🔒️(oidc) disable OIDC authentication on API

Our authentication flow uses the Django authentication which creates a
session for the User. Then the session is used to make API calls,
therefore we don't need to accept OIDC tokens directly on the API.

Accepting the OIDC token on the API can allow to bypass the "resource
server mode" which allows to restrict provided information according to
the Service Provider which makes the request.

bin/Tiltfile

@@ -49,7 +49,7 @@ clean_old_images('localhost:5001/meet-summary')
 # This is necessary because we need to inject the certificate into our LiveKit container
 local_resource(
     'copy-root-ca',
-    cmd='cp "$(mkcert -CAROOT)/rootCA.pem" ../docker/livekit/rootCA.pem',
+    cmd='cp -f "$(mkcert -CAROOT)/rootCA.pem" ../docker/livekit/rootCA.pem',
     deps=[],  # No dependencies needed
 )
 # Build a custom LiveKit Docker image that includes our root CA certificate

docs/installation.md

@@ -2,7 +2,7 @@
 
 This document is a step-by-step guide that describes how to install Visio on a k8s cluster without AI features.
 
-## Prerequisites
+## Prerequisites for a kubernetes setup
 
 - k8s cluster with an nginx-ingress controller
 - an OIDC provider (if you don't have one, we will provide an example)
@@ -12,14 +12,25 @@ This document is a step-by-step guide that describes how to install Visio on a k
 
 ### Test cluster
 
-If you do not have a test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script **bin/start-kind.sh**.
+If you do not have a kubernetes test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script located in this repo under **bin/start-kind.sh**.
 
-To be able to use the script, you will need to install:
+IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed. 
+
+To be able to use the script, you will need to install the following components:
 
 - Docker (https://docs.docker.com/desktop/)
 - Kind (https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
 - Mkcert (https://github.com/FiloSottile/mkcert#installation)
 - Helm (https://helm.sh/docs/intro/quickstart/#install-helm)
+- kubectl (https://kubernetes.io/docs/tasks/tools/)
+
+In order to initiate the local kind installation via **start-kind.sh** do the following:
+1) Make sure administrator/root user context is able to execute mkcert, docker, kind etc. commands or the script might fail
+2) Download the script to the device where the above components are installed
+3) Make the script executable
+4) Run the script with proper permissions (administrator/sudo etc.)
+
+The output of the script will resemble the below example:
 
 ```
 $ ./bin/start-kind.sh
@@ -99,7 +110,7 @@ When your k8s cluster is ready, you can start the deployment. This cluster is sp
 
 Please remember that \*.127.0.0.1.nip.io will always resolve to 127.0.0.1, except in the k8s cluster where we configure CoreDNS to answer with the ingress-nginx service IP.
 
-## Preparation
+## Preparation of components
 
 ### What will you use to authenticate your users ?
 
@@ -111,7 +122,7 @@ If you haven't run the script **bin/start-kind.sh**, you'll need to manually cre
 $ kubectl create namespace meet
 ```
 
-If you have already run the script, you can skip this step and proceed to the next instruction.
+If you have already run the script, you can skip this step and proceed to the next instruction. NOTE: Before you proceed, and is using the kind method, make sure you download this repo examples/ directory and its contents to the location where you will be executing the helm command. Helm will look for "examples/<name>values.yaml" from based on the path it is being executed.
 
 ```
 $ kubectl config set-context --current --namespace=meet
@@ -232,7 +243,7 @@ meet                     <none>   meet.127.0.0.1.nip.io       localhost   80, 44
 meet-admin               <none>   meet.127.0.0.1.nip.io       localhost   80, 443   52m
 ```
 
-You can use Visio on https://meet.127.0.0.1.nip.io. The provisioning user in keycloak is meet/meet.
+You can use Visio on https://meet.127.0.0.1.nip.io from the local device. The provisioning user in keycloak is meet/meet.
 
 ## All options
 

env.d/development/common.dist

@@ -54,3 +54,6 @@ ALLOW_UNREGISTERED_ROOMS=False
 
 # Recording
 SCREEN_RECORDING_BASE_URL=http://localhost:3000/recordings
+
+# Telephony
+ROOM_TELEPHONY_ENABLED=True

src/backend/core/migrations/0014_room_pin_code.py

@@ -0,0 +1,45 @@
+# Generated by Django 5.1.9 on 2025-05-13 08:22
+
+import secrets
+from django.db import migrations, models
+
+
+def generate_pin_for_rooms(apps, schema_editor):
+    """Generate unique 10-digit PIN codes for existing rooms.
+    The PIN code is required for SIP telephony features.
+    """
+    Room = apps.get_model('core', 'Room')
+    rooms_without_pin_code = Room.objects.filter(pin_code__isnull=True)
+    existing_pins = set(Room.objects.values_list('pin_code', flat=True))
+
+    length = 10
+
+    def generate_pin_code():
+        while True:
+            pin_code = str(secrets.randbelow(10 ** length)).zfill(length)
+            if not pin_code in existing_pins:
+                return pin_code
+
+    for room in rooms_without_pin_code:
+        room.pin_code = generate_pin_code()
+        room.save()
+
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0013_alter_user_language'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='room',
+            name='pin_code',
+            field=models.CharField(blank=True, help_text='Unique n-digit code that identifies this room in telephony mode.', max_length=None, null=True, unique=True, verbose_name='Room PIN code'),
+        ),
+        migrations.RunPython(
+            generate_pin_for_rooms,
+            reverse_code=migrations.RunPython.noop
+        ),
+    ]

src/backend/core/models.py

@@ -2,6 +2,7 @@
 Declare and configure the models for the Meet core application
 """
 
+import secrets
 import uuid
 from datetime import datetime, timedelta
 from logging import getLogger
@@ -14,7 +15,6 @@ from django.core import mail, validators
 from django.core.exceptions import PermissionDenied, ValidationError
 from django.db import models
 from django.utils import timezone
-from django.utils.functional import lazy
 from django.utils.text import capfirst, slugify
 from django.utils.translation import gettext_lazy as _
 
@@ -164,7 +164,7 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
     )
     language = models.CharField(
         max_length=10,
-        choices=lazy(lambda: settings.LANGUAGES, tuple)(),
+        choices=settings.LANGUAGES,
         default=settings.LANGUAGE_CODE,
         verbose_name=_("language"),
         help_text=_("The language in which the user wants to see the interface."),
@@ -383,6 +383,14 @@ class Room(Resource):
         verbose_name=_("Visio room configuration"),
         help_text=_("Values for Visio parameters to configure the room."),
     )
+    pin_code = models.CharField(
+        max_length=None,
+        unique=True,
+        blank=True,
+        null=True,
+        verbose_name=_("Room PIN code"),
+        help_text=_("Unique n-digit code that identifies this room in telephony mode."),
+    )
 
     class Meta:
         db_table = "meet_room"
@@ -393,6 +401,14 @@ class Room(Resource):
     def __str__(self):
         return capfirst(self.name)
 
+    def save(self, *args, **kwargs):
+        """Generate a unique n-digit pin code for new rooms."""
+        if settings.ROOM_TELEPHONY_ENABLED and not self.pk and not self.pin_code:
+            self.pin_code = self.generate_unique_pin_code(
+                length=settings.ROOM_TELEPHONY_PIN_LENGTH
+            )
+        super().save(*args, **kwargs)
+
     def clean_fields(self, exclude=None):
         """
         Automatically generate the slug from the name and make sure it does not look like a UUID.
@@ -407,6 +423,7 @@ class Room(Resource):
             pass
         else:
             raise ValidationError({"name": f'Room name "{self.name:s}" is reserved.'})
+
         super().clean_fields(exclude=exclude)
 
     @property
@@ -414,6 +431,31 @@ class Room(Resource):
         """Check if a room is public"""
         return self.access_level == RoomAccessLevel.PUBLIC
 
+    @staticmethod
+    def generate_unique_pin_code(length):
+        """Generate a unique n-digit PIN code"""
+
+        if length < 4:
+            raise ValueError(
+                "PIN code length must be at least 4 digits for minimal security"
+            )
+
+        max_value = 10**length
+
+        for _ in range(settings.ROOM_TELEPHONY_PIN_MAX_RETRIES):
+            pin_code = str(secrets.randbelow(max_value)).zfill(length)
+            if not Room.objects.filter(pin_code=pin_code).exists():
+                return pin_code
+
+        # Log a warning as a temporary measure until backend observability is implemented.
+        logger.warning(
+            "Failed to generate unique PIN code of length %s after %s attempts",
+            length,
+            settings.ROOM_TELEPHONY_PIN_MAX_RETRIES,
+        )
+
+        return None
+
 
 class BaseAccessManager(models.Manager):
     """Base manager for handling resource access control."""

src/backend/core/tests/test_models_rooms.py

@@ -2,6 +2,12 @@
 Unit tests for the Room model
 """
 
+# pylint: disable=W0613
+
+import secrets
+from logging import Logger
+from unittest import mock
+
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ValidationError
 
@@ -175,3 +181,169 @@ def test_models_rooms_is_public_property():
     # Test non-public room
     private_room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     assert private_room.is_public is False
+
+
+@mock.patch.object(Room, "generate_unique_pin_code")
+def test_telephony_disabled_skips_pin_generation(
+    mock_generate_unique_pin_code, settings
+):
+    """Telephony disabled should not generate pin codes."""
+
+    settings.ROOM_TELEPHONY_ENABLED = False
+
+    room = RoomFactory()
+
+    mock_generate_unique_pin_code.assert_not_called()
+    assert room.pin_code is None
+
+
+def test_default_and_custom_pin_length(settings):
+    """Pin codes should be created with correct configured length."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+
+    room = RoomFactory()
+
+    # Assert default value is 10 for collision reasons
+    assert len(room.pin_code) == 10
+
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    room = RoomFactory()
+
+    # Assert custom size
+    assert len(room.pin_code) == 5
+
+
+def test_room_updates_preserve_pin_code(settings):
+    """Room updates should preserve existing pin code."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+
+    room = RoomFactory()
+
+    # Store the original pin code to compare after updates
+    previous_pin_code = room.pin_code
+
+    # If this method is called, it would indicate the pin is being regenerated unnecessarily
+    with mock.patch.object(
+        Room, "generate_unique_pin_code"
+    ) as mock_generate_unique_pin_code:
+        # Explicitly call save to persist the changes to the room
+        room.slug = "aaa-aaaa-aaa"
+        room.save()
+        assert room.pin_code == previous_pin_code
+        mock_generate_unique_pin_code.assert_not_called()
+
+
+@pytest.mark.parametrize("is_telephony_enabled", [True, False])
+def test_manual_pin_code_updates(is_telephony_enabled, settings):
+    """Manual pin code changes should persist regardless of telephony setting."""
+
+    settings.ROOM_TELEPHONY_ENABLED = is_telephony_enabled
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    room = RoomFactory()
+    assert room.pin_code != "12345"
+
+    room.pin_code = "12345"
+    room.save()
+
+    assert room.pin_code == "12345"
+
+    # No data validation when manual updates are made
+    room.pin_code = "123"
+    room.save()
+
+    assert room.pin_code == "123"
+
+
+def test_pin_code_uniqueness(settings):
+    """Duplicate pin codes should raise validation error."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    RoomFactory(pin_code="12345")
+
+    with pytest.raises(ValidationError) as excinfo:
+        RoomFactory(pin_code="12345")
+
+    assert "Room with this Room PIN code already exists." in str(excinfo.value)
+
+
+@pytest.mark.parametrize("invalid_length", [0, 1, 2, 3])
+def test_pin_code_minimum_length(invalid_length, settings):
+    """Pin codes should enforce minimum length for security."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 4
+
+    # Assert no exception is raised with a valid length
+    RoomFactory()
+
+    settings.ROOM_TELEPHONY_PIN_LENGTH = invalid_length
+
+    with pytest.raises(ValueError) as excinfo:
+        RoomFactory()
+
+    assert "PIN code length must be at least 4 digits for minimal security" in str(
+        excinfo.value
+    )
+
+
+@mock.patch.object(Logger, "warning")
+@mock.patch.object(secrets, "randbelow", return_value=12345)
+def test_pin_generation_max_retries(mock_randbelow, mock_logger, settings):
+    """Pin generation should give up after max retries."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 5
+
+    RoomFactory(pin_code="12345")
+
+    # Assert default max retries is low, 5
+    room1 = RoomFactory()
+    assert mock_randbelow.call_count == 5
+    assert room1.pin_code is None
+
+    mock_logger.assert_called_once_with(
+        "Failed to generate unique PIN code of length %s after %s attempts", 5, 5
+    )
+
+    mock_logger.reset_mock()
+    mock_randbelow.reset_mock()
+    settings.ROOM_TELEPHONY_PIN_MAX_RETRIES = 3
+
+    room2 = RoomFactory()
+    assert mock_randbelow.call_count == 3
+    assert room2.pin_code is None
+
+    mock_logger.assert_called_once_with(
+        "Failed to generate unique PIN code of length %s after %s attempts", 5, 3
+    )
+
+
+@mock.patch.object(secrets, "randbelow", return_value=12345)
+def test_pin_code_zero_padding(mock_randbelow, settings):
+    """Pin codes should be zero-padded to meet required length."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PIN_LENGTH = 10
+
+    room = RoomFactory()
+    assert room.pin_code == "0000012345"
+
+
+@mock.patch.object(secrets, "randbelow", return_value=12345)
+def test_pin_generation_upper_bound(mock_randbelow, settings):
+    """Random number generator should use correct upper bound based on pin length."""
+
+    settings.ROOM_TELEPHONY_ENABLED = False
+
+    room = RoomFactory()
+
+    room.generate_unique_pin_code(length=5)
+
+    # Assert called with the right exclusive upper bound, 10^5
+    mock_randbelow.assert_called_with(100000)

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-05-13 13:54+0000\n"
+"POT-Creation-Date: 2025-05-16 17:04+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -237,19 +237,27 @@ msgstr "Visio-Raumkonfiguration"
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
 
-#: core/models.py:390 core/models.py:510
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "PIN-Code für den Raum"
+
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
+
+#: core/models.py:398 core/models.py:552
 msgid "Room"
 msgstr "Raum"
 
-#: core/models.py:391
+#: core/models.py:399
 msgid "Rooms"
 msgstr "Räume"
 
-#: core/models.py:521
+#: core/models.py:563
 msgid "Worker ID"
 msgstr "Worker-ID"
 
-#: core/models.py:523
+#: core/models.py:565
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -258,39 +266,39 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."
 
-#: core/models.py:531
+#: core/models.py:573
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"
 
-#: core/models.py:532
+#: core/models.py:574
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
 
-#: core/models.py:538
+#: core/models.py:580
 msgid "Recording"
 msgstr "Aufzeichnung"
 
-#: core/models.py:539
+#: core/models.py:581
 msgid "Recordings"
 msgstr "Aufzeichnungen"
 
-#: core/models.py:647
+#: core/models.py:689
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"
 
-#: core/models.py:648
+#: core/models.py:690
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"
 
-#: core/models.py:654
+#: core/models.py:696
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:660
+#: core/models.py:702
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:666
+#: core/models.py:708
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
 

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-05-13 13:54+0000\n"
+"POT-Creation-Date: 2025-05-16 17:04+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -233,19 +233,27 @@ msgstr "Visio room configuration"
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:390 core/models.py:510
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "Room PIN code"
+
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Unique n-digit code that identifies this room in telephony mode."
+
+#: core/models.py:398 core/models.py:552
 msgid "Room"
 msgstr "Room"
 
-#: core/models.py:391
+#: core/models.py:399
 msgid "Rooms"
 msgstr "Rooms"
 
-#: core/models.py:521
+#: core/models.py:563
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:523
+#: core/models.py:565
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -253,39 +261,39 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 
-#: core/models.py:531
+#: core/models.py:573
 msgid "Recording mode"
 msgstr "Recording mode"
 
-#: core/models.py:532
+#: core/models.py:574
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."
 
-#: core/models.py:538
+#: core/models.py:580
 msgid "Recording"
 msgstr "Recording"
 
-#: core/models.py:539
+#: core/models.py:581
 msgid "Recordings"
 msgstr "Recordings"
 
-#: core/models.py:647
+#: core/models.py:689
 msgid "Recording/user relation"
 msgstr "Recording/user relation"
 
-#: core/models.py:648
+#: core/models.py:690
 msgid "Recording/user relations"
 msgstr "Recording/user relations"
 
-#: core/models.py:654
+#: core/models.py:696
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."
 
-#: core/models.py:660
+#: core/models.py:702
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."
 
-#: core/models.py:666
+#: core/models.py:708
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."
 

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-05-13 13:54+0000\n"
+"POT-Creation-Date: 2025-05-16 17:04+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -130,12 +130,12 @@ msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
 msgstr ""
-"Entrez un identifiant valide. Cette valeur ne peut contenir que des lettres, "
+"Entrez un sub valide. Cette valeur ne peut contenir que des lettres, "
 "des chiffres et les caractères @/./+/-/_."
 
 #: core/models.py:144
 msgid "sub"
-msgstr "identifiant"
+msgstr "sub"
 
 #: core/models.py:146
 msgid ""
@@ -238,60 +238,68 @@ msgstr "Configuration de la salle de visioconférence"
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
 
-#: core/models.py:390 core/models.py:510
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "Code PIN de la salle"
+
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
+
+#: core/models.py:398 core/models.py:552
 msgid "Room"
 msgstr "Salle"
 
-#: core/models.py:391
+#: core/models.py:399
 msgid "Rooms"
 msgstr "Salles"
 
-#: core/models.py:521
+#: core/models.py:563
 msgid "Worker ID"
 msgstr "ID du Worker"
 
-#: core/models.py:523
+#: core/models.py:565
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 msgstr ""
-"Entrez un identifiant pour l'enregistrement du travailleur. Cet identifiant "
-"est conservé même lorsque le travailleur s'arrête, permettant un suivi "
+"Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant "
+"est conservé même lorsque le Worker s'arrête, permettant un suivi "
 "facile."
 
-#: core/models.py:531
+#: core/models.py:573
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"
 
-#: core/models.py:532
+#: core/models.py:574
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:538
+#: core/models.py:580
 msgid "Recording"
 msgstr "Enregistrement"
 
-#: core/models.py:539
+#: core/models.py:581
 msgid "Recordings"
 msgstr "Enregistrements"
 
-#: core/models.py:647
+#: core/models.py:689
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:648
+#: core/models.py:690
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:654
+#: core/models.py:696
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."
 
-#: core/models.py:660
+#: core/models.py:702
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."
 
-#: core/models.py:666
+#: core/models.py:708
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-05-13 13:54+0000\n"
+"POT-Creation-Date: 2025-05-16 17:04+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -233,19 +233,27 @@ msgstr "Visio-ruimteconfiguratie"
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
 
-#: core/models.py:390 core/models.py:510
+#: core/models.py:391
+msgid "Room PIN code"
+msgstr "Pincode van de kamer"
+
+#: core/models.py:392
+msgid "Unique n-digit code that identifies this room in telephony mode."
+msgstr "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
+
+#: core/models.py:398 core/models.py:552
 msgid "Room"
 msgstr "Ruimte"
 
-#: core/models.py:391
+#: core/models.py:399
 msgid "Rooms"
 msgstr "Ruimtes"
 
-#: core/models.py:521
+#: core/models.py:563
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:523
+#: core/models.py:565
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -253,39 +261,39 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
 
-#: core/models.py:531
+#: core/models.py:573
 msgid "Recording mode"
 msgstr "Opnamemodus"
 
-#: core/models.py:532
+#: core/models.py:574
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."
 
-#: core/models.py:538
+#: core/models.py:580
 msgid "Recording"
 msgstr "Opname"
 
-#: core/models.py:539
+#: core/models.py:581
 msgid "Recordings"
 msgstr "Opnames"
 
-#: core/models.py:647
+#: core/models.py:689
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"
 
-#: core/models.py:648
+#: core/models.py:690
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"
 
-#: core/models.py:654
+#: core/models.py:696
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."
 
-#: core/models.py:660
+#: core/models.py:702
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."
 
-#: core/models.py:666
+#: core/models.py:708
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
 

src/backend/meet/settings.py

@@ -257,7 +257,6 @@ class Base(Configuration):
 
     REST_FRAMEWORK = {
         "DEFAULT_AUTHENTICATION_CLASSES": (
-            "mozilla_django_oidc.contrib.drf.OIDCAuthentication",
             "rest_framework.authentication.SessionAuthentication",
         ),
         "DEFAULT_PARSER_CLASSES": [
@@ -360,7 +359,9 @@ class Base(Configuration):
     # Session
     SESSION_ENGINE = "django.contrib.sessions.backends.cache"
     SESSION_CACHE_ALIAS = "default"
-    SESSION_COOKIE_AGE = 60 * 60 * 12
+    SESSION_COOKIE_AGE = values.PositiveIntegerValue(
+        default=60 * 60 * 12, environ_name="SESSION_COOKIE_AGE", environ_prefix=None
+    )
 
     # OIDC - Authorization Code Flow
     OIDC_AUTHENTICATE_CLASS = "lasuite.oidc_login.views.OIDCAuthenticationRequestView"
@@ -573,6 +574,23 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    # SIP Telephony
+    ROOM_TELEPHONY_ENABLED = values.BooleanValue(
+        False,
+        environ_name="ROOM_TELEPHONY_ENABLED",
+        environ_prefix=None,
+    )
+    ROOM_TELEPHONY_PIN_LENGTH = values.PositiveIntegerValue(
+        10,
+        environ_name="ROOM_TELEPHONY_PIN_LENGTH",
+        environ_prefix=None,
+    )
+    ROOM_TELEPHONY_PIN_MAX_RETRIES = values.PositiveIntegerValue(
+        5,
+        environ_name="ROOM_TELEPHONY_PIN_MAX_RETRIES",
+        environ_prefix=None,
+    )
+
     # pylint: disable=invalid-name
     @property
     def ENVIRONMENT(self):

src/frontend/src/components/AppInitialization.tsx

@@ -2,9 +2,11 @@ import { silenceLiveKitLogs } from '@/utils/livekit'
 import { useConfig } from '@/api/useConfig'
 import { useAnalytics } from '@/features/analytics/hooks/useAnalytics'
 import { useSupport } from '@/features/support/hooks/useSupport'
+import { useSyncUserPreferencesWithBackend } from '@/features/auth'
 
 export const AppInitialization = () => {
   const { data } = useConfig()
+  useSyncUserPreferencesWithBackend()
 
   const {
     analytics = {},

src/frontend/src/features/rooms/livekit/components/controls/ReactionsToggle.tsx

@@ -23,6 +23,7 @@ export enum Emoji {
   LAUGHING = 'face-with-tears-of-joy',
   SURPRISED = 'face-with-open-mouth',
   CELEBRATION = 'party-popper',
+  PLEASE = 'folded-hands',
 }
 
 export interface Reaction {
@@ -121,7 +122,7 @@ export const ReactionsToggle = () => {
             className={css({
               position: 'absolute',
               top: -63,
-              left: -139,
+              left: -162,
               borderRadius: '8px',
               padding: '0.35rem',
               backgroundColor: 'primaryDark.50',

src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

@@ -67,6 +67,7 @@ backend:
     SUMMARY_SERVICE_ENDPOINT: http://meet-summary:80/api/v1/tasks/
     SUMMARY_SERVICE_API_TOKEN: password
     SCREEN_RECORDING_BASE_URL: https://meet.127.0.0.1.nip.io/recordings
+    ROOM_TELEPHONY_ENABLED: True
     SSL_CERT_FILE: /usr/local/lib/python3.12/site-packages/certifi/cacert.pem
 
 
@@ -148,7 +149,7 @@ summary:
     AWS_S3_SECRET_ACCESS_KEY: password
     OPENAI_API_KEY: password
     OPENAI_BASE_URL: https://albertine.beta.numerique.gouv.fr/v1
-    OPENAI_ASR_MODEL: openai/whisper-large-v3
+    OPENAI_ASR_MODEL: large-v2
     OPENAI_LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
     AWS_S3_SECURE_ACCESS: False
     WEBHOOK_API_TOKEN: password
@@ -181,7 +182,7 @@ celery:
     AWS_S3_SECRET_ACCESS_KEY: password
     OPENAI_API_KEY: password
     OPENAI_BASE_URL: https://albertine.beta.numerique.gouv.fr/v1
-    OPENAI_ASR_MODEL: openai/whisper-large-v3
+    OPENAI_ASR_MODEL: large-v2
     OPENAI_LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
     AWS_S3_SECURE_ACCESS: False
     WEBHOOK_API_TOKEN: password

src/helm/env.d/dev/values.meet.yaml.gotmpl

@@ -94,6 +94,7 @@ backend:
         name: backend
         key: BREVO_API_KEY
     BREVO_API_CONTACT_LIST_IDS: 8
+    ROOM_TELEPHONY_ENABLED: True
     SSL_CERT_FILE: /usr/local/lib/python3.12/site-packages/certifi/cacert.pem
 
 

src/helm/meet/Chart.yaml

@@ -1,4 +1,4 @@
 apiVersion: v2
 type: application
 name: meet
-version: 0.0.6
+version: 0.0.7

src/helm/meet/templates/ingress.yaml

@@ -60,7 +60,7 @@ spec:
               serviceName: {{ include "meet.frontend.fullname" . }}
               servicePort: {{ .Values.frontend.service.port }}
             {{- end }}
-          - path: /api
+          - path: /api/v
             {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
             pathType: Prefix
             {{- end }}
@@ -96,7 +96,7 @@ spec:
               serviceName: {{ include "meet.frontend.fullname" $ }}
               servicePort: {{ $.Values.frontend.service.port }}
             {{- end }}
-          - path: /api
+          - path: /api/v
             {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
             pathType: Prefix
             {{- end }}