🔨(docker) set file permissions to docker user

Set the app related files as owned by the docker user
the image was build with. This fixes a sync permission
error in tilt.

Also improved tilt setup so that correct uid / gid are infered
for the build args.

.dockerignore

@@ -4,7 +4,7 @@ __pycache__
 **/__pycache__
 **/*.pyc
 venv
-.venv
+**/.venv
 
 # System-specific files
 .DS_Store
@@ -24,13 +24,15 @@ data
 .cache
 .circleci
 .git
-.vscode
 .iml
-.idea
 db.sqlite3
-.mypy_cache
 .pylint.d
-.pytest_cache
+
+**/.idea
+**/.vscode
+**/.pytest_cache
+**/.mypy_cache
+**/.ruff_cache
 
 # Frontend
-node_modules
+**/node_modules

.github/workflows/meet.yml

@@ -123,16 +123,18 @@ jobs:
       - name: Install Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
-          cache: "pip"
-      - name: Install development dependencies
-        run: pip install --user .[dev]
+          python-version-file: "src/backend/pyproject.toml"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the project
+        run: uv sync --locked --all-extras
+
       - name: Check code formatting with ruff
-        run: ~/.local/bin/ruff format . --diff
+        run: uv run ruff format . --diff
       - name: Lint code with ruff
-        run: ~/.local/bin/ruff check .
+        run: uv run ruff check .
       - name: Lint code with pylint
-        run: ~/.local/bin/pylint meet demo core
+        run: uv run pylint meet demo core
 
   lint-agents:
     runs-on: ubuntu-latest
@@ -230,6 +232,7 @@ jobs:
       OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
       OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
       OIDC_OP_URL: https://oidc.example.com
+      MEDIA_BASE_URL: http://localhost:8083
 
     steps:
       - name: Checkout repository
@@ -277,11 +280,11 @@ jobs:
       - name: Install Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
-          cache: "pip"
-
-      - name: Install development dependencies
-        run: pip install --user .[dev]
+          python-version-file: "src/backend/pyproject.toml"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the dependencies
+        run: uv sync --locked --all-extras
 
       - name: Install gettext (required to compile messages)
         run: |
@@ -289,10 +292,10 @@ jobs:
           sudo apt-get install -y gettext
 
       - name: Generate a MO file from strings extracted from the project
-        run: python manage.py compilemessages
+        run: uv run python manage.py compilemessages
 
       - name: Run tests
-        run: ~/.local/bin/pytest -n 2
+        run: uv run pytest -n 2
 
   lint-front:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -8,6 +8,40 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Changed
+
+- ♿️(frontend) Caption text size setting for accessibility #1062
+- ♿️(frontend) sync html lang attribute with i18n for screen readers #1111
+- ♿️(frontend) improve MoreLink a11y and UX on home page #1112
+- ♿(frontend) improve chat toast a11y for screen readers #1109
+- ♿(frontend) improve ui and qria labels for help article links #1108
+- 🔨(python-env) migrate meet main app to UV #1120
+- 🔨(docker) set file permissions to docker user #1121
+
+## [1.10.0] - 2026-03-05
+
+### Changed
+
+- 🔒️(backend) enhance API input validation to strengthen security #1053
+- 🦺(backend) strengthen API validation for recording options #1063
+- ⚡️(frontend) optimize few performance caveats #1073
+- 🔒️(helm) introduce a dedicated Kubernetes Ingress for webhook-livekit #1066
+
+### Fixed
+
+- 🐛(migrations) use settings in migrations #1058
+- 💄(frontend) truncate pinned participant name with ellipsis on overflow #1056
+- ♿(frontend) prevent focus ring clipping on invite dialog #1078
+- ♿(frontend) dynamic tab title when connected to meeting #1060
+- 🩹(frontend) remove incorrect reference to ProConnect on the prejoin #1080
+- ✨(frontend) add Ctrl+Shift+/ to open shortcuts settings #1050
+- ♿(frontend) announce selected state to screen readers #1081
+- 💄(frontend) truncate long names with ellipsis in reaction overlay #1099
+
+### Added
+
+- ✨(backend) add file upload feature #1030
+
 ## [1.9.0] - 2026-03-02
 
 ### Added

Dockerfile

@@ -13,14 +13,28 @@ RUN apk update && \
 # ---- Back-end builder image ----
 FROM base AS back-builder
 
-WORKDIR /builder
 
-# Copy required python dependencies
-COPY ./src/backend /builder
+ENV UV_COMPILE_BYTECODE=1
+ENV UV_LINK_MODE=copy
 
-RUN mkdir /install && \
-  pip install --prefix=/install .
+# Disable Python downloads, because we want to use the system interpreter
+# across both images. If using a managed Python version, it needs to be
+# copied from the build image into the final image;
+ENV UV_PYTHON_DOWNLOADS=0
 
+# install uv
+COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
+
+WORKDIR /app
+
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+  --mount=type=bind,source=src/backend/uv.lock,target=uv.lock \
+  --mount=type=bind,source=src/backend/pyproject.toml,target=pyproject.toml \
+  uv sync --locked --no-install-project --no-dev
+COPY src/backend /app
+RUN --mount=type=cache,target=/root/.cache/uv \
+  uv sync --locked --no-dev
 
 # ---- mails ----
 FROM node:20 AS mail-builder
@@ -30,7 +44,7 @@ COPY ./src/mail /mail/app
 WORKDIR /mail/app
 
 RUN yarn install --frozen-lockfile && \
-    yarn build
+  yarn build
 
 
 # ---- static link collector ----
@@ -39,19 +53,20 @@ ARG MEET_STATIC_ROOT=/data/static
 
 RUN apk add \
   pango \
+  libmagic \
   rdfind
 
-# Copy installed python dependencies
-COPY --from=back-builder /install /usr/local
-
-# Copy Meet application (see .dockerignore)
-COPY ./src/backend /app/
-
 WORKDIR /app
 
+# Copy the application from the builder
+COPY --from=back-builder /app /app
+
+ENV PATH="/app/.venv/bin:$PATH"
+
+
 # collectstatic
 RUN DJANGO_CONFIGURATION=Build DJANGO_JWT_PRIVATE_SIGNING_KEY=Dummy \
-    python manage.py collectstatic --noinput
+  python manage.py collectstatic --noinput
 
 # Replace duplicated file by a symlink to decrease the overall size of the
 # final image
@@ -68,6 +83,7 @@ RUN apk --no-cache add \
   gettext \
   libffi-dev \
   pango \
+  libmagic \
   shared-mime-info
 
 
@@ -79,14 +95,18 @@ COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
 
-# Copy installed python dependencies
-COPY --from=back-builder /install /usr/local
-
-# Copy Meet application (see .dockerignore)
-COPY ./src/backend /app/
+# Copy the application from the builder
+ARG DOCKER_USER
+COPY --chown=${DOCKER_USER} --from=back-builder /app /app
 
 WORKDIR /app
 
+ENV PATH="/app/.venv/bin:$PATH"
+
+# Generate compiled translation messages
+RUN DJANGO_CONFIGURATION=Build \
+  python manage.py compilemessages --ignore=".venv/**/*"
+
 # We wrap commands run in this container by the following entrypoint that
 # creates a user on-the-fly with the container user ID (see USER) and root group
 # ID.
@@ -101,10 +121,9 @@ USER root:root
 # Install psql
 RUN apk add postgresql-client
 
-# Uninstall Meet and re-install it in editable mode along with development
-# dependencies
-RUN pip uninstall -y meet
-RUN pip install -e .[dev]
+# Install development dependencies
+RUN --mount=from=ghcr.io/astral-sh/uv:0.10.9,source=/uv,target=/bin/uv \
+  uv sync --all-extras --locked
 
 # Restore the un-privileged user running the application
 ARG DOCKER_USER
@@ -113,7 +132,7 @@ USER ${DOCKER_USER}
 # Target database host (e.g. database engine following docker compose services
 # name) & port
 ENV DB_HOST=postgresql \
-    DB_PORT=5432
+  DB_PORT=5432
 
 # Run django development server
 CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]

Makefile

@@ -114,7 +114,8 @@ logs: ## display app-dev logs (follow mode)
 .PHONY: logs
 
 run-backend: ## start only the backend application and all needed services
-	@$(COMPOSE) up --force-recreate -d celery-dev
+	@$(COMPOSE) up --force-recreate -d celery-dev --remove-orphans
+	@$(COMPOSE) up --force-recreate -d nginx
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
 .PHONY: run-backend

bin/Tiltfile

@@ -14,11 +14,16 @@ if DEV_ENV == 'dev-keycloak':
 def clean_old_images(image_name):
     local('docker images -q %s | tail -n +2 | xargs -r docker rmi' % image_name)
 
+
+uid = str(local('id -u', quiet=True)).strip()
+gid = str(local('id -g', quiet=True)).strip()
+DOCKER_USER = uid + ":" + gid
+
 docker_build(
     'localhost:5001/meet-backend:latest',
     context='..',
     dockerfile='../Dockerfile',
-    build_args={'DOCKER_USER': '1001:127'},
+    build_args={'DOCKER_USER': DOCKER_USER},
     only=['./src/backend', './src/mail', './docker'],
     target = 'backend-production',
     live_update=[
@@ -34,7 +39,7 @@ clean_old_images('localhost:5001/meet-backend')
 docker_build(
     'localhost:5001/meet-frontend-dinum:latest',
     context='..',
-    build_args={'DOCKER_USER': '1001:127'},
+    build_args={'DOCKER_USER': DOCKER_USER},
     dockerfile='../docker/dinum-frontend/Dockerfile',
     only=['./src/frontend', './docker', './.dockerignore'],
     target = 'frontend-production',
@@ -59,7 +64,7 @@ clean_old_images('localhost:5001/meet-frontend-generic')
 docker_build(
     'localhost:5001/meet-summary:latest',
     context='../src/summary',
-    build_args={'DOCKER_USER': '1001:127'},
+    build_args={'DOCKER_USER': DOCKER_USER},
     dockerfile='../src/summary/Dockerfile',
     only=['.'],
     target = 'production',
@@ -72,7 +77,7 @@ clean_old_images('localhost:5001/meet-summary')
 docker_build(
     'localhost:5001/meet-agents:latest',
     context='../src/agents',
-    build_args={'DOCKER_USER': '1001:127'},
+    build_args={'DOCKER_USER': DOCKER_USER},
     dockerfile='../src/agents/Dockerfile',
     only=['.'],
     target = 'production',

compose.yml

@@ -80,11 +80,11 @@ services:
     volumes:
       - ./src/backend:/app
       - ./data/static:/data/static
+      - /app/.venv
     depends_on:
         - postgresql
         - mailcatcher
         - redis
-        - nginx
         - livekit
         - createbuckets
         - createwebhook
@@ -106,6 +106,7 @@ services:
     volumes:
       - ./src/backend:/app
       - ./data/static:/data/static
+      - /app/.venv
     depends_on:
       - app-dev
 
@@ -148,6 +149,7 @@ services:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
     depends_on:
       - keycloak
+      - app-dev
     networks:
       - resource-server
       - default

docker/files/etc/nginx/conf.d/default.conf

@@ -4,10 +4,47 @@ server {
     server_name localhost;
     charset utf-8;
 
+    # Proxy auth for media
+    location /media/ {
+        # Auth request configuration
+        auth_request /media-auth;
+        auth_request_set $authHeader $upstream_http_authorization;
+        auth_request_set $authDate $upstream_http_x_amz_date;
+        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+        # Pass specific headers from the auth response
+        proxy_set_header Authorization $authHeader;
+        proxy_set_header X-Amz-Date $authDate;
+        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+        # Get resource from Minio
+        proxy_pass http://minio:9000/meet-media-storage/;
+        proxy_set_header Host minio:9000;
+        # To use with ds_proxy
+        # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
+        # proxy_set_header Host ds-proxy:4444;
+        add_header Content-Disposition "attachment";
+    }
+
+    location /media-auth {
+        proxy_pass http://app-dev:8000/api/v1.0/files/media-auth/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Original-URL $request_uri;
+        
+        # Prevent the body from being passed
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-Method $request_method;
+    }
+
     location / {
         proxy_pass http://keycloak:8080;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port $server_port;
     }
 }

docs/installation/kubernetes.md

@@ -122,11 +122,11 @@ If you haven't run the script **bin/start-kind.sh**, you'll need to manually cre
 $ kubectl create namespace meet
 ```
 
-If you have already run the script, you can skip this step and proceed to the next instruction. NOTE: Before you proceed, and is using the kind method, make sure you download this repo examples/ directory and its contents to the location where you will be executing the helm command. Helm will look for "examples/<name>values.yaml" from based on the path it is being executed.
+If you have already run the script, you can skip this step and proceed to the next instruction. NOTE: Before you proceed, and is using the kind method, make sure you download this repo examples/helm directory and its contents to the location where you will be executing the helm command. Helm will look for "examples/helm/<name>values.yaml" from based on the path it is being executed.
 
 ```
 $ kubectl config set-context --current --namespace=meet
-$ helm install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak -f examples/keycloak.values.yaml
+$ helm install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak -f examples/helm/keycloak.values.yaml
 $ #wait until
 $ kubectl get po
 NAME                    READY   STATUS    RESTARTS   AGE
@@ -150,7 +150,7 @@ OIDC_RP_SIGN_ALGO: RS256
 OIDC_RP_SCOPES: "openid email"
 ```
 
-You can find these values in **examples/keycloak.values.yaml**
+You can find these values in **examples/helm/keycloak.values.yaml**
 
 ### Find livekit server connexion values
 
@@ -159,7 +159,7 @@ LaSuite Meet use livekit for streaming part so if you have a livekit provider, o
 Livekit need a redis (and meet too) so we will start by deploying a redis :
 
 ```
-$ helm install redis oci://registry-1.docker.io/bitnamicharts/redis -f examples/redis.values.yaml
+$ helm install redis oci://registry-1.docker.io/bitnamicharts/redis -f examples/helm/redis.values.yaml
 $ kubectl get po
 NAME                    READY   STATUS    RESTARTS   AGE
 keycloak-0              1/1     Running   0          26m
@@ -172,7 +172,7 @@ When the redis is ready we can deploy livekit-server.
 ```
 $ helm repo add livekit https://helm.livekit.io
 $ helm repo update
-$ helm install livekit livekit/livekit-server -f examples/livekit.values.yaml
+$ helm install livekit livekit/livekit-server -f examples/helm/livekit.values.yaml
 $ kubectl get po
 NAME                                      READY   STATUS    RESTARTS   AGE
 keycloak-0                                1/1     Running   0          30m
@@ -199,7 +199,7 @@ CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
 LaSuite Meet uses a postgresql db as backend so if you have a provider, obtain the necessary information to use it. If you do not have, you can install a postgresql testing environment as follows:
 
 ```
-$ helm install postgresql oci://registry-1.docker.io/bitnamicharts/postgresql -f examples/postgresql.values.yaml
+$ helm install postgresql oci://registry-1.docker.io/bitnamicharts/postgresql -f examples/helm/postgresql.values.yaml
 $ kubectl get po
 NAME                                      READY   STATUS    RESTARTS   AGE
 keycloak-0                                1/1     Running   0          45m
@@ -226,7 +226,7 @@ Now you are ready to deploy LaSuite Meet without AI. AI required more dependenci
 ```
 $ helm repo add meet https://suitenumerique.github.io/meet/
 $ helm repo update
-$ helm install meet meet/meet -f examples/meet.values.yaml
+$ helm install meet meet/meet -f examples/helm/meet.values.yaml
 ```
 
 ## Test your deployment

env.d/development/common.dist

@@ -23,9 +23,11 @@ MEET_BASE_URL="http://localhost:8072"
 
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
+AWS_S3_DOMAIN_REPLACE=http://localhost:9000
 AWS_S3_ENDPOINT_URL=http://minio:9000
 AWS_S3_ACCESS_KEY_ID=meet
 AWS_S3_SECRET_ACCESS_KEY=password
+MEDIA_BASE_URL=http://localhost:8083
 
 # OIDC
 OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/certs

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.9.0"
+version = "1.10.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.3.10",

src/backend/core/api/filters.py

@@ -0,0 +1,67 @@
+"""API filters for meet' core application."""
+
+from django.utils.translation import gettext_lazy as _
+
+import django_filters
+from django_filters import BooleanFilter
+
+from core import models
+
+
+class FileFilter(django_filters.FilterSet):
+    """
+    Custom filter for filtering files.
+    """
+
+    class Meta:
+        model = models.File
+        fields = ["type"]
+
+
+class ListFileFilter(FileFilter):
+    """Filter class dedicated to the file viewset list method."""
+
+    is_creator_me = django_filters.BooleanFilter(
+        method="filter_is_creator_me", label=_("Creator is me")
+    )
+
+    is_deleted = BooleanFilter(field_name="deleted_at", method="filter_is_deleted")
+
+    class Meta:
+        model = models.File
+        fields = ["is_creator_me", "type", "upload_state", "is_deleted"]
+
+    def filter_is_deleted(self, queryset, name, value):
+        """
+        Filter files based on whether they are deleted or not.
+
+        Example:
+            - /api/v1.0/files/?is_deleted=false
+                → Filters files that were not deleted
+        """
+        if value is None:
+            return queryset
+
+        lookup = "__".join([name, "isnull"])
+        return queryset.filter(**{lookup: not value})
+
+    # pylint: disable=unused-argument
+    def filter_is_creator_me(self, queryset, name, value):
+        """
+        Filter files based on the `creator` being the current user.
+
+        Example:
+            - /api/v1.0/files/?is_creator_me=true
+                → Filters files created by the logged-in user
+            - /api/v1.0/files/?is_creator_me=false
+                → Filters files created by other users
+        """
+        user = self.request.user
+
+        if not user.is_authenticated:
+            return queryset
+
+        if value:
+            return queryset.filter(creator=user)
+
+        return queryset.exclude(creator=user)

src/backend/core/api/permissions.py

@@ -1,5 +1,7 @@
 """Permission handlers for the Meet core app."""
 
+from django.http import Http404
+
 from rest_framework import permissions
 
 from ..models import RoleChoices
@@ -106,3 +108,23 @@ class HasLiveKitRoomAccess(permissions.BasePermission):
         if not request.auth or not hasattr(request.auth, "video"):
             return False
         return request.auth.video.room == str(obj.id)
+
+
+class FilePermission(IsAuthenticated):
+    """
+    Permissions applying to the file API endpoint.
+    Handling soft deletions specificities
+    """
+
+    def has_object_permission(self, request, view, obj):
+        """
+        Return a 404 on deleted files or if the user is not the owner
+        """
+
+        if obj.deleted_at is not None or obj.hard_deleted_at is not None:
+            raise Http404
+
+        if obj.creator != request.user:
+            raise Http404
+
+        return obj.get_abilities(request.user).get(view.action, False)

src/backend/core/api/serializers.py

@@ -1,16 +1,27 @@
 """Client serializers for the Meet core app."""
 
 # pylint: disable=abstract-method,no-name-in-module
+import logging
+from os.path import splitext
+from typing import Literal
+from urllib.parse import quote
 
+from django.conf import settings
+from django.core.exceptions import SuspiciousOperation
+
+# pylint: disable=abstract-method,no-name-in-module
 from django.utils.translation import gettext_lazy as _
 
-from livekit.api import ParticipantPermission
+from django_pydantic_field.rest_framework import SchemaField
+from pydantic import BaseModel, Field
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
 from timezone_field.rest_framework import TimeZoneSerializerField
 
 from core import models, utils
 
+logger = logging.getLogger(__name__)
+
 
 class UserSerializer(serializers.ModelSerializer):
     """Serialize users."""
@@ -23,6 +34,15 @@ class UserSerializer(serializers.ModelSerializer):
         read_only_fields = ["id", "email", "full_name", "short_name"]
 
 
+class UserLightSerializer(serializers.ModelSerializer):
+    """Serialize users with limited fields."""
+
+    class Meta:
+        model = models.User
+        fields = ["id", "full_name", "short_name"]
+        read_only_fields = ["id", "full_name", "short_name"]
+
+
 class ResourceAccessSerializerMixin:
     """
     A serializer mixin to share controlling that the logged-in user submitting a room access object
@@ -201,6 +221,27 @@ class BaseValidationOnlySerializer(serializers.Serializer):
         raise NotImplementedError(f"{self.__class__.__name__} is validation-only")
 
 
+class RecordingOptions(BaseModel):
+    """Configuration options for recording.
+
+    Attributes:
+        language: ISO 639-1 language code compatible with whisperX.
+            When `None`, the transcription engine will attempt to
+            auto-detect the spoken language.
+        transcribe: Whether to transcribe the recorded audio.
+            When `None`, falls back to the application default.
+        original_mode: The original recording mode before any override.
+            Must be one of the valid RecordingModeChoices values when provided.
+
+    """
+
+    language: str | None = None
+    transcribe: bool | None = None
+    original_mode: Literal["screen_recording", "transcript"] | None = None
+
+    model_config = {"extra": "forbid"}
+
+
 class StartRecordingSerializer(BaseValidationOnlySerializer):
     """Validate start recording requests."""
 
@@ -213,10 +254,11 @@ class StartRecordingSerializer(BaseValidationOnlySerializer):
             "screen_recording or transcript.",
         },
     )
-    options = serializers.JSONField(
+    options = SchemaField(
+        schema=RecordingOptions | None,
         required=False,
         allow_null=True,
-        default=dict,
+        help_text="Recording options",
     )
 
 
@@ -261,6 +303,28 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
+class ParticipantPermission(BaseModel):
+    """Mirror the LiveKit ParticipantPermission protobuf.
+
+    Control what a participant is allowed to publish, subscribe, and do within a room.
+    Unknown fields are rejected.
+    """
+
+    can_subscribe: bool | None = None
+    can_publish: bool | None = None
+    can_publish_data: bool | None = None
+    can_publish_sources: list[int] = Field(
+        default_factory=list
+    )  # TrackSource enum values
+    hidden: bool | None = None
+    recorder: bool | None = None
+    can_update_metadata: bool | None = None
+    agent: bool | None = None
+    can_subscribe_metrics: bool | None = None
+
+    model_config = {"extra": "forbid"}
+
+
 class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
     """Validate participant update data."""
 
@@ -272,10 +336,11 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
         allow_null=True,
         help_text="Participant attributes as JSON object",
     )
-    permission = serializers.DictField(
+    permission = SchemaField(
+        schema=ParticipantPermission | None,
         required=False,
         allow_null=True,
-        help_text="Participant permission as JSON object",
+        help_text="Participant permissions",
     )
     name = serializers.CharField(
         max_length=255,
@@ -285,6 +350,33 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
         help_text="Display name for the participant",
     )
 
+    def validate_permission(self, permission):
+        """Validate that the given permission does not include forbidden or unimplemented fields."""
+
+        if permission is None:
+            return None
+
+        suspicious_fields = [
+            field
+            for field in settings.PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS
+            if getattr(permission, field) is not None
+        ]
+        if suspicious_fields:
+            raise SuspiciousOperation(
+                f"Setting the following participant permissions is not allowed: "
+                f"{', '.join(suspicious_fields)}."
+            )
+        if permission.can_subscribe_metrics is not None:
+            raise serializers.ValidationError(
+                {
+                    "permission": {
+                        "can_subscribe_metrics": "This permission is not implemented."
+                    }
+                }
+            )
+
+        return permission
+
     def validate(self, attrs):
         """Ensure at least one update field is provided."""
         update_fields = ["metadata", "attributes", "permission", "name"]
@@ -300,12 +392,144 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
                 f"{', '.join(update_fields)}."
             )
 
-        if "permission" in attrs:
-            try:
-                ParticipantPermission(**attrs["permission"])
-            except ValueError as e:
+        return attrs
+
+
+class ListFileSerializer(serializers.ModelSerializer):
+    """Serialize File model for the API."""
+
+    url = serializers.SerializerMethodField(read_only=True)
+    creator = UserLightSerializer(read_only=True)
+    abilities = serializers.SerializerMethodField(read_only=True)
+
+    class Meta:
+        model = models.File
+        fields = [
+            "id",
+            "created_at",
+            "updated_at",
+            "title",
+            "type",
+            "creator",
+            "deleted_at",
+            "hard_deleted_at",
+            "filename",
+            "upload_state",
+            "mimetype",
+            "size",
+            "description",
+            "url",
+            "abilities",
+        ]
+        read_only_fields = [
+            "id",
+            "created_at",
+            "updated_at",
+            "creator",
+            "deleted_at",
+            "hard_deleted_at",
+            "filename",
+            "upload_state",
+            "mimetype",
+            "size",
+            "url",
+            "abilities",
+        ]
+
+    def get_url(self, obj):
+        """Return the URL of the file."""
+        if obj.is_pending_upload:
+            return None
+
+        return f"{settings.MEDIA_BASE_URL}{settings.MEDIA_URL}{quote(obj.file_key)}"
+
+    def get_abilities(self, file) -> dict:
+        """Return abilities of the logged-in user on the instance."""
+        request = self.context.get("request")
+        if not request:
+            return {}
+
+        return file.get_abilities(request.user)
+
+
+class FileSerializer(ListFileSerializer):
+    """Default serializer File model for the API."""
+
+    def create(self, validated_data):
+        raise NotImplementedError("Create method can not be used.")
+
+
+class CreateFileSerializer(ListFileSerializer):
+    """Serializer used to create a new file"""
+
+    title = serializers.CharField(max_length=255, required=False)
+    policy = serializers.SerializerMethodField()
+
+    class Meta:
+        model = models.File
+        fields = [*ListFileSerializer.Meta.fields, "policy"]
+        read_only_fields = [
+            *(
+                field
+                for field in ListFileSerializer.Meta.read_only_fields
+                if field != "filename"
+            ),
+            "policy",
+        ]
+
+    def get_fields(self):
+        """Force the id field to be writable."""
+        fields = super().get_fields()
+        fields["id"].read_only = False
+
+        return fields
+
+    def validate_id(self, value):
+        """Ensure the provided ID does not already exist when creating a new file."""
+        request = self.context.get("request")
+
+        # Only check this on POST (creation)
+        if request and models.File.objects.filter(id=value).exists():
+            raise serializers.ValidationError(
+                "A file with this ID already exists. You cannot override it.",
+                code="file_create_existing_id",
+            )
+
+        return value
+
+    def validate(self, attrs):
+        """Validate extension and fill title."""
+        # we run the default validation first to make sure the base data in attrs is ok
+        attrs = super().validate(attrs)
+
+        filename_root, ext = splitext(attrs["filename"])
+
+        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
+            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[attrs["type"]]
+            if ext.lower() not in config_for_file_type["allowed_extensions"]:
+                logger.info(
+                    "create_item: file extension not allowed %s for filename %s",
+                    ext,
+                    attrs["filename"],
+                )
                 raise serializers.ValidationError(
-                    {"permission": f"Invalid permission: {str(e)}"}
-                ) from e
+                    {"filename": _("This file extension is not allowed.")},
+                    code="item_create_file_extension_not_allowed",
+                )
+
+        # The title will be the filename if not provided
+        if not attrs.get("title", None):
+            attrs["title"] = filename_root
 
         return attrs
+
+    def get_policy(self, file):
+        """Return the policy to use if the item is a file."""
+
+        if file.upload_state == models.FileUploadStateChoices.READY:
+            return None
+
+        return utils.generate_upload_policy(file)
+
+    def update(self, instance, validated_data):
+        raise NotImplementedError("Update method can not be used.")

src/backend/core/api/viewsets.py

@@ -1,16 +1,26 @@
 """API endpoints"""
+# pylint: disable=too-many-lines
 
+import re
 import uuid
 from logging import getLogger
-from urllib.parse import urlparse
+from urllib.parse import unquote, urlparse
 
 from django.conf import settings
+from django.core.files.storage import default_storage
 from django.db.models import Q
 from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.text import slugify
 
-from rest_framework import decorators, mixins, pagination, viewsets
+from django_filters import rest_framework as django_filters
+from rest_framework import (
+    decorators,
+    filters,
+    mixins,
+    pagination,
+    viewsets,
+)
 from rest_framework import (
     exceptions as drf_exceptions,
 )
@@ -22,6 +32,7 @@ from rest_framework import (
 )
 
 from core import enums, models, utils
+from core.api.filters import ListFileFilter
 from core.recording.enums import FileExtension
 from core.recording.event.authentication import StorageEventAuthentication
 from core.recording.event.exceptions import (
@@ -56,6 +67,7 @@ from core.services.participants_management import (
 )
 from core.services.room_creation import RoomCreation
 from core.services.subtitle import SubtitleException, SubtitleService
+from core.tasks.file import process_file_deletion
 
 from ..authentication.livekit import LiveKitTokenAuthentication
 from . import permissions, serializers, throttling
@@ -66,6 +78,17 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)
 
 
+FILE_FOLDER = settings.FILE_UPLOAD_PATH
+UUID_REGEX = (
+    r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
+)
+FILE_EXT_REGEX = r"[\d\w]+"
+MEDIA_STORAGE_URL_PATTERN = re.compile(
+    f"{settings.MEDIA_URL:s}"
+    rf"(?P<key>{FILE_FOLDER:s}/(?P<pk>{UUID_REGEX:s})/\.{FILE_EXT_REGEX:s})$"
+)
+
+
 class NestedGenericViewSet(viewsets.GenericViewSet):
     """
     A generic Viewset aims to be used in a nested route context.
@@ -77,20 +100,20 @@ class NestedGenericViewSet(viewsets.GenericViewSet):
     lookup_fields: list[str] = ["pk"]
     lookup_url_kwargs: list[str] = []
 
-    def __getattribute__(self, item):
+    def __getattribute__(self, file):
         """
         This method is overridden to allow to get the last lookup field or lookup url kwarg
         when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
         to keep compatibility with all methods used by the parent class `GenericViewSet`.
         """
-        if item in ["lookup_field", "lookup_url_kwarg"]:
-            return getattr(self, item + "s", [None])[-1]
+        if file in ["lookup_field", "lookup_url_kwarg"]:
+            return getattr(self, file + "s", [None])[-1]
 
-        return super().__getattribute__(item)
+        return super().__getattribute__(file)
 
     def get_queryset(self):
         """
-        Get the list of items for this view.
+        Get the list of files for this view.
 
         `lookup_fields` attribute is enumerated here to perform the nested lookup.
         """
@@ -296,12 +319,14 @@ class RoomViewSet(
             )
 
         mode = serializer.validated_data["mode"]
-        options = serializer.validated_data["options"]
+        options = serializer.validated_data.get("options")
         room = self.get_object()
 
         # May raise exception if an active or initiated recording already exist for the room
         recording = models.Recording.objects.create(
-            room=room, mode=mode, options=options
+            room=room,
+            mode=mode,
+            options=options.model_dump(exclude_none=True) if options else {},
         )
 
         models.RecordingAccess.objects.create(
@@ -607,13 +632,15 @@ class RoomViewSet(
         serializer = serializers.UpdateParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
+        permission = serializer.validated_data.get("permission")
+
         try:
             ParticipantsManagement().update(
                 room_name=str(room.pk),
                 identity=str(serializer.validated_data["participant_identity"]),
                 metadata=serializer.validated_data.get("metadata"),
                 attributes=serializer.validated_data.get("attributes"),
-                permission=serializer.validated_data.get("permission"),
+                permission=permission.model_dump() if permission else None,
                 name=serializer.validated_data.get("name"),
             )
         except ParticipantsManagementException:
@@ -789,7 +816,7 @@ class RecordingViewSet(
         # Extract the original URL from the request header
         original_url = request.META.get("HTTP_X_ORIGINAL_URL")
         if not original_url:
-            logger.debug("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
             raise drf_exceptions.PermissionDenied()
 
         logger.debug("Original url: '%s'", original_url)
@@ -806,7 +833,7 @@ class RecordingViewSet(
         try:
             return match.groupdict()
         except (ValueError, AttributeError) as exc:
-            logger.debug("Failed to extract parameters from subrequest URL: %s", exc)
+            logger.warning("Failed to extract parameters from subrequest URL: %s", exc)
             raise drf_exceptions.PermissionDenied() from exc
 
     @decorators.action(detail=False, methods=["get"], url_path="media-auth")
@@ -830,7 +857,7 @@ class RecordingViewSet(
         recording_id = url_params["recording_id"]
 
         extension = url_params["extension"]
-        if extension not in [item.value for item in FileExtension]:
+        if extension not in [file.value for file in FileExtension]:
             raise drf_exceptions.ValidationError({"detail": "Unsupported extension."})
 
         try:
@@ -854,3 +881,302 @@ class RecordingViewSet(
         request = utils.generate_s3_authorization_headers(recording.key)
 
         return drf_response.Response("authorized", headers=request.headers, status=200)
+
+
+# pylint: disable=too-many-public-methods
+class FileViewSet(
+    SerializerPerActionMixin,
+    mixins.CreateModelMixin,
+    mixins.DestroyModelMixin,
+    mixins.UpdateModelMixin,
+    mixins.ListModelMixin,
+    viewsets.GenericViewSet,
+):
+    """
+    FileViewSet API.
+
+    This viewset provides CRUD operations and additional actions for managing files.
+
+    ### API Endpoints:
+    1. **List**: Retrieve a paginated list of files.
+       Example: GET /files/?page=2
+    2. **Retrieve**: Get a specific file by its ID.
+       Example: GET /files/{id}/
+    3. **Create**: Create a new file.
+       Example: POST /files/
+    4. **Update**: Update a file by its ID.
+       Example: PUT /files/{id}/
+    5. **Delete**: Soft delete a file by its ID.
+       Example: DELETE /files/{id}/
+
+
+    ### Ordering: created_at, updated_at, title
+
+        Example:
+        - Ascending: GET /api/v1.0/files/?ordering=created_at
+
+    ### Filtering:
+        - `is_creator_me=true`: Returns files created by the current user.
+        - `is_creator_me=false`: Returns files created by other users.
+        - `is_deleted=false`: Returns files that are not (soft) deleted
+
+        Example:
+        - GET /api/v1.0/files/?is_creator_me=true
+        - GET /api/v1.0/files/?is_creator_me=false&is_deleted=false
+
+    ### Notes:
+    - Implements soft delete logic to retain file
+    """
+
+    ordering = ["-updated_at"]
+    ordering_fields = ["created_at", "updated_at", "title"]
+    pagination_class = Pagination
+    permission_classes = [
+        permissions.FilePermission,
+    ]
+    queryset = models.File.objects.filter(hard_deleted_at__isnull=True)
+    default_serializer_class = serializers.FileSerializer
+    serializer_classes = {
+        "list": serializers.ListFileSerializer,
+        "create": serializers.CreateFileSerializer,
+    }
+    filter_backends = (django_filters.DjangoFilterBackend, filters.OrderingFilter)
+    filterset_class = ListFileFilter
+
+    def get_queryset(self):
+        """Get queryset that defaults to the the current request user."""
+        user = self.request.user
+        queryset = super().get_queryset().select_related("creator")
+
+        if not user.is_authenticated:
+            return queryset.none()
+
+        # For now, we force the filtering on the current user in all cases, might evolve later
+        queryset = queryset.filter(creator=user)
+        return queryset
+
+    def get_response_for_queryset(self, queryset, context=None):
+        """Return paginated response for the queryset if requested."""
+        context = context or self.get_serializer_context()
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True, context=context)
+            result = self.get_paginated_response(serializer.data)
+            return result
+
+        serializer = self.get_serializer(queryset, many=True, context=context)
+        return drf_response.Response(serializer.data)
+
+    def perform_create(self, serializer):
+        """Set the current user as creator of the newly created file."""
+        serializer.save(creator=self.request.user)
+
+    def perform_destroy(self, instance):
+        """Override to implement a soft delete instead of dumping the record in database."""
+        instance.soft_delete()
+
+    @decorators.action(detail=True, methods=["post"], url_path="upload-ended")
+    def upload_ended(self, request, *args, **kwargs):
+        """
+        Check the actual uploaded file and mark it as ready.
+        """
+
+        file = self.get_object()
+
+        if not file.is_pending_upload:
+            raise drf_exceptions.ValidationError(
+                {"file": "This action is only available for files in PENDING state."},
+                code="file_upload_state_not_pending",
+            )
+
+        s3_client = default_storage.connection.meta.client
+
+        head_response = s3_client.head_object(
+            Bucket=default_storage.bucket_name, Key=file.file_key
+        )
+        file_size = head_response["ContentLength"]
+
+        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
+            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
+            if file_size > config_for_file_type["max_size"]:
+                self._complete_file_deletion(file)
+                logger.info(
+                    "upload_ended: file size (%s) for file %s higher than the allowed max size",
+                    file_size,
+                    file.file_key,
+                )
+                raise drf_exceptions.ValidationError(
+                    detail="The file size is higher than the allowed max size.",
+                    code="file_size_exceeded",
+                )
+
+        # python-magic recommends using at least the first 2048 bytes
+        # to reduce incorrect identification.
+        # This is a tradeoff between pulling in the whole file and the most likely relevant bytes
+        # of the file for mime type identification.
+        if file_size > 2048:
+            range_response = s3_client.get_object(
+                Bucket=default_storage.bucket_name,
+                Key=file.file_key,
+                Range="bytes=0-2047",
+            )
+            file_head = range_response["Body"].read()
+        else:
+            file_head = s3_client.get_object(
+                Bucket=default_storage.bucket_name, Key=file.file_key
+            )["Body"].read()
+
+        # Use improved MIME type detection combining magic bytes and file extension
+        logger.info("upload_ended: detecting mimetype for file: %s", file.file_key)
+        mimetype = utils.detect_mimetype(file_head, filename=file.filename)
+
+        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
+            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
+            allowed_file_mimetypes = config_for_file_type["allowed_mimetypes"]
+            if mimetype not in allowed_file_mimetypes:
+                self._complete_file_deletion(file)
+                logger.warning(
+                    "upload_ended: mimetype not allowed %s for file %s",
+                    mimetype,
+                    file.file_key,
+                )
+                raise drf_exceptions.ValidationError(
+                    detail="The file type is not allowed.",
+                    code="file_type_not_allowed",
+                )
+
+        file.upload_state = models.FileUploadStateChoices.READY
+        file.mimetype = mimetype
+        file.size = file_size
+
+        file.save(update_fields=["upload_state", "mimetype", "size"])
+
+        if head_response["ContentType"] != mimetype:
+            logger.info(
+                "upload_ended: content type mismatch between object storage and file,"
+                " updating from %s to %s",
+                head_response["ContentType"],
+                mimetype,
+            )
+            s3_client.copy_object(
+                Bucket=default_storage.bucket_name,
+                Key=file.file_key,
+                CopySource={
+                    "Bucket": default_storage.bucket_name,
+                    "Key": file.file_key,
+                },
+                ContentType=mimetype,
+                Metadata=head_response["Metadata"],
+                MetadataDirective="REPLACE",
+            )
+
+        # Not yet implemented
+        # Change the file.upload_state when this will be done
+        # malware_detection.analyse_file(file.file_key, file_id=file.id)
+
+        serializer = self.get_serializer(file)
+
+        return drf_response.Response(serializer.data, status=drf_status.HTTP_200_OK)
+
+    def _complete_file_deletion(self, file):
+        """Delete a file completely."""
+        file.soft_delete()
+        file.hard_delete()
+        process_file_deletion.delay(file.id)
+
+    def _authorize_subrequest(self, request, pattern):
+        """
+        Authorize access based on the original URL of an Nginx subrequest
+        and user permissions. Returns a dictionary of URL parameters if authorized.
+
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
+        See corresponding ingress configuration in Helm chart and read about the
+        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
+        is configured to do this.
+
+        Based on the original url and the logged in user, we must decide if we authorize Nginx
+        to let this request go through (by returning a 200 code) or if we block it (by returning
+        a 403 error). Note that we return 403 errors without any further details for security
+        reasons.
+
+        Parameters:
+        - pattern: The regex pattern to extract identifiers from the URL.
+
+        Returns:
+        - A dictionary of URL parameters if the request is authorized.
+        Raises:
+        - PermissionDenied if authorization fails.
+        """
+        # Extract the original URL from the request header
+        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
+        if not original_url:
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            raise drf_exceptions.PermissionDenied()
+
+        parsed_url = urlparse(original_url)
+        match = pattern.search(unquote(parsed_url.path))
+
+        if not match:
+            logger.warning(
+                "Subrequest URL '%s' did not match pattern '%s'",
+                parsed_url.path,
+                pattern,
+            )
+            raise drf_exceptions.PermissionDenied()
+
+        try:
+            url_params = match.groupdict()
+        except (ValueError, AttributeError) as exc:
+            logger.warning("Failed to extract parameters from subrequest URL: %s", exc)
+            raise drf_exceptions.PermissionDenied() from exc
+
+        pk = url_params.get("pk")
+        if not pk:
+            logger.warning("File ID (pk) not found in URL parameters: %s", url_params)
+            raise drf_exceptions.PermissionDenied()
+
+        # Fetch the file and check if the user has access
+        queryset = models.File.objects.all()
+        # No suspicious analysis implemented yet
+        # queryset = self._filter_suspicious_files(queryset, request.user)
+        try:
+            file = queryset.get(pk=pk)
+        except models.File.DoesNotExist as exc:
+            logger.warning("File with ID '%s' does not exist", pk)
+            raise drf_exceptions.PermissionDenied() from exc
+
+        user_abilities = file.get_abilities(request.user)
+        if not user_abilities.get(self.action, False):
+            logger.warning(
+                "User '%s' lacks permission for file '%s'", request.user.id, pk
+            )
+            raise drf_exceptions.PermissionDenied()
+
+        logger.debug(
+            "Subrequest authorization successful. Extracted parameters: %s", url_params
+        )
+        return url_params, request.user.id, file
+
+    @decorators.action(detail=False, methods=["get"], url_path="media-auth")
+    def media_auth(self, request, *args, **kwargs):
+        """
+        This view is used by an Nginx subrequest to control access to an file's
+        attachment file.
+
+        When we let the request go through, we compute authorization headers that will be added to
+        the request going through thanks to the nginx.ingress.kubernetes.io/auth-response-headers
+        annotation. The request will then be proxied to the object storage backend who will
+        respond with the file after checking the signature included in headers.
+        """
+        url_params, _, file = self._authorize_subrequest(
+            request, MEDIA_STORAGE_URL_PATTERN
+        )
+
+        if file.is_pending_upload:
+            logger.warning("File '%s' is not ready", file.id)
+            raise drf_exceptions.PermissionDenied()
+
+        # Generate S3 authorization headers using the extracted URL parameters
+        request = utils.generate_s3_authorization_headers(f"{url_params.get('key'):s}")
+
+        return drf_response.Response("authorized", headers=request.headers, status=200)

src/backend/core/factories.py

@@ -2,8 +2,11 @@
 Core application factories
 """
 
+from io import BytesIO
+
 from django.conf import settings
 from django.contrib.auth.hashers import make_password
+from django.core.files.storage import default_storage
 from django.utils.text import slugify
 
 import factory.fuzzy
@@ -153,3 +156,42 @@ class ApplicationDomainFactory(factory.django.DjangoModelFactory):
 
     domain = factory.Faker("domain_name")
     application = factory.SubFactory(ApplicationFactory)
+
+
+class FileFactory(factory.django.DjangoModelFactory):
+    """A factory to create files"""
+
+    class Meta:
+        model = models.File
+        skip_postgeneration_save = True
+
+    title = factory.Sequence(lambda n: f"file{n}")
+    creator = factory.SubFactory(UserFactory)
+    deleted_at = None
+    type = factory.fuzzy.FuzzyChoice([t[0] for t in models.FileTypeChoices.choices])
+    filename = factory.lazy_attribute(lambda o: fake.file_name())
+    upload_state = None
+    size = None
+
+    @factory.post_generation
+    def update_upload_state(self, create, extracted, **kwargs):
+        """Change the upload state of a file."""
+        if create and extracted:
+            self.upload_state = extracted
+            self.save()
+
+    @factory.post_generation
+    def upload_bytes(self, create, extracted, **kwargs):
+        """Save content of the file into the storage"""
+        if create and extracted is not None:
+            content = (
+                extracted
+                if isinstance(extracted, bytes)
+                else str(extracted).encode("utf-8")
+            )
+
+            self.filename = kwargs.get("filename", self.filename or "content.txt")
+            self.size = len(content)
+            self.save()
+
+            default_storage.save(self.file_key, BytesIO(content))

src/backend/core/migrations/0001_initial.py

@@ -44,7 +44,7 @@ class Migration(migrations.Migration):
                 ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
                 ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                 ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
-                ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
+                ('language', models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
                 ('timezone', timezone_field.fields.TimeZoneField(choices_display='WITH_GMT_OFFSET', default='UTC', help_text='The timezone in which the user wants to see times.', use_pytz=False)),
                 ('is_device', models.BooleanField(default=False, help_text='Whether the user is a device or a real user.', verbose_name='device')),
                 ('is_staff', models.BooleanField(default=False, help_text='Whether the user can log into this admin site.', verbose_name='staff status')),
@@ -96,7 +96,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='resource',
             name='users',
-            field=models.ManyToManyField(related_name='resources', through='core.ResourceAccess', to=settings.AUTH_USER_MODEL),
+            field=models.ManyToManyField(related_name='resources', through='core.ResourceAccess', through_fields=('resource', 'user'), to=settings.AUTH_USER_MODEL),
         ),
         migrations.AddConstraint(
             model_name='resourceaccess',

src/backend/core/migrations/0004_alter_user_language.py

@@ -1,5 +1,5 @@
 # Generated by Django 5.0.7 on 2024-08-07 14:39
-
+from django.conf import settings
 from django.db import migrations, models
 
 
@@ -13,6 +13,6 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='user',
             name='language',
-            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+            field=models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
         ),
     ]

src/backend/core/migrations/0013_alter_user_language.py

@@ -1,5 +1,5 @@
 # Generated by Django 5.1.8 on 2025-04-22 14:52
-
+from django.conf import settings
 from django.db import migrations, models
 
 
@@ -13,6 +13,6 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='user',
             name='language',
-            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'), ('nl-nl', 'Dutch'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+            field=models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
         ),
     ]

src/backend/core/migrations/0017_file.py

@@ -0,0 +1,42 @@
+# Generated by Django 5.2.11 on 2026-03-03 15:22
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0016_recording_options'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='File',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
+                ('type', models.CharField(choices=[('background_image', 'Background image')], max_length=25)),
+                ('title', models.CharField(max_length=255, verbose_name='title')),
+                ('deleted_at', models.DateTimeField(blank=True, null=True)),
+                ('hard_deleted_at', models.DateTimeField(blank=True, null=True)),
+                ('filename', models.CharField(max_length=255)),
+                ('upload_state', models.CharField(choices=[('pending', 'Pending'), ('ready', 'Ready')], max_length=25)),
+                ('mimetype', models.CharField(blank=True, max_length=255, null=True)),
+                ('size', models.BigIntegerField(blank=True, null=True)),
+                ('description', models.TextField(blank=True, null=True)),
+                ('malware_detection_info', models.JSONField(blank=True, default=dict, help_text='Malware detection info when the analysis status is unsafe.', null=True)),
+                ('creator', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.RESTRICT, related_name='files_created', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'verbose_name': 'File',
+                'verbose_name_plural': 'Files',
+                'db_table': 'file',
+                'ordering': ('created_at',),
+                'indexes': [models.Index(fields=['creator', 'type', '-created_at'], name='file_creator_730cce_idx')],
+            },
+        ),
+    ]

src/backend/core/models.py

@@ -1,11 +1,14 @@
 """
 Declare and configure the models for the Meet core application
+# pylint: disable=too-many-lines
 """
+# pylint: disable=too-many-lines
 
 import secrets
 import uuid
 from datetime import datetime, timedelta
 from logging import getLogger
+from os.path import splitext
 from typing import List, Optional
 
 from django.conf import settings
@@ -14,7 +17,7 @@ from django.contrib.auth.base_user import AbstractBaseUser
 from django.contrib.postgres.fields import ArrayField
 from django.core import mail, validators
 from django.core.exceptions import PermissionDenied, ValidationError
-from django.db import models
+from django.db import models, transaction
 from django.utils import timezone
 from django.utils.text import capfirst, slugify
 from django.utils.translation import gettext_lazy as _
@@ -829,3 +832,186 @@ class ApplicationDomain(BaseModel):
 
         self.domain = self.domain.lower().strip()
         super().save(*args, **kwargs)
+
+
+class FileUploadStateChoices(models.TextChoices):
+    """Possible states of a file."""
+
+    PENDING = "pending", _("Pending")
+    # Commented out for now, as we may need this when we implement the malware detection logic.
+    # ANALYZING = "analyzing", _("Analyzing")
+    # SUSPICIOUS = "suspicious", _("Suspicious")
+    # FILE_TOO_LARGE_TO_ANALYZE = (
+    #     "file_too_large_to_analyze",
+    #     _("File too large to analyze"),
+    # )
+    READY = "ready", _("Ready")
+
+
+class FileTypeChoices(models.TextChoices):
+    """Defines the possible types of a file."""
+
+    BACKGROUND_IMAGE = "background_image", _("Background image")
+
+
+class File(BaseModel):
+    """File uploaded by a user."""
+
+    type = models.CharField(
+        max_length=25,
+        choices=FileTypeChoices.choices,
+        null=False,
+        blank=False,
+    )
+    title = models.CharField(_("title"), max_length=255)
+    creator = models.ForeignKey(
+        User,
+        on_delete=models.RESTRICT,
+        related_name="files_created",
+        blank=True,
+        null=True,
+    )
+    deleted_at = models.DateTimeField(null=True, blank=True)
+    hard_deleted_at = models.DateTimeField(null=True, blank=True)
+
+    filename = models.CharField(max_length=255, null=False, blank=False)
+
+    upload_state = models.CharField(
+        max_length=25,
+        choices=FileUploadStateChoices.choices,
+    )
+    mimetype = models.CharField(max_length=255, null=True, blank=True)
+    size = models.BigIntegerField(null=True, blank=True)
+    description = models.TextField(null=True, blank=True)
+    malware_detection_info = models.JSONField(
+        null=True,
+        blank=True,
+        default=dict,
+        help_text=_("Malware detection info when the analysis status is unsafe."),
+    )
+
+    class Meta:
+        db_table = "file"
+        verbose_name = _("File")
+        verbose_name_plural = _("Files")
+        ordering = ("created_at",)
+        indexes = [
+            models.Index(fields=["creator", "type", "-created_at"]),
+        ]
+
+    def __str__(self):
+        return str(self.title)
+
+    def save(self, *args, **kwargs):
+        """Set the upload state to pending if it's the first save and it's a file."""
+
+        if self.created_at is None:
+            self.upload_state = FileUploadStateChoices.PENDING
+
+        return super().save(*args, **kwargs)
+
+    def delete(self, using=None, keep_parents=False):
+        if self.deleted_at is None:
+            raise RuntimeError("The file must be soft deleted before being deleted.")
+
+        return super().delete(using, keep_parents)
+
+    @property
+    def is_pending_upload(self):
+        """Return whether the file is in a pending upload state"""
+        return self.upload_state == FileUploadStateChoices.PENDING
+
+    @property
+    def extension(self):
+        """Return the extension related to the filename."""
+        if self.filename is None:
+            raise RuntimeError(
+                "The file must have a filename to compute its extension."
+            )
+
+        _, extension = splitext(self.filename)
+
+        if extension:
+            return extension.lstrip(".")
+
+        return None
+
+    @property
+    def key_base(self):
+        """Key base of the location where the file is stored in object storage."""
+        if not self.pk:
+            raise RuntimeError(
+                "The file instance must be saved before requesting a storage key."
+            )
+
+        return f"{settings.FILE_UPLOAD_PATH}/{self.pk!s}"
+
+    @property
+    def file_key(self):
+        """Key used to store the file in object storage."""
+        _, extension = splitext(self.filename)
+        # We store only the extension in the storage system to avoid
+        # leaking Personal Information in logs, etc.
+        return f"{self.key_base}/{extension!s}"
+
+    def get_abilities(self, user):
+        """
+        Compute and return abilities for a given user on the file.
+        """
+        # Characteristics that are based only on specific access
+        is_creator = user == self.creator
+        retrieve = is_creator
+        is_deleted = self.deleted_at is not None
+        can_update = is_creator and not is_deleted and user.is_authenticated
+        can_hard_delete = is_creator and user.is_authenticated
+        can_destroy = can_hard_delete and not is_deleted
+
+        return {
+            "destroy": can_destroy,
+            "hard_delete": can_hard_delete,
+            "retrieve": retrieve,
+            "media_auth": retrieve and not is_deleted,
+            "partial_update": can_update,
+            "update": can_update,
+            "upload_ended": can_update and user.is_authenticated,
+        }
+
+    @transaction.atomic
+    def soft_delete(self):
+        """
+        Soft delete the file.
+        We still keep the .delete() method untouched for programmatic purposes.
+        """
+        if self.deleted_at:
+            raise RuntimeError("This file is already deleted.")
+
+        self.deleted_at = timezone.now()
+        self.save(update_fields=["deleted_at"])
+
+    def hard_delete(self):
+        """
+        Hard delete the file.
+        We still keep the .delete() method untouched for programmatic purposes.
+        """
+        if self.hard_deleted_at:
+            raise ValidationError(
+                {
+                    "hard_deleted_at": ValidationError(
+                        _("This file is already hard deleted."),
+                        code="file_hard_delete_already_effective",
+                    )
+                }
+            )
+
+        if self.deleted_at is None:
+            raise ValidationError(
+                {
+                    "hard_deleted_at": ValidationError(
+                        _("To hard delete a file, it must first be soft deleted."),
+                        code="file_hard_delete_should_soft_delete_first",
+                    )
+                }
+            )
+
+        self.hard_deleted_at = timezone.now()
+        self.save(update_fields=["hard_deleted_at"])

src/backend/core/tasks/_task.py

@@ -0,0 +1,49 @@
+# ruff: noqa: PLC0415
+
+from django.conf import settings
+
+
+def task(*d_args, **d_kwargs):
+    """
+    Decorator compatible with Celery's @app.task, but works without Celery.
+
+    If Celery is available, returns a real Celery task.
+    If not, returns the original function and provides `.delay()`/`.apply_async()`
+    as synchronous fallbacks (so existing call sites don't break).
+
+    Notes:
+        Mostly LLM-generated.
+    """
+
+    def _fallback_wrap(func):
+        def delay(*args, **kwargs):
+            return func(*args, **kwargs)
+
+        def apply_async(args=None, kwargs=None, **_options):
+            return func(*(args or ()), **(kwargs or {}))
+
+        func.delay = delay
+        func.apply_async = apply_async
+        return func
+
+    # Handle bare decorator usage: @task
+    if len(d_args) == 1 and callable(d_args[0]) and not d_kwargs:
+        func = d_args[0]
+        if settings.CELERY_ENABLED:
+            from meet.celery_app import app as _celery_app
+
+            return _celery_app.task(func)
+        return _fallback_wrap(func)
+
+    # Handle parameterized usage: @task(...), e.g. @task(bind=True)
+    def _decorate(func):
+        if settings.CELERY_ENABLED:
+            from meet.celery_app import app as _celery_app
+
+            return _celery_app.task(*d_args, **d_kwargs)(func)
+        return _fallback_wrap(func)
+
+    return _decorate
+
+
+__all__ = ("task",)

src/backend/core/tasks/file.py

@@ -0,0 +1,36 @@
+"""
+Tasks related to files.
+"""
+
+import logging
+
+from django.core.files.storage import default_storage
+
+from core.models import File
+from core.tasks._task import task
+
+logger = logging.getLogger(__name__)
+
+
+@task
+def process_file_deletion(file_id):
+    """
+    Process the deletion of a file.
+    Definitely delete it in the database.
+    Delete the files from the storage.
+    """
+    logger.info("Processing item deletion for %s", file_id)
+    try:
+        file = File.objects.get(id=file_id)
+    except File.DoesNotExist:
+        logger.error("Item %s does not exist", file_id)
+        return
+
+    if file.hard_deleted_at is None:
+        logger.error("To process an item deletion, it must be hard deleted first.")
+        return
+
+    logger.info("Deleting file %s", file.file_key)
+    default_storage.delete(file.file_key)
+
+    file.delete()

src/backend/core/tests/files/test_api_files_create.py

@@ -0,0 +1,323 @@
+"""
+Tests for files API endpoint in meet's core app: create
+"""
+
+from concurrent.futures import ThreadPoolExecutor
+from urllib.parse import parse_qs, urlparse
+from uuid import uuid4
+
+from django.utils import timezone
+
+import pytest
+from freezegun import freeze_time
+from rest_framework import status
+from rest_framework.test import APIClient
+
+from core import factories
+from core.models import File, FileTypeChoices, FileUploadStateChoices
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_files_create_anonymous():
+    """Anonymous users should not be allowed to create items."""
+    response = APIClient().post(
+        "/api/v1.0/files/",
+        {
+            "title": "My file",
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+        },
+    )
+
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+    assert not File.objects.exists()
+
+
+def test_api_files_create_authenticated_success():
+    """
+    Authenticated users should be able to create files and should automatically be declared
+    as the owner of the newly created file.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "title": "my file",
+            "filename": "my_file.png",
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201, response.json()
+    file = File.objects.get()
+    assert file.title == "my file"
+    assert file.creator == user
+    assert file.type == FileTypeChoices.BACKGROUND_IMAGE
+    assert file.upload_state == FileUploadStateChoices.PENDING
+
+
+def test_api_files_create_file_authenticated_no_filename():
+    """
+    Creating a file item without providing a filename should fail.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "title": "my item",
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+        },
+        format="json",
+    )
+    assert response.status_code == 400
+    assert response.json() == {"filename": ["This field is required."]}
+
+
+def test_api_files_create_file_authenticated_success():
+    """
+    Authenticated users should be able to create a file file and must provide a filename.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    now = timezone.now()
+    with freeze_time(now):
+        response = client.post(
+            "/api/v1.0/files/",
+            {
+                "type": FileTypeChoices.BACKGROUND_IMAGE,
+                "title": "Eiffle tower",
+                "filename": "file.png",
+            },
+            format="json",
+        )
+    assert response.status_code == 201
+    file = File.objects.get()
+    assert file.title == "Eiffle tower"
+    assert file.type == FileTypeChoices.BACKGROUND_IMAGE
+    assert file.filename == "file.png"
+
+    response_data = response.json()
+    assert response_data["creator"] is not None, response_data
+
+    assert response.json().get("policy") is not None
+
+    policy = response.json()["policy"]
+    policy_parsed = urlparse(policy)
+
+    assert policy_parsed.scheme == "http"
+    assert policy_parsed.netloc == "localhost:9000"
+    assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}/.png"
+
+    query_params = parse_qs(policy_parsed.query)
+
+    assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
+    assert query_params.pop("X-Amz-Credential") == [
+        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
+    ]
+    assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
+    assert query_params.pop("X-Amz-Expires") == ["60"]
+    assert query_params.pop("X-Amz-SignedHeaders") == ["host;x-amz-acl"]
+    assert query_params.pop("X-Amz-Signature") is not None
+
+    assert len(query_params) == 0
+
+
+def test_api_files_create_file_authenticated_extension_not_allowed():
+    """
+    Creating a file item with an extension not allowed should fail.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "title": "Paris tower",
+            "filename": "file.notallowed",
+        },
+        format="json",
+    )
+    assert response.status_code == 400
+    assert response.json() == {"filename": ["This file extension is not allowed."]}
+
+
+def test_api_files_create_file_authenticated_extension_case_insensitive():
+    """
+    Creating a file item with an extension, no matter the case used, should be allowed.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "file.JPG",
+        },
+        format="json",
+    )
+    assert response.status_code == 201, response.json()
+    file = File.objects.get()
+    assert file.title == "file"
+
+
+def test_api_files_create_file_authenticated_not_checking_extension(settings):
+    """
+    Creating a file with an extension not allowed should not fail when restrictions are disabled.
+    """
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = False
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "file.notallowed",
+        },
+        format="json",
+    )
+    assert response.status_code == 201, response.json()
+    file = File.objects.get()
+    assert file.title == "file"
+
+
+def test_api_files_create_file_authenticated_no_extension_but_checking_it_should_fail(
+    settings,
+):
+    """
+    Creating a file without an extension but checking the extension should fail.
+    """
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "file",
+        },
+        format="json",
+    )
+    assert response.status_code == 400
+    assert response.json() == {"filename": ["This file extension is not allowed."]}
+
+
+def test_api_files_create_file_authenticated_hidden_file_but_checking_extension_should_fail(
+    settings,
+):
+    """
+    Creating a hidden file (starting with a dot) but checking the extension should fail.
+    """
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": ".file",
+        },
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"filename": ["This file extension is not allowed."]}
+
+
+def test_api_files_create_force_id_success():
+    """It should be possible to force the item ID when creating a   item."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    forced_id = uuid4()
+
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "id": str(forced_id),
+            "title": "my item",
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "my_file.png",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201, response.json()
+    files = File.objects.all()
+    assert len(files) == 1
+    assert files[0].id == forced_id
+
+
+def test_api_files_create_force_id_existing():
+    """
+    It should not be possible to use the ID of an existing file when forcing ID on creation.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory()
+
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "id": str(file.id),
+            "title": "my file",
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "my_file.png",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "id": ["A file with this ID already exists. You cannot override it."]
+    }
+
+
+@pytest.mark.django_db(transaction=True)
+def test_api_files_create_file_race_condition():
+    """
+    It should be possible to create several files at the same time
+    without causing any race conditions or data integrity issues.
+    """
+
+    def create_item(title):
+        user = factories.UserFactory()
+        client = APIClient()
+        client.force_login(user)
+        return client.post(
+            "/api/v1.0/files/",
+            {
+                "title": title,
+                "type": FileTypeChoices.BACKGROUND_IMAGE,
+                "filename": "my_file.png",
+            },
+            format="json",
+        )
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        future1 = executor.submit(create_item, "my item 1")
+        future2 = executor.submit(create_item, "my item 2")
+
+        response1 = future1.result()
+        response2 = future2.result()
+
+        assert response1.status_code == 201
+        assert response2.status_code == 201

src/backend/core/tests/files/test_api_files_delete.py

@@ -0,0 +1,45 @@
+"""
+Tests for files API endpoint in meet's core app: delete
+"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_files_delete_anonymous():
+    """Anonymous users should not be allowed to destroy a file."""
+    file = factories.FileFactory()
+    existing_items = models.File.objects.all().count()
+
+    response = APIClient().delete(
+        f"/api/v1.0/files/{file.id!s}/",
+    )
+
+    assert response.status_code == 401
+    assert models.File.objects.count() == existing_items
+
+
+def test_api_files_delete_authenticated_owner():
+    """
+    Authenticated users should be able to delete a item they own.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(creator=user)
+
+    response = client.delete(
+        f"/api/v1.0/files/{file.id}/",
+    )
+
+    assert response.status_code == 204
+
+    # Make sure it is only a soft delete
+    file.refresh_from_db()
+    assert file.deleted_at is not None

src/backend/core/tests/files/test_api_files_list.py

@@ -0,0 +1,160 @@
+"""
+Tests for files API endpoint in meet's core app: list
+"""
+
+from unittest import mock
+
+from django.utils import timezone
+
+import pytest
+from faker import Faker
+from rest_framework.pagination import PageNumberPagination
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+fake = Faker()
+pytestmark = pytest.mark.django_db
+
+
+def test_api_files_list_anonymous_not_allowed():
+    """
+    Anonymous users should not be allowed to list files whatever the
+    """
+    response = APIClient().get("/api/v1.0/files/")
+    assert response.status_code == 401
+
+
+def test_api_files_list_authentificated_user_allowed():
+    """
+    Authentificated users should be allowed to list files
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/files/")
+    assert response.status_code == 200
+    assert response.data == {"count": 0, "next": None, "previous": None, "results": []}
+
+
+def test_api_files_list_format():
+    """Validate the format of files as returned by the list view."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        title="item 1",
+        creator=user,
+    )
+
+    # A file from another user should not appear
+    factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        title="item 2",
+    )
+
+    # hard deleted item should not appear
+    factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        hard_deleted_at=timezone.now(),
+        title="hard deleted item",
+        creator=user,
+    )
+
+    response = client.get("/api/v1.0/files/")
+
+    assert response.status_code == 200
+    content = response.json()
+    results = content.pop("results")
+    assert content == {
+        "count": 1,
+        "next": None,
+        "previous": None,
+    }
+    assert len(results) == 1
+    assert results == [
+        {
+            "id": str(file.id),
+            "created_at": file.created_at.isoformat().replace("+00:00", "Z"),
+            "creator": {
+                "id": str(file.creator.id),
+                "full_name": file.creator.full_name,
+                "short_name": file.creator.short_name,
+            },
+            "title": file.title,
+            "updated_at": file.updated_at.isoformat().replace("+00:00", "Z"),
+            "type": models.FileTypeChoices.BACKGROUND_IMAGE,
+            "upload_state": file.upload_state,
+            "url": None,
+            "mimetype": file.mimetype,
+            "filename": file.filename,
+            "size": None,
+            "description": None,
+            "deleted_at": None,
+            "hard_deleted_at": None,
+            "abilities": {
+                "destroy": True,
+                "hard_delete": True,
+                "media_auth": True,
+                "partial_update": True,
+                "retrieve": True,
+                "update": True,
+                "upload_ended": True,
+            },
+        }
+    ]
+
+
+@mock.patch.object(PageNumberPagination, "get_page_size", return_value=2)
+def test_api_files_list_pagination(
+    _mock_page_size,
+):
+    """Pagination should work as expected."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    file_ids = [
+        str(file.id)
+        for file in factories.FileFactory.create_batch(
+            3,
+            creator=user,
+            type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        )
+    ]
+    # Get page 1
+    response = client.get(
+        "/api/v1.0/files/",
+    )
+
+    assert response.status_code == 200
+    content = response.json()
+
+    assert content["count"] == 3
+    assert content["next"] == "http://testserver/api/v1.0/files/?page=2"
+    assert content["previous"] is None
+
+    assert len(content["results"]) == 2
+    for item in content["results"]:
+        file_ids.remove(item["id"])
+
+    # Get page 2
+    response = client.get(
+        "/api/v1.0/files/?page=2",
+    )
+
+    assert response.status_code == 200
+    content = response.json()
+
+    assert content["count"] == 3
+    assert content["next"] is None
+    assert content["previous"] == "http://testserver/api/v1.0/files/"
+
+    assert len(content["results"]) == 1
+    for item in content["results"]:
+        file_ids.remove(item["id"])
+    assert file_ids == []

src/backend/core/tests/files/test_api_files_list_filters.py

@@ -0,0 +1,216 @@
+"""
+Tests for files API endpoint in meet's core app: list
+"""
+
+import pytest
+from faker import Faker
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+fake = Faker()
+pytestmark = pytest.mark.django_db
+
+
+# Filters: unknown field
+
+
+def test_api_files_list_filter_unknown_field():
+    """
+    Trying to filter by an unknown field should do nothing.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.FileFactory(type=models.FileTypeChoices.BACKGROUND_IMAGE)
+    expected_ids = {
+        str(file.id)
+        for file in factories.FileFactory.create_batch(
+            2, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
+        )
+    }
+
+    response = client.get("/api/v1.0/files/?unknown=true")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
+    assert {result["id"] for result in results} == expected_ids
+
+
+# Filters: is_creator_me
+
+
+def test_api_files_list_filter_is_creator_me_true():
+    """
+    Authenticated users should be able to filter files they created.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.FileFactory.create_batch(
+        2, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
+    )
+    factories.FileFactory.create_batch(2, type=models.FileTypeChoices.BACKGROUND_IMAGE)
+
+    response = client.get("/api/v1.0/files/?is_creator_me=true")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
+
+    # Ensure all results are created by the current user
+    for result in results:
+        assert result["creator"] == {
+            "id": str(user.id),
+            "full_name": user.full_name,
+            "short_name": user.short_name,
+        }
+
+
+def test_api_files_list_filter_is_creator_me_invalid():
+    """Filtering with an invalid `is_creator_me` value should do nothing."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.FileFactory.create_batch(
+        3, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
+    )
+
+    response = client.get("/api/v1.0/files/?is_creator_me=invalid")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 3
+
+
+# Filters: type
+
+
+def test_api_files_list_filter_type_and_upload_status():
+    """
+    Authenticated users should be able to filter files by their type and upload status.
+
+    This test will make more sense when other types are added to the API
+    """
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        creator=user,
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.PENDING,
+    )
+    assert file.upload_state == models.FileUploadStateChoices.PENDING
+
+    expected_files = factories.FileFactory.create_batch(
+        2,
+        creator=user,
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+    )
+    expected_files_ids = {str(file.id) for file in expected_files}
+
+    # Filter by type: background_image & upload state
+    response = client.get("/api/v1.0/files/?type=background_image&upload_state=ready")
+
+    assert response.status_code == 200
+    assert response.json()["count"] == 2
+
+    results = response.json()["results"]
+
+    # Ensure all results are background images
+    results_ids = {result["id"] for result in results}
+    assert results_ids == expected_files_ids
+    for result in results:
+        assert result["type"] == models.FileTypeChoices.BACKGROUND_IMAGE
+        assert result["upload_state"] == models.FileUploadStateChoices.READY
+
+    # Second request without the upload_state filter, to check that all 3 show up
+    response = client.get("/api/v1.0/files/?type=background_image")
+
+    assert response.status_code == 200
+    assert response.json()["count"] == 3
+
+    results = response.json()["results"]
+
+    # Ensure all results are background images
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(file.id) for file in expected_files + [file]}
+    for result in results:
+        assert result["type"] == models.FileTypeChoices.BACKGROUND_IMAGE
+
+
+def test_api_files_list_filter_is_deleted():
+    """
+    Authenticated users should be able to filter files by their deletion status.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    not_deleted_file = factories.FileFactory(creator=user)
+
+    deleted_files = factories.FileFactory.create_batch(2, creator=user)
+    for file in deleted_files:
+        file.soft_delete()
+
+    # No filters
+    response_no_filters = client.get("/api/v1.0/files/")
+
+    assert response_no_filters.status_code == 200
+    assert response_no_filters.json()["count"] == 3
+
+    results = response_no_filters.json()["results"]
+
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(file.id) for file in [*deleted_files, not_deleted_file]}
+
+    # Filters deleted
+    response_filter_deleted = client.get("/api/v1.0/files/?is_deleted=true")
+
+    assert response_filter_deleted.status_code == 200
+    assert response_filter_deleted.json()["count"] == 2
+
+    results = response_filter_deleted.json()["results"]
+
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(file.id) for file in deleted_files}
+
+    # Filters not deleted
+    response_filter_not_deleted = client.get("/api/v1.0/files/?is_deleted=false")
+
+    assert response_filter_not_deleted.status_code == 200
+    assert response_filter_not_deleted.json()["count"] == 1
+
+    results = response_filter_not_deleted.json()["results"]
+
+    # Ensure all results are deleted
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(file.id) for file in [not_deleted_file]}
+
+
+def test_api_files_list_filter_unknown_type():
+    """
+    Filtering by an unknown type should return an empty list
+    """
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    factories.FileFactory.create_batch(3, creator=user)
+
+    response = client.get("/api/v1.0/files/?type=unknown")
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "type": ["Select a valid choice. unknown is not one of the available choices."]
+    }

src/backend/core/tests/files/test_api_files_list_ordering.py

@@ -0,0 +1,71 @@
+"""Test the ordering of items."""
+
+import operator
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_files_list_ordering_default():
+    """items should be ordered by descending "updated_at" by default"""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.FileFactory.create_batch(
+        4, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
+    )
+    response = client.get("/api/v1.0/files/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 4
+
+    # Check that results are sorted by descending "updated_at" as expected
+    for i in range(3):
+        assert operator.ge(results[i]["updated_at"], results[i + 1]["updated_at"])
+
+
+def test_api_files_list_ordering_by_fields():
+    """It should be possible to order by several fields"""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.FileFactory.create_batch(
+        4, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
+    )
+
+    for parameter in [
+        "created_at",
+        "-created_at",
+        "updated_at",
+        "-updated_at",
+    ]:
+        is_descending = parameter.startswith("-")
+        field = parameter.lstrip("-")
+        querystring = f"?ordering={parameter}"
+
+        response = client.get(f"/api/v1.0/files/{querystring:s}")
+        assert response.status_code == 200
+        results = response.json()["results"]
+        assert len(results) == 4
+
+        # Check that results are sorted by the field in querystring as expected
+        compare = operator.ge if is_descending else operator.le
+        for i in range(3):
+            operator1 = (
+                results[i][field].lower()
+                if isinstance(results[i][field], str)
+                else results[i][field]
+            )
+            operator2 = (
+                results[i + 1][field].lower()
+                if isinstance(results[i + 1][field], str)
+                else results[i + 1][field]
+            )
+            assert compare(operator1, operator2)

src/backend/core/tests/files/test_api_files_media_auth.py

@@ -0,0 +1,141 @@
+"""
+Test file uploads API endpoint for users in meet's core app.
+"""
+
+from io import BytesIO
+from urllib.parse import quote, urlparse
+
+from django.conf import settings
+from django.core.files.storage import default_storage
+from django.utils import timezone
+
+import pytest
+import requests
+from freezegun import freeze_time
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_files_media_auth_anonymous_not_authorized():
+    """Anonymous users should not be allowed to retrieve a file"""
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+    )
+
+    original_url = f"http://localhost/media/{file.file_key:s}"
+    response = APIClient().get(
+        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 401
+
+
+def test_api_files_media_get_own():
+    """
+    Authenticated user should be allowed to retrieve their own file.
+    """
+    user = factories.UserFactory()
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+        creator=user,
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    default_storage.save(
+        file.file_key,
+        BytesIO(b"my prose"),
+    )
+
+    original_url = f"http://localhost/media/{file.file_key:s}"
+    now = timezone.now()
+    with freeze_time(now):
+        response = client.get(
+            "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+        )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/meet-media-storage/{file.file_key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"
+
+
+def test_api_files_media_auth_file_pending():
+    """
+    Users who have a specific access to an file, whatever the role, should not be able to
+    retrieve related attachments if the file is not ready.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        upload_state=models.FileUploadStateChoices.PENDING,
+        creator=user,
+    )
+
+    key = file.file_key
+
+    original_url = quote(f"http://localhost/media/{key:s}")
+    response = client.get(
+        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403
+
+
+def test_api_files_media_auth_own_file_deleted():
+    """
+    This function tests the access restrictions on deleted files through the media
+    authorization API endpoint. It ensures that a user cannot retrieve a file that is deleted.
+    """
+    user = factories.UserFactory()
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+        creator=user,
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    default_storage.save(
+        file.file_key,
+        BytesIO(b"my prose"),
+    )
+    file.soft_delete()
+
+    original_url = f"http://localhost/media/{file.file_key:s}"
+    response = client.get(
+        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403

src/backend/core/tests/files/test_api_files_update.py

@@ -0,0 +1,67 @@
+"""
+Tests for files API endpoint in meet's core app: update
+"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+from core.api import serializers
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_files_update_anonymous_forbidden():
+    """
+    Anonymous users should not be allowed to update an file when link
+    configuration does not allow it.
+    """
+
+    file = factories.FileFactory()
+
+    old_file_values = serializers.FileSerializer(instance=file).data
+    new_file_values = serializers.FileSerializer(instance=factories.FileFactory()).data
+
+    response = APIClient().put(
+        f"/api/v1.0/files/{file.id!s}/",
+        new_file_values,
+        format="json",
+    )
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    file.refresh_from_db()
+    item_values = serializers.FileSerializer(instance=file).data
+    assert item_values == old_file_values
+
+
+def test_api_files_update_description_and_title():
+    """
+    Test the description and title of an file can be updated.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        description="Old description",
+        title="Old title",
+        creator=user,
+    )
+
+    response = client.patch(
+        f"/api/v1.0/files/{file.id!s}/",
+        {"description": "New description", "title": "New title"},
+        format="json",
+    )
+    assert response.status_code == 200
+    result = response.json()
+    assert result["description"] == "New description"
+    assert result["title"] == "New title"
+
+    file.refresh_from_db()
+    assert file.description == "New description"
+    assert file.title == "New title"

src/backend/core/tests/files/test_api_files_upload_ended.py

@@ -0,0 +1,272 @@
+"""Test related to item upload ended API."""
+
+import logging
+from io import BytesIO
+
+from django.core.files.storage import default_storage
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.models import FileTypeChoices, FileUploadStateChoices
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_file_upload_ended_anonymous():
+    """Anonymous users should not be allowed to end an upload."""
+    file = factories.FileFactory()
+    response = APIClient().post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    assert response.status_code == 401
+
+
+def test_api_file_upload_ended_non_creator_not_found():
+    """Users without write permissions should not be allowed to end an upload."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory()
+
+    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    assert response.status_code == 404
+
+
+def test_api_file_upload_ended_on_wrong_upload_state():
+    """
+    Users should not be allowed to end an upload on files that are not in the PENDING upload state.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE,
+        creator=user,
+        update_upload_state=FileUploadStateChoices.READY,
+    )
+
+    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "file": "This action is only available for files in PENDING state."
+    }
+
+
+def test_api_file_upload_ended_success(settings):
+    """
+    Users should be able to end an upload on files that are files and in the UPLOADING upload state.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "allowed_mimetypes": ["text/html", "text/plain"],
+        },
+    }
+
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE,
+        filename="my_file.txt",
+        mimetype="text/html",
+        creator=user,
+    )
+
+    default_storage.save(
+        file.file_key,
+        BytesIO(b"my prose"),
+    )
+
+    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    assert response.status_code == 200
+
+    file.refresh_from_db()
+    assert file.upload_state == FileUploadStateChoices.READY
+    assert file.mimetype == "text/plain"
+    assert file.size == 8
+
+    assert response.json()["mimetype"] == "text/plain"
+
+
+def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
+    """
+    Test that the API returns a 400 when the mimetype is not allowed.
+    File should be deleted and the file should be deleted from the storage.
+    """
+    settings.RESTRICT_UPLOAD_FILE_TYPE = True
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "allowed_mimetypes": ["application/pdf"],
+        }
+    }
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE, filename="my_file.txt", creator=user
+    )
+
+    default_storage.save(
+        file.file_key,
+        BytesIO(b"my prose"),
+    )
+
+    with caplog.at_level(logging.WARNING):
+        response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    assert response.status_code == 400
+    assert (
+        f"upload_ended: mimetype not allowed text/plain for file {file.file_key}"
+        in caplog.text
+    )
+
+    assert not models.File.objects.filter(id=file.id).exists()
+    assert not default_storage.exists(file.file_key)
+
+
+def test_api_file_upload_ended_mimetype_not_allowed_not_checking_mimetype(settings):
+    """
+    Test that the API returns a 200 when the mimetype is not allowed but not checking the mimetype.
+    """
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = False
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "allowed_mimetypes": ["application/pdf"],
+        }
+    }
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE, filename="my_file.txt", creator=user
+    )
+
+    default_storage.save(
+        file.file_key,
+        BytesIO(b"my prose"),
+    )
+
+    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    assert response.status_code == 200
+
+    file.refresh_from_db()
+    assert file.upload_state == FileUploadStateChoices.READY
+    assert file.mimetype == "text/plain"
+    assert file.size == 8
+
+    assert response.json()["mimetype"] == "text/plain"
+
+
+def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog):
+    """
+    Object on storage should have the same mimetype than the one saved in the
+    File object.
+    """
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "allowed_mimetypes": ["text/html", "application/pdf"],
+        }
+    }
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE,
+        filename="my_file.pdf",
+        title="my_file.pdf",
+        creator=user,
+    )
+
+    s3_client = default_storage.connection.meta.client
+
+    s3_client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=file.file_key,
+        ContentType="text/html",
+        Body=BytesIO(
+            b'<meta http-equiv="refresh" content="0; url=https://fichiers.numerique.gouv.fr">'
+        ),
+        Metadata={
+            "foo": "bar",
+        },
+    )
+
+    head_object = s3_client.head_object(
+        Bucket=default_storage.bucket_name, Key=file.file_key
+    )
+
+    assert head_object["ContentType"] == "text/html"
+    with caplog.at_level(logging.INFO, logger="core.api.viewsets"):
+        response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+    assert (
+        "upload_ended: content type mismatch between object storage and file,"
+        " updating from text/html to application/pdf" in caplog.text
+    )
+    assert response.status_code == 200
+
+    file.refresh_from_db()
+
+    assert file.mimetype == "application/pdf"
+
+    head_object = s3_client.head_object(
+        Bucket=default_storage.bucket_name, Key=file.file_key
+    )
+    assert head_object["ContentType"] == "application/pdf"
+    assert head_object["Metadata"] == {"foo": "bar"}
+
+
+def test_api_upload_ended_file_size_exceeded(settings, caplog):
+    """
+    Test when the file size exceed the allowed max upload file size
+    should return a 400 and delete the file.
+    """
+
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "max_size": 0,
+        }
+    }
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE, filename="my_file.txt", creator=user
+    )
+
+    default_storage.save(
+        file.file_key,
+        BytesIO(b"my prose"),
+    )
+
+    with caplog.at_level(logging.INFO, logger="core.api.viewsets"):
+        response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+    assert (
+        f"upload_ended: file size (8) for file {file.file_key} higher than the allowed max size"
+        in caplog.text
+    )
+    assert response.status_code == 400
+
+    assert not models.File.objects.filter(id=file.id).exists()
+    assert not default_storage.exists(file.file_key)

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -8,6 +8,7 @@ import random
 from unittest import mock
 from uuid import uuid4
 
+from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
 import pytest
@@ -132,11 +133,7 @@ def test_update_participant_success(mock_livekit_client):
                 1,
                 2,
             ],  # [TrackSource.CAMERA, TrackSource.MICROPHONE]
-            "hidden": False,
-            "recorder": False,
             "can_update_metadata": True,
-            "agent": False,
-            "can_subscribe_metrics": False,
         },
         "name": "John Doe",
     }
@@ -151,6 +148,151 @@ def test_update_participant_success(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
+@pytest.mark.parametrize(
+    "permission_payload",
+    [
+        {},  # empty dict is valid
+        {"can_subscribe": True},
+        {"can_publish": True},
+        {"can_publish_data": True},
+        {"can_publish_sources": [1, 2]},
+        {"can_update_metadata": True},
+    ],
+)
+def test_update_participant_permission_fields_are_optional(
+    mock_livekit_client, permission_payload
+):
+    """Test that each required permission field can be passed individually."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": permission_payload,
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+    mock_livekit_client.aclose.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    "value,permission_key",
+    [
+        (False, "hidden"),
+        (True, "hidden"),
+        (False, "recorder"),
+        (True, "recorder"),
+        (False, "agent"),
+        (True, "agent"),
+    ],
+)
+@mock.patch("core.api.serializers.SuspiciousOperation", side_effect=SuspiciousOperation)
+def test_update_participant_suspicious_permission(
+    mock_suspicious, value, permission_key
+):
+    """Test update participant raises 400 when a restricted permission is set."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_subscribe": True,
+            "can_publish": True,
+            "can_publish_data": True,
+            "can_update_metadata": False,
+            permission_key: value,
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    mock_suspicious.assert_called_once_with(
+        f"Setting the following participant permissions is not allowed: {permission_key}."
+    )
+
+
+@mock.patch("core.api.serializers.SuspiciousOperation", side_effect=SuspiciousOperation)
+def test_update_participant_suspicious_permission_multiple(mock_suspicious):
+    """Test update participant raises 400 when multiple suspicious permissions are set."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_subscribe": True,
+            "can_publish": True,
+            "can_publish_data": True,
+            "hidden": True,
+            "recorder": False,
+            "can_update_metadata": False,
+            "agent": True,
+            "can_subscribe_metrics": False,
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    mock_suspicious.assert_called_once_with(
+        "Setting the following participant permissions is not allowed: hidden, recorder, agent."
+    )
+
+
+@pytest.mark.parametrize("value", (False, True))
+def test_update_participant_unimplemented_can_subscribe_metrics(value):
+    """Test update participant raises 400 when can_subscribe_metrics is set."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_subscribe": True,
+            "can_publish": True,
+            "can_publish_data": True,
+            "can_update_metadata": False,
+            "can_subscribe_metrics": value,
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "can_subscribe_metrics" in str(response.data)
+
+
 def test_update_participant_forbidden_without_access():
     """Test update participant returns 403 when user lacks room privileges."""
     client = APIClient()
@@ -226,7 +368,17 @@ def test_update_participant_invalid_permission():
     response = client.post(url, payload, format="json")
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert "Invalid permission" in str(response.data)
+    assert response.json() == {
+        "permission": [
+            {
+                "type": "extra_forbidden",
+                "loc": ["invalid-attributes"],
+                "msg": "Extra inputs are not permitted",
+                "input": "True",
+                "url": "https://errors.pydantic.dev/2.12/v/extra_forbidden",
+            },
+        ]
+    }
 
 
 def test_update_participant_wrong_metadata_attributes():

src/backend/core/tests/rooms/test_api_rooms_start_recording.py

@@ -199,3 +199,308 @@ def test_start_recording_success(
     access = recording.accesses.first()
     assert access.user == user
     assert access.role == "owner"
+
+
+@pytest.mark.parametrize("value", ["fr", "en", "nl", "de"])
+def test_start_recording_options_language_valid(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept a valid ISO 639-1 language code."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"language": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"language": value}
+
+
+@pytest.mark.parametrize("value", ["invalid-value", "francais", "123"])
+def test_start_recording_options_language_not_validated(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Invalid language codes are currently accepted — no format validation yet.
+
+    TODO: tighten this once language validation is introduced.
+    """
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"language": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+
+def test_start_recording_options_language_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept null language (triggers auto-detection)."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"language": None}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+@pytest.mark.parametrize("value", [True, 1, "y", "on", "true", "yes", "t"])
+def test_start_recording_options_transcribe_valid_true(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept transcribe with any valid pydantic true values."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"transcribe": True}
+
+
+@pytest.mark.parametrize("value", [False, 0, "n", "off", "false", "no", "f"])
+def test_start_recording_options_transcribe_valid_false(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept transcribe with any valid pydantic false values."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"transcribe": False}
+
+
+def test_start_recording_options_transcribe_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept transcribe=null (falls back to application default)."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": None}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept options=null."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": None},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_omitted(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept a request with no options field at all."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_unknown_field_rejected(settings):
+    """Should reject unknown fields in options (extra='forbid')."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"unknown_field": "value"}},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+@pytest.mark.parametrize("value", ["foo", 12])
+def test_start_recording_options_invalid_transcribe_type(settings, value):
+    """Should reject non-boolean transcribe values."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": value}},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+@pytest.mark.parametrize("value", ["screen_recording", "transcript"])
+def test_start_recording_options_original_mode_valid(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept valid recording mode choices for original_mode."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"original_mode": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"original_mode": value}
+
+
+def test_start_recording_options_original_mode_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept original_mode=null."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"original_mode": None}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_original_mode_omitted(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept a request with original_mode omitted."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+@pytest.mark.parametrize("value", ["invalid_mode", "foo", 123, "SCREEN_RECORDING"])
+def test_start_recording_options_original_mode_invalid(settings, value):
+    """Should reject invalid recording mode values for original_mode."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"original_mode": value}},
+        format="json",
+    )
+
+    assert response.status_code == 400

src/backend/core/tests/test_utils_detect_mimetype.py

@@ -0,0 +1,166 @@
+"""
+Test utils.detect_mimetype
+Originally taken from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L166  # pylint:disable=line-too-long
+"""
+
+import pytest
+
+from core import utils
+
+
+def test_detect_mimetype_from_content_pdf():
+    """Test detect_mimetype detects PDF from content (magic bytes)."""
+    # PDF magic bytes: %PDF
+    pdf_content = b"%PDF-1.4\n"
+    mimetype = utils.detect_mimetype(pdf_content, filename="document.pdf")
+    assert mimetype == "application/pdf"
+
+
+def test_detect_mimetype_from_content_png():
+    """Test detect_mimetype detects PNG from content (magic bytes)."""
+    # PNG magic bytes: \x89PNG\r\n\x1a\n
+    png_content = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR"
+    mimetype = utils.detect_mimetype(png_content, filename="image.png")
+    assert mimetype == "image/png"
+
+
+def test_detect_mimetype_from_content_jpeg():
+    """Test detect_mimetype detects JPEG from content (magic bytes)."""
+    # JPEG magic bytes: \xff\xd8\xff
+    jpeg_content = b"\xff\xd8\xff\xe0\x00\x10JFIF"
+    mimetype = utils.detect_mimetype(jpeg_content, filename="photo.jpg")
+    assert mimetype == "image/jpeg"
+
+
+def test_detect_mimetype_from_content_text_plain():
+    """Test detect_mimetype detects plain text from content."""
+    text_content = b"This is plain text content"
+    mimetype = utils.detect_mimetype(text_content, filename="file.txt")
+    assert mimetype == "text/plain"
+
+
+def test_detect_mimetype_empty_file():
+    """Test detect_mimetype handles empty files."""
+    empty_content = b""
+    mimetype = utils.detect_mimetype(empty_content, filename="empty.txt")
+    # Empty files should be detected as application/x-empty by magic bytes
+    assert mimetype == "application/x-empty"
+
+
+def test_detect_mimetype_uses_extension_when_content_generic():
+    """Test detect_mimetype uses extension when content detection returns generic type."""
+    # Generic binary content that might be detected as application/octet-stream
+    generic_content = b"\x00\x01\x02\x03\x04\x05"
+    # But if we have a specific extension, we should use it
+    mimetype = utils.detect_mimetype(generic_content, filename="document.pdf")
+    # Should prefer extension-based detection for specific types
+    assert mimetype == "application/pdf"
+
+
+def test_detect_mimetype_uses_extension_for_json():
+    """Test detect_mimetype uses extension for JSON files."""
+    # JSON content might be detected as text/plain
+    json_content = b'{"key": "value"}'
+    mimetype = utils.detect_mimetype(json_content, filename="data.json")
+    # Should use extension to get application/json
+    assert mimetype == "application/json"
+
+
+def test_detect_mimetype_without_filename():
+    """Test detect_mimetype works without filename (content-only detection)."""
+    pdf_content = b"%PDF-1.4\n"
+    mimetype = utils.detect_mimetype(pdf_content, filename=None)
+    assert mimetype == "application/pdf"
+
+
+def test_detect_mimetype_fallback_to_extension():
+    """Test detect_mimetype falls back to extension when content detection is generic."""
+    # Content that might be detected as text/plain
+    content = b"some content"
+    mimetype = utils.detect_mimetype(content, filename="script.js")
+    # Should use extension to get JavaScript MIME type
+    # (can be text/javascript or application/javascript)
+    assert mimetype in ["text/javascript", "application/javascript"]
+
+
+def test_detect_mimetype_generic_content_no_extension():
+    """Test detect_mimetype with generic content and no extension."""
+    generic_content = b"\x00\x01\x02\x03"
+    mimetype = utils.detect_mimetype(generic_content, filename="file")
+    # Should return content-based detection (likely application/octet-stream)
+    assert mimetype in ["application/octet-stream", "application/x-empty"]
+
+
+def test_detect_mimetype_xml_file():
+    """Test detect_mimetype detects XML files."""
+    xml_content = b'<?xml version="1.0"?><root></root>'
+    mimetype = utils.detect_mimetype(xml_content, filename="data.xml")
+    # Should detect as XML (either from content or extension)
+    assert mimetype in ["application/xml", "text/xml"]
+
+
+def test_detect_mimetype_csv_file():
+    """Test detect_mimetype detects CSV files."""
+    csv_content = b"name,age\nJohn,30\nJane,25"
+    mimetype = utils.detect_mimetype(csv_content, filename="data.csv")
+    # CSV might be detected as text/plain, but extension should help
+    assert mimetype in ["text/csv", "text/plain"]
+
+
+def test_detect_mimetype_zip_file():
+    """Test detect_mimetype detects ZIP files from magic bytes."""
+    # ZIP magic bytes: PK\x03\x04
+    zip_content = b"PK\x03\x04\x14\x00\x00\x00"
+    mimetype = utils.detect_mimetype(zip_content, filename="archive.zip")
+    assert mimetype == "application/zip"
+
+
+def test_detect_mimetype_prefers_content_over_extension():
+    """Test detect_mimetype prefers content detection when both are available and specific."""
+    # PDF content but wrong extension
+    pdf_content = b"%PDF-1.4\n"
+    mimetype = utils.detect_mimetype(pdf_content, filename="document.txt")
+    # Should prefer content detection (PDF) over extension (txt)
+    assert mimetype == "application/pdf"
+
+
+@pytest.mark.xfail(
+    reason="Fails in our repo, but passes in the original repo, leaving it there"
+)
+def test_detect_mimetype_powerpoint_pptx():
+    """Test detect_mimetype correctly detects PowerPoint .pptx files."""
+    # .pptx files are ZIP archives, so content might be detected as application/zip or octet-stream
+    # But with the extension, it should be detected as PowerPoint MIME type
+    # Using minimal ZIP-like content that might be detected as generic
+    pptx_content = b"PK\x03\x04"  # ZIP magic bytes (PPTX is a ZIP archive)
+    mimetype = utils.detect_mimetype(pptx_content, filename="presentation.pptx")
+    # Should use extension to get PowerPoint MIME type
+    assert mimetype in [
+        "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+        "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
+    ]
+
+
+def test_detect_mimetype_powerpoint_ppt():
+    """Test detect_mimetype correctly detects PowerPoint .ppt files (older format)."""
+    # .ppt files might be detected as application/octet-stream by magic bytes
+    # But with the extension, it should be detected as PowerPoint MIME type
+    ppt_content = b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"  # OLE2 compound document header
+    mimetype = utils.detect_mimetype(ppt_content, filename="presentation.ppt")
+    # Should use extension to get PowerPoint MIME type
+    assert mimetype in [
+        "application/vnd.ms-powerpoint",
+        "application/mspowerpoint",
+    ]
+
+
+def test_detect_mimetype_ole_storage():
+    """
+    Microsoft files .xls .doc .ppt can use the mimetype application/x-ole-storage
+    for Microsoft OLE2/Compound File Binary Format. In that case we want to rely on the extension
+    """
+
+    xls_ole_content = b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"
+    mimetype = utils.detect_mimetype(xls_ole_content, filename="document.xls")
+
+    assert mimetype == "application/vnd.ms-excel"

src/backend/core/urls.py

@@ -14,6 +14,7 @@ router = DefaultRouter()
 router.register("users", viewsets.UserViewSet, basename="users")
 router.register("rooms", viewsets.RoomViewSet, basename="rooms")
 router.register("recordings", viewsets.RecordingViewSet, basename="recordings")
+router.register("files", viewsets.FileViewSet, basename="files")
 router.register(
     "resource-accesses", viewsets.ResourceAccessViewSet, basename="resource_accesses"
 )

src/backend/core/utils.py

@@ -7,6 +7,8 @@ Utils functions used in the core app
 
 import hashlib
 import json
+import logging
+import mimetypes
 import random
 import secrets
 import string
@@ -17,7 +19,9 @@ from django.conf import settings
 from django.core.files.storage import default_storage
 
 import aiohttp
+import boto3
 import botocore
+import magic
 from asgiref.sync import async_to_sync
 from livekit.api import (  # pylint: disable=E0611
     AccessToken,
@@ -29,6 +33,8 @@ from livekit.api import (  # pylint: disable=E0611
     VideoGrants,
 )
 
+logger = logging.getLogger(__name__)
+
 
 def generate_color(identity: str) -> str:
     """Generates a consistent HSL color based on a given identity string.
@@ -344,3 +350,108 @@ def generate_room_slug():
         for size in sizes
     ]
     return "-".join(parts)
+
+
+def detect_mimetype(file_buffer: bytes, filename: str | None = None) -> str:
+    """
+    Detect MIME type using multiple methods for better accuracy.
+
+    This function combines:
+    1. Magic bytes detection (python-magic) - most reliable for actual file content
+    2. File extension detection (mimetypes) - useful as fallback or for validation
+
+    Args:
+        file_buffer: The file content buffer (first bytes of the file)
+        filename: Optional filename to extract extension from
+
+    Returns:
+        str: The detected MIME type
+
+    Notes:
+        Originally from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L166 # pylint:disable=line-too-long
+    """
+    # Initialize magic detector
+    mime_detector = magic.Magic(mime=True)
+
+    # Method 1: Detect from file content (magic bytes) - most reliable
+    mimetype_from_content = mime_detector.from_buffer(file_buffer)
+
+    # If we have a filename, try extension-based detection as well
+    mimetype_from_extension = None
+    if filename:
+        # Use mimetypes module to guess from extension
+        # Use guess_file_type (Python 3.13+) instead of deprecated guess_type
+        mimetype_from_extension, _ = mimetypes.guess_file_type(filename, strict=False)
+
+    logger.debug("detect_mimetype: mimetype_from_content: %s", mimetype_from_content)
+    logger.debug(
+        "detect_mimetype: mimetype_from_extension: %s", mimetype_from_extension
+    )
+
+    # Strategy: Prefer content-based detection, but use extension if:
+    # 1. Content detection returns generic types (application/octet-stream, text/plain)
+    # 2. Content detection fails or returns None
+    # 3. Extension detection provides a more specific type
+
+    # Generic/unreliable MIME types that we should try to improve
+    generic_types = {
+        "application/octet-stream",
+        "application/x-ole-storage",  # used by .xls, .doc and .ppt
+        "application/zip",
+        "text/plain",
+    }
+
+    # If content detection gives us a generic type and we have extension info
+    if mimetype_from_content in generic_types and mimetype_from_extension:
+        # Use extension-based detection if it's more specific
+        if mimetype_from_extension not in generic_types:
+            return mimetype_from_extension
+
+    # If content detection failed, returned None or is a generic type, use extension if available
+    if not mimetype_from_content or mimetype_from_content in generic_types:
+        if mimetype_from_extension:
+            return mimetype_from_extension
+
+    # Default to content-based detection (most reliable)
+    return mimetype_from_content or "application/octet-stream"
+
+
+def generate_upload_policy(file):
+    """
+    Generate a S3 upload policy for a given file.
+
+    Notes:
+        Originally taken from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L102  # pylint: disable=line-too-long
+    """
+
+    key = file.file_key
+
+    # This settings should be used if the backend application and the frontend application
+    # can't connect to the object storage with the same domain. This is the case in the
+    # docker compose stack used in development. The frontend application will use localhost
+    # to connect to the object storage while the backend application will use the object storage
+    # service name declared in the docker compose stack.
+    # This is needed because the domain name is used to compute the signature. So it can't be
+    # changed dynamically by the frontend application.
+    if settings.AWS_S3_DOMAIN_REPLACE:
+        s3_client = boto3.client(
+            "s3",
+            aws_access_key_id=settings.AWS_S3_ACCESS_KEY_ID,
+            aws_secret_access_key=settings.AWS_S3_SECRET_ACCESS_KEY,
+            endpoint_url=settings.AWS_S3_DOMAIN_REPLACE,
+            config=botocore.client.Config(
+                region_name=settings.AWS_S3_REGION_NAME,
+                signature_version=settings.AWS_S3_SIGNATURE_VERSION,
+            ),
+        )
+    else:
+        s3_client = default_storage.connection.meta.client
+
+    # Generate the policy
+    policy = s3_client.generate_presigned_url(
+        ClientMethod="put_object",
+        Params={"Bucket": default_storage.bucket_name, "Key": key, "ACL": "private"},
+        ExpiresIn=settings.AWS_S3_UPLOAD_POLICY_EXPIRATION,
+    )
+
+    return policy

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-12-29 15:15+0000\n"
+"POT-Creation-Date: 2026-02-26 17:34+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,141 +29,149 @@ msgstr "Berechtigungen"
 msgid "Important dates"
 msgstr "Wichtige Daten"
 
-#: core/admin.py:128 core/admin.py:228
+#: core/admin.py:132 core/admin.py:243
 msgid "No owner"
 msgstr "Kein Eigentümer"
 
-#: core/admin.py:131 core/admin.py:231
+#: core/admin.py:135 core/admin.py:246
 msgid "Multiple owners"
 msgstr "Mehrere Eigentümer"
 
-#: core/admin.py:143
+#: core/admin.py:148
 msgid "Resend notification to external service"
 msgstr "Benachrichtigung erneut an externen Dienst senden"
 
-#: core/admin.py:166
+#: core/admin.py:171
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Benachrichtigung für Aufnahme %(id)s fehlgeschlagen"
 
-#: core/admin.py:174
+#: core/admin.py:179
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Benachrichtigung für Aufnahme %(id)s fehlgeschlagen: %(error)s"
 
-#: core/admin.py:182
+#: core/admin.py:187
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Benachrichtigungen für %(count)s Aufnahme(n) erfolgreich gesendet."
 
-#: core/admin.py:190
+#: core/admin.py:195
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s abgelaufene Aufnahme(n) übersprungen."
 
-#: core/admin.py:294
+#: core/admin.py:309
 msgid "No scopes"
 msgstr "Keine Scopes"
 
-#: core/admin.py:296
+#: core/admin.py:311
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/serializers.py:68
+#: core/api/filters.py:24
+msgid "Creator is me"
+msgstr "Ersteller bin ich"
+
+#: core/api/serializers.py:84
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
 "hinzuzufügen."
 
-#: core/models.py:34
+#: core/api/serializers.py:443
+msgid "This file extension is not allowed."
+msgstr "Diese Dateiendung ist nicht erlaubt."
+
+#: core/models.py:35
 msgid "Member"
 msgstr "Mitglied"
 
-#: core/models.py:35
+#: core/models.py:36
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:36
+#: core/models.py:37
 msgid "Owner"
 msgstr "Eigentümer"
 
-#: core/models.py:52
+#: core/models.py:53
 msgid "Initiated"
 msgstr "Gestartet"
 
-#: core/models.py:53
+#: core/models.py:54
 msgid "Active"
 msgstr "Aktiv"
 
-#: core/models.py:54
+#: core/models.py:55
 msgid "Stopped"
 msgstr "Beendet"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Saved"
 msgstr "Gespeichert"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Aborted"
 msgstr "Abgebrochen"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Failed to Start"
 msgstr "Start fehlgeschlagen"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Failed to Stop"
 msgstr "Stopp fehlgeschlagen"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Notification succeeded"
 msgstr "Benachrichtigung erfolgreich"
 
-#: core/models.py:86
+#: core/models.py:87
 msgid "SCREEN_RECORDING"
 msgstr "BILDSCHIRMAUFZEICHNUNG"
 
-#: core/models.py:87
+#: core/models.py:88
 msgid "TRANSCRIPT"
 msgstr "TRANSKRIPT"
 
-#: core/models.py:93
+#: core/models.py:94
 msgid "Public Access"
 msgstr "Öffentlicher Zugriff"
 
-#: core/models.py:94
+#: core/models.py:95
 msgid "Trusted Access"
 msgstr "Vertrauenswürdiger Zugriff"
 
-#: core/models.py:95
+#: core/models.py:96
 msgid "Restricted Access"
 msgstr "Eingeschränkter Zugriff"
 
-#: core/models.py:107
+#: core/models.py:108
 msgid "id"
 msgstr "ID"
 
-#: core/models.py:108
+#: core/models.py:109
 msgid "primary key for the record as UUID"
 msgstr "Primärschlüssel des Eintrags als UUID"
 
-#: core/models.py:114
+#: core/models.py:115
 msgid "created on"
 msgstr "erstellt am"
 
-#: core/models.py:115
+#: core/models.py:116
 msgid "date and time at which a record was created"
 msgstr "Datum und Uhrzeit der Erstellung eines Eintrags"
 
-#: core/models.py:120
+#: core/models.py:121
 msgid "updated on"
 msgstr "aktualisiert am"
 
-#: core/models.py:121
+#: core/models.py:122
 msgid "date and time at which a record was last updated"
 msgstr "Datum und Uhrzeit der letzten Aktualisierung eines Eintrags"
 
-#: core/models.py:141
+#: core/models.py:142
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -171,11 +179,11 @@ msgstr ""
 "Geben Sie einen gültigen Sub ein. Dieser Wert darf nur Buchstaben, Zahlen "
 "und die Zeichen @/./+/-/_ enthalten."
 
-#: core/models.py:147
+#: core/models.py:148
 msgid "sub"
 msgstr "Sub"
 
-#: core/models.py:149
+#: core/models.py:150
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -183,55 +191,55 @@ msgstr ""
 "Optional für ausstehende Benutzer; erforderlich nach Kontoaktivierung. "
 "Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ Zeichen erlaubt."
 
-#: core/models.py:158
+#: core/models.py:159
 msgid "identity email address"
 msgstr "Identitäts-E-Mail-Adresse"
 
-#: core/models.py:163
+#: core/models.py:164
 msgid "admin email address"
 msgstr "Administrator-E-Mail-Adresse"
 
-#: core/models.py:165
+#: core/models.py:166
 msgid "full name"
 msgstr "Vollständiger Name"
 
-#: core/models.py:167
+#: core/models.py:168
 msgid "short name"
 msgstr "Kurzname"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "language"
 msgstr "Sprache"
 
-#: core/models.py:174
+#: core/models.py:175
 msgid "The language in which the user wants to see the interface."
 msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."
 
-#: core/models.py:180
+#: core/models.py:181
 msgid "The timezone in which the user wants to see times."
 msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."
 
-#: core/models.py:183
+#: core/models.py:184
 msgid "device"
 msgstr "Gerät"
 
-#: core/models.py:185
+#: core/models.py:186
 msgid "Whether the user is a device or a real user."
 msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."
 
-#: core/models.py:188
+#: core/models.py:189
 msgid "staff status"
 msgstr "Mitarbeiterstatus"
 
-#: core/models.py:190
+#: core/models.py:191
 msgid "Whether the user can log into this admin site."
 msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."
 
-#: core/models.py:193
+#: core/models.py:194
 msgid "active"
 msgstr "aktiv"
 
-#: core/models.py:196
+#: core/models.py:197
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -239,66 +247,66 @@ msgstr ""
 "Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
 "anstelle des Löschens des Kontos."
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "user"
 msgstr "Benutzer"
 
-#: core/models.py:210
+#: core/models.py:211
 msgid "users"
 msgstr "Benutzer"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:270
+#: core/models.py:271
 msgid "Resources"
 msgstr "Ressourcen"
 
-#: core/models.py:324
+#: core/models.py:329
 msgid "Resource access"
 msgstr "Ressourcenzugriff"
 
-#: core/models.py:325
+#: core/models.py:330
 msgid "Resource accesses"
 msgstr "Ressourcenzugriffe"
 
-#: core/models.py:331
+#: core/models.py:336
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
 "bereits."
 
-#: core/models.py:387
+#: core/models.py:392
 msgid "Visio room configuration"
 msgstr "Visio-Raumkonfiguration"
 
-#: core/models.py:388
+#: core/models.py:393
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
 
-#: core/models.py:395
+#: core/models.py:400
 msgid "Room PIN code"
 msgstr "PIN-Code für den Raum"
 
-#: core/models.py:396
+#: core/models.py:401
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
 
-#: core/models.py:402 core/models.py:556
+#: core/models.py:407 core/models.py:561
 msgid "Room"
 msgstr "Raum"
 
-#: core/models.py:403
+#: core/models.py:408
 msgid "Rooms"
 msgstr "Räume"
 
-#: core/models.py:567
+#: core/models.py:572
 msgid "Worker ID"
 msgstr "Worker-ID"
 
-#: core/models.py:569
+#: core/models.py:574
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -307,108 +315,149 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."
 
-#: core/models.py:577
+#: core/models.py:582
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"
 
-#: core/models.py:578
+#: core/models.py:583
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
 
-#: core/models.py:583 core/models.py:584
+#: core/models.py:588 core/models.py:589
 msgid "Recording options"
 msgstr "Aufnahmeoptionen"
 
-#: core/models.py:590
+#: core/models.py:595
 msgid "Recording"
 msgstr "Aufzeichnung"
 
-#: core/models.py:591
+#: core/models.py:596
 msgid "Recordings"
 msgstr "Aufzeichnungen"
 
-#: core/models.py:699
+#: core/models.py:704
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"
 
-#: core/models.py:700
+#: core/models.py:705
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"
 
-#: core/models.py:706
+#: core/models.py:711
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:712
+#: core/models.py:717
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:718
+#: core/models.py:723
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
 
-#: core/models.py:735
+#: core/models.py:740
 msgid "Create rooms"
 msgstr "Räume erstellen"
 
-#: core/models.py:736
+#: core/models.py:741
 msgid "List rooms"
 msgstr "Räume auflisten"
 
-#: core/models.py:737
+#: core/models.py:742
 msgid "Retrieve room details"
 msgstr "Raumdetails abrufen"
 
-#: core/models.py:738
+#: core/models.py:743
 msgid "Update rooms"
 msgstr "Räume aktualisieren"
 
-#: core/models.py:739
+#: core/models.py:744
 msgid "Delete rooms"
 msgstr "Räume löschen"
 
-#: core/models.py:752
+#: core/models.py:757
 msgid "Application name"
 msgstr "Anwendungsname"
 
-#: core/models.py:753
+#: core/models.py:758
 msgid "Descriptive name for this application."
 msgstr "Beschreibender Name für diese Anwendung."
 
-#: core/models.py:763
+#: core/models.py:768
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."
 
-#: core/models.py:774
+#: core/models.py:779
 msgid "Application"
 msgstr "Anwendung"
 
-#: core/models.py:775
+#: core/models.py:780
 msgid "Applications"
 msgstr "Anwendungen"
 
-#: core/models.py:798
+#: core/models.py:803
 msgid "Enter a valid domain"
 msgstr "Geben Sie eine gültige Domain ein"
 
-#: core/models.py:801
+#: core/models.py:806
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:802
+#: core/models.py:807
 msgid "Email domain this application can act on behalf of."
 msgstr "E-Mail-Domain, im Namen der diese Anwendung handeln kann."
 
-#: core/models.py:814
+#: core/models.py:819
 msgid "Application domain"
 msgstr "Anwendungsdomain"
 
-#: core/models.py:815
+#: core/models.py:820
 msgid "Application domains"
 msgstr "Anwendungsdomains"
 
-#: core/recording/event/notification.py:94
+#: core/models.py:838
+msgid "Pending"
+msgstr "Ausstehend"
+
+#: core/models.py:846
+msgid "Ready"
+msgstr "Bereit"
+
+#: core/models.py:852
+msgid "Background image"
+msgstr "Hintergrundbild"
+
+#: core/models.py:864
+msgid "title"
+msgstr "Titel"
+
+#: core/models.py:890
+msgid "Malware detection info when the analysis status is unsafe."
+msgstr ""
+"Informationen zur Malware-Erkennung, wenn der Analyse-Status unsicher ist."
+
+#: core/models.py:895
+msgid "File"
+msgstr "Datei"
+
+#: core/models.py:896
+msgid "Files"
+msgstr "Dateien"
+
+#: core/models.py:970
+msgid "This file is already hard deleted."
+msgstr "Diese Datei wurde bereits endgültig gelöscht."
+
+#: core/models.py:980
+#, fuzzy
+#| msgid "To hard delete a file, it must first be soft deleted."
+msgid "To hard delete a file, it must first be soft deleted."
+msgstr ""
+"Um eine Datei endgültig zu löschen, muss sie zuvor weich gelöscht worden "
+"sein."
+
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Ihre Aufzeichnung ist bereit"
 
@@ -536,18 +585,18 @@ msgstr ""
 " Wenn Sie Fragen haben oder Unterstützung benötigen, wenden Sie sich bitte "
 "an unser Support-Team unter %(support_email)s. "
 
-#: meet/settings.py:169
+#: meet/settings.py:224
 msgid "English"
 msgstr "Englisch"
 
-#: meet/settings.py:170
+#: meet/settings.py:225
 msgid "French"
 msgstr "Französisch"
 
-#: meet/settings.py:171
+#: meet/settings.py:226
 msgid "Dutch"
 msgstr "Niederländisch"
 
-#: meet/settings.py:172
+#: meet/settings.py:227
 msgid "German"
 msgstr "Deutsch"

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-12-29 15:15+0000\n"
+"POT-Creation-Date: 2026-02-26 17:26+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,139 +29,147 @@ msgstr "Permissions"
 msgid "Important dates"
 msgstr "Important dates"
 
-#: core/admin.py:128 core/admin.py:228
+#: core/admin.py:132 core/admin.py:243
 msgid "No owner"
 msgstr "No owner"
 
-#: core/admin.py:131 core/admin.py:231
+#: core/admin.py:135 core/admin.py:246
 msgid "Multiple owners"
 msgstr "Multiple owners"
 
-#: core/admin.py:143
+#: core/admin.py:148
 msgid "Resend notification to external service"
 msgstr "Resend notification to external service"
 
-#: core/admin.py:166
+#: core/admin.py:171
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Failed to notify for recording %(id)s"
 
-#: core/admin.py:174
+#: core/admin.py:179
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Failed to notify for recording %(id)s: %(error)s"
 
-#: core/admin.py:182
+#: core/admin.py:187
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Successfully sent notifications for %(count)s recording(s)."
 
-#: core/admin.py:190
+#: core/admin.py:195
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "Skipped %(count)s expired recording(s)."
 
-#: core/admin.py:294
+#: core/admin.py:309
 msgid "No scopes"
 msgstr "No scopes"
 
-#: core/admin.py:296
+#: core/admin.py:311
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/serializers.py:68
+#: core/api/filters.py:24
+msgid "Creator is me"
+msgstr "Creator is me"
+
+#: core/api/serializers.py:84
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr "You must be administrator or owner of a room to add accesses to it."
 
-#: core/models.py:34
+#: core/api/serializers.py:443
+msgid "This file extension is not allowed."
+msgstr "This file extension is not allowed."
+
+#: core/models.py:35
 msgid "Member"
 msgstr "Member"
 
-#: core/models.py:35
+#: core/models.py:36
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:36
+#: core/models.py:37
 msgid "Owner"
 msgstr "Owner"
 
-#: core/models.py:52
+#: core/models.py:53
 msgid "Initiated"
 msgstr "Initiated"
 
-#: core/models.py:53
+#: core/models.py:54
 msgid "Active"
 msgstr "Active"
 
-#: core/models.py:54
+#: core/models.py:55
 msgid "Stopped"
 msgstr "Stopped"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Saved"
 msgstr "Saved"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Aborted"
 msgstr "Aborted"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Failed to Start"
 msgstr "Failed to Start"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Failed to Stop"
 msgstr "Failed to Stop"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Notification succeeded"
 msgstr "Notification succeeded"
 
-#: core/models.py:86
+#: core/models.py:87
 msgid "SCREEN_RECORDING"
 msgstr "SCREEN_RECORDING"
 
-#: core/models.py:87
+#: core/models.py:88
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:93
+#: core/models.py:94
 msgid "Public Access"
 msgstr "Public Access"
 
-#: core/models.py:94
+#: core/models.py:95
 msgid "Trusted Access"
 msgstr "Trusted Access"
 
-#: core/models.py:95
+#: core/models.py:96
 msgid "Restricted Access"
 msgstr "Restricted Access"
 
-#: core/models.py:107
+#: core/models.py:108
 msgid "id"
 msgstr "id"
 
-#: core/models.py:108
+#: core/models.py:109
 msgid "primary key for the record as UUID"
 msgstr "primary key for the record as UUID"
 
-#: core/models.py:114
+#: core/models.py:115
 msgid "created on"
 msgstr "created on"
 
-#: core/models.py:115
+#: core/models.py:116
 msgid "date and time at which a record was created"
 msgstr "date and time at which a record was created"
 
-#: core/models.py:120
+#: core/models.py:121
 msgid "updated on"
 msgstr "updated on"
 
-#: core/models.py:121
+#: core/models.py:122
 msgid "date and time at which a record was last updated"
 msgstr "date and time at which a record was last updated"
 
-#: core/models.py:141
+#: core/models.py:142
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -169,11 +177,11 @@ msgstr ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
 
-#: core/models.py:147
+#: core/models.py:148
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:149
+#: core/models.py:150
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -181,55 +189,55 @@ msgstr ""
 "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
 "characters only."
 
-#: core/models.py:158
+#: core/models.py:159
 msgid "identity email address"
 msgstr "identity email address"
 
-#: core/models.py:163
+#: core/models.py:164
 msgid "admin email address"
 msgstr "admin email address"
 
-#: core/models.py:165
+#: core/models.py:166
 msgid "full name"
 msgstr "full name"
 
-#: core/models.py:167
+#: core/models.py:168
 msgid "short name"
 msgstr "short name"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "language"
 msgstr "language"
 
-#: core/models.py:174
+#: core/models.py:175
 msgid "The language in which the user wants to see the interface."
 msgstr "The language in which the user wants to see the interface."
 
-#: core/models.py:180
+#: core/models.py:181
 msgid "The timezone in which the user wants to see times."
 msgstr "The timezone in which the user wants to see times."
 
-#: core/models.py:183
+#: core/models.py:184
 msgid "device"
 msgstr "device"
 
-#: core/models.py:185
+#: core/models.py:186
 msgid "Whether the user is a device or a real user."
 msgstr "Whether the user is a device or a real user."
 
-#: core/models.py:188
+#: core/models.py:189
 msgid "staff status"
 msgstr "staff status"
 
-#: core/models.py:190
+#: core/models.py:191
 msgid "Whether the user can log into this admin site."
 msgstr "Whether the user can log into this admin site."
 
-#: core/models.py:193
+#: core/models.py:194
 msgid "active"
 msgstr "active"
 
-#: core/models.py:196
+#: core/models.py:197
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -237,63 +245,63 @@ msgstr ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "user"
 msgstr "user"
 
-#: core/models.py:210
+#: core/models.py:211
 msgid "users"
 msgstr "users"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resource"
 msgstr "Resource"
 
-#: core/models.py:270
+#: core/models.py:271
 msgid "Resources"
 msgstr "Resources"
 
-#: core/models.py:324
+#: core/models.py:329
 msgid "Resource access"
 msgstr "Resource access"
 
-#: core/models.py:325
+#: core/models.py:330
 msgid "Resource accesses"
 msgstr "Resource accesses"
 
-#: core/models.py:331
+#: core/models.py:336
 msgid "Resource access with this User and Resource already exists."
 msgstr "Resource access with this User and Resource already exists."
 
-#: core/models.py:387
+#: core/models.py:392
 msgid "Visio room configuration"
 msgstr "Visio room configuration"
 
-#: core/models.py:388
+#: core/models.py:393
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:395
+#: core/models.py:400
 msgid "Room PIN code"
 msgstr "Room PIN code"
 
-#: core/models.py:396
+#: core/models.py:401
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr "Unique n-digit code that identifies this room in telephony mode."
 
-#: core/models.py:402 core/models.py:556
+#: core/models.py:407 core/models.py:561
 msgid "Room"
 msgstr "Room"
 
-#: core/models.py:403
+#: core/models.py:408
 msgid "Rooms"
 msgstr "Rooms"
 
-#: core/models.py:567
+#: core/models.py:572
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:569
+#: core/models.py:574
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -301,111 +309,151 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 
-#: core/models.py:577
+#: core/models.py:582
 msgid "Recording mode"
 msgstr "Recording mode"
 
-#: core/models.py:578
+#: core/models.py:583
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."
 
-#: core/models.py:583 core/models.py:584
+#: core/models.py:588 core/models.py:589
 msgid "Recording options"
 msgstr "Recording options"
 
-#: core/models.py:590
+#: core/models.py:595
 msgid "Recording"
 msgstr "Recording"
 
-#: core/models.py:591
+#: core/models.py:596
 msgid "Recordings"
 msgstr "Recordings"
 
-#: core/models.py:699
+#: core/models.py:704
 msgid "Recording/user relation"
 msgstr "Recording/user relation"
 
-#: core/models.py:700
+#: core/models.py:705
 msgid "Recording/user relations"
 msgstr "Recording/user relations"
 
-#: core/models.py:706
+#: core/models.py:711
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."
 
-#: core/models.py:712
+#: core/models.py:717
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."
 
-#: core/models.py:718
+#: core/models.py:723
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."
 
-#: core/models.py:735
+#: core/models.py:740
 #, fuzzy
 #| msgid "created on"
 msgid "Create rooms"
 msgstr "Create rooms"
 
-#: core/models.py:736
+#: core/models.py:741
 msgid "List rooms"
 msgstr "List rooms"
 
-#: core/models.py:737
+#: core/models.py:742
 msgid "Retrieve room details"
 msgstr "Retrieve room details"
 
-#: core/models.py:738
+#: core/models.py:743
 #, fuzzy
 #| msgid "updated on"
 msgid "Update rooms"
 msgstr "Update rooms"
 
-#: core/models.py:739
+#: core/models.py:744
 msgid "Delete rooms"
 msgstr "Delete rooms"
 
-#: core/models.py:752
+#: core/models.py:757
 msgid "Application name"
 msgstr "Application name"
 
-#: core/models.py:753
+#: core/models.py:758
 msgid "Descriptive name for this application."
 msgstr "Descriptive name for this application."
 
-#: core/models.py:763
+#: core/models.py:768
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Hashed on Save. Copy it now if this is a new secret."
 
-#: core/models.py:774
+#: core/models.py:779
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:775
+#: core/models.py:780
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:798
+#: core/models.py:803
 msgid "Enter a valid domain"
 msgstr "Enter a valid domain"
 
-#: core/models.py:801
+#: core/models.py:806
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:802
+#: core/models.py:807
 msgid "Email domain this application can act on behalf of."
 msgstr "Email domain this application can act on behalf of."
 
-#: core/models.py:814
+#: core/models.py:819
 msgid "Application domain"
 msgstr "Application domain"
 
-#: core/models.py:815
+#: core/models.py:820
 msgid "Application domains"
 msgstr "Application domains"
 
-#: core/recording/event/notification.py:94
+#: core/models.py:838
+#, fuzzy
+#| msgid "Recording"
+msgid "Pending"
+msgstr "Pending"
+
+#: core/models.py:846
+msgid "Ready"
+msgstr "Ready"
+
+#: core/models.py:852
+msgid "Background image"
+msgstr "Background image"
+
+#: core/models.py:864
+msgid "title"
+msgstr "title"
+
+#: core/models.py:890
+msgid "Malware detection info when the analysis status is unsafe."
+msgstr "Malware detection info when the analysis status is unsafe."
+
+#: core/models.py:895
+msgid "File"
+msgstr "File"
+
+#: core/models.py:896
+msgid "Files"
+msgstr "Files"
+
+#: core/models.py:970
+#, fuzzy
+#| msgid "This user is already in this recording."
+msgid "This file is already hard deleted."
+msgstr "This file is already hard deleted."
+
+#: core/models.py:980
+msgid "To hard delete a file, it must first be soft deleted."
+msgstr "To hard delete a file, it must first be soft deleted."
+
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Your recording is ready"
 
@@ -533,18 +581,18 @@ msgstr ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "
 
-#: meet/settings.py:169
+#: meet/settings.py:224
 msgid "English"
 msgstr "English"
 
-#: meet/settings.py:170
+#: meet/settings.py:225
 msgid "French"
 msgstr "French"
 
-#: meet/settings.py:171
+#: meet/settings.py:226
 msgid "Dutch"
 msgstr "Dutch"
 
-#: meet/settings.py:172
+#: meet/settings.py:227
 msgid "German"
 msgstr "German"

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-12-29 15:15+0000\n"
+"POT-Creation-Date: 2026-02-26 17:26+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,143 +29,151 @@ msgstr "Permissions"
 msgid "Important dates"
 msgstr "Dates importantes"
 
-#: core/admin.py:128 core/admin.py:228
+#: core/admin.py:132 core/admin.py:243
 msgid "No owner"
 msgstr "Pas de propriétaire"
 
-#: core/admin.py:131 core/admin.py:231
+#: core/admin.py:135 core/admin.py:246
 msgid "Multiple owners"
 msgstr "Plusieurs propriétaires"
 
-#: core/admin.py:143
+#: core/admin.py:148
 msgid "Resend notification to external service"
 msgstr "Renvoyer la notification au service externe"
 
-#: core/admin.py:166
+#: core/admin.py:171
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Échec de la notification pour l’enregistrement %(id)s"
 
-#: core/admin.py:174
+#: core/admin.py:179
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Échec de la notification pour l’enregistrement %(id)s : %(error)s"
 
-#: core/admin.py:182
+#: core/admin.py:187
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Notifications envoyées avec succès pour %(count)s enregistrement(s)."
 
-#: core/admin.py:190
+#: core/admin.py:195
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s enregistrement(s) expiré(s) ignoré(s)."
 
-#: core/admin.py:294
+#: core/admin.py:309
 msgid "No scopes"
 msgstr "Aucun scopes"
 
-#: core/admin.py:296
+#: core/admin.py:311
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/serializers.py:68
+#: core/api/filters.py:24
+msgid "Creator is me"
+msgstr "Je suis le créateur"
+
+#: core/api/serializers.py:84
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
 "des accès."
 
-#: core/models.py:34
+#: core/api/serializers.py:443
+msgid "This file extension is not allowed."
+msgstr "Cette extension n'est pas autorisée"
+
+#: core/models.py:35
 msgid "Member"
 msgstr "Membre"
 
-#: core/models.py:35
+#: core/models.py:36
 msgid "Administrator"
 msgstr "Administrateur"
 
-#: core/models.py:36
+#: core/models.py:37
 msgid "Owner"
 msgstr "Propriétaire"
 
-#: core/models.py:52
+#: core/models.py:53
 msgid "Initiated"
 msgstr "Initié"
 
-#: core/models.py:53
+#: core/models.py:54
 msgid "Active"
 msgstr "Actif"
 
-#: core/models.py:54
+#: core/models.py:55
 msgid "Stopped"
 msgstr "Arrêté"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Saved"
 msgstr "Enregistré"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Aborted"
 msgstr "Abandonné"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Failed to Start"
 msgstr "Échec au démarrage"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Failed to Stop"
 msgstr "Échec à l'arrêt"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Notification succeeded"
 msgstr "Notification réussie"
 
-#: core/models.py:86
+#: core/models.py:87
 msgid "SCREEN_RECORDING"
 msgstr "ENREGISTREMENT_ÉCRAN"
 
-#: core/models.py:87
+#: core/models.py:88
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPTION"
 
-#: core/models.py:93
+#: core/models.py:94
 msgid "Public Access"
 msgstr "Accès public"
 
-#: core/models.py:94
+#: core/models.py:95
 msgid "Trusted Access"
 msgstr "Accès de confiance"
 
-#: core/models.py:95
+#: core/models.py:96
 msgid "Restricted Access"
 msgstr "Accès restreint"
 
-#: core/models.py:107
+#: core/models.py:108
 msgid "id"
 msgstr "id"
 
-#: core/models.py:108
+#: core/models.py:109
 msgid "primary key for the record as UUID"
 msgstr "clé primaire pour l'enregistrement sous forme d'UUID"
 
-#: core/models.py:114
+#: core/models.py:115
 msgid "created on"
 msgstr "créé le"
 
-#: core/models.py:115
+#: core/models.py:116
 msgid "date and time at which a record was created"
 msgstr "date et heure auxquelles un enregistrement a été créé"
 
-#: core/models.py:120
+#: core/models.py:121
 msgid "updated on"
 msgstr "mis à jour le"
 
-#: core/models.py:121
+#: core/models.py:122
 msgid "date and time at which a record was last updated"
 msgstr ""
 "date et heure auxquelles un enregistrement a été mis à jour pour la dernière "
 "fois"
 
-#: core/models.py:141
+#: core/models.py:142
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -173,11 +181,11 @@ msgstr ""
 "Entrez un sub valide. Cette valeur ne peut contenir que des lettres, des "
 "chiffres et les caractères @/./+/-/_."
 
-#: core/models.py:147
+#: core/models.py:148
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:149
+#: core/models.py:150
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -185,55 +193,55 @@ msgstr ""
 "Optionnel pour les utilisateurs en attente ; requis lors de l'activation du "
 "compte. 255 caractères maximum. Lettres, chiffres et @/./+/-/_ uniquement."
 
-#: core/models.py:158
+#: core/models.py:159
 msgid "identity email address"
 msgstr "adresse e-mail d'identité"
 
-#: core/models.py:163
+#: core/models.py:164
 msgid "admin email address"
 msgstr "adresse e-mail d'administrateur"
 
-#: core/models.py:165
+#: core/models.py:166
 msgid "full name"
 msgstr "nom complet"
 
-#: core/models.py:167
+#: core/models.py:168
 msgid "short name"
 msgstr "nom court"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "language"
 msgstr "langue"
 
-#: core/models.py:174
+#: core/models.py:175
 msgid "The language in which the user wants to see the interface."
 msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."
 
-#: core/models.py:180
+#: core/models.py:181
 msgid "The timezone in which the user wants to see times."
 msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."
 
-#: core/models.py:183
+#: core/models.py:184
 msgid "device"
 msgstr "appareil"
 
-#: core/models.py:185
+#: core/models.py:186
 msgid "Whether the user is a device or a real user."
 msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."
 
-#: core/models.py:188
+#: core/models.py:189
 msgid "staff status"
 msgstr "statut du personnel"
 
-#: core/models.py:190
+#: core/models.py:191
 msgid "Whether the user can log into this admin site."
 msgstr "Si l'utilisateur peut se connecter à ce site d'administration."
 
-#: core/models.py:193
+#: core/models.py:194
 msgid "active"
 msgstr "actif"
 
-#: core/models.py:196
+#: core/models.py:197
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -241,65 +249,65 @@ msgstr ""
 "Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
 "au lieu de supprimer des comptes."
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "user"
 msgstr "utilisateur"
 
-#: core/models.py:210
+#: core/models.py:211
 msgid "users"
 msgstr "utilisateurs"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:270
+#: core/models.py:271
 msgid "Resources"
 msgstr "Ressources"
 
-#: core/models.py:324
+#: core/models.py:329
 msgid "Resource access"
 msgstr "Accès aux ressources"
 
-#: core/models.py:325
+#: core/models.py:330
 msgid "Resource accesses"
 msgstr "Accès aux ressources"
 
-#: core/models.py:331
+#: core/models.py:336
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."
 
-#: core/models.py:387
+#: core/models.py:392
 msgid "Visio room configuration"
 msgstr "Configuration de la salle de visioconférence"
 
-#: core/models.py:388
+#: core/models.py:393
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
 
-#: core/models.py:395
+#: core/models.py:400
 msgid "Room PIN code"
 msgstr "Code PIN de la salle"
 
-#: core/models.py:396
+#: core/models.py:401
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
 
-#: core/models.py:402 core/models.py:556
+#: core/models.py:407 core/models.py:561
 msgid "Room"
 msgstr "Salle"
 
-#: core/models.py:403
+#: core/models.py:408
 msgid "Rooms"
 msgstr "Salles"
 
-#: core/models.py:567
+#: core/models.py:572
 msgid "Worker ID"
 msgstr "ID du Worker"
 
-#: core/models.py:569
+#: core/models.py:574
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -307,109 +315,147 @@ msgstr ""
 "Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant est "
 "conservé même lorsque le Worker s'arrête, permettant un suivi facile."
 
-#: core/models.py:577
+#: core/models.py:582
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"
 
-#: core/models.py:578
+#: core/models.py:583
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:583 core/models.py:584
+#: core/models.py:588 core/models.py:589
 msgid "Recording options"
 msgstr "Options d'enregistrement"
 
-#: core/models.py:590
+#: core/models.py:595
 msgid "Recording"
 msgstr "Enregistrement"
 
-#: core/models.py:591
+#: core/models.py:596
 msgid "Recordings"
 msgstr "Enregistrements"
 
-#: core/models.py:699
+#: core/models.py:704
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:700
+#: core/models.py:705
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:706
+#: core/models.py:711
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."
 
-#: core/models.py:712
+#: core/models.py:717
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."
 
-#: core/models.py:718
+#: core/models.py:723
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 
-#: core/models.py:735
+#: core/models.py:740
 msgid "Create rooms"
 msgstr "Créer des salles"
 
-#: core/models.py:736
+#: core/models.py:741
 msgid "List rooms"
 msgstr "Lister les salles"
 
-#: core/models.py:737
+#: core/models.py:742
 msgid "Retrieve room details"
 msgstr "Afficher les détails d’une salle"
 
-#: core/models.py:738
+#: core/models.py:743
 msgid "Update rooms"
 msgstr "Mettre à jour les salles"
 
-#: core/models.py:739
+#: core/models.py:744
 msgid "Delete rooms"
 msgstr "Supprimer les salles"
 
-#: core/models.py:752
+#: core/models.py:757
 msgid "Application name"
 msgstr "Nom de l’application"
 
-#: core/models.py:753
+#: core/models.py:758
 msgid "Descriptive name for this application."
 msgstr "Nom descriptif de cette application."
 
-#: core/models.py:763
+#: core/models.py:768
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un "
 "nouveau secret."
 
-#: core/models.py:774
+#: core/models.py:779
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:775
+#: core/models.py:780
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:798
+#: core/models.py:803
 msgid "Enter a valid domain"
 msgstr "Saisissez un domaine valide"
 
-#: core/models.py:801
+#: core/models.py:806
 msgid "Domain"
 msgstr "Domaine"
 
-#: core/models.py:802
+#: core/models.py:807
 msgid "Email domain this application can act on behalf of."
 msgstr "Domaine de messagerie au nom duquel cette application peut agir."
 
-#: core/models.py:814
+#: core/models.py:819
 msgid "Application domain"
 msgstr "Domaine d’application"
 
-#: core/models.py:815
+#: core/models.py:820
 msgid "Application domains"
 msgstr "Domaines d’application"
 
-#: core/recording/event/notification.py:94
+#: core/models.py:838
+msgid "Pending"
+msgstr "En attente"
+
+#: core/models.py:846
+msgid "Ready"
+msgstr "Prêt"
+
+#: core/models.py:852
+msgid "Background image"
+msgstr "Image de fond"
+
+#: core/models.py:864
+msgid "title"
+msgstr "Titre"
+
+#: core/models.py:890
+msgid "Malware detection info when the analysis status is unsafe."
+msgstr "Information concernant la détection de Malware cand le statut n'est pas sain"
+
+#: core/models.py:895
+msgid "File"
+msgstr "Fichier"
+
+#: core/models.py:896
+msgid "Files"
+msgstr "Fichiers"
+
+#: core/models.py:970
+#, fuzzy
+#| msgid "This user is already in this recording."
+msgid "This file is already hard deleted."
+msgstr "Ce fichier a été supprimé."
+
+#: core/models.py:980
+msgid "To hard delete a file, it must first be soft deleted."
+msgstr "Pour supprimer définitivement un fichier il doit d'abord avoir été marqué comme supprimé (soft delete)"
+
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Votre enregistrement est prêt"
 
@@ -537,18 +583,18 @@ msgstr ""
 " Si vous avez des questions ou besoin d'assistance, veuillez contacter notre "
 "équipe d'assistance à %(support_email)s. "
 
-#: meet/settings.py:169
+#: meet/settings.py:224
 msgid "English"
 msgstr "Anglais"
 
-#: meet/settings.py:170
+#: meet/settings.py:225
 msgid "French"
 msgstr "Français"
 
-#: meet/settings.py:171
+#: meet/settings.py:226
 msgid "Dutch"
 msgstr "Néerlandais"
 
-#: meet/settings.py:172
+#: meet/settings.py:227
 msgid "German"
 msgstr "Allemand"

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-12-29 15:15+0000\n"
+"POT-Creation-Date: 2026-02-26 17:34+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,140 +29,148 @@ msgstr "Rechten"
 msgid "Important dates"
 msgstr "Belangrijke datums"
 
-#: core/admin.py:128 core/admin.py:228
+#: core/admin.py:132 core/admin.py:243
 msgid "No owner"
 msgstr "Geen eigenaar"
 
-#: core/admin.py:131 core/admin.py:231
+#: core/admin.py:135 core/admin.py:246
 msgid "Multiple owners"
 msgstr "Meerdere eigenaren"
 
-#: core/admin.py:143
+#: core/admin.py:148
 msgid "Resend notification to external service"
 msgstr "Melding opnieuw verzenden naar externe dienst"
 
-#: core/admin.py:166
+#: core/admin.py:171
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Melding voor opname %(id)s mislukt"
 
-#: core/admin.py:174
+#: core/admin.py:179
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Melding voor opname %(id)s mislukt: %(error)s"
 
-#: core/admin.py:182
+#: core/admin.py:187
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Meldingen succesvol verzonden voor %(count)s opname(n)."
 
-#: core/admin.py:190
+#: core/admin.py:195
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s verlopen opname(n) overgeslagen."
 
-#: core/admin.py:294
+#: core/admin.py:309
 msgid "No scopes"
 msgstr "Geen scopes"
 
-#: core/admin.py:296
+#: core/admin.py:311
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/serializers.py:68
+#: core/api/filters.py:24
+msgid "Creator is me"
+msgstr "Maker ben ik"
+
+#: core/api/serializers.py:84
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."
 
-#: core/models.py:34
+#: core/api/serializers.py:443
+msgid "This file extension is not allowed."
+msgstr "Deze bestandsextensie is niet toegestaan."
+
+#: core/models.py:35
 msgid "Member"
 msgstr "Lid"
 
-#: core/models.py:35
+#: core/models.py:36
 msgid "Administrator"
 msgstr "Beheerder"
 
-#: core/models.py:36
+#: core/models.py:37
 msgid "Owner"
 msgstr "Eigenaar"
 
-#: core/models.py:52
+#: core/models.py:53
 msgid "Initiated"
 msgstr "Gestart"
 
-#: core/models.py:53
+#: core/models.py:54
 msgid "Active"
 msgstr "Actief"
 
-#: core/models.py:54
+#: core/models.py:55
 msgid "Stopped"
 msgstr "Gestopt"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Saved"
 msgstr "Opgeslagen"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Aborted"
 msgstr "Afgebroken"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Failed to Start"
 msgstr "Starten mislukt"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Failed to Stop"
 msgstr "Stoppen mislukt"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Notification succeeded"
 msgstr "Notificatie geslaagd"
 
-#: core/models.py:86
+#: core/models.py:87
 msgid "SCREEN_RECORDING"
 msgstr "SCHERM_OPNAME"
 
-#: core/models.py:87
+#: core/models.py:88
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:93
+#: core/models.py:94
 msgid "Public Access"
 msgstr "Openbare toegang"
 
-#: core/models.py:94
+#: core/models.py:95
 msgid "Trusted Access"
 msgstr "Vertrouwde toegang"
 
-#: core/models.py:95
+#: core/models.py:96
 msgid "Restricted Access"
 msgstr "Beperkte toegang"
 
-#: core/models.py:107
+#: core/models.py:108
 msgid "id"
 msgstr "id"
 
-#: core/models.py:108
+#: core/models.py:109
 msgid "primary key for the record as UUID"
 msgstr "primaire sleutel voor het record als UUID"
 
-#: core/models.py:114
+#: core/models.py:115
 msgid "created on"
 msgstr "aangemaakt op"
 
-#: core/models.py:115
+#: core/models.py:116
 msgid "date and time at which a record was created"
 msgstr "datum en tijd waarop een record werd aangemaakt"
 
-#: core/models.py:120
+#: core/models.py:121
 msgid "updated on"
 msgstr "bijgewerkt op"
 
-#: core/models.py:121
+#: core/models.py:122
 msgid "date and time at which a record was last updated"
 msgstr "datum en tijd waarop een record voor het laatst werd bijgewerkt"
 
-#: core/models.py:141
+#: core/models.py:142
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -170,11 +178,11 @@ msgstr ""
 "Voer een geldige sub in. Deze waarde mag alleen letters, cijfers en @/./+/-/"
 "_ tekens bevatten."
 
-#: core/models.py:147
+#: core/models.py:148
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:149
+#: core/models.py:150
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -182,55 +190,55 @@ msgstr ""
 "Optioneel voor gebruikers in afwachting; vereist bij accountactivering. "
 "Maximum 255 tekens. Alleen letters, cijfers en @/./+/-/_ toegestaan."
 
-#: core/models.py:158
+#: core/models.py:159
 msgid "identity email address"
 msgstr "identiteit e-mailadres"
 
-#: core/models.py:163
+#: core/models.py:164
 msgid "admin email address"
 msgstr "beheerder e-mailadres"
 
-#: core/models.py:165
+#: core/models.py:166
 msgid "full name"
 msgstr "volledige naam"
 
-#: core/models.py:167
+#: core/models.py:168
 msgid "short name"
 msgstr "korte naam"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "language"
 msgstr "taal"
 
-#: core/models.py:174
+#: core/models.py:175
 msgid "The language in which the user wants to see the interface."
 msgstr "De taal waarin de gebruiker de interface wil zien."
 
-#: core/models.py:180
+#: core/models.py:181
 msgid "The timezone in which the user wants to see times."
 msgstr "De tijdzone waarin de gebruiker tijden wil zien."
 
-#: core/models.py:183
+#: core/models.py:184
 msgid "device"
 msgstr "apparaat"
 
-#: core/models.py:185
+#: core/models.py:186
 msgid "Whether the user is a device or a real user."
 msgstr "Of de gebruiker een apparaat is of een echte gebruiker."
 
-#: core/models.py:188
+#: core/models.py:189
 msgid "staff status"
 msgstr "personeelsstatus"
 
-#: core/models.py:190
+#: core/models.py:191
 msgid "Whether the user can log into this admin site."
 msgstr "Of de gebruiker kan inloggen op deze beheersite."
 
-#: core/models.py:193
+#: core/models.py:194
 msgid "active"
 msgstr "actief"
 
-#: core/models.py:196
+#: core/models.py:197
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -238,64 +246,64 @@ msgstr ""
 "Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
 "plaats van accounts te verwijderen."
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "user"
 msgstr "gebruiker"
 
-#: core/models.py:210
+#: core/models.py:211
 msgid "users"
 msgstr "gebruikers"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resource"
 msgstr "Bron"
 
-#: core/models.py:270
+#: core/models.py:271
 msgid "Resources"
 msgstr "Bronnen"
 
-#: core/models.py:324
+#: core/models.py:329
 msgid "Resource access"
 msgstr "Brontoegang"
 
-#: core/models.py:325
+#: core/models.py:330
 msgid "Resource accesses"
 msgstr "Brontoegangsrechten"
 
-#: core/models.py:331
+#: core/models.py:336
 msgid "Resource access with this User and Resource already exists."
 msgstr "Brontoegang met deze gebruiker en bron bestaat al."
 
-#: core/models.py:387
+#: core/models.py:392
 msgid "Visio room configuration"
 msgstr "Visio-ruimteconfiguratie"
 
-#: core/models.py:388
+#: core/models.py:393
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
 
-#: core/models.py:395
+#: core/models.py:400
 msgid "Room PIN code"
 msgstr "Pincode van de kamer"
 
-#: core/models.py:396
+#: core/models.py:401
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
 
-#: core/models.py:402 core/models.py:556
+#: core/models.py:407 core/models.py:561
 msgid "Room"
 msgstr "Ruimte"
 
-#: core/models.py:403
+#: core/models.py:408
 msgid "Rooms"
 msgstr "Ruimtes"
 
-#: core/models.py:567
+#: core/models.py:572
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:569
+#: core/models.py:574
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -303,108 +311,148 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
 
-#: core/models.py:577
+#: core/models.py:582
 msgid "Recording mode"
 msgstr "Opnamemodus"
 
-#: core/models.py:578
+#: core/models.py:583
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."
 
-#: core/models.py:583 core/models.py:584
+#: core/models.py:588 core/models.py:589
 msgid "Recording options"
 msgstr "Opnameopties"
 
-#: core/models.py:590
+#: core/models.py:595
 msgid "Recording"
 msgstr "Opname"
 
-#: core/models.py:591
+#: core/models.py:596
 msgid "Recordings"
 msgstr "Opnames"
 
-#: core/models.py:699
+#: core/models.py:704
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"
 
-#: core/models.py:700
+#: core/models.py:705
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"
 
-#: core/models.py:706
+#: core/models.py:711
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."
 
-#: core/models.py:712
+#: core/models.py:717
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."
 
-#: core/models.py:718
+#: core/models.py:723
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
 
-#: core/models.py:735
+#: core/models.py:740
 msgid "Create rooms"
 msgstr "Ruimtes aanmaken"
 
-#: core/models.py:736
+#: core/models.py:741
 msgid "List rooms"
 msgstr "Ruimtes weergeven"
 
-#: core/models.py:737
+#: core/models.py:742
 msgid "Retrieve room details"
 msgstr "Details van een ruimte ophalen"
 
-#: core/models.py:738
+#: core/models.py:743
 msgid "Update rooms"
 msgstr "Ruimtes bijwerken"
 
-#: core/models.py:739
+#: core/models.py:744
 msgid "Delete rooms"
 msgstr "Ruimtes verwijderen"
 
-#: core/models.py:752
+#: core/models.py:757
 msgid "Application name"
 msgstr "Naam van de applicatie"
 
-#: core/models.py:753
+#: core/models.py:758
 msgid "Descriptive name for this application."
 msgstr "Beschrijvende naam voor deze applicatie."
 
-#: core/models.py:763
+#: core/models.py:768
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."
 
-#: core/models.py:774
+#: core/models.py:779
 msgid "Application"
 msgstr "Applicatie"
 
-#: core/models.py:775
+#: core/models.py:780
 msgid "Applications"
 msgstr "Applicaties"
 
-#: core/models.py:798
+#: core/models.py:803
 msgid "Enter a valid domain"
 msgstr "Voer een geldig domein in"
 
-#: core/models.py:801
+#: core/models.py:806
 msgid "Domain"
 msgstr "Domein"
 
-#: core/models.py:802
+#: core/models.py:807
 msgid "Email domain this application can act on behalf of."
 msgstr "E-maildomein namens welke deze applicatie kan handelen."
 
-#: core/models.py:814
+#: core/models.py:819
 msgid "Application domain"
 msgstr "Applicatiedomein"
 
-#: core/models.py:815
+#: core/models.py:820
 msgid "Application domains"
 msgstr "Applicatiedomeinen"
 
-#: core/recording/event/notification.py:94
+#: core/models.py:838
+msgid "Pending"
+msgstr "In afwachting"
+
+#: core/models.py:846
+msgid "Ready"
+msgstr "Klaar"
+
+#: core/models.py:852
+msgid "Background image"
+msgstr "Achtergrondafbeelding"
+
+#: core/models.py:864
+msgid "title"
+msgstr "Titel"
+
+#: core/models.py:890
+msgid "Malware detection info when the analysis status is unsafe."
+msgstr "Informatie over malwaredetectie wanneer de analysestatus onveilig is."
+
+#: core/models.py:895
+msgid "File"
+msgstr "Bestand"
+
+#: core/models.py:896
+msgid "Files"
+msgstr "Bestanden"
+
+#: core/models.py:970
+msgid "This file is already hard deleted."
+msgstr "Dit bestand is al definitief verwijderd."
+
+#: core/models.py:980
+#, fuzzy
+#| msgid "To hard delete a file, it must first be soft deleted."
+msgid "To hard delete a file, it must first be soft deleted."
+msgstr ""
+"Om een bestand definitief te verwijderen, moet het eerst zacht verwijderd "
+"zijn."
+
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Je opname is klaar"
 
@@ -532,18 +580,18 @@ msgstr ""
 " Als je vragen hebt of hulp nodig hebt, neem dan contact op met ons support "
 "team via %(support_email)s. "
 
-#: meet/settings.py:169
+#: meet/settings.py:224
 msgid "English"
 msgstr "Engels"
 
-#: meet/settings.py:170
+#: meet/settings.py:225
 msgid "French"
 msgstr "Frans"
 
-#: meet/settings.py:171
+#: meet/settings.py:226
 msgid "Dutch"
 msgstr "Nederlands"
 
-#: meet/settings.py:172
+#: meet/settings.py:227
 msgid "German"
 msgstr "Duits"

src/backend/meet/settings.py

@@ -28,6 +28,10 @@ from sentry_sdk.integrations.logging import ignore_logger
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = path.dirname(path.dirname(path.abspath(__file__)))
 
+KB = 1024
+MB = 1024 * KB
+GB = 1024 * MB
+
 
 def get_release():
     """
@@ -121,6 +125,9 @@ class Base(Configuration):
     STATIC_ROOT = path.join(DATA_DIR, "static")
     MEDIA_URL = "/media/"
     MEDIA_ROOT = path.join(DATA_DIR, "media")
+    MEDIA_BASE_URL = values.Value(
+        "", environ_name="MEDIA_BASE_URL", environ_prefix=None
+    )
 
     SITE_ID = 1
 
@@ -154,6 +161,40 @@ class Base(Configuration):
         environ_name="AWS_STORAGE_BUCKET_NAME",
         environ_prefix=None,
     )
+    AWS_S3_SIGNATURE_VERSION = values.Value(
+        "s3v4",
+        environ_name="AWS_S3_SIGNATURE_VERSION",
+        environ_prefix=None,
+    )
+    AWS_S3_UPLOAD_POLICY_EXPIRATION = values.Value(
+        60,  # 1 minute
+        environ_name="AWS_S3_UPLOAD_POLICY_EXPIRATION",
+        environ_prefix=None,
+    )
+    AWS_S3_DOMAIN_REPLACE = values.Value(
+        environ_name="AWS_S3_DOMAIN_REPLACE",
+        environ_prefix=None,
+    )
+
+    FILE_UPLOAD_PATH = values.Value(
+        "files", environ_name="FILE_UPLOAD_PATH", environ_prefix=None
+    )
+
+    FILE_UPLOAD_APPLY_RESTRICTIONS = values.BooleanValue(
+        default=True, environ_name="FILE_UPLOAD_APPLY_RESTRICTIONS", environ_prefix=None
+    )
+
+    FILE_UPLOAD_RESTRICTIONS = values.DictValue(
+        {
+            "background_image": {
+                "max_size": 2 * MB,
+                "allowed_extensions": [".jpeg", ".jpg", ".png"],
+                "allowed_mimetypes": ["image/jpeg", "image/png"],
+            },
+        },
+        environ_name="FILE_UPLOAD_RESTRICTIONS",
+        environ_prefix=None,
+    )
 
     # Internationalization
     # https://docs.djangoproject.com/en/3.1/topics/i18n/
@@ -394,6 +435,9 @@ class Base(Configuration):
     THUMBNAIL_ALIASES = {}
 
     # Celery
+    # Defaults to False to avoid breaking change, async task will be run
+    # synchronously
+    CELERY_ENABLED = values.BooleanValue(False)
     CELERY_BROKER_URL = values.Value("redis://redis:6379/0")
     CELERY_BROKER_TRANSPORT_OPTIONS = values.DictValue({})
 
@@ -596,6 +640,12 @@ class Base(Configuration):
     ALLOW_UNREGISTERED_ROOMS = values.BooleanValue(
         True, environ_name="ALLOW_UNREGISTERED_ROOMS", environ_prefix=None
     )
+    # if provided, treat as suspicious (possible privilege escalation attempt).
+    PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS = values.ListValue(
+        ["hidden", "recorder", "agent"],
+        environ_name="PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS",
+        environ_prefix=None,
+    )
 
     # Recording settings
     RECORDING_ENABLE = values.BooleanValue(

src/backend/pyproject.toml

@@ -2,12 +2,12 @@
 # Meet package
 #
 [build-system]
-requires = ["setuptools"]
-build-backend = "setuptools.build_meta"
+requires = ["uv_build>=0.10.9,<0.11.0"]
+build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.9.0"
+version = "1.10.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -21,8 +21,7 @@ classifiers = [
 ]
 description = "A simple video and phone conferencing tool, powered by LiveKit"
 keywords = ["Django", "Contacts", "Templates", "RBAC"]
-license = { file = "LICENSE" }
-readme = "README.md"
+license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
     "boto3==1.42.49",
@@ -33,13 +32,15 @@ dependencies = [
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
     "django-countries==8.2.0",
+    "django-filter==25.2",
     "django-lasuite[all]==0.0.24",
     "django-parler==2.3",
     "redis==5.2.1",
     "django-redis==6.0.0",
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
-    "django==5.2.11",
+    "django-pydantic-field==0.5.4",
+    "django==5.2.12",
     "djangorestframework==3.16.1",
     "drf_spectacular==0.29.0",
     "dockerflow==2026.1.26",
@@ -50,8 +51,10 @@ dependencies = [
     "markdown==3.10.2",
     "nested-multipart-parser==1.6.0",
     "psycopg[binary]==3.3.2",
+    "pydantic==2.12.4",
     "PyJWT==2.11.0",
     "python-frontmatter==1.1.0",
+    "python-magic==0.4.27",
     "requests==2.32.5",
     "sentry-sdk==2.53.0",
     "whitenoise==6.11.0",
@@ -66,7 +69,7 @@ dependencies = [
 "Homepage" = "https://github.com/suitenumerique/meet"
 "Repository" = "https://github.com/suitenumerique/meet"
 
-[project.optional-dependencies]
+[dependency-groups]
 dev = [
     "django-extensions==4.1",
     "drf-spectacular-sidecar==2026.1.1",
@@ -86,12 +89,13 @@ dev = [
     "types-requests==2.32.4.20260107",
 ]
 
-[tool.setuptools]
-packages = { find = { where = ["."], exclude = ["tests"] } }
-zip-safe = true
-
-[tool.distutils.bdist_wheel]
-universal = true
+[tool.uv.build-backend]
+module-root = ""
+source-exclude = [
+    "**/tests/**",
+    "**/test_*.py",
+    "**/tests.py",
+]
 
 [tool.ruff]
 exclude = [

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.9.0",
+      "version": "1.10.0",
       "dependencies": {
         "@fontsource-variable/material-symbols-outlined": "5.2.34",
         "@fontsource/material-icons-outlined": "5.2.6",
@@ -979,10 +979,11 @@
       }
     },
     "node_modules/@eslint/eslintrc/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -1105,9 +1106,9 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.9",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
-      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
+      "version": "1.19.10",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.10.tgz",
+      "integrity": "sha512-hZ7nOssGqRgyV3FVVQdfi+U4q02uB23bpnYpdvNXkYTRRyWx84b7yf1ans+dnJ/7h41sGL3CeQTfO+ZGxuO+Iw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1143,10 +1144,11 @@
       }
     },
     "node_modules/@humanwhocodes/config-array/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -4493,33 +4495,10 @@
         "tinyglobby": "^0.2.14"
       }
     },
-    "node_modules/@ts-morph/common/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/@ts-morph/common/node_modules/brace-expansion": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
-      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/@ts-morph/common/node_modules/minimatch": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.2.tgz",
-      "integrity": "sha512-+G4CpNBxa5MprY+04MbgOw1v7So6n5JY166pFi9KfYwT78fxScCeSNQSNzp6dpPSW2rONOps6Ocam1wFhCgoVw==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -5414,13 +5393,26 @@
       "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="
     },
     "node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/brace-expansion/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/braces": {
@@ -6608,9 +6600,9 @@
       }
     },
     "node_modules/eslint-plugin-jsx-a11y/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -6734,10 +6726,11 @@
       }
     },
     "node_modules/eslint/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -7391,9 +7384,10 @@
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -8789,9 +8783,10 @@
       }
     },
     "node_modules/matcher-collection/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -8891,13 +8886,13 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.8",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.8.tgz",
+      "integrity": "sha512-reYkDYtj/b19TeqbNZCV4q9t+Yxylf/rYBsLb42SXJatTv4/ylq5lEiAmhA/IToxO7NI2UzNMghHoHuaqDkAjw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -11879,9 +11874,10 @@
       }
     },
     "node_modules/walk-sync/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.9.0",
+  "version": "1.10.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/src/App.tsx

@@ -4,7 +4,7 @@ import { Suspense } from 'react'
 import { ReactQueryDevtools } from '@tanstack/react-query-devtools'
 import { QueryClientProvider } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
-import { useLang } from 'hoofd'
+import { useTitle } from 'hoofd'
 import { Switch, Route } from 'wouter'
 import { I18nProvider } from 'react-aria-components'
 import { Layout } from './layout/Layout'
@@ -17,7 +17,7 @@ import { useIsSdkContext } from '@/features/sdk/hooks/useIsSdkContext'
 
 function App() {
   const { i18n } = useTranslation()
-  useLang(i18n.language)
+  useTitle(import.meta.env.VITE_APP_TITLE ?? '')
 
   const isSDKContext = useIsSdkContext()
 

src/frontend/src/features/home/components/MoreLink.tsx

@@ -2,23 +2,25 @@ import { A, Text } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { useConfig } from '@/api/useConfig'
 
+const appTitle = import.meta.env.VITE_APP_TITLE ?? 'LaSuite Meet'
+
 export const MoreLink = () => {
   const { t } = useTranslation('home')
   const { data } = useConfig()
 
-  if (!data?.manifest_link) return
+  if (!data?.manifest_link) return null
 
   return (
-    <Text as={'p'} variant={'sm'} style={{ padding: '1rem 0' }}>
+    <Text as="p" variant="sm" style={{ padding: '1rem 0' }}>
       <A
         href={data?.manifest_link}
         target="_blank"
         rel="noopener noreferrer"
-        aria-label={t('moreLinkLabel')}
+        externalIcon
+        aria-label={t('moreLinkLabel', { appTitle })}
       >
-        {t('moreLink')}
-      </A>{' '}
-      {t('moreAbout', { appTitle: `${import.meta.env.VITE_APP_TITLE}` })}
+        {t('moreLink')} {t('moreAbout', { appTitle })}
+      </A>
     </Text>
   )
 }

src/frontend/src/features/home/routes/Home.tsx

@@ -258,23 +258,10 @@ export const Home = () => {
               </DialogTrigger>
             </div>
             <Separator />
-            <div
-              className={css({
-                display: { base: 'none', lg: 'inline' },
-              })}
-            >
-              <MoreLink />
-            </div>
+            <MoreLink />
           </LeftColumn>
           <RightColumn>
             <IntroSlider />
-            <div
-              className={css({
-                display: { base: 'inline', lg: 'none' },
-              })}
-            >
-              <MoreLink />
-            </div>
           </RightColumn>
         </Columns>
         <LaterMeetingDialog

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -18,10 +18,15 @@ import {
   ANIMATION_DURATION,
   ReactionPortals,
 } from '@/features/rooms/livekit/components/ReactionPortal'
+import { layoutStore } from '@/stores/layout'
+import { PanelId } from '@/features/rooms/livekit/hooks/useSidePanel'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
 
 export const MainNotificationToast = () => {
   const room = useRoomContext()
   const { triggerNotificationSound } = useNotificationSound()
+  const { t } = useTranslation('notifications')
+  const announce = useScreenReaderAnnounce()
 
   const [reactions, setReactions] = useState<Reaction[]>([])
   const instanceIdRef = useRef(0)
@@ -41,12 +46,21 @@ export const MainNotificationToast = () => {
         },
         { timeout: NotificationDuration.MESSAGE }
       )
+      if (layoutStore.activePanelId !== PanelId.CHAT) {
+        announce(
+          t('chatMessageReceived', {
+            name: participant.name || t('defaultName'),
+            message: chatMessage.message,
+          }),
+          'polite'
+        )
+      }
     }
     room.on(RoomEvent.ChatMessage, handleChatMessage)
     return () => {
       room.off(RoomEvent.ChatMessage, handleChatMessage)
     }
-  }, [room, triggerNotificationSound])
+  }, [room, triggerNotificationSound, announce, t])
 
   const handleEmoji = (emoji: string, participant: Participant) => {
     if (!emoji || !Object.values(Emoji).includes(emoji as Emoji)) return

src/frontend/src/features/recording/components/NoAccessView.tsx

@@ -79,11 +79,20 @@ export const NoAccessView = ({
           })}
         >
           {t(`${i18nKey}.body`)}
-          <br />
           {helpArticle && (
-            <A href={helpArticle} target="_blank">
-              {t(`${i18nKey}.linkMore`)}
-            </A>
+            <>
+              {' '}
+              <A
+                href={helpArticle}
+                target="_blank"
+                rel="noopener noreferrer"
+                externalIcon
+                color="note"
+                aria-label={t(`${i18nKey}.linkAriaLabel`)}
+              >
+                {t(`${i18nKey}.linkMore`)}
+              </A>
+            </>
           )}
         </Text>
       </VStack>

src/frontend/src/features/recording/components/ScreenRecordingSidePanel.tsx

@@ -151,12 +151,16 @@ export const ScreenRecordingSidePanel = () => {
         </H>
         <Text variant="body" fullWidth>
           {recordingMaxDuration
-            ? t('body', {
-                max_duration: recordingMaxDuration,
-              })
+            ? t('body', { max_duration: recordingMaxDuration })
             : t('bodyWithoutMaxDuration')}{' '}
           {data?.support?.help_article_recording && (
-            <A href={data.support.help_article_recording} target="_blank">
+            <A
+              href={data.support.help_article_recording}
+              target="_blank"
+              rel="noopener noreferrer"
+              externalIcon
+              aria-label={t('linkAriaLabel')}
+            >
               {t('linkMore')}
             </A>
           )}

src/frontend/src/features/recording/components/TranscriptSidePanel.tsx

@@ -187,12 +187,16 @@ export const TranscriptSidePanel = () => {
         </H>
         <Text variant="body" fullWidth>
           {recordingMaxDuration
-            ? t('body', {
-                max_duration: recordingMaxDuration,
-              })
+            ? t('body', { max_duration: recordingMaxDuration })
             : t('bodyWithoutMaxDuration')}{' '}
           {data?.support?.help_article_transcript && (
-            <A href={data.support.help_article_transcript} target="_blank">
+            <A
+              href={data.support.help_article_transcript}
+              target="_blank"
+              rel="noopener noreferrer"
+              externalIcon
+              aria-label={t('linkAriaLabel')}
+            >
               {t('linkMore')}
             </A>
           )}
@@ -208,6 +212,7 @@ export const TranscriptSidePanel = () => {
                   href={data.transcription_destination}
                   target="_blank"
                   rel="noopener noreferrer"
+                  externalIcon
                 >
                   {data.transcription_destination.replace('https://', '')}
                 </A>

src/frontend/src/features/rooms/components/InviteDialog.tsx

@@ -65,7 +65,7 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
           alignItems="left"
           justify="start"
           gap={0}
-          style={{ maxWidth: '100%', overflow: 'hidden' }}
+          style={{ maxWidth: '100%', overflow: 'visible' }}
         >
           <Heading slot="title" level={2} className={text({ variant: 'h2' })}>
             {t('heading')}
@@ -93,7 +93,7 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
                 flexDirection: 'column',
                 marginTop: '0.5rem',
                 gap: '1rem',
-                overflow: 'hidden',
+                overflow: 'visible',
               })}
             >
               <div

src/frontend/src/features/rooms/components/Join.tsx

@@ -753,7 +753,7 @@ export const Join = ({
                     try {
                       saveVideoInputDeviceId(id)
                       if (videoTrack) {
-                        await await videoTrack.setDeviceId({ exact: id })
+                        await videoTrack.setDeviceId({ exact: id })
                       }
                     } catch (err) {
                       console.error('Failed to switch camera device', err)

src/frontend/src/features/rooms/components/Rating.tsx

@@ -4,7 +4,7 @@ import { cva } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'
 import { styled, VStack } from '@/styled-system/jsx'
 import { usePostHog } from 'posthog-js/react'
-import { PostHog } from 'posthog-js'
+import type { PostHog } from 'posthog-js'
 import { Button as RACButton } from 'react-aria-components'
 import { useIsAnalyticsEnabled } from '@/features/analytics/hooks/useIsAnalyticsEnabled'
 

src/frontend/src/features/rooms/hooks/useWaitingParticipants.ts

@@ -74,13 +74,17 @@ export const useWaitingParticipants = () => {
   ): Promise<void> => {
     try {
       setListEnabled(false)
-      for (const participant of waitingParticipants) {
-        await enterRoom({
-          roomId: roomId,
-          allowEntry,
-          participantId: participant.id,
-        })
-      }
+
+      await Promise.all(
+        waitingParticipants.map((participant) =>
+          enterRoom({
+            roomId: roomId,
+            allowEntry,
+            participantId: participant.id,
+          })
+        )
+      )
+
       await refetchWaiting()
     } catch (e) {
       console.error(e)

src/frontend/src/features/rooms/livekit/components/IsIdleDisconnectModal.tsx

@@ -13,7 +13,7 @@ import { useSettingsDialog } from '@/features/settings/hook/useSettingsDialog'
 import { SettingsDialogExtendedKey } from '@/features/settings/type'
 
 const IDLE_DISCONNECT_TIMEOUT_MS = 120000 // 2 minutes
-const COUNTDOWN_ANNOUNCEMENT_SECONDS = [90, 60, 30]
+const COUNTDOWN_ANNOUNCEMENT_SECONDS = new Set([90, 60, 30])
 const FINAL_COUNTDOWN_SECONDS = 10
 
 export const IsIdleDisconnectModal = () => {
@@ -58,7 +58,7 @@ export const IsIdleDisconnectModal = () => {
     if (!connectionObserverSnap.isIdleDisconnectModalOpen) return
 
     const shouldAnnounce =
-      COUNTDOWN_ANNOUNCEMENT_SECONDS.includes(remainingSeconds) ||
+      COUNTDOWN_ANNOUNCEMENT_SECONDS.has(remainingSeconds) ||
       remainingSeconds <= FINAL_COUNTDOWN_SECONDS
 
     if (shouldAnnounce && remainingSeconds !== lastAnnouncementRef.current) {

src/frontend/src/features/rooms/livekit/components/KeyboardShortcutHint.tsx

@@ -1,5 +1,28 @@
 import React, { ReactNode } from 'react'
-import { css } from '@/styled-system/css'
+import { styled } from '@/styled-system/jsx'
+
+const Hint = styled('div', {
+  base: {
+    position: 'absolute',
+    top: '0.75rem',
+    right: '0.75rem',
+    backgroundColor: 'rgba(0,0,0,0.5)',
+    color: 'white',
+    borderRadius: 'calc(var(--lk-border-radius) / 2)',
+    paddingInline: '0.5rem',
+    paddingBlock: '0.1rem',
+    fontSize: '0.875rem',
+    opacity: 0,
+    visibility: 'hidden',
+    pointerEvents: 'none',
+    transition: 'opacity 150ms ease',
+    '.lk-grid-layout > *:first-child:focus-within &': {
+      opacity: 1,
+      visibility: 'visible',
+      pointerEvents: 'auto',
+    },
+  },
+})
 
 export interface KeyboardShortcutHintProps {
   children: ReactNode
@@ -12,21 +35,5 @@ export interface KeyboardShortcutHintProps {
 export const KeyboardShortcutHint: React.FC<KeyboardShortcutHintProps> = ({
   children,
 }) => {
-  return (
-    <div
-      className={css({
-        position: 'absolute',
-        top: '0.75rem',
-        right: '0.75rem',
-        backgroundColor: 'rgba(0,0,0,0.5)',
-        color: 'white',
-        borderRadius: 'calc(var(--lk-border-radius) / 2)',
-        paddingInline: '0.5rem',
-        paddingBlock: '0.1rem',
-        fontSize: '0.875rem',
-      })}
-    >
-      {children}
-    </div>
-  )
+  return <Hint>{children}</Hint>
 }

src/frontend/src/features/rooms/livekit/components/ParticipantName.tsx

@@ -1,8 +1,21 @@
+import type { CSSProperties } from 'react'
 import { Text } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { useParticipantInfo } from '@livekit/components-react'
 import { Participant } from 'livekit-client'
 
+const participantNameStyles: CSSProperties = {
+  paddingBottom: '0.1rem',
+  overflow: 'hidden',
+  textOverflow: 'ellipsis',
+  whiteSpace: 'nowrap',
+}
+
+const participantNameScreenShareStyles: CSSProperties = {
+  ...participantNameStyles,
+  marginLeft: '0.4rem',
+}
+
 export const ParticipantName = ({
   participant,
   isScreenShare = false,
@@ -17,26 +30,14 @@ export const ParticipantName = ({
 
   if (isScreenShare) {
     return (
-      <Text
-        variant="sm"
-        style={{
-          paddingBottom: '0.1rem',
-          marginLeft: '0.4rem',
-        }}
-      >
+      <Text variant="sm" style={participantNameScreenShareStyles}>
         {t('screenShare', { name: displayedName })}
       </Text>
     )
   }
 
   return (
-    <Text
-      variant="sm"
-      style={{
-        paddingBottom: '0.1rem',
-      }}
-      aria-hidden="true"
-    >
+    <Text variant="sm" style={participantNameStyles} aria-hidden="true">
       {displayedName}
     </Text>
   )

src/frontend/src/features/rooms/livekit/components/ParticipantTile.tsx

@@ -183,7 +183,7 @@ export const ParticipantTile: (
                       }}
                     >
                       {isHandRaised && !isScreenShare && (
-                        <>
+                        <span>
                           <span>{positionInQueue}</span>
                           <RiHand
                             color="black"
@@ -197,7 +197,7 @@ export const ParticipantTile: (
                               animationIterationCount: '2',
                             }}
                           />
-                        </>
+                        </span>
                       )}
                       {isScreenShare && (
                         <ScreenShareIcon
@@ -210,10 +210,12 @@ export const ParticipantTile: (
                       {isEncrypted && !isScreenShare && (
                         <LockLockedIcon style={{ marginRight: '0.25rem' }} />
                       )}
-                      <ParticipantName
-                        isScreenShare={isScreenShare}
-                        participant={trackReference.participant}
-                      />
+                      <div className="lk-participant-name-wrapper">
+                        <ParticipantName
+                          isScreenShare={isScreenShare}
+                          participant={trackReference.participant}
+                        />
+                      </div>
                     </div>
                   </HStack>
                   <ConnectionQualityIndicator className="lk-participant-metadata-item" />
@@ -229,9 +231,7 @@ export const ParticipantTile: (
           )}
         </ParticipantContextIfNeeded>
       </TrackRefContextIfNeeded>
-      {hasKeyboardFocus && (
-        <KeyboardShortcutHint>{t('toolbarHint')}</KeyboardShortcutHint>
-      )}
+      <KeyboardShortcutHint>{t('toolbarHint')}</KeyboardShortcutHint>
     </div>
   )
 })

src/frontend/src/features/rooms/livekit/components/ReactionPortal.tsx

@@ -102,6 +102,11 @@ export function FloatingReaction({
             paddingTop: '0.15rem',
             boxShadow: '0 2px 4px rgba(0, 0, 0, 0.1)',
             lineHeight: '16px',
+            maxWidth: '12rem',
+            display: 'inline-block',
+            overflow: 'hidden',
+            textOverflow: 'ellipsis',
+            whiteSpace: 'nowrap',
           })}
         >
           {name}

src/frontend/src/features/rooms/livekit/components/Tools.tsx

@@ -148,17 +148,22 @@ export const Tools = () => {
         className={css({
           textStyle: 'sm',
           paddingX: '0.75rem',
+          paddingTop: '0.25rem',
           marginBottom: '1rem',
         })}
       >
         {t('body')}{' '}
         {data?.support?.help_article_more_tools && (
-          <>
-            <A href={data?.support?.help_article_more_tools} target="_blank">
-              {t('moreLink')}
-            </A>
-            .
-          </>
+          <A
+            href={data.support.help_article_more_tools}
+            target="_blank"
+            rel="noopener noreferrer"
+            externalIcon
+            color="note"
+            aria-label={t('linkAriaLabel')}
+          >
+            {t('moreLink')}
+          </A>
         )}
       </Text>
       {isTranscriptEnabled && (

src/frontend/src/features/rooms/livekit/components/controls/ToolsToggle.tsx

@@ -4,6 +4,7 @@ import { useTranslation } from 'react-i18next'
 import { useSidePanel } from '../../hooks/useSidePanel'
 import { css } from '@/styled-system/css'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
 
 export const ToolsToggle = ({
   variant = 'primaryTextDark',
@@ -15,6 +16,11 @@ export const ToolsToggle = ({
   const { isToolsOpen, toggleTools } = useSidePanel()
   const tooltipLabel = isToolsOpen ? 'open' : 'closed'
 
+  useRegisterKeyboardShortcut({
+    id: 'recording',
+    handler: toggleTools,
+  })
+
   return (
     <div
       className={css({

src/frontend/src/features/rooms/livekit/hooks/useRoomPageTitle.ts

@@ -0,0 +1,28 @@
+import { useTitle } from 'hoofd'
+import { useRoomData } from './useRoomData'
+import { useMemo } from 'react'
+
+const APP_TITLE = import.meta.env.VITE_APP_TITLE ?? ''
+
+/**
+ * Updates the browser tab title with the room name to help users easily find
+ * the meeting tab among many open tabs. Works on both the join screen and
+ * once connected.
+ */
+export const useRoomPageTitle = () => {
+  const roomData = useRoomData()
+
+  const pageTitle = useMemo(() => {
+    if (!roomData) {
+      return APP_TITLE
+    }
+
+    const roomLabel = roomData.name || roomData.slug || ''
+
+    if (!roomLabel) return APP_TITLE
+
+    return `${APP_TITLE} - ${roomLabel}  `
+  }, [roomData])
+
+  useTitle(pageTitle)
+}

src/frontend/src/features/rooms/livekit/prefabs/Chat.tsx

@@ -151,7 +151,12 @@ export function Chat({ ...props }: ChatProps) {
         minHeight={0}
         overflowY="scroll"
       >
-        <ul className="lk-list lk-chat-messages" ref={ulRef}>
+        <ul
+          className="lk-list lk-chat-messages"
+          ref={ulRef}
+          role="log"
+          aria-relevant="additions"
+        >
           {renderedMessages}
         </ul>
       </Div>

src/frontend/src/features/rooms/livekit/prefabs/ControlBar/DesktopControlBar.tsx

@@ -12,6 +12,7 @@ import { StartMediaButton } from '../../components/controls/StartMediaButton'
 import { MoreOptions } from './MoreOptions'
 import { useRef } from 'react'
 import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import { useFullScreen } from '../../hooks/useFullScreen'
 import { VideoDeviceControl } from '../../components/controls/Device/VideoDeviceControl'
 import { AudioDevicesControl } from '../../components/controls/Device/AudioDevicesControl'
 
@@ -21,6 +22,8 @@ export function DesktopControlBar({
   const browserSupportsScreenSharing = supportsScreenSharing()
   const desktopControlBarEl = useRef<HTMLDivElement>(null)
 
+  const { toggleFullScreen, isFullscreenAvailable } = useFullScreen({})
+
   useRegisterKeyboardShortcut({
     id: 'focus-toolbar',
     handler: () => {
@@ -32,6 +35,13 @@ export function DesktopControlBar({
       firstButton?.focus()
     },
   })
+
+  useRegisterKeyboardShortcut({
+    id: 'fullscreen',
+    handler: toggleFullScreen,
+    isDisabled: !isFullscreenAvailable,
+  })
+
   return (
     <div
       ref={desktopControlBarEl}

src/frontend/src/features/rooms/livekit/prefabs/VideoConference.tsx

@@ -30,7 +30,11 @@ import { useSidePanel } from '../hooks/useSidePanel'
 import { RecordingProvider } from '@/features/recording'
 import { ScreenShareErrorModal } from '../components/ScreenShareErrorModal'
 import { useConnectionObserver } from '../hooks/useConnectionObserver'
+import { useRoomPageTitle } from '../hooks/useRoomPageTitle'
 import { useNoiseReduction } from '../hooks/useNoiseReduction'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import { useSettingsDialog } from '@/features/settings'
+import { SettingsDialogExtendedKey } from '@/features/settings/type'
 import { useVideoResolutionSubscription } from '../hooks/useVideoResolutionSubscription'
 import { SettingsDialogProvider } from '@/features/settings/components/SettingsDialogProvider'
 import { useSubtitles } from '@/features/subtitle/hooks/useSubtitles'
@@ -97,6 +101,7 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
   const { t: tRooms } = useTranslation('rooms')
   const room = useRoomContext()
   const announce = useScreenReaderAnnounce()
+  const { toggleSettingsDialog } = useSettingsDialog()
 
   const getAnnouncementName = useCallback(
     (participant?: Participant | null) => {
@@ -109,8 +114,16 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
   )
 
   useConnectionObserver()
+  useRoomPageTitle()
   useVideoResolutionSubscription()
 
+  useRegisterKeyboardShortcut({
+    id: 'open-shortcuts',
+    handler: useCallback(() => {
+      toggleSettingsDialog(SettingsDialogExtendedKey.SHORTCUTS)
+    }, [toggleSettingsDialog]),
+  })
+
   const tracks = useTracks(
     [
       { source: Track.Source.Camera, withPlaceholder: true },

src/frontend/src/features/rooms/utils/isRoomValid.ts

@@ -4,8 +4,10 @@ export const roomIdPattern = '[a-z]{3}-[a-z]{4}-[a-z]{3}'
 export const flexibleRoomIdPattern =
   '(?:[a-zA-Z0-9]{3}-?[a-zA-Z0-9]{4}-?[a-zA-Z0-9]{3})'
 
+const roomRegex = new RegExp(`^${roomIdPattern}$`)
+
 export const isRoomValid = (roomIdOrUrl: string) =>
-  new RegExp(`^${roomIdPattern}$`).test(roomIdOrUrl) ||
+  roomRegex.test(roomIdOrUrl) ||
   new RegExp(`^${window.location.origin}/${roomIdPattern}$`).test(roomIdOrUrl)
 
 export const normalizeRoomId = (roomId: string) => {

src/frontend/src/features/settings/components/tabs/AccessibilityTab.tsx

@@ -4,6 +4,7 @@ import { css } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'
 import { useSnapshot } from 'valtio'
 import { accessibilityStore } from '@/stores/accessibility'
+import { CaptionsSettings } from '@/features/subtitle/component/CaptionsSettings'
 
 export type AccessibilityTabProps = Pick<TabPanelProps, 'id'>
 
@@ -32,6 +33,7 @@ export const AccessibilityTab = ({ id }: AccessibilityTabProps) => {
             wrapperProps={{ noMargin: true, fullWidth: true }}
           />
         </li>
+        <CaptionsSettings />
       </ul>
     </TabPanel>
   )

src/frontend/src/features/settings/components/tabs/ShortcutTab.tsx

@@ -3,15 +3,20 @@ import { ShortcutRow } from '@/features/shortcuts/components/ShortcutRow'
 import { css } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'
 import { TabPanel, type TabPanelProps } from '@/primitives/Tabs'
-import { H } from '@/primitives'
 
 const tableStyle = css({
   width: '100%',
   borderCollapse: 'collapse',
   overflowY: 'auto',
+  '& caption': {
+    fontWeight: 'bold',
+    marginBottom: '0.75rem',
+    textAlign: 'left',
+  },
   '& th, & td': {
     padding: '0.65rem 0',
     textAlign: 'left',
+    fontWeight: 'normal',
   },
   '& tbody tr': {
     borderBottom: '1px solid rgba(255,255,255,0.08)',
@@ -29,12 +34,11 @@ export const ShortcutTab = ({ id }: Pick<TabPanelProps, 'id'>) => {
       className={css({
         display: 'flex',
         flexDirection: 'column',
-        gap: '0.75rem',
       })}
     >
-      <H lvl={2}>{t('shortcuts.listLabel')}</H>
       <table className={tableStyle}>
-        <thead className="sr-only">
+        <caption>{t('shortcuts.listLabel')}</caption>
+        <thead>
           <tr>
             <th scope="col">{t('shortcuts.columnAction')}</th>
             <th scope="col">{t('shortcuts.columnShortcut')}</th>

src/frontend/src/features/settings/components/tabs/VideoTab.tsx

@@ -4,7 +4,7 @@ import { TabPanel, TabPanelProps } from '@/primitives/Tabs'
 import { useMediaDeviceSelect, useRoomContext } from '@livekit/components-react'
 import { useTranslation } from 'react-i18next'
 import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePersistentUserChoices'
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useMemo, useState } from 'react'
 import { css } from '@/styled-system/css'
 import {
   createLocalVideoTrack,
@@ -22,6 +22,8 @@ export type VideoTabProps = Pick<DialogProps, 'onOpenChange'> &
 
 type DeviceItems = Array<{ value: string; label: string }>
 
+const EMPTY_PROPS = {}
+
 export const VideoTab = ({ id }: VideoTabProps) => {
   const { t } = useTranslation('settings', { keyPrefix: 'video' })
   const { localParticipant, remoteParticipants } = useRoomContext()
@@ -59,7 +61,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
   const isCamEnabled = devicesIn?.length > 0
 
   const disabledProps = isCamEnabled
-    ? {}
+    ? EMPTY_PROPS
     : {
         placeholder: t('permissionsRequired'),
         isDisabled: true,
@@ -117,6 +119,40 @@ export const VideoTab = ({ id }: VideoTabProps) => {
     }
   }, [videoDeviceId, videoElement])
 
+  const resolutionItems = useMemo(() => {
+    return [
+      {
+        value: 'h720',
+        label: `${t('resolution.publish.items.high')} (720p)`,
+      },
+      {
+        value: 'h360',
+        label: `${t('resolution.publish.items.medium')} (360p)`,
+      },
+      {
+        value: 'h180',
+        label: `${t('resolution.publish.items.low')} (180p)`,
+      },
+    ]
+  }, [t])
+
+  const videoQualityItems = useMemo(() => {
+    return [
+      {
+        value: VideoQuality.HIGH.toString(),
+        label: t('resolution.subscribe.items.high'),
+      },
+      {
+        value: VideoQuality.MEDIUM.toString(),
+        label: t('resolution.subscribe.items.medium'),
+      },
+      {
+        value: VideoQuality.LOW.toString(),
+        label: t('resolution.subscribe.items.low'),
+      },
+    ]
+  }, [t])
+
   return (
     <TabPanel padding={'md'} flex id={id}>
       <RowWrapper heading={t('camera.heading')}>
@@ -178,20 +214,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
         <Field
           type="select"
           label={t('resolution.publish.label')}
-          items={[
-            {
-              value: 'h720',
-              label: `${t('resolution.publish.items.high')} (720p)`,
-            },
-            {
-              value: 'h360',
-              label: `${t('resolution.publish.items.medium')} (360p)`,
-            },
-            {
-              value: 'h180',
-              label: `${t('resolution.publish.items.low')} (180p)`,
-            },
-          ]}
+          items={resolutionItems}
           selectedKey={videoPublishResolution}
           onSelectionChange={async (key) => {
             await handleVideoResolutionChange(key as VideoResolution)
@@ -206,20 +229,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
         <Field
           type="select"
           label={t('resolution.subscribe.label')}
-          items={[
-            {
-              value: VideoQuality.HIGH.toString(),
-              label: t('resolution.subscribe.items.high'),
-            },
-            {
-              value: VideoQuality.MEDIUM.toString(),
-              label: t('resolution.subscribe.items.medium'),
-            },
-            {
-              value: VideoQuality.LOW.toString(),
-              label: t('resolution.subscribe.items.low'),
-            },
-          ]}
+          items={videoQualityItems}
           selectedKey={videoSubscribeQuality?.toString()}
           onSelectionChange={(key) => {
             if (key == undefined) return

src/frontend/src/features/settings/hook/useSettingsDialog.ts

@@ -14,7 +14,25 @@ export const useSettingsDialog = () => {
     settingsStore.areSettingsOpen = true
   }
 
+  const closeSettingsDialog = () => {
+    settingsStore.areSettingsOpen = false
+  }
+
+  const toggleSettingsDialog = (
+    defaultSelectedTab?: SettingsDialogExtendedKey
+  ) => {
+    if (areSettingsOpen) {
+      closeSettingsDialog()
+    } else {
+      if (defaultSelectedTab)
+        settingsStore.defaultSelectedTab = defaultSelectedTab
+      settingsStore.areSettingsOpen = true
+    }
+  }
+
   return {
     openSettingsDialog,
+    closeSettingsDialog,
+    toggleSettingsDialog,
   }
 }

src/frontend/src/features/shortcuts/catalog.ts

@@ -5,6 +5,7 @@ import { Shortcut } from './types'
 export type ShortcutCategory = 'navigation' | 'media' | 'interaction'
 
 export type ShortcutId =
+  | 'open-shortcuts'
   | 'focus-toolbar'
   | 'toggle-microphone'
   | 'toggle-camera'
@@ -29,6 +30,11 @@ export type ShortcutDescriptor = {
 }
 
 export const shortcutCatalog: ShortcutDescriptor[] = [
+  {
+    id: 'open-shortcuts',
+    category: 'navigation',
+    shortcut: { key: '/', ctrlKey: true, shiftKey: true },
+  },
   {
     id: 'focus-toolbar',
     category: 'navigation',

src/frontend/src/features/shortcuts/components/ShortcutBadge.tsx

@@ -25,9 +25,9 @@ export const ShortcutBadge: React.FC<ShortcutBadgeProps> = ({
 }) => {
   return (
     <>
-      <div className={cx(badgeStyle, className)} aria-hidden="true">
-        <span>{visualLabel}</span>
-      </div>
+      <kbd className={cx(badgeStyle, className)} aria-hidden="true">
+        {visualLabel}
+      </kbd>
       {srLabel && <span className="sr-only">{srLabel}</span>}
     </>
   )

src/frontend/src/features/shortcuts/components/ShortcutRow.tsx

@@ -31,9 +31,9 @@ export const ShortcutRow: React.FC<ShortcutRowProps> = ({ descriptor }) => {
 
   return (
     <tr>
-      <td className={text({ variant: 'body' })}>
+      <th scope="row" className={text({ variant: 'body' })}>
         {t(`actions.${descriptor.id}`)}
-      </td>
+      </th>
       <td className={shortcutCellStyle}>
         <ShortcutBadge visualLabel={visualShortcut} srLabel={srShortcut} />
       </td>

src/frontend/src/features/shortcuts/useKeyboardShortcuts.ts

@@ -19,7 +19,10 @@ export const useKeyboardShortcuts = () => {
         shiftKey,
         altKey,
       })
-      const shortcut = shortcutsSnap.shortcuts.get(shortcutKey)
+      let shortcut = shortcutsSnap.shortcuts.get(shortcutKey)
+      if (!shortcut && shortcutKey === 'ctrl+shift+?') {
+        shortcut = shortcutsSnap.shortcuts.get('ctrl+shift+/')
+      }
       if (!shortcut) return
       e.preventDefault()
       await shortcut()

src/frontend/src/features/subtitle/component/CaptionsSettings.tsx

@@ -0,0 +1,49 @@
+import { Field, H } from '@/primitives'
+import { css } from '@/styled-system/css'
+import { useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useSnapshot } from 'valtio'
+import {
+  accessibilityStore,
+  type CaptionTextSize,
+  CAPTION_TEXT_SIZE_OPTIONS,
+} from '@/stores/accessibility'
+
+export const CaptionsSettings = () => {
+  const { t } = useTranslation('settings', {
+    keyPrefix: 'accessibility.captions',
+  })
+  const snap = useSnapshot(accessibilityStore)
+
+  const captionTextSizeItems = useMemo(
+    () =>
+      CAPTION_TEXT_SIZE_OPTIONS.map((size) => ({
+        value: size,
+        label: t(`textSize.options.${size}`),
+      })),
+    [t]
+  )
+
+  return (
+    <li>
+      <H
+        lvl={3}
+        className={css({
+          marginBottom: '0.5rem',
+        })}
+      >
+        {t('heading')}
+      </H>
+      <Field
+        type="select"
+        label={t('textSize.label')}
+        items={captionTextSizeItems}
+        selectedKey={snap.captionTextSize}
+        onSelectionChange={(key) => {
+          accessibilityStore.captionTextSize = key as CaptionTextSize
+        }}
+        wrapperProps={{ noMargin: true, fullWidth: true }}
+      />
+    </li>
+  )
+}

src/frontend/src/features/subtitle/component/Subtitles.tsx

@@ -8,6 +8,25 @@ import { useRoomContext } from '@livekit/components-react'
 import { getParticipantColor } from '@/features/rooms/utils/getParticipantColor'
 import { getParticipantName } from '@/features/rooms/utils/getParticipantName'
 import { Participant, RoomEvent } from 'livekit-client'
+import { useSnapshot } from 'valtio'
+import {
+  accessibilityStore,
+  CAPTION_TEXT_SIZE_OPTIONS,
+  type CaptionTextSize,
+} from '@/stores/accessibility'
+
+const FONT_SIZE_CONFIG: Record<
+  CaptionTextSize,
+  { fontSize: string; lineHeight: string }
+> = {
+  small: { fontSize: '0.875rem', lineHeight: '1.2rem' },
+  medium: { fontSize: '1.5rem', lineHeight: '1.7rem' },
+  large: { fontSize: '2.25rem', lineHeight: '2.5rem' },
+}
+
+const CAPTION_FONT_SIZES = Object.fromEntries(
+  CAPTION_TEXT_SIZE_OPTIONS.map((size) => [size, FONT_SIZE_CONFIG[size]])
+) as Record<CaptionTextSize, { fontSize: string; lineHeight: string }>
 
 export interface TranscriptionSegment {
   id: string
@@ -73,8 +92,10 @@ const useTranscriptionState = () => {
 }
 
 const Transcription = ({ row }: { row: TranscriptionRow }) => {
+  const { captionTextSize } = useSnapshot(accessibilityStore)
   const participantColor = getParticipantColor(row.participant)
   const participantName = getParticipantName(row.participant)
+  const { fontSize, lineHeight } = CAPTION_FONT_SIZES[captionTextSize]
 
   const getDisplayText = (row: TranscriptionRow): string => {
     return row.segments
@@ -116,10 +137,9 @@ const Transcription = ({ row }: { row: TranscriptionRow }) => {
           </Text>
           <p
             className={css({
-              fontSize: '1.5rem',
-              lineHeight: '1.7rem',
               fontWeight: '400',
             })}
+            style={{ fontSize, lineHeight }}
           >
             {displayText}
           </p>
@@ -198,7 +218,6 @@ export const Subtitles = () => {
         )
       }
     }
-
     return rows
   }, [transcriptionSegments])
 

src/frontend/src/i18n/init.ts

@@ -3,6 +3,7 @@ import resourcesToBackend from 'i18next-resources-to-backend'
 import { initReactI18next } from 'react-i18next'
 import LanguageDetector from 'i18next-browser-languagedetector'
 const i18nDefaultNamespace = 'global'
+const fallbackLng = 'fr'
 
 i18n.setDefaultNamespace(i18nDefaultNamespace)
 i18n
@@ -15,7 +16,7 @@ i18n
   .use(LanguageDetector)
   .init({
     supportedLngs: ['en', 'fr', 'nl', 'de'],
-    fallbackLng: 'fr',
+    fallbackLng,
     ns: i18nDefaultNamespace,
     detection: {
       order: ['localStorage', 'navigator'],
@@ -24,3 +25,10 @@ i18n
       escapeValue: false,
     },
   })
+  .then(() => {
+    document.documentElement.setAttribute('lang', i18n.language || fallbackLng)
+  })
+
+i18n.on('languageChanged', (lang) => {
+  document.documentElement.setAttribute('lang', lang)
+})

src/frontend/src/locales/de/global.json

@@ -25,6 +25,7 @@
     "heading": "Überprüfen Sie Ihren Meeting-Code",
     "body": "Stellen Sie sicher, dass Sie den richtigen Meeting-Code in der URL eingegeben haben. Beispiel:"
   },
+  "selected": "ausgewählt",
   "submit": "OK",
   "footer": {
     "links": {
@@ -45,7 +46,7 @@
     "license": "Etalab 2.0 Lizenz"
   },
   "loginHint": {
-    "title": "Melden Sie sich mit Ihrem ProConnect-Konto an",
+    "title": "Melden Sie sich mit Ihrem Konto an",
     "body": "Statt zu warten, melden Sie sich mit Ihrem ProConnect-Konto an.",
     "button": {
       "ariaLabel": "Hinweis schließen",

src/frontend/src/locales/de/home.json

@@ -10,7 +10,7 @@
   "joinMeetingTipContent": "Sie können einem Meeting beitreten, indem Sie den vollständigen Link in die Adressleiste Ihres Browsers einfügen.",
   "joinMeetingTipHeading": "Wussten Sie schon?",
   "loginToCreateMeeting": "Melden Sie sich an, um ein Meeting zu erstellen",
-  "moreLinkLabel": "Mehr erfahren – neues Tab",
+  "moreLinkLabel": "Mehr erfahren über {{appTitle}} – neues Tab",
   "moreLink": "Mehr erfahren",
   "moreAbout": "über {{appTitle}}",
   "createMenu": {

src/frontend/src/locales/de/notifications.json

@@ -9,6 +9,7 @@
   },
   "muted": "{{name}} hat dein Mikrofon stummgeschaltet. Kein Teilnehmer kann dich hören.",
   "openChat": "Chat öffnen",
+  "chatMessageReceived": "{{name}} sagt: {{message}}",
   "lowerHand": {
     "auto": "Es scheint, dass du angefangen hast zu sprechen, daher wird deine Hand gesenkt.",
     "dismiss": "Hand oben lassen"

src/frontend/src/locales/de/rooms.json

@@ -322,11 +322,13 @@
     "closeButton": "{{content}} ausblenden"
   },
   "chat": {
-    "disclaimer": "Die Nachrichten sind nur für Teilnehmer zum Zeitpunkt des Sendens sichtbar. Alle Nachrichten werden am Ende des Anrufs gelöscht."
+    "disclaimer": "Die Nachrichten sind nur für Teilnehmer zum Zeitpunkt des Sendens sichtbar. Alle Nachrichten werden am Ende des Anrufs gelöscht.",
+    "messagesLog": "Chat-Nachrichten"
   },
   "moreTools": {
     "body": "Greifen Sie auf weitere Tools zu, um Ihre Meetings zu verbessern.",
-    "moreLink": "Mehr erfahren",
+    "linkAriaLabel": "Dokumentation zu den Tools öffnen - öffnet in neuem Fenster",
+    "moreLink": "Dokumentation öffnen",
     "tools": {
       "transcript": {
         "title": "Transkribieren",
@@ -370,11 +372,13 @@
       "starting": "Wird gestartet…",
       "anotherModeStarted": "Eine Aufnahme läuft. <br/> Wechseln Sie das Menü und stoppen Sie sie."
     },
-    "linkMore": "Mehr erfahren",
+    "linkMore": "Dokumentation öffnen",
+    "linkAriaLabel": "Dokumentation zur Transkription öffnen - öffnet in neuem Fenster",
     "notAdminOrOwner": {
       "heading": "Zugriff eingeschränkt",
       "body": "Aus Sicherheitsgründen kann nur der Ersteller oder ein Administrator des Meetings eine Transkription (Beta) starten.",
-      "linkMore": "Mehr erfahren",
+      "linkMore": "Dokumentation öffnen",
+      "linkAriaLabel": "Dokumentation zum Transkriptionszugang öffnen - öffnet in neuem Fenster",
       "dividerLabel": "ODER",
       "login": {
         "heading": "Anmeldung erforderlich",
@@ -389,7 +393,8 @@
     "premium": {
       "heading": "Premium-Funktion",
       "body": "Diese Funktion ist öffentlichen Bediensteten vorbehalten. Wenn Ihre E-Mail-Adresse nicht autorisiert ist, kontaktieren Sie bitte den Support, um Zugriff zu erhalten.",
-      "linkMore": "Mehr erfahren",
+      "linkMore": "Dokumentation öffnen",
+      "linkAriaLabel": "Dokumentation zum Premium-Zugang öffnen - öffnet in neuem Fenster",
       "dividerLabel": "ODER",
       "login": {
         "heading": "Anmeldung erforderlich",
@@ -406,7 +411,8 @@
     "heading": "Diesen Anruf für später aufzeichnen",
     "body": "Zeichnen Sie bis zu {{max_duration}} des Meetings auf.",
     "bodyWithoutMaxDuration": "Zeichnen Sie Ihr Meeting unbegrenzt auf.",
-    "linkMore": "Mehr erfahren",
+    "linkMore": "Dokumentation öffnen",
+    "linkAriaLabel": "Dokumentation zur Aufzeichnung öffnen - öffnet in neuem Fenster",
     "details": {
       "receiver": "Die Aufzeichnung wird an den Organisator und die Mitorganisatoren gesendet.",
       "destination": "Diese Aufzeichnung wird vorübergehend auf unseren Servern gespeichert",
@@ -424,7 +430,8 @@
     "notAdminOrOwner": {
       "heading": "Zugriff eingeschränkt",
       "body": "Aus Sicherheitsgründen kann nur der Ersteller oder ein Administrator des Meetings eine Videoaufnahme (Beta) starten.",
-      "linkMore": "Mehr erfahren",
+      "linkMore": "Dokumentation öffnen",
+      "linkAriaLabel": "Dokumentation zum Aufzeichnungszugang öffnen - öffnet in neuem Fenster",
       "dividerLabel": "ODER",
       "login": {
         "heading": "Anmeldung erforderlich",
@@ -590,7 +597,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Optionen für {{name}}",
-    "toolbarHint": "F2: zur Symbolleiste unten.",
+    "toolbarHint": "Ctrl+Shift+/: Direkt auf die Tastenkürzel zugreifen.",
     "pin": {
       "enable": "Anheften",
       "disable": "Lösen"

src/frontend/src/locales/de/settings.json

@@ -116,6 +116,17 @@
   "accessibility": {
     "announceReactions": {
       "label": "Reaktionen vorlesen"
+    },
+    "captions": {
+      "heading": "Untertitel",
+      "textSize": {
+        "label": "Untertitel-Schriftgröße",
+        "options": {
+          "small": "Klein",
+          "medium": "Mittel",
+          "large": "Groß"
+        }
+      }
     }
   },
   "tabs": {

src/frontend/src/locales/en/global.json

@@ -25,6 +25,7 @@
     "heading": "Verify your meeting code",
     "body": "Check that you have entered the correct meeting code in the URL. Example:"
   },
+  "selected": "selected",
   "submit": "OK",
   "footer": {
     "links": {
@@ -45,7 +46,7 @@
     "license": "etalab 2.0 license"
   },
   "loginHint": {
-    "title": "Log in with your ProConnect account",
+    "title": "Log in with your account",
     "body": "Instead of waiting, log in with your ProConnect account.",
     "button": {
       "ariaLabel": "Close the suggestion",

src/frontend/src/locales/en/home.json

@@ -10,7 +10,7 @@
   "joinMeetingTipContent": "You can join a meeting by pasting its full link in the browser's address bar.",
   "joinMeetingTipHeading": "Did you know?",
   "loginToCreateMeeting": "Login to create a meeting",
-  "moreLinkLabel": "Learn more - new tab",
+  "moreLinkLabel": "Learn more about {{appTitle}} - new tab",
   "moreLink": "Learn more",
   "moreAbout": "about {{appTitle}}",
   "createMenu": {

src/frontend/src/locales/en/notifications.json

@@ -9,6 +9,7 @@
   },
   "muted": "{{name}} has muted your microphone. No participant can hear you.",
   "openChat": "Open chat",
+  "chatMessageReceived": "{{name}} says: {{message}}",
   "lowerHand": {
     "auto": "It seems you have started speaking, so your hand will be lowered.",
     "dismiss": "Keep hand raised"

src/frontend/src/locales/en/rooms.json

@@ -322,11 +322,13 @@
     "closeButton": "Hide {{content}}"
   },
   "chat": {
-    "disclaimer": "The messages are visible to participants only at the time they are sent. All messages are deleted at the end of the call."
+    "disclaimer": "The messages are visible to participants only at the time they are sent. All messages are deleted at the end of the call.",
+    "messagesLog": "Chat messages"
   },
   "moreTools": {
     "body": "Access more tools to enhance your meetings.",
-    "moreLink": "Learn more",
+    "linkAriaLabel": "Open documentation about tools - opens in new window",
+    "moreLink": "Open documentation",
     "tools": {
       "transcript": {
         "title": "Transcribe",
@@ -370,11 +372,13 @@
       "starting": "Starting…",
       "anotherModeStarted": "Screen recording is running. Switch panels and stop it."
     },
-    "linkMore": "Learn more",
+    "linkMore": "Open documentation",
+    "linkAriaLabel": "Open documentation about transcription - opens in new window",
     "notAdminOrOwner": {
       "heading": "Restricted Access",
       "body": "For security reasons, only the meeting creator or an admin can start a transcription (beta).",
-      "linkMore": "Learn more",
+      "linkMore": "Open documentation",
+      "linkAriaLabel": "Open documentation about transcription access - opens in new window",
       "dividerLabel": "OR",
       "login": {
         "heading": "Login Required",
@@ -389,7 +393,8 @@
     "premium": {
       "heading": "Premium feature",
       "body": "This feature is reserved for public agents. If your email address is not authorized, please contact support to get access.",
-      "linkMore": "Learn more",
+      "linkMore": "Open documentation",
+      "linkAriaLabel": "Open documentation about premium access - opens in new window",
       "dividerLabel": "OR",
       "login": {
         "heading": "You are not logged in!",
@@ -406,7 +411,8 @@
     "heading": "Record this call for later",
     "body": "Record up to {{max_duration}} of meeting.",
     "bodyWithoutMaxDuration": "Record your meeting without limit.",
-    "linkMore": "Learn more",
+    "linkMore": "Open documentation",
+    "linkAriaLabel": "Open documentation about recording - opens in new window",
     "details": {
       "receiver": "The recording will be sent to the host and co-hosts.",
       "destination": "This recording will be temporarily stored on our servers",
@@ -424,7 +430,8 @@
     "notAdminOrOwner": {
       "heading": "Restricted Access",
       "body": "For security reasons, only the meeting creator or an admin can start a recording (beta).",
-      "linkMore": "Learn more",
+      "linkMore": "Open documentation",
+      "linkAriaLabel": "Open documentation about recording access - opens in new window",
       "dividerLabel": "OR",
       "login": {
         "heading": "Login Required",
@@ -590,7 +597,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options for {{name}}",
-    "toolbarHint": "F2: go to the bottom toolbar.",
+    "toolbarHint": "Ctrl+Shift+/: access shortcuts directly.",
     "pin": {
       "enable": "Pin",
       "disable": "Unpin"

src/frontend/src/locales/en/settings.json

@@ -116,6 +116,17 @@
   "accessibility": {
     "announceReactions": {
       "label": "Announce reactions aloud"
+    },
+    "captions": {
+      "heading": "Captions",
+      "textSize": {
+        "label": "Caption text size",
+        "options": {
+          "small": "Small",
+          "medium": "Medium",
+          "large": "Large"
+        }
+      }
     }
   },
   "tabs": {

src/frontend/src/locales/fr/global.json

@@ -25,6 +25,7 @@
     "heading": "Vérifier votre code de réunion",
     "body": "Vérifiez que vous avez saisi le code de réunion correct dans l'URL. Exemple :"
   },
+  "selected": "sélectionné",
   "submit": "OK",
   "footer": {
     "links": {
@@ -45,7 +46,7 @@
     "license": "licence etalab 2.0"
   },
   "loginHint": {
-    "title": "Connectez-vous avec votre compte ProConnect",
+    "title": "Connectez-vous avec votre compte",
     "body": "Au lieu de patienter, connectez-vous avec votre compte ProConnect.",
     "button": {
       "ariaLabel": "Fermer la suggestion",

src/frontend/src/locales/fr/home.json

@@ -10,7 +10,7 @@
   "joinMeetingTipContent": "Vous pouvez rejoindre une réunion en copiant directement son lien complet dans la barre d'adresse du navigateur.",
   "joinMeetingTipHeading": "Astuce",
   "loginToCreateMeeting": "Connectez-vous pour créer une réunion",
-  "moreLinkLabel": "En savoir plus - nouvelle fenêtre",
+  "moreLinkLabel": "En savoir plus sur {{appTitle}} - nouvelle fenêtre",
   "moreLink": "En savoir plus",
   "moreAbout": "sur {{appTitle}}",
   "createMenu": {

src/frontend/src/locales/fr/notifications.json

@@ -9,6 +9,7 @@
   },
   "muted": "{{name}} a coupé votre micro. Aucun participant ne peut l'entendre.",
   "openChat": "Ouvrir le chat",
+  "chatMessageReceived": "{{name}} dit : {{message}}",
   "lowerHand": {
     "auto": "Il semblerait que vous ayez pris la parole, donc la main va être baissée.",
     "dismiss": "Laisser la main levée"

src/frontend/src/locales/fr/rooms.json

@@ -322,11 +322,13 @@
     "closeButton": "Masquer {{content}}"
   },
   "chat": {
-    "disclaimer": "Les messages sont visibles par les participants uniquement au moment de\nleur envoi. Tous les messages sont supprimés à la fin de l'appel."
+    "disclaimer": "Les messages sont visibles par les participants uniquement au moment de\nleur envoi. Tous les messages sont supprimés à la fin de l'appel.",
+    "messagesLog": "Messages du chat"
   },
   "moreTools": {
-    "body": "Accèder à d'avantage d'outils pour améliorer vos réunions.",
-    "moreLink": "En savoir plus",
+    "body": "Accéder à davantage d'outils pour améliorer vos réunions.",
+    "linkAriaLabel": "Ouvrir la documentation sur les outils - ouvre dans une nouvelle fenêtre",
+    "moreLink": "Ouvrir la documentation",
     "tools": {
       "transcript": {
         "title": "Transcrire",
@@ -370,11 +372,13 @@
       "starting": "Démarrage…",
       "anotherModeStarted": "Un enregistrement est en cours. <br/> Changez de menu et arrêtez le."
     },
-    "linkMore": "En savoir plus",
+    "linkMore": "Ouvrir la documentation",
+    "linkAriaLabel": "Ouvrir la documentation sur la transcription - ouvre dans une nouvelle fenêtre",
     "notAdminOrOwner": {
       "heading": "Accès restreint",
       "body": "Pour des raisons de sécurité, seul le créateur ou un administrateur de la réunion peut lancer une transcription (beta).",
-      "linkMore": "En savoir plus",
+      "linkMore": "Ouvrir la documentation",
+      "linkAriaLabel": "Ouvrir la documentation sur l'accès à la transcription - ouvre dans une nouvelle fenêtre",
       "dividerLabel": "OU",
       "login": {
         "heading": "Connexion requise",
@@ -389,7 +393,7 @@
     "premium": {
       "heading": "Fonctionnalité premium",
       "body": "Cette fonctionnalité est réservée aux agents publics. Si votre adresse email n’est pas autorisée, contactez le support pour obtenir l'accès.",
-      "linkMore": "En savoir plus",
+      "linkMore": "Ouvrir la documentation",
       "dividerLabel": "OU",
       "login": {
         "heading": "Vous n'êtes pas connecté !",
@@ -399,14 +403,16 @@
         "heading": "Demander à l'organisateur",
         "body": "L'hôte recevra une notification et pourra démarrer la transcription pour vous.",
         "buttonLabel": "Demander"
-      }
+      },
+      "linkAriaLabel": "Ouvrir la documentation sur l'accès premium - ouvre dans une nouvelle fenêtre"
     }
   },
   "screenRecording": {
     "heading": "Enregistrez cet appel pour plus tard",
     "body": "Enregistrez jusqu'à {{max_duration}} de réunion.",
     "bodyWithoutMaxDuration": "Enregistrez votre réunion sans limite.",
-    "linkMore": "En savoir plus",
+    "linkMore": "Ouvrir la documentation",
+    "linkAriaLabel": "Ouvrir la documentation sur l'enregistrement - ouvre dans une nouvelle fenêtre",
     "details": {
       "receiver": "L'enregistrement sera envoyé à l'organisateur et aux coorganisateurs.",
       "destination": "Cet enregistrement sera conservé temporairement sur nos serveurs",
@@ -424,7 +430,8 @@
     "notAdminOrOwner": {
       "heading": "Accès restreint",
       "body": "Pour des raisons de sécurité, seul le créateur ou un administrateur de la réunion peut lancer un enregistrement (beta).",
-      "linkMore": "En savoir plus",
+      "linkMore": "Ouvrir la documentation",
+      "linkAriaLabel": "Ouvrir la documentation sur l'accès à l'enregistrement - ouvre dans une nouvelle fenêtre",
       "dividerLabel": "OU",
       "login": {
         "heading": "Connexion requise",
@@ -590,7 +597,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options pour {{name}}",
-    "toolbarHint": "F2 : raccourci barre d'outils en bas.",
+    "toolbarHint": "Ctrl+Shift+/ : accéder directement aux raccourcis.",
     "pin": {
       "enable": "Épingler",
       "disable": "Annuler l'épinglage"

src/frontend/src/locales/fr/settings.json

@@ -116,6 +116,17 @@
   "accessibility": {
     "announceReactions": {
       "label": "Vocaliser les réactions"
+    },
+    "captions": {
+      "heading": "Sous-titres",
+      "textSize": {
+        "label": "Taille du texte des sous-titres",
+        "options": {
+          "small": "Petit",
+          "medium": "Moyen",
+          "large": "Grand"
+        }
+      }
     }
   },
   "tabs": {

src/frontend/src/locales/nl/global.json

@@ -24,6 +24,7 @@
   "notFound": {
     "heading": "Pagina niet gevonden"
   },
+  "selected": "geselecteerd",
   "submit": "OK",
   "footer": {
     "links": {
@@ -44,7 +45,7 @@
     "license": "etalab 2.0 licentie"
   },
   "loginHint": {
-    "title": "Log in met je ProConnect-account",
+    "title": "Log in met je account",
     "body": "In plaats van te wachten, log in met je ProConnect-account.",
     "button": {
       "ariaLabel": "Sluit de suggestie",