🔒️(ci) disable Trivy scan pending clarification from Aqua Security

The Trivy GitHub repository was wiped over the weekend, raising suspicions of a potential supply chain attack. Temporarily disable the scan until the situation is clarified.
🔧(ci) introduce Claude security review GitHub Action
2026-03-02 11:09:46 +01:00 · 2026-03-02 11:09:46 +01:00 · 2026-02-27 22:49:03 +01:00 · 2026-02-27 19:39:55 +01:00 · 2026-02-27 19:39:55 +01:00 · 2026-02-27 19:39:55 +01:00
189 changed files with 9803 additions and 3556 deletions
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Download Crowdin files
        uses: crowdin/github-action@v2
@@ -23,7 +23,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -37,18 +43,19 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '--target backend-production -f Dockerfile'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        with:
+#          docker-build-args: '--target backend-production -f Dockerfile'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          target: backend-production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -59,7 +66,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -73,12 +86,12 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        with:
+#          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -86,6 +99,7 @@ jobs:
          context: .
          file: ./src/frontend/Dockerfile
          target: frontend-production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -96,7 +110,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -110,12 +130,12 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        with:
+#          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -123,6 +143,7 @@ jobs:
          context: .
          file: ./docker/dinum-frontend/Dockerfile
          target: frontend-production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -133,7 +154,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -147,6 +174,14 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        continue-on-error: true
+#        with:
+#          docker-build-args: '-f src/summary/Dockerfile --target production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+          docker-context: './src/summary'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -154,6 +189,7 @@ jobs:
          context: ./src/summary
          file: ./src/summary/Dockerfile
          target: production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -164,7 +200,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -178,6 +220,14 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        continue-on-error: true
+#        with:
+#          docker-build-args: '-f src/agents/Dockerfile --target production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+#          docker-context: './src/agents'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -185,6 +235,7 @@ jobs:
          context: ./src/agents
          file: ./src/agents/Dockerfile
          target: production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -7,14 +7,18 @@ on:
  pull_request:
    branches:
      - "*"
+permissions:
+  contents: read

 jobs:
  lint-git:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
+    permissions:
+      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: show
@@ -39,9 +43,11 @@ jobs:
    if: |
      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
      github.event_name == 'pull_request'
+    permissions:
+        contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -49,9 +55,11 @@ jobs:

  lint-changelog:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -62,20 +70,22 @@ jobs:

  build-mails:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: "18"

      - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -95,21 +105,23 @@ jobs:

      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}

  lint-back:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -124,14 +136,16 @@ jobs:

  lint-agents:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/agents
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -144,14 +158,16 @@ jobs:

  lint-summary:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/summary
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -165,7 +181,8 @@ jobs:
  test-back:
    runs-on: ubuntu-latest
    needs: build-mails
-
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/backend
@@ -216,7 +233,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Create writable /data
        run: |
@@ -224,7 +241,7 @@ jobs:
          sudo mkdir -p /data/static

      - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -258,7 +275,7 @@ jobs:
            mc mb meet/meet-media-storage"

      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -279,9 +296,11 @@ jobs:

  lint-front:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: cd src/frontend/ && npm ci
@@ -294,12 +313,14 @@ jobs:

  lint-sdk:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: npm ci
@@ -312,13 +333,15 @@ jobs:

  build-sdk:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    needs: lint-sdk
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: npm ci
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -0,0 +1,29 @@
+# /!\
+# Security Note: This action is not hardened against prompt injection attacks and should only be used
+# to review trusted PRs. Configure your repository with "Require approval for all external contributors"
+# to ensure workflows only run after a maintainer has reviewed the PR.
+name: Security Review
+
+permissions:
+  pull-requests: write  # Needed for leaving PR comments
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2
+
+      - uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
+        with:
+          comment-pr: true
+          exclude-directories: docs,gitlint,LICENSES,bin
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
@@ -8,19 +8,154 @@ and this project adheres to

 ## [Unreleased]

+### Added
+
+- 👷(docker) add arm64 platform support for image builds
+- ✨(summary) add localization support for transcription context text
+
+### Changed
+
+- ♻️(frontend) replace custom reactions toolbar with react aria popover #985
+- 🔒️(frontend) uninstall curl from the frontend production image #987
+- 💄(frontend) add focus ring to reaction emoji buttons
+- ✨(frontend) introduce a shortcut settings tab #975
+- 🚚(frontend) rename "wellknown" directory to "well-known" #1009
+- 🌐(frontend) localize SR modifier labels #1010
+- ⬆️(backend) update python dependencies #1011
+- ♿️(frontend) fix focus ring on tab container components #1012
+- ♿️(frontend) upgrade join meeting modal accessibility #1027
+- ⬆️(python) bump minimal required python version to 3.13 #1033
+- ♿️(frontend) improve accessibility of the IntroSlider carousel #1026
+- ♿️(frontend) add skip link component for keyboard navigation #1019
+
+### Fixed
+
+- 🩹(frontend) fix German language preference update #1021
+
+## [1.8.0] - 2026-02-20
+
+### Changed
+
+- 🔒️(agents) uninstall pip from the agents image
+- 🔒️(summary) switch to Alpine base image
+- 🔒️(backend) uninstall pip in the production image
+
+### Fixed
+
+- 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
+- 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
+
+## [1.7.0] - 2026-02-19
+
+### Added
+
+- ✨(frontend) expose Windows app web link #976
+- ✨(frontend) support additional shortcuts to broaden accessibility
+
+### Changed
+
+- ✨(frontend) add clickable settings general link in idle modal #974
+- ♻️(backend) refactor external API token-related items #1006
+
+## [1.6.0] - 2026-02-10
+
+### Added
+
+- ✨(backend) monitor throttling rate failure through sentry #964
+- 🚀(paas) add PaaS deployment scripts, tested on Scalingo #957
+
+### Changed
+
+- ♿️(frontend) improve spinner reduced‑motion fallback #931
+- ♿️(frontend) fix form labels and autocomplete wiring #932
+- 🥅(summary) catch file-related exceptions when handling recording #944
+- 📝(frontend) update legal terms #956
+- ⚡️(backend) enhance django admin's loading performance #954
+- 🌐(frontend) add missing DE translation for accessibility settings
+
+### Fixed
+
+- 🔐(backend) enforce object-level permission checks on room endpoint #959
+- 🔒️(backend) add application validation when consuming external JWT #963
+
+## [1.5.0] - 2026-01-28
+
+### Changed
+
+- ♿️(frontend) adjust visual-only tooltip a11y labels #910
+- ♿️(frontend) sr pin/unpin announcements with dedicated messages #898
+- ♿(frontend) adjust sr announcements for idle disconnect timer #908
+- ♿️(frontend) add global screen reader announcer#922
+
+### Fixed
+
+- 🔒️(frontend) fix an XSS vulnerability on the recording page #911
+
+## [1.4.0] - 2026-01-25
+
+### Added
+
+- ✨(frontend) add configurable redirect for unauthenticated users #904
+
+### Changed
+
+- ♿️(frontend) add accessible back button in side panel #881
+- ♿️(frontend) improve participants toggle a11y label #880
+- ♿️(frontend) make carousel image decorative #871
+- ♿️(frontend) reactions are now vocalized and configurable #849
+- ♿️(frontend) improve background effect announcements #879
+
+### Fixed
+
+- 🔒(backend) prevent automatic upgrade setuptools
+- ♿(frontend) improve contrast for selected options #863
+- ♿️(frontend) announce copy state in invite dialog #877
+- 📝(frontend) align close dialog label in rooms locale #878
+- 🩹(backend) use case-insensitive email matching in the external api #887
+- 🐛(frontend) ensure transcript segments are sorted by their timestamp #899
+- 🐛(frontend) scope scrollbar gutter override to video rooms #882
+
+## [1.3.0] - 2026-01-13
+
+### Added
+
+- ✨(summary) add dutch and german languages
+- 🔧(agents) make Silero VAD optional
+- 🚸(frontend) explain to a user they were ejected
+
+### Changed
+
+- 📈(frontend) track new recording's modes
+- ♿️(frontend) improve accessibility of the background and effects menu
+- ♿️(frontend) improve SR and focus for transcript and recording #810
+- 💄(frontend) adjust spacing in the recording side panels
+- 🚸(frontend) remove the default comma delimiter in humanized durations
+
+### Fixed
+
+- 🐛(frontend) remove unexpected F2 tooltip when clicking video screen
+- 🩹(frontend) icon font loading to avoid text/icon flickering
+
+## [1.2.0] - 2026-01-05
+
+### Added
+
 - ✨(agent) support Kyutai client for subtitle
- ✨(frontend) remove the beta badge
 - ✨(all) support starting transcription and recording simultaneously
 - ✨(backend) persist options on a recording
 - ✨(all) support choosing the transcription language
 - ✨(summary) add a download link to the audio/video file
 - ✨(frontend) allow unprivileged users to request a recording
+
+### Changed
+
+- 🚸(frontend) remove the beta badge
 - ♻️(summary) extract file handling in a robust service
 - ♻️(all) manage recording state on the backend side

 ## [1.1.0] - 2025-12-22

-### Added 
+### Added

 - ✨(backend) enable user creation via email for external integrations
 - ✨(summary) add Langfuse observability for LLM API calls
@@ -32,6 +167,6 @@ and this project adheres to
 - ♿(frontend) improve accessibility:
 - ♿️(frontend) hover controls, focus, SR #803
 - ♿️(frontend) change ptt keybinding from space to v #813
- ♿(frontend) indicate external link opens in new window on feedback #816 
+- ♿(frontend) indicate external link opens in new window on feedback #816
 - ♿(frontend) fix heading level in modal to maintain semantic hierarchy #815
 - ♿️(frontend) Improve focus management when opening and closing chat #807
@@ -4,7 +4,7 @@
 FROM python:3.13.5-alpine3.21 AS base

 # Upgrade pip to its latest release to speed up dependencies installation
-RUN python -m pip install --upgrade pip setuptools
+RUN python -m pip install --upgrade pip

 # Upgrade system packages to install security updates
 RUN apk update && \
@@ -127,6 +127,9 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py

+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
@@ -23,9 +23,10 @@
 # ==============================================================================
 # VARIABLES

-BOLD := \033[1m
-RESET := \033[0m
-GREEN := \033[1;32m
+ESC := $(shell printf '\033')
+BOLD := $(ESC)[1m
+RESET := $(ESC)[0m
+GREEN := $(ESC)[1;32m


 # -- Database
@@ -85,7 +86,8 @@ bootstrap: \
 	demo \
 	back-i18n-compile \
 	mails-install \
-	mails-build
+	mails-build \
+	run
 .PHONY: bootstrap

 # -- Docker/compose
@@ -0,0 +1,2 @@
+web: bin/buildpack_start.sh
+postdeploy: python manage.py migrate
@@ -50,6 +50,9 @@ La Suite Meet is fully self-hostable and released under the MIT License, ensurin

 We’re continuously adding new features to enhance your experience, with the latest updates coming soon!

+### 🚀 Major roll out to all French public servants
+
+On the 25th of January 2026, David Amiel, France’s Minister for Civil Service and State Reform, announced the full deployment of Visio—the French government’s dedicated Meet platform—to all public servants. ([Source in French](https://www.latribune.fr/article/la-tribune-dimanche/politique/73157688099661/david-amiel-ministre-delegue-de-la-fonction-publique-nous-allons-sortir-de-la-dependance-aux-outils-americains))

 ## Table of Contents

@@ -86,7 +89,7 @@ We hope to see many more, here is an incomplete list of public La Suite Meet ins
 | [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM    | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up|
 | [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT    | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up|
 | [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop    | Free and open demo to all. Content and accounts are reset after one month |
-| [meet.demo.mosacloud.eu](https://meet.demo.mosacloud.eu/)     | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |
+| [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |


 ## Contributing
@@ -18,6 +18,7 @@ docker_build(
    'localhost:5001/meet-backend:latest',
    context='..',
    dockerfile='../Dockerfile',
+    build_args={'DOCKER_USER': '1001:127'},
    only=['./src/backend', './src/mail', './docker'],
    target = 'backend-production',
    live_update=[
@@ -33,6 +34,7 @@ clean_old_images('localhost:5001/meet-backend')
 docker_build(
    'localhost:5001/meet-frontend-dinum:latest',
    context='..',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../docker/dinum-frontend/Dockerfile',
    only=['./src/frontend', './docker', './.dockerignore'],
    target = 'frontend-production',
@@ -57,6 +59,7 @@ clean_old_images('localhost:5001/meet-frontend-generic')
 docker_build(
    'localhost:5001/meet-summary:latest',
    context='../src/summary',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/summary/Dockerfile',
    only=['.'],
    target = 'production',
@@ -69,8 +72,9 @@ clean_old_images('localhost:5001/meet-summary')
 docker_build(
    'localhost:5001/meet-agents:latest',
    context='../src/agents',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/agents/Dockerfile',
-   only=['.'],
+    only=['.'],
    target = 'production',
    live_update=[
        sync('../src/agents', '/app'),
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -o errexit    # always exit on error
+set -o pipefail   # don't ignore exit codes when piping output
+
+echo "-----> Running post-compile script"
+
+# Cleanup
+rm -rf docker docs env.d gitlint
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -o errexit    # always exit on error
+set -o pipefail   # don't ignore exit codes when piping output
+
+echo "-----> Running post-frontend script"
+
+# Move the frontend build to the nginx root and clean up
+mkdir -p build/
+mv src/frontend/dist build/frontend-out
+
+ASSETS_DIR=build/frontend-out/assets
+if [ -n "$CUSTOM_LOGO_URL" ]; then
+    # Ensure https
+    [[ ! "$CUSTOM_LOGO_URL" =~ ^https:// ]] && echo "[custom-logo] ERROR: URL must use HTTPS" >&2 && exit 1
+
+    # Prevent SSRF
+    HOSTNAME=$(echo "$CUSTOM_LOGO_URL" | sed -E 's|^https://([^/:]+).*|\1|')
+    [[ "$HOSTNAME" =~ ^(localhost|127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|0\.0\.0\.0|\[::1\]) ]] && echo "[custom-logo] ERROR: SSRF blocked: $HOSTNAME" >&2 && exit 1
+
+    LOGO_FILE="${ASSETS_DIR}/logo.svg"
+    TMP_FILE=$(mktemp "${LOGO_FILE}.XXXXXX.tmp")
+
+    # Actual download
+    echo "[custom-logo] INFO: Downloading custom logo from: $CUSTOM_LOGO_URL"
+    curl -fsSL --tlsv1.2 -o "$TMP_FILE" "$CUSTOM_LOGO_URL"
+
+    # Validate filesize
+    FILESIZE=$(stat -c%s "$TMP_FILE" 2>/dev/null || stat -f%z "$TMP_FILE")
+    [[ "$FILESIZE" -eq 0 ]] && echo "[custom-logo] ERROR: empty file" >&2 && exit 1
+    [[ "$FILESIZE" -gt 5242880 ]] && echo "[custom-logo] ERROR: file too large (${FILESIZE}B > 5MB)" >&2 && exit 1
+
+    # Validate file type
+    IS_SVG=false
+
+    HEADER=$(head -c 100 "$TMP_FILE" | tr -d '\0' | tr '[:upper:]' '[:lower:]')
+    [[ "$HEADER" =~ ^.*"<svg".*$ ]] && IS_SVG=true
+    [[ "$HEADER" =~ ^.*"<?xml".*"<svg".*$ ]] && IS_SVG=true
+
+    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
+
+    mv -f "$TMP_FILE" "$LOGO_FILE"
+    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
+fi
+
+mv src/backend/* ./
+mv deploy/paas/* ./
+
+echo "3.13" > .python-version
+echo "." > requirements.txt
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Start the Django backend server
+gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
+
+# Start the Nginx server
+bin/run &
+
+# if the current shell is killed, also terminate all its children     
+trap "pkill SIGTERM -P $$" SIGTERM
+
+# wait for a single child to finish,
+wait -n
+# then kill all the other tasks
+pkill -P $$
@@ -235,7 +235,7 @@ services:
      - livekit-egress

  livekit-egress:
-      image: livekit/egress
+      image: livekit/egress:v1.11.0
      environment:
        EGRESS_CONFIG_FILE: ./livekit-egress.yaml
      volumes:
@@ -0,0 +1,52 @@
+# ERB templated nginx configuration
+# see https://doc.scalingo.com/platform/deployment/buildpacks/nginx
+
+upstream backend_server {
+	server localhost:8000 fail_timeout=0;
+}
+
+server {
+  listen <%= ENV["PORT"] %>;
+  server_name _;
+  server_tokens off;
+
+  root /app/build/frontend-out;
+
+  # Django rest framework
+  location ^~ /api/ {
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+      proxy_redirect off;
+      proxy_pass http://backend_server;
+  }
+
+  # Django admin
+  location ^~ /admin/ {
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+      proxy_redirect off;
+      proxy_pass http://backend_server;
+  }
+
+  # Serve static files with caching
+  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+      expires 30d;
+      add_header Cache-Control "public, max-age=2592000";
+  }
+
+  # Serve static files
+  location / {
+      try_files $uri $uri/ /index.html;
+      # Add no-cache headers
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
+      add_header Expires 0;
+  }
+
+  # Optionally, handle 404 errors by redirecting to index.html
+  error_page 404 =200 /index.html;
+}
@@ -1,9 +1,9 @@
 upstream meet_backend {
-    server ${BACKEND_HOST}:8000 fail_timeout=0;
+    server ${BACKEND_INTERNAL_HOST}:8000 fail_timeout=0;
 }

 upstream meet_frontend {
-    server ${FRONTEND_HOST}:8080 fail_timeout=0;
+    server ${FRONTEND_INTERNAL_HOST}:8080 fail_timeout=0;
 }

 server {
@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.9.0
+FROM livekit/livekit-server:v1.9.4

 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
@@ -3,3 +3,8 @@ redis:
  address: redis:6379
 keys:
  devkey: secret
+
+webhook:
+  api_key: devkey
+  urls:
+      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
@@ -10,7 +10,7 @@ services:
    - env.d/postgresql
    - env.d/common
    volumes:
-    - ./data/databases/backend:/var/lib/postgresql/data/pgdata
+    - ./data/databases/backend:/var/lib/postgresql/data

  redis:
    image: redis:5
@@ -20,8 +20,8 @@ services:
    user: ${DOCKER_USER:-1000}
    restart: always
    env_file:
+    - .env
    - env.d/common
-    - env.d/backend
    - env.d/postgresql
    healthcheck:
      test: ["CMD", "python", "manage.py", "check"]
@@ -45,6 +45,7 @@ services:
    - /docker-entrypoint.sh
    command: ["nginx", "-g", "daemon off;"]
    env_file:
+    - .env
    - env.d/common
    # Uncomment and set your values if using our nginx proxy example
    # environment:
@@ -8,7 +8,7 @@
 ### Step 1: Prepare your working environment:

 ```bash
-mkdir keycloak/env.d && cd keycloak
+mkdir -p keycloak/env.d && cd keycloak
 curl -o compose.yaml https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docs/examples/compose/keycloak/compose.yaml
 curl -o env.d/kc_postgresql https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/kc_postgresql
 curl -o env.d/keycloak https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/keycloak
@@ -89,4 +89,4 @@ Your keycloak instance is now available on https://doc.yourdomain.tld
 #### Step 3: Get Client Credentials

 1. Go to the "Credentials" tab.
-2. Copy the client ID (`meet` in this example) and the client secret.
+2. Copy the client ID (`meet` in this example) and the client secret.
@@ -9,6 +9,10 @@ La Suite Meet maintainers use only the Kubernetes deployment method in productio
 We understand that not everyone has a Kubernetes cluster available, please follow the instructions provided [here](/docs/installation/compose.md) to set up a docker compose instance.
 We also provide [Docker images](https://hub.docker.com/u/lasuite?page=1&search=meet) that can be deployed using Compose.

+## Scalingo
+
+La Suite Meet can be deployed on Scalingo PaaS using the Suite Numérique buildpack. See the [Scalingo deployment guide](./scalingo.md) for detailed instructions.
+
 ## Other ways to install La Suite Meet
 Community members have contributed alternative ways to install La Suite Meet 🙏. While maintainers may not provide direct support, we help keep these instructions up to date, and you can reach out to contributors or the community for assistance.

@@ -1,6 +1,6 @@
 # Installation with docker compose

-We provide a sample configuration for running Meet using Docker Compose. Please note that this configuration is experimental, and the official way to deploy Meet in production is to use [k8s](../installation/k8s.md)
+We provide a sample configuration for running Meet using Docker Compose. Please note that this configuration is experimental, and the official way to deploy Meet in production is to use [k8s](../installation/kubernetes.md).

 ## Requirements

@@ -47,7 +47,7 @@ curl -o default.conf.template https://raw.githubusercontent.com/suitenumerique/m

 ## Step 2: Configuration

-Meet configuration is achieved through environment variables. We provide a [detailed description of all variables](../env.md).
+Meet configuration is achieved through environment variables. We provide a [detailed description of all variables](../../src/helm/meet/README.md).

 In this example, we assume the following services:

@@ -129,7 +129,7 @@ The following ports will need to be opened:
 - 7881/tcp - WebRTC ICE over TCP
 - 7882/udp - for WebRTC multiplexing over UDP

-If you are using ufw, enter the follwoing:
+If you are using ufw, enter the following:
 ```
 ufw allow 80/tcp
 ufw allow 443/tcp
@@ -177,6 +177,15 @@ You will need to uncomment the environment and network sections in compose file
 #    external: true
 ```

+#### Caddy Reverse Proxy
+Expose the Frontend port to the host
+```yaml
+frontend:
+  …
+  ports:
+    - "8086:8086"
+```
+
 ## Step 5: Start Meet

 You are ready to start your Meet application !
@@ -198,7 +207,7 @@ Replace `<admin email>` with the email of your admin user and generate a secure

 Your Meet instance is now available on the domain you defined, https://meet.yourdomain.tld.

-THe admin interface is available on https://meet.yourdomain.tld/admin with the admin user you just created.
+The admin interface is available on https://meet.yourdomain.tld/admin with the admin user you just created.

 ## How to upgrade your Meet application

@@ -0,0 +1,185 @@
+# Deployment on Scalingo
+
+This guide explains how to deploy La Suite Meet on [Scalingo](https://scalingo.com/) using the [Suite Numérique buildpack](https://github.com/suitenumerique/buildpack).
+
+## Overview
+
+Scalingo is a Platform-as-a-Service (PaaS) that simplifies application deployment. This setup uses a custom buildpack to handle both the frontend (Vite) and backend (Django) builds, serving them through Nginx.
+
+## Prerequisites
+
+- A Scalingo account
+- Scalingo CLI installed (optional but recommended)
+- A PostgreSQL database addon
+- A Redis addon (for caching and sessions)
+
+## Step 1: Create Your App
+
+Create a new app on Scalingo using `scalingo` cli or using the [Scalingo dashboard](https://dashboard.scalingo.com/).
+
+## Step 2: Provision Addons
+
+Add the required PostgreSQL and Redis services.
+
+This will set the following environment variables automatically:
+- `SCALINGO_POSTGRESQL_URL` - Database connection string
+- `SCALINGO_REDIS_URL` - Redis connection string
+
+## Step 3: Configure Environment Variables
+
+Set the following environment variables in your Scalingo app:
+
+### Buildpack Configuration
+
+```bash
+scalingo env-set BUILDPACK_URL="https://github.com/suitenumerique/buildpack#main"
+scalingo env-set LASUITE_APP_NAME="meet"
+scalingo env-set LASUITE_BACKEND_DIR="."
+scalingo env-set LASUITE_FRONTEND_DIR="src/frontend/"
+scalingo env-set LASUITE_NGINX_DIR="."
+scalingo env-set LASUITE_SCRIPT_POSTCOMPILE="bin/buildpack_postcompile.sh"
+scalingo env-set LASUITE_SCRIPT_POSTFRONTEND="bin/buildpack_postfrontend.sh"
+```
+
+### Database and Cache
+
+```bash
+scalingo env-set DATABASE_URL="\$SCALINGO_POSTGRESQL_URL"
+scalingo env-set REDIS_URL="\$SCALINGO_REDIS_URL"
+```
+
+### Django Settings
+
+```bash
+scalingo env-set DJANGO_SETTINGS_MODULE="meet.settings"
+scalingo env-set DJANGO_CONFIGURATION="Production"
+scalingo env-set DJANGO_SECRET_KEY="<generate-a-secure-secret-key>"
+scalingo env-set DJANGO_ALLOWED_HOSTS="my-meet-app.osc-fr1.scalingo.io"
+```
+
+### OIDC Authentication
+
+Configure your OIDC provider (e.g., Keycloak, Authentik):
+
+```bash
+scalingo env-set OIDC_OP_BASE_URL="https://auth.yourdomain.com/realms/meet"
+scalingo env-set OIDC_RP_CLIENT_ID="meet-client-id"
+scalingo env-set OIDC_RP_CLIENT_SECRET="<your-client-secret>"
+scalingo env-set OIDC_RP_SIGN_ALGO="RS256"
+```
+
+### LiveKit Configuration
+
+Meet requires a LiveKit server for video conferencing:
+
+```bash
+scalingo env-set LIVEKIT_API_URL="wss://livekit.yourdomain.com"
+scalingo env-set LIVEKIT_API_KEY="<your-livekit-api-key>"
+scalingo env-set LIVEKIT_API_SECRET="<your-livekit-api-secret>"
+```
+
+### Email Configuration (Optional)
+
+For email notifications see https://doc.scalingo.com/platform/app/sending-emails:
+
+```bash
+scalingo env-set DJANGO_EMAIL_HOST="smtp.example.org"
+scalingo env-set DJANGO_EMAIL_PORT="587"
+scalingo env-set DJANGO_EMAIL_HOST_USER="<smtp-user>"
+scalingo env-set DJANGO_EMAIL_HOST_PASSWORD="<smtp-password>"
+scalingo env-set DJANGO_EMAIL_USE_TLS="True"
+scalingo env-set DJANGO_EMAIL_FROM="meet@yourdomain.com"
+```
+
+## Step 4: Deploy
+
+Deploy your application:
+
+```bash
+git push scalingo main
+```
+
+The Procfile will automatically:
+1. Build the frontend (Vite)
+2. Build the backend (Django)
+3. Run the post-compile script (cleanup)
+4. Run the post-frontend script (move assets and prepare for deployment)
+5. Start Nginx and Gunicorn
+6. Run django migrations
+
+## Step 5: Create superuser
+
+After the first deployment, create an admin user:
+
+```bash
+scalingo run python manage.py createsuperuser
+```
+
+## Custom Domain (Optional)
+
+To use a custom domain:
+
+1. Add the domain in Scalingo dashboard
+2. Update `DJANGO_ALLOWED_HOSTS` with your custom domain
+3. Configure your DNS to point to Scalingo
+
+```bash
+scalingo domains-add meet.yourdomain.com
+scalingo env-set DJANGO_ALLOWED_HOSTS="meet.yourdomain.com,my-meet-app.osc-fr1.scalingo.io"
+```
+
+## Custom Logo (Optional)
+
+To use a custom logo, set the `CUSTOM_LOGO_URL` environment variable with an HTTPS URL pointing to an SVG item (max 5MB):
+
+```bash
+scalingo env-set CUSTOM_LOGO_URL="https://cdn.yourdomain.com/logo.svg"
+```
+
+## Troubleshooting
+
+### Check Logs
+
+```bash
+scalingo logs --tail
+```
+
+### Common Issues
+
+1. **Build fails**: Check that all required environment variables are set
+2. **Database connection error**: Verify `DATABASE_URL` is correctly set to `$SCALINGO_POSTGRESQL_URL`
+3. **Static files not served**: Ensure the buildpack post-frontend script ran successfully
+4. **OIDC errors**: Verify your OIDC provider configuration and callback URLs
+
+### Useful Commands
+
+```bash
+# Open a console
+scalingo run bash
+
+# Restart the app
+scalingo restart
+
+# Scale containers
+scalingo scale web:2
+
+# One-off command
+scalingo run python manage.py shell
+```
+
+## Architecture
+
+On Scalingo, the application runs as follows:
+
+1. **Build Phase**: The buildpack compiles both frontend and backend
+2. **Runtime**:
+   - Nginx serves static files and proxies to the backend
+   - Gunicorn runs the Django WSGI application
+   - Both processes are managed by the `bin/buildpack_start.sh` script
+
+## Additional Resources
+
+- [Scalingo Documentation](https://doc.scalingo.com/)
+- [Suite Numérique Buildpack](https://github.com/suitenumerique/buildpack)
+- [Meet Environment Variables](../../src/helm/meet/README.md)
+- [Django Configurations Documentation](https://django-configurations.readthedocs.io/)
@@ -1,7 +1,7 @@
 APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"

-AWS_STORAGE_BUCKET_NAME="meet-media-storage"
+AWS_STORAGE_BUCKET_NAME="http://meet-media-storage"
 AWS_S3_ENDPOINT_URL="minio:9000"
 AWS_S3_SECURE_ACCESS=false

@@ -20,7 +20,7 @@ DJANGO_EMAIL_FROM=<your email address>
 #DJANGO_EMAIL_USE_SSL=true # A flag to enable or disable SSL for email sending.

 DJANGO_EMAIL_BRAND_NAME="La Suite Numérique" 
-DJANGO_EMAIL_LOGO_IMG="https://${meet_HOST}/assets/logo-suite-numerique.png"
+DJANGO_EMAIL_LOGO_IMG="https://${MEET_HOST}/assets/logo-suite-numerique.png"

 # Backend url
 MEET_BASE_URL="https://${MEET_HOST}"
@@ -2,6 +2,7 @@
 Gitlint extra rule to validate that the message title is of the form
 "<gitmoji>(<scope>) <subject>"
 """
+
 from __future__ import unicode_literals

 import re
@@ -3,6 +3,21 @@
  "dependencyDashboard": true,
  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
+    {
+        "groupName": "js dependencies",
+        "matchManagers": ["npm"],
+        "schedule": ["on the first day of the month"],
+        "matchPackagePatterns": ["*"],
+        "minimumReleaseAge": "7 days",
+        "internalChecksFilter": "strict"
+      },
+      {
+        "groupName": "python dependencies",
+        "matchManagers": ["setup-cfg", "pep621"],
+        "schedule": ["on the first day of the month"],
+        "matchPackagePatterns": ["*"],
+        "minimumReleaseAge": "7 days"
+      },
    {
      "enabled": false,
      "groupName": "ignored python dependencies",
@@ -15,6 +30,12 @@
      "matchPackageNames": ["pylint"],
      "allowedVersions": "<4.0.0"
    },
+    {
+        "groupName": "allowed django versions",
+        "matchManagers": ["pep621"],
+        "matchPackageNames": ["django"],
+        "allowedVersions": "<6.0.0"
+    },
    {
      "enabled": false,
      "groupName": "ignored js dependencies",
@@ -4,6 +4,8 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libgobject-2.0-0 \
+    "openssl=3.5.4-1~deb13u2" \
+    "libssl3t64=3.5.4-1~deb13u2" \
    && rm -rf /var/lib/apt/lists/*

 FROM base AS builder
@@ -19,6 +21,9 @@ FROM base AS production

 WORKDIR /app

+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 ARG DOCKER_USER
 USER ${DOCKER_USER}

@@ -31,6 +31,7 @@ logger = logging.getLogger("transcriber")

 TRANSCRIBER_AGENT_NAME = os.getenv("TRANSCRIBER_AGENT_NAME", "multi-user-transcriber")
 STT_PROVIDER = os.getenv("STT_PROVIDER", "deepgram")
+ENABLE_SILERO_VAD = os.getenv("ENABLE_SILERO_VAD", "true").lower() == "true"


 def create_stt_provider():
@@ -122,9 +123,8 @@ class MultiUserTranscriber:
        if participant.identity in self._sessions:
            return self._sessions[participant.identity]

-        session = AgentSession(
-            vad=self.ctx.proc.userdata["vad"],
-        )
+        vad = self.ctx.proc.userdata.get("vad", None)
+        session = AgentSession(vad=vad)
        room_io = RoomIO(
            agent_session=session,
            room=self.ctx.room,
@@ -193,7 +193,8 @@ async def handle_transcriber_job_request(job_req: JobRequest) -> None:

 def prewarm(proc: JobProcess):
    """Preload voice activity detection model."""
-    proc.userdata["vad"] = silero.VAD.load()
+    if ENABLE_SILERO_VAD:
+        proc.userdata["vad"] = silero.VAD.load()


 if __name__ == "__main__":
@@ -1,14 +1,15 @@

 [project]
 name = "agents"
-version = "1.1.0"
+version = "1.8.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.3.10",
    "livekit-plugins-deepgram==1.3.10",
    "livekit-plugins-silero==1.3.10",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1"
+    "python-dotenv==1.2.1",
+    "protobuf==6.33.5"
 ]

 [project.optional-dependencies]
@@ -115,6 +115,10 @@ class RoomAdmin(admin.ModelAdmin):
    list_filter = ["access_level", "created_at"]
    readonly_fields = ["id", "created_at", "updated_at"]

+    def get_queryset(self, request):
+        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
+        return super().get_queryset(request).prefetch_related("accesses__user")
+
    def get_owner(self, obj):
        """Return the owner of the room for display in the admin list."""

@@ -138,6 +142,7 @@ class RecordingAccessInline(admin.TabularInline):

    model = models.RecordingAccess
    extra = 0
+    autocomplete_fields = ["user"]


@admin.action(description=_("Resend notification to external service"))
@@ -207,8 +212,18 @@ class RecordingAdmin(admin.ModelAdmin):
        "created_at",
        "worker_id",
    )
-    list_filter = ["status", "room", "created_at"]
-    readonly_fields = ["id", "created_at", "updated_at"]
+    list_filter = ["created_at"]
+    list_select_related = ("room",)
+    readonly_fields = (
+        "id",
+        "created_at",
+        "options",
+        "mode",
+        "room",
+        "status",
+        "updated_at",
+        "worker_id",
+    )
    actions = [resend_notification]

    def get_queryset(self, request):
@@ -0,0 +1,26 @@
+"""Throttling modules for the API."""
+
+from lasuite.drf.throttling import MonitoredThrottleMixin
+from rest_framework.throttling import AnonRateThrottle
+from sentry_sdk import capture_message
+
+
+def sentry_monitoring_throttle_failure(message):
+    """Log when a failure occurs to detect rate limiting issues."""
+    capture_message(message, "warning")
+
+
+class MonitoredAnonRateThrottle(MonitoredThrottleMixin, AnonRateThrottle):
+    """Throttle for the monitored scoped rate throttle."""
+
+
+class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle Anonymous user requesting room entry"""
+
+    scope = "request_entry"
+
+
+class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle Anonymous user requesting room generation callback"""
+
+    scope = "creation_callback"
@@ -10,7 +10,7 @@ from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.text import slugify

-from rest_framework import decorators, mixins, pagination, throttling, viewsets
+from rest_framework import decorators, mixins, pagination, viewsets
 from rest_framework import (
    exceptions as drf_exceptions,
 )
@@ -58,7 +58,7 @@ from core.services.room_creation import RoomCreation
 from core.services.subtitle import SubtitleException, SubtitleService

 from ..authentication.livekit import LiveKitTokenAuthentication
-from . import permissions, serializers
+from . import permissions, serializers, throttling
 from .feature_flag import FeatureFlag

 # pylint: disable=too-many-ancestors
@@ -191,18 +191,6 @@ class UserViewSet(
        )


-class RequestEntryAnonRateThrottle(throttling.AnonRateThrottle):
-    """Throttle Anonymous user requesting room entry"""
-
-    scope = "request_entry"
-
-
-class CreationCallbackAnonRateThrottle(throttling.AnonRateThrottle):
-    """Throttle Anonymous user requesting room generation callback"""
-
-    scope = "creation_callback"
-
-
 class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.DestroyModelMixin,
@@ -379,7 +367,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="request-entry",
        permission_classes=[],
-        throttle_classes=[RequestEntryAnonRateThrottle],
+        throttle_classes=[throttling.RequestEntryAnonRateThrottle],
    )
    def request_entry(self, request, pk=None):  # pylint: disable=unused-argument
        """Request entry to a room"""
@@ -489,7 +477,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="creation-callback",
        permission_classes=[],
-        throttle_classes=[CreationCallbackAnonRateThrottle],
+        throttle_classes=[throttling.CreationCallbackAnonRateThrottle],
    )
    def creation_callback(self, request):
        """Retrieve cached room data via an unauthenticated request with a unique ID.
@@ -1,25 +1,51 @@
 """Authentication Backends for external application to the Meet core app."""

+# pylint: disable=R0913,R0917
+# ruff: noqa: PLR0913
+
 import logging

 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.core.exceptions import SuspiciousOperation

-import jwt as pyJwt
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
 from rest_framework import authentication, exceptions

+from core.models import Application
+from core.services import jwt_token
+
 User = get_user_model()
 logger = logging.getLogger(__name__)


-class ApplicationJWTAuthentication(authentication.BaseAuthentication):
-    """JWT authentication for application-delegated API access.
+class BaseJWTAuthentication(authentication.BaseAuthentication):
+    """Base JWT authentication class."""

-    Validates JWT tokens issued to applications that are acting on behalf
-    of users. Tokens must include user_id, client_id, and delegation flag.
-    """
+    def __init__(
+        self, secret_key, algorithm, issuer, audience, expiration_seconds, token_type
+    ):
+        """Initialize the JWT authentication backend with the given token service configuration.
+
+        Args:
+            secret_key: Secret key for JWT encoding/decoding
+            algorithm: JWT algorithm (e.g. HS256)
+            issuer: Expected token issuer identifier
+            audience: Expected token audience identifier
+            expiration_seconds: Token expiration time in seconds
+            token_type: Token type (e.g. Bearer)
+        """
+
+        super().__init__()
+
+        self._token_service = jwt_token.JwtTokenService(
+            secret_key=secret_key,
+            algorithm=algorithm,
+            issuer=issuer,
+            audience=audience,
+            expiration_seconds=expiration_seconds,
+            token_type=token_type,
+        )

    def authenticate(self, request):
        """Extract and validate JWT from Authorization header.
@@ -46,6 +72,78 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):

        return self.authenticate_credentials(token)

+    def decode_jwt(self, token):
+        """Decode and validate JWT token.
+
+        Args:
+            token: JWT token string
+
+        Returns:
+            Decoded payload dict, or None if token is invalid
+
+        Raises:
+            AuthenticationFailed: If token is expired or has invalid issuer/audience
+        """
+
+        try:
+            payload = self._token_service.decode_jwt(token)
+            return payload
+        except jwt_token.TokenExpiredError as e:
+            logger.warning("Token expired")
+            raise exceptions.AuthenticationFailed("Token expired.") from e
+        except jwt_token.TokenInvalidError as e:
+            logger.warning("Invalid JWT issuer or audience: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token.") from e
+        except jwt_token.TokenDecodeError:
+            # Invalid JWT token - defer to next authentication backend
+            return None
+
+    def validate_payload(self, payload):
+        """Validate JWT payload claims.
+
+        Override in subclasses to add custom validation.
+
+        Args:
+            payload: Decoded JWT payload
+
+        Raises:
+            AuthenticationFailed: If required claims are missing or invalid
+        """
+
+    def get_user(self, payload):
+        """Retrieve and validate user from payload.
+
+        Args:
+            payload: Decoded JWT payload
+
+        Returns:
+            User instance
+
+        Raises:
+            AuthenticationFailed: If user not found or inactive
+        """
+        user_id = payload.get("user_id")
+
+        if not user_id:
+            logger.warning("Missing 'user_id' in JWT payload")
+            raise exceptions.AuthenticationFailed("Invalid token claims.")
+
+        try:
+            user = User.objects.get(id=user_id)
+        except User.DoesNotExist as e:
+            logger.warning("User not found: %s", user_id)
+            raise exceptions.AuthenticationFailed("User not found.") from e
+
+        if not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user_id)
+            raise exceptions.AuthenticationFailed("User account is disabled.")
+
+        return user
+
+    def authenticate_header(self, request):
+        """Return authentication scheme for WWW-Authenticate header."""
+        return "Bearer"
+
    def authenticate_credentials(self, token):
        """Validate JWT token and return authenticated user.

@@ -60,60 +158,61 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
        Raises:
            AuthenticationFailed: If token is expired, or user not found
        """
-        # Decode and validate JWT
-        try:
-            payload = pyJwt.decode(
-                token,
-                settings.APPLICATION_JWT_SECRET_KEY,
-                algorithms=[settings.APPLICATION_JWT_ALG],
-                issuer=settings.APPLICATION_JWT_ISSUER,
-                audience=settings.APPLICATION_JWT_AUDIENCE,
-            )
-        except pyJwt.ExpiredSignatureError as e:
-            logger.warning("Token expired")
-            raise exceptions.AuthenticationFailed("Token expired.") from e
-        except pyJwt.InvalidIssuerError as e:
-            logger.warning("Invalid JWT issuer: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except pyJwt.InvalidAudienceError as e:
-            logger.warning("Invalid JWT audience: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except pyJwt.InvalidTokenError:
-            # Invalid JWT token - defer to next authentication backend
+
+        payload = self.decode_jwt(token)
+
+        if payload is None:
            return None

-        user_id = payload.get("user_id")
+        self.validate_payload(payload)
+        user = self.get_user(payload)
+
+        return (user, payload)
+
+
+class ApplicationJWTAuthentication(BaseJWTAuthentication):
+    """JWT authentication for application-delegated API access.
+
+    Validates JWT tokens issued to applications that are acting on behalf
+    of users. Tokens must include user_id, client_id, and delegation flag.
+    """
+
+    def __init__(self):
+        """Initialize authentication backend with application JWT settings from Django settings."""
+        super().__init__(
+            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
+            algorithm=settings.APPLICATION_JWT_ALG,
+            issuer=settings.APPLICATION_JWT_ISSUER,
+            audience=settings.APPLICATION_JWT_AUDIENCE,
+            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
+            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
+        )
+
+    def validate_payload(self, payload):
+        """Validate application-specific claims."""
        client_id = payload.get("client_id")
        is_delegated = payload.get("delegated", False)

-        if not user_id:
-            logger.warning("Missing 'user_id' in JWT payload")
-            raise exceptions.AuthenticationFailed("Invalid token claims.")
-
        if not client_id:
            logger.warning("Missing 'client_id' in JWT payload")
            raise exceptions.AuthenticationFailed("Invalid token claims.")

+        try:
+            application = Application.objects.get(client_id=client_id)
+        except Application.DoesNotExist as e:
+            logger.warning("Application not found: %s", client_id)
+            raise exceptions.AuthenticationFailed("Application not found.") from e
+
+        if not application.active:
+            logger.warning(
+                "Inactive application attempted authentication: %s", client_id
+            )
+            raise exceptions.AuthenticationFailed("Application is disabled.")
+
        if not is_delegated:
            logger.warning("Token is not marked as delegated")
            raise exceptions.AuthenticationFailed("Invalid token type.")

-        try:
-            user = User.objects.get(id=user_id)
-        except User.DoesNotExist as e:
-            logger.warning("User not found: %s", user_id)
-            raise exceptions.AuthenticationFailed("User not found.") from e
-
-        if not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user_id)
-            raise exceptions.AuthenticationFailed("User account is disabled.")
-
-        return (user, payload)
-
-    def authenticate_header(self, request):
-        """Return authentication scheme for WWW-Authenticate header."""
-        return "Bearer"
-

 class ResourceServerBackend(LaSuiteBackend):
    """OIDC Resource Server backend for user creation and retrieval."""
@@ -33,12 +33,11 @@ class BaseScopePermission(permissions.BasePermission):
        Raises:
            PermissionDenied: If required scope is missing from token
        """
-        # Get the current action (e.g., 'list', 'create')
+        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
        action = getattr(view, "action", None)
        if not action:
-            raise exceptions.PermissionDenied(
-                "Insufficient permissions. Unknown action."
-            )
+            # DRF routers return a 405 for unsupported methods
+            return True

        required_scope = self.scope_map.get(action)
        if not required_scope:
@@ -57,9 +56,12 @@ class BaseScopePermission(permissions.BasePermission):
        if isinstance(token_scopes, str):
            token_scopes = token_scopes.split()

+        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
+        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
+
        if settings.OIDC_RS_SCOPES_PREFIX:
            token_scopes = [
-                scope.replace(f"{settings.OIDC_RS_SCOPES_PREFIX}:", "")
+                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
                for scope in token_scopes
            ]

@@ -82,3 +84,23 @@ class HasRequiredRoomScope(BaseScopePermission):
        "partial_update": models.ApplicationScope.ROOMS_UPDATE,
        "destroy": models.ApplicationScope.ROOMS_DELETE,
    }
+
+
+class RoomPermissions(permissions.BasePermission):
+    """Permissions applying to the room API endpoint."""
+
+    def has_permission(self, request, view):
+        """Allow access only to authenticated users."""
+        return request.user.is_authenticated
+
+    def has_object_permission(self, request, view, obj):
+        """Enforce role-based access: read=any role, delete=owner, write=admin or owner."""
+        user = request.user
+
+        if request.method in permissions.SAFE_METHODS:
+            return obj.has_any_role(user)
+
+        if request.method == "DELETE":
+            return obj.is_owner(user)
+
+        return obj.is_administrator_or_owner(user)
@@ -1,14 +1,12 @@
 """External API endpoints"""

-from datetime import datetime, timedelta, timezone
 from logging import getLogger

 from django.conf import settings
 from django.contrib.auth.hashers import check_password
-from django.core.exceptions import ValidationError
+from django.core.exceptions import SuspiciousOperation, ValidationError
 from django.core.validators import validate_email

-import jwt
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework import decorators, mixins, viewsets
 from rest_framework import (
@@ -22,13 +20,14 @@ from rest_framework import (
 )

 from core import api, models
+from core.services.jwt_token import JwtTokenService

 from . import authentication, permissions, serializers

 logger = getLogger(__name__)


-class ApplicationViewSet(viewsets.GenericViewSet):
+class ApplicationViewSet(viewsets.ViewSet):
    """API endpoints for application authentication and token generation."""

    @decorators.action(
@@ -93,7 +92,7 @@ class ApplicationViewSet(viewsets.GenericViewSet):
            )

        try:
-            user = models.User.objects.get(email=email)
+            user = models.User.objects.get(email__iexact=email)
        except models.User.DoesNotExist as e:
            if (
                settings.APPLICATION_ALLOW_USER_CREATION
@@ -123,34 +122,33 @@ class ApplicationViewSet(viewsets.GenericViewSet):
                )
            else:
                raise drf_exceptions.NotFound("User not found.") from e
+        except models.User.MultipleObjectsReturned as e:
+            raise SuspiciousOperation(
+                "Multiple user accounts share a common email."
+            ) from e

-        now = datetime.now(timezone.utc)
        scope = " ".join(application.scopes or [])

-        payload = {
-            "iss": settings.APPLICATION_JWT_ISSUER,
-            "aud": settings.APPLICATION_JWT_AUDIENCE,
-            "iat": now,
-            "exp": now + timedelta(seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS),
-            "client_id": client_id,
-            "scope": scope,
-            "user_id": str(user.id),
-            "delegated": True,
-        }
-
-        token = jwt.encode(
-            payload,
-            settings.APPLICATION_JWT_SECRET_KEY,
+        token_service = JwtTokenService(
+            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
            algorithm=settings.APPLICATION_JWT_ALG,
+            issuer=settings.APPLICATION_JWT_ISSUER,
+            audience=settings.APPLICATION_JWT_AUDIENCE,
+            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
+            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
+        )
+
+        data = token_service.generate_jwt(
+            user,
+            scope,
+            {
+                "client_id": client_id,
+                "delegated": True,
+            },
        )

        return drf_response.Response(
-            {
-                "access_token": token,
-                "token_type": settings.APPLICATION_JWT_TOKEN_TYPE,
-                "expires_in": settings.APPLICATION_JWT_EXPIRATION_SECONDS,
-                "scope": scope,
-            },
+            data,
            status=drf_status.HTTP_200_OK,
        )

@@ -178,7 +176,9 @@ class RoomViewSet(
        ResourceServerAuthentication,
    ]
    permission_classes = [
-        api.permissions.IsAuthenticated & permissions.HasRequiredRoomScope
+        api.permissions.IsAuthenticated
+        & permissions.HasRequiredRoomScope
+        & permissions.RoomPermissions
    ]
    queryset = models.Room.objects.all()
    serializer_class = serializers.RoomSerializer
@@ -292,6 +292,10 @@ class Resource(BaseModel):
                role = RoleChoices.MEMBER
        return role

+    def has_any_role(self, user):
+        """Check if a user has any role on the resource."""
+        return self.get_role(user) is not None
+
    def is_administrator_or_owner(self, user):
        """
        Check if a user is administrator or owner of the resource."""
@@ -167,6 +167,7 @@ class NotificationService:
                owner_access.user.timezone
            ).strftime("%H:%M"),
            "download_link": f"{get_recording_download_base_url()}/{recording.id}",
+            "context_language": owner_access.user.language,
        }

        headers = {
@@ -1,7 +1,11 @@
 """Recording-related LiveKit Events Service"""

+# pylint: disable=no-member
+
 from logging import getLogger

+from livekit import api
+
 from core import models, utils

 logger = getLogger(__name__)
@@ -14,6 +18,27 @@ class RecordingEventsError(Exception):
 class RecordingEventsService:
    """Handles recording-related Livekit webhook events."""

+    @staticmethod
+    def handle_update(recording, egress_status):
+        """Handle egress status updates and sync recording state to room metadata."""
+
+        room_name = str(recording.room.id)
+
+        status_mapping = {
+            api.EgressStatus.EGRESS_ACTIVE: "started",
+            api.EgressStatus.EGRESS_ENDING: "saving",
+            api.EgressStatus.EGRESS_ABORTED: "aborted",
+        }
+
+        recording_status = status_mapping.get(egress_status)
+        if recording_status:
+            try:
+                utils.update_room_metadata(
+                    room_name, {"recording_status": recording_status}
+                )
+            except utils.MetadataUpdateException as e:
+                logger.exception("Failed to update room's metadata: %s", e)
+
    @staticmethod
    def handle_limit_reached(recording):
        """Stop recording and notify participants when limit is reached."""
@@ -105,10 +105,4 @@ class WorkerServiceMediator:
        finally:
            recording.save()

-        try:
-            room_name = str(recording.room.id)
-            utils.update_room_metadata(room_name, {"recording_status": "saving"})
-        except utils.MetadataUpdateException as e:
-            logger.exception("Failed to update room's metadata: %s", e)
-
        logger.info("Worker stopped for room %s", recording.room)
@@ -0,0 +1,153 @@
+"""JWT token service."""
+
+# pylint: disable=R0913,R0917
+# ruff: noqa: PLR0913
+
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+
+from django.core.exceptions import ImproperlyConfigured
+
+import jwt
+
+
+class JWTError(Exception):
+    """Base exception for all JWT token errors."""
+
+
+class TokenExpiredError(JWTError):
+    """Raised when the JWT token has expired."""
+
+
+class TokenInvalidError(JWTError):
+    """Raised when the JWT token has an invalid issuer or audience."""
+
+
+class TokenDecodeError(JWTError):
+    """Raised for any other unrecoverable JWT decode failure."""
+
+
+class JwtTokenService:
+    """Generic JWT token service with configurable settings."""
+
+    def __init__(
+        self,
+        secret_key: str,
+        algorithm: str,
+        issuer: str,
+        audience: str,
+        expiration_seconds: int,
+        token_type: str,
+    ):
+        """
+        Initialize the token service with custom settings.
+
+        Args:
+            secret_key: Secret key for JWT encoding/decoding
+            algorithm: JWT algorithm
+            issuer: Token issuer identifier
+            audience: Token audience identifier
+            expiration_seconds: Token expiration time in seconds
+            token_type: Token type
+
+        Raises:
+            ImproperlyConfigured: If secret_key is None or empty
+        """
+        if not secret_key:
+            raise ImproperlyConfigured("Secret key is required.")
+        if not algorithm:
+            raise ImproperlyConfigured("Algorithm is required.")
+        if not token_type:
+            raise ImproperlyConfigured("Token's type is required.")
+        if expiration_seconds is None:
+            raise ImproperlyConfigured("Expiration's seconds is required.")
+
+        self._key = secret_key
+        self._algorithm = algorithm
+        self._issuer = issuer
+        self._audience = audience
+        self._expiration_seconds = expiration_seconds
+        self._token_type = token_type
+
+    def generate_jwt(
+        self, user, scope: str, extra_payload: Optional[dict] = None
+    ) -> dict:
+        """
+        Generate an access token for the given user.
+
+        Note: any extra_payload variables named iat, exp, or user_id will
+        be overwritten by this service
+
+        Args:
+            user: User instance for whom to generate the token
+            scope: Space-separated scope string
+
+        Returns:
+            Dictionary containing access_token, token_type, expires_in, and scope optionally
+        """
+        now = datetime.now(timezone.utc)
+
+        payload = extra_payload.copy() if extra_payload else {}
+
+        payload.update(
+            {
+                "iat": now,
+                "exp": now + timedelta(seconds=self._expiration_seconds),
+                "user_id": str(user.id),
+            }
+        )
+
+        if self._issuer:
+            payload["iss"] = self._issuer
+        if self._audience:
+            payload["aud"] = self._audience
+        if scope:
+            payload["scope"] = scope
+
+        token = jwt.encode(
+            payload,
+            self._key,
+            algorithm=self._algorithm,
+        )
+
+        response = {
+            "access_token": token,
+            "token_type": self._token_type,
+            "expires_in": self._expiration_seconds,
+        }
+
+        if scope:
+            response["scope"] = scope
+
+        return response
+
+    def decode_jwt(self, token):
+        """Decode and validate JWT token.
+
+        Args:
+            token: JWT token string
+
+        Returns:
+            Decoded payload dict.
+
+        Raises:
+            TokenExpiredError: If the token has expired.
+            TokenInvalidError: If the token has an invalid issuer or audience.
+            TokenDecodeError: If the token is malformed or cannot be decoded.
+        """
+
+        try:
+            payload = jwt.decode(
+                token,
+                self._key,
+                algorithms=[self._algorithm],
+                issuer=self._issuer,
+                audience=self._audience,
+            )
+            return payload
+        except jwt.ExpiredSignatureError as e:
+            raise TokenExpiredError("Token expired.") from e
+        except (jwt.InvalidIssuerError, jwt.InvalidAudienceError) as e:
+            raise TokenInvalidError("Invalid token.") from e
+        except jwt.InvalidTokenError as e:
+            raise TokenDecodeError("Token decode error.") from e
@@ -118,8 +118,10 @@ class LiveKitEventsService:
        except Exception as e:
            raise InvalidPayloadError("Invalid webhook payload") from e

-        if self._filter_regex and not self._filter_regex.search(data.room.name):
-            logger.info("Filtered webhook event for room '%s'", data.room.name)
+        room_name = data.room.name or data.egress_info.room_name
+
+        if self._filter_regex and not self._filter_regex.search(room_name):
+            logger.info("Filtered webhook event for room '%s'", room_name)
            return

        try:
@@ -138,23 +140,19 @@ class LiveKitEventsService:
        # pylint: disable=not-callable
        handler(data)

-    def _handle_egress_started(self, data):
-        """Handle 'egress_started' event."""
+    def _handle_egress_updated(self, data):
+        """Handle 'egress_updated' event."""

+        egress_id = data.egress_info.egress_id
        try:
-            recording = models.Recording.objects.get(
-                worker_id=data.egress_info.egress_id
-            )
+            recording = models.Recording.objects.get(worker_id=egress_id)
        except models.Recording.DoesNotExist as err:
            raise ActionFailedError(
-                f"Recording with worker ID {data.egress_info.egress_id} does not exist"
+                f"Recording with worker ID {egress_id} does not exist"
            ) from err

-        try:
-            room_name = str(recording.room.id)
-            utils.update_room_metadata(room_name, {"recording_status": "started"})
-        except utils.MetadataUpdateException as e:
-            logger.exception("Failed to update room's metadata: %s", e)
+        egress_status = data.egress_info.status
+        self.recording_events.handle_update(recording, egress_status)

    def _handle_egress_ended(self, data):
        """Handle 'egress_ended' event."""
@@ -102,6 +102,7 @@ def test_notify_user_by_email_success(mocked_current_site, settings):
    settings.EMAIL_SUPPORT_EMAIL = "support@acme.com"
    settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
    settings.SCREEN_RECORDING_BASE_URL = "https://acme.com/recordings"
+    settings.RECORDING_DOWNLOAD_BASE_URL = None
    settings.EMAIL_FROM = "notifications@acme.com"

    recording = factories.RecordingFactory(room__name="Conference Room A")
@@ -122,10 +122,7 @@ def test_mediator_start_recording_from_forbidden_status(
    mock_update_room_metadata.assert_not_called()


-@mock.patch("core.utils.update_room_metadata")
-def test_mediator_stop_recording_success(
-    mock_update_room_metadata, mediator, mock_worker_service
-):
+def test_mediator_stop_recording_success(mediator, mock_worker_service):
    """Test successful recording stop"""
    # Setup
    mock_recording = RecordingFactory(
@@ -143,15 +140,8 @@ def test_mediator_stop_recording_success(
    mock_recording.refresh_from_db()
    assert mock_recording.status == RecordingStatusChoices.STOPPED

-    mock_update_room_metadata.assert_called_once_with(
-        str(mock_recording.room.id), {"recording_status": "saving"}
-    )

-
-@mock.patch("core.utils.update_room_metadata")
-def test_mediator_stop_recording_aborted(
-    mock_update_room_metadata, mediator, mock_worker_service
-):
+def test_mediator_stop_recording_aborted(mediator, mock_worker_service):
    """Test recording stop when worker returns ABORTED"""
    # Setup
    mock_recording = RecordingFactory(
@@ -166,15 +156,10 @@ def test_mediator_stop_recording_aborted(
    mock_recording.refresh_from_db()
    assert mock_recording.status == RecordingStatusChoices.ABORTED

-    mock_update_room_metadata.assert_called_once_with(
-        str(mock_recording.room.id), {"recording_status": "saving"}
-    )
-

@pytest.mark.parametrize("error_class", [WorkerConnectionError, WorkerResponseError])
-@mock.patch("core.utils.update_room_metadata")
 def test_mediator_stop_recording_worker_errors(
-    mock_update_room_metadata, mediator, mock_worker_service, error_class
+    mediator, mock_worker_service, error_class
 ):
    """Test handling of worker errors during stop"""
    # Setup
@@ -190,5 +175,3 @@ def test_mediator_stop_recording_worker_errors(
    # Verify recording updates
    mock_recording.refresh_from_db()
    assert mock_recording.status == RecordingStatusChoices.FAILED_TO_STOP
-
-    mock_update_room_metadata.assert_not_called()
@@ -94,22 +94,55 @@ def test_handle_egress_ended_success(
    assert recording.status == "stopped"


+@pytest.mark.parametrize(
+    ("egress_status", "status"),
+    (
+        (EgressStatus.EGRESS_ACTIVE, "started"),
+        (EgressStatus.EGRESS_ENDING, "saving"),
+        (EgressStatus.EGRESS_ABORTED, "aborted"),
+    ),
+)
@mock.patch("core.utils.update_room_metadata")
-def test_handle_egress_started_success(mock_update_room_metadata, service):
-    """Should successfully start recording and update room's metadata."""
+def test_handle_egress_updated_success(
+    mock_update_room_metadata, egress_status, status, service
+):
+    """Should successfully update room's metadata."""

    recording = RecordingFactory(worker_id="worker-1", status="initiated")
    mock_data = mock.MagicMock()
    mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = EgressStatus.EGRESS_ACTIVE
+    mock_data.egress_info.status = egress_status

-    service._handle_egress_started(mock_data)
+    service._handle_egress_updated(mock_data)

    mock_update_room_metadata.assert_called_once_with(
-        str(recording.room.id), {"recording_status": "started"}
+        str(recording.room.id), {"recording_status": status}
    )


+@pytest.mark.parametrize(
+    "egress_status",
+    (
+        EgressStatus.EGRESS_FAILED,
+        EgressStatus.EGRESS_LIMIT_REACHED,
+    ),
+)
+@mock.patch("core.utils.update_room_metadata")
+def test_handle_egress_updated_non_handled(
+    mock_update_room_metadata, egress_status, service
+):
+    """Should ignore certain egress status and don't trigger metadata updates."""
+
+    recording = RecordingFactory(worker_id="worker-1", status="initiated")
+    mock_data = mock.MagicMock()
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = egress_status
+
+    service._handle_egress_updated(mock_data)
+
+    mock_update_room_metadata.assert_not_called()
+
+
@pytest.mark.parametrize(
    ("mode", "notification_type"),
    (
@@ -2,21 +2,21 @@
 Tests for external API /room endpoint
 """

-# pylint: disable=W0621
+# pylint: disable=W0621,C0302

+import uuid
 from datetime import datetime, timedelta, timezone
+from unittest import mock

 from django.conf import settings

 import jwt
 import pytest
 import responses
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework.test import APIClient

-from core.factories import (
-    RoomFactory,
-    UserFactory,
-)
+from core.factories import ApplicationFactory, RoomFactory, UserFactory
 from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, User

 pytestmark = pytest.mark.django_db
@@ -27,12 +27,14 @@ def generate_test_token(user, scopes):
    now = datetime.now(timezone.utc)
    scope_string = " ".join(scopes)

+    application = ApplicationFactory()
+
    payload = {
        "iss": settings.APPLICATION_JWT_ISSUER,
        "aud": settings.APPLICATION_JWT_AUDIENCE,
        "iat": now,
        "exp": now + timedelta(seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS),
-        "client_id": "test-client-id",
+        "client_id": str(application.client_id),
        "scope": scope_string,
        "user_id": str(user.id),
        "delegated": True,
@@ -53,10 +55,24 @@ def test_api_rooms_list_requires_authentication():
    assert response.status_code == 401


-def test_api_rooms_list_with_valid_token(settings):
-    """Listing rooms with valid token should succeed."""
+def test_api_rooms_list_inactive_user():
+    """List should return 401 if user is inactive."""

-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    user1 = UserFactory(is_active=False)
+    RoomFactory(users=[(user1, RoleChoices.OWNER)])
+
+    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user account is disabled" in str(response.data).lower()
+
+
+def test_api_rooms_list_with_valid_token():
+    """Listing rooms with valid token should succeed."""

    user = UserFactory()
    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
@@ -73,9 +89,25 @@ def test_api_rooms_list_with_valid_token(settings):
    assert response.data["results"][0]["id"] == str(room.id)


+def test_api_rooms_list_with_no_rooms():
+    """Listing rooms with a valid token returns an empty list when there are no rooms."""
+
+    user = UserFactory()
+
+    # Generate valid token
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 0
+    assert response.data["results"] == []
+
+
 def test_api_rooms_list_with_expired_token(settings):
    """Listing rooms with expired token should return 401."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0

    user = UserFactory()
@@ -92,8 +124,8 @@ def test_api_rooms_list_with_expired_token(settings):


@responses.activate
-def test_api_rooms_list_with_invalid_token(settings):
-    """Listing rooms with invalid token should return 400."""
+def test_api_rooms_list_with_invalid_rs_token(settings):
+    """Listing rooms with invalid resource server token should return 400."""

    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
    settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -116,9 +148,8 @@ def test_api_rooms_list_with_invalid_token(settings):
    assert response.status_code == 400


-def test_api_rooms_list_missing_scope(settings):
+def test_api_rooms_list_missing_scope():
    """Listing rooms without required scope should return 403."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -130,12 +161,30 @@ def test_api_rooms_list_missing_scope(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 403
-    assert "Insufficient permissions. Required scope: rooms:list" in str(response.data)
+    assert (
+        "insufficient permissions. required scope: rooms:list"
+        in str(response.data).lower()
+    )


-def test_api_rooms_list_filters_by_user(settings):
+def test_api_rooms_list_no_scope():
+    """Listing rooms without any scope should return 403."""
+
+    user = UserFactory()
+
+    # Token without scope
+    token = generate_test_token(user, [])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()
+
+
+def test_api_rooms_list_filters_by_user():
    """List should only return rooms accessible to the authenticated user."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user1 = UserFactory()
    user2 = UserFactory()
@@ -144,7 +193,9 @@ def test_api_rooms_list_filters_by_user(settings):
    room2 = RoomFactory(users=[(user2, RoleChoices.OWNER)])
    room3 = RoomFactory(users=[(user1, RoleChoices.MEMBER)])

-    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
+    token = generate_test_token(
+        user1, [ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE]
+    )

    client = APIClient()
    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
@@ -158,9 +209,82 @@ def test_api_rooms_list_filters_by_user(settings):
    assert str(room2.id) not in returned_ids


-def test_api_rooms_retrieve_requires_scope(settings):
+def test_api_rooms_retrieve_requires_authentication():
+    """Retrieving rooms without authentication should return 401."""
+
+    user1 = UserFactory()
+    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
+
+    client = APIClient()
+    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
+
+    assert response.status_code == 401
+
+
+def test_api_rooms_retrieve_inactive_user():
+    """Retrieve should return 401 if user is inactive."""
+
+    user1 = UserFactory(is_active=False)
+    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
+
+    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
+
+    assert response.status_code == 401
+    assert "user account is disabled" in str(response.data).lower()
+
+
+def test_api_rooms_retrieve_with_expired_token(settings):
+    """Retrieving rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    # Generate expired token
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 401
+    assert "expired" in str(response.data).lower()
+
+
+@responses.activate
+def test_api_rooms_retrieve_with_invalid_rs_token(settings):
+    """Retrieving rooms with invalid resource server token should return 400."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": False,
+        },
+    )
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
+    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
+
+    # Return 400 instead of 401 because ResourceServerAuthentication raises
+    # SuspiciousOperation when the introspected user is not active
+    assert response.status_code == 400
+
+
+def test_api_rooms_retrieve_requires_scope():
    """Retrieving a room requires ROOMS_RETRIEVE scope."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()
    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
@@ -178,9 +302,25 @@ def test_api_rooms_retrieve_requires_scope(settings):
    )


+def test_api_rooms_retrieve_no_scope():
+    """Retrieving rooms without any scope should return 403."""
+
+    user = UserFactory()
+
+    # Token without scope
+    token = generate_test_token(user, [])
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()
+
+
 def test_api_rooms_retrieve_success(settings):
    """Retrieving a room with correct scope should succeed."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_BASE_URL = "http://your-application.com"
    settings.ROOM_TELEPHONY_ENABLED = True
    settings.ROOM_TELEPHONY_PHONE_NUMBER = "+1-555-0100"
@@ -212,9 +352,128 @@ def test_api_rooms_retrieve_success(settings):
    }


-def test_api_rooms_create_requires_scope(settings):
+def test_api_rooms_retrieve_success_by_user():
+    """Retrieve should only return rooms accessible to the authenticated user."""
+
+    user1 = UserFactory()
+    user2 = UserFactory()
+
+    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
+    room2 = RoomFactory(users=[(user2, RoleChoices.OWNER)])
+    room3 = RoomFactory(users=[(user1, RoleChoices.MEMBER)])
+    room4 = RoomFactory(users=[(user1, RoleChoices.ADMIN)])
+
+    token = generate_test_token(
+        user1, [ApplicationScope.ROOMS_RETRIEVE, ApplicationScope.ROOMS_LIST]
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room2.id}/")
+
+    assert response.status_code == 403
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
+
+    assert response.status_code == 200
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room3.id}/")
+
+    assert response.status_code == 200
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room4.id}/")
+
+    assert response.status_code == 200
+
+
+def test_api_rooms_retrieve_not_found():
+    """Retrieving a non-existing room with correct scope should return a 404."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{uuid.uuid4()}/")
+
+    assert response.status_code == 404
+    assert "no room matches the given query." in str(response.data).lower()
+
+
+def test_api_rooms_create_requires_authentication():
+    """Creating rooms without authentication should return 401."""
+
+    client = APIClient()
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+
+
+def test_api_rooms_create_with_expired_token(settings):
+    """Creating rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
+
+    user = UserFactory()
+
+    # Generate expired token
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "expired" in str(response.data).lower()
+
+
+@responses.activate
+def test_api_rooms_create_with_invalid_rs_token(settings):
+    """Creating rooms with invalid resource server token should return 400."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": False,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    # Return 400 instead of 401 because ResourceServerAuthentication raises
+    # SuspiciousOperation when the introspected user is not active
+    assert response.status_code == 400
+
+
+def test_api_rooms_create_inactive_user():
+    """Create should return 401 if user is inactive."""
+
+    user1 = UserFactory(is_active=False)
+
+    token = generate_test_token(user1, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user account is disabled" in str(response.data).lower()
+
+
+def test_api_rooms_create_requires_scope():
    """Creating a room requires ROOMS_CREATE scope."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()

    # Token without ROOMS_CREATE scope
@@ -225,18 +484,36 @@ def test_api_rooms_create_requires_scope(settings):
    response = client.post("/external-api/v1.0/rooms/", {}, format="json")

    assert response.status_code == 403
-    assert "Insufficient permissions. Required scope: rooms:create" in str(
-        response.data
+    assert (
+        "insufficient permissions. required scope: rooms:create"
+        in str(response.data).lower()
    )


-def test_api_rooms_create_success(settings):
-    """Creating a room with correct scope should succeed."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+def test_api_rooms_create_no_scope():
+    """Creating rooms without any scope should return 403."""

    user = UserFactory()

-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+    # Token without scope
+    token = generate_test_token(user, [])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()
+
+
+def test_api_rooms_create_success():
+    """Creating a room with correct scope should succeed."""
+
+    user = UserFactory()
+
+    token = generate_test_token(
+        user, [ApplicationScope.ROOMS_CREATE, ApplicationScope.ROOMS_LIST]
+    )

    client = APIClient()
    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
@@ -245,6 +522,8 @@ def test_api_rooms_create_success(settings):
    assert response.status_code == 201
    assert "id" in response.data
    assert "slug" in response.data
+    assert "name" in response.data
+    assert response.data["name"] == response.data["slug"]

    # Verify room was created with user as owner
    room = Room.objects.get(id=response.data["id"])
@@ -252,9 +531,72 @@ def test_api_rooms_create_success(settings):
    assert room.access_level == "trusted"


+def test_api_rooms_create_readonly_enforcement():
+    """Creating a room succeeds and any provided read-only fields are ignored."""
+
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {
+            "id": "fake-id",
+            "slug": "fake-slug",
+            "name": "fake-name",
+            "access_level": "public",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert "slug" in response.data
+    assert response.data["id"] != "fake-id"
+    assert "name" in response.data
+    assert response.data["slug"] != "fake-slug"
+    assert "id" in response.data
+    assert response.data["name"] != "fake-name"
+
+    # Verify room was created with user as owner
+    room = Room.objects.get(id=response.data["id"])
+    assert room.get_role(user) == RoleChoices.OWNER
+    assert room.access_level == "trusted"
+
+
+def test_api_rooms_unknown_actions():
+    """Updating or deleting a room are not supported yet."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(
+        user,
+        [
+            ApplicationScope.ROOMS_RETRIEVE,
+            ApplicationScope.ROOMS_DELETE,
+            ApplicationScope.ROOMS_UPDATE,
+        ],
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.delete(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 405
+    assert 'method "delete" not allowed.' in str(response.data).lower()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 405
+    assert 'method "patch" not allowed.' in str(response.data).lower()
+
+
 def test_api_rooms_response_no_url(settings):
    """Response should not include url field when APPLICATION_BASE_URL is None."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_BASE_URL = None

    user = UserFactory()
@@ -273,7 +615,6 @@ def test_api_rooms_response_no_url(settings):

 def test_api_rooms_response_no_telephony(settings):
    """Response should not include telephony field when ROOM_TELEPHONY_ENABLED is False."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.ROOM_TELEPHONY_ENABLED = False

    user = UserFactory()
@@ -290,10 +631,41 @@ def test_api_rooms_response_no_telephony(settings):
    assert response.data["id"] == str(room.id)


+def test_api_rooms_token_scope_case_insensitive(settings):
+    """Token's scope should be case-insensitive."""
+    user = UserFactory()
+    application = ApplicationFactory()
+
+    # Generate token with mixed-case scope "Rooms:List" to verify that scope
+    # validation is case-insensitive (should match "rooms:list")
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "scope": "Rooms:List",  # Mixed case - should be accepted as "rooms:list"
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+
+
 def test_api_rooms_token_without_delegated_flag(settings):
    """Token without delegated flag should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()
+    application = ApplicationFactory()

    # Generate token without delegated flag
    now = datetime.now(timezone.utc)
@@ -302,7 +674,7 @@ def test_api_rooms_token_without_delegated_flag(settings):
        "aud": settings.APPLICATION_JWT_AUDIENCE,
        "iat": now,
        "exp": now + timedelta(hours=1),
-        "client_id": "test-client",
+        "client_id": str(application.client_id),
        "scope": "rooms:list",
        "user_id": str(user.id),
        "delegated": False,  # Not delegated
@@ -318,12 +690,75 @@ def test_api_rooms_token_without_delegated_flag(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 401
-    assert "Invalid token type." in str(response.data)
+    assert "invalid token type." in str(response.data).lower()
+
+
+@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
+def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
+    """Token signed with an invalid key should defer to the next authentication."""
+    user = UserFactory()
+    application = ApplicationFactory()
+
+    # Generate token without delegated flag
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "scope": "rooms:list",
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        "invalid-private-key",
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    mock_rs_authenticate.assert_called()
+    assert response.status_code == 401
+
+
+@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
+def test_api_rooms_token_invalid_alg(mock_rs_authenticate, settings):
+    """Token signed with an invalid alg should defer to the next authentication."""
+    settings.APPLICATION_JWT_ALG = "RS256"
+    user = UserFactory()
+
+    # Generate token without delegated flag
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": "test-client",
+        "scope": "rooms:list",
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm="HS256",  # different value
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    mock_rs_authenticate.assert_called()
+    assert response.status_code == 401


 def test_api_rooms_token_missing_client_id(settings):
    """Token without client_id should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()

    now = datetime.now(timezone.utc)
@@ -348,7 +783,152 @@ def test_api_rooms_token_missing_client_id(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 401
-    assert "Invalid token claims." in str(response.data)
+    assert "invalid token claims." in str(response.data).lower()
+
+
+def test_api_rooms_token_missing_user_id(settings):
+    """Token without user_id should be rejected."""
+    application = ApplicationFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "scope": "rooms:list",
+        "delegated": True,
+        # Missing user_id
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "invalid token claims." in str(response.data).lower()
+
+
+def test_api_rooms_token_invalid_audience(settings):
+    """Token with an invalid audience should be rejected."""
+    user = UserFactory()
+    application = ApplicationFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": "invalid-audience",
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "user_id": str(user.id),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "invalid token." in str(response.data).lower()
+
+
+def test_api_rooms_token_unknown_user(settings):
+    """Token for unknown user should be rejected."""
+    application = ApplicationFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "user_id": str(uuid.uuid4()),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user not found." in str(response.data).lower()
+
+
+def test_api_rooms_token_unknown_application(settings):
+    """Token for unknown application should be rejected."""
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": "unknown-client-id",
+        "user_id": str(uuid.uuid4()),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "application not found." in str(response.data).lower()
+
+
+def test_api_rooms_token_inactive_application(settings):
+    """Token for inactive application should be rejected."""
+    application = ApplicationFactory(active=False)
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "user_id": str(uuid.uuid4()),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "application is disabled." in str(response.data).lower()


@responses.activate
@@ -507,7 +1087,7 @@ def test_resource_server_authentication_successful(settings):
            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
            "sub": "very-specific-sub",
            "client_id": "some_service_provider",
-            "scope": "openid lasuite_meet lasuite_meet:rooms:list",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:list lasuite_meet:rooms:retrieve",
            "active": True,
        },
    )
@@ -21,8 +21,7 @@ pytestmark = pytest.mark.django_db

 def test_api_applications_generate_token_success(settings):
    """Valid credentials should return a JWT token."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
-    user = UserFactory(email="user@example.com")
+    UserFactory(email="User.Family@example.com")
    application = ApplicationFactory(
        active=True,
        scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
@@ -40,7 +39,7 @@ def test_api_applications_generate_token_success(settings):
            "client_id": application.client_id,
            "client_secret": plain_secret,
            "grant_type": "client_credentials",
-            "scope": user.email,
+            "scope": "user.family@example.com",
        },
        format="json",
    )
@@ -173,9 +172,8 @@ def test_api_applications_generate_token_domain_not_authorized():
    assert "not authorized for this email domain" in str(response.data)


-def test_api_applications_generate_token_domain_authorized(settings):
+def test_api_applications_generate_token_domain_authorized():
    """Application with domain authorization should succeed."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@allowed.com")
    application = ApplicationFactory(
        active=True,
@@ -230,7 +228,6 @@ def test_api_applications_generate_token_user_not_found():
@freeze_time("2023-01-15 12:00:00")
 def test_api_applications_token_payload_structure(settings):
    """Generated token should have correct payload structure."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@example.com")

    application = ApplicationFactory(
@@ -280,7 +277,6 @@ def test_api_applications_token_payload_structure(settings):
 def test_api_applications_token_new_user(settings):
    """Should create a new pending user when creation is allowed and user doesn't exist."""

-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_ALLOW_USER_CREATION = True
    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
@@ -337,7 +333,6 @@ def test_api_applications_token_new_user(settings):
 def test_api_applications_token_existing_user(settings):
    """Application should not create a new user when user exist."""

-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@example.com")

    settings.APPLICATION_ALLOW_USER_CREATION = True
@@ -18,6 +18,7 @@ from socket import gethostbyname, gethostname

 from django.utils.translation import gettext_lazy as _

+import dj_database_url
 import sentry_sdk
 from configurations import Configuration, values
 from lasuite.configuration.values import SecretFileValue
@@ -92,7 +93,11 @@ class Base(Configuration):

    # Database
    DATABASES = {
-        "default": {
+        "default": dj_database_url.config()
+        if values.DatabaseURLValue(
+            None, environ_name="DATABASE_URL", environ_prefix=None
+        )
+        else {
            "ENGINE": values.Value(
                "django.db.backends.postgresql_psycopg2",
                environ_name="DB_ENGINE",
@@ -292,6 +297,9 @@ class Base(Configuration):
            ),
        },
    }
+    MONITORED_THROTTLE_FAILURE_CALLBACK = (
+        "core.api.throttling.sentry_monitoring_throttle_failure"
+    )

    SPECTACULAR_SETTINGS = {
        "TITLE": "Meet API",
@@ -336,6 +344,9 @@ class Base(Configuration):
        "feedback": values.DictValue(
            {}, environ_name="FRONTEND_FEEDBACK", environ_prefix=None
        ),
+        "external_home_url": values.Value(
+            None, environ_name="FRONTEND_EXTERNAL_HOME_URL", environ_prefix=None
+        ),
        "use_french_gov_footer": values.BooleanValue(
            False, environ_name="FRONTEND_USE_FRENCH_GOV_FOOTER", environ_prefix=None
        ),
@@ -656,7 +667,7 @@ class Base(Configuration):
        [],
        environ_name="BREVO_API_CONTACT_LIST_IDS",
        environ_prefix=None,
-        converter=lambda x: int(x),  # pylint: disable=unnecessary-lambda
+        converter=int,
    )
    BREVO_API_CONTACT_ATTRIBUTES = values.DictValue({"VISIO_USER": True})
    BREVO_API_TIMEOUT = values.PositiveIntegerValue(
@@ -906,6 +917,9 @@ class Test(Base):
    USE_SWAGGER = True
    EXTERNAL_API_ENABLED = True

+    APPLICATION_JWT_SECRET_KEY = "devKey"  # noqa:S105
+    APPLICATION_JWT_AUDIENCE = "Test inc."
+
    CELERY_TASK_ALWAYS_EAGER = values.BooleanValue(True)

    def __init__(self):
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "meet"
-version = "1.1.0"
+version = "1.8.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -17,46 +17,47 @@ classifiers = [
    "License :: OSI Approved :: MIT License",
    "Natural Language :: English",
    "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.13",
 ]
 description = "A simple video and phone conferencing tool, powered by LiveKit"
 keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = { file = "LICENSE" }
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.40.69",
+    "boto3==1.42.49",
    "Brotli==1.2.0",
    "brevo-python==1.2.0",
-    "celery[redis]==5.5.3",
+    "celery[redis]==5.6.2",
+    "dj-database-url==3.1.0",
    "django-configurations==2.5.1",
    "django-cors-headers==4.9.0",
-    "django-countries==8.0.0",
-    "django-lasuite[all]==0.0.19",
+    "django-countries==8.2.0",
+    "django-lasuite[all]==0.0.24",
    "django-parler==2.3",
    "redis==5.2.1",
    "django-redis==6.0.0",
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
-    "django==5.2.9",
+    "django==5.2.11",
    "djangorestframework==3.16.1",
    "drf_spectacular==0.29.0",
-    "dockerflow==2024.4.2",
+    "dockerflow==2026.1.26",
    "easy_thumbnails==2.10.1",
    "factory_boy==3.3.3",
-    "gunicorn==23.0.0",
-    "jsonschema==4.25.1",
-    "markdown==3.10",
+    "gunicorn==25.1.0",
+    "jsonschema==4.26.0",
+    "markdown==3.10.2",
    "nested-multipart-parser==1.6.0",
-    "psycopg[binary]==3.2.12",
-    "PyJWT==2.10.1",
+    "psycopg[binary]==3.3.2",
+    "PyJWT==2.11.0",
    "python-frontmatter==1.1.0",
    "requests==2.32.5",
-    "sentry-sdk==2.43.0",
+    "sentry-sdk==2.53.0",
    "whitenoise==6.11.0",
-    "mozilla-django-oidc==4.0.1",
-    "livekit-api==1.0.7",
-    "aiohttp==3.13.2",
+    "mozilla-django-oidc==5.0.2",
+    "livekit-api==1.1.0",
+    "aiohttp==3.13.3",
 ]

 [project.urls]
@@ -68,21 +69,21 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
    "django-extensions==4.1",
-    "drf-spectacular-sidecar==2025.10.1",
+    "drf-spectacular-sidecar==2026.1.1",
    "freezegun==1.5.5",
    "ipdb==0.13.13",
-    "ipython==9.7.0",
-    "pyfakefs==5.10.2",
-    "pylint-django==2.6.1",
+    "ipython==9.10.0",
+    "pyfakefs==6.1.1",
+    "pylint-django==2.7.0",
    "pylint<4.0.0",
    "pytest-cov==7.0.0",
-    "pytest-django==4.11.1",
-    "pytest==9.0.0",
+    "pytest-django==4.12.0",
+    "pytest==9.0.2",
    "pytest-icdiff==0.9",
    "pytest-xdist==3.8.0",
    "responses==0.25.8",
-    "ruff==0.14.4",
-    "types-requests==2.32.4.20250913",
+    "ruff==0.15.1",
+    "types-requests==2.32.4.20260107",
 ]

 [tool.setuptools]
@@ -43,7 +43,8 @@ RUN apk update && apk upgrade libssl3 \
    libxml2>=2.12.7-r2 \
    libxslt>=1.1.39-r2 \
    libexpat>=2.7.2-r0 \
-    libpng>=1.6.53-r0
+    libpng>=1.6.53-r0 \
+    && apk del curl

 USER nginx

@@ -5,6 +5,12 @@ server {

  root /usr/share/nginx/html;

+  location = /.well-known/windows-app-web-link {
+      default_type application/json;
+      alias /usr/share/nginx/html/.well-known/windows-app-web-link;
+      add_header Content-Disposition "attachment; filename=windows-app-web-link";
+  }
+
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
@@ -6,6 +6,22 @@
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
    <link rel="manifest" href="/site.webmanifest">
+    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
+    <link
+      rel="preload"
+      as="font"
+      crossorigin="anonymous"
+      href="/node_modules/@fontsource/material-icons-outlined/files/material-icons-outlined-latin-400-normal.woff2"
+      type="font/woff2"
+    />
+    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
+    <link
+      rel="preload"
+      as="font"
+      crossorigin="anonymous"
+      href="/node_modules/@fontsource-variable/material-symbols-outlined/files/material-symbols-outlined-latin-wght-normal.woff2"
+      type="font/woff2"
+    />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>%VITE_APP_TITLE%</title>
  </head>
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.1.0",
+  "version": "1.8.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -13,56 +13,56 @@
    "check": "prettier --check ./src"
  },
  "dependencies": {
-    "@fontsource-variable/material-symbols-outlined": "5.2.30",
+    "@fontsource-variable/material-symbols-outlined": "5.2.34",
    "@fontsource/material-icons-outlined": "5.2.6",
-    "@livekit/components-react": "2.9.13",
-    "@livekit/components-styles": "1.1.6",
-    "@livekit/track-processors": "0.6.1",
-    "@pandacss/preset-panda": "0.54.0",
-    "@react-aria/toast": "3.0.5",
-    "@react-types/overlays": "3.9.0",
+    "@livekit/components-react": "2.9.19",
+    "@livekit/components-styles": "1.2.0",
+    "@livekit/track-processors": "0.7.0",
+    "@pandacss/preset-panda": "1.8.2",
+    "@react-aria/toast": "3.0.10",
+    "@react-types/overlays": "3.9.3",
    "@remixicon/react": "4.6.0",
-    "@tanstack/react-query": "5.81.5",
+    "@tanstack/react-query": "5.90.21",
    "@timephy/rnnoise-wasm": "1.0.0",
-    "crisp-sdk-web": "1.0.25",
+    "crisp-sdk-web": "1.0.27",
    "derive-valtio": "0.2.0",
    "hoofd": "1.7.3",
-    "humanize-duration": "3.33.0",
-    "i18next": "25.3.1",
-    "i18next-browser-languagedetector": "8.2.0",
+    "humanize-duration": "3.33.2",
+    "i18next": "25.8.8",
+    "i18next-browser-languagedetector": "8.2.1",
    "i18next-parser": "9.3.0",
    "i18next-resources-to-backend": "1.2.1",
    "libphonenumber-js": "1.12.10",
-    "livekit-client": "2.15.7",
-    "posthog-js": "1.256.2",
+    "livekit-client": "2.17.1",
+    "posthog-js": "1.342.1",
    "react": "18.3.1",
-    "react-aria-components": "1.10.1",
+    "react-aria-components": "1.14.0",
    "react-dom": "18.3.1",
    "react-i18next": "15.1.1",
    "use-sound": "5.0.0",
-    "valtio": "2.1.5",
-    "wouter": "3.7.1"
+    "valtio": "2.3.0",
+    "wouter": "3.9.0"
  },
  "devDependencies": {
-    "@pandacss/dev": "0.54.0",
-    "@tanstack/eslint-plugin-query": "5.81.2",
-    "@tanstack/react-query-devtools": "5.81.5",
+    "@pandacss/dev": "1.8.2",
+    "@tanstack/eslint-plugin-query": "5.91.4",
+    "@tanstack/react-query-devtools": "5.91.3",
    "@types/humanize-duration": "3.27.4",
    "@types/node": "22.16.0",
    "@types/react": "18.3.12",
    "@types/react-dom": "18.3.1",
    "@typescript-eslint/eslint-plugin": "8.35.1",
    "@typescript-eslint/parser": "8.35.1",
-    "@vitejs/plugin-react": "4.6.0",
+    "@vitejs/plugin-react": "5.1.4",
    "eslint": "8.57.0",
    "eslint-config-prettier": "10.1.5",
    "eslint-plugin-jsx-a11y": "6.10.2",
    "eslint-plugin-react-hooks": "5.2.0",
    "eslint-plugin-react-refresh": "0.4.20",
    "postcss": "8.5.6",
-    "prettier": "3.6.2",
+    "prettier": "3.8.1",
    "typescript": "5.8.3",
-    "vite": "7.0.8",
-    "vite-tsconfig-paths": "5.1.4"
+    "vite": "7.3.1",
+    "vite-tsconfig-paths": "6.1.1"
  }
 }
@@ -0,0 +1,6 @@
+[
+{
+  "packageFamilyName" : "Visio_g3z6ba6vek6vg",
+  "paths" : [ "*" ]
+}
+]
@@ -17,6 +17,7 @@ export interface ApiConfig {
  feedback: {
    url: string
  }
+  external_home_url?: string
  silence_livekit_debug_logs?: boolean
  is_silent_login_enabled?: boolean
  custom_css_url?: string
@@ -6,6 +6,7 @@ export const BlurOnStrong = () => {
      viewBox="0 0 24 24"
      fill="none"
      xmlns="http://www.w3.org/2000/svg"
+      aria-hidden="true"
    >
      <path
        fillRule="evenodd"
@@ -4,6 +4,7 @@ import { Button } from '@/primitives'
 import { RiArrowLeftSLine, RiArrowRightSLine } from '@remixicon/react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 const Heading = styled('h2', {
  base: {
@@ -144,6 +145,21 @@ type Slide = {
  isAvailableInBeta?: boolean
 }

+const carouselNavButton = css({
+  _focusVisible: {
+    outline: '2px solid var(--colors-focus-ring) !important',
+    outlineOffset: '1px',
+  },
+  _disabled: {
+    color: 'greyscale.400',
+    cursor: 'default',
+    pointerEvents: 'none',
+    _pressed: {
+      backgroundColor: 'transparent',
+    },
+  },
+})
+
 // todo - optimize how images are imported
 const SLIDES: Slide[] = [
  {
@@ -163,11 +179,45 @@ const SLIDES: Slide[] = [
 export const IntroSlider = () => {
  const [slideIndex, setSlideIndex] = useState(0)
  const { t } = useTranslation('home', { keyPrefix: 'introSlider' })
+  const announce = useScreenReaderAnnounce()

  const NUMBER_SLIDES = SLIDES.length

+  const goPrev = () => {
+    if (slideIndex === 0) return
+    const newIndex = slideIndex - 1
+    setSlideIndex(newIndex)
+    announce(
+      t('slidePosition', { current: newIndex + 1, total: NUMBER_SLIDES }),
+      'polite',
+      'global'
+    )
+  }
+
+  const goNext = () => {
+    if (slideIndex === NUMBER_SLIDES - 1) return
+    const newIndex = slideIndex + 1
+    setSlideIndex(newIndex)
+    announce(
+      t('slidePosition', { current: newIndex + 1, total: NUMBER_SLIDES }),
+      'polite',
+      'global'
+    )
+  }
+
+  const ariaLabelParams = {
+    current: slideIndex + 1,
+    total: NUMBER_SLIDES,
+  }
+  const previousAriaLabel = t('previous.labelWithPosition', ariaLabelParams)
+  const nextAriaLabel = t('next.labelWithPosition', ariaLabelParams)
+
  return (
-    <Container>
+    <Container
+      role="region"
+      aria-roledescription="carousel"
+      aria-label={t('carouselLabel')}
+    >
      <div
        className={css({
          display: 'flex',
@@ -180,10 +230,10 @@ export const IntroSlider = () => {
            <Button
              variant="secondaryText"
              square
-              aria-label={t('previous.label')}
-              tooltip={t('previous.tooltip')}
-              onPress={() => setSlideIndex(slideIndex - 1)}
-              isDisabled={slideIndex == 0}
+              className={carouselNavButton}
+              aria-label={previousAriaLabel}
+              aria-disabled={slideIndex === 0}
+              onPress={goPrev}
            >
              <RiArrowLeftSLine />
            </Button>
@@ -191,8 +241,12 @@ export const IntroSlider = () => {
        </ButtonContainer>
        <SlideContainer>
          {SLIDES.map((slide, index) => (
-            <Slide visible={index == slideIndex} key={index}>
-              <Image src={slide.src} alt={t(`${slide.key}.imgAlt`)} />
+            <Slide
+              aria-hidden={index !== slideIndex}
+              visible={index === slideIndex}
+              key={index}
+            >
+              <Image src={slide.src} alt="" role="presentation" />
              <TextAnimation visible={index == slideIndex}>
                <Heading>{t(`${slide.key}.title`)}</Heading>
                <Body>{t(`${slide.key}.body`)}</Body>
@@ -205,10 +259,10 @@ export const IntroSlider = () => {
            <Button
              variant="secondaryText"
              square
-              aria-label={t('next.label')}
-              tooltip={t('next.tooltip')}
-              onPress={() => setSlideIndex(slideIndex + 1)}
-              isDisabled={slideIndex == NUMBER_SLIDES - 1}
+              className={carouselNavButton}
+              aria-label={nextAriaLabel}
+              aria-disabled={slideIndex === NUMBER_SLIDES - 1}
+              onPress={goNext}
            >
              <RiArrowRightSLine />
            </Button>
@@ -5,37 +5,42 @@ import { isRoomValid } from '@/features/rooms'

 export const JoinMeetingDialog = () => {
  const { t } = useTranslation('home')
+
+  const handleSubmit = (data: { roomId?: FormDataEntryValue }) => {
+    const roomId = (data.roomId as string)
+      .trim()
+      .replace(`${window.location.origin}/`, '')
+    navigateTo('room', roomId)
+  }
+
+  const validateRoomId = (value: string) => {
+    const trimmed = value.trim()
+    if (!trimmed) return null
+    return !isRoomValid(trimmed) ? (
+      <>
+        <p>{t('joinInputError')}</p>
+        <Ul>
+          <li>{window.location.origin}/uio-azer-jkl</li>
+          <li>uio-azer-jkl</li>
+        </Ul>
+      </>
+    ) : null
+  }
+
  return (
    <Dialog title={t('joinMeeting')}>
-      <Form
-        onSubmit={(data) => {
-          navigateTo(
-            'room',
-            (data.roomId as string)
-              .trim()
-              .replace(`${window.location.origin}/`, '')
-          )
-        }}
-        submitLabel={t('joinInputSubmit')}
-      >
+      <Form onSubmit={handleSubmit} submitLabel={t('joinInputSubmit')}>
+        {/* eslint-disable jsx-a11y/no-autofocus -- Focus on input when modal opens, required for accessibility */}
        <Field
          type="text"
+          autoFocus
+          isRequired
          name="roomId"
          label={t('joinInputLabel')}
          description={t('joinInputExample', {
            example: window.origin + '/azer-tyu-qsdf',
          })}
-          validate={(value) => {
-            return !isRoomValid(value.trim()) ? (
-              <>
-                <p>{t('joinInputError')}</p>
-                <Ul>
-                  <li>{window.location.origin}/uio-azer-jkl</li>
-                  <li>uio-azer-jkl</li>
-                </Ul>
-              </>
-            ) : null
-          }}
+          validate={validateRoomId}
        />
      </Form>
      <H lvl={2}>{t('joinMeetingTipHeading')}</H>
@@ -11,7 +11,7 @@ import { RiAddLine, RiLink } from '@remixicon/react'
 import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
 import { IntroSlider } from '@/features/home/components/IntroSlider'
 import { MoreLink } from '@/features/home/components/MoreLink'
-import { ReactNode, useState } from 'react'
+import { ReactNode, useEffect, useState } from 'react'

 import { css } from '@/styled-system/css'
 import { menuRecipe } from '@/primitives/menuRecipe.ts'
@@ -19,6 +19,7 @@ import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePers
 import { useConfig } from '@/api/useConfig'
 import { LoginButton } from '@/components/LoginButton'
 import { ApiRoom } from '@/features/rooms/api/ApiRoom'
+import { LoadingScreen } from '@/components/LoadingScreen'

 const Columns = ({ children }: { children?: ReactNode }) => {
  return (
@@ -155,9 +156,34 @@ export const Home = () => {

  const { mutateAsync: createRoom } = useCreateRoom()
  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
+  const [redirectFailed, setRedirectFailed] = useState(false)

  const { data } = useConfig()

+  useEffect(() => {
+    const checkSiteAndRedirect = async () => {
+      if (!data?.external_home_url) return
+      if (isLoggedIn === false) {
+        try {
+          await fetch(data.external_home_url, {
+            method: 'HEAD', // Use HEAD to avoid downloading the full page
+            mode: 'no-cors', // Needed for cross-origin requests
+          })
+          window.location.replace(data.external_home_url)
+        } catch (error) {
+          setRedirectFailed(true)
+          console.error('Site is not reachable:', error)
+        }
+      }
+    }
+
+    checkSiteAndRedirect()
+  }, [isLoggedIn, data])
+
+  if (data?.external_home_url && isLoggedIn == false && !redirectFailed) {
+    return <LoadingScreen header={false} footer={false} delay={0} />
+  }
+
  return (
    <UserAware>
      <Screen>
@@ -25,15 +25,27 @@ export const TermsOfServiceRoute = () => {
        {/* Article 2 */}
        <H lvl={2}>{t('articles.article2.title')}</H>
        <P>{t('articles.article2.content')}</P>
-        <P>{t('articles.article2.purposes')}</P>
+        {ensureArray(
+          t('articles.article2.paragraphs', {
+            returnObjects: true,
+          })
+        ).map((paragraph, index) => (
+          <P key={index}>{paragraph}</P>
+        ))}

        {/* Article 3 */}
        <H lvl={2}>{t('articles.article3.title')}</H>
-        <P>{t('articles.article3.definition')}</P>
+        {ensureArray(
+          t('articles.article3.paragraphs', {
+            returnObjects: true,
+          })
+        ).map((paragraph, index) => (
+          <P key={index}>{paragraph}</P>
+        ))}

        {/* Article 4 */}
        <H lvl={2}>{t('articles.article4.title')}</H>
-        <P>{t('articles.article4.content')}</P>
+        <P>{t('articles.article4.definition')}</P>

        {/* Article 5 */}
        <H lvl={2} margin={false}>
@@ -62,6 +74,7 @@ export const TermsOfServiceRoute = () => {
            __html: t('articles.article5.sections.section1.paragraph3'),
          }}
        ></P>
+        <P>{t('articles.article5.sections.section1.paragraph4')}</P>

        {/* Section 5.2 */}
        <H lvl={3} bold>
@@ -111,15 +124,12 @@ export const TermsOfServiceRoute = () => {
        ))}

        {/* Article 7 */}
-        <H lvl={2} margin={false}>
-          {t('articles.article7.title')}
-        </H>
+        <H lvl={2}>{t('articles.article7.title')}</H>

        {/* Section 7.1 */}
        <H lvl={3} bold>
          {t('articles.article7.sections.section1.title')}
        </H>
-        <P>{t('articles.article7.sections.section1.content')}</P>
        {ensureArray(
          t('articles.article7.sections.section1.paragraphs', {
            returnObjects: true,
@@ -132,16 +142,51 @@ export const TermsOfServiceRoute = () => {
        <H lvl={3} bold>
          {t('articles.article7.sections.section2.title')}
        </H>
+        {ensureArray(
+          t('articles.article7.sections.section2.paragraphs', {
+            returnObjects: true,
+          })
+        ).map((paragraph, index) => (
+          <P key={index}>{paragraph}</P>
+        ))}
+
+        {/* Section 7.3 */}
+        <H lvl={3} bold>
+          {t('articles.article7.sections.section3.title')}
+        </H>
+        {ensureArray(
+          t('articles.article7.sections.section3.paragraphs', {
+            returnObjects: true,
+          })
+        ).map((paragraph, index) => (
+          <P key={index}>{paragraph}</P>
+        ))}
+
+        {/* Section 7.4 */}
+        <H lvl={3} bold>
+          {t('articles.article7.sections.section4.title')}
+        </H>
+        {ensureArray(
+          t('articles.article7.sections.section4.paragraphs', {
+            returnObjects: true,
+          })
+        ).map((paragraph, index) => (
+          <P key={index}>{paragraph}</P>
+        ))}
+
+        {/* Section 7.5 */}
+        <H lvl={3} bold>
+          {t('articles.article7.sections.section5.title')}
+        </H>
        <P>
-          {t('articles.article7.sections.section2.content')
+          {t('articles.article7.sections.section5.content')
            .split('https://github.com/suitenumerique/meet')[0]
            .replace('https://github.com/suitenumerique/meet', '')}{' '}
          <A href="https://github.com/suitenumerique/meet" color="primary">
            https://github.com/suitenumerique/meet
          </A>
-          {'. '}
          {
-            t('articles.article7.sections.section2.content').split(
+            t('articles.article7.sections.section5.content').split(
              'https://github.com/suitenumerique/meet'
            )[1]
          }
@@ -66,16 +66,22 @@ export function ToastRecordingRequest({
          name: participant?.name,
        })}
        {!options.isMenuOpen && (
-          <Button
-            size="sm"
-            variant="text"
+          <div
            className={css({
-              color: 'primary.300',
+              marginLeft: '0.5rem',
            })}
-            onPress={options.openMenu}
          >
-            {t('openMenu')}
-          </Button>
+            <Button
+              size="sm"
+              variant="text"
+              className={css({
+                color: 'primary.300',
+              })}
+              onPress={options.openMenu}
+            >
+              {t('openMenu')}
+            </Button>
+          </div>
        )}
      </HStack>
    </StyledToastContainer>
@@ -1,7 +1,7 @@
-import { css, cx } from '@/styled-system/css'
+import { css } from '@/styled-system/css'
 import { HStack } from '@/styled-system/jsx'
 import { Spinner } from '@/primitives/Spinner'
-import { Button, Text } from '@/primitives'
+import { Button, Icon, Text } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { RecordingStatuses } from '../hooks/useRecordingStatuses'
 import { ReactNode, useEffect, useRef, useState } from 'react'
@@ -42,6 +42,17 @@ export const ControlsButton = ({
 }: ControlsButtonProps) => {
  const { t } = useTranslation('rooms', { keyPrefix: i18nKeyPrefix })

+  // Focus management: focus the primary action button when this side panel opens.
+  const primaryActionRef = useRef<HTMLButtonElement | null>(null)
+
+  useEffect(() => {
+    requestAnimationFrame(() => {
+      if (primaryActionRef.current) {
+        primaryActionRef.current.focus({ preventScroll: true })
+      }
+    })
+  }, [])
+
  const room = useRoomContext()
  const isRoomConnected = room.state == ConnectionState.Connected

@@ -97,6 +108,7 @@ export const ControlsButton = ({
          fullWidth
          onPress={handle}
          isDisabled={isDisabled}
+          ref={primaryActionRef}
        >
          {t('button.stop')}
        </Button>
@@ -129,31 +141,23 @@ export const ControlsButton = ({
          })}
          onPress={() => openSidePanel()}
        >
-          <span
-            className={cx(
-              'material-icons',
-              css({
-                color: 'primary.500',
-                marginRight: '1rem',
-              })
-            )}
-          >
-            info
-          </span>
+          <Icon
+            className={css({
+              color: 'primary.500',
+              marginRight: '1rem',
+            })}
+            name="info"
+          />
          <Text variant={'smNote'}>
            {parseLineBreaks(t('button.anotherModeStarted'))}
          </Text>
-          <span
-            className={cx(
-              'material-icons',
-              css({
-                color: 'primary.500',
-                marginLeft: 'auto',
-              })
-            )}
-          >
-            chevron_right
-          </span>
+          <Icon
+            className={css({
+              color: 'primary.500',
+              marginLeft: 'auto',
+            })}
+            name="chevron_right"
+          />
        </RACButton>
      )}
      <Button
@@ -161,6 +165,8 @@ export const ControlsButton = ({
        fullWidth
        onPress={handle}
        isDisabled={isDisabled}
+        size="compact"
+        ref={primaryActionRef}
      >
        {t('button.start')}
      </Button>
@@ -1,4 +1,4 @@
-import { H, Text } from '@/primitives'
+import { H, Text, Icon } from '@/primitives'
 import { css } from '@/styled-system/css'
 import { LoginButton } from '@/components/LoginButton'
 import { HStack } from '@/styled-system/jsx'
@@ -24,9 +24,7 @@ export const LoginPrompt = ({ heading, body }: LoginPromptProps) => {
      })}
    >
      <HStack justify="start" alignItems="center" marginBottom="0.5rem">
-        <span className="material-symbols" aria-hidden={true}>
-          login
-        </span>
+        <Icon type="symbols" name="login" />
        <H lvl={3} margin={false} padding={false}>
          {heading}
        </H>
@@ -1,6 +1,6 @@
 import { css } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'
-import { useMemo } from 'react'
+import { useMemo, useRef, useEffect } from 'react'
 import { Text } from '@/primitives'
 import {
  RecordingMode,
@@ -13,6 +13,7 @@ import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'
 import { useRoomMetadata } from '../hooks/useRoomMetadata'
 import { RecordingStatusIcon } from './RecordingStatusIcon'
 import { useIsRecording } from '@livekit/components-react'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 export const RecordingStateToast = () => {
  const { t } = useTranslation('rooms', {
@@ -21,6 +22,9 @@ export const RecordingStateToast = () => {

  const { openTranscript, openScreenRecording } = useSidePanel()

+  const lastKeyRef = useRef('')
+  const announce = useScreenReaderAnnounce()
+
  const hasTranscriptAccess = useHasRecordingAccess(
    RecordingMode.Transcript,
    FeatureFlags.Transcript
@@ -67,6 +71,16 @@ export const RecordingStateToast = () => {
    return `${metadata.recording_mode}.${status}`
  }, [metadata, isStarted, isStarting, isRecording])

+  // Update screen reader message only when the key actually changes
+  // This prevents duplicate announcements caused by re-renders
+  useEffect(() => {
+    if (key && key !== lastKeyRef.current) {
+      lastKeyRef.current = key
+      const message = t(key)
+      announce(message)
+    }
+  }, [announce, key, t])
+
  if (!key) return null

  const hasScreenRecordingAccessAndActive =
@@ -74,61 +88,65 @@ export const RecordingStateToast = () => {
  const hasTranscriptAccessAndActive = isTranscriptActive && hasTranscriptAccess

  return (
-    <div
-      className={css({
-        display: 'flex',
-        position: 'fixed',
-        top: '10px',
-        left: '10px',
-        paddingY: '0.25rem',
-        paddingX: '0.75rem 0.75rem',
-        backgroundColor: 'danger.700',
-        borderColor: 'white',
-        border: '1px solid',
-        color: 'white',
-        borderRadius: '4px',
-        gap: '0.5rem',
-      })}
-    >
-      <RecordingStatusIcon
-        isStarted={isStarted}
-        isTranscriptActive={isTranscriptActive}
-      />
+    <>
+      {/* Visual banner (without aria-live to avoid duplicate announcements) */}
+      <div
+        className={css({
+          display: 'flex',
+          position: 'fixed',
+          top: '10px',
+          left: '10px',
+          paddingY: '0.25rem',
+          paddingX: '0.75rem 0.75rem',
+          backgroundColor: 'danger.700',
+          borderColor: 'white',
+          border: '1px solid',
+          color: 'white',
+          borderRadius: '4px',
+          gap: '0.5rem',
+        })}
+      >
+        <RecordingStatusIcon
+          isStarted={isStarted}
+          isTranscriptActive={isTranscriptActive}
+        />

-      {!hasScreenRecordingAccessAndActive && !hasTranscriptAccessAndActive && (
-        <Text
-          variant={'sm'}
-          className={css({
-            fontWeight: '500 !important',
-          })}
-        >
-          {t(key)}
-        </Text>
-      )}
-      {hasScreenRecordingAccessAndActive && (
-        <RACButton
-          onPress={openScreenRecording}
-          className={css({
-            textStyle: 'sm !important',
-            fontWeight: '500 !important',
-            cursor: 'pointer',
-          })}
-        >
-          {t(key)}
-        </RACButton>
-      )}
-      {hasTranscriptAccessAndActive && (
-        <RACButton
-          onPress={openTranscript}
-          className={css({
-            textStyle: 'sm !important',
-            fontWeight: '500 !important',
-            cursor: 'pointer',
-          })}
-        >
-          {t(key)}
-        </RACButton>
-      )}
-    </div>
+        {!hasScreenRecordingAccessAndActive &&
+          !hasTranscriptAccessAndActive && (
+            <Text
+              variant={'sm'}
+              className={css({
+                fontWeight: '500 !important',
+              })}
+            >
+              {t(key)}
+            </Text>
+          )}
+        {hasScreenRecordingAccessAndActive && (
+          <RACButton
+            onPress={openScreenRecording}
+            className={css({
+              textStyle: 'sm !important',
+              fontWeight: '500 !important',
+              cursor: 'pointer',
+            })}
+          >
+            {t(key)}
+          </RACButton>
+        )}
+        {hasTranscriptAccessAndActive && (
+          <RACButton
+            onPress={openTranscript}
+            className={css({
+              textStyle: 'sm !important',
+              fontWeight: '500 !important',
+              cursor: 'pointer',
+            })}
+          >
+            {t(key)}
+          </RACButton>
+        )}
+      </div>
+    </>
  )
 }
@@ -1,4 +1,5 @@
 import { Spinner } from '@/primitives/Spinner'
+import { Icon } from '@/primitives'

 interface RecordingStatusIconProps {
  isStarted: boolean
@@ -14,8 +15,8 @@ export const RecordingStatusIcon = ({
  }

  if (isTranscriptActive) {
-    return <span className="material-symbols">speech_to_text</span>
+    return <Icon type="symbols" name="speech_to_text" />
  }

-  return <span className="material-symbols">screen_record</span>
+  return <Icon type="symbols" name="screen_record" />
 }
@@ -1,4 +1,4 @@
-import { Button, H, Text } from '@/primitives'
+import { Button, Icon, H, Text } from '@/primitives'
 import { css } from '@/styled-system/css'
 import { HStack } from '@/styled-system/jsx'
 import { useEffect, useRef, useState } from 'react'
@@ -59,7 +59,7 @@ export const RequestRecording = ({
      })}
    >
      <HStack justify="start" alignItems="center" marginBottom="0.5rem">
-        <span className="material-symbols">person_raised_hand</span>
+        <Icon type="symbols" name="person_raised_hand" />
        <H lvl={3} margin={false} padding={false}>
          {heading}
        </H>
@@ -1,5 +1,6 @@
 import { css } from '@/styled-system/css'
 import { ReactNode } from 'react'
+import { Icon } from '@/primitives'

 type RowPosition = 'first' | 'middle' | 'last' | 'single'

@@ -29,9 +30,10 @@ export const RowWrapper = ({
      className={css({
        width: '100%',
        background: 'gray.100',
-        padding: '8px',
+        paddingBlock: '0.5rem',
+        paddingInline: '0',
        display: 'flex',
-        marginTop: '4px',
+        marginTop: '0.25rem',
      })}
    >
      <div
@@ -40,17 +42,19 @@ export const RowWrapper = ({
          display: 'flex',
          justifyContent: 'center',
          alignItems: 'center',
+          paddingInline: '0.25rem',
        })}
      >
        {/*  fixme - doesn't handle properly material-symbols  */}
-        <span className="material-icons">{iconName}</span>
+        <Icon name={iconName} />
      </div>
      <div
        className={css({
-          flex: 5,
+          flex: 6,
          display: 'flex',
          alignItems: 'center',
          gap: '0.25rem',
+          paddingInlineEnd: '8px',
        })}
      >
        {children}
@@ -5,7 +5,6 @@ import { useRoomId } from '@/features/rooms/livekit/hooks/useRoomId'
 import { useRoomContext } from '@livekit/components-react'
 import {
  RecordingMode,
-  useHasFeatureWithoutAdminRights,
  useHumanizeRecordingMaxDuration,
  useRecordingStatuses,
 } from '@/features/recording'
@@ -19,7 +18,6 @@ import {
 } from '@/features/notifications'
 import posthog from 'posthog-js'
 import { useConfig } from '@/api/useConfig'
-import { FeatureFlags } from '@/features/analytics/enums'
 import { NoAccessView } from './NoAccessView'
 import { ControlsButton } from './ControlsButton'
 import { RowWrapper } from './RowWrapper'
@@ -28,6 +26,7 @@ import { Checkbox } from '@/primitives/Checkbox'
 import { useTranscriptionLanguage } from '@/features/settings'
 import { useMutateRecording } from '../hooks/useMutateRecording'
 import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'
+import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner.ts'

 export const ScreenRecordingSidePanel = () => {
  const { data } = useConfig()
@@ -38,10 +37,7 @@ export const ScreenRecordingSidePanel = () => {

  const [includeTranscript, setIncludeTranscript] = useState(false)

-  const hasFeatureWithoutAdminRights = useHasFeatureWithoutAdminRights(
-    RecordingMode.ScreenRecording,
-    FeatureFlags.ScreenRecording
-  )
+  const isAdminOrOwner = useIsAdminOrOwner()

  const { notifyParticipants } = useNotifyParticipants()
  const { selectedLanguageKey, isLanguageSetToAuto } =
@@ -98,14 +94,17 @@ export const ScreenRecordingSidePanel = () => {
        await notifyParticipants({
          type: NotificationType.ScreenRecordingStarted,
        })
-        posthog.capture('screen-recording-started', {})
+        posthog.capture('screen-recording-started', {
+          includeTranscript: includeTranscript,
+          language: selectedLanguageKey,
+        })
      }
    } catch (error) {
      console.error('Failed to handle recording:', error)
    }
  }

-  if (hasFeatureWithoutAdminRights) {
+  if (!isAdminOrOwner) {
    return (
      <NoAccessView
        i18nKeyPrefix={keyPrefix}
@@ -146,7 +145,7 @@ export const ScreenRecordingSidePanel = () => {
          },
        })}
      />
-      <VStack gap={0} marginBottom={30}>
+      <VStack gap={0} marginBottom={15}>
        <H lvl={1} margin={'sm'} fullWidth>
          {t('heading')}
        </H>
@@ -163,7 +162,7 @@ export const ScreenRecordingSidePanel = () => {
          )}
        </Text>
      </VStack>
-      <VStack gap={0} marginBottom={40}>
+      <VStack gap={0} marginBottom={25}>
        <RowWrapper iconName="cloud_download" position="first">
          <Text variant="sm">{t('details.destination')}</Text>
        </RowWrapper>
@@ -117,7 +117,10 @@ export const TranscriptSidePanel = () => {
        await notifyParticipants({
          type: NotificationType.TranscriptionStarted,
        })
-        posthog.capture('transcript-started', {})
+        posthog.capture('transcript-started', {
+          includeScreenRecording: includeScreenRecording,
+          language: selectedLanguageKey,
+        })
      }
    } catch (error) {
      console.error('Failed to handle transcript:', error)
@@ -178,7 +181,7 @@ export const TranscriptSidePanel = () => {
          },
        })}
      />
-      <VStack gap={0} marginBottom={30}>
+      <VStack gap={0} marginBottom={15}>
        <H lvl={1} margin={'sm'}>
          {t('heading')}
        </H>
@@ -195,7 +198,7 @@ export const TranscriptSidePanel = () => {
          )}
        </Text>
      </VStack>
-      <VStack gap={0} marginBottom={40}>
+      <VStack gap={0} marginBottom={25}>
        <RowWrapper iconName="article" position="first">
          <Text variant="sm">
            {data?.transcription_destination ? (
@@ -11,6 +11,7 @@ export const useHumanizeRecordingMaxDuration = () => {

    return humanizeDuration(data?.recording?.max_duration, {
      language: i18n.language,
+      delimiter: ' ',
    })
  }, [data])
 }
@@ -104,14 +104,12 @@ export const RecordingDownload = () => {
              {t('success.title')}
            </H>
            <Text centered margin="md" wrap={'balance'}>
-              <span
-                dangerouslySetInnerHTML={{
-                  __html: t('success.body', {
-                    room: data.room.name,
-                    created_at: formatDate(data.created_at, 'YYYY-MM-DD HH:mm'),
-                  }),
-                }}
-              />
+              <span>
+                {t('success.body', {
+                  room: data.room.name,
+                  created_at: formatDate(data.created_at, 'YYYY-MM-DD HH:mm'),
+                })}
+              </span>
              <span>
                {configData?.recording?.expiration_days && (
                  <>
@@ -25,12 +25,12 @@ import { VideoConference } from '../livekit/prefabs/VideoConference'
 import { css } from '@/styled-system/css'
 import { BackgroundProcessorFactory } from '../livekit/components/blur'
 import { LocalUserChoices } from '@/stores/userChoices'
-import { navigateTo } from '@/navigation/navigateTo'
 import { MediaDeviceErrorAlert } from './MediaDeviceErrorAlert'
 import { usePostHog } from 'posthog-js/react'
 import { useConfig } from '@/api/useConfig'
 import { isFireFox } from '@/utils/livekit'
 import { useIsMobile } from '@/utils/useIsMobile'
+import { navigateTo } from '@/navigation/navigateTo'

 export const Conference = ({
  roomId,
@@ -228,10 +228,20 @@ export const Conference = ({
            posthog.captureException(e)
          }}
          onDisconnected={(e) => {
-            if (e == DisconnectReason.CLIENT_INITIATED) {
-              navigateTo('feedback', { duplicateIdentity: false })
-            } else if (e == DisconnectReason.DUPLICATE_IDENTITY) {
-              navigateTo('feedback', { duplicateIdentity: true })
+            switch (e) {
+              case DisconnectReason.CLIENT_INITIATED:
+                navigateTo('feedback')
+                return
+              case DisconnectReason.DUPLICATE_IDENTITY:
+              case DisconnectReason.PARTICIPANT_REMOVED:
+                navigateTo(
+                  'feedback',
+                  {},
+                  {
+                    state: { reason: e },
+                  }
+                )
+                return
            }
          }}
          onMediaDeviceFailure={(e, kind) => {
@@ -112,8 +112,8 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
                    square
                    size={'sm'}
                    onPress={copyRoomUrlToClipboard}
-                    aria-label={t('copyUrl')}
-                    tooltip={t('copyUrl')}
+                    aria-label={isRoomUrlCopied ? t('copied') : t('copyUrl')}
+                    tooltip={isRoomUrlCopied ? t('copied') : t('copyUrl')}
                  >
                    {isRoomUrlCopied ? (
                      <RiCheckLine aria-hidden="true" />
@@ -138,11 +138,12 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
                  {formatPinCode(roomData?.pin_code)}
                </Text>
              </div>
+
              <Button
                variant={isCopied ? 'success' : 'secondaryText'}
                size="sm"
                fullWidth
-                aria-label={t('copy')}
+                aria-label={isCopied ? t('copied') : t('copy')}
                style={{
                  justifyContent: 'start',
                }}
@@ -173,7 +174,7 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
            <Button
              variant={isCopied ? 'success' : 'tertiary'}
              fullWidth
-              aria-label={t('copy')}
+              aria-label={isCopied ? t('copied') : t('copy')}
              onPress={copyRoomToClipboard}
              data-attr="share-dialog-copy"
            >
@@ -446,16 +446,14 @@ export const Join = ({
                type="text"
                onChange={saveUsername}
                label={t('usernameLabel')}
-                aria-label={t('usernameLabel')}
+                id="input-name"
                defaultValue={username}
                validate={(value) => !value && t('errors.usernameEmpty')}
                wrapperProps={{
                  noMargin: true,
                  fullWidth: true,
                }}
-                labelProps={{
-                  center: true,
-                }}
+                autoComplete="name"
                maxLength={50}
              />
            </VStack>
@@ -1,21 +1,29 @@
-import { Button, Dialog, H, P } from '@/primitives'
+import { A, Button, Dialog, H, P, ScreenReaderAnnouncer } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { css } from '@/styled-system/css'
 import { useSnapshot } from 'valtio'
 import { connectionObserverStore } from '@/stores/connectionObserver'
 import { HStack } from '@/styled-system/jsx'
-import { useEffect, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { navigateTo } from '@/navigation/navigateTo'
 import humanizeDuration from 'humanize-duration'
 import i18n from 'i18next'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+import { useSettingsDialog } from '@/features/settings/hook/useSettingsDialog'
+import { SettingsDialogExtendedKey } from '@/features/settings/type'

 const IDLE_DISCONNECT_TIMEOUT_MS = 120000 // 2 minutes
+const COUNTDOWN_ANNOUNCEMENT_SECONDS = [90, 60, 30]
+const FINAL_COUNTDOWN_SECONDS = 10

 export const IsIdleDisconnectModal = () => {
  const connectionObserverSnap = useSnapshot(connectionObserverStore)
  const [timeRemaining, setTimeRemaining] = useState(IDLE_DISCONNECT_TIMEOUT_MS)
+  const lastAnnouncementRef = useRef<number | null>(null)
+  const { openSettingsDialog } = useSettingsDialog()

  const { t } = useTranslation('rooms', { keyPrefix: 'isIdleDisconnectModal' })
+  const announce = useScreenReaderAnnounce()

  useEffect(() => {
    if (connectionObserverSnap.isIdleDisconnectModalOpen) {
@@ -35,10 +43,42 @@ export const IsIdleDisconnectModal = () => {
    }
  }, [connectionObserverSnap.isIdleDisconnectModalOpen])

-  const minutes = Math.floor(timeRemaining / 1000 / 60)
-  const seconds = (timeRemaining / 1000) % 60
+  useEffect(() => {
+    if (!connectionObserverSnap.isIdleDisconnectModalOpen) {
+      lastAnnouncementRef.current = null
+    }
+  }, [connectionObserverSnap.isIdleDisconnectModalOpen])
+
+  const remainingSeconds = Math.floor(timeRemaining / 1000)
+  const minutes = Math.floor(remainingSeconds / 60)
+  const seconds = remainingSeconds % 60
  const formattedTime = `${minutes}:${seconds.toString().padStart(2, '0')}`

+  useEffect(() => {
+    if (!connectionObserverSnap.isIdleDisconnectModalOpen) return
+
+    const shouldAnnounce =
+      COUNTDOWN_ANNOUNCEMENT_SECONDS.includes(remainingSeconds) ||
+      remainingSeconds <= FINAL_COUNTDOWN_SECONDS
+
+    if (shouldAnnounce && remainingSeconds !== lastAnnouncementRef.current) {
+      lastAnnouncementRef.current = remainingSeconds
+      const message = t('countdownAnnouncement', {
+        duration: humanizeDuration(remainingSeconds * 1000, {
+          language: i18n.language,
+          round: false,
+          largest: 2,
+        }),
+      })
+      announce(message, 'assertive', 'idle')
+    }
+  }, [
+    announce,
+    connectionObserverSnap.isIdleDisconnectModalOpen,
+    remainingSeconds,
+    t,
+  ])
+
  return (
    <Dialog
      isOpen={connectionObserverSnap.isIdleDisconnectModalOpen}
@@ -52,6 +92,7 @@ export const IsIdleDisconnectModal = () => {
      {({ close }) => {
        return (
          <div>
+            <ScreenReaderAnnouncer channel="idle" />
            <div
              className={css({
                height: '50px',
@@ -65,6 +106,7 @@ export const IsIdleDisconnectModal = () => {
                color: 'blue.800',
                margin: 'auto',
              })}
+              aria-hidden="true"
            >
              {formattedTime}
            </div>
@@ -78,7 +120,19 @@ export const IsIdleDisconnectModal = () => {
                }),
              })}
            </P>
-            <P>{t('settings')}</P>
+            <P>
+              {t('settingsPrefix')}{' '}
+              <A
+                color="primary"
+                onPress={() => {
+                  connectionObserverStore.isIdleDisconnectModalOpen = false
+                  openSettingsDialog(SettingsDialogExtendedKey.GENERAL)
+                }}
+              >
+                {t('settingsLink')}
+              </A>
+              {t('settingsSuffix')}
+            </P>
            <HStack marginTop="2rem">
              <Button
                onPress={() => {
@@ -117,7 +117,9 @@ export const ParticipantTile: (
    'aria-label': t('containerLabel', { name: participantName }),
    onFocus: (event: React.FocusEvent<HTMLDivElement>) => {
      elementProps.onFocus?.(event)
-      setHasKeyboardFocus(true)
+      const target = event.target as HTMLElement | null
+      const isFocusVisible = !!target?.matches?.(':focus-visible')
+      setHasKeyboardFocus(isFocusVisible)
    },
    onBlur: (event: React.FocusEvent<HTMLDivElement>) => {
      elementProps.onBlur?.(event)
@@ -5,6 +5,10 @@ import { css } from '@/styled-system/css'
 import { Participant } from 'livekit-client'
 import { useTranslation } from 'react-i18next'
 import { Reaction } from '@/features/rooms/livekit/components/controls/ReactionsToggle'
+import { getEmojiLabel } from '@/features/rooms/livekit/utils/reactionUtils'
+import { accessibilityStore } from '@/stores/accessibility'
+import { useSnapshot } from 'valtio'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 export const ANIMATION_DURATION = 3000
 export const ANIMATION_DISTANCE = 300
@@ -140,11 +144,41 @@ export function ReactionPortal({
  )
 }

-export const ReactionPortals = ({ reactions }: { reactions: Reaction[] }) =>
-  reactions.map((instance) => (
-    <ReactionPortal
-      key={instance.id}
-      emoji={instance.emoji}
-      participant={instance.participant}
-    />
-  ))
+export const ReactionPortals = ({ reactions }: { reactions: Reaction[] }) => {
+  const { t } = useTranslation('rooms', { keyPrefix: 'controls.reactions' })
+  const { announceReactions } = useSnapshot(accessibilityStore)
+  const [lastAnnouncedId, setLastAnnouncedId] = useState<number | null>(null)
+  const announce = useScreenReaderAnnounce()
+
+  const latestReaction =
+    reactions.length > 0 ? reactions[reactions.length - 1] : undefined
+
+  useEffect(() => {
+    if (!announceReactions) {
+      return
+    }
+    if (!latestReaction) return
+    const isNewReaction = latestReaction.id !== lastAnnouncedId
+    if (!isNewReaction) return
+
+    const emojiLabel = getEmojiLabel(latestReaction.emoji, t)
+    const participantName = latestReaction.participant?.isLocal
+      ? t('you')
+      : latestReaction.participant?.name?.trim() ||
+        t('someone', { defaultValue: 'Someone' })
+    announce(t('announce', { name: participantName, emoji: emojiLabel }))
+    setLastAnnouncedId(latestReaction.id)
+  }, [announce, latestReaction, lastAnnouncedId, announceReactions, t])
+
+  return (
+    <>
+      {reactions.map((instance) => (
+        <ReactionPortal
+          key={instance.id}
+          emoji={instance.emoji}
+          participant={instance.participant}
+        />
+      ))}
+    </>
+  )
+}
@@ -13,27 +13,32 @@ import { Effects } from './effects/Effects'
 import { Admin } from './Admin'
 import { Tools } from './Tools'
 import { Info } from './Info'
+import { HStack } from '@/styled-system/jsx'

 type StyledSidePanelProps = {
  title: string
+  ariaLabel: string
  children: ReactNode
  onClose: () => void
  isClosed: boolean
  closeButtonTooltip: string
  isSubmenu: boolean
  onBack: () => void
+  backButtonLabel: string
 }

 const StyledSidePanel = ({
  title,
+  ariaLabel,
  children,
  onClose,
  isClosed,
  closeButtonTooltip,
  isSubmenu = false,
  onBack,
+  backButtonLabel,
 }: StyledSidePanelProps) => (
-  <div
+  <aside
    className={css({
      borderWidth: '1px',
      borderStyle: 'solid',
@@ -58,32 +63,37 @@ const StyledSidePanel = ({
    style={{
      transform: isClosed ? 'translateX(calc(360px + 1.5rem))' : 'none',
    }}
+    aria-hidden={isClosed}
+    aria-label={ariaLabel}
  >
-    <Heading
-      slot="title"
-      level={1}
-      className={text({ variant: 'h2' })}
-      style={{
-        paddingLeft: '1.5rem',
-        paddingTop: '1rem',
-        display: isClosed ? 'none' : 'flex',
-        justifyContent: 'start',
-        alignItems: 'center',
-      }}
-    >
+    <HStack alignItems="center">
      {isSubmenu && (
        <Button
          variant="secondaryText"
-          size={'sm'}
+          size="sm"
          square
-          className={css({ marginRight: '0.5rem' })}
+          className={css({ marginRight: '0.5rem', marginLeft: '1rem' })}
+          aria-label={backButtonLabel}
          onPress={onBack}
        >
-          <RiArrowLeftLine size={20} />
+          <RiArrowLeftLine size={20} aria-hidden="true" />
        </Button>
      )}
-      {title}
-    </Heading>
+      <Heading
+        slot="title"
+        level={1}
+        className={text({ variant: 'h2' })}
+        style={{
+          paddingLeft: isSubmenu ? 0 : '1.5rem',
+          paddingTop: '1rem',
+          display: isClosed ? 'none' : 'flex',
+          justifyContent: 'start',
+          alignItems: 'center',
+        }}
+      >
+        {title}
+      </Heading>
+    </HStack>
    <Div
      position="absolute"
      top="5"
@@ -104,7 +114,7 @@ const StyledSidePanel = ({
      </Button>
    </Div>
    {children}
-  </div>
+  </aside>
 )

 type PanelProps = {
@@ -125,7 +135,6 @@ const Panel = ({ isOpen, keepAlive = false, children }: PanelProps) => (
    {keepAlive || isOpen ? children : null}
  </div>
 )
-
 export const SidePanel = () => {
  const {
    activePanelId,
@@ -144,6 +153,7 @@ export const SidePanel = () => {
  return (
    <StyledSidePanel
      title={t(`heading.${activeSubPanelId || activePanelId}`)}
+      ariaLabel={t('ariaLabel')}
      onClose={() => {
        layoutStore.activePanelId = null
        layoutStore.activeSubPanelId = null
@@ -153,6 +163,7 @@ export const SidePanel = () => {
      })}
      isClosed={!isSidePanelOpen}
      isSubmenu={isSubPanelOpen}
+      backButtonLabel={t('backToTools')}
      onBack={() => (layoutStore.activeSubPanelId = null)}
    >
      <Panel isOpen={isParticipantsOpen}>
@@ -164,7 +175,7 @@ export const SidePanel = () => {
      <Panel isOpen={isChatOpen} keepAlive={true}>
        <Chat />
      </Panel>
-      <Panel isOpen={isToolsOpen}>
+      <Panel isOpen={isToolsOpen} keepAlive={true}>
        <Tools />
      </Panel>
      <Panel isOpen={isAdminOpen}>
@@ -1,9 +1,10 @@
-import { A, Div, Text } from '@/primitives'
+import { A, Div, Icon, Text } from '@/primitives'
 import { css } from '@/styled-system/css'
 import { Button as RACButton } from 'react-aria-components'
 import { useTranslation } from 'react-i18next'
 import { ReactNode } from 'react'
 import { SubPanelId, useSidePanel } from '../hooks/useSidePanel'
+import { useRestoreFocus } from '@/hooks/useRestoreFocus'
 import {
  useIsRecordingModeEnabled,
  RecordingMode,
@@ -86,7 +87,7 @@ const ToolButton = ({
          alignItems: 'center',
        })}
      >
-        <span className="material-symbols">chevron_forward</span>
+        <Icon type="symbols" name="chevron_forward" />
      </div>
    </RACButton>
  )
@@ -94,10 +95,26 @@ const ToolButton = ({

 export const Tools = () => {
  const { data } = useConfig()
-  const { openTranscript, openScreenRecording, activeSubPanelId } =
+  const { openTranscript, openScreenRecording, activeSubPanelId, isToolsOpen } =
    useSidePanel()
  const { t } = useTranslation('rooms', { keyPrefix: 'moreTools' })

+  // Restore focus to the element that opened the Tools panel
+  // following the same pattern as Chat.
+  useRestoreFocus(isToolsOpen, {
+    // If the active element is a MenuItem (DIV) that will be unmounted when the menu closes,
+    // find the "more options" button ("Plus d'options") that opened the menu
+    resolveTrigger: (activeEl) => {
+      if (activeEl?.tagName === 'DIV') {
+        return document.querySelector<HTMLElement>('#room-options-trigger')
+      }
+      // For direct button clicks (e.g. "Plus d'outils"), use the active element as is
+      return activeEl
+    },
+    restoreFocusRaf: true,
+    preventScroll: true,
+  })
+
  const isTranscriptEnabled = useIsRecordingModeEnabled(
    RecordingMode.Transcript
  )
@@ -146,7 +163,7 @@ export const Tools = () => {
      </Text>
      {isTranscriptEnabled && (
        <ToolButton
-          icon={<span className="material-symbols">speech_to_text</span>}
+          icon={<Icon type="symbols" name="speech_to_text" />}
          title={t('tools.transcript.title')}
          description={t('tools.transcript.body')}
          onPress={() => openTranscript()}
@@ -154,7 +171,7 @@ export const Tools = () => {
      )}
      {isScreenRecordingEnabled && (
        <ToolButton
-          icon={<span className="material-symbols">mode_standby</span>}
+          icon={<Icon type="symbols" name="mode_standby" />}
          title={t('tools.screenRecording.title')}
          description={t('tools.screenRecording.body')}
          onPress={() => openScreenRecording()}
@@ -11,9 +11,7 @@ import {
  ProcessorType,
 } from '.'

-export class UnifiedBackgroundTrackProcessor
-  implements BackgroundProcessorInterface
-{
+export class UnifiedBackgroundTrackProcessor implements BackgroundProcessorInterface {
  processor: ProcessorWrapper<BackgroundOptions>
  opts: BackgroundOptions
  processorType: ProcessorType
@@ -13,8 +13,7 @@ export interface ProcessorSerialized {
  options: BackgroundOptions
 }

-export interface BackgroundProcessorInterface
-  extends TrackProcessor<Track.Kind> {
+export interface BackgroundProcessorInterface extends TrackProcessor<Track.Kind> {
  update(opts: BackgroundOptions): Promise<void>
  options: BackgroundOptions
  clone(): BackgroundProcessorInterface
@@ -6,6 +6,7 @@ import { ToggleButton } from '@/primitives'
 import { chatStore } from '@/stores/chat'
 import { useSidePanel } from '../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ChatToggle = ({
  onPress,
@@ -18,6 +19,11 @@ export const ChatToggle = ({
  const { isChatOpen, toggleChat } = useSidePanel()
  const tooltipLabel = isChatOpen ? 'open' : 'closed'

+  useRegisterKeyboardShortcut({
+    id: 'toggle-chat',
+    handler: toggleChat,
+  })
+
  return (
    <div
      className={css({
@@ -18,6 +18,7 @@ import { useCannotUseDevice } from '../../../hooks/useCannotUseDevice'
 import { useDeviceIcons } from '../../../hooks/useDeviceIcons'
 import { useDeviceShortcut } from '../../../hooks/useDeviceShortcut'
 import { ToggleSource, CaptureOptionsBySource } from '@livekit/components-core'
+import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'

 type ToggleDeviceStyleProps = {
  variant?: NonNullable<ButtonRecipeProps>['variant']
@@ -88,12 +89,14 @@ export const ToggleDevice = <T extends ToggleSource>({
  const deviceShortcut = useDeviceShortcut(kind)

  useRegisterKeyboardShortcut({
-    shortcut: deviceShortcut,
+    id: deviceShortcut?.id,
    handler: async () => await toggle(),
    isDisabled: cannotUseDevice,
  })
+
+  const pushToTalkShortcut = getShortcutDescriptorById('push-to-talk')
  useLongPress({
-    keyCode: kind === 'audioinput' ? 'KeyV' : undefined,
+    keyCode: kind === 'audioinput' ? pushToTalkShortcut?.code : undefined,
    onKeyDown,
    onKeyUp,
    isDisabled: cannotUseDevice,
@@ -103,7 +106,9 @@ export const ToggleDevice = <T extends ToggleSource>({
    const label = t(enabled ? 'disable' : 'enable', {
      keyPrefix: `selectDevice.${kind}`,
    })
-    return deviceShortcut ? appendShortcutLabel(label, deviceShortcut) : label
+    return deviceShortcut?.shortcut
+      ? appendShortcutLabel(label, deviceShortcut.shortcut)
+      : label
  }, [enabled, kind, deviceShortcut, t])

  const Icon =
@@ -9,6 +9,7 @@ import {
  closeLowerHandToasts,
  showLowerHandToast,
 } from '@/features/notifications/utils'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 const SPEAKING_DETECTION_DELAY = 3000

@@ -33,6 +34,16 @@ export const HandToggle = () => {
    closeLowerHandToasts()
  }, [isHandRaised])

+  const handleToggle = () => {
+    toggleRaisedHand()
+    resetToastState()
+  }
+
+  useRegisterKeyboardShortcut({
+    id: 'raise-hand',
+    handler: handleToggle,
+  })
+
  useEffect(() => {
    const shouldShowToast = isSpeaking && isHandRaised && !hasShownToast

@@ -68,10 +79,7 @@ export const HandToggle = () => {
        aria-label={t(tooltipLabel)}
        tooltip={t(tooltipLabel)}
        isSelected={isHandRaised}
-        onPress={() => {
-          toggleRaisedHand()
-          resetToastState()
-        }}
+        onPress={handleToggle}
        data-attr={`controls-hand-${tooltipLabel}`}
      >
        <RiHand />
@@ -9,6 +9,7 @@ export const OptionsButton = () => {
  return (
    <Menu variant="dark">
      <Button
+        id="room-options-trigger"
        square
        variant="primaryDark"
        aria-label={t('options.buttonLabel')}
@@ -1,10 +1,12 @@
 import { useTranslation } from 'react-i18next'
 import { RiGroupLine, RiInfinityLine } from '@remixicon/react'
 import { ToggleButton } from '@/primitives'
+import { VisualOnlyTooltip } from '@/primitives/VisualOnlyTooltip'
 import { css } from '@/styled-system/css'
 import { useParticipants } from '@livekit/components-react'
 import { useSidePanel } from '../../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ParticipantsToggle = ({
  onPress,
@@ -19,11 +21,18 @@ export const ParticipantsToggle = ({
   */
  const participants = useParticipants()
  const numParticipants = participants?.length
+  const announcedCount =
+    numParticipants && numParticipants > 0 ? numParticipants : 1

  const { isParticipantsOpen, toggleParticipants } = useSidePanel()

  const tooltipLabel = isParticipantsOpen ? 'open' : 'closed'

+  useRegisterKeyboardShortcut({
+    id: 'toggle-participants',
+    handler: toggleParticipants,
+  })
+
  return (
    <div
      className={css({
@@ -31,21 +40,24 @@ export const ParticipantsToggle = ({
        display: 'inline-block',
      })}
    >
-      <ToggleButton
-        square
-        variant="primaryTextDark"
-        aria-label={t(tooltipLabel)}
-        tooltip={t(tooltipLabel)}
-        isSelected={isParticipantsOpen}
-        onPress={(e) => {
-          toggleParticipants()
-          onPress?.(e)
-        }}
-        data-attr={`controls-participants-${tooltipLabel}`}
-        {...props}
-      >
-        <RiGroupLine />
-      </ToggleButton>
+      <VisualOnlyTooltip tooltip={t(tooltipLabel)}>
+        <ToggleButton
+          square
+          variant="primaryTextDark"
+          aria-label={`${t(tooltipLabel)}. ${t('count', {
+            count: announcedCount,
+          })}.`}
+          isSelected={isParticipantsOpen}
+          onPress={(e) => {
+            toggleParticipants()
+            onPress?.(e)
+          }}
+          data-attr={`controls-participants-${tooltipLabel}`}
+          {...props}
+        >
+          <RiGroupLine />
+        </ToggleButton>
+      </VisualOnlyTooltip>
      <div
        className={css({
          position: 'absolute',
@@ -1,6 +1,6 @@
 import { useTranslation } from 'react-i18next'
 import { RiEmotionLine } from '@remixicon/react'
-import { useState, useRef, useEffect } from 'react'
+import { useState, useRef } from 'react'
 import { css } from '@/styled-system/css'
 import { useRoomContext } from '@livekit/components-react'
 import { ToggleButton, Button } from '@/primitives'
@@ -10,7 +10,14 @@ import {
  ANIMATION_DURATION,
  ReactionPortals,
 } from '@/features/rooms/livekit/components/ReactionPortal'
-import { Toolbar as RACToolbar } from 'react-aria-components'
+import { getEmojiLabel } from '@/features/rooms/livekit/utils/reactionUtils'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import {
+  Popover as RACPopover,
+  Dialog,
+  DialogTrigger,
+} from 'react-aria-components'
+import { FocusScope } from '@react-aria/focus'
 import { Participant } from 'livekit-client'
 import useRateLimiter from '@/hooks/useRateLimiter'

@@ -38,7 +45,12 @@ export const ReactionsToggle = () => {
  const instanceIdRef = useRef(0)
  const room = useRoomContext()

-  const [isVisible, setIsVisible] = useState(false)
+  const [isOpen, setIsOpen] = useState(false)
+
+  useRegisterKeyboardShortcut({
+    id: 'reaction',
+    handler: () => setIsOpen((prev) => !prev),
+  })

  const sendReaction = async (emoji: string) => {
    const encoder = new TextEncoder()
@@ -72,100 +84,76 @@ export const ReactionsToggle = () => {
    windowMs: 1000,
  })

-  // Custom animation implementation for the emoji toolbar
-  // Could not use a menu and its animation, because a menu would make the toolbar inaccessible by keyboard
-  // animation isn't perfect
-  const [isRendered, setIsRendered] = useState(isVisible)
-  const [opacity, setOpacity] = useState(isVisible ? 1 : 0)
-
-  useEffect(() => {
-    if (isVisible) {
-      // Show: first render, then animate in
-      setIsRendered(true)
-      // Need to delay setting opacity to ensure CSS transition works
-      // (using requestAnimationFrame to ensure DOM has updated)
-      requestAnimationFrame(() => {
-        requestAnimationFrame(() => {
-          setOpacity(1)
-        })
-      })
-    } else if (isRendered) {
-      // Hide: first animate out, then unrender
-      setOpacity(0)
-
-      // Wait for animation to complete before removing from DOM
-      const timer = setTimeout(() => {
-        setIsRendered(false)
-      }, 200) // Match this to your animation duration
-      return () => clearTimeout(timer)
-    }
-  }, [isVisible, isRendered])
-
  return (
    <>
-      <div
-        className={css({
-          position: 'relative',
-        })}
-      >
-        <ToggleButton
-          square
-          variant="primaryDark"
-          aria-label={t('button')}
-          tooltip={t('button')}
-          onPress={() => setIsVisible(!isVisible)}
-        >
-          <RiEmotionLine />
-        </ToggleButton>
-        {isRendered && (
-          <div
+      <div className={css({ position: 'relative' })}>
+        <DialogTrigger isOpen={isOpen} onOpenChange={setIsOpen}>
+          <ToggleButton
+            square
+            variant="primaryDark"
+            aria-label={t('button')}
+            tooltip={t('button')}
+            isSelected={isOpen}
+            onChange={setIsOpen}
+          >
+            <RiEmotionLine />
+          </ToggleButton>
+          <RACPopover
+            placement="top"
+            offset={8}
+            isNonModal
+            shouldCloseOnInteractOutside={() => false}
            className={css({
-              position: 'absolute',
-              top: -63,
-              left: -162,
              borderRadius: '8px',
              padding: '0.35rem',
              backgroundColor: 'primaryDark.50',
-              opacity: opacity,
-              transition: 'opacity 0.2s ease',
+              '&[data-entering]': {
+                animation: 'fade 200ms ease',
+              },
+              '&[data-exiting]': {
+                animation: 'fade 200ms ease-in reverse',
+              },
            })}
-            onTransitionEnd={() => {
-              if (!isVisible) {
-                setIsRendered(false)
-              }
-            }}
          >
-            <RACToolbar
-              className={css({
-                display: 'flex',
-                gap: '0.5rem',
-              })}
-            >
-              {Object.values(Emoji).map((emoji, index) => (
-                <Button
-                  key={index}
-                  onPress={() => debouncedSendReaction(emoji)}
-                  aria-label={t('send', { emoji })}
-                  variant="primaryTextDark"
-                  size="sm"
-                  square
-                  data-attr={`send-reaction-${emoji}`}
+            <Dialog className={css({ outline: 'none' })}>
+              {/* eslint-disable-next-line jsx-a11y/no-autofocus -- FocusScope autoFocus is programmatic focus for overlays, not the HTML autofocus attribute */}
+              <FocusScope contain autoFocus restoreFocus>
+                <div
+                  role="toolbar"
+                  aria-orientation="horizontal"
+                  aria-label={t('button')}
+                  className={css({
+                    display: 'flex',
+                    gap: '0.5rem',
+                  })}
                >
-                  <img
-                    src={`/assets/reactions/${emoji}.png`}
-                    alt=""
-                    className={css({
-                      minHeight: '28px',
-                      minWidth: '28px',
-                      pointerEvents: 'none',
-                      userSelect: 'none',
-                    })}
-                  />
-                </Button>
-              ))}
-            </RACToolbar>
-          </div>
-        )}
+                  {Object.values(Emoji).map((emoji, index) => (
+                    <Button
+                      key={index}
+                      onPress={() => debouncedSendReaction(emoji)}
+                      aria-label={t('send', { emoji: getEmojiLabel(emoji, t) })}
+                      variant="primaryTextDark"
+                      size="sm"
+                      square
+                      data-attr={`send-reaction-${emoji}`}
+                    >
+                      <img
+                        src={`/assets/reactions/${emoji}.png`}
+                        alt=""
+                        className={css({
+                          width: '28px',
+                          height: '28px',
+                          pointerEvents: 'none',
+                          userSelect: 'none',
+                        })}
+                      />
+                    </Button>
+                  ))}
+                </div>
+              </FocusScope>
+            </Dialog>
+          </RACPopover>
+        </DialogTrigger>
      </div>
      <ReactionPortals reactions={reactions} />
    </>
@@ -6,8 +6,7 @@ import {
 import React from 'react'

 /** @public */
-export interface AllowMediaPlaybackProps
-  extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+export interface AllowMediaPlaybackProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
  label?: string
 }

@@ -9,15 +9,16 @@ import {
 } from '../blur'
 import { css } from '@/styled-system/css'
 import { H, P, Text, ToggleButton } from '@/primitives'
+import { VisualOnlyTooltip } from '@/primitives/VisualOnlyTooltip'
 import { styled } from '@/styled-system/jsx'
 import { BlurOn } from '@/components/icons/BlurOn'
 import { BlurOnStrong } from '@/components/icons/BlurOnStrong'
 import { useTrackToggle } from '@livekit/components-react'
 import { Loader } from '@/primitives/Loader'
 import { useSyncAfterDelay } from '@/hooks/useSyncAfterDelay'
-import { RiProhibited2Line } from '@remixicon/react'
 import { FunnyEffects } from './FunnyEffects'
 import { useHasFunnyEffectsAccess } from '../../hooks/useHasFunnyEffectsAccess'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 enum BlurRadius {
  NONE = 0,
@@ -50,11 +51,17 @@ export const EffectsConfiguration = ({
  layout = 'horizontal',
 }: EffectsConfigurationProps) => {
  const videoRef = useRef<HTMLVideoElement>(null)
+  const blurLightRef = useRef<HTMLButtonElement | null>(null)
  const { t } = useTranslation('rooms', { keyPrefix: 'effects' })
  const { toggle, enabled } = useTrackToggle({ source: Track.Source.Camera })
  const [processorPending, setProcessorPending] = useState(false)
  const processorPendingReveal = useSyncAfterDelay(processorPending)
  const hasFunnyEffectsAccess = useHasFunnyEffectsAccess()
+  const announce = useScreenReaderAnnounce()
+  const effectAnnouncementTimeout = useRef<ReturnType<
+    typeof setTimeout
+  > | null>(null)
+  const effectAnnouncementId = useRef(0)

  useEffect(() => {
    const videoElement = videoRef.current
@@ -69,16 +76,92 @@ export const EffectsConfiguration = ({
    }
  }, [videoTrack, videoTrack?.isMuted])

+  useEffect(() => {
+    if (!blurLightRef.current) return
+
+    const rafId = requestAnimationFrame(() => {
+      blurLightRef.current?.focus({ preventScroll: true })
+    })
+
+    return () => {
+      cancelAnimationFrame(rafId)
+    }
+  }, [])
+
+  useEffect(
+    () => () => {
+      if (effectAnnouncementTimeout.current) {
+        clearTimeout(effectAnnouncementTimeout.current)
+      }
+    },
+    []
+  )
+
+  const announceEffectStatusMessage = (message: string) => {
+    effectAnnouncementId.current += 1
+    const currentId = effectAnnouncementId.current
+
+    if (effectAnnouncementTimeout.current) {
+      clearTimeout(effectAnnouncementTimeout.current)
+    }
+
+    effectAnnouncementTimeout.current = setTimeout(() => {
+      if (currentId !== effectAnnouncementId.current) return
+      announce(message)
+    }, 80)
+  }
+
  const clearEffect = async () => {
    await videoTrack.stopProcessor()
    onSubmit?.(undefined)
  }

+  const getVirtualBackgroundName = (imagePath?: string) => {
+    if (!imagePath) return ''
+    const match = imagePath.match(/\/backgrounds\/(\d+)\.jpg$/)
+    if (!match) return ''
+    const index = Number(match[1]) - 1
+    if (Number.isNaN(index)) return ''
+    return t(`virtual.descriptions.${index}`)
+  }
+
+  const updateEffectStatusMessage = (
+    type: ProcessorType,
+    options: BackgroundOptions,
+    wasSelectedBeforeToggle: boolean
+  ) => {
+    if (wasSelectedBeforeToggle) {
+      announceEffectStatusMessage(t('blur.status.none'))
+      return
+    }
+
+    if (type === ProcessorType.BLUR) {
+      const message =
+        options.blurRadius === BlurRadius.LIGHT
+          ? t('blur.status.light')
+          : t('blur.status.strong')
+      announceEffectStatusMessage(message)
+      return
+    }
+
+    if (type === ProcessorType.VIRTUAL) {
+      const backgroundName = getVirtualBackgroundName(options.imagePath)
+      if (backgroundName) {
+        announceEffectStatusMessage(
+          `${t('virtual.selectedLabel')} ${backgroundName}`
+        )
+        return
+      }
+    }
+  }
+
  const toggleEffect = async (
    type: ProcessorType,
    options: BackgroundOptions
  ) => {
    setProcessorPending(true)
+    const wasSelectedBeforeToggle = isSelected(type, options)
+
    if (!videoTrack) {
      /**
       * Special case: if no video track is available, then we must pass directly the processor into the
@@ -104,7 +187,7 @@ export const EffectsConfiguration = ({

    const processor = getProcessor()
    try {
-      if (isSelected(type, options)) {
+      if (wasSelectedBeforeToggle) {
        // Stop processor.
        await clearEffect()
      } else if (
@@ -131,6 +214,8 @@ export const EffectsConfiguration = ({
        // We want to trigger onSubmit when options changes so the parent component is aware of it.
        onSubmit?.(processor)
      }
+
+      updateEffectStatusMessage(type, options, wasSelectedBeforeToggle)
    } catch (error) {
      console.error('Error applying effect:', error)
    } finally {
@@ -153,8 +238,28 @@ export const EffectsConfiguration = ({
    )
  }

-  const tooltipLabel = (type: ProcessorType, options: BackgroundOptions) => {
-    return t(`${type}.${isSelected(type, options) ? 'clear' : 'apply'}`)
+  const tooltipBlur = (type: ProcessorType, options: BackgroundOptions) => {
+    const strength =
+      options.blurRadius === BlurRadius.LIGHT ? 'light' : 'normal'
+    const action = isSelected(type, options) ? 'clear' : 'apply'
+
+    return t(`${type}.${strength}.${action}`)
+  }
+
+  const ariaLabelVirtualBackground = (
+    index: number,
+    imagePath: string
+  ): string => {
+    const isSelectedBackground = isSelected(ProcessorType.VIRTUAL, {
+      imagePath,
+    })
+    const prefix = isSelectedBackground ? 'selectedLabel' : 'apply'
+    const backgroundName = t(`virtual.descriptions.${index}`)
+    return `${t(`virtual.${prefix}`)} ${backgroundName}`
+  }
+
+  const tooltipVirtualBackground = (index: number): string => {
+    return t(`virtual.descriptions.${index}`)
  }

  return (
@@ -265,65 +370,57 @@ export const EffectsConfiguration = ({
              >
                {t('blur.title')}
              </H>
-              <div
-                className={css({
-                  display: 'flex',
-                  gap: '1.25rem',
-                })}
-              >
-                <ToggleButton
-                  variant="bigSquare"
-                  aria-label={t('clear')}
-                  onPress={async () => {
-                    await clearEffect()
-                  }}
-                  isSelected={!getProcessor()}
-                  isDisabled={processorPendingReveal || isDisabled}
+              <div>
+                <div
+                  className={css({
+                    display: 'flex',
+                    gap: '1.25rem',
+                  })}
                >
-                  <RiProhibited2Line />
-                </ToggleButton>
-                <ToggleButton
-                  variant="bigSquare"
-                  aria-label={tooltipLabel(ProcessorType.BLUR, {
-                    blurRadius: BlurRadius.LIGHT,
-                  })}
-                  tooltip={tooltipLabel(ProcessorType.BLUR, {
-                    blurRadius: BlurRadius.LIGHT,
-                  })}
-                  isDisabled={processorPendingReveal || isDisabled}
-                  onChange={async () =>
-                    await toggleEffect(ProcessorType.BLUR, {
+                  <ToggleButton
+                    ref={blurLightRef}
+                    variant="bigSquare"
+                    aria-label={tooltipBlur(ProcessorType.BLUR, {
                      blurRadius: BlurRadius.LIGHT,
-                    })
-                  }
-                  isSelected={isSelected(ProcessorType.BLUR, {
-                    blurRadius: BlurRadius.LIGHT,
-                  })}
-                  data-attr="toggle-blur-light"
-                >
-                  <BlurOn />
-                </ToggleButton>
-                <ToggleButton
-                  variant="bigSquare"
-                  aria-label={tooltipLabel(ProcessorType.BLUR, {
-                    blurRadius: BlurRadius.NORMAL,
-                  })}
-                  tooltip={tooltipLabel(ProcessorType.BLUR, {
-                    blurRadius: BlurRadius.NORMAL,
-                  })}
-                  isDisabled={processorPendingReveal || isDisabled}
-                  onChange={async () =>
-                    await toggleEffect(ProcessorType.BLUR, {
+                    })}
+                    tooltip={tooltipBlur(ProcessorType.BLUR, {
+                      blurRadius: BlurRadius.LIGHT,
+                    })}
+                    isDisabled={processorPendingReveal || isDisabled}
+                    onChange={async () =>
+                      await toggleEffect(ProcessorType.BLUR, {
+                        blurRadius: BlurRadius.LIGHT,
+                      })
+                    }
+                    isSelected={isSelected(ProcessorType.BLUR, {
+                      blurRadius: BlurRadius.LIGHT,
+                    })}
+                    data-attr="toggle-blur-light"
+                  >
+                    <BlurOn />
+                  </ToggleButton>
+                  <ToggleButton
+                    variant="bigSquare"
+                    aria-label={tooltipBlur(ProcessorType.BLUR, {
                      blurRadius: BlurRadius.NORMAL,
-                    })
-                  }
-                  isSelected={isSelected(ProcessorType.BLUR, {
-                    blurRadius: BlurRadius.NORMAL,
-                  })}
-                  data-attr="toggle-blur-normal"
-                >
-                  <BlurOnStrong />
-                </ToggleButton>
+                    })}
+                    tooltip={tooltipBlur(ProcessorType.BLUR, {
+                      blurRadius: BlurRadius.NORMAL,
+                    })}
+                    isDisabled={processorPendingReveal || isDisabled}
+                    onChange={async () =>
+                      await toggleEffect(ProcessorType.BLUR, {
+                        blurRadius: BlurRadius.NORMAL,
+                      })
+                    }
+                    isSelected={isSelected(ProcessorType.BLUR, {
+                      blurRadius: BlurRadius.NORMAL,
+                    })}
+                    data-attr="toggle-blur-normal"
+                  >
+                    <BlurOnStrong />
+                  </ToggleButton>
+                </div>
              </div>
              <div
                className={css({
@@ -343,39 +440,37 @@ export const EffectsConfiguration = ({
                  className={css({
                    display: 'flex',
                    gap: '1.25rem',
+                    paddingBottom: '0.5rem',
                    flexWrap: 'wrap',
                  })}
                >
                  {[...Array(8).keys()].map((i) => {
                    const imagePath = `/assets/backgrounds/${i + 1}.jpg`
                    const thumbnailPath = `/assets/backgrounds/thumbnails/${i + 1}.jpg`
+                    const tooltipText = tooltipVirtualBackground(i)
                    return (
-                      <ToggleButton
-                        key={i}
-                        variant="bigSquare"
-                        aria-label={tooltipLabel(ProcessorType.VIRTUAL, {
-                          imagePath,
-                        })}
-                        tooltip={tooltipLabel(ProcessorType.VIRTUAL, {
-                          imagePath,
-                        })}
-                        isDisabled={processorPendingReveal || isDisabled}
-                        onChange={async () =>
-                          await toggleEffect(ProcessorType.VIRTUAL, {
+                      <VisualOnlyTooltip key={i} tooltip={tooltipText}>
+                        <ToggleButton
+                          variant="bigSquare"
+                          aria-label={ariaLabelVirtualBackground(i, imagePath)}
+                          isDisabled={processorPendingReveal || isDisabled}
+                          onChange={async () =>
+                            await toggleEffect(ProcessorType.VIRTUAL, {
+                              imagePath,
+                            })
+                          }
+                          isSelected={isSelected(ProcessorType.VIRTUAL, {
                            imagePath,
-                          })
-                        }
-                        isSelected={isSelected(ProcessorType.VIRTUAL, {
-                          imagePath,
-                        })}
-                        className={css({
-                          bgSize: 'cover',
-                        })}
-                        style={{
-                          backgroundImage: `url(${thumbnailPath})`,
-                        }}
-                        data-attr={`toggle-virtual-${i}`}
-                      />
+                          })}
+                          className={css({
+                            bgSize: 'cover',
+                          })}
+                          style={{
+                            backgroundImage: `url(${thumbnailPath})`,
+                          }}
+                          data-attr={`toggle-virtual-${i}`}
+                        />
+                      </VisualOnlyTooltip>
                    )
                  })}
                </div>
@@ -11,8 +11,7 @@ const ASPECT_RATIO = 16 / 10
 const ASPECT_RATIO_INVERT = (1 - ASPECT_RATIO) * -1

 /** @public */
-export interface CarouselLayoutProps
-  extends React.HTMLAttributes<HTMLMediaElement> {
+export interface CarouselLayoutProps extends React.HTMLAttributes<HTMLMediaElement> {
  tracks: TrackReferenceOrPlaceholder[]
  children: React.ReactNode
  /** Place the tiles vertically or horizontally next to each other.
@@ -13,7 +13,8 @@ import { PaginationControl } from '../controls/PaginationControl'

 /** @public */
 export interface GridLayoutProps
-  extends React.HTMLAttributes<HTMLDivElement>,
+  extends
+    React.HTMLAttributes<HTMLDivElement>,
    Pick<UseParticipantsOptions, 'updateOnlyOn'> {
  children: React.ReactNode
  tracks: TrackReferenceOrPlaceholder[]
@@ -12,6 +12,6 @@ export function useCanPublishTrack(trackSource: TrackSource): boolean {

  return Boolean(
    permissions?.canPublish &&
-      permissions?.canPublishSources?.includes(trackSource)
+    permissions?.canPublishSources?.includes(trackSource)
  )
 }
@@ -1,19 +1,16 @@
 import { useMemo } from 'react'
-import { Shortcut } from '@/features/shortcuts/types'
+import {
+  getShortcutDescriptorById,
+  ShortcutDescriptor,
+} from '@/features/shortcuts/catalog'

 export const useDeviceShortcut = (kind: MediaDeviceKind) => {
-  return useMemo<Shortcut | undefined>(() => {
+  return useMemo<ShortcutDescriptor | undefined>(() => {
    switch (kind) {
      case 'audioinput':
-        return {
-          key: 'd',
-          ctrlKey: true,
-        }
+        return getShortcutDescriptorById('toggle-microphone')
      case 'videoinput':
-        return {
-          key: 'e',
-          ctrlKey: true,
-        }
+        return getShortcutDescriptorById('toggle-camera')
      default:
        return undefined
    }
@@ -1,5 +1,5 @@
 import type { ChatMessage, ChatOptions } from '@livekit/components-core'
-import React, { useEffect } from 'react'
+import React from 'react'
 import {
  formatChatMessageLinks,
  useChat,
@@ -15,10 +15,10 @@ import { ChatEntry } from '../components/chat/Entry'
 import { useSidePanel } from '../hooks/useSidePanel'
 import { LocalParticipant, RemoteParticipant, RoomEvent } from 'livekit-client'
 import { css } from '@/styled-system/css'
+import { useRestoreFocus } from '@/hooks/useRestoreFocus'

 export interface ChatProps
-  extends React.HTMLAttributes<HTMLDivElement>,
-    ChatOptions {}
+  extends React.HTMLAttributes<HTMLDivElement>, ChatOptions {}

 /**
 * The Chat component adds a basis chat functionality to the LiveKit room. The messages are distributed to all participants
@@ -38,33 +38,16 @@ export function Chat({ ...props }: ChatProps) {

  // Keep track of the element that opened the chat so we can restore focus
  // when the chat panel is closed.
-  const prevIsChatOpenRef = React.useRef(false)
-  const chatTriggerRef = React.useRef<HTMLElement | null>(null)
-
-  useEffect(() => {
-    const wasChatOpen = prevIsChatOpenRef.current
-    const isChatPanelOpen = isChatOpen
-
-    // Chat just opened
-    if (!wasChatOpen && isChatPanelOpen) {
-      chatTriggerRef.current = document.activeElement as HTMLElement | null
-      // Avoid layout "jump" during the side panel slide-in animation.
-      // Focusing can trigger scroll into view; preventScroll keeps the animation smooth.
+  useRestoreFocus(isChatOpen, {
+    // Avoid layout "jump" during the side panel slide-in animation.
+    // Focusing can trigger scroll into view; preventScroll keeps the animation smooth.
+    onOpened: () => {
      requestAnimationFrame(() => {
        inputRef.current?.focus({ preventScroll: true })
      })
-    }
-    // Chat just closed
-    if (wasChatOpen && !isChatPanelOpen) {
-      const trigger = chatTriggerRef.current
-      if (trigger && document.contains(trigger)) {
-        trigger.focus({ preventScroll: true })
-      }
-      chatTriggerRef.current = null
-    }
-
-    prevIsChatOpenRef.current = isChatPanelOpen
-  }, [isChatOpen])
+    },
+    preventScroll: true,
+  })

  // Use useParticipants hook to trigger a re-render when the participant list changes.
  const participants = useParticipants()
@@ -22,7 +22,7 @@ export function DesktopControlBar({
  const desktopControlBarEl = useRef<HTMLDivElement>(null)

  useRegisterKeyboardShortcut({
-    shortcut: { key: 'F2' },
+    id: 'focus-toolbar',
    handler: () => {
      const root = desktopControlBarEl.current
      if (!root) return
@@ -73,6 +73,7 @@ export function MobileControlBar({
          />
          <HandToggle />
          <Button
+            id="room-options-trigger"
            square
            variant="primaryDark"
            aria-label={t('options.buttonLabel')}
@@ -37,6 +37,7 @@ export const LateralMenu = () => {
  return (
    <DialogTrigger isOpen={isOpen} onOpenChange={setIsOpen}>
      <Button
+        id="controlbar-more-options-trigger"
        square
        variant="secondaryDark"
        aria-label={t('controls.moreOptions')}
--- a/Show More
+++ b/Show More