🔖(minor) bump release to 0.1.28

telephony frontend + backend
source map
enhance analytics on the summary microservice

.github/workflows/deploy.yml

@@ -1,35 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    tags:
-      - 'preprod'
-      - 'production'
-
-
-jobs:
-  notify-argocd:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v4
-      -
-        name: Call argocd github webhook
-        run: |
-          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${{ secrets.ARGOCD_WEBHOOK_SECRET }}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" ${{ vars.ARGOCD_WEBHOOK_URL }}
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${{ secrets.ARGOCD_PRODUCTION_WEBHOOK_SECRET }}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" ${{ secrets.ARGOCD_PRODUCTION_WEBHOOK_URL }}
-
-  start-test-on-preprod:
-    needs:
-      - notify-argocd
-    runs-on: ubuntu-latest
-    if: startsWith(github.event.ref, 'refs/tags/preprod')
-    steps:
-      -
-        name: Debug
-        run: |
-          echo "Start test when preprod is ready"

.github/workflows/docker-hub.yml

@@ -49,7 +49,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-  build-and-push-frontend:
+  build-and-push-frontend-generic:
     runs-on: ubuntu-latest
     steps:
       -
@@ -83,6 +83,40 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+  build-and-push-frontend-dinum:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@v4
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: lasuite/meet-frontend-dinum
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        run: echo "${{ secrets.DOCKER_HUB_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_HUB_USER }}" --password-stdin
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+          docker-image-name: 'docker.io/lasuite/meet-frontend-dinum:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./docker/dinum-frontend/Dockerfile
+          target: frontend-production
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
   build-and-push-summary:
     runs-on: ubuntu-latest
     steps:
@@ -113,7 +147,8 @@ jobs:
 
   notify-argocd:
     needs:
-      - build-and-push-frontend
+      - build-and-push-frontend-generic
+      - build-and-push-frontend-dinum
       - build-and-push-backend
       - build-and-push-summary
     runs-on: ubuntu-latest

.github/workflows/meet.yml

@@ -81,7 +81,7 @@ jobs:
       - name: Install Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
       - name: Install development dependencies
         run: pip install --user .[dev]
       - name: Check code formatting with ruff
@@ -135,6 +135,9 @@ jobs:
       STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
       LIVEKIT_API_SECRET: secret
       LIVEKIT_API_KEY: devkey
+      AWS_S3_ENDPOINT_URL: http://localhost:9000
+      AWS_S3_ACCESS_KEY_ID: meet
+      AWS_S3_SECRET_ACCESS_KEY: password
 
     steps:
       - name: Checkout repository
@@ -152,10 +155,37 @@ jobs:
           path: "src/backend/core/templates/mail"
           key: mail-templates-${{ hashFiles('src/mail/mjml') }}
 
+      - name: Start MinIO
+        run: |
+          docker pull minio/minio
+          docker run -d --name minio \
+            -p 9000:9000 \
+            -e "MINIO_ACCESS_KEY=meet" \
+            -e "MINIO_SECRET_KEY=password" \
+            -v /data/media:/data \
+            minio/minio server --console-address :9001 /data
+
+      # Tool to wait for a service to be ready
+      - name: Install Dockerize
+        run: |
+          curl -sSL https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz | sudo tar -C /usr/local/bin -xzv
+
+      - name: Wait for MinIO to be ready
+        run: |
+          dockerize -wait tcp://localhost:9000 -timeout 10s
+
+      - name: Configure MinIO
+        run: |
+          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
+          docker exec ${MINIO} sh -c \
+            "mc alias set meet http://localhost:9000 meet password && \
+            mc alias ls && \
+            mc mb meet/meet-media-storage"
+
       - name: Install Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install development dependencies
         run: pip install --user .[dev]
@@ -219,67 +249,3 @@ jobs:
 
       - name: Build SDK
         run: npm run build
-
-  i18n-crowdin:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: "infrastructure,secrets"
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
-      - name: Load sops secrets
-        uses: rouja/actions-sops@main
-        with:
-          secret-file: secrets/numerique-gouv/meet/secrets.enc.env
-          age-key: ${{ secrets.SOPS_PRIVATE }}
-
-      - name: Install gettext (required to make messages)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-
-      - name: Install Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Install development dependencies
-        working-directory: src/backend
-        run: pip install --user .[dev]
-
-      - name: Generate the translation base file
-        run: ~/.local/bin/django-admin makemessages --keep-pot --all
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "18.x"
-          cache: "npm"
-          cache-dependency-path: src/frontend/package-lock.json
-
-      - name: Install dependencies
-        run: cd src/frontend/ && npm ci
-
-      - name: Extract the frontend translation
-        run: make frontend-i18n-extract
-
-      - name: Upload files to Crowdin
-        uses: crowdin/github-action@v2
-        with:
-          config: crowdin/config.yml
-          upload_sources: true
-          upload_translations: true
-          download_translations: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_BASE_PATH: ${{ github.workspace }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

CHANGELOG.md

@@ -8,3 +8,5 @@ and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+- 🔧(backend) support `_FILE` for secret environment variables #566 

Dockerfile

@@ -1,7 +1,7 @@
 # Django Meet
 
 # ---- base image to inherit from ----
-FROM python:3.12.6-alpine3.20 AS base
+FROM python:3.13.5-alpine3.21 AS base
 
 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip setuptools
@@ -62,11 +62,11 @@ FROM base AS core
 
 ENV PYTHONUNBUFFERED=1
 
-RUN apk add \
-  gettext \
+RUN apk --no-cache add \
   cairo \
-  libffi-dev \
   gdk-pixbuf \
+  gettext \
+  libffi-dev \
   pango \
   shared-mime-info
 

Makefile

@@ -347,3 +347,7 @@ start-tilt: ## start the kubernetes cluster using kind
 start-tilt-keycloak: ## start the kubernetes cluster using kind, without Pro Connect for authentication, use keycloak
 	DEV_ENV=dev-keycloak tilt up -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster
+
+start-tilt-dinum: ## start the kubernetes cluster using kind, without Pro Connect for authentication, but with DINUM styles
+	DEV_ENV=dev-dinum tilt up -f ./bin/Tiltfile
+.PHONY: build-k8s-cluster

README.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://livekit.io/">LiveKit</a> - <a href="https://go.crisp.chat/chat/embed/?website_id=58ea6697-8eba-4492-bc59-ad6562585041">Chat with us</a> - <a href="https://github.com/orgs/suitenumerique/projects/3/views/2">Roadmap</a> - <a href="https://github.com/suitenumerique/meet/blob/main/CHANGELOG.md">Changelog</a> - <a href="https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md">Bug reports</a> 
+  <a href="https://livekit.io/">LiveKit</a> - <a href="https://matrix.to/#/#meet-official:matrix.org">Chat with us</a> - <a href="https://github.com/orgs/suitenumerique/projects/3/views/2">Roadmap</a> - <a href="https://github.com/suitenumerique/meet/blob/main/CHANGELOG.md">Changelog</a> - <a href="https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md">Bug reports</a> 
 </p>
 
 <p align="center">
@@ -33,9 +33,9 @@ Powered by [LiveKit](https://livekit.io/), La Suite Meet offers Zoom-level perfo
 - Support for multiple screen sharing streams
 - Non-persistent, secure chat
 - End-to-end encryption (coming soon)
-- Meeting recording (coming soon)
+- Meeting recording
 - Meeting transcription (currently in beta)
-- Telephony integration (in development)
+- Telephony integration
 - Secure participation with robust authentication and access control
 - LiveKit Advances features including :
   - speaker detection 
@@ -111,6 +111,7 @@ Come help us make La Suite Meet even better. We're growing fast and [would love
 ## Credits 
 
 We're using the awesome [LiveKit](https://livekit.io/) implementation. We're also thankful to the teams behind [Django Rest Framework](https://www.django-rest-framework.org/), [Vite.js](https://vite.dev/), and [React Aria](https://github.com/adobe/react-spectrum) — Thanks for your amazing work!
+This project is tested with BrowserStack.
 
 ## License
 

bin/Tiltfile

@@ -2,6 +2,15 @@ load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
 load('ext://namespace', 'namespace_create', 'namespace_inject')
 namespace_create('meet')
 
+DEV_ENV = os.getenv('DEV_ENV', 'dev')
+
+if DEV_ENV == 'dev-dinum':
+    update_settings(suppress_unused_image_warnings=["localhost:5001/meet-frontend-generic:latest"])
+
+if DEV_ENV == 'dev-keycloak':
+    update_settings(suppress_unused_image_warnings=["localhost:5001/meet-frontend-dinum:latest"])
+
+
 def clean_old_images(image_name):
     local('docker images -q %s | tail -n +2 | xargs -r docker rmi' % image_name)
 
@@ -22,7 +31,19 @@ docker_build(
 clean_old_images('localhost:5001/meet-backend')
 
 docker_build(
-    'localhost:5001/meet-frontend:latest',
+    'localhost:5001/meet-frontend-dinum:latest',
+    context='..',
+    dockerfile='../docker/dinum-frontend/Dockerfile',
+    only=['./src/frontend', './docker', './.dockerignore'],
+    target = 'frontend-production',
+    live_update=[
+        sync('../src/frontend', '/home/frontend'),
+    ]
+)
+clean_old_images('localhost:5001/meet-frontend-dinum')
+
+docker_build(
+    'localhost:5001/meet-frontend-generic:latest',
     context='..',
     dockerfile='../src/frontend/Dockerfile',
     only=['./src/frontend', './docker', './.dockerignore'],
@@ -31,7 +52,7 @@ docker_build(
         sync('../src/frontend', '/home/frontend'),
     ]
 )
-clean_old_images('localhost:5001/meet-frontend')
+clean_old_images('localhost:5001/meet-frontend-generic')
 
 docker_build(
     'localhost:5001/meet-summary:latest',
@@ -49,7 +70,7 @@ clean_old_images('localhost:5001/meet-summary')
 # This is necessary because we need to inject the certificate into our LiveKit container
 local_resource(
     'copy-root-ca',
-    cmd='cp "$(mkcert -CAROOT)/rootCA.pem" ../docker/livekit/rootCA.pem',
+    cmd='cp -f "$(mkcert -CAROOT)/rootCA.pem" ../docker/livekit/rootCA.pem',
     deps=[],  # No dependencies needed
 )
 # Build a custom LiveKit Docker image that includes our root CA certificate

compose.yml

@@ -15,6 +15,37 @@ services:
     ports:
       - "1081:1080"
 
+  minio:
+    user: ${DOCKER_USER:-1000}
+    image: minio/minio
+    environment:
+      - MINIO_ROOT_USER=meet
+      - MINIO_ROOT_PASSWORD=password
+    ports:
+      - '9000:9000'
+      - '9001:9001'
+    healthcheck:
+      test: [ "CMD", "mc", "ready", "local" ]
+      interval: 1s
+      timeout: 20s
+      retries: 300
+    entrypoint: ""
+    command: minio server --console-address :9001 /data
+    volumes:
+      - ./data/media:/data
+
+  createbuckets:
+    image: minio/mc
+    depends_on:
+      minio:
+        condition: service_healthy
+        restart: true
+    entrypoint: >
+      sh -c "
+      /usr/bin/mc alias set meet http://minio:9000 meet password && \
+      /usr/bin/mc mb meet/meet-media-storage && \
+      exit 0;"
+
   app-dev:
     build:
       context: .
@@ -40,6 +71,9 @@ services:
         - redis
         - nginx
         - livekit
+        - createbuckets
+    extra_hosts:
+      - "127.0.0.1.nip.io:host-gateway"
   
   celery-dev:
     user: ${DOCKER_USER:-1000}
@@ -73,6 +107,7 @@ services:
       - postgresql
       - redis
       - livekit
+      - minio
 
   celery:
     user: ${DOCKER_USER:-1000}
@@ -103,6 +138,7 @@ services:
       target: frontend-production
       args:
         VITE_API_BASE_URL: "http://localhost:8071"
+        VITE_APP_TITLE: "LaSuite Meet"
     image: meet:frontend-development
     ports:
       - "3000:8080"

docker/dinum-frontend/Dockerfile

@@ -0,0 +1,62 @@
+# ---- Front-end image ----
+FROM node:20-alpine AS frontend-deps
+
+WORKDIR /home/frontend/
+
+COPY ./src/frontend/package.json ./package.json
+COPY ./src/frontend/package-lock.json ./package-lock.json
+
+RUN npm ci
+
+COPY .dockerignore ./.dockerignore
+COPY ./src/frontend/ .
+
+# ---- Front-end builder image ----
+FROM frontend-deps AS meet-builder
+
+WORKDIR /home/frontend
+
+ENV VITE_APP_TITLE="Visio"
+ENV VITE_BUILD_SOURCEMAP="true"
+
+RUN npm run build
+
+# Inject PostHog sourcemap metadata into the built assets
+# This metadata is essential for correctly mapping errors to source maps in production
+RUN set -e && \
+    npx @posthog/cli sourcemap inject --directory ./dist/assets
+
+COPY ./docker/dinum-frontend/dinum-styles.css \
+    ./dist/assets/
+
+COPY ./docker/dinum-frontend/logo.svg \
+    ./dist/assets/logo.svg
+
+COPY ./docker/dinum-frontend/assets/ \
+    ./dist/assets/
+
+COPY ./docker/dinum-frontend/fonts/ \
+    ./dist/assets/fonts/
+
+# ---- Front-end image ----
+FROM nginxinc/nginx-unprivileged:alpine3.21 AS frontend-production
+
+USER root
+RUN apk update && apk upgrade libssl3 libcrypto3 libxml2>=2.12.7-r2 libxslt>=1.1.39-r2
+
+USER nginx
+
+# Un-privileged user running the application
+ARG DOCKER_USER
+USER ${DOCKER_USER}
+
+COPY --from=meet-builder \
+    /home/frontend/dist \
+    /usr/share/nginx/html
+
+COPY ./src/frontend/default.conf /etc/nginx/conf.d
+COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
+
+ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
+
+CMD ["nginx", "-g", "daemon off;"]

docker/dinum-frontend/assets/gouvernement.svg

@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   width="38.194309mm"
+   height="3.4877367mm"
+   viewBox="0 0 38.194309 3.4877367"
+   version="1.1"
+   id="svg1"
+   sodipodi:docname="gouvernement.svg"
+   inkscape:version="1.4.1 (93de688d07, 2025-03-30)"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <sodipodi:namedview
+     id="namedview1"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     inkscape:document-units="mm"
+     inkscape:zoom="6.1918409"
+     inkscape:cx="79.620909"
+     inkscape:cy="44.332534"
+     inkscape:window-width="1901"
+     inkscape:window-height="1037"
+     inkscape:window-x="5"
+     inkscape:window-y="5"
+     inkscape:window-maximized="0"
+     inkscape:current-layer="layer1" />
+  <defs
+     id="defs1">
+    <rect
+       x="111.07374"
+       y="333.22122"
+       width="541.4845"
+       height="297.51895"
+       id="rect2" />
+    <rect
+       x="158.10136"
+       y="358.3631"
+       width="425.55618"
+       height="204.21426"
+       id="rect1" />
+  </defs>
+  <g
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     id="layer1"
+     transform="translate(-53.656101,-100.08408)">
+    <path
+       d="m 55.435527,103.08144 c -0.72898,0 -1.249045,-0.56007 -1.249045,-1.25349 0,-0.69342 0.502285,-1.25349 1.204595,-1.25349 0.41783,0 0.760095,0.20447 0.96901,0.50673 l 0.333375,-0.25781 c -0.28448,-0.38227 -0.742315,-0.64008 -1.302385,-0.64008 -0.973455,0 -1.63576,0.75565 -1.63576,1.64465 0,0.889 0.680085,1.64465 1.68021,1.64465 0.582295,0 1.05791,-0.24892 1.346835,-0.64008 v -1.21349 h -1.31572 v 0.36005 h 0.89789 v 0.70231 c -0.217805,0.24447 -0.54229,0.40005 -0.929005,0.40005 z m 3.569334,-2.89814 c -0.973455,0 -1.63576,0.75565 -1.63576,1.64465 0,0.889 0.662305,1.64465 1.63576,1.64465 0.96901,0 1.631315,-0.75565 1.631315,-1.64465 0,-0.889 -0.662305,-1.64465 -1.631315,-1.64465 z m 0,2.89814 c -0.70231,0 -1.204595,-0.56007 -1.204595,-1.25349 0,-0.69342 0.502285,-1.25349 1.204595,-1.25349 0.697865,0 1.20015,0.56007 1.20015,1.25349 0,0.69342 -0.502285,1.25349 -1.20015,1.25349 z m 4.276088,-0.84455 c 0,0.53784 -0.31115,0.84455 -0.786765,0.84455 -0.48006,0 -0.79121,-0.30671 -0.79121,-0.84455 v -1.96469 h -0.41783 v 1.93802 c 0,0.8001 0.48006,1.26238 1.20904,1.26238 0.72898,0 1.204595,-0.46228 1.204595,-1.26238 v -1.93802 h -0.41783 z m 0.942341,-1.96469 1.2446,3.1115 h 0.55118 l 1.2446,-3.1115 h -0.4445 l -1.07569,2.68922 -1.07569,-2.68922 z m 3.653795,3.1115 h 1.67132 v -0.3556 h -1.25349 v -1.05347 h 1.07569 v -0.35115 h -1.07569 v -0.99568 h 1.25349 v -0.3556 h -1.67132 z m 2.502533,0 h 0.41783 v -1.36462 h 0.40894 c 0.03111,0 0.06667,0 0.09779,-0.004 l 0.902335,1.36906 h 0.493395 l -1.00457,-1.44907 c 0.333375,-0.13335 0.52451,-0.41339 0.52451,-0.78677 0,-0.5334 -0.386715,-0.87566 -1.01346,-0.87566 h -0.82677 z m 0.84455,-2.7559 c 0.3556,0 0.564515,0.19558 0.564515,0.51117 0,0.33338 -0.208915,0.52451 -0.564515,0.52451 h -0.42672 v -1.03568 z m 2.004699,2.7559 h 0.41783 v -2.60033 l 1.76022,2.60033 h 0.546735 v -3.1115 h -0.41783 v 2.60032 l -1.76022,-2.60032 h -0.546735 z m 3.71158,0 h 1.67132 v -0.3556 h -1.25349 v -1.05347 h 1.07569 v -0.35115 h -1.07569 v -0.99568 h 1.25349 v -0.3556 h -1.67132 z m 2.502533,0 h 0.41783 v -2.55143 l 0.90678,1.48463 h 0.32004 l 0.90678,-1.48463 v 2.55143 h 0.41783 v -3.1115 h -0.5334 l -0.95123,1.56908 -0.95123,-1.56908 h -0.5334 z m 3.951605,0 h 1.67132 v -0.3556 h -1.25349 v -1.05347 h 1.07569 v -0.35115 h -1.07569 v -0.99568 h 1.25349 v -0.3556 h -1.67132 z m 2.502535,0 h 0.41783 v -2.60033 l 1.76022,2.60033 h 0.546735 v -3.1115 h -0.41783 v 2.60032 l -1.76022,-2.60032 H 85.89712 Z m 3.373758,-2.72923 h 1.03124 v 2.72923 h 0.41783 v -2.72923 h 1.03124 v -0.38227 h -2.48031 z"
+       id="text3"
+       style="font-size:4.445px;line-height:0.661464px;font-family:Marianne;-inkscape-font-specification:'Marianne, Normal';letter-spacing:0px;word-spacing:0px;display:inline;stroke:#000000;stroke-width:0.198437"
+       aria-label="GOUVERNEMENT" />
+  </g>
+</svg>

docker/dinum-frontend/dinum-styles.css

@@ -0,0 +1,70 @@
+:root {
+    --fonts-sans: 'Marianne', ui-sans-serif, system-ui, sans-serif;
+}
+
+.Header-beforeLogo {
+    display: block;
+}
+
+.Header-beforeLogo::before {
+    content: '';
+    display: block;
+    background-image: url(/assets/marianne.svg);
+    background-position: 0 -0.046875rem;
+    background-size: 2.0625rem 0.84375rem;
+    height: 0.75rem;
+    margin-bottom: 0.1rem;
+    width: 2.0625rem;
+}
+
+.Header-beforeLogo::after {
+    content: '';
+    display: block;
+    background-image: url(/assets/gouvernement.svg), url(/assets/devise.svg);
+    background-repeat: no-repeat, no-repeat;
+    background-size: 108.8px 10px, 40px 29px;
+    background-position: 0 3px, 0 18.9px;
+    width: 108.8px;
+    height: 48px;
+    margin-top: 0.25rem;
+}
+
+@font-face {
+    font-family: 'Marianne';
+    src: url('/assets/fonts/Marianne-Regular-subset.woff2') format('woff2');
+    font-weight: 400;
+    font-style: normal;
+    font-display: swap;
+}
+
+@font-face {
+    font-family: 'Marianne';
+    src: url('/assets/fonts/Marianne-Regular_Italic-subset.woff2') format('woff2');
+    font-weight: 400;
+    font-style: italic;
+    font-display: swap;
+}
+
+@font-face {
+    font-family: 'Marianne';
+    src: url('/assets/fonts/Marianne-Medium-subset.woff2') format('woff2');
+    font-weight: 500;
+    font-style: normal;
+    font-display: swap;
+}
+
+@font-face {
+    font-family: 'Marianne';
+    src: url('/assets/fonts/Marianne-Bold-subset.woff2') format('woff2');
+    font-weight: 700;
+    font-style: normal;
+    font-display: swap;
+}
+
+@font-face {
+    font-family: 'Marianne';
+    src: url('/assets/fonts/Marianne-ExtraBold-subset.woff2') format('woff2');
+    font-weight: 800;
+    font-style: normal;
+    font-display: swap;
+}

docs/installation.md

@@ -2,7 +2,7 @@
 
 This document is a step-by-step guide that describes how to install Visio on a k8s cluster without AI features.
 
-## Prerequisites
+## Prerequisites for a kubernetes setup
 
 - k8s cluster with an nginx-ingress controller
 - an OIDC provider (if you don't have one, we will provide an example)
@@ -12,14 +12,25 @@ This document is a step-by-step guide that describes how to install Visio on a k
 
 ### Test cluster
 
-If you do not have a test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script **bin/start-kind.sh**.
+If you do not have a kubernetes test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script located in this repo under **bin/start-kind.sh**.
 
-To be able to use the script, you will need to install:
+IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed. 
+
+To be able to use the script, you will need to install the following components:
 
 - Docker (https://docs.docker.com/desktop/)
 - Kind (https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
 - Mkcert (https://github.com/FiloSottile/mkcert#installation)
 - Helm (https://helm.sh/docs/intro/quickstart/#install-helm)
+- kubectl (https://kubernetes.io/docs/tasks/tools/)
+
+In order to initiate the local kind installation via **start-kind.sh** do the following:
+1) Make sure administrator/root user context is able to execute mkcert, docker, kind etc. commands or the script might fail
+2) Download the script to the device where the above components are installed
+3) Make the script executable
+4) Run the script with proper permissions (administrator/sudo etc.)
+
+The output of the script will resemble the below example:
 
 ```
 $ ./bin/start-kind.sh
@@ -99,7 +110,7 @@ When your k8s cluster is ready, you can start the deployment. This cluster is sp
 
 Please remember that \*.127.0.0.1.nip.io will always resolve to 127.0.0.1, except in the k8s cluster where we configure CoreDNS to answer with the ingress-nginx service IP.
 
-## Preparation
+## Preparation of components
 
 ### What will you use to authenticate your users ?
 
@@ -111,7 +122,7 @@ If you haven't run the script **bin/start-kind.sh**, you'll need to manually cre
 $ kubectl create namespace meet
 ```
 
-If you have already run the script, you can skip this step and proceed to the next instruction.
+If you have already run the script, you can skip this step and proceed to the next instruction. NOTE: Before you proceed, and is using the kind method, make sure you download this repo examples/ directory and its contents to the location where you will be executing the helm command. Helm will look for "examples/<name>values.yaml" from based on the path it is being executed.
 
 ```
 $ kubectl config set-context --current --namespace=meet
@@ -232,99 +243,123 @@ meet                     <none>   meet.127.0.0.1.nip.io       localhost   80, 44
 meet-admin               <none>   meet.127.0.0.1.nip.io       localhost   80, 443   52m
 ```
 
-You can use Visio on https://meet.127.0.0.1.nip.io. The provisioning user in keycloak is meet/meet.
+You can use Visio on https://meet.127.0.0.1.nip.io from the local device. The provisioning user in keycloak is meet/meet.
 
 ## All options
 
 These are the environmental options available on meet backend.
 
-| Option                                          | Description                              | default                                                                                                                                                       |
-| ----------------------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| DJANGO_ALLOWED_HOSTS                            | Host that are allowed                    | []                                                                                                                                                            |
-| DJANGO_SECRET_KEY                               | Secret key used                          |                                                                                                                                                               |
-| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence system checks                    | []                                                                                                                                                            |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              |                                          | false                                                                                                                                                         |
-| DB_ENGINE                                       | Database engine used                     | django.db.backends.postgresql_psycopg2                                                                                                                        |
-| DB_NAME                                         | name of the database                     | meet                                                                                                                                                          |
-| DB_USER                                         | user used to connect to database         | dinum                                                                                                                                                         |
-| DB_PASSWORD                                     | password used to connect to the database | pass                                                                                                                                                          |
-| DB_HOST                                         | hostname of the database                 | localhost                                                                                                                                                     |
-| DB_PORT                                         | port to connect to database              | 5432                                                                                                                                                          |
-| STORAGES_STATICFILES_BACKEND                    | Static file serving engine               | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                       |
-| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                         |                                                                                                                                                               |
-| AWS_S3_ACCESS_KEY_ID                            | s3 access key                            |                                                                                                                                                               |
-| AWS_S3_SECRET_ACCESS_KEY                        | s3 secret key                            |                                                                                                                                                               |
-| AWS_S3_REGION_NAME                              | s3 region                                |                                                                                                                                                               |
-| AWS_STORAGE_BUCKET_NAME                         | s3 bucket name                           |                                                                                                                                                               |
-| DJANGO_LANGUAGE_CODE                            | Default language                         | en-us                                                                                                                                                         |
-| REDIS_URL                                       | redis endpoint                           | redis://redis:6379/1                                                                                                                                          |
-| REQUEST_ENTRY_THROTTLE_RATES                    | throttle rates                           | 150/minute                                                                                                                                                    |
-| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | deploy check                             | False                                                                                                                                                         |
-| FRONTEND_ANALYTICS                              | analytics information                    | {}                                                                                                                                                            |
-| FRONTEND_SUPPORT                                | crisp frontend support                   | {}                                                                                                                                                            |
-| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | silence livekit debug                    | false                                                                                                                                                         |
-| DJANGO_EMAIL_BACKEND                            | email backend library                    | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
-| DJANGO_EMAIL_HOST                               | host of the email server                 |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_USER                          | user to connect to the email server      |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_PASSWORD                      | password to connect tto the email server |                                                                                                                                                               |
-| DJANGO_EMAIL_PORT                               | por tot connect to the email server      |                                                                                                                                                               |
-| DJANGO_EMAIL_USE_TLS                            | enable tls on email connection           | false                                                                                                                                                         |
-| DJANGO_EMAIL_USE_SSL                            | enable tls on email connection           | false                                                                                                                                                         |
-| DJANGO_EMAIL_FROM                               | email from account                       | from@example.com                                                                                                                                              |
-| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | allow all cors origins                   | true                                                                                                                                                          |
-| DJANGO_CORS_ALLOWED_ORIGINS                     | origins to allow in string               | []                                                                                                                                                            |
-| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | origins to allow in regex                | []                                                                                                                                                            |
-| SENTRY_DSN                                      | sentry server                            |                                                                                                                                                               |
-| DJANGO_CELERY_BROKER_URL                        | celery broker host                       | redis://redis:6379/0                                                                                                                                          |
-| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | celery broker options                    | {}                                                                                                                                                            |
-| OIDC_CREATE_USER                                | create oidc user if not exists           | false                                                                                                                                                         |
-| OIDC_VERIFY_SSL                                 | verify ssl for oidc                      | true                                                                                                                                                          |
-| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | fallback to email for identification     | false                                                                                                                                                         |
-| OIDC_RP_SIGN_ALGO                               | token verification algoritm used by oidc | RS256                                                                                                                                                         |
-| OIDC_RP_CLIENT_ID                               | oidc client                              | meet                                                                                                                                                          |
-| OIDC_RP_CLIENT_SECRET                           | oidc client secret                       |                                                                                                                                                               |
-| OIDC_OP_JWKS_ENDPOINT                           | oidc endpoint for JWKS                   |                                                                                                                                                               |
-| OIDC_OP_AUTHORIZATION_ENDPOINT                  | oidc endpoint for authorization          |                                                                                                                                                               |
-| OIDC_OP_TOKEN_ENDPOINT                          | oidc endpoint for token                  |                                                                                                                                                               |
-| OIDC_OP_USER_ENDPOINT                           | oidc endpoint for user                   |                                                                                                                                                               |
-| OIDC_OP_LOGOUT_ENDPOINT                         | oidc endpoint for logout                 |                                                                                                                                                               |
-| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | extra parameters for oidc request        |                                                                                                                                                               |
-| OIDC_RP_SCOPES                                  | oidc scopes                              | openid email                                                                                                                                                  |
-| LOGIN_REDIRECT_URL                              | login redirect url                       |                                                                                                                                                               |
-| LOGIN_REDIRECT_URL_FAILURE                      | login redurect url for failure           |                                                                                                                                                               |
-| LOGOUT_REDIRECT_URL                             | url to redirect to on logout             |                                                                                                                                                               |
-| OIDC_USE_NONCE                                  | use nonce for oidc                       | true                                                                                                                                                          |
-| OIDC_REDIRECT_REQUIRE_HTTPS                     | require https for oidc                   | false                                                                                                                                                         |
-| OIDC_REDIRECT_ALLOWED_HOSTS                     | allowed redirect hosts for oidc          | []                                                                                                                                                            |
-| OIDC_STORE_ID_TOKEN                             | store oidc ID token                      | true                                                                                                                                                          |
-| ALLOW_LOGOUT_GET_METHOD                         | allow logout through get method          | true                                                                                                                                                          |
-| OIDC_REDIRECT_FIELD_NAME                        | direct field for oidc                    | returnTo                                                                                                                                                      |
-| OIDC_USERINFO_FULLNAME_FIELDS                   | full name claim from OIDC token          | ["given_name", "usual_name"]                                                                                                                                  |
-| OIDC_USERINFO_SHORTNAME_FIELD                   | shortname claim from OIDC token          | given_name                                                                                                                                                    |
-| LIVEKIT_API_KEY                                 | livekit api key                          |                                                                                                                                                               |
-| LIVEKIT_API_SECRET                              | livekit api secret                       |                                                                                                                                                               |
-| LIVEKIT_API_URL                                 | livekit api url                          |                                                                                                                                                               |
-| RESOURCE_DEFAULT_ACCESS_LEVEL                   | default resource access level for rooms  | public                                                                                                                                                        |
-| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms        | true                                                                                                                                                          |
-| RECORDING_ENABLE                                | record meeting option                    | false                                                                                                                                                         |
-| RECORDING_OUTPUT_FOLDER                         | folder to store meetings                 | recordings                                                                                                                                                    |
-| RECORDING_VERIFY_SSL                            | verify ssl for recording storage         | true                                                                                                                                                          |
-| RECORDING_WORKER_CLASSES                        | worker classes for recording             | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
-| RECORDING_EVENT_PARSER_CLASS                    | storage event engine for recording       | core.recording.event.parsers.MinioParser                                                                                                                      |
-| RECORDING_ENABLE_STORAGE_EVENT_AUTH             | enable storage event authorization       | true                                                                                                                                                          |
-| RECORDING_STORAGE_EVENT_ENABLE                  | enable recording storage events          | false                                                                                                                                                         |
-| RECORDING_STORAGE_EVENT_TOKEN                   | recording storage event token            |                                                                                                                                                               |
-| SUMMARY_SERVICE_ENDPOINT                        | summary service endpoint                 |                                                                                                                                                               |
-| SUMMARY_SERVICE_API_TOKEN                       | api token voor summary service           |                                                                                                                                                               |
-| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | signup users to marketing emails         | false                                                                                                                                                         |
-| MARKETING_SERVICE_CLASS                         | markering class                          | core.services.marketing.BrevoMarketingService                                                                                                                 |
-| BREVO_API_KEY                                   | breva api key for marketing emails       |                                                                                                                                                               |
-| BREVO_API_CONTACT_LIST_IDS                      | brevo api contact list ids               | []                                                                                                                                                            |
-| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | brevo contact attributes                 | {"VISIO_USER": True}                                                                                                                                          |
-| BREVO_API_TIMEOUT                               | brevo timeout                            | 1                                                                                                                                                             |
-| LOBBY_KEY_PREFIX                                | lobby prefix                             | room_lobby                                                                                                                                                    |
-| LOBBY_WAITING_TIMEOUT                           | lobby waiting tumeout                    | 3                                                                                                                                                             |
-| LOBBY_DENIED_TIMEOUT                            | lobby deny timeout                       | 5                                                                                                                                                             |
-| LOBBY_ACCEPTED_TIMEOUT                          | lobby accept timeout                     | 21600                                                                                                                                                         |
-| LOBBY_NOTIFICATION_TYPE                         | lobby notification types                 | participantWaiting                                                                                                                                            |
-| LOBBY_COOKIE_NAME                               | lobby cookie name                        | lobbyParticipantId                                                                                                                                            |
+| Option                                          | Description                                                                                                                                                | default                                                                                                                                                       |
+| ----------------------------------------------- |------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| DATA_DIR                                        | Data directory location                                                                                                                                    | /data                                                                                                                                                         |
+| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                     | []                                                                                                                                                            |
+| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                        |                                                                                                                                                               |
+| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                               | []                                                                                                                                                            |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                | false                                                                                                                                                         |
+| DB_ENGINE                                       | Database engine used                                                                                                                                       | django.db.backends.postgresql_psycopg2                                                                                                                        |
+| DB_NAME                                         | Name of the database                                                                                                                                       | meet                                                                                                                                                          |
+| DB_USER                                         | User used to connect to database                                                                                                                           | dinum                                                                                                                                                         |
+| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                   | pass                                                                                                                                                          |
+| DB_HOST                                         | Hostname of the database                                                                                                                                   | localhost                                                                                                                                                     |
+| DB_PORT                                         | Port to connect to database                                                                                                                                | 5432                                                                                                                                                          |
+| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                 | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                       |
+| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                           |                                                                                                                                                               |
+| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                              |                                                                                                                                                               |
+| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                              |                                                                                                                                                               |
+| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                  |                                                                                                                                                               |
+| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                             | meet-media-storage                                                                                                                                            |
+| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                           | en-us                                                                                                                                                         |
+| REDIS_URL                                       | Redis endpoint                                                                                                                                             | redis://redis:6379/1                                                                                                                                          |
+| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                       | 43200 (12 hours)                                                                                                                                              |
+| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                               | 150/minute                                                                                                                                                    |
+| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                           | 600/minute                                                                                                                                                    |
+| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                 | false                                                                                                                                                         |
+| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                  | []                                                                                                                                                            |
+| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app       |                                                                                                                                                               |
+| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                      | {}                                                                                                                                                            |
+| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools` | {}                                                                                                                                                            |
+| FRONTEND_TRANSCRIPT                             | Frontend transcription configuration, you can pass a beta form, with `form_beta_users`                                                                     | {}                                                                                                                                                            |
+| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                            | {}                                                                                                                                                            |
+| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                 | false                                                                                                                                                         |
+| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                | true                                                                                                                                                          |
+| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                            | {}                                                                                                                                                            |
+| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                          | false                                                                                                                                                         |
+| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                          | false                                                                                                                                                         |
+| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                      | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
+| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                   |                                                                                                                                                               |
+| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                        |                                                                                                                                                               |
+| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                    |                                                                                                                                                               |
+| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                        |                                                                                                                                                               |
+| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                             | false                                                                                                                                                         |
+| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                             | false                                                                                                                                                         |
+| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                         | from@example.com                                                                                                                                              |
+| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                        |                                                                                                                                                               |
+| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                      |                                                                                                                                                               |
+| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                           |                                                                                                                                                               |
+| EMAIL_DOMAIN                                    | Email domain                                                                                                                                               |                                                                                                                                                               |
+| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                         |                                                                                                                                                               |
+| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                     | false                                                                                                                                                         |
+| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                             | []                                                                                                                                                            |
+| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                          | []                                                                                                                                                            |
+| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                          |                                                                                                                                                               |
+| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                         | redis://redis:6379/0                                                                                                                                          |
+| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                      | {}                                                                                                                                                            |
+| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                             | true                                                                                                                                                          |
+| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                        | true                                                                                                                                                          |
+| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                       | false                                                                                                                                                         |
+| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                  | RS256                                                                                                                                                         |
+| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                             | meet                                                                                                                                                          |
+| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                         |                                                                                                                                                               |
+| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                     |                                                                                                                                                               |
+| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                            |                                                                                                                                                               |
+| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                    |                                                                                                                                                               |
+| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                     |                                                                                                                                                               |
+| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                     | AUTO                                                                                                                                                          |
+| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                   |                                                                                                                                                               |
+| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                          | {}                                                                                                                                                            |
+| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                | openid email                                                                                                                                                  |
+| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                         | true                                                                                                                                                          |
+| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                     | false                                                                                                                                                         |
+| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                            | []                                                                                                                                                            |
+| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                        | true                                                                                                                                                          |
+| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                    | returnTo                                                                                                                                                      |
+| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                            | ["given_name", "usual_name"]                                                                                                                                  |
+| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                           | given_name                                                                                                                                                    |
+| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                            | []                                                                                                                                                            |
+| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                         |                                                                                                                                                               |
+| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                             |                                                                                                                                                               |
+| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                               |                                                                                                                                                               |
+| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                            | true                                                                                                                                                          |
+| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                            |                                                                                                                                                               |
+| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                         |                                                                                                                                                               |
+| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                            |                                                                                                                                                               |
+| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                         | true                                                                                                                                                          |
+| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                    | public                                                                                                                                                        |
+| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                          | true                                                                                                                                                          |
+| RECORDING_ENABLE                                | Record meeting option                                                                                                                                      | false                                                                                                                                                         |
+| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                   | recordings                                                                                                                                                    |
+| RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                               | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
+| RECORDING_EVENT_PARSER_CLASS                    | Storage event engine for recording                                                                                                                         | core.recording.event.parsers.MinioParser                                                                                                                      |
+| RECORDING_ENABLE_STORAGE_EVENT_AUTH             | Enable storage event authorization                                                                                                                         | true                                                                                                                                                          |
+| RECORDING_STORAGE_EVENT_ENABLE                  | Enable recording storage events                                                                                                                            | false                                                                                                                                                         |
+| RECORDING_STORAGE_EVENT_TOKEN                   | Recording storage event token                                                                                                                              |                                                                                                                                                               |
+| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                               |                                                                                                                                                               |
+| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                  |                                                                                                                                                               |
+| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                   |                                                                                                                                                               |
+| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                              |                                                                                                                                                               |
+| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                           | false                                                                                                                                                         |
+| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                    | core.services.marketing.BrevoMarketingService                                                                                                                 |
+| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                         |                                                                                                                                                               |
+| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                 | []                                                                                                                                                            |
+| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                   | {"VISIO_USER": true}                                                                                                                                          |
+| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                   | 1                                                                                                                                                             |
+| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                           | room_lobby                                                                                                                                                    |
+| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                           | 3                                                                                                                                                             |
+| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                              | 5                                                                                                                                                             |
+| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                            | 21600 (6 hours)                                                                                                                                               |
+| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                   | participantWaiting                                                                                                                                            |
+| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                          | lobbyParticipantId                                                                                                                                            |
+| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                       | 600 (10 minutes)                                                                                                                                              |
+| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                               | false                                                                                                                                                         |
+| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                       | 10                                                                                                                                                            |
+| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                              | 5                                                                                                                                                             |

env.d/development/common.dist

@@ -12,12 +12,20 @@ PYTHONPATH=/app
 # Mail
 DJANGO_EMAIL_HOST="mailcatcher"
 DJANGO_EMAIL_PORT=1025
+DJANGO_EMAIL_BRAND_NAME=La Suite Numérique
+DJANGO_EMAIL_SUPPORT_EMAIL=test@yopmail.com
+DJANGO_EMAIL_LOGO_IMG=http://localhost:3000/assets/logo-suite-numerique.png
+DJANGO_EMAIL_DOMAIN=localhost:3000
+DJANGO_EMAIL_APP_BASE_URL=http://localhost:3000
 
 # Backend url
 MEET_BASE_URL="http://localhost:8072"
 
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
+AWS_S3_ENDPOINT_URL=http://minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 
 # OIDC
 OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/certs
@@ -34,11 +42,21 @@ LOGIN_REDIRECT_URL=http://localhost:3000
 LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
 LOGOUT_REDIRECT_URL=http://localhost:3000
 
-OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
+OIDC_REDIRECT_ALLOWED_HOSTS=localhost:8083,localhost:3000
 OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
 
 # Livekit Token settings
 LIVEKIT_API_SECRET=secret
 LIVEKIT_API_KEY=devkey
-LIVEKIT_API_URL=http://localhost:7880
+LIVEKIT_API_URL=http://127.0.0.1.nip.io:7880
+LIVEKIT_VERIFY_SSL=False
 ALLOW_UNREGISTERED_ROOMS=False
+
+# Recording
+SCREEN_RECORDING_BASE_URL=http://localhost:3000/recordings
+
+# Telephony
+ROOM_TELEPHONY_ENABLED=True
+
+FRONTEND_USE_FRENCH_GOV_FOOTER=False
+FRONTEND_USE_PROCONNECT_BUTTON=False

renovate.json

@@ -7,7 +7,7 @@
       "enabled": false,
       "groupName": "ignored python dependencies",
       "matchManagers": ["pep621"],
-      "matchPackageNames": []
+      "matchPackageNames": ["redis"]
     },
     {
       "enabled": false,

src/backend/core/admin.py

@@ -99,6 +99,7 @@ class ResourceAccessInline(admin.TabularInline):
 
     model = models.ResourceAccess
     extra = 0
+    autocomplete_fields = ["user"]
 
 
 @admin.register(models.Room)
@@ -106,6 +107,10 @@ class RoomAdmin(admin.ModelAdmin):
     """Room admin interface declaration."""
 
     inlines = (ResourceAccessInline,)
+    search_fields = ["name", "slug", "=id"]
+    list_display = ["name", "slug", "access_level", "created_at"]
+    list_filter = ["access_level", "created_at"]
+    readonly_fields = ["id", "created_at", "updated_at"]
 
 
 class RecordingAccessInline(admin.TabularInline):
@@ -120,4 +125,28 @@ class RecordingAdmin(admin.ModelAdmin):
     """Recording admin interface declaration."""
 
     inlines = (RecordingAccessInline,)
-    list_display = ("id", "status", "room", "created_at", "worker_id")
+    search_fields = ["status", "=id", "worker_id", "room__slug", "=room__id"]
+    list_display = ("id", "status", "room", "get_owner", "created_at", "worker_id")
+    list_filter = ["status", "room", "created_at"]
+    readonly_fields = ["id", "created_at", "updated_at"]
+
+    def get_queryset(self, request):
+        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
+        return super().get_queryset(request).prefetch_related("accesses__user")
+
+    def get_owner(self, obj):
+        """Return the owner of the recording for display in the admin list."""
+
+        owners = [
+            access
+            for access in obj.accesses.all()
+            if access.role == models.RoleChoices.OWNER
+        ]
+
+        if not owners:
+            return _("No owner")
+
+        if len(owners) > 1:
+            return _("Multiple owners")
+
+        return str(owners[0].user)

src/backend/core/api/__init__.py

@@ -40,6 +40,14 @@ def get_frontend_configuration(request):
         "recording": {
             "is_enabled": settings.RECORDING_ENABLE,
             "available_modes": settings.RECORDING_WORKER_CLASSES.keys(),
+            "expiration_days": settings.RECORDING_EXPIRATION_DAYS,
+        },
+        "telephony": {
+            "enabled": settings.ROOM_TELEPHONY_ENABLED,
+            "phone_number": settings.ROOM_TELEPHONY_PHONE_NUMBER
+            if settings.ROOM_TELEPHONY_ENABLED
+            else None,
+            "default_country": settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
         },
     }
     frontend_configuration.update(settings.FRONTEND_CONFIGURATION)

src/backend/core/api/permissions.py

@@ -64,7 +64,7 @@ class RoomPermissions(permissions.BasePermission):
         if request.method == "DELETE":
             return obj.is_owner(user)
 
-        return obj.is_administrator(user)
+        return obj.is_administrator_or_owner(user)
 
 
 class ResourceAccessPermission(IsAuthenticated):
@@ -80,7 +80,7 @@ class ResourceAccessPermission(IsAuthenticated):
         if request.method == "DELETE" and obj.role == RoleChoices.OWNER:
             return obj.user == user
 
-        return obj.resource.is_administrator(user)
+        return obj.resource.is_administrator_or_owner(user)
 
 
 class HasAbilityPermission(IsAuthenticated):
@@ -94,11 +94,11 @@ class HasAbilityPermission(IsAuthenticated):
 class HasPrivilegesOnRoom(IsAuthenticated):
     """Check if user has privileges on a given room."""
 
-    message = "You must have privileges to start a recording."
+    message = "You must have privileges on room to perform this action."
 
     def has_object_permission(self, request, view, obj):
         """Determine if user has privileges on room."""
-        return obj.is_owner(request.user) or obj.is_administrator(request.user)
+        return obj.is_administrator_or_owner(request.user)
 
 
 class IsRecordingEnabled(permissions.BasePermission):

src/backend/core/api/serializers.py

@@ -1,9 +1,12 @@
 """Client serializers for the Meet core app."""
 
+import uuid
+
 from django.utils.translation import gettext_lazy as _
 
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
+from timezone_field.rest_framework import TimeZoneSerializerField
 
 from core import models, utils
 
@@ -11,9 +14,11 @@ from core import models, utils
 class UserSerializer(serializers.ModelSerializer):
     """Serialize users."""
 
+    timezone = TimeZoneSerializerField()
+
     class Meta:
         model = models.User
-        fields = ["id", "email", "full_name", "short_name"]
+        fields = ["id", "email", "full_name", "short_name", "timezone", "language"]
         read_only_fields = ["id", "email", "full_name", "short_name"]
 
 
@@ -34,10 +39,10 @@ class ResourceAccessSerializerMixin:
             # Update
             self.instance
             and (
-                data["role"] == models.RoleChoices.OWNER
+                data.get("role") == models.RoleChoices.OWNER
                 and not self.instance.resource.is_owner(user)
                 or self.instance.role == models.RoleChoices.OWNER
-                and not self.instance.user == user
+                and self.instance.user != user
             )
         ) or (
             # Create
@@ -55,7 +60,9 @@ class ResourceAccessSerializerMixin:
         request = self.context.get("request", None)
         user = getattr(request, "user", None)
 
-        if not (user and user.is_authenticated and resource.is_administrator(user)):
+        if not (
+            user and user.is_authenticated and resource.is_administrator_or_owner(user)
+        ):
             raise PermissionDenied(
                 _("You must be administrator or owner of a room to add accesses to it.")
             )
@@ -100,8 +107,8 @@ class RoomSerializer(serializers.ModelSerializer):
 
     class Meta:
         model = models.Room
-        fields = ["id", "name", "slug", "configuration", "access_level"]
-        read_only_fields = ["id", "slug"]
+        fields = ["id", "name", "slug", "configuration", "access_level", "pin_code"]
+        read_only_fields = ["id", "slug", "pin_code"]
 
     def to_representation(self, instance):
         """
@@ -115,9 +122,11 @@ class RoomSerializer(serializers.ModelSerializer):
             return output
 
         role = instance.get_role(request.user)
-        is_admin = models.RoleChoices.check_administrator_role(role)
+        is_admin_or_owner = models.RoleChoices.check_administrator_role(
+            role
+        ) or models.RoleChoices.check_owner_role(role)
 
-        if role is not None:
+        if is_admin_or_owner:
             access_serializer = NestedResourceAccessSerializer(
                 instance.accesses.select_related("resource", "user").all(),
                 context=self.context,
@@ -125,7 +134,7 @@ class RoomSerializer(serializers.ModelSerializer):
             )
             output["accesses"] = access_serializer.data
 
-        if not is_admin:
+        if not is_admin_or_owner:
             del output["configuration"]
 
         should_access_room = (
@@ -144,7 +153,7 @@ class RoomSerializer(serializers.ModelSerializer):
                 room_id=room_id, user=request.user, username=username
             )
 
-        output["is_administrable"] = is_admin
+        output["is_administrable"] = is_admin_or_owner
 
         return output
 
@@ -156,7 +165,17 @@ class RecordingSerializer(serializers.ModelSerializer):
 
     class Meta:
         model = models.Recording
-        fields = ["id", "room", "created_at", "updated_at", "status", "mode"]
+        fields = [
+            "id",
+            "room",
+            "created_at",
+            "updated_at",
+            "status",
+            "mode",
+            "key",
+            "is_expired",
+            "expired_at",
+        ]
         read_only_fields = fields
 
 
@@ -189,11 +208,11 @@ class RequestEntrySerializer(serializers.Serializer):
 
     def create(self, validated_data):
         """Not implemented as this is a validation-only serializer."""
-        raise NotImplementedError("StartRecordingSerializer is validation-only")
+        raise NotImplementedError("RequestEntrySerializer is validation-only")
 
     def update(self, instance, validated_data):
         """Not implemented as this is a validation-only serializer."""
-        raise NotImplementedError("StartRecordingSerializer is validation-only")
+        raise NotImplementedError("RequestEntrySerializer is validation-only")
 
 
 class ParticipantEntrySerializer(serializers.Serializer):
@@ -202,13 +221,21 @@ class ParticipantEntrySerializer(serializers.Serializer):
     participant_id = serializers.CharField(required=True)
     allow_entry = serializers.BooleanField(required=True)
 
+    def validate_participant_id(self, value):
+        """Validate that the participant_id is a valid UUID hex string."""
+        try:
+            uuid.UUID(hex=value, version=4)
+        except (ValueError, TypeError) as e:
+            raise serializers.ValidationError("Invalid UUID hex format") from e
+        return value
+
     def create(self, validated_data):
         """Not implemented as this is a validation-only serializer."""
-        raise NotImplementedError("StartRecordingSerializer is validation-only")
+        raise NotImplementedError("ParticipantEntrySerializer is validation-only")
 
     def update(self, instance, validated_data):
         """Not implemented as this is a validation-only serializer."""
-        raise NotImplementedError("StartRecordingSerializer is validation-only")
+        raise NotImplementedError("ParticipantEntrySerializer is validation-only")
 
 
 class CreationCallbackSerializer(serializers.Serializer):
@@ -218,8 +245,22 @@ class CreationCallbackSerializer(serializers.Serializer):
 
     def create(self, validated_data):
         """Not implemented as this is a validation-only serializer."""
-        raise NotImplementedError("StartRecordingSerializer is validation-only")
+        raise NotImplementedError("CreationCallbackSerializer is validation-only")
 
     def update(self, instance, validated_data):
         """Not implemented as this is a validation-only serializer."""
-        raise NotImplementedError("StartRecordingSerializer is validation-only")
+        raise NotImplementedError("CreationCallbackSerializer is validation-only")
+
+
+class RoomInviteSerializer(serializers.Serializer):
+    """Validate room invite creation data."""
+
+    emails = serializers.ListField(child=serializers.EmailField(), allow_empty=False)
+
+    def create(self, validated_data):
+        """Not implemented as this is a validation-only serializer."""
+        raise NotImplementedError("RoomInviteSerializer is validation-only")
+
+    def update(self, instance, validated_data):
+        """Not implemented as this is a validation-only serializer."""
+        raise NotImplementedError("RoomInviteSerializer is validation-only")

src/backend/core/api/viewsets.py

@@ -4,7 +4,6 @@ import uuid
 from logging import getLogger
 from urllib.parse import urlparse
 
-
 from django.conf import settings
 from django.db.models import Q
 from django.http import Http404
@@ -22,7 +21,8 @@ from rest_framework import (
     status as drf_status,
 )
 
-from core import models, utils, enums
+from core import enums, models, utils
+from core.recording.enums import FileExtension
 from core.recording.event.authentication import StorageEventAuthentication
 from core.recording.event.exceptions import (
     InvalidBucketError,
@@ -41,6 +41,7 @@ from core.recording.worker.factories import (
 from core.recording.worker.mediator import (
     WorkerServiceMediator,
 )
+from core.services.invitation import InvitationService
 from core.services.livekit_events import (
     LiveKitEventsService,
     LiveKitWebhookError,
@@ -365,7 +366,7 @@ class RoomViewSet(
 
     @decorators.action(
         detail=True,
-        methods=["POST"],
+        methods=["post"],
         url_path="request-entry",
         permission_classes=[],
         throttle_classes=[RequestEntryAnonRateThrottle],
@@ -448,7 +449,7 @@ class RoomViewSet(
 
     @decorators.action(
         detail=False,
-        methods=["POST"],
+        methods=["post"],
         url_path="webhooks-livekit",
         permission_classes=[],
     )
@@ -474,7 +475,7 @@ class RoomViewSet(
 
     @decorators.action(
         detail=False,
-        methods=["POST"],
+        methods=["post"],
         url_path="creation-callback",
         permission_classes=[],
         throttle_classes=[CreationCallbackAnonRateThrottle],
@@ -497,41 +498,45 @@ class RoomViewSet(
             {"status": "success", "room": room}, status=drf_status.HTTP_200_OK
         )
 
+    @decorators.action(
+        detail=True,
+        methods=["post"],
+        url_path="invite",
+        permission_classes=[
+            permissions.HasPrivilegesOnRoom,
+        ],
+    )
+    def invite(self, request, pk=None):  # pylint: disable=unused-argument
+        """Send email invitations to join a room.
 
-class ResourceAccessListModelMixin:
-    """List mixin for resource access API."""
+        This API endpoint allows a user with appropriate privileges to send email invitations
+        to one or more recipients, inviting them to join the specified room.
+        """
 
-    def get_permissions(self):
-        """User only needs to be authenticated to list rooms access"""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        else:
-            return super().get_permissions()
+        room = self.get_object()
 
-        return [permission() for permission in permission_classes]
+        serializer = serializers.RoomInviteSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
 
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        queryset = super().get_queryset()
-        if self.action == "list":
-            user = self.request.user
-            queryset = queryset.filter(
-                Q(resource__accesses__user=user),
-                resource__accesses__role__in=[
-                    models.RoleChoices.ADMIN,
-                    models.RoleChoices.OWNER,
-                ],
-            ).distinct()
-        return queryset
+        emails = serializer.validated_data.get("emails")
+        emails = list(set(emails))
+
+        InvitationService().invite_to_room(
+            room=room, sender=request.user, emails=emails
+        )
+
+        return drf_response.Response(
+            {"status": "success", "message": "invitations sent"},
+            status=drf_status.HTTP_200_OK,
+        )
 
 
 class ResourceAccessViewSet(
-    ResourceAccessListModelMixin,
     mixins.CreateModelMixin,
     mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
     mixins.RetrieveModelMixin,
     mixins.UpdateModelMixin,
+    mixins.ListModelMixin,
     viewsets.GenericViewSet,
 ):
     """
@@ -542,6 +547,25 @@ class ResourceAccessViewSet(
     queryset = models.ResourceAccess.objects.all()
     serializer_class = serializers.ResourceAccessSerializer
 
+    def get_queryset(self):
+        """Return the queryset according to the action."""
+
+        queryset = super().get_queryset()
+
+        # Restrict access to resources the user either has explicit
+        # permissions for or administrative privileges over.
+        if self.action == "list":
+            user = self.request.user
+            queryset = queryset.filter(
+                Q(resource__accesses__user=user),
+                resource__accesses__role__in=[
+                    models.RoleChoices.ADMIN,
+                    models.RoleChoices.OWNER,
+                ],
+            ).distinct()
+
+        return queryset
+
 
 class RecordingViewSet(
     mixins.DestroyModelMixin,
@@ -594,7 +618,7 @@ class RecordingViewSet(
             )
 
         try:
-            recording = models.Recording.objects.select_related('room').get(id=recording_id)
+            recording = models.Recording.objects.get(id=recording_id)
         except models.Recording.DoesNotExist as e:
             raise drf_exceptions.NotFound("No recording found for this event.") from e
 
@@ -621,17 +645,14 @@ class RecordingViewSet(
             {"message": "Event processed."},
         )
 
-
     def _auth_get_original_url(self, request):
         """
         Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
         Raises PermissionDenied if the header is missing.
-
         The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
         See corresponding ingress configuration in Helm chart and read about the
         nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
         is configured to do this.
-
         Based on the original url and the logged-in user, we must decide if we authorize Nginx
         to let this request go through (by returning a 200 code) or if we block it (by returning
         a 403 error). Note that we return 403 errors without any further details for security
@@ -665,7 +686,6 @@ class RecordingViewSet(
         """
         This view is used by an Nginx subrequest to control access to a recording's
         media file.
-
         When we let the request go through, we compute authorization headers that will be added to
         the request going through thanks to the nginx.ingress.kubernetes.io/auth-response-headers
         annotation. The request will then be proxied to the object storage backend who will
@@ -679,24 +699,30 @@ class RecordingViewSet(
         )
 
         user = request.user
-        recording_id = url_params['recording']
+        recording_id = url_params["recording_id"]
+
+        extension = url_params["extension"]
+        if extension not in [item.value for item in FileExtension]:
+            raise drf_exceptions.ValidationError({"detail": "Unsupported extension."})
 
         try:
             recording = models.Recording.objects.get(id=recording_id)
         except models.Recording.DoesNotExist as e:
             raise drf_exceptions.NotFound("No recording found for this event.") from e
 
+        if extension != recording.extension:
+            raise drf_exceptions.NotFound("No recording found with this extension.")
+
         abilities = recording.get_abilities(user)
 
         if not abilities["retrieve"]:
-            logger.debug("User '%s' lacks permission for attachment", user)
+            logger.debug("User '%s' lacks permission for attachment", user.id)
             raise drf_exceptions.PermissionDenied()
 
         if not recording.is_saved:
             logger.debug("Recording '%s' has not been saved", recording)
             raise drf_exceptions.PermissionDenied()
 
-        # Generate S3 authorization headers using the extracted URL parameters
         request = utils.generate_s3_authorization_headers(recording.key)
 
         return drf_response.Response("authorized", headers=request.headers, status=200)

src/backend/core/apps.py

@@ -1,11 +0,0 @@
-"""Meet Core application"""
-# from django.apps import AppConfig
-# from django.utils.translation import gettext_lazy as _
-
-
-# class CoreConfig(AppConfig):
-#     """Configuration class for the Meet core app."""
-
-#     name = "core"
-#     app_label = "core"
-#     verbose_name = _("meet core application")

src/backend/core/authentication/backends.py

@@ -1,12 +1,13 @@
 """Authentication Backends for the Meet core app."""
 
+import contextlib
+
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 
-import requests
-from mozilla_django_oidc.auth import (
-    OIDCAuthenticationBackend as MozillaOIDCAuthenticationBackend,
+from lasuite.oidc_login.backends import (
+    OIDCAuthenticationBackend as LaSuiteOIDCAuthenticationBackend,
 )
 
 from core.models import User
@@ -17,93 +18,46 @@ from core.services.marketing import (
 )
 
 
-class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
+class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
     """Custom OpenID Connect (OIDC) Authentication Backend.
 
     This class overrides the default OIDC Authentication Backend to accommodate differences
     in the User and Identity models, and handles signed and/or encrypted UserInfo response.
     """
 
-    def get_userinfo(self, access_token, id_token, payload):
-        """Return user details dictionary.
+    def get_extra_claims(self, user_info):
+        """
+        Return extra claims from user_info.
 
-        Parameters:
-        - access_token (str): The access token.
-        - id_token (str): The id token (unused).
-        - payload (dict): The token payload (unused).
-
-        Note: The id_token and payload parameters are unused in this implementation,
-        but were kept to preserve base method signature.
-
-        Note: It handles signed and/or encrypted UserInfo Response. It is required by
-        Agent Connect, which follows the OIDC standard. It forces us to override the
-        base method, which deal with 'application/json' response.
+        Args:
+          user_info (dict): The user information dictionary.
 
         Returns:
-        - dict: User details dictionary obtained from the OpenID Connect user endpoint.
+          dict: A dictionary of extra claims.
+
         """
-
-        user_response = requests.get(
-            self.OIDC_OP_USER_ENDPOINT,
-            headers={"Authorization": f"Bearer {access_token}"},
-            verify=self.get_settings("OIDC_VERIFY_SSL", True),
-            timeout=self.get_settings("OIDC_TIMEOUT", None),
-            proxies=self.get_settings("OIDC_PROXY", None),
-        )
-        user_response.raise_for_status()
-        userinfo = self.verify_token(user_response.text)
-        return userinfo
-
-    def get_or_create_user(self, access_token, id_token, payload):
-        """Return a User based on userinfo. Get or create a new user if no user matches the Sub.
-
-        Parameters:
-        - access_token (str): The access token.
-        - id_token (str): The ID token.
-        - payload (dict): The user payload.
-
-        Returns:
-        - User: An existing or newly created User instance.
-
-        Raises:
-        - Exception: Raised when user creation is not allowed and no existing user is found.
-        """
-
-        user_info = self.get_userinfo(access_token, id_token, payload)
-        sub = user_info.get("sub")
-
-        if not sub:
-            raise SuspiciousOperation(
-                _("User info contained no recognizable user identification")
-            )
-
-        email = user_info.get("email")
-        user = self.get_existing_user(sub, email)
-
-        claims = {
-            "email": email,
+        return {
+            # Get user's full name from OIDC fields defined in settings
             "full_name": self.compute_full_name(user_info),
             "short_name": user_info.get(settings.OIDC_USERINFO_SHORTNAME_FIELD),
         }
-        if not user and self.get_settings("OIDC_CREATE_USER", True):
-            user = User.objects.create(
-                sub=sub,
-                password="!",  # noqa: S106
-                **claims,
-            )
 
-            if settings.SIGNUP_NEW_USER_TO_MARKETING_EMAIL:
-                self.signup_to_marketing_email(email)
+    def post_get_or_create_user(self, user, claims, is_new_user):
+        """
+        Post-processing after user creation or retrieval.
 
-        elif not user:
-            return None
+        Args:
+          user (User): The user instance.
+          claims (dict): The claims dictionary.
+          is_new_user (bool): Indicates if the user was newly created.
 
-        if not user.is_active:
-            raise SuspiciousOperation(_("User account is disabled"))
+        Returns:
+        - None
 
-        self.update_user_if_needed(user, claims)
-
-        return user
+        """
+        email = claims["email"]
+        if is_new_user and email and settings.SIGNUP_NEW_USER_TO_MARKETING_EMAIL:
+            self.signup_to_marketing_email(email)
 
     @staticmethod
     def signup_to_marketing_email(email):
@@ -116,7 +70,9 @@ class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
 
         Note: For a more robust solution, consider using Async task processing (Celery/Django-Q)
         """
-        try:
+        with contextlib.suppress(
+            ContactCreationError, ImproperlyConfigured, ImportError
+        ):
             marketing_service = get_marketing_service()
             contact_data = ContactData(
                 email=email, attributes={"VISIO_SOURCE": ["SIGNIN"]}
@@ -124,8 +80,6 @@ class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
             marketing_service.create_contact(
                 contact_data, timeout=settings.BREVO_API_TIMEOUT
             )
-        except (ContactCreationError, ImproperlyConfigured, ImportError):
-            pass
 
     def get_existing_user(self, sub, email):
         """Fetch existing user by sub or email."""
@@ -139,35 +93,6 @@ class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
                     pass
                 except User.MultipleObjectsReturned as e:
                     raise SuspiciousOperation(
-                        _("Multiple user accounts share a common email.")
+                        "Multiple user accounts share a common email."
                     ) from e
         return None
-
-    @staticmethod
-    def compute_full_name(user_info):
-        """Compute user's full name based on OIDC fields in settings."""
-        full_name = " ".join(
-            filter(
-                None,
-                (
-                    user_info.get(field)
-                    for field in settings.OIDC_USERINFO_FULLNAME_FIELDS
-                ),
-            )
-        )
-        return full_name or None
-
-    @staticmethod
-    def update_user_if_needed(user, claims):
-        """Update user claims if they have changed."""
-        user_fields = vars(user.__class__)  # Get available model fields
-        updated_claims = {
-            key: value
-            for key, value in claims.items()
-            if value and key in user_fields and value != getattr(user, key)
-        }
-
-        if not updated_claims:
-            return
-
-        User.objects.filter(sub=user.sub).update(**updated_claims)

src/backend/core/authentication/urls.py

@@ -1,18 +0,0 @@
-"""Authentication URLs for the People core app."""
-
-from django.urls import path
-
-from mozilla_django_oidc.urls import urlpatterns as mozzila_oidc_urls
-
-from .views import OIDCLogoutCallbackView, OIDCLogoutView
-
-urlpatterns = [
-    # Override the default 'logout/' path from Mozilla Django OIDC with our custom view.
-    path("logout/", OIDCLogoutView.as_view(), name="oidc_logout_custom"),
-    path(
-        "logout-callback/",
-        OIDCLogoutCallbackView.as_view(),
-        name="oidc_logout_callback",
-    ),
-    *mozzila_oidc_urls,
-]

src/backend/core/authentication/views.py

@@ -1,181 +0,0 @@
-"""Authentication Views for the People core app."""
-
-import copy
-from urllib.parse import urlencode
-
-from django.contrib import auth
-from django.core.exceptions import SuspiciousOperation
-from django.http import HttpResponseRedirect
-from django.urls import reverse
-from django.utils import crypto
-
-from mozilla_django_oidc.utils import (
-    absolutify,
-)
-from mozilla_django_oidc.views import (
-    OIDCAuthenticationCallbackView as MozillaOIDCAuthenticationCallbackView,
-)
-from mozilla_django_oidc.views import (
-    OIDCAuthenticationRequestView as MozillaOIDCAuthenticationRequestView,
-)
-from mozilla_django_oidc.views import (
-    OIDCLogoutView as MozillaOIDCOIDCLogoutView,
-)
-
-
-class OIDCLogoutView(MozillaOIDCOIDCLogoutView):
-    """Custom logout view for handling OpenID Connect (OIDC) logout flow.
-
-    Adds support for handling logout callbacks from the identity provider (OP)
-    by initiating the logout flow if the user has an active session.
-
-    The Django session is retained during the logout process to persist the 'state' OIDC parameter.
-    This parameter is crucial for maintaining the integrity of the logout flow between this call
-    and the subsequent callback.
-    """
-
-    @staticmethod
-    def persist_state(request, state):
-        """Persist the given 'state' parameter in the session's 'oidc_states' dictionary
-
-        This method is used to store the OIDC state parameter in the session, according to the
-        structure expected by Mozilla Django OIDC's 'add_state_and_verifier_and_nonce_to_session'
-        utility function.
-        """
-
-        if "oidc_states" not in request.session or not isinstance(
-            request.session["oidc_states"], dict
-        ):
-            request.session["oidc_states"] = {}
-
-        request.session["oidc_states"][state] = {}
-        request.session.save()
-
-    def construct_oidc_logout_url(self, request):
-        """Create the redirect URL for interfacing with the OIDC provider.
-
-        Retrieves the necessary parameters from the session and constructs the URL
-        required to initiate logout with the OpenID Connect provider.
-
-        If no ID token is found in the session, the logout flow will not be initiated,
-        and the method will return the default redirect URL.
-
-        The 'state' parameter is generated randomly and persisted in the session to ensure
-        its integrity during the subsequent callback.
-        """
-
-        oidc_logout_endpoint = self.get_settings("OIDC_OP_LOGOUT_ENDPOINT")
-
-        if not oidc_logout_endpoint:
-            return self.redirect_url
-
-        reverse_url = reverse("oidc_logout_callback")
-        id_token = request.session.get("oidc_id_token", None)
-
-        if not id_token:
-            return self.redirect_url
-
-        query = {
-            "id_token_hint": id_token,
-            "state": crypto.get_random_string(self.get_settings("OIDC_STATE_SIZE", 32)),
-            "post_logout_redirect_uri": absolutify(request, reverse_url),
-        }
-
-        self.persist_state(request, query["state"])
-
-        return f"{oidc_logout_endpoint}?{urlencode(query)}"
-
-    def post(self, request):
-        """Handle user logout.
-
-        If the user is not authenticated, redirects to the default logout URL.
-        Otherwise, constructs the OIDC logout URL and redirects the user to start
-        the logout process.
-
-        If the user is redirected to the default logout URL, ensure her Django session
-        is terminated.
-        """
-
-        logout_url = self.redirect_url
-
-        if request.user.is_authenticated:
-            logout_url = self.construct_oidc_logout_url(request)
-
-        # If the user is not redirected to the OIDC provider, ensure logout
-        if logout_url == self.redirect_url:
-            auth.logout(request)
-
-        return HttpResponseRedirect(logout_url)
-
-
-class OIDCLogoutCallbackView(MozillaOIDCOIDCLogoutView):
-    """Custom view for handling the logout callback from the OpenID Connect (OIDC) provider.
-
-    Handles the callback after logout from the identity provider (OP).
-    Verifies the state parameter and performs necessary logout actions.
-
-    The Django session is maintained during the logout process to ensure the integrity
-    of the logout flow initiated in the previous step.
-    """
-
-    http_method_names = ["get"]
-
-    def get(self, request):
-        """Handle the logout callback.
-
-        If the user is not authenticated, redirects to the default logout URL.
-        Otherwise, verifies the state parameter and performs necessary logout actions.
-        """
-
-        if not request.user.is_authenticated:
-            return HttpResponseRedirect(self.redirect_url)
-
-        state = request.GET.get("state")
-
-        if state not in request.session.get("oidc_states", {}):
-            msg = "OIDC callback state not found in session `oidc_states`!"
-            raise SuspiciousOperation(msg)
-
-        del request.session["oidc_states"][state]
-        request.session.save()
-
-        auth.logout(request)
-
-        return HttpResponseRedirect(self.redirect_url)
-
-
-class OIDCAuthenticationCallbackView(MozillaOIDCAuthenticationCallbackView):
-    """Custom callback view for handling the silent login flow."""
-
-    @property
-    def failure_url(self):
-        """Override the failure URL property to handle silent login flow
-
-        A silent login failure (e.g., no active user session) should not be
-        considered as an authentication failure.
-        """
-        if self.request.session.get("silent", None):
-            del self.request.session["silent"]
-            self.request.session.save()
-            return self.success_url
-        return super().failure_url
-
-
-class OIDCAuthenticationRequestView(MozillaOIDCAuthenticationRequestView):
-    """Custom authentication view for handling the silent login flow."""
-
-    def get_extra_params(self, request):
-        """Handle 'prompt' extra parameter for the silent login flow
-
-        This extra parameter is necessary to distinguish between a standard
-        authentication flow and the silent login flow.
-        """
-        extra_params = self.get_settings("OIDC_AUTH_REQUEST_EXTRA_PARAMS", None)
-        if extra_params is None:
-            extra_params = {}
-        if request.GET.get("silent") == "true":
-            extra_params = copy.deepcopy(extra_params)
-            extra_params.update({"prompt": "none"})
-            request.session["silent"] = True
-            request.session.save()
-        return extra_params

src/backend/core/enums.py

@@ -1,21 +1,21 @@
 """
 Core application enums declaration
 """
+
 import re
 
 from django.conf import global_settings, settings
 from django.utils.translation import gettext_lazy as _
 
-
 UUID_REGEX = (
     r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
 )
-FILE_EXT_REGEX = r"\.[a-zA-Z0-9]{1,10}"
-RECORDING_FOLDER = 'recordings'
-RECORDING_STORAGE_URL_PATTERN = re.compile(
-    f"/media/recordings/(?P<recording>{UUID_REGEX:s})(?P<extension>{FILE_EXT_REGEX:s})"
-)
+FILE_EXT_REGEX = r"[a-zA-Z0-9]{1,10}"
 
+# pylint: disable=line-too-long
+RECORDING_STORAGE_URL_PATTERN = re.compile(
+    f"/media/{settings.RECORDING_OUTPUT_FOLDER}/(?P<recording_id>{UUID_REGEX:s}).(?P<extension>{FILE_EXT_REGEX:s})"
+)
 
 # Django sets `LANGUAGES` by default with all supported languages. We can use it for
 # the choice of languages which should not be limited to the few languages active in

src/backend/core/factories.py

@@ -1,4 +1,3 @@
-# ruff: noqa: S311
 """
 Core application factories
 """

src/backend/core/migrations/0013_alter_user_language.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.1.8 on 2025-04-22 14:52
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0012_alter_room_access_level'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='user',
+            name='language',
+            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'), ('nl-nl', 'Dutch'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+        ),
+    ]

src/backend/core/migrations/0014_room_pin_code.py

@@ -0,0 +1,45 @@
+# Generated by Django 5.1.9 on 2025-05-13 08:22
+
+import secrets
+from django.db import migrations, models
+
+
+def generate_pin_for_rooms(apps, schema_editor):
+    """Generate unique 10-digit PIN codes for existing rooms.
+    The PIN code is required for SIP telephony features.
+    """
+    Room = apps.get_model('core', 'Room')
+    rooms_without_pin_code = Room.objects.filter(pin_code__isnull=True)
+    existing_pins = set(Room.objects.values_list('pin_code', flat=True))
+
+    length = 10
+
+    def generate_pin_code():
+        while True:
+            pin_code = str(secrets.randbelow(10 ** length)).zfill(length)
+            if pin_code not in existing_pins:
+                return pin_code
+
+    for room in rooms_without_pin_code:
+        room.pin_code = generate_pin_code()
+        room.save()
+
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0013_alter_user_language'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='room',
+            name='pin_code',
+            field=models.CharField(blank=True, help_text='Unique n-digit code that identifies this room in telephony mode.', max_length=None, null=True, unique=True, verbose_name='Room PIN code'),
+        ),
+        migrations.RunPython(
+            generate_pin_for_rooms,
+            reverse_code=migrations.RunPython.noop
+        ),
+    ]

src/backend/core/models.py

@@ -2,9 +2,11 @@
 Declare and configure the models for the Meet core application
 """
 
+import secrets
 import uuid
+from datetime import datetime, timedelta
 from logging import getLogger
-from typing import List
+from typing import List, Optional
 
 from django.conf import settings
 from django.contrib.auth import models as auth_models
@@ -12,12 +14,14 @@ from django.contrib.auth.base_user import AbstractBaseUser
 from django.core import mail, validators
 from django.core.exceptions import PermissionDenied, ValidationError
 from django.db import models
-from django.utils.functional import lazy
+from django.utils import timezone
 from django.utils.text import capfirst, slugify
 from django.utils.translation import gettext_lazy as _
 
 from timezone_field import TimeZoneField
 
+from .recording.enums import FileExtension
+
 logger = getLogger(__name__)
 
 
@@ -31,7 +35,7 @@ class RoleChoices(models.TextChoices):
     @classmethod
     def check_administrator_role(cls, role):
         """Check if a role is administrator."""
-        return role in [cls.ADMIN, cls.OWNER]
+        return role == cls.ADMIN
 
     @classmethod
     def check_owner_role(cls, role):
@@ -160,7 +164,7 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
     )
     language = models.CharField(
         max_length=10,
-        choices=lazy(lambda: settings.LANGUAGES, tuple)(),
+        choices=settings.LANGUAGES,
         default=settings.LANGUAGE_CODE,
         verbose_name=_("language"),
         help_text=_("The language in which the user wants to see the interface."),
@@ -284,13 +288,13 @@ class Resource(BaseModel):
                 role = RoleChoices.MEMBER
         return role
 
-    def is_administrator(self, user):
+    def is_administrator_or_owner(self, user):
         """
-        Check if a user is administrator of the resource.
-
-        Users carrying the "owner" role are considered as administrators a fortiori.
-        """
-        return RoleChoices.check_administrator_role(self.get_role(user))
+        Check if a user is administrator or owner of the resource."""
+        role = self.get_role(user)
+        return RoleChoices.check_administrator_role(
+            role
+        ) or RoleChoices.check_owner_role(role)
 
     def is_owner(self, user):
         """Check if a user is owner of the resource."""
@@ -379,6 +383,14 @@ class Room(Resource):
         verbose_name=_("Visio room configuration"),
         help_text=_("Values for Visio parameters to configure the room."),
     )
+    pin_code = models.CharField(
+        max_length=None,
+        unique=True,
+        blank=True,
+        null=True,
+        verbose_name=_("Room PIN code"),
+        help_text=_("Unique n-digit code that identifies this room in telephony mode."),
+    )
 
     class Meta:
         db_table = "meet_room"
@@ -389,6 +401,14 @@ class Room(Resource):
     def __str__(self):
         return capfirst(self.name)
 
+    def save(self, *args, **kwargs):
+        """Generate a unique n-digit pin code for new rooms."""
+        if settings.ROOM_TELEPHONY_ENABLED and not self.pk and not self.pin_code:
+            self.pin_code = self.generate_unique_pin_code(
+                length=settings.ROOM_TELEPHONY_PIN_LENGTH
+            )
+        super().save(*args, **kwargs)
+
     def clean_fields(self, exclude=None):
         """
         Automatically generate the slug from the name and make sure it does not look like a UUID.
@@ -403,6 +423,7 @@ class Room(Resource):
             pass
         else:
             raise ValidationError({"name": f'Room name "{self.name:s}" is reserved.'})
+
         super().clean_fields(exclude=exclude)
 
     @property
@@ -410,6 +431,31 @@ class Room(Resource):
         """Check if a room is public"""
         return self.access_level == RoomAccessLevel.PUBLIC
 
+    @staticmethod
+    def generate_unique_pin_code(length):
+        """Generate a unique n-digit PIN code"""
+
+        if length < 4:
+            raise ValueError(
+                "PIN code length must be at least 4 digits for minimal security"
+            )
+
+        max_value = 10**length
+
+        for _ in range(settings.ROOM_TELEPHONY_PIN_MAX_RETRIES):
+            pin_code = str(secrets.randbelow(max_value)).zfill(length)
+            if not Room.objects.filter(pin_code=pin_code).exists():
+                return pin_code
+
+        # Log a warning as a temporary measure until backend observability is implemented.
+        logger.warning(
+            "Failed to generate unique PIN code of length %s after %s attempts",
+            length,
+            settings.ROOM_TELEPHONY_PIN_MAX_RETRIES,
+        )
+
+        return None
+
 
 class BaseAccessManager(models.Manager):
     """Base manager for handling resource access control."""
@@ -578,16 +624,55 @@ class Recording(BaseModel):
 
     @property
     def is_saved(self) -> bool:
-        """Wip"""
+        """Check if the recording is in a saved state."""
         return self.status in {
+            RecordingStatusChoices.NOTIFICATION_SUCCEEDED,
             RecordingStatusChoices.SAVED,
         }
 
+    @property
+    def extension(self):
+        """Get recording extension based on its mode."""
+        extensions = {
+            RecordingModeChoices.TRANSCRIPT: FileExtension.OGG.value,
+            RecordingModeChoices.SCREEN_RECORDING: FileExtension.MP4.value,
+        }
+        return extensions.get(self.mode, FileExtension.MP4.value)
+
     @property
     def key(self):
-        """Wip."""
-        extension = "ogg" if self.mode == RecordingModeChoices.TRANSCRIPT else "mp4"
-        return f"{settings.RECORDING_OUTPUT_FOLDER}/{self.id}.{extension}"
+        """Generate the file key based on recording mode."""
+
+        return f"{settings.RECORDING_OUTPUT_FOLDER}/{self.id}.{self.extension}"
+
+    @property
+    def expired_at(self) -> Optional[datetime]:
+        """
+        Calculate the expiration date based on created_at and RECORDING_EXPIRATION_DAYS.
+        Returns None if no expiration is configured.
+
+        Note: This is a naive and imperfect implementation since recordings are actually
+        saved to the bucket after created_at timestamp is set. The actual expiration
+        will be determined by the bucket lifecycle policy which operates on the object's
+        timestamp in the storage system, not this value.
+        """
+
+        if not settings.RECORDING_EXPIRATION_DAYS:
+            return None
+
+        return self.created_at + timedelta(days=settings.RECORDING_EXPIRATION_DAYS)
+
+    @property
+    def is_expired(self) -> bool:
+        """
+        Determine if the recording has expired by comparing expired_at with current UTC time.
+        Returns False if no expiration is configured or if expiration date is in the future.
+        """
+        if not self.expired_at:
+            return False
+
+        return self.expired_at < timezone.now()
+
 
 class RecordingAccess(BaseAccess):
     """Relation model to give access to a recording for a user or a team with a role."""

src/backend/core/recording/enums.py

@@ -0,0 +1,10 @@
+"""Enums related to recordings."""
+
+from enum import Enum
+
+
+class FileExtension(Enum):
+    """Enum for file extensions used in recordings."""
+
+    OGG = "ogg"
+    MP4 = "mp4"

src/backend/core/recording/event/authentication.py

@@ -55,7 +55,7 @@ class StorageEventAuthentication(BaseAuthentication):
         if not required_token:
             if settings.RECORDING_ENABLE_STORAGE_EVENT_AUTH:
                 raise AuthenticationFailed(
-                    _("Authentication is enabled but token is not configured.")
+                    "Authentication is enabled but token is not configured."
                 )
 
             return MachineUser(), None
@@ -67,7 +67,7 @@ class StorageEventAuthentication(BaseAuthentication):
                 "Authentication failed: Missing Authorization header (ip: %s)",
                 request.META.get("REMOTE_ADDR"),
             )
-            raise AuthenticationFailed(_("Authorization header is required"))
+            raise AuthenticationFailed("Authorization header is required")
 
         auth_parts = auth_header.split(" ")
         if len(auth_parts) != 2 or auth_parts[0] != self.TOKEN_TYPE:
@@ -75,7 +75,7 @@ class StorageEventAuthentication(BaseAuthentication):
                 "Authentication failed: Invalid authorization header (ip: %s)",
                 request.META.get("REMOTE_ADDR"),
             )
-            raise AuthenticationFailed(_("Invalid authorization header."))
+            raise AuthenticationFailed("Invalid authorization header.")
 
         token = auth_parts[1]
 
@@ -85,7 +85,7 @@ class StorageEventAuthentication(BaseAuthentication):
                 "Authentication failed: Invalid token (ip: %s)",
                 request.META.get("REMOTE_ADDR"),
             )
-            raise AuthenticationFailed(_("Invalid token"))
+            raise AuthenticationFailed("Invalid token")
 
         return MachineUser(), token
 

src/backend/core/recording/event/notification.py

@@ -4,11 +4,10 @@ import logging
 import smtplib
 
 from django.conf import settings
+from django.core.mail import send_mail
 from django.template.loader import render_to_string
 from django.utils.translation import get_language, override
 from django.utils.translation import gettext_lazy as _
-from django.contrib.sites.models import Site
-from django.core.mail import send_mail
 
 import requests
 
@@ -38,11 +37,12 @@ class NotificationService:
 
     @staticmethod
     def _notify_user_by_email(recording) -> bool:
-        """Wip."""
+        """
+        Send an email notification to recording owners when their recording is ready.
 
-        # subject
-        # emails
-        domain = Site.objects.get_current().domain
+        The email includes a direct link that redirects owners to a dedicated download
+        page in the frontend where they can access their specific recording.
+        """
 
         owner_accesses = (
             models.RecordingAccess.objects.select_related("user")
@@ -50,50 +50,63 @@ class NotificationService:
                 role=models.RoleChoices.OWNER,
                 recording_id=recording.id,
             )
-            .all()
+            .order_by("created_at")
         )
 
         if not owner_accesses:
             logger.error("No owner found for recording %s", recording.id)
             return False
 
-        language = get_language()
+        context = {
+            "brandname": settings.EMAIL_BRAND_NAME,
+            "support_email": settings.EMAIL_SUPPORT_EMAIL,
+            "logo_img": settings.EMAIL_LOGO_IMG,
+            "domain": settings.EMAIL_DOMAIN,
+            "room_name": recording.room.name,
+            "recording_expiration_days": settings.RECORDING_EXPIRATION_DAYS,
+            "link": f"{settings.SCREEN_RECORDING_BASE_URL}/{recording.id}",
+        }
 
-        context = (
-            {
-                "brandname": settings.EMAIL_BRAND_NAME,
-                "support_email": settings.EMAIL_SUPPORT_EMAIL,
-                "logo_img": settings.EMAIL_LOGO_IMG,
-                "domain": domain,
-                "room_name": recording.room.name,
-                "recording_date": recording.created_at.strftime("%A %d %B %Y"),
-                "recording_time": recording.created_at.strftime("%H:%M"),
-                "link": f"{domain}/recordings/{recording.id}",
-            }
-        )
+        has_failures = False
 
-        emails = [access.user.email for access in owner_accesses]
-
-        with override(language):
-            msg_html = render_to_string("mail/html/screen_recording.html", context)
-            msg_plain = render_to_string("mail/text/screen_recording.txt", context)
-            subject = str(_("Your recording is ready"))  # Force translation
-
-            try:
-                send_mail(
-                    subject.capitalize(),
-                    msg_plain,
-                    settings.EMAIL_FROM,
-                    emails,
-                    html_message=msg_html,
-                    fail_silently=False,
+        # We process emails individually rather than in batch because:
+        # 1. Each email requires personalization (timezone, language)
+        # 2. The number of recipients per recording is typically small (not thousands)
+        for access in owner_accesses:
+            user = access.user
+            language = user.language or get_language()
+            with override(language):
+                personalized_context = {
+                    "recording_date": recording.created_at.astimezone(
+                        user.timezone
+                    ).strftime("%Y-%m-%d"),
+                    "recording_time": recording.created_at.astimezone(
+                        user.timezone
+                    ).strftime("%H:%M"),
+                    **context,
+                }
+                msg_html = render_to_string(
+                    "mail/html/screen_recording.html", personalized_context
                 )
-            except smtplib.SMTPException as exception:
-                logger.error("notification to %s was not sent: %s", emails, exception)
-                return False
+                msg_plain = render_to_string(
+                    "mail/text/screen_recording.txt", personalized_context
+                )
+                subject = str(_("Your recording is ready"))  # Force translation
 
-        return True
+                try:
+                    send_mail(
+                        subject.capitalize(),
+                        msg_plain,
+                        settings.EMAIL_FROM,
+                        [user.email],
+                        html_message=msg_html,
+                        fail_silently=False,
+                    )
+                except smtplib.SMTPException as exception:
+                    logger.error("notification could not be sent: %s", exception)
+                    has_failures = True
 
+        return not has_failures
 
     @staticmethod
     def _notify_summary_service(recording):

src/backend/core/recording/event/parsers.py

@@ -86,7 +86,7 @@ class MinioParser:
 
         # pylint: disable=line-too-long
         self._filepath_regex = re.compile(
-            r"(?P<url_encoded_folder_path>(?:[^%]+%2F)*)?(?P<recording_id>[0-9a-fA-F\-]{36})\.(?P<extension>[a-zA-Z0-9]+)"
+            r"(?P<url_encoded_folder_path>(?:[^%]+%2F)+)?(?P<recording_id>[0-9a-fA-F\-]{36})\.(?P<extension>[a-zA-Z0-9]+)"
         )
 
     @staticmethod
@@ -123,7 +123,7 @@ class MinioParser:
                 f"Invalid bucket: expected {self._bucket_name}, got {event_data.bucket_name}"
             )
 
-        if not event_data.filetype in self._allowed_filetypes:
+        if event_data.filetype not in self._allowed_filetypes:
             raise InvalidFileTypeError(
                 f"Invalid file type, expected {self._allowed_filetypes},"
                 f"got '{event_data.filetype}'"

src/backend/core/recording/worker/factories.py

@@ -17,7 +17,6 @@ class WorkerServiceConfig:
 
     output_folder: str
     server_configurations: Dict[str, Any]
-    verify_ssl: Optional[bool]
     bucket_args: Optional[dict]
 
     @classmethod
@@ -29,7 +28,6 @@ class WorkerServiceConfig:
         return cls(
             output_folder=settings.RECORDING_OUTPUT_FOLDER,
             server_configurations=settings.LIVEKIT_CONFIGURATION,
-            verify_ssl=settings.RECORDING_VERIFY_SSL,
             bucket_args={
                 "endpoint": settings.AWS_S3_ENDPOINT_URL,
                 "access_key": settings.AWS_S3_ACCESS_KEY_ID,

src/backend/core/recording/worker/services.py

@@ -2,11 +2,11 @@
 
 # pylint: disable=no-member
 
-import aiohttp
 from asgiref.sync import async_to_sync
 from livekit import api as livekit_api
-from livekit.api.egress_service import EgressService
 
+from ... import utils
+from ..enums import FileExtension
 from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig
 
@@ -28,21 +28,26 @@ class BaseEgressService:
     async def _handle_request(self, request, method_name: str):
         """Handle making a request to the LiveKit API and returns the response."""
 
-        # Use HTTP connector for local development with Tilt,
-        # where cluster communications are unsecure
-        connector = aiohttp.TCPConnector(ssl=self._config.verify_ssl)
+        lkapi = utils.create_livekit_client(self._config.server_configurations)
 
-        async with aiohttp.ClientSession(connector=connector) as session:
-            client = EgressService(session, **self._config.server_configurations)
-            method = getattr(client, method_name)
-            try:
-                response = await method(request)
-            except livekit_api.TwirpError as e:
-                raise WorkerConnectionError(
-                    f"LiveKit client connection error, {e.message}."
-                ) from e
+        # ruff: noqa: SLF001
+        # pylint: disable=protected-access
+        method = getattr(lkapi._egress, method_name)
 
+        try:
+            response = await method(request)
             return response
+        except livekit_api.TwirpError as e:
+            raise WorkerConnectionError(
+                f"LiveKit client connection error, {e.message}."
+            ) from e
+        except Exception as e:
+            raise WorkerConnectionError(
+                f"Unexpected error during LiveKit client connection: {str(e)}"
+            ) from e
+
+        finally:
+            await lkapi.aclose()
 
     def stop(self, worker_id: str) -> str:
         """Stop an ongoing egress worker.
@@ -89,7 +94,9 @@ class VideoCompositeEgressService(BaseEgressService):
 
         # Save room's recording as a mp4 video file.
         file_type = livekit_api.EncodedFileType.MP4
-        filepath = self._get_filepath(filename=recording_id, extension="mp4")
+        filepath = self._get_filepath(
+            filename=recording_id, extension=FileExtension.MP4.value
+        )
 
         file_output = livekit_api.EncodedFileOutput(
             file_type=file_type,
@@ -98,8 +105,7 @@ class VideoCompositeEgressService(BaseEgressService):
         )
 
         request = livekit_api.RoomCompositeEgressRequest(
-            room_name=room_name,
-            file_outputs=[file_output],
+            room_name=room_name, file_outputs=[file_output], layout="speaker-light"
         )
 
         response = self._handle_request(request, "start_room_composite_egress")
@@ -120,7 +126,9 @@ class AudioCompositeEgressService(BaseEgressService):
 
         # Save room's recording as an ogg audio file.
         file_type = livekit_api.EncodedFileType.OGG
-        filepath = self._get_filepath(filename=recording_id, extension="ogg")
+        filepath = self._get_filepath(
+            filename=recording_id, extension=FileExtension.OGG.value
+        )
 
         file_output = livekit_api.EncodedFileOutput(
             file_type=file_type,

src/backend/core/services/invitation.py

@@ -0,0 +1,59 @@
+"""Invitation Service."""
+
+import smtplib
+from logging import getLogger
+
+from django.conf import settings
+from django.core.mail import send_mail
+from django.template.loader import render_to_string
+from django.utils.translation import get_language, override
+from django.utils.translation import gettext_lazy as _
+
+logger = getLogger(__name__)
+
+
+class InvitationError(Exception):
+    """Exception raised when invitation emails cannot be sent."""
+
+    status_code = 500
+
+
+class InvitationService:
+    """Service for invitations to users."""
+
+    @staticmethod
+    def invite_to_room(room, sender, emails):
+        """Send invitation emails to join a room."""
+
+        language = get_language()
+
+        context = {
+            "brandname": settings.EMAIL_BRAND_NAME,
+            "logo_img": settings.EMAIL_LOGO_IMG,
+            "domain": settings.EMAIL_DOMAIN,
+            "room_url": f"{settings.EMAIL_APP_BASE_URL}/{room.slug}",
+            "room_link": f"{settings.EMAIL_DOMAIN}/{room.slug}",
+            "sender_email": sender.email,
+        }
+
+        with override(language):
+            msg_html = render_to_string("mail/html/invitation.html", context)
+            msg_plain = render_to_string("mail/text/invitation.txt", context)
+            subject = str(
+                _(
+                    f"Video call in progress: {sender.email} is waiting for you to connect"
+                )
+            )  # Force translation
+
+            try:
+                send_mail(
+                    subject,
+                    msg_plain,
+                    settings.EMAIL_FROM,
+                    emails,
+                    html_message=msg_html,
+                    fail_silently=False,
+                )
+            except smtplib.SMTPException as e:
+                logger.error("invitation to %s was not sent: %s", emails, e)
+                raise InvitationError("Could not send invitation") from e

src/backend/core/services/livekit_events.py

@@ -2,12 +2,18 @@
 
 import uuid
 from enum import Enum
+from logging import getLogger
 
 from django.conf import settings
 
 from livekit import api
 
+from core import models
+
 from .lobby import LobbyService
+from .telephony import TelephonyException, TelephonyService
+
+logger = getLogger(__name__)
 
 
 class LiveKitWebhookError(Exception):
@@ -77,6 +83,7 @@ class LiveKitEventsService:
         )
         self.webhook_receiver = api.WebhookReceiver(token_verifier)
         self.lobby_service = LobbyService()
+        self.telephony_service = TelephonyService()
 
     def receive(self, request):
         """Process webhook and route to appropriate handler."""
@@ -108,10 +115,54 @@ class LiveKitEventsService:
         # pylint: disable=not-callable
         handler(data)
 
-    def _handle_room_finished(self, data):
-        """Handle 'room_finished' event."""
+    def _handle_room_started(self, data):
+        """Handle 'room_started' event."""
+
         try:
             room_id = uuid.UUID(data.room.name)
+        except ValueError as e:
+            logger.warning(
+                "Ignoring room event: room name '%s' is not a valid UUID format.",
+                data.room.name,
+            )
+            raise ActionFailedError("Failed to process room started event") from e
+
+        try:
+            room = models.Room.objects.get(id=room_id)
+        except models.Room.DoesNotExist as err:
+            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
+
+        if settings.ROOM_TELEPHONY_ENABLED:
+            try:
+                self.telephony_service.create_dispatch_rule(room)
+            except TelephonyException as e:
+                raise ActionFailedError(
+                    f"Failed to create telephony dispatch rule for room {room_id}"
+                ) from e
+
+    def _handle_room_finished(self, data):
+        """Handle 'room_finished' event."""
+
+        try:
+            room_id = uuid.UUID(data.room.name)
+        except ValueError as e:
+            logger.warning(
+                "Ignoring room event: room name '%s' is not a valid UUID format.",
+                data.room.name,
+            )
+            raise ActionFailedError("Failed to process room finished event") from e
+
+        if settings.ROOM_TELEPHONY_ENABLED:
+            try:
+                self.telephony_service.delete_dispatch_rule(room_id)
+            except TelephonyException as e:
+                raise ActionFailedError(
+                    f"Failed to delete telephony dispatch rule for room {room_id}"
+                ) from e
+
+        try:
             self.lobby_service.clear_room_cache(room_id)
         except Exception as e:
-            raise ActionFailedError("Failed to process room finished event") from e
+            raise ActionFailedError(
+                f"Failed to clear room cache for room {room_id}"
+            ) from e

src/backend/core/services/lobby.py

@@ -14,7 +14,6 @@ from django.core.cache import cache
 from asgiref.sync import async_to_sync
 from livekit.api import (  # pylint: disable=E0611
     ListRoomsRequest,
-    LiveKitAPI,
     SendDataRequest,
     TwirpError,
 )
@@ -347,7 +346,7 @@ class LobbyService:
             "type": settings.LOBBY_NOTIFICATION_TYPE,
         }
 
-        lkapi = LiveKitAPI(**settings.LIVEKIT_CONFIGURATION)
+        lkapi = utils.create_livekit_client()
 
         try:
             room_response = await lkapi.room.list_rooms(

src/backend/core/services/marketing.py

@@ -10,6 +10,7 @@ from django.core.exceptions import ImproperlyConfigured
 from django.utils.module_loading import import_string
 
 import brevo_python
+import urllib3
 
 logger = logging.getLogger(__name__)
 
@@ -120,8 +121,11 @@ class BrevoMarketingService:
 
         try:
             response = contact_api.create_contact(contact, **api_configurations)
-        except brevo_python.rest.ApiException as err:
-            logger.exception("Failed to create contact in Brevo")
+        except (
+            brevo_python.rest.ApiException,
+            urllib3.exceptions.ReadTimeoutError,
+        ) as err:
+            logger.warning("Failed to create contact in Brevo", exc_info=True)
             raise ContactCreationError("Failed to create contact in Brevo") from err
 
         return response

src/backend/core/services/telephony.py

@@ -0,0 +1,124 @@
+"""Telephony service for managing SIP dispatch rules for room access."""
+
+from logging import getLogger
+
+from asgiref.sync import async_to_sync
+from livekit.api import TwirpError
+from livekit.protocol.sip import (
+    CreateSIPDispatchRuleRequest,
+    DeleteSIPDispatchRuleRequest,
+    ListSIPDispatchRuleRequest,
+    SIPDispatchRule,
+    SIPDispatchRuleDirect,
+)
+
+from core import utils
+
+logger = getLogger(__name__)
+
+
+class TelephonyException(Exception):
+    """Exception raised when telephony operations fail."""
+
+
+class TelephonyService:
+    """Service for managing participant access through the telephony system (SIP)."""
+
+    def _rule_name(self, room_id):
+        """Generate the rule name for a room based on its ID."""
+        return f"SIP_{str(room_id)}"
+
+    @async_to_sync
+    async def create_dispatch_rule(self, room):
+        """Create a SIP inbound dispatch rule for direct room routing.
+
+        Configures telephony to route incoming SIP calls directly to the specified room
+        using the room's ID and PIN code for authentication.
+        """
+
+        direct_rule = SIPDispatchRule(
+            dispatch_rule_direct=SIPDispatchRuleDirect(
+                room_name=str(room.id), pin=str(room.pin_code)
+            )
+        )
+
+        request = CreateSIPDispatchRuleRequest(
+            rule=direct_rule, name=self._rule_name(room.id)
+        )
+
+        lkapi = utils.create_livekit_client()
+
+        try:
+            await lkapi.sip.create_sip_dispatch_rule(create=request)
+        except TwirpError as e:
+            logger.exception(
+                "Unexpected error creating dispatch rule for room %s", room.id
+            )
+            raise TelephonyException("Could not create dispatch rule") from e
+
+        finally:
+            await lkapi.aclose()
+
+    async def _list_dispatch_rules_ids(self, room_id):
+        """List SIP dispatch rule IDs for a specific room.
+
+        Fetches all existing SIP dispatch rules and filters them by room name
+        since LiveKit API doesn't support server-side filtering by 'room_name'.
+        This approach is acceptable for moderate scale but may need refactoring
+        for high-volume scenarios.
+
+        Note:
+            Feature request for server-side filtering: livekit/sip#405
+        """
+
+        lkapi = utils.create_livekit_client()
+
+        try:
+            existing_rules = await lkapi.sip.list_sip_dispatch_rule(
+                list=ListSIPDispatchRuleRequest()
+            )
+        except TwirpError as e:
+            logger.exception("Failed to list dispatch rules for room %s", room_id)
+            raise TelephonyException("Could not list dispatch rules") from e
+        finally:
+            await lkapi.aclose()
+
+        if not existing_rules or not existing_rules.items:
+            return []
+
+        rule_name = self._rule_name(room_id)
+
+        return [
+            existing_rule.sip_dispatch_rule_id
+            for existing_rule in existing_rules.items
+            if existing_rule.name == rule_name
+        ]
+
+    @async_to_sync
+    async def delete_dispatch_rule(self, room_id):
+        """Delete all SIP inbound dispatch rules associated with a specific room."""
+
+        rules_ids = await self._list_dispatch_rules_ids(room_id)
+
+        if not rules_ids:
+            logger.info("No dispatch rules found for room %s", room_id)
+            return False
+
+        if len(rules_ids) > 1:
+            logger.error("Multiple dispatch rules found for room %s", room_id)
+
+        lkapi = utils.create_livekit_client()
+        try:
+            for rule_id in rules_ids:
+                await lkapi.sip.delete_sip_dispatch_rule(
+                    delete=DeleteSIPDispatchRuleRequest(sip_dispatch_rule_id=rule_id)
+                )
+
+            return True
+
+        except TwirpError as e:
+            logger.exception("Failed to delete dispatch rules for room %s", room_id)
+            raise TelephonyException("Could not delete dispatch rules") from e
+
+        finally:
+            await lkapi.aclose()

src/backend/core/tests/authentication/test_backends.py

@@ -58,7 +58,7 @@ def test_authentication_getter_new_user_no_email(monkeypatch):
 
     assert user.sub == "123"
     assert user.email is None
-    assert user.password == "!"
+    assert user.has_usable_password() is False
     assert models.User.objects.count() == 1
 
 
@@ -84,7 +84,7 @@ def test_authentication_getter_new_user_with_email(monkeypatch):
     assert user.email == email
     assert user.full_name is None
     assert user.short_name is None
-    assert user.password == "!"
+    assert user.has_usable_password() is False
     assert models.User.objects.count() == 1
 
 
@@ -110,7 +110,7 @@ def test_authentication_getter_new_user_with_names(monkeypatch, email):
     assert user.email == email
     assert user.full_name == "John Doe"
     assert user.short_name == "John"
-    assert user.password == "!"
+    assert user.has_usable_password() is False
     assert models.User.objects.count() == 1
 
 
@@ -129,7 +129,7 @@ def test_models_oidc_user_getter_invalid_token(django_assert_num_queries, monkey
         django_assert_num_queries(0),
         pytest.raises(
             SuspiciousOperation,
-            match="User info contained no recognizable user identification",
+            match="Claims verification failed",
         ),
     ):
         klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
@@ -287,9 +287,7 @@ def test_finds_user_whitespace_email(django_assert_num_queries, settings):
     [
         "john.doe@ｅxample.com",  # Fullwidth character in domain
         "john.doe@еxample.com",  # Cyrillic 'е' in domain
-        "JOHN.DOe@exam𝔭le.com",  # Mixed Gothic '𝔭' in domain
         "john.doe@exаmple.com",  # Cyrillic 'а' (a) in domain
-        "john.doe@ｅ𝓧𝓪𝓶𝓹𝓵𝓮.com",  # Mixed fullwidth and cursive in domain
     ],
 )
 def test_authentication_getter_existing_user_email_tricky(email, monkeypatch, settings):

src/backend/core/tests/authentication/test_urls.py

@@ -1,10 +0,0 @@
-"""Unit tests for the Authentication URLs."""
-
-from core.authentication.urls import urlpatterns
-
-
-def test_urls_override_default_mozilla_django_oidc():
-    """Custom URL patterns should override default ones from Mozilla Django OIDC."""
-
-    url_names = [u.name for u in urlpatterns]
-    assert url_names.index("oidc_logout_custom") < url_names.index("oidc_logout")

src/backend/core/tests/authentication/test_views.py

@@ -1,359 +0,0 @@
-"""Unit tests for the Authentication Views."""
-
-from unittest import mock
-from urllib.parse import parse_qs, urlparse
-
-from django.contrib.auth.models import AnonymousUser
-from django.contrib.sessions.middleware import SessionMiddleware
-from django.core.exceptions import SuspiciousOperation
-from django.test import RequestFactory
-from django.test.utils import override_settings
-from django.urls import reverse
-from django.utils import crypto
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories
-from core.authentication.views import (
-    MozillaOIDCAuthenticationCallbackView,
-    OIDCAuthenticationCallbackView,
-    OIDCAuthenticationRequestView,
-    OIDCLogoutCallbackView,
-    OIDCLogoutView,
-)
-
-pytestmark = pytest.mark.django_db
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
-def test_view_logout_anonymous():
-    """Anonymous users calling the logout url,
-    should be redirected to the specified LOGOUT_REDIRECT_URL."""
-
-    url = reverse("oidc_logout_custom")
-    response = APIClient().get(url)
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
-
-
-@mock.patch.object(
-    OIDCLogoutView, "construct_oidc_logout_url", return_value="/example-logout"
-)
-def test_view_logout(mocked_oidc_logout_url):
-    """Authenticated users should be redirected to OIDC provider for logout."""
-
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    url = reverse("oidc_logout_custom")
-    response = client.get(url)
-
-    mocked_oidc_logout_url.assert_called_once()
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/default-redirect-logout")
-@mock.patch.object(
-    OIDCLogoutView, "construct_oidc_logout_url", return_value="/default-redirect-logout"
-)
-def test_view_logout_no_oidc_provider(mocked_oidc_logout_url):
-    """Authenticated users should be logged out when no OIDC provider is available."""
-
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    url = reverse("oidc_logout_custom")
-
-    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
-        response = client.get(url)
-        mocked_oidc_logout_url.assert_called_once()
-        mock_logout.assert_called_once()
-
-    assert response.status_code == 302
-    assert response.url == "/default-redirect-logout"
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
-def test_view_logout_callback_anonymous():
-    """Anonymous users calling the logout callback url,
-    should be redirected to the specified LOGOUT_REDIRECT_URL."""
-
-    url = reverse("oidc_logout_callback")
-    response = APIClient().get(url)
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
-
-
-@pytest.mark.parametrize(
-    "initial_oidc_states",
-    [{}, {"other_state": "foo"}],
-)
-def test_view_logout_persist_state(initial_oidc_states):
-    """State value should be persisted in session's data."""
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    if initial_oidc_states:
-        request.session["oidc_states"] = initial_oidc_states
-        request.session.save()
-
-    mocked_state = "mock_state"
-
-    OIDCLogoutView().persist_state(request, mocked_state)
-
-    assert "oidc_states" in request.session
-    assert request.session["oidc_states"] == {
-        "mock_state": {},
-        **initial_oidc_states,
-    }
-
-
-@override_settings(OIDC_OP_LOGOUT_ENDPOINT="/example-logout")
-@mock.patch.object(OIDCLogoutView, "persist_state")
-@mock.patch.object(crypto, "get_random_string", return_value="mocked_state")
-def test_view_logout_construct_oidc_logout_url(
-    mocked_get_random_string, mocked_persist_state
-):
-    """Should construct the logout URL to initiate the logout flow with the OIDC provider."""
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    request.session["oidc_id_token"] = "mocked_oidc_id_token"
-    request.session.save()
-
-    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
-
-    mocked_persist_state.assert_called_once()
-    mocked_get_random_string.assert_called_once()
-
-    params = parse_qs(urlparse(redirect_url).query)
-
-    assert params["id_token_hint"][0] == "mocked_oidc_id_token"
-    assert params["state"][0] == "mocked_state"
-
-    url = reverse("oidc_logout_callback")
-    assert url in params["post_logout_redirect_uri"][0]
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/")
-def test_view_logout_construct_oidc_logout_url_none_id_token():
-    """If no ID token is available in the session,
-    the user should be redirected to the final URL."""
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
-
-    assert redirect_url == "/"
-
-
-@pytest.mark.parametrize(
-    "initial_state",
-    [None, {"other_state": "foo"}],
-)
-def test_view_logout_callback_wrong_state(initial_state):
-    """Should raise an error if OIDC state doesn't match session data."""
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    if initial_state:
-        request.session["oidc_states"] = initial_state
-        request.session.save()
-
-    callback_view = OIDCLogoutCallbackView.as_view()
-
-    with pytest.raises(SuspiciousOperation) as excinfo:
-        callback_view(request)
-
-    assert (
-        str(excinfo.value) == "OIDC callback state not found in session `oidc_states`!"
-    )
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
-def test_view_logout_callback():
-    """If state matches, callback should clear OIDC state and redirects."""
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().get("/logout-callback/", data={"state": "mocked_state"})
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    mocked_state = "mocked_state"
-
-    request.session["oidc_states"] = {mocked_state: {}}
-    request.session.save()
-
-    callback_view = OIDCLogoutCallbackView.as_view()
-
-    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
-
-        def clear_user(request):
-            # Assert state is cleared prior to logout
-            assert request.session["oidc_states"] == {}
-            request.user = AnonymousUser()
-
-        mock_logout.side_effect = clear_user
-        response = callback_view(request)
-        mock_logout.assert_called_once()
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
-
-
-@pytest.mark.parametrize("mocked_extra_params_setting", [{"foo": 123}, {}, None])
-def test_view_authentication_default(settings, mocked_extra_params_setting):
-    """By default, authentication request should not trigger silent login."""
-
-    settings.OIDC_AUTH_REQUEST_EXTRA_PARAMS = mocked_extra_params_setting
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-    request.GET = {}
-
-    view = OIDCAuthenticationRequestView()
-    extra_params = view.get_extra_params(request)
-
-    assert extra_params == (mocked_extra_params_setting or {})
-
-
-@pytest.mark.parametrize("mocked_extra_params_setting", [{"foo": 123}, {}, None])
-def test_view_authentication_silent_false(settings, mocked_extra_params_setting):
-    """Ensure setting 'silent' parameter to a random value doesn't trigger the silent login flow."""
-
-    settings.OIDC_AUTH_REQUEST_EXTRA_PARAMS = mocked_extra_params_setting
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-    request.GET = {"silent": "foo"}
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    view = OIDCAuthenticationRequestView()
-    extra_params = view.get_extra_params(request)
-
-    assert extra_params == (mocked_extra_params_setting or {})
-    assert not request.session.get("silent")
-
-
-@pytest.mark.parametrize("mocked_extra_params_setting", [{"foo": 123}, {}, None])
-def test_view_authentication_silent_true(settings, mocked_extra_params_setting):
-    """If 'silent' parameter is set to True, the silent login should be triggered."""
-    settings.OIDC_AUTH_REQUEST_EXTRA_PARAMS = mocked_extra_params_setting
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-    request.GET = {"silent": "true"}
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    view = OIDCAuthenticationRequestView()
-    extra_params = view.get_extra_params(request)
-    expected_params = {"prompt": "none"}
-
-    assert (
-        extra_params == {**mocked_extra_params_setting, **expected_params}
-        if mocked_extra_params_setting
-        else expected_params
-    )
-    assert request.session.get("silent") is True
-
-
-@mock.patch.object(
-    MozillaOIDCAuthenticationCallbackView,
-    "failure_url",
-    new_callable=mock.PropertyMock,
-    return_value="foo",
-)
-def test_view_callback_failure_url(mocked_failure_url):
-    """Test default behavior of the 'failure_url' property"""
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    view = OIDCAuthenticationCallbackView()
-    view.request = request
-
-    returned_url = view.failure_url
-
-    mocked_failure_url.assert_called_once()
-    assert returned_url == "foo"
-
-
-@mock.patch.object(
-    OIDCAuthenticationCallbackView,
-    "success_url",
-    new_callable=mock.PropertyMock,
-    return_value="foo",
-)
-def test_view_callback_failure_url_silent_login(mocked_success_url):
-    """If a silent login was initiated and failed, it should not be treated as a failure."""
-
-    user = factories.UserFactory()
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    request.session["silent"] = True
-    request.session.save()
-
-    view = OIDCAuthenticationCallbackView()
-    view.request = request
-
-    returned_url = view.failure_url
-
-    mocked_success_url.assert_called_once()
-    assert returned_url == "foo"
-    assert not request.session.get("silent")

src/backend/core/tests/recording/event/test_notification.py

@@ -0,0 +1,224 @@
+"""
+Test event notification.
+"""
+
+# pylint: disable=E1128,W0621,W0613,W0212
+
+import datetime
+import smtplib
+from unittest import mock
+
+from django.contrib.sites.models import Site
+
+import pytest
+
+from core import factories, models
+from core.recording.event.notification import NotificationService, notification_service
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def mocked_current_site():
+    """Mocks the Site.objects.get_current()to return a controlled predefined domain."""
+
+    site_mock = mock.Mock()
+    site_mock.domain = "test-domain.com"
+
+    with mock.patch.object(
+        Site.objects, "get_current", return_value=site_mock
+    ) as patched:
+        yield patched
+
+
+@mock.patch.object(NotificationService, "_notify_summary_service", return_value=True)
+def test_notify_external_services_transcript_mode(mock_notify_summary):
+    """Test notification routing for transcript mode recordings."""
+
+    service = NotificationService()
+
+    recording = factories.RecordingFactory(mode=models.RecordingModeChoices.TRANSCRIPT)
+    result = service.notify_external_services(recording)
+
+    assert result is True
+    mock_notify_summary.assert_called_once_with(recording)
+
+
+@mock.patch.object(NotificationService, "_notify_user_by_email", return_value=True)
+def test_notify_external_services_screen_recording_mode(mock_notify_email):
+    """Test notification routing for screen recording mode."""
+
+    service = NotificationService()
+
+    recording = factories.RecordingFactory(
+        mode=models.RecordingModeChoices.SCREEN_RECORDING
+    )
+
+    result = service.notify_external_services(recording)
+
+    assert result is True
+    mock_notify_email.assert_called_once_with(recording)
+
+
+def test_notify_external_services_unknown_mode(caplog):
+    """Test notification for unknown recording mode."""
+    recording = factories.RecordingFactory()
+
+    # Bypass validation
+    recording.mode = "unknown"
+
+    service = NotificationService()
+
+    result = service.notify_external_services(recording)
+
+    assert result is False
+    assert f"Unknown recording mode unknown for recording {recording.id}" in caplog.text
+
+
+# pylint: disable=too-many-locals
+def test_notify_user_by_email_success(mocked_current_site, settings):
+    """Test successful email notification to recording owners."""
+    settings.EMAIL_BRAND_NAME = "ACME"
+    settings.EMAIL_SUPPORT_EMAIL = "support@acme.com"
+    settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
+    settings.SCREEN_RECORDING_BASE_URL = "https://acme.com/recordings"
+    settings.EMAIL_FROM = "notifications@acme.com"
+
+    recording = factories.RecordingFactory(room__name="Conference Room A")
+
+    # Fix recording test to avoid flaky tests
+    recording.created_at = datetime.datetime(2023, 5, 15, 14, 30, 0)
+
+    french_user = factories.UserFactory(
+        email="franc@test.com", language="fr-fr", timezone="Europe/Paris"
+    )
+    dutch_user = factories.UserFactory(
+        email="berry@test.com", language="nl-nl", timezone="Europe/Amsterdam"
+    )
+    english_user = factories.UserFactory(
+        email="john@test.com", language="en-us", timezone="America/Phoenix"
+    )
+
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER, user=french_user
+    )
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER, user=dutch_user
+    )
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER, user=english_user
+    )
+
+    # Create non-owner users to verify they don't receive emails
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.MEMBER
+    )
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.ADMIN
+    )
+
+    notification_service = NotificationService()
+
+    with mock.patch("core.recording.event.notification.send_mail") as mock_send_mail:
+        result = notification_service._notify_user_by_email(recording)
+
+        assert result is True
+        assert mock_send_mail.call_count == 3
+
+        call_args_list = mock_send_mail.call_args_list
+
+        base_content = [
+            "ACME",  # Brand name
+            "support@acme.com",  # Support email
+            "https://acme.com/logo",  # Logo URL
+            f"https://acme.com/recordings/{recording.id}",  # Recording link
+            "Conference Room A",  # Room name
+        ]
+
+        # First call verification
+        subject1, body1, sender1, recipients1 = call_args_list[0][0]
+        assert subject1 == "Votre enregistrement est prêt"
+
+        # Verify email contains expected content
+        personalized_content1 = [
+            *base_content,
+            "2023-05-15",  # Formatted date
+            "16:30",  # Formatted time
+            "Votre enregistrement est prêt !",  # Intro
+        ]
+        for content in personalized_content1:
+            assert content in body1
+
+        assert recipients1 == ["franc@test.com"]
+        assert sender1 == "notifications@acme.com"
+
+        # Second call verification
+        subject2, body2, sender2, recipients2 = call_args_list[1][0]
+        assert subject2 == "Je opname is klaar"
+
+        # Verify second email content (if needed)
+        personalized_content2 = [
+            *base_content,
+            "2023-05-15",  # Formatted date
+            "16:30",  # Formatted time
+            "Je opname is klaar!",  # Intro
+        ]
+        for content in personalized_content2:
+            assert content in body2
+
+        assert recipients2 == ["berry@test.com"]
+        assert sender2 == "notifications@acme.com"
+
+        # Third call verification
+        subject3, body3, sender3, recipients3 = call_args_list[2][0]
+        assert subject3 == "Your recording is ready"
+
+        # Verify second email content (if needed)
+        personalized_content3 = [
+            *base_content,
+            "Conference Room A",  # Room name
+            "2023-05-15",  # Formatted date
+            "07:30",  # Formatted time
+            "Your recording is ready!",  # Intro
+        ]
+        for content in personalized_content3:
+            assert content in body3
+
+        assert recipients3 == ["john@test.com"]
+        assert sender3 == "notifications@acme.com"
+
+
+def test_notify_user_by_email_no_owners(mocked_current_site, caplog):
+    """Test email notification when no owners are found."""
+
+    # Recording with no access
+    recording = factories.RecordingFactory()
+
+    result = notification_service._notify_user_by_email(recording)
+
+    assert result is False
+    assert f"No owner found for recording {recording.id}" in caplog.text
+
+
+def test_notify_user_by_email_smtp_exception(mocked_current_site, caplog):
+    """Test email notification when an exception occurs."""
+
+    recording = factories.RecordingFactory(room__name="Conference Room A")
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER
+    )
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER
+    )
+
+    notification_service = NotificationService()
+
+    with mock.patch(
+        "core.recording.event.notification.send_mail",
+        side_effect=smtplib.SMTPException("SMTP Error"),
+    ) as mock_send_mail:
+        result = notification_service._notify_user_by_email(recording)
+
+        assert result is False
+        assert mock_send_mail.call_count == 2
+        assert "notification could not be sent:" in caplog.text

src/backend/core/tests/recording/event/test_parsers.py

@@ -129,8 +129,11 @@ def test_validate_invalid_filetype(minio_parser):
 @pytest.mark.parametrize(
     "invalid_filepath",
     [
-        "invalid_filepath",
+        "invalid_filepath",  # totally invalid string
         "recording/46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        "recording/46d1a121-2426-484d-8fb3-09b5d886f7a8",  # missing extension
+        "46d1a121-2426-484d-8fb3-09b5d886f7a8",  # missing url_encoded_folder_path and extension
+        "",  # empty string
         "recording%2F46d1a1212426484d8fb309b5d886f7a8.ogg",
     ],
 )

src/backend/core/tests/recording/test_api_recordings_list.py

@@ -22,15 +22,37 @@ def test_api_recordings_list_anonymous():
     assert response.status_code == 401
 
 
+def test_api_recordings_list_authenticated_no_recording():
+    """
+    Authenticated users listing recordings should only
+    see recordings to which they have access.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+    factories.UserRecordingAccessFactory(user=other_user)
+
+    response = client.get(
+        "/api/v1.0/recordings/",
+    )
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert results == []
+
+
 @pytest.mark.parametrize(
     "role",
     ["administrator", "member", "owner"],
 )
-def test_api_recordings_list_authenticated_direct(role):
+def test_api_recordings_list_authenticated_direct(role, settings):
     """
     Authenticated users listing recordings, should only see the recordings
     to which they are related.
     """
+    settings.RECORDING_EXPIRATIONS_DAYS = None
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
@@ -57,7 +79,9 @@ def test_api_recordings_list_authenticated_direct(role):
     assert expected_ids == result_ids
     assert results[0] == {
         "id": str(recording.id),
+        "key": recording.key,
         "created_at": recording.created_at.isoformat().replace("+00:00", "Z"),
+        "mode": recording.mode,
         "room": {
             "access_level": str(room.access_level),
             "id": str(room.id),
@@ -66,6 +90,8 @@ def test_api_recordings_list_authenticated_direct(role):
         },
         "status": "initiated",
         "updated_at": recording.updated_at.isoformat().replace("+00:00", "Z"),
+        "expired_at": None,
+        "is_expired": False,
     }
 
 

src/backend/core/tests/recording/test_api_recordings_media_auth.py

@@ -0,0 +1,284 @@
+"""
+Test media-auth authorization API endpoint in docs core app.
+"""
+
+from io import BytesIO
+from urllib.parse import urlparse
+from uuid import uuid4
+
+from django.conf import settings
+from django.core.files.storage import default_storage
+from django.utils import timezone
+
+import pytest
+import requests
+from rest_framework.test import APIClient
+
+from core import models
+from core.factories import RecordingFactory, UserFactory, UserRecordingAccessFactory
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_recordings_media_auth_unauthenticated():
+    """
+    Test that unauthenticated requests to download media are rejected
+    """
+    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
+
+    response = APIClient().get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 401
+
+
+def test_api_recordings_media_auth_wrong_path():
+    """
+    Test that media URLs with incorrect path structures are rejected
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/wrong-path/{uuid4()!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403
+
+
+def test_api_recordings_media_auth_unknown_recording():
+    """
+    Test that requests for non-existent recordings are properly handled
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 404
+
+
+def test_api_recordings_media_auth_no_abilities():
+    """
+    Test that users without any access permissions cannot download recordings
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    recording = RecordingFactory(status=models.RecordingStatusChoices.SAVED)
+    original_url = f"http://localhost/media/recordings/{recording.id!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403
+
+
+def test_api_recordings_media_auth_wrong_abilities():
+    """
+    Test that users with insufficient role permissions cannot download recordings
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    recording = RecordingFactory(status=models.RecordingStatusChoices.SAVED)
+
+    UserRecordingAccessFactory(user=user, recording=recording, role="member")
+
+    original_url = f"http://localhost/media/recordings/{recording.id!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403
+
+
+@pytest.mark.parametrize("wrong_status", ["initiated", "active", "failed_to_stop"])
+def test_api_recordings_media_auth_unsaved(wrong_status):
+    """
+    Test that recordings that aren't in 'saved' status cannot be downloaded
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    recording = RecordingFactory(status=wrong_status)
+    UserRecordingAccessFactory(user=user, recording=recording, role="owner")
+
+    original_url = f"http://localhost/media/recordings/{recording.id!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403
+
+
+def test_api_recordings_media_auth_mismatched_extension():
+    """
+    Test that requests with mismatched file extensions are rejected
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    recording = RecordingFactory(
+        status=models.RecordingStatusChoices.SAVED,
+        mode=models.RecordingModeChoices.TRANSCRIPT,
+    )
+    UserRecordingAccessFactory(user=user, recording=recording, role="owner")
+
+    original_url = f"http://localhost/media/recordings/{recording.id!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No recording found with this extension."}
+
+
+@pytest.mark.parametrize(
+    "wrong_extension", ["jpg", "txt", "mp3"], ids=["image", "text", "audio"]
+)
+def test_api_recordings_media_auth_wrong_extension(wrong_extension):
+    """
+    Trying to download a recording with an unsupported extension should return
+    a validation error (400) with details about allowed extensions.
+    """
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    recording = RecordingFactory(status=models.RecordingStatusChoices.SAVED)
+    UserRecordingAccessFactory(user=user, recording=recording, role="owner")
+
+    original_url = (
+        f"http://localhost/media/recordings/{recording.id!s}.{wrong_extension}"
+    )
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Unsupported extension."}
+
+
+@pytest.mark.parametrize("mode", ["screen_recording", "transcript"])
+def test_api_recordings_media_auth_success_owner(mode):
+    """
+    Test downloading a recording when logged in and authorized.
+    Verifies S3 authentication headers and successful file retrieval.
+    """
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    recording = RecordingFactory(status=models.RecordingStatusChoices.SAVED, mode=mode)
+    UserRecordingAccessFactory(user=user, recording=recording, role="owner")
+
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=recording.key,
+        Body=BytesIO(b"my prose"),
+        ContentType="text/plain",
+    )
+
+    original_url = f"http://localhost/media/{recording.key:s}"
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/meet-media-storage/{recording.key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"
+
+
+@pytest.mark.parametrize("mode", ["screen_recording", "transcript"])
+def test_api_recordings_media_auth_success_administrator(mode):
+    """
+    Test downloading a recording when logged in and authorized.
+    Verifies S3 authentication headers and successful file retrieval.
+    """
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    recording = RecordingFactory(status=models.RecordingStatusChoices.SAVED, mode=mode)
+    UserRecordingAccessFactory(user=user, recording=recording, role="administrator")
+
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=recording.key,
+        Body=BytesIO(b"my prose"),
+        ContentType="text/plain",
+    )
+
+    original_url = f"http://localhost/media/{recording.key:s}"
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/meet-media-storage/{recording.key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"

src/backend/core/tests/recording/test_api_recordings_retrieve.py

@@ -0,0 +1,243 @@
+"""
+Test recordings API endpoints in the Meet core app: retrieve.
+"""
+
+import random
+
+import pytest
+from freezegun import freeze_time
+from rest_framework.test import APIClient
+
+from ...factories import RecordingFactory, UserFactory, UserRecordingAccessFactory
+from ...models import RecordingStatusChoices
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_recording_retrieve_anonymous():
+    """Anonymous users should not be able to retrieve recordings."""
+    recording = RecordingFactory()
+    client = APIClient()
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_recording_retrieve_authenticated():
+    """Authenticated users without access receive 404 when requesting recordings.
+
+    The API returns 404 instead of 403 to avoid revealing the existence of
+    resources the user doesn't have permission to access.
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = UserFactory()
+    recording = UserRecordingAccessFactory(user=other_user).recording
+
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No Recording matches the given query."}
+
+
+def test_api_recording_retrieve_members():
+    """
+    A user who is a member of a recording should not be able to retrieve it.
+    """
+    user = UserFactory()
+    recording = RecordingFactory()
+
+    UserRecordingAccessFactory(recording=recording, user=user, role="member")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
+def test_api_recording_retrieve_administrators(settings):
+    """A user who is an administrator of a recording should be able to retrieve it."""
+    settings.RECORDING_EXPIRATION_DAYS = None
+
+    user = UserFactory()
+    recording = RecordingFactory()
+
+    UserRecordingAccessFactory(recording=recording, user=user, role="administrator")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+
+    assert response.status_code == 200
+    content = response.json()
+    room = recording.room
+
+    assert content == {
+        "id": str(recording.id),
+        "key": recording.key,
+        "room": {
+            "access_level": str(room.access_level),
+            "id": str(room.id),
+            "name": room.name,
+            "slug": room.slug,
+        },
+        "created_at": recording.created_at.isoformat().replace("+00:00", "Z"),
+        "updated_at": recording.updated_at.isoformat().replace("+00:00", "Z"),
+        "status": str(recording.status),
+        "mode": str(recording.mode),
+        "expired_at": None,
+        "is_expired": False,
+    }
+
+
+def test_api_recording_retrieve_owners(settings):
+    """A user who is an owner of a recording should be able to retrieve it."""
+    settings.RECORDING_EXPIRATION_DAYS = None
+    user = UserFactory()
+    recording = RecordingFactory()
+
+    UserRecordingAccessFactory(recording=recording, user=user, role="owner")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+
+    assert response.status_code == 200
+    content = response.json()
+    room = recording.room
+
+    assert content == {
+        "id": str(recording.id),
+        "key": recording.key,
+        "room": {
+            "access_level": str(room.access_level),
+            "id": str(room.id),
+            "name": room.name,
+            "slug": room.slug,
+        },
+        "created_at": recording.created_at.isoformat().replace("+00:00", "Z"),
+        "updated_at": recording.updated_at.isoformat().replace("+00:00", "Z"),
+        "status": str(recording.status),
+        "mode": str(recording.mode),
+        "expired_at": None,
+        "is_expired": False,
+    }
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_api_recording_retrieve_compute_expiration_date_correctly(settings):
+    """Test that the API returns the correct expiration date for a non-expired recording."""
+    settings.RECORDING_EXPIRATION_DAYS = 1
+
+    user = UserFactory()
+    recording = RecordingFactory()
+
+    UserRecordingAccessFactory(
+        recording=recording, user=user, role=random.choice(["administrator", "owner"])
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+
+    assert response.status_code == 200
+    content = response.json()
+    room = recording.room
+
+    assert content == {
+        "id": str(recording.id),
+        "key": recording.key,
+        "room": {
+            "access_level": str(room.access_level),
+            "id": str(room.id),
+            "name": room.name,
+            "slug": room.slug,
+        },
+        "created_at": "2023-01-15T12:00:00Z",
+        "updated_at": "2023-01-15T12:00:00Z",
+        "status": str(recording.status),
+        "mode": str(recording.mode),
+        "expired_at": "2023-01-16T12:00:00Z",
+        "is_expired": False,  # Ensure the recording is still valid and hasn't expired
+    }
+
+
+def test_api_recording_retrieve_expired(settings):
+    """Test that the API returns the correct expiration date and flag for an expired recording."""
+    settings.RECORDING_EXPIRATION_DAYS = 2
+
+    user = UserFactory()
+
+    with freeze_time("2023-01-15 12:00:00"):
+        recording = RecordingFactory()
+
+    UserRecordingAccessFactory(
+        recording=recording, user=user, role=random.choice(["administrator", "owner"])
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+
+    assert response.status_code == 200
+    content = response.json()
+    room = recording.room
+
+    assert content == {
+        "id": str(recording.id),
+        "key": recording.key,
+        "room": {
+            "access_level": str(room.access_level),
+            "id": str(room.id),
+            "name": room.name,
+            "slug": room.slug,
+        },
+        "created_at": "2023-01-15T12:00:00Z",
+        "updated_at": "2023-01-15T12:00:00Z",
+        "status": str(recording.status),
+        "mode": str(recording.mode),
+        "expired_at": "2023-01-17T12:00:00Z",
+        "is_expired": True,  # Ensure the recording has expired
+    }
+
+
+@pytest.mark.parametrize(
+    "status",
+    [
+        RecordingStatusChoices.INITIATED,
+        RecordingStatusChoices.ACTIVE,
+        RecordingStatusChoices.SAVED,
+        RecordingStatusChoices.FAILED_TO_START,
+        RecordingStatusChoices.FAILED_TO_STOP,
+        RecordingStatusChoices.ABORTED,
+    ],
+)
+def test_api_recording_retrieve_any_status(status):
+    """Test that recordings with any status can be retrieved."""
+    user = UserFactory()
+    recording = RecordingFactory(status=status)
+
+    UserRecordingAccessFactory(recording=recording, user=user, role="owner")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
+
+    assert response.status_code == 200
+    content = response.json()
+    assert content["id"] == str(recording.id)
+    assert content["status"] == status

src/backend/core/tests/recording/worker/test_factories.py

@@ -32,7 +32,6 @@ def test_settings():
     mocked_settings = {
         "RECORDING_OUTPUT_FOLDER": "/test/output",
         "LIVEKIT_CONFIGURATION": {"server": "test.example.com"},
-        "RECORDING_VERIFY_SSL": True,
         "AWS_S3_ENDPOINT_URL": "https://s3.test.com",
         "AWS_S3_ACCESS_KEY_ID": "test_key",
         "AWS_S3_SECRET_ACCESS_KEY": "test_secret",
@@ -56,7 +55,6 @@ def test_config_initialization(default_config):
     """Test that WorkerServiceConfig is properly initialized from settings"""
     assert default_config.output_folder == "/test/output"
     assert default_config.server_configurations == {"server": "test.example.com"}
-    assert default_config.verify_ssl is True
     assert default_config.bucket_args == {
         "endpoint": "https://s3.test.com",
         "access_key": "test_key",
@@ -76,7 +74,6 @@ def test_config_immutability(default_config):
 @override_settings(
     RECORDING_OUTPUT_FOLDER="/test/output",
     LIVEKIT_CONFIGURATION={"server": "test.example.com"},
-    RECORDING_VERIFY_SSL=True,
     AWS_S3_ENDPOINT_URL="https://s3.test.com",
     AWS_S3_ACCESS_KEY_ID="test_key",
     AWS_S3_SECRET_ACCESS_KEY="test_secret",

src/backend/core/tests/recording/worker/test_services.py

@@ -6,10 +6,9 @@ Test worker service classes.
 
 from unittest.mock import AsyncMock, Mock, patch
 
-import aiohttp
 import pytest
 
-from core.recording.worker.exceptions import WorkerConnectionError, WorkerResponseError
+from core.recording.worker.exceptions import WorkerResponseError
 from core.recording.worker.factories import WorkerServiceConfig
 from core.recording.worker.services import (
     AudioCompositeEgressService,
@@ -25,11 +24,10 @@ def config():
     return WorkerServiceConfig(
         output_folder="/test/output",
         server_configurations={
-            "host": "test.livekit.io",
+            "url": "test.livekit.io",
             "api_key": "test_key",
             "api_secret": "test_secret",
         },
-        verify_ssl=True,
         bucket_args={
             "endpoint": "https://s3.test.com",
             "access_key": "test_key",
@@ -127,58 +125,6 @@ def test_base_egress_filepath_construction(service, filename, extension, expecte
     assert result.endswith(f"{filename}.{extension}")
 
 
-def test_base_egress_handle_request_success(
-    config, service, mock_client_session, mock_egress_service, mock_tcp_connector
-):
-    """Test successful request handling"""
-    # Setup mock response
-    mock_response = Mock()
-    mock_method = AsyncMock(return_value=mock_response)
-    mock_egress_instance = Mock()
-    mock_egress_instance.test_method = mock_method
-    mock_egress_service.return_value = mock_egress_instance
-
-    # Create test request
-    test_request = Mock()
-
-    response = service._handle_request(test_request, "test_method")
-
-    mock_client_session.assert_called_once_with(
-        connector=mock_tcp_connector.return_value
-    )
-
-    # Verify EgressService initialization
-    mock_egress_service.assert_called_once_with(
-        mock_client_session.return_value.__aenter__.return_value,
-        **service._config.server_configurations,
-    )
-
-    # Verify method call and response
-    mock_method.assert_called_once_with(test_request)
-    assert response == mock_response
-
-
-def test_base_egress_handle_request_connection_error(service, mock_egress_service):
-    """Test handling of connection errors"""
-    # Setup mock error
-    mock_method = AsyncMock(
-        side_effect=livekit_api.TwirpError(msg="Connection failed", code=500)
-    )
-    mock_egress_instance = Mock()
-    mock_egress_instance.test_method = mock_method
-    mock_egress_service.return_value = mock_egress_instance
-
-    # Create test request
-    test_request = Mock()
-
-    # Verify error handling
-    with pytest.raises(WorkerConnectionError) as exc:
-        service._handle_request(test_request, "test_method")
-
-    assert "LiveKit client connection error" in str(exc.value)
-    assert "Connection failed" in str(exc.value)
-
-
 @pytest.mark.parametrize(
     "response_status,expected_result",
     [
@@ -224,43 +170,6 @@ def test_base_egress_start_not_implemented(service):
     assert "Subclass must implement this method" in str(exc.value)
 
 
-@pytest.mark.parametrize("verify_ssl", [True, False])
-def test_base_egress_ssl_verification_config(verify_ssl):
-    """Test SSL verification configuration"""
-    config = WorkerServiceConfig(
-        output_folder="/test/output",
-        server_configurations={
-            "host": "test.livekit.io",
-            "api_key": "test_key",
-            "api_secret": "test_secret",
-        },
-        verify_ssl=verify_ssl,
-        bucket_args={
-            "endpoint": "https://s3.test.com",
-            "access_key": "test_key",
-            "secret": "test_secret",
-            "region": "test-region",
-            "bucket": "test-bucket",
-            "force_path_style": True,
-        },
-    )
-
-    service = BaseEgressService(config)
-
-    # Mock ClientSession to capture connector configuration
-    with patch("aiohttp.ClientSession") as mock_session:
-        mock_session.return_value.__aenter__ = AsyncMock()
-        mock_session.return_value.__aexit__ = AsyncMock()
-
-        # Trigger request to verify connector configuration
-        service._handle_request(Mock(), "test_method")
-
-        # Verify SSL configuration
-        connector = mock_session.call_args[1]["connector"]
-        assert isinstance(connector, aiohttp.TCPConnector)
-        assert connector._ssl == verify_ssl
-
-
 def test_video_composite_egress_hrid(video_service):
     """Test HRID is correct"""
     assert video_service.hrid == "video-recording-composite-livekit-egress"

src/backend/core/tests/rooms/test_api_rooms_invite.py

@@ -0,0 +1,294 @@
+"""
+Test rooms API endpoints in the Meet core app: invite.
+"""
+
+# pylint: disable=W0621,W0613
+
+import json
+import random
+from unittest import mock
+
+import pytest
+from rest_framework.test import APIClient
+
+from ...factories import RoomFactory, UserFactory
+from ...services.invitation import InvitationError, InvitationService
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_rooms_invite_anonymous():
+    """Test anonymous users should not be allowed to invite people to rooms."""
+
+    client = APIClient()
+    room = RoomFactory()
+
+    data = {"emails": ["toto@yopmail.com"]}
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 401
+
+
+def test_api_rooms_invite_no_access():
+    """Test non-privileged users should not be allowed to invite people to rooms."""
+
+    client = APIClient()
+    room = RoomFactory()
+
+    user = UserFactory()
+    client.force_login(user)
+
+    data = {"emails": ["toto@yopmail.com"]}
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You must have privileges on room to perform this action.",
+    }
+
+
+def test_api_rooms_invite_member():
+    """Test member users should not be allowed to invite people to rooms."""
+
+    client = APIClient()
+    room = RoomFactory()
+
+    user = UserFactory()
+    client.force_login(user)
+
+    room.accesses.create(user=user, role="member")
+
+    data = {"emails": ["toto@yopmail.com"]}
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You must have privileges on room to perform this action.",
+    }
+
+
+def test_api_rooms_invite_missing_emails():
+    """Test missing email list should return validation error."""
+
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+
+    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
+
+    client.force_login(user)
+
+    data = {"foo": []}
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "emails": [
+            "This field is required.",
+        ]
+    }
+
+
+def test_api_rooms_invite_empty_emails():
+    """Test empty email list should return validation error."""
+
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+
+    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
+
+    client.force_login(user)
+
+    data = {"emails": []}
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "emails": [
+            "This list may not be empty.",
+        ]
+    }
+
+
+def test_api_rooms_invite_invalid_emails():
+    """Test invalid email addresses should return validation errors."""
+
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+
+    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
+
+    client.force_login(user)
+
+    data = {"emails": ["abdc", "efg"]}
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "emails": {
+            "0": ["Enter a valid email address."],
+            "1": ["Enter a valid email address."],
+        }
+    }
+
+
+def test_api_rooms_invite_partially_invalid_emails():
+    """Test partially invalid email addresses should return validation errors."""
+
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+
+    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
+
+    client.force_login(user)
+
+    data = {"emails": ["fabrice@yopmail.com", "efg"]}
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "emails": {
+            "1": ["Enter a valid email address."],
+        }
+    }
+
+
+@mock.patch.object(InvitationService, "invite_to_room")
+def test_api_rooms_invite_duplicates(mock_invite_to_room):
+    """Test duplicate emails should be deduplicated before processing."""
+
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+
+    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
+
+    client.force_login(user)
+
+    data = {"emails": ["toto@yopmail.com", "toto@yopmail.com", "Toto@yopmail.com"]}
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 200
+    mock_invite_to_room.assert_called_once()
+
+    _, kwargs = mock_invite_to_room.call_args
+
+    assert kwargs["room"] == room
+    assert kwargs["sender"] == user
+    assert sorted(kwargs["emails"]) == sorted(["Toto@yopmail.com", "toto@yopmail.com"])
+
+
+@mock.patch.object(InvitationService, "invite_to_room", side_effect=InvitationError())
+def test_api_rooms_invite_error(mock_invite_to_room):
+    """Test invitation service error should return appropriate error response."""
+
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+
+    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
+
+    client.force_login(user)
+
+    data = {"emails": ["toto@yopmail.com", "toto@yopmail.com"]}
+
+    with pytest.raises(InvitationError):
+        client.post(
+            f"/api/v1.0/rooms/{room.id}/invite/",
+            json.dumps(data),
+            content_type="application/json",
+        )
+
+    mock_invite_to_room.assert_called_once()
+
+
+@mock.patch("core.services.invitation.send_mail")
+def test_api_rooms_invite_success(mock_send_mail, settings):
+    """Test privileged users should successfully send invitation emails."""
+
+    settings.EMAIL_BRAND_NAME = "ACME"
+    settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
+    settings.EMAIL_APP_BASE_URL = "https://acme.com"
+    settings.EMAIL_FROM = "notifications@acme.com"
+    settings.EMAIL_DOMAIN = "acme.com"
+
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+
+    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
+
+    client.force_login(user)
+
+    data = {"emails": ["fabien@yopmail.com", "gerald@yopmail.com"]}
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/invite/",
+        json.dumps(data),
+        content_type="application/json",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"status": "success", "message": "invitations sent"}
+
+    mock_send_mail.assert_called_once()
+
+    subject, body, sender, recipients = mock_send_mail.call_args[0]
+
+    assert (
+        subject == f"Video call in progress: {user.email} is waiting for you to connect"
+    )
+
+    # Verify email contains expected content
+    required_content = [
+        "ACME",  # Brand name
+        "https://acme.com/logo",  # Logo URL
+        f"https://acme.com/{room.slug}",  # Room url
+        f"acme.com/{room.slug}",  # Room link
+    ]
+
+    for content in required_content:
+        assert content in body
+
+    assert sender == "notifications@acme.com"
+
+    # Verify all owners received the email (order-independent comparison)
+    assert sorted(recipients) == sorted(["fabien@yopmail.com", "gerald@yopmail.com"])

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -132,18 +132,18 @@ def test_request_entry_with_existing_participants(settings):
 
     # Add two participants already waiting in the lobby
     cache.set(
-        f"mocked-cache-prefix_{room.id}_participant1",
+        f"mocked-cache-prefix_{room.id}_2f7f162fe7d1421b90e702bfbfbf8def",
         {
-            "id": "participant1",
+            "id": "2f7f162fe7d1421b90e702bfbfbf8def",
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
         },
     )
     cache.set(
-        f"mocked-cache-prefix_{room.id}_participant2",
+        f"mocked-cache-prefix_{room.id}_f4ca3ab8a6c04ad88097b8da33f60f10",
         {
-            "id": "participant2",
+            "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
             "username": "user2",
             "status": "accepted",
             "color": "#654321",
@@ -257,7 +257,9 @@ def test_request_entry_authenticated_user_public_room(settings):
     with (
         mock.patch.object(LobbyService, "notify_participants", return_value=None),
         mock.patch.object(
-            LobbyService, "_get_or_create_participant_id", return_value="123"
+            LobbyService,
+            "_get_or_create_participant_id",
+            return_value="2f7f162fe7d1421b90e702bfbfbf8def",
         ),
         mock.patch.object(
             utils, "generate_livekit_config", return_value={"token": "test-token"}
@@ -274,11 +276,11 @@ def test_request_entry_authenticated_user_public_room(settings):
     # Verify the lobby cookie was set
     cookie = response.cookies.get("mocked-cookie")
     assert cookie is not None
-    assert cookie.value == "123"
+    assert cookie.value == "2f7f162fe7d1421b90e702bfbfbf8def"
 
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": "123",
+        "id": "2f7f162fe7d1421b90e702bfbfbf8def",
         "username": "test_user",
         "status": "accepted",
         "color": "mocked-color",
@@ -300,9 +302,9 @@ def test_request_entry_waiting_participant_public_room(settings):
 
     # Add a waiting participant to the room's lobby cache
     cache.set(
-        f"mocked-cache-prefix_{room.id}_participant1",
+        f"mocked-cache-prefix_{room.id}_2f7f162fe7d1421b90e702bfbfbf8def",
         {
-            "id": "participant1",
+            "id": "2f7f162fe7d1421b90e702bfbfbf8def",
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
@@ -310,7 +312,7 @@ def test_request_entry_waiting_participant_public_room(settings):
     )
 
     # Simulate a browser with existing participant cookie
-    client.cookies.load({"mocked-cookie": "participant1"})
+    client.cookies.load({"mocked-cookie": "2f7f162fe7d1421b90e702bfbfbf8def"})
 
     with (
         mock.patch.object(LobbyService, "notify_participants", return_value=None),
@@ -328,11 +330,11 @@ def test_request_entry_waiting_participant_public_room(settings):
     # Verify the lobby cookie was set
     cookie = response.cookies.get("mocked-cookie")
     assert cookie is not None
-    assert cookie.value == "participant1"
+    assert cookie.value == "2f7f162fe7d1421b90e702bfbfbf8def"
 
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": "participant1",
+        "id": "2f7f162fe7d1421b90e702bfbfbf8def",
         "username": "user1",
         "status": "accepted",
         "color": "#123456",
@@ -379,7 +381,7 @@ def test_allow_participant_to_enter_anonymous():
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/enter/",
-        {"participant_id": "test-id", "allow_entry": True},
+        {"participant_id": "2f7f162fe7d1421b90e702bfbfbf8def", "allow_entry": True},
     )
 
     assert response.status_code == 401
@@ -394,7 +396,7 @@ def test_allow_participant_to_enter_non_owner():
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/enter/",
-        {"participant_id": "test-id", "allow_entry": True},
+        {"participant_id": "2f7f162fe7d1421b90e702bfbfbf8def", "allow_entry": True},
     )
 
     assert response.status_code == 403
@@ -412,7 +414,7 @@ def test_allow_participant_to_enter_public_room():
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/enter/",
-        {"participant_id": "test-id", "allow_entry": True},
+        {"participant_id": "2f7f162fe7d1421b90e702bfbfbf8def", "allow_entry": True},
     )
 
     assert response.status_code == 404
@@ -435,9 +437,9 @@ def test_allow_participant_to_enter_success(settings, allow_entry, updated_statu
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     cache.set(
-        f"mocked-cache-prefix_{room.id!s}_participant1",
+        f"mocked-cache-prefix_{room.id!s}_2f7f162fe7d1421b90e702bfbfbf8def",
         {
-            "id": "test-id",
+            "id": "2f7f162fe7d1421b90e702bfbfbf8def",
             "status": "waiting",
             "username": "foo",
             "color": "123",
@@ -446,13 +448,18 @@ def test_allow_participant_to_enter_success(settings, allow_entry, updated_statu
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/enter/",
-        {"participant_id": "participant1", "allow_entry": allow_entry},
+        {
+            "participant_id": "2f7f162fe7d1421b90e702bfbfbf8def",
+            "allow_entry": allow_entry,
+        },
     )
 
     assert response.status_code == 200
     assert response.json() == {"message": "Participant was updated."}
 
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_participant1")
+    participant_data = cache.get(
+        f"mocked-cache-prefix_{room.id!s}_2f7f162fe7d1421b90e702bfbfbf8def"
+    )
     assert participant_data.get("status") == updated_status
 
 
@@ -468,12 +475,14 @@ def test_allow_participant_to_enter_participant_not_found(settings):
 
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_test-id")
+    participant_data = cache.get(
+        f"mocked-cache-prefix_{room.id!s}_2f7f162fe7d1421b90e702bfbfbf8def"
+    )
     assert participant_data is None
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/enter/",
-        {"participant_id": "test-id", "allow_entry": True},
+        {"participant_id": "2f7f162fe7d1421b90e702bfbfbf8def", "allow_entry": True},
     )
 
     assert response.status_code == 404
@@ -563,18 +572,18 @@ def test_list_waiting_participants_success(settings):
 
     # Add participants in the lobby
     cache.set(
-        f"mocked-cache-prefix_{room.id}_participant1",
+        f"mocked-cache-prefix_{room.id}_2f7f162fe7d1421b90e702bfbfbf8def",
         {
-            "id": "participant1",
+            "id": "2f7f162fe7d1421b90e702bfbfbf8def",
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
         },
     )
     cache.set(
-        f"mocked-cache-prefix_{room.id}_participant2",
+        f"mocked-cache-prefix_{room.id}_f4ca3ab8a6c04ad88097b8da33f60f10",
         {
-            "id": "participant2",
+            "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
             "username": "user2",
             "status": "waiting",
             "color": "#654321",
@@ -588,13 +597,13 @@ def test_list_waiting_participants_success(settings):
     participants = response.json().get("participants")
     assert sorted(participants, key=lambda p: p["id"]) == [
         {
-            "id": "participant1",
+            "id": "2f7f162fe7d1421b90e702bfbfbf8def",
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
         },
         {
-            "id": "participant2",
+            "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
             "username": "user2",
             "status": "waiting",
             "color": "#654321",

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -32,6 +32,7 @@ def test_api_rooms_retrieve_anonymous_private_pk():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -51,6 +52,7 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -69,6 +71,7 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -85,6 +88,7 @@ def test_api_rooms_retrieve_anonymous_private_slug():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -101,6 +105,7 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -209,6 +214,7 @@ def test_api_rooms_retrieve_anonymous_public(mock_token):
             "token": "foo",
         },
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -251,6 +257,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
             "token": "foo",
         },
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -295,6 +302,7 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
             "token": "foo",
         },
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -324,6 +332,7 @@ def test_api_rooms_retrieve_authenticated():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -336,23 +345,22 @@ def test_api_rooms_retrieve_authenticated():
         "url": "test_url_value",
     }
 )
-def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries):
+def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, settings):
     """
-    Users who are members of a room should be allowed to see related users.
+    Users who are members of a room should not be allowed to see related users.
     """
+    settings.TIME_ZONE = "UTC"
     user = UserFactory()
     other_user = UserFactory()
 
     room = RoomFactory()
-    user_access = UserResourceAccessFactory(resource=room, user=user, role="member")
-    other_user_access = UserResourceAccessFactory(
-        resource=room, user=other_user, role="member"
-    )
+    UserResourceAccessFactory(resource=room, user=user, role="member")
+    UserResourceAccessFactory(resource=room, user=other_user, role="member")
 
     client = APIClient()
     client.force_login(user)
 
-    with django_assert_num_queries(4):
+    with django_assert_num_queries(3):
         response = client.get(
             f"/api/v1.0/rooms/{room.id!s}/",
         )
@@ -360,33 +368,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries):
     assert response.status_code == 200
     content_dict = response.json()
 
-    assert sorted(content_dict.pop("accesses"), key=lambda x: x["id"]) == sorted(
-        [
-            {
-                "id": str(user_access.id),
-                "user": {
-                    "id": str(user_access.user.id),
-                    "email": user_access.user.email,
-                    "full_name": user_access.user.full_name,
-                    "short_name": user_access.user.short_name,
-                },
-                "resource": str(room.id),
-                "role": user_access.role,
-            },
-            {
-                "id": str(other_user_access.id),
-                "user": {
-                    "id": str(other_user_access.user.id),
-                    "email": other_user_access.user.email,
-                    "full_name": other_user_access.user.full_name,
-                    "short_name": other_user_access.user.short_name,
-                },
-                "resource": str(room.id),
-                "role": other_user_access.role,
-            },
-        ],
-        key=lambda x: x["id"],
-    )
+    assert "accesses" not in content_dict
 
     expected_name = str(room.id)
     assert content_dict == {
@@ -399,6 +381,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries):
             "token": "foo",
         },
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -415,11 +398,14 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries):
         "url": "test_url_value",
     }
 )
-def test_api_rooms_retrieve_administrators(mock_token, django_assert_num_queries):
+def test_api_rooms_retrieve_administrators(
+    mock_token, django_assert_num_queries, settings
+):
     """
     A user who is an administrator or owner of a room should be allowed
     to see related users.
     """
+    settings.TIME_ZONE = "UTC"
     user = UserFactory()
     other_user = UserFactory()
     room = RoomFactory()
@@ -448,6 +434,8 @@ def test_api_rooms_retrieve_administrators(mock_token, django_assert_num_queries
                     "email": other_user_access.user.email,
                     "full_name": other_user_access.user.full_name,
                     "short_name": other_user_access.user.short_name,
+                    "timezone": "UTC",
+                    "language": other_user_access.user.language,
                 },
                 "resource": str(room.id),
                 "role": other_user_access.role,
@@ -459,6 +447,8 @@ def test_api_rooms_retrieve_administrators(mock_token, django_assert_num_queries
                     "email": user_access.user.email,
                     "full_name": user_access.user.full_name,
                     "short_name": user_access.user.short_name,
+                    "timezone": "UTC",
+                    "language": user_access.user.language,
                 },
                 "resource": str(room.id),
                 "role": user_access.role,
@@ -478,6 +468,7 @@ def test_api_rooms_retrieve_administrators(mock_token, django_assert_num_queries
             "token": "foo",
         },
         "name": room.name,
+        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 

src/backend/core/tests/rooms/test_api_rooms_webhook.py

@@ -2,7 +2,6 @@
 Test LiveKit webhook endpoint on the rooms API.
 """
 
-# ruff: noqa: PLR0913
 # pylint: disable=R0913,W0621,R0917,W0613
 import base64
 import hashlib
@@ -25,7 +24,7 @@ def webhook_event_data():
             "name": "00000000-0000-0000-0000-000000000000",
             "emptyTimeout": 300,
             "creationTime": "1692627281",
-            "turnPassword": "2Pvdj+/WV1xV4EkB8klJ9xkXDWY=",
+            "turnPassword": "fake-turn-password",
             "enabledCodecs": [
                 {"mime": "audio/opus"},
                 {"mime": "video/H264"},
@@ -144,7 +143,7 @@ def test_handled_event_type(
 
 def test_unhandled_event_type(client, mock_livekit_config):
     """Should return 200 for event types that have no handler."""
-    event_data = json.dumps({"event": "room_started"})
+    event_data = json.dumps({"event": "participant_joined"})
 
     hash64 = base64.b64encode(hashlib.sha256(event_data.encode()).digest()).decode()
     token = api.AccessToken(

src/backend/core/tests/services/test_livekit_events.py

@@ -8,6 +8,7 @@ from unittest import mock
 
 import pytest
 
+from core.factories import RoomFactory
 from core.services.livekit_events import (
     ActionFailedError,
     AuthenticationError,
@@ -17,6 +18,7 @@ from core.services.livekit_events import (
     api,
 )
 from core.services.lobby import LobbyService
+from core.services.telephony import TelephonyException, TelephonyService
 
 pytestmark = pytest.mark.django_db
 
@@ -56,42 +58,149 @@ def test_initialization(
 
 
 @mock.patch.object(LobbyService, "clear_room_cache")
-def test_handle_room_finished(mock_clear_cache, service):
-    """Should clear lobby cache when room is finished."""
-
+@mock.patch.object(TelephonyService, "delete_dispatch_rule")
+def test_handle_room_finished_clears_cache_and_deletes_dispatch_rule(
+    mock_delete_dispatch_rule, mock_clear_cache, service, settings
+):
+    """Should clear lobby cache and delete telephony dispatch rule when room finishes."""
+    settings.ROOM_TELEPHONY_ENABLED = True
     mock_room_name = uuid.uuid4()
-
     mock_data = mock.MagicMock()
     mock_data.room.name = str(mock_room_name)
 
     service._handle_room_finished(mock_data)
 
+    mock_delete_dispatch_rule.assert_called_once_with(mock_room_name)
+    mock_clear_cache.assert_called_once_with(mock_room_name)
+
+
+@mock.patch.object(LobbyService, "clear_room_cache")
+@mock.patch.object(TelephonyService, "delete_dispatch_rule")
+def test_handle_room_finished_skips_telephony_when_disabled(
+    mock_delete_dispatch_rule, mock_clear_cache, service, settings
+):
+    """Should clear lobby cache but skip dispatch rule deletion when telephony is disabled."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    mock_room_name = uuid.uuid4()
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(mock_room_name)
+
+    service._handle_room_finished(mock_data)
+
+    mock_delete_dispatch_rule.assert_not_called()
     mock_clear_cache.assert_called_once_with(mock_room_name)
 
 
 @mock.patch.object(
     LobbyService, "clear_room_cache", side_effect=Exception("Test error")
 )
-def test_handle_room_finished_error(mock_clear_cache, service):
-    """Should raise ActionFailedError when processing fails."""
+@mock.patch.object(TelephonyService, "delete_dispatch_rule")
+def test_handle_room_finished_raises_error_when_cache_clearing_fails(
+    mock_delete_dispatch_rule, mock_clear_cache, service, settings
+):
+    """Should raise ActionFailedError when lobby cache clearing fails when room finishes."""
+    settings.ROOM_TELEPHONY_ENABLED = True
     mock_data = mock.MagicMock()
     mock_data.room.name = "00000000-0000-0000-0000-000000000000"
-    with pytest.raises(
-        ActionFailedError, match="Failed to process room finished event"
-    ):
+
+    expected_error = (
+        "Failed to clear room cache for room 00000000-0000-0000-0000-000000000000"
+    )
+
+    with pytest.raises(ActionFailedError, match=expected_error):
         service._handle_room_finished(mock_data)
 
+    mock_delete_dispatch_rule.assert_called_once_with(
+        uuid.UUID("00000000-0000-0000-0000-000000000000")
+    )
 
-def test_handle_room_finished_invalid_room_name(service):
-    """Should raise ActionFailedError when processing fails."""
+
+@mock.patch.object(LobbyService, "clear_room_cache")
+@mock.patch.object(
+    TelephonyService,
+    "delete_dispatch_rule",
+    side_effect=TelephonyException("Test error"),
+)
+def test_handle_room_finished_raises_error_when_telephony_deletion_fails(
+    mock_delete_dispatch_rule, mock_clear_cache, service, settings
+):
+    """Should raise ActionFailedError when dispatch rule deletion fails when room finishes."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    mock_data = mock.MagicMock()
+    mock_data.room.name = "00000000-0000-0000-0000-000000000000"
+
+    expected_error = (
+        "Failed to delete telephony dispatch rule for room "
+        "00000000-0000-0000-0000-000000000000"
+    )
+
+    with pytest.raises(ActionFailedError, match=expected_error):
+        service._handle_room_finished(mock_data)
+
+    mock_clear_cache.assert_not_called()
+
+
+def test_handle_room_finished_raises_error_for_invalid_room_name(service):
+    """Should raise ActionFailedError when room name format is invalid when room finishes."""
     mock_data = mock.MagicMock()
     mock_data.room.name = "invalid"
+
     with pytest.raises(
         ActionFailedError, match="Failed to process room finished event"
     ):
         service._handle_room_finished(mock_data)
 
 
+@mock.patch.object(TelephonyService, "create_dispatch_rule")
+def test_handle_room_started_creates_dispatch_rule_successfully(
+    mock_create_dispatch_rule, service, settings
+):
+    """Should create telephony dispatch rule when room starts successfully."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    room = RoomFactory()
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    service._handle_room_started(mock_data)
+
+    mock_create_dispatch_rule.assert_called_once_with(room)
+
+
+@mock.patch.object(TelephonyService, "create_dispatch_rule")
+def test_handle_room_started_skips_dispatch_rule_when_telephony_disabled(
+    mock_create_dispatch_rule, service, settings
+):
+    """Should skip creating telephony dispatch rule when telephony is disabled during room start."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    room = RoomFactory()
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    service._handle_room_started(mock_data)
+
+    mock_create_dispatch_rule.assert_not_called()
+
+
+def test_handle_room_started_raises_error_for_invalid_room_name(service):
+    """Should raise ActionFailedError when room name format is invalid  when room starts."""
+    mock_data = mock.MagicMock()
+    mock_data.room.name = "invalid"
+
+    with pytest.raises(ActionFailedError, match="Failed to process room started event"):
+        service._handle_room_started(mock_data)
+
+
+def test_handle_room_started_raises_error_for_nonexistent_room(service):
+    """Should raise ActionFailedError when a room starts that doesn't exist in the database."""
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(uuid.uuid4())
+
+    expected_error = f"Room with ID {mock_data.room.name} does not exist"
+
+    with pytest.raises(ActionFailedError, match=expected_error):
+        service._handle_room_started(mock_data)
+
+
 @mock.patch.object(
     api.WebhookReceiver, "receive", side_effect=Exception("Invalid payload")
 )

src/backend/core/tests/services/test_lobby.py

@@ -776,9 +776,10 @@ def test_update_participant_status_success(mock_cache, lobby_service, participan
     lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
 
 
-@mock.patch("core.services.lobby.LiveKitAPI")
-def test_notify_participants_success_no_room(mock_livekit_api, lobby_service):
+@mock.patch("core.utils.create_livekit_client")
+def test_notify_participants_success_no_room(mock_create_livekit_client, lobby_service):
     """Test the notify_participants method when the LiveKit room doesn't exist yet."""
+
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
     # Set up the mock LiveKitAPI and its behavior
@@ -794,15 +795,11 @@ def test_notify_participants_success_no_room(mock_livekit_api, lobby_service):
 
     mock_api_instance.room.list_rooms = mock.AsyncMock(return_value=MockResponse())
     mock_api_instance.aclose = mock.AsyncMock()
-    mock_livekit_api.return_value = mock_api_instance
+    mock_create_livekit_client.return_value = mock_api_instance
 
     # Act
     lobby_service.notify_participants(room.id)
 
-    # Assert
-    # Verify the API was initialized with correct configuration
-    mock_livekit_api.assert_called_once_with(**settings.LIVEKIT_CONFIGURATION)
-
     # Verify that the service checked for existing rooms
     mock_api_instance.room.list_rooms.assert_called_once()
 
@@ -813,8 +810,8 @@ def test_notify_participants_success_no_room(mock_livekit_api, lobby_service):
     mock_api_instance.aclose.assert_called_once()
 
 
-@mock.patch("core.services.lobby.LiveKitAPI")
-def test_notify_participants_success(mock_livekit_api, lobby_service):
+@mock.patch("core.utils.create_livekit_client")
+def test_notify_participants_success(mock_create_livekit_client, lobby_service):
     """Test successful participant notification."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     # Set up the mock LiveKitAPI and its behavior
@@ -830,14 +827,11 @@ def test_notify_participants_success(mock_livekit_api, lobby_service):
     mock_api_instance.room.list_rooms = mock.AsyncMock(return_value=MockResponse())
 
     mock_api_instance.aclose = mock.AsyncMock()
-    mock_livekit_api.return_value = mock_api_instance
+    mock_create_livekit_client.return_value = mock_api_instance
 
     # Call the function
     lobby_service.notify_participants(room.id)
 
-    # Verify the API was called correctly
-    mock_livekit_api.assert_called_once_with(**settings.LIVEKIT_CONFIGURATION)
-
     # Verify that the service checked for existing rooms
     mock_api_instance.room.list_rooms.assert_called_once()
 
@@ -855,15 +849,15 @@ def test_notify_participants_success(mock_livekit_api, lobby_service):
     mock_api_instance.aclose.assert_called_once()
 
 
-@mock.patch("core.services.lobby.LiveKitAPI")
-def test_notify_participants_error(mock_livekit_api, lobby_service):
+@mock.patch("core.utils.create_livekit_client")
+def test_notify_participants_error(mock_create_livekit_client, lobby_service):
     """Test participant notification with API error."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     # Set up the mock LiveKitAPI and its behavior
     mock_api_instance = mock.Mock()
     mock_api_instance.room = mock.Mock()
     mock_api_instance.room.send_data = mock.AsyncMock(
-        side_effect=TwirpError(msg="test error", code=123)
+        side_effect=TwirpError(msg="test error", code=123, status=123)
     )
 
     class MockResponse:
@@ -874,7 +868,7 @@ def test_notify_participants_error(mock_livekit_api, lobby_service):
     mock_api_instance.room.list_rooms = mock.AsyncMock(return_value=MockResponse())
 
     mock_api_instance.aclose = mock.AsyncMock()
-    mock_livekit_api.return_value = mock_api_instance
+    mock_create_livekit_client.return_value = mock_api_instance
 
     # Call the function and expect an exception
     with pytest.raises(
@@ -882,9 +876,6 @@ def test_notify_participants_error(mock_livekit_api, lobby_service):
     ):
         lobby_service.notify_participants(room.id)
 
-    # Verify the API was called correctly
-    mock_livekit_api.assert_called_once_with(**settings.LIVEKIT_CONFIGURATION)
-
     # Verify that the service checked for existing rooms
     mock_api_instance.room.list_rooms.assert_called_once()
 

src/backend/core/tests/services/test_marketing.py

@@ -11,6 +11,7 @@ from django.core.exceptions import ImproperlyConfigured
 
 import brevo_python
 import pytest
+import urllib3
 
 from core.services.marketing import (
     BrevoMarketingService,
@@ -133,6 +134,34 @@ def test_create_contact_api_error(mock_contact_api):
         brevo_service.create_contact(valid_contact_data)
 
 
+@mock.patch("brevo_python.ContactsApi")
+def test_create_contact_timeout_error(mock_contact_api):
+    """Test contact creation timeout error handling."""
+
+    mock_api = mock_contact_api.return_value
+    settings.BREVO_API_KEY = "test-api-key"
+    settings.BREVO_API_CONTACT_LIST_IDS = [1, 2, 3, 4]
+    settings.BREVO_API_CONTACT_ATTRIBUTES = {"source": "test"}
+
+    valid_contact_data = ContactData(
+        email="test@example.com",
+        attributes={"first_name": "Test"},
+        list_ids=[1, 2],
+        update_enabled=True,
+    )
+
+    brevo_service = BrevoMarketingService()
+
+    mock_api.create_contact.side_effect = urllib3.exceptions.ReadTimeoutError(
+        pool=mock.Mock(),
+        url="https://api.brevo.com/v3/endpoint",
+        message="HTTPSConnectionPool(host='api.brevo.com', port=443): Read timed out.",
+    )
+
+    with pytest.raises(ContactCreationError, match="Failed to create contact in Brevo"):
+        brevo_service.create_contact(valid_contact_data)
+
+
 @pytest.fixture
 def clear_marketing_cache():
     """Clear marketing service cache between tests."""

src/backend/core/tests/services/test_telephony_service.py

@@ -0,0 +1,305 @@
+"""
+Test telephony service.
+"""
+
+# pylint: disable=W0212
+
+from unittest import mock
+
+import pytest
+from asgiref.sync import async_to_sync
+from livekit.api import TwirpError
+from livekit.protocol.sip import (
+    CreateSIPDispatchRuleRequest,
+    DeleteSIPDispatchRuleRequest,
+    ListSIPDispatchRuleRequest,
+    ListSIPDispatchRuleResponse,
+    SIPDispatchRule,
+    SIPDispatchRuleInfo,
+)
+
+from core.factories import RoomFactory
+from core.models import RoomAccessLevel
+from core.services.telephony import TelephonyException, TelephonyService
+
+pytestmark = pytest.mark.django_db
+
+
+def create_mock_livekit_client():
+    """Factory for creating LiveKit client mock."""
+    mock_api = mock.Mock()
+    mock_api.sip = mock.Mock()
+    mock_api.aclose = mock.AsyncMock()
+    return mock_api
+
+
+def test_rule_name():
+    """Test rule name generation."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+    rule_name = telephony_service._rule_name(room.id)
+
+    assert rule_name == f"SIP_{str(room.id)}"
+
+
+@mock.patch("core.utils.create_livekit_client")
+def test_create_dispatch_rule_success(mock_client_factory):
+    """Test successful dispatch rule creation."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.create_sip_dispatch_rule = mock.AsyncMock()
+    mock_client_factory.return_value = mock_api
+
+    telephony_service.create_dispatch_rule(room)
+
+    mock_api.sip.create_sip_dispatch_rule.assert_called_once()
+    create_request = mock_api.sip.create_sip_dispatch_rule.call_args[1]["create"]
+
+    assert isinstance(create_request, CreateSIPDispatchRuleRequest)
+    assert create_request.name == f"SIP_{str(room.id)}"
+    assert create_request.rule.dispatch_rule_direct.room_name == str(room.id)
+    assert create_request.rule.dispatch_rule_direct.pin == str(room.pin_code)
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.utils.create_livekit_client")
+def test_create_dispatch_rule_api_failure(mock_client_factory):
+    """Test dispatch rule creation when API fails."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.create_sip_dispatch_rule = mock.AsyncMock(
+        side_effect=TwirpError(msg="Internal server error", code=500, status=500)
+    )
+    mock_client_factory.return_value = mock_api
+
+    with pytest.raises(TelephonyException, match="Could not create dispatch rule"):
+        telephony_service.create_dispatch_rule(room)
+
+    mock_api.sip.create_sip_dispatch_rule.assert_called_once()
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.utils.create_livekit_client")
+def test_list_dispatch_rules_ids_success(mock_client_factory):
+    """Test successful listing of dispatch rule IDs."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_rules = [
+        SIPDispatchRuleInfo(
+            sip_dispatch_rule_id="rule-1",
+            name=f"SIP_{str(room.id)}",
+            rule=SIPDispatchRule(),
+        ),
+        SIPDispatchRuleInfo(
+            sip_dispatch_rule_id="rule-2", name="OTHER_RULE", rule=SIPDispatchRule()
+        ),
+        SIPDispatchRuleInfo(
+            sip_dispatch_rule_id="rule-3",
+            name=f"SIP_{str(room.id)}",
+            rule=SIPDispatchRule(),
+        ),
+    ]
+
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.list_sip_dispatch_rule = mock.AsyncMock(
+        return_value=ListSIPDispatchRuleResponse(items=mock_rules)
+    )
+    mock_client_factory.return_value = mock_api
+
+    result = async_to_sync(telephony_service._list_dispatch_rules_ids)(room.id)
+
+    assert len(result) == 2
+    assert "rule-1" in result
+    assert "rule-3" in result
+    assert "rule-2" not in result
+
+    mock_api.sip.list_sip_dispatch_rule.assert_called_once()
+    list_request = mock_api.sip.list_sip_dispatch_rule.call_args[1]["list"]
+    assert isinstance(list_request, ListSIPDispatchRuleRequest)
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.utils.create_livekit_client")
+def test_list_dispatch_rules_ids_empty_response(mock_client_factory):
+    """Test listing dispatch rule IDs when no rules exist."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.list_sip_dispatch_rule = mock.AsyncMock(
+        return_value=ListSIPDispatchRuleResponse(items=[])
+    )
+    mock_client_factory.return_value = mock_api
+
+    result = async_to_sync(telephony_service._list_dispatch_rules_ids)(room.id)
+
+    assert result == []
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.utils.create_livekit_client")
+def test_list_dispatch_rules_ids_no_matching_rules(mock_client_factory):
+    """Test listing dispatch rule IDs when no rules match the room."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_rules = [
+        SIPDispatchRuleInfo(
+            sip_dispatch_rule_id="rule-1", name="OTHER_RULE_1", rule=SIPDispatchRule()
+        ),
+        SIPDispatchRuleInfo(
+            sip_dispatch_rule_id="rule-2", name="OTHER_RULE_2", rule=SIPDispatchRule()
+        ),
+    ]
+
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.list_sip_dispatch_rule = mock.AsyncMock(
+        return_value=ListSIPDispatchRuleResponse(items=mock_rules)
+    )
+    mock_client_factory.return_value = mock_api
+
+    result = async_to_sync(telephony_service._list_dispatch_rules_ids)(room.id)
+
+    assert result == []
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.utils.create_livekit_client")
+def test_list_dispatch_rules_ids_api_failure(mock_client_factory):
+    """Test listing dispatch rule IDs when API fails."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.list_sip_dispatch_rule = mock.AsyncMock(
+        side_effect=TwirpError(msg="Internal server error", code=500, status=500)
+    )
+    mock_client_factory.return_value = mock_api
+
+    with pytest.raises(TelephonyException, match="Could not list dispatch rules"):
+        async_to_sync(telephony_service._list_dispatch_rules_ids)(room.id)
+
+    mock_api.sip.list_sip_dispatch_rule.assert_called_once()
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.services.telephony.TelephonyService._list_dispatch_rules_ids")
+@mock.patch("core.utils.create_livekit_client")
+def test_delete_dispatch_rule_no_rules(mock_client_factory, mock_list_rules):
+    """Test deleting dispatch rules when no rules exist."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_list_rules.return_value = []
+
+    result = telephony_service.delete_dispatch_rule(room.id)
+
+    assert result is False
+    mock_list_rules.assert_called_once_with(room.id)
+    mock_client_factory.assert_not_called()
+
+
+@mock.patch("core.services.telephony.TelephonyService._list_dispatch_rules_ids")
+@mock.patch("core.utils.create_livekit_client")
+def test_delete_dispatch_rule_single_rule(mock_client_factory, mock_list_rules):
+    """Test deleting a single dispatch rule."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_list_rules.return_value = ["rule-1"]
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.delete_sip_dispatch_rule = mock.AsyncMock()
+    mock_client_factory.return_value = mock_api
+
+    result = telephony_service.delete_dispatch_rule(room.id)
+
+    assert result is True
+    mock_api.sip.delete_sip_dispatch_rule.assert_called_once()
+    delete_request = mock_api.sip.delete_sip_dispatch_rule.call_args[1]["delete"]
+    assert isinstance(delete_request, DeleteSIPDispatchRuleRequest)
+    assert delete_request.sip_dispatch_rule_id == "rule-1"
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.services.telephony.TelephonyService._list_dispatch_rules_ids")
+@mock.patch("core.utils.create_livekit_client")
+def test_delete_dispatch_rule_multiple_rules(mock_client_factory, mock_list_rules):
+    """Test deleting multiple dispatch rules."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_list_rules.return_value = ["rule-1", "rule-2", "rule-3"]
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.delete_sip_dispatch_rule = mock.AsyncMock()
+    mock_client_factory.return_value = mock_api
+
+    result = telephony_service.delete_dispatch_rule(room.id)
+
+    assert result is True
+    assert mock_api.sip.delete_sip_dispatch_rule.call_count == 3
+
+    deleted_rule_ids = [
+        call_args[1]["delete"].sip_dispatch_rule_id
+        for call_args in mock_api.sip.delete_sip_dispatch_rule.call_args_list
+    ]
+    assert all(
+        rule_id in deleted_rule_ids for rule_id in ["rule-1", "rule-2", "rule-3"]
+    )
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.services.telephony.TelephonyService._list_dispatch_rules_ids")
+@mock.patch("core.utils.create_livekit_client")
+def test_delete_dispatch_rule_partial_failure(mock_client_factory, mock_list_rules):
+    """Test deleting multiple dispatch rules when one deletion fails."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_list_rules.return_value = ["rule-1", "rule-2", "rule-3"]
+    mock_api = create_mock_livekit_client()
+
+    call_count = 0
+
+    def delete_side_effect(*args, **kwargs):
+        nonlocal call_count
+        if call_count == 0:
+            call_count += 1
+            return None
+        raise TwirpError(msg="Deletion failed", code=500, status=500)
+
+    mock_api.sip.delete_sip_dispatch_rule = mock.AsyncMock(
+        side_effect=delete_side_effect
+    )
+    mock_client_factory.return_value = mock_api
+
+    with pytest.raises(TelephonyException, match="Could not delete dispatch rules"):
+        telephony_service.delete_dispatch_rule(room.id)
+
+    assert mock_api.sip.delete_sip_dispatch_rule.call_count == 2
+    mock_api.aclose.assert_called_once()
+
+
+@mock.patch("core.services.telephony.TelephonyService._list_dispatch_rules_ids")
+@mock.patch("core.utils.create_livekit_client")
+def test_delete_dispatch_rule_api_failure(mock_client_factory, mock_list_rules):
+    """Test deleting dispatch rules when API fails immediately."""
+    telephony_service = TelephonyService()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, pin_code="1234")
+
+    mock_list_rules.return_value = ["rule-1"]
+    mock_api = create_mock_livekit_client()
+    mock_api.sip.delete_sip_dispatch_rule = mock.AsyncMock(
+        side_effect=TwirpError(msg="Internal server error", code=500, status=500)
+    )
+    mock_client_factory.return_value = mock_api
+
+    with pytest.raises(TelephonyException, match="Could not delete dispatch rules"):
+        telephony_service.delete_dispatch_rule(room.id)
+
+    mock_api.sip.delete_sip_dispatch_rule.assert_called_once()
+    mock_api.aclose.assert_called_once()

src/backend/core/tests/test_api_users.py

@@ -103,8 +103,10 @@ def test_api_users_retrieve_me_anonymous():
     }
 
 
-def test_api_users_retrieve_me_authenticated():
+def test_api_users_retrieve_me_authenticated(settings):
     """Authenticated users should be able to retrieve their own user via the "/users/me" path."""
+
+    settings.TIME_ZONE = "UTC"
     user = factories.UserFactory()
 
     client = APIClient()
@@ -121,6 +123,8 @@ def test_api_users_retrieve_me_authenticated():
         "email": user.email,
         "full_name": user.full_name,
         "short_name": user.short_name,
+        "language": user.language,
+        "timezone": "UTC",
     }
 
 

src/backend/core/tests/test_models_recording.py

@@ -12,7 +12,8 @@ from core.factories import (
     UserFactory,
     UserRecordingAccessFactory,
 )
-from core.models import Recording, RecordingStatusChoices
+from core.models import Recording, RecordingModeChoices, RecordingStatusChoices
+from core.recording.enums import FileExtension
 
 pytestmark = pytest.mark.django_db
 
@@ -216,3 +217,74 @@ def test_models_recording_worker_id_very_long():
     too_long_id = "w" * 256
     with pytest.raises(ValidationError):
         RecordingFactory(worker_id=too_long_id)
+
+
+# Test key property method
+
+
+def test_models_recording_key_for_transcript(settings):
+    """Test key property returns correct path for transcript mode."""
+
+    settings.RECORDING_OUTPUT_FOLDER = "/custom/path"
+
+    recording = RecordingFactory(mode=RecordingModeChoices.TRANSCRIPT)
+    expected_path = f"/custom/path/{recording.id}.{FileExtension.OGG.value}"
+    assert recording.key == expected_path
+
+
+def test_models_recording_key_for_screen_recording(settings):
+    """Test key property returns correct path for screen recording mode."""
+    settings.RECORDING_OUTPUT_FOLDER = "/custom/path"
+
+    recording = RecordingFactory(mode=RecordingModeChoices.SCREEN_RECORDING)
+    expected_path = f"/custom/path/{recording.id}.{FileExtension.MP4.value}"
+    assert recording.key == expected_path
+
+
+def test_models_recording_key_for_unknown_mode(settings):
+    """Test key property uses default extension for unknown mode."""
+
+    settings.RECORDING_OUTPUT_FOLDER = "/custom/path"
+    recording = RecordingFactory()
+    # Directly set an invalid mode (bypassing validation)
+    recording.mode = "unknown_mode"
+    expected_path = f"/custom/path/{recording.id}.{FileExtension.MP4.value}"
+    assert recording.key == expected_path
+
+
+# Test is_saved method
+
+
+def test_models_recording_is_saved_true():
+    """Test is_saved property returns True for SAVED and NOTIFICATION_SUCCEEDED status."""
+    recording = RecordingFactory(status=RecordingStatusChoices.SAVED)
+    assert recording.is_saved is True
+
+    recording = RecordingFactory(status=RecordingStatusChoices.NOTIFICATION_SUCCEEDED)
+    assert recording.is_saved is True
+
+
+def test_models_recording_is_saved_false_active():
+    """Test is_saved property returns False for ACTIVE status."""
+    recording = RecordingFactory(status=RecordingStatusChoices.ACTIVE)
+    assert recording.is_saved is False
+
+
+def test_models_recording_is_saved_false_initiated():
+    """Test is_saved property returns False for INITIATED status."""
+    recording = RecordingFactory(status=RecordingStatusChoices.INITIATED)
+    assert recording.is_saved is False
+
+
+@pytest.mark.parametrize(
+    "status",
+    [
+        RecordingStatusChoices.FAILED_TO_STOP,
+        RecordingStatusChoices.FAILED_TO_START,
+        RecordingStatusChoices.ABORTED,
+    ],
+)
+def test_models_recording_is_saved_false_error_states(status):
+    """Test is_saved property returns False for error statuses."""
+    recording = RecordingFactory(status=status)
+    assert recording.is_saved is False

src/backend/core/tests/test_models_rooms.py

@@ -2,6 +2,12 @@
 Unit tests for the Room model
 """
 
+# pylint: disable=W0613
+
+import secrets
+from logging import Logger
+from unittest import mock
+
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ValidationError
 
@@ -96,7 +102,7 @@ def test_models_rooms_access_rights_none(django_assert_num_queries):
     with django_assert_num_queries(0):
         assert room.get_role(None) is None
     with django_assert_num_queries(0):
-        assert room.is_administrator(None) is False
+        assert room.is_administrator_or_owner(None) is False
     with django_assert_num_queries(0):
         assert room.is_owner(None) is False
 
@@ -109,7 +115,7 @@ def test_models_rooms_access_rights_anonymous(django_assert_num_queries):
     with django_assert_num_queries(0):
         assert room.get_role(user) is None
     with django_assert_num_queries(0):
-        assert room.is_administrator(user) is False
+        assert room.is_administrator_or_owner(user) is False
     with django_assert_num_queries(0):
         assert room.is_owner(user) is False
 
@@ -122,7 +128,7 @@ def test_models_rooms_access_rights_authenticated(django_assert_num_queries):
     with django_assert_num_queries(1):
         assert room.get_role(user) is None
     with django_assert_num_queries(1):
-        assert room.is_administrator(user) is False
+        assert room.is_administrator_or_owner(user) is False
     with django_assert_num_queries(1):
         assert room.is_owner(user) is False
 
@@ -135,7 +141,7 @@ def test_models_rooms_access_rights_member_direct(django_assert_num_queries):
     with django_assert_num_queries(1):
         assert room.get_role(user) == "member"
     with django_assert_num_queries(1):
-        assert room.is_administrator(user) is False
+        assert room.is_administrator_or_owner(user) is False
     with django_assert_num_queries(1):
         assert room.is_owner(user) is False
 
@@ -148,7 +154,7 @@ def test_models_rooms_access_rights_administrator_direct(django_assert_num_queri
     with django_assert_num_queries(1):
         assert room.get_role(user) == "administrator"
     with django_assert_num_queries(1):
-        assert room.is_administrator(user) is True
+        assert room.is_administrator_or_owner(user) is True
     with django_assert_num_queries(1):
         assert room.is_owner(user) is False
 
@@ -161,7 +167,7 @@ def test_models_rooms_access_rights_owner_direct(django_assert_num_queries):
     with django_assert_num_queries(1):
         assert room.get_role(user) == "owner"
     with django_assert_num_queries(1):
-        assert room.is_administrator(user) is True
+        assert room.is_administrator_or_owner(user) is True
     with django_assert_num_queries(1):
         assert room.is_owner(user) is True
 
@@ -175,3 +181,169 @@ def test_models_rooms_is_public_property():
     # Test non-public room
     private_room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     assert private_room.is_public is False
+
+
+@mock.patch.object(Room, "generate_unique_pin_code")
+def test_telephony_disabled_skips_pin_generation(
+    mock_generate_unique_pin_code, settings
+):
+    """Telephony disabled should not generate pin codes."""
+
+    settings.ROOM_TELEPHONY_ENABLED = False
+
+    room = RoomFactory()
+
+    mock_generate_unique_pin_code.assert_not_called()
+    assert room.pin_code is None
+
+
+def test_default_and_custom_pin_length(settings):
+    """Pin codes should be created with correct configured length."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+
+    room = RoomFactory()
+
+    # Assert default value is 10 for collision reasons
+    assert len(room.pin_code) == 10
+
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    room = RoomFactory()
+
+    # Assert custom size
+    assert len(room.pin_code) == 5
+
+
+def test_room_updates_preserve_pin_code(settings):
+    """Room updates should preserve existing pin code."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+
+    room = RoomFactory()
+
+    # Store the original pin code to compare after updates
+    previous_pin_code = room.pin_code
+
+    # If this method is called, it would indicate the pin is being regenerated unnecessarily
+    with mock.patch.object(
+        Room, "generate_unique_pin_code"
+    ) as mock_generate_unique_pin_code:
+        # Explicitly call save to persist the changes to the room
+        room.slug = "aaa-aaaa-aaa"
+        room.save()
+        assert room.pin_code == previous_pin_code
+        mock_generate_unique_pin_code.assert_not_called()
+
+
+@pytest.mark.parametrize("is_telephony_enabled", [True, False])
+def test_manual_pin_code_updates(is_telephony_enabled, settings):
+    """Manual pin code changes should persist regardless of telephony setting."""
+
+    settings.ROOM_TELEPHONY_ENABLED = is_telephony_enabled
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    room = RoomFactory()
+    assert room.pin_code != "12345"
+
+    room.pin_code = "12345"
+    room.save()
+
+    assert room.pin_code == "12345"
+
+    # No data validation when manual updates are made
+    room.pin_code = "123"
+    room.save()
+
+    assert room.pin_code == "123"
+
+
+def test_pin_code_uniqueness(settings):
+    """Duplicate pin codes should raise validation error."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    RoomFactory(pin_code="12345")
+
+    with pytest.raises(ValidationError) as excinfo:
+        RoomFactory(pin_code="12345")
+
+    assert "Room with this Room PIN code already exists." in str(excinfo.value)
+
+
+@pytest.mark.parametrize("invalid_length", [0, 1, 2, 3])
+def test_pin_code_minimum_length(invalid_length, settings):
+    """Pin codes should enforce minimum length for security."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 4
+
+    # Assert no exception is raised with a valid length
+    RoomFactory()
+
+    settings.ROOM_TELEPHONY_PIN_LENGTH = invalid_length
+
+    with pytest.raises(ValueError) as excinfo:
+        RoomFactory()
+
+    assert "PIN code length must be at least 4 digits for minimal security" in str(
+        excinfo.value
+    )
+
+
+@mock.patch.object(Logger, "warning")
+@mock.patch.object(secrets, "randbelow", return_value=12345)
+def test_pin_generation_max_retries(mock_randbelow, mock_logger, settings):
+    """Pin generation should give up after max retries."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    RoomFactory(pin_code="12345")
+
+    # Assert default max retries is low, 5
+    room1 = RoomFactory()
+    assert mock_randbelow.call_count == 5
+    assert room1.pin_code is None
+
+    mock_logger.assert_called_once_with(
+        "Failed to generate unique PIN code of length %s after %s attempts", 5, 5
+    )
+
+    mock_logger.reset_mock()
+    mock_randbelow.reset_mock()
+    settings.ROOM_TELEPHONY_PIN_MAX_RETRIES = 3
+
+    room2 = RoomFactory()
+    assert mock_randbelow.call_count == 3
+    assert room2.pin_code is None
+
+    mock_logger.assert_called_once_with(
+        "Failed to generate unique PIN code of length %s after %s attempts", 5, 3
+    )
+
+
+@mock.patch.object(secrets, "randbelow", return_value=12345)
+def test_pin_code_zero_padding(mock_randbelow, settings):
+    """Pin codes should be zero-padded to meet required length."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 10
+
+    room = RoomFactory()
+    assert room.pin_code == "0000012345"
+
+
+@mock.patch.object(secrets, "randbelow", return_value=12345)
+def test_pin_generation_upper_bound(mock_randbelow, settings):
+    """Random number generator should use correct upper bound based on pin length."""
+
+    settings.ROOM_TELEPHONY_ENABLED = False
+
+    room = RoomFactory()
+
+    room.generate_unique_pin_code(length=5)
+
+    # Assert called with the right exclusive upper bound, 10^5
+    mock_randbelow.assert_called_with(100000)

src/backend/core/tests/test_utils.py

@@ -0,0 +1,62 @@
+"""
+Test utils functions
+"""
+
+from unittest import mock
+
+from core.utils import create_livekit_client
+
+
+@mock.patch("asyncio.get_running_loop")
+@mock.patch("core.utils.LiveKitAPI")
+def test_create_livekit_client_ssl_enabled(
+    mock_livekit_api, mock_get_running_loop, settings
+):
+    """Test LiveKitAPI client creation with SSL verification enabled."""
+    mock_get_running_loop.return_value = mock.MagicMock()
+    settings.LIVEKIT_VERIFY_SSL = True
+
+    create_livekit_client()
+
+    mock_livekit_api.assert_called_once_with(
+        **settings.LIVEKIT_CONFIGURATION, session=None
+    )
+
+
+@mock.patch("core.utils.aiohttp.ClientSession")
+@mock.patch("asyncio.get_running_loop")
+@mock.patch("core.utils.LiveKitAPI")
+def test_create_livekit_client_ssl_disabled(
+    mock_livekit_api, mock_get_running_loop, mock_client_session, settings
+):
+    """Test LiveKitAPI client creation with SSL verification disabled."""
+    mock_get_running_loop.return_value = mock.MagicMock()
+    mock_session_instance = mock.MagicMock()
+    mock_client_session.return_value = mock_session_instance
+    settings.LIVEKIT_VERIFY_SSL = False
+
+    create_livekit_client()
+
+    mock_livekit_api.assert_called_once_with(
+        **settings.LIVEKIT_CONFIGURATION, session=mock_session_instance
+    )
+
+
+@mock.patch("asyncio.get_running_loop")
+@mock.patch("core.utils.LiveKitAPI")
+def test_create_livekit_client_custom_configuration(
+    mock_livekit_api, mock_get_running_loop, settings
+):
+    """Test LiveKitAPI client creation with custom configuration."""
+    settings.LIVEKIT_VERIFY_SSL = True
+
+    mock_get_running_loop.return_value = mock.MagicMock()
+    custom_configuration = {
+        "api_key": "mock_key",
+        "api_secret": "mock_secret",
+        "url": "http://mock-url.com",
+    }
+
+    create_livekit_client(custom_configuration)
+
+    mock_livekit_api.assert_called_once_with(**custom_configuration, session=None)

src/backend/core/urls.py

@@ -3,10 +3,10 @@
 from django.conf import settings
 from django.urls import include, path
 
+from lasuite.oidc_login.urls import urlpatterns as oidc_urls
 from rest_framework.routers import DefaultRouter
 
 from core.api import get_frontend_configuration, viewsets
-from core.authentication.urls import urlpatterns as oidc_urls
 
 # - Main endpoints
 router = DefaultRouter()

src/backend/core/utils.py

@@ -11,12 +11,11 @@ from typing import Optional
 from uuid import uuid4
 
 from django.conf import settings
-
-from livekit.api import AccessToken, VideoGrants
-
 from django.core.files.storage import default_storage
 
+import aiohttp
 import botocore
+from livekit.api import AccessToken, LiveKitAPI, VideoGrants
 
 
 def generate_color(identity: str) -> str:
@@ -127,7 +126,6 @@ def generate_s3_authorization_headers(key):
     - the object storage service does not need to be exposed on internet
     """
 
-
     url = default_storage.unsigned_connection.meta.client.generate_presigned_url(
         "get_object",
         ExpiresIn=0,
@@ -145,3 +143,18 @@ def generate_s3_authorization_headers(key):
     auth.add_auth(request)
 
     return request
+
+
+def create_livekit_client(custom_configuration=None):
+    """Create and return a configured LiveKit API client."""
+
+    custom_session = None
+
+    if not settings.LIVEKIT_VERIFY_SSL:
+        connector = aiohttp.TCPConnector(ssl=False)
+        custom_session = aiohttp.ClientSession(connector=connector)
+
+    # Use default configuration if none provided
+    configuration = custom_configuration or settings.LIVEKIT_CONFIGURATION
+
+    return LiveKitAPI(session=custom_session, **configuration)

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -0,0 +1,446 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2025-05-26 10:50+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: core/admin.py:26
+msgid "Personal info"
+msgstr "Persönliche Informationen"
+
+#: core/admin.py:39
+msgid "Permissions"
+msgstr "Berechtigungen"
+
+#: core/admin.py:51
+msgid "Important dates"
+msgstr "Wichtige Daten"
+
+#: core/admin.py:143
+msgid "No owner"
+msgstr "Kein Eigentümer"
+
+#: core/admin.py:146
+msgid "Multiple owners"
+msgstr "Mehrere Eigentümer"
+
+#: core/api/serializers.py:63
+msgid "You must be administrator or owner of a room to add accesses to it."
+msgstr ""
+"Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
+"hinzuzufügen."
+
+#: core/models.py:31
+msgid "Member"
+msgstr "Mitglied"
+
+#: core/models.py:32
+msgid "Administrator"
+msgstr "Administrator"
+
+#: core/models.py:33
+msgid "Owner"
+msgstr "Eigentümer"
+
+#: core/models.py:49
+msgid "Initiated"
+msgstr "Gestartet"
+
+#: core/models.py:50
+msgid "Active"
+msgstr "Aktiv"
+
+#: core/models.py:51
+msgid "Stopped"
+msgstr "Beendet"
+
+#: core/models.py:52
+msgid "Saved"
+msgstr "Gespeichert"
+
+#: core/models.py:53
+msgid "Aborted"
+msgstr "Abgebrochen"
+
+#: core/models.py:54
+msgid "Failed to Start"
+msgstr "Start fehlgeschlagen"
+
+#: core/models.py:55
+msgid "Failed to Stop"
+msgstr "Stopp fehlgeschlagen"
+
+#: core/models.py:56
+msgid "Notification succeeded"
+msgstr "Benachrichtigung erfolgreich"
+
+#: core/models.py:83
+msgid "SCREEN_RECORDING"
+msgstr "BILDSCHIRMAUFZEICHNUNG"
+
+#: core/models.py:84
+msgid "TRANSCRIPT"
+msgstr "TRANSKRIPT"
+
+#: core/models.py:90
+msgid "Public Access"
+msgstr "Öffentlicher Zugriff"
+
+#: core/models.py:91
+msgid "Trusted Access"
+msgstr "Vertrauenswürdiger Zugriff"
+
+#: core/models.py:92
+msgid "Restricted Access"
+msgstr "Eingeschränkter Zugriff"
+
+#: core/models.py:104
+msgid "id"
+msgstr "ID"
+
+#: core/models.py:105
+msgid "primary key for the record as UUID"
+msgstr "Primärschlüssel des Eintrags als UUID"
+
+#: core/models.py:111
+msgid "created on"
+msgstr "erstellt am"
+
+#: core/models.py:112
+msgid "date and time at which a record was created"
+msgstr "Datum und Uhrzeit der Erstellung eines Eintrags"
+
+#: core/models.py:117
+msgid "updated on"
+msgstr "aktualisiert am"
+
+#: core/models.py:118
+msgid "date and time at which a record was last updated"
+msgstr "Datum und Uhrzeit der letzten Aktualisierung eines Eintrags"
+
+#: core/models.py:138
+msgid ""
+"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
+"_ characters."
+msgstr ""
+"Geben Sie einen gültigen Sub ein. Dieser Wert darf nur Buchstaben, Zahlen "
+"und die Zeichen @/./+/-/_ enthalten."
+
+#: core/models.py:144
+msgid "sub"
+msgstr "Sub"
+
+#: core/models.py:146
+msgid ""
+"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
+"characters only."
+msgstr ""
+"Erforderlich. Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ sind "
+"erlaubt."
+
+#: core/models.py:154
+msgid "identity email address"
+msgstr "Identitäts-E-Mail-Adresse"
+
+#: core/models.py:159
+msgid "admin email address"
+msgstr "Administrator-E-Mail-Adresse"
+
+#: core/models.py:161
+msgid "full name"
+msgstr "Vollständiger Name"
+
+#: core/models.py:163
+msgid "short name"
+msgstr "Kurzname"
+
+#: core/models.py:169
+msgid "language"
+msgstr "Sprache"
+
+#: core/models.py:170
+msgid "The language in which the user wants to see the interface."
+msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."
+
+#: core/models.py:176
+msgid "The timezone in which the user wants to see times."
+msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."
+
+#: core/models.py:179
+msgid "device"
+msgstr "Gerät"
+
+#: core/models.py:181
+msgid "Whether the user is a device or a real user."
+msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."
+
+#: core/models.py:184
+msgid "staff status"
+msgstr "Mitarbeiterstatus"
+
+#: core/models.py:186
+msgid "Whether the user can log into this admin site."
+msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."
+
+#: core/models.py:189
+msgid "active"
+msgstr "aktiv"
+
+#: core/models.py:192
+msgid ""
+"Whether this user should be treated as active. Unselect this instead of "
+"deleting accounts."
+msgstr ""
+"Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
+"anstelle des Löschens des Kontos."
+
+#: core/models.py:205
+msgid "user"
+msgstr "Benutzer"
+
+#: core/models.py:206
+msgid "users"
+msgstr "Benutzer"
+
+#: core/models.py:265
+msgid "Resource"
+msgstr "Ressource"
+
+#: core/models.py:266
+msgid "Resources"
+msgstr "Ressourcen"
+
+#: core/models.py:320
+msgid "Resource access"
+msgstr "Ressourcenzugriff"
+
+#: core/models.py:321
+msgid "Resource accesses"
+msgstr "Ressourcenzugriffe"
+
+#: core/models.py:327
+msgid "Resource access with this User and Resource already exists."
+msgstr ""
+"Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
+"bereits."
+
+#: core/models.py:383
+msgid "Visio room configuration"
+msgstr "Visio-Raumkonfiguration"
+
+#: core/models.py:384
+msgid "Values for Visio parameters to configure the room."
+msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
+
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "PIN-Code für den Raum"
+
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
+
+#: core/models.py:398 core/models.py:552
+msgid "Room"
+msgstr "Raum"
+
+#: core/models.py:399
+msgid "Rooms"
+msgstr "Räume"
+
+#: core/models.py:563
+msgid "Worker ID"
+msgstr "Worker-ID"
+
+#: core/models.py:565
+msgid ""
+"Enter an identifier for the worker recording.This ID is retained even when "
+"the worker stops, allowing for easy tracking."
+msgstr ""
+"Geben Sie eine ID für die Aufzeichnung des Workers ein. Diese ID bleibt "
+"erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
+"ermöglicht."
+
+#: core/models.py:573
+msgid "Recording mode"
+msgstr "Aufzeichnungsmodus"
+
+#: core/models.py:574
+msgid "Defines the mode of recording being called."
+msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
+
+#: core/models.py:580
+msgid "Recording"
+msgstr "Aufzeichnung"
+
+#: core/models.py:581
+msgid "Recordings"
+msgstr "Aufzeichnungen"
+
+#: core/models.py:689
+msgid "Recording/user relation"
+msgstr "Beziehung Aufzeichnung/Benutzer"
+
+#: core/models.py:690
+msgid "Recording/user relations"
+msgstr "Beziehungen Aufzeichnung/Benutzer"
+
+#: core/models.py:696
+msgid "This user is already in this recording."
+msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
+
+#: core/models.py:702
+msgid "This team is already in this recording."
+msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
+
+#: core/models.py:708
+msgid "Either user or team must be set, not both."
+msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
+
+#: core/recording/event/notification.py:94
+msgid "Your recording is ready"
+msgstr "Ihre Aufzeichnung ist bereit"
+
+#: core/services/invitation.py:44
+#, python-brace-format
+msgid "Video call in progress: {sender.email} is waiting for you to connect"
+msgstr "Videoanruf läuft: {sender.email} wartet auf Ihre Teilnahme"
+
+#: core/templates/mail/html/invitation.html:159
+#: core/templates/mail/html/screen_recording.html:159
+#: core/templates/mail/text/invitation.txt:3
+#: core/templates/mail/text/screen_recording.txt:3
+msgid "Logo email"
+msgstr "Logo-E-Mail"
+
+#: core/templates/mail/html/invitation.html:189
+#: core/templates/mail/text/invitation.txt:5
+msgid "invites you to join an ongoing video call"
+msgstr "lädt Sie zu einem laufenden Videoanruf ein"
+
+#: core/templates/mail/html/invitation.html:200
+#: core/templates/mail/text/invitation.txt:7
+msgid "JOIN THE CALL"
+msgstr "AM ANRUF TEILNEHMEN"
+
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:13
+msgid ""
+"If you can't click the button, copy and paste the URL into your browser to "
+"join the call."
+msgstr ""
+"Wenn Sie den Button nicht anklicken können, kopieren Sie die URL und fügen "
+"Sie sie in Ihren Browser ein, um am Anruf teilzunehmen."
+
+#: core/templates/mail/html/invitation.html:235
+#: core/templates/mail/text/invitation.txt:15
+msgid "Tips for a better experience:"
+msgstr "Tipps für ein besseres Erlebnis:"
+
+#: core/templates/mail/html/invitation.html:237
+#: core/templates/mail/text/invitation.txt:17
+msgid "Use Chrome or Firefox for better call quality"
+msgstr "Verwenden Sie Chrome oder Firefox für eine bessere Anrufqualität"
+
+#: core/templates/mail/html/invitation.html:238
+#: core/templates/mail/text/invitation.txt:18
+msgid "Test your microphone and camera before joining"
+msgstr "Testen Sie Ihr Mikrofon und Ihre Kamera vor dem Beitritt"
+
+#: core/templates/mail/html/invitation.html:239
+#: core/templates/mail/text/invitation.txt:19
+msgid "Make sure you have a stable internet connection"
+msgstr "Stellen Sie sicher, dass Sie eine stabile Internetverbindung haben"
+
+#: core/templates/mail/html/invitation.html:248
+#: core/templates/mail/html/screen_recording.html:240
+#: core/templates/mail/text/invitation.txt:21
+#: core/templates/mail/text/screen_recording.txt:22
+#, python-format
+msgid " Thank you for using %(brandname)s. "
+msgstr " Vielen Dank für die Nutzung von %(brandname)s. "
+
+#: core/templates/mail/html/screen_recording.html:188
+#: core/templates/mail/text/screen_recording.txt:6
+msgid "Your recording is ready!"
+msgstr "Ihre Aufzeichnung ist fertig!"
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid ""
+" Your recording of \"%(room_name)s\" on %(recording_date)s at "
+"%(recording_time)s is now ready to download. "
+msgstr ""
+" Ihre Aufzeichnung von \"%(room_name)s\" am %(recording_date)s um "
+"%(recording_time)s steht nun zum Herunterladen bereit. "
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid " The recording will expire in %(days)s days. "
+msgstr " Die Aufzeichnung wird in %(days)s Tagen ablaufen. "
+
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:10
+msgid "To keep this recording permanently:"
+msgstr "So speichern Sie diese Aufzeichnung dauerhaft:"
+
+#: core/templates/mail/html/screen_recording.html:203
+#: core/templates/mail/text/screen_recording.txt:12
+msgid "Click the \"Open\" button below "
+msgstr "Klicken Sie auf den Button „Öffnen“ unten "
+
+#: core/templates/mail/html/screen_recording.html:204
+#: core/templates/mail/text/screen_recording.txt:13
+msgid "Use the \"Download\" button in the interface "
+msgstr "Verwenden Sie den Button „Herunterladen“ in der Oberfläche "
+
+#: core/templates/mail/html/screen_recording.html:205
+#: core/templates/mail/text/screen_recording.txt:14
+msgid "Save the file to your preferred location"
+msgstr "Speichern Sie die Datei an einem gewünschten Ort"
+
+#: core/templates/mail/html/screen_recording.html:216
+#: core/templates/mail/text/screen_recording.txt:16
+msgid "Open"
+msgstr "Öffnen"
+
+#: core/templates/mail/html/screen_recording.html:225
+#: core/templates/mail/text/screen_recording.txt:18
+#, python-format
+msgid ""
+" If you have any questions or need assistance, please contact our support "
+"team at %(support_email)s. "
+msgstr ""
+" Wenn Sie Fragen haben oder Unterstützung benötigen, wenden Sie sich bitte "
+"an unser Support-Team unter %(support_email)s. "
+
+#: meet/settings.py:162
+msgid "English"
+msgstr "Englisch"
+
+#: meet/settings.py:163
+msgid "French"
+msgstr "Französisch"
+
+#: meet/settings.py:164
+msgid "Dutch"
+msgstr "Niederländisch"
+
+#: meet/settings.py:165
+msgid "German"
+msgstr "Deutsch"

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-04-03 10:31+0000\n"
+"POT-Creation-Date: 2025-05-26 10:50+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,192 +17,425 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: core/admin.py:31
+#: core/admin.py:26
 msgid "Personal info"
 msgstr ""
 
-#: core/admin.py:33
+#: core/admin.py:39
 msgid "Permissions"
-msgstr ""
+msgstr "Permissions"
 
-#: core/admin.py:45
+#: core/admin.py:51
 msgid "Important dates"
-msgstr ""
+msgstr "Important dates"
 
-#: core/api/serializers.py:128
-msgid "Markdown Body"
-msgstr ""
+#: core/admin.py:143
+msgid "No owner"
+msgstr "No owner"
 
-#: core/authentication.py:71
-msgid "User info contained no recognizable user identification"
-msgstr ""
+#: core/admin.py:146
+msgid "Multiple owners"
+msgstr "Multiple owners"
 
-#: core/authentication.py:91
-msgid "Claims contained no recognizable user identification"
-msgstr ""
+#: core/api/serializers.py:63
+msgid "You must be administrator or owner of a room to add accesses to it."
+msgstr "You must be administrator or owner of a room to add accesses to it."
 
-#: core/models.py:27
+#: core/models.py:31
 msgid "Member"
-msgstr ""
+msgstr "Member"
 
-#: core/models.py:28
+#: core/models.py:32
 msgid "Administrator"
-msgstr ""
+msgstr "Administrator"
 
-#: core/models.py:29
+#: core/models.py:33
 msgid "Owner"
-msgstr ""
-
-#: core/models.py:41
-msgid "id"
-msgstr ""
-
-#: core/models.py:42
-msgid "primary key for the record as UUID"
-msgstr ""
-
-#: core/models.py:48
-msgid "created on"
-msgstr ""
+msgstr "Owner"
 
 #: core/models.py:49
-msgid "date and time at which a record was created"
-msgstr ""
+msgid "Initiated"
+msgstr "Initiated"
+
+#: core/models.py:50
+msgid "Active"
+msgstr "Active"
+
+#: core/models.py:51
+msgid "Stopped"
+msgstr "Stopped"
+
+#: core/models.py:52
+msgid "Saved"
+msgstr "Saved"
+
+#: core/models.py:53
+msgid "Aborted"
+msgstr "Aborted"
 
 #: core/models.py:54
-msgid "updated on"
-msgstr ""
+msgid "Failed to Start"
+msgstr "Failed to Start"
 
 #: core/models.py:55
-msgid "date and time at which a record was last updated"
-msgstr ""
+msgid "Failed to Stop"
+msgstr "Failed to Stop"
 
-#: core/models.py:75
+#: core/models.py:56
+msgid "Notification succeeded"
+msgstr "Notification succeeded"
+
+#: core/models.py:83
+msgid "SCREEN_RECORDING"
+msgstr "SCREEN_RECORDING"
+
+#: core/models.py:84
+msgid "TRANSCRIPT"
+msgstr "TRANSCRIPT"
+
+#: core/models.py:90
+msgid "Public Access"
+msgstr "Public Access"
+
+#: core/models.py:91
+msgid "Trusted Access"
+msgstr "Trusted Access"
+
+#: core/models.py:92
+msgid "Restricted Access"
+msgstr "Restricted Access"
+
+#: core/models.py:104
+msgid "id"
+msgstr "id"
+
+#: core/models.py:105
+msgid "primary key for the record as UUID"
+msgstr "primary key for the record as UUID"
+
+#: core/models.py:111
+msgid "created on"
+msgstr "created on"
+
+#: core/models.py:112
+msgid "date and time at which a record was created"
+msgstr "date and time at which a record was created"
+
+#: core/models.py:117
+msgid "updated on"
+msgstr "updated on"
+
+#: core/models.py:118
+msgid "date and time at which a record was last updated"
+msgstr "date and time at which a record was last updated"
+
+#: core/models.py:138
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
 msgstr ""
+"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
+"_ characters."
 
-#: core/models.py:81
+#: core/models.py:144
 msgid "sub"
-msgstr ""
+msgstr "sub"
 
-#: core/models.py:83
+#: core/models.py:146
 msgid ""
 "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
 "characters only."
 msgstr ""
+"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
+"characters only."
 
-#: core/models.py:91
+#: core/models.py:154
 msgid "identity email address"
-msgstr ""
+msgstr "identity email address"
 
-#: core/models.py:96
+#: core/models.py:159
 msgid "admin email address"
-msgstr ""
+msgstr "admin email address"
 
-#: core/models.py:103
+#: core/models.py:161
+msgid "full name"
+msgstr "full name"
+
+#: core/models.py:163
+msgid "short name"
+msgstr "short name"
+
+#: core/models.py:169
 msgid "language"
-msgstr ""
+msgstr "language"
 
-#: core/models.py:104
+#: core/models.py:170
 msgid "The language in which the user wants to see the interface."
-msgstr ""
+msgstr "The language in which the user wants to see the interface."
 
-#: core/models.py:110
+#: core/models.py:176
 msgid "The timezone in which the user wants to see times."
-msgstr ""
+msgstr "The timezone in which the user wants to see times."
 
-#: core/models.py:113
+#: core/models.py:179
 msgid "device"
-msgstr ""
+msgstr "device"
 
-#: core/models.py:115
+#: core/models.py:181
 msgid "Whether the user is a device or a real user."
-msgstr ""
+msgstr "Whether the user is a device or a real user."
 
-#: core/models.py:118
+#: core/models.py:184
 msgid "staff status"
-msgstr ""
+msgstr "staff status"
 
-#: core/models.py:120
+#: core/models.py:186
 msgid "Whether the user can log into this admin site."
-msgstr ""
+msgstr "Whether the user can log into this admin site."
 
-#: core/models.py:123
+#: core/models.py:189
 msgid "active"
-msgstr ""
+msgstr "active"
 
-#: core/models.py:126
+#: core/models.py:192
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 msgstr ""
+"Whether this user should be treated as active. Unselect this instead of "
+"deleting accounts."
 
-#: core/models.py:138
+#: core/models.py:205
 msgid "user"
-msgstr ""
+msgstr "user"
 
-#: core/models.py:139
+#: core/models.py:206
 msgid "users"
-msgstr ""
+msgstr "users"
 
-#: core/models.py:161
-msgid "title"
-msgstr ""
+#: core/models.py:265
+msgid "Resource"
+msgstr "Resource"
 
-#: core/models.py:162
-msgid "description"
-msgstr ""
+#: core/models.py:266
+msgid "Resources"
+msgstr "Resources"
 
-#: core/models.py:163
-msgid "code"
-msgstr ""
+#: core/models.py:320
+msgid "Resource access"
+msgstr "Resource access"
 
-#: core/models.py:164
-msgid "css"
-msgstr ""
+#: core/models.py:321
+msgid "Resource accesses"
+msgstr "Resource accesses"
 
-#: core/models.py:166
-msgid "public"
-msgstr ""
+#: core/models.py:327
+msgid "Resource access with this User and Resource already exists."
+msgstr "Resource access with this User and Resource already exists."
 
-#: core/models.py:168
-msgid "Whether this template is public for anyone to use."
-msgstr ""
+#: core/models.py:383
+msgid "Visio room configuration"
+msgstr "Visio room configuration"
 
-#: core/models.py:174
-msgid "Template"
-msgstr ""
+#: core/models.py:384
+msgid "Values for Visio parameters to configure the room."
+msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:175
-msgid "Templates"
-msgstr ""
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "Room PIN code"
 
-#: core/models.py:256
-msgid "Template/user relation"
-msgstr ""
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Unique n-digit code that identifies this room in telephony mode."
 
-#: core/models.py:257
-msgid "Template/user relations"
-msgstr ""
+#: core/models.py:398 core/models.py:552
+msgid "Room"
+msgstr "Room"
 
-#: core/models.py:263
-msgid "This user is already in this template."
-msgstr ""
+#: core/models.py:399
+msgid "Rooms"
+msgstr "Rooms"
 
-#: core/models.py:269
-msgid "This team is already in this template."
-msgstr ""
+#: core/models.py:563
+msgid "Worker ID"
+msgstr "Worker ID"
 
-#: core/models.py:275
+#: core/models.py:565
+msgid ""
+"Enter an identifier for the worker recording.This ID is retained even when "
+"the worker stops, allowing for easy tracking."
+msgstr ""
+"Enter an identifier for the worker recording.This ID is retained even when "
+"the worker stops, allowing for easy tracking."
+
+#: core/models.py:573
+msgid "Recording mode"
+msgstr "Recording mode"
+
+#: core/models.py:574
+msgid "Defines the mode of recording being called."
+msgstr "Defines the mode of recording being called."
+
+#: core/models.py:580
+msgid "Recording"
+msgstr "Recording"
+
+#: core/models.py:581
+msgid "Recordings"
+msgstr "Recordings"
+
+#: core/models.py:689
+msgid "Recording/user relation"
+msgstr "Recording/user relation"
+
+#: core/models.py:690
+msgid "Recording/user relations"
+msgstr "Recording/user relations"
+
+#: core/models.py:696
+msgid "This user is already in this recording."
+msgstr "This user is already in this recording."
+
+#: core/models.py:702
+msgid "This team is already in this recording."
+msgstr "This team is already in this recording."
+
+#: core/models.py:708
 msgid "Either user or team must be set, not both."
-msgstr ""
+msgstr "Either user or team must be set, not both."
 
-#: meet/settings.py:134
+#: core/recording/event/notification.py:94
+msgid "Your recording is ready"
+msgstr "Your recording is ready"
+
+#: core/services/invitation.py:44
+#, python-brace-format
+msgid "Video call in progress: {sender.email} is waiting for you to connect"
+msgstr "Video call in progress: {sender.email} is waiting for you to connect"
+
+#: core/templates/mail/html/invitation.html:159
+#: core/templates/mail/html/screen_recording.html:159
+#: core/templates/mail/text/invitation.txt:3
+#: core/templates/mail/text/screen_recording.txt:3
+msgid "Logo email"
+msgstr "Logo email"
+
+#: core/templates/mail/html/invitation.html:189
+#: core/templates/mail/text/invitation.txt:5
+msgid "invites you to join an ongoing video call"
+msgstr "invites you to join an ongoing video call"
+
+#: core/templates/mail/html/invitation.html:200
+#: core/templates/mail/text/invitation.txt:7
+msgid "JOIN THE CALL"
+msgstr "JOIN THE CALL"
+
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:13
+msgid ""
+"If you can't click the button, copy and paste the URL into your browser to "
+"join the call."
+msgstr ""
+"If you can't click the button, copy and paste the URL into your browser to "
+"join the call."
+
+#: core/templates/mail/html/invitation.html:235
+#: core/templates/mail/text/invitation.txt:15
+msgid "Tips for a better experience:"
+msgstr "Tips for a better experience:"
+
+#: core/templates/mail/html/invitation.html:237
+#: core/templates/mail/text/invitation.txt:17
+msgid "Use Chrome or Firefox for better call quality"
+msgstr "Use Chrome or Firefox for better call quality"
+
+#: core/templates/mail/html/invitation.html:238
+#: core/templates/mail/text/invitation.txt:18
+msgid "Test your microphone and camera before joining"
+msgstr "Test your microphone and camera before joining"
+
+#: core/templates/mail/html/invitation.html:239
+#: core/templates/mail/text/invitation.txt:19
+msgid "Make sure you have a stable internet connection"
+msgstr "Make sure you have a stable internet connection"
+
+#: core/templates/mail/html/invitation.html:248
+#: core/templates/mail/html/screen_recording.html:240
+#: core/templates/mail/text/invitation.txt:21
+#: core/templates/mail/text/screen_recording.txt:22
+#, python-format
+msgid " Thank you for using %(brandname)s. "
+msgstr " Thank you for using %(brandname)s. "
+
+#: core/templates/mail/html/screen_recording.html:188
+#: core/templates/mail/text/screen_recording.txt:6
+msgid "Your recording is ready!"
+msgstr "Your recording is ready!"
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid ""
+" Your recording of \"%(room_name)s\" on %(recording_date)s at "
+"%(recording_time)s is now ready to download. "
+msgstr ""
+" Your recording of \"%(room_name)s\" on %(recording_date)s at "
+"%(recording_time)s is now ready to download. "
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid " The recording will expire in %(days)s days. "
+msgstr " The recording will expire in %(days)s days. "
+
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:10
+msgid "To keep this recording permanently:"
+msgstr "To keep this recording permanently:"
+
+#: core/templates/mail/html/screen_recording.html:203
+#: core/templates/mail/text/screen_recording.txt:12
+msgid "Click the \"Open\" button below "
+msgstr "Click the \"Open\" button below "
+
+#: core/templates/mail/html/screen_recording.html:204
+#: core/templates/mail/text/screen_recording.txt:13
+msgid "Use the \"Download\" button in the interface "
+msgstr "Use the \"Download\" button in the interface "
+
+#: core/templates/mail/html/screen_recording.html:205
+#: core/templates/mail/text/screen_recording.txt:14
+msgid "Save the file to your preferred location"
+msgstr "Save the file to your preferred location"
+
+#: core/templates/mail/html/screen_recording.html:216
+#: core/templates/mail/text/screen_recording.txt:16
+msgid "Open"
+msgstr "Open"
+
+#: core/templates/mail/html/screen_recording.html:225
+#: core/templates/mail/text/screen_recording.txt:18
+#, python-format
+msgid ""
+" If you have any questions or need assistance, please contact our support "
+"team at %(support_email)s. "
+msgstr ""
+" If you have any questions or need assistance, please contact our support "
+"team at %(support_email)s. "
+
+#: meet/settings.py:162
 msgid "English"
-msgstr ""
+msgstr "English"
 
-#: meet/settings.py:135
+#: meet/settings.py:163
 msgid "French"
-msgstr ""
+msgstr "French"
+
+#: meet/settings.py:164
+msgid "Dutch"
+msgstr "Dutch"
+
+#: meet/settings.py:165
+msgid "German"
+msgstr "German"

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,201 +8,440 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-04-03 10:31+0000\n"
+"POT-Creation-Date: 2025-05-26 10:50+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: core/admin.py:31
+#: core/admin.py:26
 msgid "Personal info"
-msgstr ""
+msgstr "Informations personnelles"
 
-#: core/admin.py:33
+#: core/admin.py:39
 msgid "Permissions"
-msgstr ""
+msgstr "Permissions"
 
-#: core/admin.py:45
+#: core/admin.py:51
 msgid "Important dates"
-msgstr ""
+msgstr "Dates importantes"
 
-#: core/api/serializers.py:128
-msgid "Markdown Body"
-msgstr ""
+#: core/admin.py:143
+msgid "No owner"
+msgstr "Pas de propriétaire"
 
-#: core/authentication.py:71
-msgid "User info contained no recognizable user identification"
-msgstr ""
+#: core/admin.py:146
+msgid "Multiple owners"
+msgstr "Plusieurs propriétaires"
 
-#: core/authentication.py:91
-msgid "Claims contained no recognizable user identification"
+#: core/api/serializers.py:63
+msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
+"Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
+"des accès."
 
-#: core/models.py:27
+#: core/models.py:31
 msgid "Member"
-msgstr ""
+msgstr "Membre"
 
-#: core/models.py:28
+#: core/models.py:32
 msgid "Administrator"
-msgstr ""
+msgstr "Administrateur"
 
-#: core/models.py:29
+#: core/models.py:33
 msgid "Owner"
-msgstr ""
-
-#: core/models.py:41
-msgid "id"
-msgstr ""
-
-#: core/models.py:42
-msgid "primary key for the record as UUID"
-msgstr ""
-
-#: core/models.py:48
-msgid "created on"
-msgstr ""
+msgstr "Propriétaire"
 
 #: core/models.py:49
-msgid "date and time at which a record was created"
-msgstr ""
+msgid "Initiated"
+msgstr "Initié"
+
+#: core/models.py:50
+msgid "Active"
+msgstr "Actif"
+
+#: core/models.py:51
+msgid "Stopped"
+msgstr "Arrêté"
+
+#: core/models.py:52
+msgid "Saved"
+msgstr "Enregistré"
+
+#: core/models.py:53
+msgid "Aborted"
+msgstr "Abandonné"
 
 #: core/models.py:54
-msgid "updated on"
-msgstr ""
+msgid "Failed to Start"
+msgstr "Échec au démarrage"
 
 #: core/models.py:55
+msgid "Failed to Stop"
+msgstr "Échec à l'arrêt"
+
+#: core/models.py:56
+msgid "Notification succeeded"
+msgstr "Notification réussie"
+
+#: core/models.py:83
+msgid "SCREEN_RECORDING"
+msgstr "ENREGISTREMENT_ÉCRAN"
+
+#: core/models.py:84
+msgid "TRANSCRIPT"
+msgstr "TRANSCRIPTION"
+
+#: core/models.py:90
+msgid "Public Access"
+msgstr "Accès public"
+
+#: core/models.py:91
+msgid "Trusted Access"
+msgstr "Accès de confiance"
+
+#: core/models.py:92
+msgid "Restricted Access"
+msgstr "Accès restreint"
+
+#: core/models.py:104
+msgid "id"
+msgstr "id"
+
+#: core/models.py:105
+msgid "primary key for the record as UUID"
+msgstr "clé primaire pour l'enregistrement sous forme d'UUID"
+
+#: core/models.py:111
+msgid "created on"
+msgstr "créé le"
+
+#: core/models.py:112
+msgid "date and time at which a record was created"
+msgstr "date et heure auxquelles un enregistrement a été créé"
+
+#: core/models.py:117
+msgid "updated on"
+msgstr "mis à jour le"
+
+#: core/models.py:118
 msgid "date and time at which a record was last updated"
 msgstr ""
+"date et heure auxquelles un enregistrement a été mis à jour pour la dernière "
+"fois"
 
-#: core/models.py:75
+#: core/models.py:138
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
 msgstr ""
+"Entrez un sub valide. Cette valeur ne peut contenir que des lettres, "
+"des chiffres et les caractères @/./+/-/_."
 
-#: core/models.py:81
+#: core/models.py:144
 msgid "sub"
-msgstr ""
+msgstr "sub"
 
-#: core/models.py:83
+#: core/models.py:146
 msgid ""
 "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
 "characters only."
 msgstr ""
+"Obligatoire. 255 caractères ou moins. Lettres, chiffres et caractères @/./"
+"+/-/_ uniquement."
 
-#: core/models.py:91
+#: core/models.py:154
 msgid "identity email address"
-msgstr ""
+msgstr "adresse e-mail d'identité"
 
-#: core/models.py:96
+#: core/models.py:159
 msgid "admin email address"
-msgstr ""
+msgstr "adresse e-mail d'administrateur"
 
-#: core/models.py:103
+#: core/models.py:161
+msgid "full name"
+msgstr "nom complet"
+
+#: core/models.py:163
+msgid "short name"
+msgstr "nom court"
+
+#: core/models.py:169
 msgid "language"
-msgstr ""
+msgstr "langue"
 
-#: core/models.py:104
+#: core/models.py:170
 msgid "The language in which the user wants to see the interface."
-msgstr ""
+msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."
 
-#: core/models.py:110
+#: core/models.py:176
 msgid "The timezone in which the user wants to see times."
-msgstr ""
+msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."
 
-#: core/models.py:113
+#: core/models.py:179
 msgid "device"
-msgstr ""
+msgstr "appareil"
 
-#: core/models.py:115
+#: core/models.py:181
 msgid "Whether the user is a device or a real user."
-msgstr ""
+msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."
 
-#: core/models.py:118
+#: core/models.py:184
 msgid "staff status"
-msgstr ""
+msgstr "statut du personnel"
 
-#: core/models.py:120
+#: core/models.py:186
 msgid "Whether the user can log into this admin site."
-msgstr ""
+msgstr "Si l'utilisateur peut se connecter à ce site d'administration."
 
-#: core/models.py:123
+#: core/models.py:189
 msgid "active"
-msgstr ""
+msgstr "actif"
 
-#: core/models.py:126
+#: core/models.py:192
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 msgstr ""
+"Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
+"au lieu de supprimer des comptes."
 
-#: core/models.py:138
+#: core/models.py:205
 msgid "user"
-msgstr ""
+msgstr "utilisateur"
 
-#: core/models.py:139
+#: core/models.py:206
 msgid "users"
-msgstr ""
+msgstr "utilisateurs"
 
-#: core/models.py:161
-msgid "title"
-msgstr ""
+#: core/models.py:265
+msgid "Resource"
+msgstr "Ressource"
 
-#: core/models.py:162
-msgid "description"
-msgstr ""
+#: core/models.py:266
+msgid "Resources"
+msgstr "Ressources"
 
-#: core/models.py:163
-msgid "code"
-msgstr ""
+#: core/models.py:320
+msgid "Resource access"
+msgstr "Accès aux ressources"
 
-#: core/models.py:164
-msgid "css"
-msgstr ""
+#: core/models.py:321
+msgid "Resource accesses"
+msgstr "Accès aux ressources"
 
-#: core/models.py:166
-msgid "public"
+#: core/models.py:327
+msgid "Resource access with this User and Resource already exists."
 msgstr ""
+"L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."
 
-#: core/models.py:168
-msgid "Whether this template is public for anyone to use."
+#: core/models.py:383
+msgid "Visio room configuration"
+msgstr "Configuration de la salle de visioconférence"
+
+#: core/models.py:384
+msgid "Values for Visio parameters to configure the room."
+msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
+
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "Code PIN de la salle"
+
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
+
+#: core/models.py:398 core/models.py:552
+msgid "Room"
+msgstr "Salle"
+
+#: core/models.py:399
+msgid "Rooms"
+msgstr "Salles"
+
+#: core/models.py:563
+msgid "Worker ID"
+msgstr "ID du Worker"
+
+#: core/models.py:565
+msgid ""
+"Enter an identifier for the worker recording.This ID is retained even when "
+"the worker stops, allowing for easy tracking."
 msgstr ""
+"Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant "
+"est conservé même lorsque le Worker s'arrête, permettant un suivi "
+"facile."
 
-#: core/models.py:174
-msgid "Template"
-msgstr ""
+#: core/models.py:573
+msgid "Recording mode"
+msgstr "Mode d'enregistrement"
 
-#: core/models.py:175
-msgid "Templates"
-msgstr ""
+#: core/models.py:574
+msgid "Defines the mode of recording being called."
+msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:256
-msgid "Template/user relation"
-msgstr ""
+#: core/models.py:580
+msgid "Recording"
+msgstr "Enregistrement"
 
-#: core/models.py:257
-msgid "Template/user relations"
-msgstr ""
+#: core/models.py:581
+msgid "Recordings"
+msgstr "Enregistrements"
 
-#: core/models.py:263
-msgid "This user is already in this template."
-msgstr ""
+#: core/models.py:689
+msgid "Recording/user relation"
+msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:269
-msgid "This team is already in this template."
-msgstr ""
+#: core/models.py:690
+msgid "Recording/user relations"
+msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:275
+#: core/models.py:696
+msgid "This user is already in this recording."
+msgstr "Cet utilisateur est déjà dans cet enregistrement."
+
+#: core/models.py:702
+msgid "This team is already in this recording."
+msgstr "Cette équipe est déjà dans cet enregistrement."
+
+#: core/models.py:708
 msgid "Either user or team must be set, not both."
-msgstr ""
+msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 
-#: meet/settings.py:134
+#: core/recording/event/notification.py:94
+msgid "Your recording is ready"
+msgstr "Votre enregistrement est prêt"
+
+#: core/services/invitation.py:44
+#, python-brace-format
+msgid "Video call in progress: {sender.email} is waiting for you to connect"
+msgstr "Appel vidéo en cours : {sender.email} attend que vous vous connectiez"
+
+#: core/templates/mail/html/invitation.html:159
+#: core/templates/mail/html/screen_recording.html:159
+#: core/templates/mail/text/invitation.txt:3
+#: core/templates/mail/text/screen_recording.txt:3
+msgid "Logo email"
+msgstr "Logo email"
+
+#: core/templates/mail/html/invitation.html:189
+#: core/templates/mail/text/invitation.txt:5
+msgid "invites you to join an ongoing video call"
+msgstr "vous invite à rejoindre un appel vidéo en cours"
+
+#: core/templates/mail/html/invitation.html:200
+#: core/templates/mail/text/invitation.txt:7
+msgid "JOIN THE CALL"
+msgstr "REJOINDRE L'APPEL"
+
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:13
+msgid ""
+"If you can't click the button, copy and paste the URL into your browser to "
+"join the call."
+msgstr ""
+"Si vous ne pouvez pas cliquer sur le bouton, copiez et collez l'URL dans "
+"votre navigateur pour rejoindre l'appel."
+
+#: core/templates/mail/html/invitation.html:235
+#: core/templates/mail/text/invitation.txt:15
+msgid "Tips for a better experience:"
+msgstr "Conseils pour une meilleure expérience :"
+
+#: core/templates/mail/html/invitation.html:237
+#: core/templates/mail/text/invitation.txt:17
+msgid "Use Chrome or Firefox for better call quality"
+msgstr "Utilisez Chrome ou Firefox pour une meilleure qualité d'appel"
+
+#: core/templates/mail/html/invitation.html:238
+#: core/templates/mail/text/invitation.txt:18
+msgid "Test your microphone and camera before joining"
+msgstr "Testez votre microphone et votre caméra avant de rejoindre"
+
+#: core/templates/mail/html/invitation.html:239
+#: core/templates/mail/text/invitation.txt:19
+msgid "Make sure you have a stable internet connection"
+msgstr "Assurez-vous d'avoir une connexion Internet stable"
+
+#: core/templates/mail/html/invitation.html:248
+#: core/templates/mail/html/screen_recording.html:240
+#: core/templates/mail/text/invitation.txt:21
+#: core/templates/mail/text/screen_recording.txt:22
+#, python-format
+msgid " Thank you for using %(brandname)s. "
+msgstr " Merci d'utiliser %(brandname)s. "
+
+#: core/templates/mail/html/screen_recording.html:188
+#: core/templates/mail/text/screen_recording.txt:6
+msgid "Your recording is ready!"
+msgstr "Votre enregistrement est prêt !"
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid ""
+" Your recording of \"%(room_name)s\" on %(recording_date)s at "
+"%(recording_time)s is now ready to download. "
+msgstr ""
+" Votre enregistrement de \"%(room_name)s\" du %(recording_date)s à "
+"%(recording_time)s est maintenant prêt à être téléchargé. "
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid " The recording will expire in %(days)s days. "
+msgstr " L'enregistrement expirera dans %(days)s jours. "
+
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:10
+msgid "To keep this recording permanently:"
+msgstr "Pour conserver cet enregistrement de façon permanente :"
+
+#: core/templates/mail/html/screen_recording.html:203
+#: core/templates/mail/text/screen_recording.txt:12
+msgid "Click the \"Open\" button below "
+msgstr "Cliquez sur le bouton \"Ouvrir\" ci-dessous "
+
+#: core/templates/mail/html/screen_recording.html:204
+#: core/templates/mail/text/screen_recording.txt:13
+msgid "Use the \"Download\" button in the interface "
+msgstr "Utilisez le bouton \"Télécharger\" dans l'interface "
+
+#: core/templates/mail/html/screen_recording.html:205
+#: core/templates/mail/text/screen_recording.txt:14
+msgid "Save the file to your preferred location"
+msgstr "Enregistrez le fichier à l'emplacement de votre choix"
+
+#: core/templates/mail/html/screen_recording.html:216
+#: core/templates/mail/text/screen_recording.txt:16
+msgid "Open"
+msgstr "Ouvrir"
+
+#: core/templates/mail/html/screen_recording.html:225
+#: core/templates/mail/text/screen_recording.txt:18
+#, python-format
+msgid ""
+" If you have any questions or need assistance, please contact our support "
+"team at %(support_email)s. "
+msgstr ""
+" Si vous avez des questions ou besoin d'assistance, veuillez contacter notre "
+"équipe d'assistance à %(support_email)s. "
+
+#: meet/settings.py:162
 msgid "English"
-msgstr ""
+msgstr "Anglais"
 
-#: meet/settings.py:135
+#: meet/settings.py:163
 msgid "French"
-msgstr ""
+msgstr "Français"
+
+#: meet/settings.py:164
+msgid "Dutch"
+msgstr "Néerlandais"
+
+#: meet/settings.py:165
+msgid "German"
+msgstr "Allemand"

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -0,0 +1,441 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2025-05-26 10:50+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: core/admin.py:26
+msgid "Personal info"
+msgstr "Persoonlijke informatie"
+
+#: core/admin.py:39
+msgid "Permissions"
+msgstr "Rechten"
+
+#: core/admin.py:51
+msgid "Important dates"
+msgstr "Belangrijke datums"
+
+#: core/admin.py:143
+msgid "No owner"
+msgstr "Geen eigenaar"
+
+#: core/admin.py:146
+msgid "Multiple owners"
+msgstr "Meerdere eigenaren"
+
+#: core/api/serializers.py:63
+msgid "You must be administrator or owner of a room to add accesses to it."
+msgstr ""
+"Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."
+
+#: core/models.py:31
+msgid "Member"
+msgstr "Lid"
+
+#: core/models.py:32
+msgid "Administrator"
+msgstr "Beheerder"
+
+#: core/models.py:33
+msgid "Owner"
+msgstr "Eigenaar"
+
+#: core/models.py:49
+msgid "Initiated"
+msgstr "Gestart"
+
+#: core/models.py:50
+msgid "Active"
+msgstr "Actief"
+
+#: core/models.py:51
+msgid "Stopped"
+msgstr "Gestopt"
+
+#: core/models.py:52
+msgid "Saved"
+msgstr "Opgeslagen"
+
+#: core/models.py:53
+msgid "Aborted"
+msgstr "Afgebroken"
+
+#: core/models.py:54
+msgid "Failed to Start"
+msgstr "Starten mislukt"
+
+#: core/models.py:55
+msgid "Failed to Stop"
+msgstr "Stoppen mislukt"
+
+#: core/models.py:56
+msgid "Notification succeeded"
+msgstr "Notificatie geslaagd"
+
+#: core/models.py:83
+msgid "SCREEN_RECORDING"
+msgstr "SCHERM_OPNAME"
+
+#: core/models.py:84
+msgid "TRANSCRIPT"
+msgstr "TRANSCRIPT"
+
+#: core/models.py:90
+msgid "Public Access"
+msgstr "Openbare toegang"
+
+#: core/models.py:91
+msgid "Trusted Access"
+msgstr "Vertrouwde toegang"
+
+#: core/models.py:92
+msgid "Restricted Access"
+msgstr "Beperkte toegang"
+
+#: core/models.py:104
+msgid "id"
+msgstr "id"
+
+#: core/models.py:105
+msgid "primary key for the record as UUID"
+msgstr "primaire sleutel voor het record als UUID"
+
+#: core/models.py:111
+msgid "created on"
+msgstr "aangemaakt op"
+
+#: core/models.py:112
+msgid "date and time at which a record was created"
+msgstr "datum en tijd waarop een record werd aangemaakt"
+
+#: core/models.py:117
+msgid "updated on"
+msgstr "bijgewerkt op"
+
+#: core/models.py:118
+msgid "date and time at which a record was last updated"
+msgstr "datum en tijd waarop een record voor het laatst werd bijgewerkt"
+
+#: core/models.py:138
+msgid ""
+"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
+"_ characters."
+msgstr ""
+"Voer een geldige sub in. Deze waarde mag alleen letters, cijfers en @/./+/-/"
+"_ tekens bevatten."
+
+#: core/models.py:144
+msgid "sub"
+msgstr "sub"
+
+#: core/models.py:146
+msgid ""
+"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
+"characters only."
+msgstr ""
+"Vereist. 255 tekens of minder. Alleen letters, cijfers en @/./+/-/_ tekens."
+
+#: core/models.py:154
+msgid "identity email address"
+msgstr "identiteit e-mailadres"
+
+#: core/models.py:159
+msgid "admin email address"
+msgstr "beheerder e-mailadres"
+
+#: core/models.py:161
+msgid "full name"
+msgstr "volledige naam"
+
+#: core/models.py:163
+msgid "short name"
+msgstr "korte naam"
+
+#: core/models.py:169
+msgid "language"
+msgstr "taal"
+
+#: core/models.py:170
+msgid "The language in which the user wants to see the interface."
+msgstr "De taal waarin de gebruiker de interface wil zien."
+
+#: core/models.py:176
+msgid "The timezone in which the user wants to see times."
+msgstr "De tijdzone waarin de gebruiker tijden wil zien."
+
+#: core/models.py:179
+msgid "device"
+msgstr "apparaat"
+
+#: core/models.py:181
+msgid "Whether the user is a device or a real user."
+msgstr "Of de gebruiker een apparaat is of een echte gebruiker."
+
+#: core/models.py:184
+msgid "staff status"
+msgstr "personeelsstatus"
+
+#: core/models.py:186
+msgid "Whether the user can log into this admin site."
+msgstr "Of de gebruiker kan inloggen op deze beheersite."
+
+#: core/models.py:189
+msgid "active"
+msgstr "actief"
+
+#: core/models.py:192
+msgid ""
+"Whether this user should be treated as active. Unselect this instead of "
+"deleting accounts."
+msgstr ""
+"Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
+"plaats van accounts te verwijderen."
+
+#: core/models.py:205
+msgid "user"
+msgstr "gebruiker"
+
+#: core/models.py:206
+msgid "users"
+msgstr "gebruikers"
+
+#: core/models.py:265
+msgid "Resource"
+msgstr "Bron"
+
+#: core/models.py:266
+msgid "Resources"
+msgstr "Bronnen"
+
+#: core/models.py:320
+msgid "Resource access"
+msgstr "Brontoegang"
+
+#: core/models.py:321
+msgid "Resource accesses"
+msgstr "Brontoegangsrechten"
+
+#: core/models.py:327
+msgid "Resource access with this User and Resource already exists."
+msgstr "Brontoegang met deze gebruiker en bron bestaat al."
+
+#: core/models.py:383
+msgid "Visio room configuration"
+msgstr "Visio-ruimteconfiguratie"
+
+#: core/models.py:384
+msgid "Values for Visio parameters to configure the room."
+msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
+
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "Pincode van de kamer"
+
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
+
+#: core/models.py:398 core/models.py:552
+msgid "Room"
+msgstr "Ruimte"
+
+#: core/models.py:399
+msgid "Rooms"
+msgstr "Ruimtes"
+
+#: core/models.py:563
+msgid "Worker ID"
+msgstr "Worker ID"
+
+#: core/models.py:565
+msgid ""
+"Enter an identifier for the worker recording.This ID is retained even when "
+"the worker stops, allowing for easy tracking."
+msgstr ""
+"Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
+"zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
+
+#: core/models.py:573
+msgid "Recording mode"
+msgstr "Opnamemodus"
+
+#: core/models.py:574
+msgid "Defines the mode of recording being called."
+msgstr "Definieert de modus van opname die wordt aangeroepen."
+
+#: core/models.py:580
+msgid "Recording"
+msgstr "Opname"
+
+#: core/models.py:581
+msgid "Recordings"
+msgstr "Opnames"
+
+#: core/models.py:689
+msgid "Recording/user relation"
+msgstr "Opname/gebruiker-relatie"
+
+#: core/models.py:690
+msgid "Recording/user relations"
+msgstr "Opname/gebruiker-relaties"
+
+#: core/models.py:696
+msgid "This user is already in this recording."
+msgstr "Deze gebruiker is al in deze opname."
+
+#: core/models.py:702
+msgid "This team is already in this recording."
+msgstr "Dit team is al in deze opname."
+
+#: core/models.py:708
+msgid "Either user or team must be set, not both."
+msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
+
+#: core/recording/event/notification.py:94
+msgid "Your recording is ready"
+msgstr "Je opname is klaar"
+
+#: core/services/invitation.py:44
+#, python-brace-format
+msgid "Video call in progress: {sender.email} is waiting for you to connect"
+msgstr "Video-oproep bezig: {sender.email} wacht op je verbinding"
+
+#: core/templates/mail/html/invitation.html:159
+#: core/templates/mail/html/screen_recording.html:159
+#: core/templates/mail/text/invitation.txt:3
+#: core/templates/mail/text/screen_recording.txt:3
+msgid "Logo email"
+msgstr "Logo e-mail"
+
+#: core/templates/mail/html/invitation.html:189
+#: core/templates/mail/text/invitation.txt:5
+msgid "invites you to join an ongoing video call"
+msgstr "nodigt je uit om deel te nemen aan een lopende video-oproep"
+
+#: core/templates/mail/html/invitation.html:200
+#: core/templates/mail/text/invitation.txt:7
+msgid "JOIN THE CALL"
+msgstr "NEEM DEEL AAN DE OPROEP"
+
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:13
+msgid ""
+"If you can't click the button, copy and paste the URL into your browser to "
+"join the call."
+msgstr ""
+"Als je niet op de knop kunt klikken, kopieer en plak dan de URL in je "
+"browser om deel te nemen aan de oproep."
+
+#: core/templates/mail/html/invitation.html:235
+#: core/templates/mail/text/invitation.txt:15
+msgid "Tips for a better experience:"
+msgstr "Tips voor een betere ervaring:"
+
+#: core/templates/mail/html/invitation.html:237
+#: core/templates/mail/text/invitation.txt:17
+msgid "Use Chrome or Firefox for better call quality"
+msgstr "Gebruik Chrome of Firefox voor betere gesprekskwaliteit"
+
+#: core/templates/mail/html/invitation.html:238
+#: core/templates/mail/text/invitation.txt:18
+msgid "Test your microphone and camera before joining"
+msgstr "Test je microfoon en camera voordat je deelneemt"
+
+#: core/templates/mail/html/invitation.html:239
+#: core/templates/mail/text/invitation.txt:19
+msgid "Make sure you have a stable internet connection"
+msgstr "Zorg ervoor dat je een stabiele internetverbinding hebt"
+
+#: core/templates/mail/html/invitation.html:248
+#: core/templates/mail/html/screen_recording.html:240
+#: core/templates/mail/text/invitation.txt:21
+#: core/templates/mail/text/screen_recording.txt:22
+#, python-format
+msgid " Thank you for using %(brandname)s. "
+msgstr " Bedankt voor het gebruik van %(brandname)s. "
+
+#: core/templates/mail/html/screen_recording.html:188
+#: core/templates/mail/text/screen_recording.txt:6
+msgid "Your recording is ready!"
+msgstr "Je opname is klaar!"
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid ""
+" Your recording of \"%(room_name)s\" on %(recording_date)s at "
+"%(recording_time)s is now ready to download. "
+msgstr ""
+" Je opname van \"%(room_name)s\" op %(recording_date)s om %(recording_time)s "
+"is nu klaar om te downloaden. "
+
+#: core/templates/mail/html/screen_recording.html:195
+#: core/templates/mail/text/screen_recording.txt:8
+#, python-format
+msgid " The recording will expire in %(days)s days. "
+msgstr " De opname verloopt over %(days)s dagen. "
+
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:10
+msgid "To keep this recording permanently:"
+msgstr "Om deze opname permanent te bewaren:"
+
+#: core/templates/mail/html/screen_recording.html:203
+#: core/templates/mail/text/screen_recording.txt:12
+msgid "Click the \"Open\" button below "
+msgstr "Klik op de \"Openen\"-knop hieronder "
+
+#: core/templates/mail/html/screen_recording.html:204
+#: core/templates/mail/text/screen_recording.txt:13
+msgid "Use the \"Download\" button in the interface "
+msgstr "Gebruik de \"Download\"-knop in de interface "
+
+#: core/templates/mail/html/screen_recording.html:205
+#: core/templates/mail/text/screen_recording.txt:14
+msgid "Save the file to your preferred location"
+msgstr "Sla het bestand op naar je gewenste locatie"
+
+#: core/templates/mail/html/screen_recording.html:216
+#: core/templates/mail/text/screen_recording.txt:16
+msgid "Open"
+msgstr "Openen"
+
+#: core/templates/mail/html/screen_recording.html:225
+#: core/templates/mail/text/screen_recording.txt:18
+#, python-format
+msgid ""
+" If you have any questions or need assistance, please contact our support "
+"team at %(support_email)s. "
+msgstr ""
+" Als je vragen hebt of hulp nodig hebt, neem dan contact op met ons support "
+"team via %(support_email)s. "
+
+#: meet/settings.py:162
+msgid "English"
+msgstr "Engels"
+
+#: meet/settings.py:163
+msgid "French"
+msgstr "Frans"
+
+#: meet/settings.py:164
+msgid "Dutch"
+msgstr "Nederlands"
+
+#: meet/settings.py:165
+msgid "German"
+msgstr "Duits"

src/backend/manage.py

@@ -3,12 +3,12 @@
 meet's sandbox management script.
 """
 
-import os
 import sys
+from os import environ
 
 if __name__ == "__main__":
-    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "meet.settings")
-    os.environ.setdefault("DJANGO_CONFIGURATION", "Development")
+    environ.setdefault("DJANGO_SETTINGS_MODULE", "meet.settings")
+    environ.setdefault("DJANGO_CONFIGURATION", "Development")
 
     from configurations.management import execute_from_command_line
 

src/backend/meet/celery_app.py

@@ -1,13 +1,13 @@
 """Meet celery configuration file."""
 
-import os
+from os import environ
 
 from celery import Celery
 from configurations.importer import install
 
 # Set the default Django settings module for the 'celery' program.
-os.environ.setdefault("DJANGO_SETTINGS_MODULE", "meet.settings")
-os.environ.setdefault("DJANGO_CONFIGURATION", "Development")
+environ.setdefault("DJANGO_SETTINGS_MODULE", "meet.settings")
+environ.setdefault("DJANGO_CONFIGURATION", "Development")
 
 install(check_options=True)
 

src/backend/meet/settings.py

@@ -11,19 +11,19 @@ https://docs.djangoproject.com/en/3.1/ref/settings/
 """
 
 import json
-import os
+from os import path
 from socket import gethostbyname, gethostname
 
 from django.utils.translation import gettext_lazy as _
 
 import sentry_sdk
 from configurations import Configuration, values
+from lasuite.configuration.values import SecretFileValue
 from sentry_sdk.integrations.django import DjangoIntegration
 from sentry_sdk.integrations.logging import ignore_logger
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
-BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-DATA_DIR = os.path.join("/", "data")
+BASE_DIR = path.dirname(path.dirname(path.abspath(__file__)))
 
 
 def get_release():
@@ -39,7 +39,7 @@ def get_release():
     # Try to get the current release from the version.json file generated by the
     # CI during the Docker image build
     try:
-        with open(os.path.join(BASE_DIR, "version.json"), encoding="utf8") as version:
+        with open(path.join(BASE_DIR, "version.json"), encoding="utf8") as version:
             return json.load(version)["version"]
     except FileNotFoundError:
         return "NA"  # Default: not available
@@ -70,9 +70,11 @@ class Base(Configuration):
 
     API_VERSION = "v1.0"
 
+    DATA_DIR = values.Value(path.join("/", "data"), environ_name="DATA_DIR")
+
     # Security
     ALLOWED_HOSTS = values.ListValue([])
-    SECRET_KEY = values.Value(None)
+    SECRET_KEY = SecretFileValue(None)
     SILENCED_SYSTEM_CHECKS = values.ListValue([])
     ALLOW_UNSECURE_USER_LISTING = values.BooleanValue(
         False, environ_name="ALLOW_UNSECURE_USER_LISTING", environ_prefix=None
@@ -92,7 +94,7 @@ class Base(Configuration):
             ),
             "NAME": values.Value("meet", environ_name="DB_NAME", environ_prefix=None),
             "USER": values.Value("dinum", environ_name="DB_USER", environ_prefix=None),
-            "PASSWORD": values.Value(
+            "PASSWORD": SecretFileValue(
                 "pass", environ_name="DB_PASSWORD", environ_prefix=None
             ),
             "HOST": values.Value(
@@ -105,9 +107,9 @@ class Base(Configuration):
 
     # Static files (CSS, JavaScript, Images)
     STATIC_URL = "/static/"
-    STATIC_ROOT = os.path.join(DATA_DIR, "static")
+    STATIC_ROOT = path.join(DATA_DIR, "static")
     MEDIA_URL = "/media/"
-    MEDIA_ROOT = os.path.join(DATA_DIR, "media")
+    MEDIA_ROOT = path.join(DATA_DIR, "media")
 
     SITE_ID = 1
 
@@ -127,10 +129,10 @@ class Base(Configuration):
     AWS_S3_ENDPOINT_URL = values.Value(
         environ_name="AWS_S3_ENDPOINT_URL", environ_prefix=None
     )
-    AWS_S3_ACCESS_KEY_ID = values.Value(
+    AWS_S3_ACCESS_KEY_ID = SecretFileValue(
         environ_name="AWS_S3_ACCESS_KEY_ID", environ_prefix=None
     )
-    AWS_S3_SECRET_ACCESS_KEY = values.Value(
+    AWS_S3_SECRET_ACCESS_KEY = SecretFileValue(
         environ_name="AWS_S3_SECRET_ACCESS_KEY", environ_prefix=None
     )
     AWS_S3_REGION_NAME = values.Value(
@@ -160,10 +162,12 @@ class Base(Configuration):
         (
             ("en-us", _("English")),
             ("fr-fr", _("French")),
+            ("nl-nl", _("Dutch")),
+            ("de-de", _("German")),
         )
     )
 
-    LOCALE_PATHS = (os.path.join(BASE_DIR, "locale"),)
+    LOCALE_PATHS = (path.join(BASE_DIR, "locale"),)
 
     TIME_ZONE = "UTC"
     USE_I18N = True
@@ -173,7 +177,7 @@ class Base(Configuration):
     TEMPLATES = [
         {
             "BACKEND": "django.template.backends.django.DjangoTemplates",
-            "DIRS": [os.path.join(BASE_DIR, "templates")],
+            "DIRS": [path.join(BASE_DIR, "templates")],
             "OPTIONS": {
                 "context_processors": [
                     "django.contrib.auth.context_processors.auth",
@@ -261,6 +265,9 @@ class Base(Configuration):
             "rest_framework.parsers.JSONParser",
             "nested_multipart_parser.drf.DrfNestedParser",
         ],
+        "DEFAULT_RENDERER_CLASSES": [
+            "rest_framework.renderers.JSONRenderer",
+        ],
         "EXCEPTION_HANDLER": "core.api.exception_handler",
         "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
         "PAGE_SIZE": 20,
@@ -298,6 +305,11 @@ class Base(Configuration):
 
     # Frontend
     FRONTEND_CONFIGURATION = {
+        # If set, a <link> tag with this URL as href is added to the <head> of the frontend app.
+        # This is useful if you want to change CSS variables to customize the look of the app.
+        "custom_css_url": values.Value(
+            None, environ_name="FRONTEND_CUSTOM_CSS_URL", environ_prefix=None
+        ),
         "analytics": values.DictValue(
             {}, environ_name="FRONTEND_ANALYTICS", environ_prefix=None
         ),
@@ -307,13 +319,31 @@ class Base(Configuration):
         "silence_livekit_debug_logs": values.BooleanValue(
             False, environ_name="FRONTEND_SILENCE_LIVEKIT_DEBUG", environ_prefix=None
         ),
+        "is_silent_login_enabled": values.BooleanValue(
+            True, environ_name="FRONTEND_IS_SILENT_LOGIN_ENABLED", environ_prefix=None
+        ),
+        "feedback": values.DictValue(
+            {}, environ_name="FRONTEND_FEEDBACK", environ_prefix=None
+        ),
+        "use_french_gov_footer": values.BooleanValue(
+            False, environ_name="FRONTEND_USE_FRENCH_GOV_FOOTER", environ_prefix=None
+        ),
+        "use_proconnect_button": values.BooleanValue(
+            False, environ_name="FRONTEND_USE_PROCONNECT_BUTTON", environ_prefix=None
+        ),
+        "transcript": values.DictValue(
+            {}, environ_name="FRONTEND_TRANSCRIPT", environ_prefix=None
+        ),
+        "manifest_link": values.Value(
+            None, environ_name="FRONTEND_MANIFEST_LINK", environ_prefix=None
+        ),
     }
 
     # Mail
     EMAIL_BACKEND = values.Value("django.core.mail.backends.smtp.EmailBackend")
     EMAIL_HOST = values.Value(None)
     EMAIL_HOST_USER = values.Value(None)
-    EMAIL_HOST_PASSWORD = values.Value(None)
+    EMAIL_HOST_PASSWORD = SecretFileValue(None)
     EMAIL_PORT = values.PositiveIntegerValue(None)
     EMAIL_USE_TLS = values.BooleanValue(False)
     EMAIL_USE_SSL = values.BooleanValue(False)
@@ -321,12 +351,14 @@ class Base(Configuration):
     EMAIL_BRAND_NAME = values.Value(None)
     EMAIL_SUPPORT_EMAIL = values.Value(None)
     EMAIL_LOGO_IMG = values.Value(None)
+    EMAIL_DOMAIN = values.Value(None)
+    EMAIL_APP_BASE_URL = values.Value(None)
 
     AUTH_USER_MODEL = "core.User"
 
     # CORS
     CORS_ALLOW_CREDENTIALS = True
-    CORS_ALLOW_ALL_ORIGINS = values.BooleanValue(True)
+    CORS_ALLOW_ALL_ORIGINS = values.BooleanValue(False)
     CORS_ALLOWED_ORIGINS = values.ListValue([])
     CORS_ALLOWED_ORIGIN_REGEXES = values.ListValue([])
 
@@ -346,11 +378,13 @@ class Base(Configuration):
     # Session
     SESSION_ENGINE = "django.contrib.sessions.backends.cache"
     SESSION_CACHE_ALIAS = "default"
-    SESSION_COOKIE_AGE = 60 * 60 * 12
+    SESSION_COOKIE_AGE = values.PositiveIntegerValue(
+        default=60 * 60 * 12, environ_name="SESSION_COOKIE_AGE", environ_prefix=None
+    )
 
     # OIDC - Authorization Code Flow
-    OIDC_AUTHENTICATE_CLASS = "core.authentication.views.OIDCAuthenticationRequestView"
-    OIDC_CALLBACK_CLASS = "core.authentication.views.OIDCAuthenticationCallbackView"
+    OIDC_AUTHENTICATE_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationRequestView"
+    OIDC_CALLBACK_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationCallbackView"
     OIDC_CREATE_USER = values.BooleanValue(
         default=True, environ_name="OIDC_CREATE_USER", environ_prefix=None
     )
@@ -367,7 +401,7 @@ class Base(Configuration):
     OIDC_RP_CLIENT_ID = values.Value(
         "meet", environ_name="OIDC_RP_CLIENT_ID", environ_prefix=None
     )
-    OIDC_RP_CLIENT_SECRET = values.Value(
+    OIDC_RP_CLIENT_SECRET = SecretFileValue(
         None,
         environ_name="OIDC_RP_CLIENT_SECRET",
         environ_prefix=None,
@@ -384,6 +418,9 @@ class Base(Configuration):
     OIDC_OP_USER_ENDPOINT = values.Value(
         None, environ_name="OIDC_OP_USER_ENDPOINT", environ_prefix=None
     )
+    OIDC_OP_USER_ENDPOINT_FORMAT = values.Value(
+        "AUTO", environ_name="OIDC_OP_USER_ENDPOINT_FORMAT", environ_prefix=None
+    )
     OIDC_OP_LOGOUT_ENDPOINT = values.Value(
         None, environ_name="OIDC_OP_LOGOUT_ENDPOINT", environ_prefix=None
     )
@@ -430,15 +467,23 @@ class Base(Configuration):
         environ_name="OIDC_USERINFO_SHORTNAME_FIELD",
         environ_prefix=None,
     )
+    OIDC_USERINFO_ESSENTIAL_CLAIMS = values.ListValue(
+        default=[],
+        environ_name="OIDC_USERINFO_ESSENTIAL_CLAIMS",
+        environ_prefix=None,
+    )
 
     # Video conference configuration
     LIVEKIT_CONFIGURATION = {
-        "api_key": values.Value(environ_name="LIVEKIT_API_KEY", environ_prefix=None),
-        "api_secret": values.Value(
+        "api_key": SecretFileValue(environ_name="LIVEKIT_API_KEY", environ_prefix=None),
+        "api_secret": SecretFileValue(
             environ_name="LIVEKIT_API_SECRET", environ_prefix=None
         ),
         "url": values.Value(environ_name="LIVEKIT_API_URL", environ_prefix=None),
     }
+    LIVEKIT_VERIFY_SSL = values.BooleanValue(
+        True, environ_name="LIVEKIT_VERIFY_SSL", environ_prefix=None
+    )
     RESOURCE_DEFAULT_ACCESS_LEVEL = values.Value(
         "public", environ_name="RESOURCE_DEFAULT_ACCESS_LEVEL", environ_prefix=None
     )
@@ -453,9 +498,6 @@ class Base(Configuration):
     RECORDING_OUTPUT_FOLDER = values.Value(
         "recordings", environ_name="RECORDING_OUTPUT_FOLDER", environ_prefix=None
     )
-    RECORDING_VERIFY_SSL = values.BooleanValue(
-        True, environ_name="RECORDING_VERIFY_SSL", environ_prefix=None
-    )
     RECORDING_WORKER_CLASSES = values.DictValue(
         {
             "screen_recording": "core.recording.worker.services.VideoCompositeEgressService",
@@ -475,15 +517,23 @@ class Base(Configuration):
     RECORDING_STORAGE_EVENT_ENABLE = values.BooleanValue(
         False, environ_name="RECORDING_STORAGE_EVENT_ENABLE", environ_prefix=None
     )
-    RECORDING_STORAGE_EVENT_TOKEN = values.Value(
+    RECORDING_STORAGE_EVENT_TOKEN = SecretFileValue(
         None, environ_name="RECORDING_STORAGE_EVENT_TOKEN", environ_prefix=None
     )
+    # Number of days before recordings expire - must be synced with bucket lifecycle policy
+    # Set to None for no expiration
+    RECORDING_EXPIRATION_DAYS = values.IntegerValue(
+        None, environ_name="RECORDING_EXPIRATION_DAYS", environ_prefix=None
+    )
     SUMMARY_SERVICE_ENDPOINT = values.Value(
         None, environ_name="SUMMARY_SERVICE_ENDPOINT", environ_prefix=None
     )
-    SUMMARY_SERVICE_API_TOKEN = values.Value(
+    SUMMARY_SERVICE_API_TOKEN = SecretFileValue(
         None, environ_name="SUMMARY_SERVICE_API_TOKEN", environ_prefix=None
     )
+    SCREEN_RECORDING_BASE_URL = values.Value(
+        None, environ_name="SCREEN_RECORDING_BASE_URL", environ_prefix=None
+    )
 
     # Marketing and communication settings
     SIGNUP_NEW_USER_TO_MARKETING_EMAIL = values.BooleanValue(
@@ -496,7 +546,7 @@ class Base(Configuration):
         environ_name="MARKETING_SERVICE_CLASS",
         environ_prefix=None,
     )
-    BREVO_API_KEY = values.Value(
+    BREVO_API_KEY = SecretFileValue(
         None, environ_name="BREVO_API_KEY", environ_prefix=None
     )
     BREVO_API_CONTACT_LIST_IDS = values.ListValue(
@@ -543,6 +593,33 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    # SIP Telephony
+    ROOM_TELEPHONY_ENABLED = values.BooleanValue(
+        False,
+        environ_name="ROOM_TELEPHONY_ENABLED",
+        environ_prefix=None,
+    )
+    ROOM_TELEPHONY_PIN_LENGTH = values.PositiveIntegerValue(
+        10,
+        environ_name="ROOM_TELEPHONY_PIN_LENGTH",
+        environ_prefix=None,
+    )
+    ROOM_TELEPHONY_PIN_MAX_RETRIES = values.PositiveIntegerValue(
+        5,
+        environ_name="ROOM_TELEPHONY_PIN_MAX_RETRIES",
+        environ_prefix=None,
+    )
+    ROOM_TELEPHONY_PHONE_NUMBER = values.Value(
+        None,
+        environ_name="ROOM_TELEPHONY_PHONE_NUMBER",
+        environ_prefix=None,
+    )
+    ROOM_TELEPHONY_DEFAULT_COUNTRY = values.Value(
+        "US",
+        environ_name="ROOM_TELEPHONY_DEFAULT_COUNTRY",
+        environ_prefix=None,
+    )
+
     # pylint: disable=invalid-name
     @property
     def ENVIRONMENT(self):
@@ -589,10 +666,7 @@ class Base(Configuration):
                 release=get_release(),
                 integrations=[DjangoIntegration()],
             )
-
-            # Add the application name to the Sentry scope
-            scope = sentry_sdk.get_global_scope()
-            scope.set_tag("application", "backend")
+            sentry_sdk.set_tag("application", "backend")
 
             # Ignore the logs added by the DockerflowMiddleware
             ignore_logger("request.summary")
@@ -756,6 +830,14 @@ class Staging(Production):
     """
 
 
+class Sandbox(Production):
+    """
+    Sandbox environment settings
+
+    nota bene: it should inherit from the Production environment.
+    """
+
+
 class PreProduction(Production):
     """
     Pre-production environment settings

src/backend/meet/wsgi.py

@@ -7,11 +7,11 @@ For more information on this file, see
 https://docs.djangoproject.com/en/3.1/howto/deployment/wsgi/
 """
 
-import os
+from os import environ
 
 from configurations.wsgi import get_wsgi_application
 
-os.environ.setdefault("DJANGO_SETTINGS_MODULE", "meet.settings")
-os.environ.setdefault("DJANGO_CONFIGURATION", "Development")
+environ.setdefault("DJANGO_SETTINGS_MODULE", "meet.settings")
+environ.setdefault("DJANGO_CONFIGURATION", "Development")
 
 application = get_wsgi_application()

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meet"
-version = "0.1.17"
+version = "0.1.28"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -25,39 +25,38 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "boto3==1.37.18",
+    "boto3==1.38.42",
     "Brotli==1.1.0",
     "brevo-python==1.1.2",
-    "celery[redis]==5.4.0",
+    "celery[redis]==5.5.3",
     "django-configurations==2.5.1",
     "django-cors-headers==4.7.0",
     "django-countries==7.6.1",
+    "django-lasuite[all]==0.0.10",
     "django-parler==2.3",
     "redis==5.2.1",
-    "django-redis==5.4.0",
-    "django-storages[s3]==1.14.5",
+    "django-redis==6.0.0",
+    "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
-    "django==5.1.8",
-    "djangorestframework==3.15.2",
+    "django==5.2.3",
+    "djangorestframework==3.16.0",
     "drf_spectacular==0.28.0",
     "dockerflow==2024.4.2",
     "easy_thumbnails==2.10",
     "factory_boy==3.3.3",
     "gunicorn==23.0.0",
-    "jsonschema==4.23.0",
-    "june-analytics-python==2.3.0",
-    "markdown==3.7",
+    "jsonschema==4.24.0",
+    "markdown==3.8.2",
     "nested-multipart-parser==1.5.0",
-    "psycopg[binary]==3.2.6",
+    "psycopg[binary]==3.2.9",
     "PyJWT==2.10.1",
     "python-frontmatter==1.1.0",
-    "requests==2.32.3",
-    "sentry-sdk==2.24.1",
-    "url-normalize==1.4.3",
+    "requests==2.32.4",
+    "sentry-sdk==2.30.0",
     "whitenoise==6.9.0",
     "mozilla-django-oidc==4.0.1",
-    "livekit-api==0.8.2",
-    "aiohttp==3.11.14",
+    "livekit-api==1.0.3",
+    "aiohttp==3.12.13",
 ]
 
 [project.urls]
@@ -68,22 +67,22 @@ dependencies = [
 
 [project.optional-dependencies]
 dev = [
-    "django-extensions==3.2.3",
-    "drf-spectacular-sidecar==2025.3.1",
-    "freezegun==1.5.1",
+    "django-extensions==4.1",
+    "drf-spectacular-sidecar==2025.6.1",
+    "freezegun==1.5.2",
     "ipdb==0.13.13",
-    "ipython==9.0.2",
-    "pyfakefs==5.8.0",
+    "ipython==9.3.0",
+    "pyfakefs==5.9.1",
     "pylint-django==2.6.1",
-    "pylint==3.3.6",
-    "pytest-cov==6.0.0",
-    "pytest-django==4.10.0",
-    "pytest==8.3.5",
+    "pylint==3.3.7",
+    "pytest-cov==6.2.1",
+    "pytest-django==4.11.1",
+    "pytest==8.4.1",
     "pytest-icdiff==0.9",
-    "pytest-xdist==3.6.1",
+    "pytest-xdist==3.7.0",
     "responses==0.25.7",
-    "ruff==0.11.2",
-    "types-requests==2.32.0.20250306",
+    "ruff==0.12.0",
+    "types-requests==2.32.4.20250611",
 ]
 
 [tool.setuptools]

src/frontend/.env.development

@@ -1 +1,2 @@
 VITE_API_BASE_URL=http://localhost:8071/
+VITE_APP_TITLE=LaSuite Meet

src/frontend/.env.production

@@ -0,0 +1 @@
+VITE_APP_TITLE=LaSuite Meet

src/frontend/Dockerfile

@@ -35,7 +35,7 @@ ENV VITE_API_BASE_URL=${VITE_API_BASE_URL}
 RUN npm run build
 
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.26-alpine AS frontend-production
+FROM nginxinc/nginx-unprivileged:alpine3.21 AS frontend-production
 
 USER root
 RUN apk update && apk upgrade libssl3 libcrypto3 libxml2>=2.12.7-r2 libxslt>=1.1.39-r2

src/frontend/default.conf

@@ -1,6 +1,7 @@
 server {
   listen 8080;
   server_name localhost;
+  server_tokens off;
 
   root /usr/share/nginx/html;
 

src/frontend/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/assets/icon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Visio</title>
+    <title>%VITE_APP_TITLE%</title>
   </head>
   <body>
     <div id="root"></div>

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "0.1.17",
+  "version": "0.1.28",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
@@ -13,48 +13,50 @@
     "check": "prettier --check ./src"
   },
   "dependencies": {
-    "@livekit/components-react": "2.8.1",
-    "@livekit/components-styles": "1.1.4",
-    "@livekit/track-processors": "0.3.3",
-    "@pandacss/preset-panda": "0.53.3",
-    "@react-aria/toast": "3.0.1",
+    "@livekit/components-react": "2.9.13",
+    "@livekit/components-styles": "1.1.6",
+    "@livekit/track-processors": "0.5.7",
+    "@pandacss/preset-panda": "0.54.0",
+    "@react-aria/toast": "3.0.5",
     "@remixicon/react": "4.6.0",
-    "@tanstack/react-query": "5.69.0",
+    "@tanstack/react-query": "5.81.5",
+    "@timephy/rnnoise-wasm": "1.0.0",
     "crisp-sdk-web": "1.0.25",
     "hoofd": "1.7.3",
-    "i18next": "24.2.3",
-    "i18next-browser-languagedetector": "8.0.4",
+    "i18next": "25.3.1",
+    "i18next-browser-languagedetector": "8.2.0",
     "i18next-parser": "9.3.0",
     "i18next-resources-to-backend": "1.2.1",
-    "livekit-client": "2.9.8",
-    "posthog-js": "1.232.6",
+    "livekit-client": "2.15.2",
+    "posthog-js": "1.256.2",
+    "libphonenumber-js": "1.12.9",
     "react": "18.3.1",
-    "react-aria-components": "1.7.1",
+    "react-aria-components": "1.10.1",
     "react-dom": "18.3.1",
     "react-i18next": "15.1.1",
     "use-sound": "5.0.0",
-    "valtio": "2.1.4",
-    "wouter": "3.6.0"
+    "valtio": "2.1.5",
+    "wouter": "3.7.1"
   },
   "devDependencies": {
-    "@pandacss/dev": "0.53.3",
-    "@tanstack/eslint-plugin-query": "5.68.0",
-    "@tanstack/react-query-devtools": "5.69.0",
-    "@types/node": "22.13.13",
+    "@pandacss/dev": "0.54.0",
+    "@tanstack/eslint-plugin-query": "5.81.2",
+    "@tanstack/react-query-devtools": "5.81.5",
+    "@types/node": "22.16.0",
     "@types/react": "18.3.12",
     "@types/react-dom": "18.3.1",
-    "@typescript-eslint/eslint-plugin": "8.28.0",
-    "@typescript-eslint/parser": "8.28.0",
-    "@vitejs/plugin-react": "4.3.4",
+    "@typescript-eslint/eslint-plugin": "8.35.1",
+    "@typescript-eslint/parser": "8.35.1",
+    "@vitejs/plugin-react": "4.6.0",
     "eslint": "8.57.0",
-    "eslint-config-prettier": "10.1.1",
+    "eslint-config-prettier": "10.1.5",
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-react-hooks": "5.2.0",
-    "eslint-plugin-react-refresh": "0.4.19",
-    "postcss": "8.5.3",
-    "prettier": "3.5.3",
-    "typescript": "5.8.2",
-    "vite": "6.2.4",
+    "eslint-plugin-react-refresh": "0.4.20",
+    "postcss": "8.5.6",
+    "prettier": "3.6.2",
+    "typescript": "5.8.3",
+    "vite": "7.0.2",
     "vite-tsconfig-paths": "5.1.4"
   }
 }

src/frontend/panda.config.ts

@@ -190,9 +190,6 @@ const config: Config = {
       fonts: {
         sans: {
           value: [
-            'Marianne',
-            'Source Sans',
-            'Source Sans fallback',
             'ui-sans-serif',
             'system-ui',
             '-apple-system',
@@ -318,6 +315,10 @@ const config: Config = {
           'subtle-text': { value: '{colors.red.700}' },
           ...pandaPreset.theme.tokens.colors.red,
         },
+        alert: {
+          DEFAULT: { value: '{colors.blue.700}' },
+          notification: { value: '{colors.red.600}' },
+        },
         success: {
           DEFAULT: { value: '{colors.green.700}' },
           hover: { value: '{colors.green.800}' },
@@ -397,6 +398,12 @@ const config: Config = {
           lineHeight: '1.25rem',
         },
       },
+      xs: {
+        value: {
+          fontSize: '0.825rem',
+          lineHeight: '1.15rem',
+        },
+      },
       badge: {
         value: {
           fontSize: '0.75rem',