🔒️(backend) add application validation when consuming external JWT

Token generation already verifies that the application is active, but this guarantee was not enforced when the token was used. This change adds a runtime check to ensure the client_id claim matches an existing and active application when evaluating permissions. This also introduces an emergency revocation mechanism, allowing all previously issued tokens for a given application to be invalidated if the application is disabled.
2026-02-09 13:56:15 +01:00
38 changed files with 64 additions and 577 deletions
@@ -8,21 +8,6 @@ and this project adheres to

 ## [Unreleased]

-### Added
-
- ✨(frontend) expose Windows app web link #976
-
-### Changed
-
- ✨(frontend) add clickable settings general link in idle modal #974
-
-## [1.6.0] - 2026-02-10
-
-### Added
-
- ✨(backend) monitor throttling rate failure through sentry #964
- 🚀(paas) add PaaS deployment scripts, tested on Scalingo #957
-
 ### Changed

 - ♿️(frontend) improve spinner reduced‑motion fallback #931
@@ -1,2 +0,0 @@
-web: bin/buildpack_start.sh
-postdeploy: python manage.py migrate
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-set -o errexit    # always exit on error
-set -o pipefail   # don't ignore exit codes when piping output
-
-echo "-----> Running post-compile script"
-
-# Cleanup
-rm -rf docker docs env.d gitlint
@@ -1,50 +0,0 @@
-#!/bin/bash
-
-set -o errexit    # always exit on error
-set -o pipefail   # don't ignore exit codes when piping output
-
-echo "-----> Running post-frontend script"
-
-# Move the frontend build to the nginx root and clean up
-mkdir -p build/
-mv src/frontend/dist build/frontend-out
-
-ASSETS_DIR=build/frontend-out/assets
-if [ -n "$CUSTOM_LOGO_URL" ]; then
-    # Ensure https
-    [[ ! "$CUSTOM_LOGO_URL" =~ ^https:// ]] && echo "[custom-logo] ERROR: URL must use HTTPS" >&2 && exit 1
-
-    # Prevent SSRF
-    HOSTNAME=$(echo "$CUSTOM_LOGO_URL" | sed -E 's|^https://([^/:]+).*|\1|')
-    [[ "$HOSTNAME" =~ ^(localhost|127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|0\.0\.0\.0|\[::1\]) ]] && echo "[custom-logo] ERROR: SSRF blocked: $HOSTNAME" >&2 && exit 1
-
-    LOGO_FILE="${ASSETS_DIR}/logo.svg"
-    TMP_FILE=$(mktemp "${LOGO_FILE}.XXXXXX.tmp")
-
-    # Actual download
-    echo "[custom-logo] INFO: Downloading custom logo from: $CUSTOM_LOGO_URL"
-    curl -fsSL --tlsv1.2 -o "$TMP_FILE" "$CUSTOM_LOGO_URL"
-
-    # Validate filesize
-    FILESIZE=$(stat -c%s "$TMP_FILE" 2>/dev/null || stat -f%z "$TMP_FILE")
-    [[ "$FILESIZE" -eq 0 ]] && echo "[custom-logo] ERROR: empty file" >&2 && exit 1
-    [[ "$FILESIZE" -gt 5242880 ]] && echo "[custom-logo] ERROR: file too large (${FILESIZE}B > 5MB)" >&2 && exit 1
-
-    # Validate file type
-    IS_SVG=false
-
-    HEADER=$(head -c 100 "$TMP_FILE" | tr -d '\0' | tr '[:upper:]' '[:lower:]')
-    [[ "$HEADER" =~ ^.*"<svg".*$ ]] && IS_SVG=true
-    [[ "$HEADER" =~ ^.*"<?xml".*"<svg".*$ ]] && IS_SVG=true
-
-    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
-
-    mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
-fi
-
-mv src/backend/* ./
-mv deploy/paas/* ./
-
-echo "3.13" > .python-version
-echo "." > requirements.txt
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-# Start the Django backend server
-gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
-
-# Start the Nginx server
-bin/run &
-
-# if the current shell is killed, also terminate all its children     
-trap "pkill SIGTERM -P $$" SIGTERM
-
-# wait for a single child to finish,
-wait -n
-# then kill all the other tasks
-pkill -P $$
@@ -1,52 +0,0 @@
-# ERB templated nginx configuration
-# see https://doc.scalingo.com/platform/deployment/buildpacks/nginx
-
-upstream backend_server {
-	server localhost:8000 fail_timeout=0;
-}
-
-server {
-  listen <%= ENV["PORT"] %>;
-  server_name _;
-  server_tokens off;
-
-  root /app/build/frontend-out;
-
-  # Django rest framework
-  location ^~ /api/ {
-      proxy_set_header X-Forwarded-Proto https;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-      proxy_redirect off;
-      proxy_pass http://backend_server;
-  }
-
-  # Django admin
-  location ^~ /admin/ {
-      proxy_set_header X-Forwarded-Proto https;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-      proxy_redirect off;
-      proxy_pass http://backend_server;
-  }
-
-  # Serve static files with caching
-  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
-      expires 30d;
-      add_header Cache-Control "public, max-age=2592000";
-  }
-
-  # Serve static files
-  location / {
-      try_files $uri $uri/ /index.html;
-      # Add no-cache headers
-      add_header Cache-Control "no-cache, no-store, must-revalidate";
-      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
-      add_header Expires 0;
-  }
-
-  # Optionally, handle 404 errors by redirecting to index.html
-  error_page 404 =200 /index.html;
-}
@@ -9,10 +9,6 @@ La Suite Meet maintainers use only the Kubernetes deployment method in productio
 We understand that not everyone has a Kubernetes cluster available, please follow the instructions provided [here](/docs/installation/compose.md) to set up a docker compose instance.
 We also provide [Docker images](https://hub.docker.com/u/lasuite?page=1&search=meet) that can be deployed using Compose.

-## Scalingo
-
-La Suite Meet can be deployed on Scalingo PaaS using the Suite Numérique buildpack. See the [Scalingo deployment guide](./scalingo.md) for detailed instructions.
-
 ## Other ways to install La Suite Meet
 Community members have contributed alternative ways to install La Suite Meet 🙏. While maintainers may not provide direct support, we help keep these instructions up to date, and you can reach out to contributors or the community for assistance.

@@ -1,185 +0,0 @@
-# Deployment on Scalingo
-
-This guide explains how to deploy La Suite Meet on [Scalingo](https://scalingo.com/) using the [Suite Numérique buildpack](https://github.com/suitenumerique/buildpack).
-
-## Overview
-
-Scalingo is a Platform-as-a-Service (PaaS) that simplifies application deployment. This setup uses a custom buildpack to handle both the frontend (Vite) and backend (Django) builds, serving them through Nginx.
-
-## Prerequisites
-
- A Scalingo account
- Scalingo CLI installed (optional but recommended)
- A PostgreSQL database addon
- A Redis addon (for caching and sessions)
-
-## Step 1: Create Your App
-
-Create a new app on Scalingo using `scalingo` cli or using the [Scalingo dashboard](https://dashboard.scalingo.com/).
-
-## Step 2: Provision Addons
-
-Add the required PostgreSQL and Redis services.
-
-This will set the following environment variables automatically:
- `SCALINGO_POSTGRESQL_URL` - Database connection string
- `SCALINGO_REDIS_URL` - Redis connection string
-
-## Step 3: Configure Environment Variables
-
-Set the following environment variables in your Scalingo app:
-
-### Buildpack Configuration
-
-```bash
-scalingo env-set BUILDBACK_URL="https://github.com/suitenumerique/buildpack#main"
-scalingo env-set LASUITE_APP_NAME="meet"
-scalingo env-set LASUITE_BACKEND_DIR="."
-scalingo env-set LASUITE_FRONTEND_DIR="src/frontend/"
-scalingo env-set LASUITE_NGINX_DIR="."
-scalingo env-set LASUITE_SCRIPT_POSTCOMPILE="bin/buildpack_postcompile.sh"
-scalingo env-set LASUITE_SCRIPT_POSTFRONTEND="bin/buildpack_postfrontend.sh"
-```
-
-### Database and Cache
-
-```bash
-scalingo env-set DATABASE_URL="\$SCALINGO_POSTGRESQL_URL"
-scalingo env-set REDIS_URL="\$SCALINGO_REDIS_URL"
-```
-
-### Django Settings
-
-```bash
-scalingo env-set DJANGO_SETTINGS_MODULE="meet.settings"
-scalingo env-set DJANGO_CONFIGURATION="Production"
-scalingo env-set DJANGO_SECRET_KEY="<generate-a-secure-secret-key>"
-scalingo env-set DJANGO_ALLOWED_HOSTS="my-meet-app.osc-fr1.scalingo.io"
-```
-
-### OIDC Authentication
-
-Configure your OIDC provider (e.g., Keycloak, Authentik):
-
-```bash
-scalingo env-set OIDC_OP_BASE_URL="https://auth.yourdomain.com/realms/meet"
-scalingo env-set OIDC_RP_CLIENT_ID="meet-client-id"
-scalingo env-set OIDC_RP_CLIENT_SECRET="<your-client-secret>"
-scalingo env-set OIDC_RP_SIGN_ALGO="RS256"
-```
-
-### LiveKit Configuration
-
-Meet requires a LiveKit server for video conferencing:
-
-```bash
-scalingo env-set LIVEKIT_API_URL="wss://livekit.yourdomain.com"
-scalingo env-set LIVEKIT_API_KEY="<your-livekit-api-key>"
-scalingo env-set LIVEKIT_API_SECRET="<your-livekit-api-secret>"
-```
-
-### Email Configuration (Optional)
-
-For email notifications see https://doc.scalingo.com/platform/app/sending-emails:
-
-```bash
-scalingo env-set DJANGO_EMAIL_HOST="smtp.example.org"
-scalingo env-set DJANGO_EMAIL_PORT="587"
-scalingo env-set DJANGO_EMAIL_HOST_USER="<smtp-user>"
-scalingo env-set DJANGO_EMAIL_HOST_PASSWORD="<smtp-password>"
-scalingo env-set DJANGO_EMAIL_USE_TLS="True"
-scalingo env-set DJANGO_EMAIL_FROM="meet@yourdomain.com"
-```
-
-## Step 4: Deploy
-
-Deploy your application:
-
-```bash
-git push scalingo main
-```
-
-The Procfile will automatically:
-1. Build the frontend (Vite)
-2. Build the backend (Django)
-3. Run the post-compile script (cleanup)
-4. Run the post-frontend script (move assets and prepare for deployment)
-5. Start Nginx and Gunicorn
-6. Run django migrations
-
-## Step 5: Create superuser
-
-After the first deployment, create an admin user:
-
-```bash
-scalingo run python manage.py createsuperuser
-```
-
-## Custom Domain (Optional)
-
-To use a custom domain:
-
-1. Add the domain in Scalingo dashboard
-2. Update `DJANGO_ALLOWED_HOSTS` with your custom domain
-3. Configure your DNS to point to Scalingo
-
-```bash
-scalingo domains-add meet.yourdomain.com
-scalingo env-set DJANGO_ALLOWED_HOSTS="meet.yourdomain.com,my-meet-app.osc-fr1.scalingo.io"
-```
-
-## Custom Logo (Optional)
-
-To use a custom logo, set the `CUSTOM_LOGO_URL` environment variable with an HTTPS URL pointing to an SVG item (max 5MB):
-
-```bash
-scalingo env-set CUSTOM_LOGO_URL="https://cdn.yourdomain.com/logo.svg"
-```
-
-## Troubleshooting
-
-### Check Logs
-
-```bash
-scalingo logs --tail
-```
-
-### Common Issues
-
-1. **Build fails**: Check that all required environment variables are set
-2. **Database connection error**: Verify `DATABASE_URL` is correctly set to `$SCALINGO_POSTGRESQL_URL`
-3. **Static files not served**: Ensure the buildpack post-frontend script ran successfully
-4. **OIDC errors**: Verify your OIDC provider configuration and callback URLs
-
-### Useful Commands
-
-```bash
-# Open a console
-scalingo run bash
-
-# Restart the app
-scalingo restart
-
-# Scale containers
-scalingo scale web:2
-
-# One-off command
-scalingo run python manage.py shell
-```
-
-## Architecture
-
-On Scalingo, the application runs as follows:
-
-1. **Build Phase**: The buildpack compiles both frontend and backend
-2. **Runtime**:
-   - Nginx serves static files and proxies to the backend
-   - Gunicorn runs the Django WSGI application
-   - Both processes are managed by the `bin/buildpack_start.sh` script
-
-## Additional Resources
-
- [Scalingo Documentation](https://doc.scalingo.com/)
- [Suite Numérique Buildpack](https://github.com/suitenumerique/buildpack)
- [Meet Environment Variables](../../src/helm/meet/README.md)
- [Django Configurations Documentation](https://django-configurations.readthedocs.io/)
@@ -1,7 +1,7 @@

 [project]
 name = "agents"
-version = "1.6.0"
+version = "1.5.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.3.10",
@@ -1,26 +0,0 @@
-"""Throttling modules for the API."""
-
-from lasuite.drf.throttling import MonitoredThrottleMixin
-from rest_framework.throttling import AnonRateThrottle
-from sentry_sdk import capture_message
-
-
-def sentry_monitoring_throttle_failure(message):
-    """Log when a failure occurs to detect rate limiting issues."""
-    capture_message(message, "warning")
-
-
-class MonitoredAnonRateThrottle(MonitoredThrottleMixin, AnonRateThrottle):
-    """Throttle for the monitored scoped rate throttle."""
-
-
-class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle Anonymous user requesting room entry"""
-
-    scope = "request_entry"
-
-
-class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle Anonymous user requesting room generation callback"""
-
-    scope = "creation_callback"
@@ -10,7 +10,7 @@ from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.text import slugify

-from rest_framework import decorators, mixins, pagination, viewsets
+from rest_framework import decorators, mixins, pagination, throttling, viewsets
 from rest_framework import (
    exceptions as drf_exceptions,
 )
@@ -58,7 +58,7 @@ from core.services.room_creation import RoomCreation
 from core.services.subtitle import SubtitleException, SubtitleService

 from ..authentication.livekit import LiveKitTokenAuthentication
-from . import permissions, serializers, throttling
+from . import permissions, serializers
 from .feature_flag import FeatureFlag

 # pylint: disable=too-many-ancestors
@@ -191,6 +191,18 @@ class UserViewSet(
        )


+class RequestEntryAnonRateThrottle(throttling.AnonRateThrottle):
+    """Throttle Anonymous user requesting room entry"""
+
+    scope = "request_entry"
+
+
+class CreationCallbackAnonRateThrottle(throttling.AnonRateThrottle):
+    """Throttle Anonymous user requesting room generation callback"""
+
+    scope = "creation_callback"
+
+
 class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.DestroyModelMixin,
@@ -367,7 +379,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="request-entry",
        permission_classes=[],
-        throttle_classes=[throttling.RequestEntryAnonRateThrottle],
+        throttle_classes=[RequestEntryAnonRateThrottle],
    )
    def request_entry(self, request, pk=None):  # pylint: disable=unused-argument
        """Request entry to a room"""
@@ -477,7 +489,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="creation-callback",
        permission_classes=[],
-        throttle_classes=[throttling.CreationCallbackAnonRateThrottle],
+        throttle_classes=[CreationCallbackAnonRateThrottle],
    )
    def creation_callback(self, request):
        """Retrieve cached room data via an unauthenticated request with a unique ID.
@@ -18,7 +18,6 @@ from socket import gethostbyname, gethostname

 from django.utils.translation import gettext_lazy as _

-import dj_database_url
 import sentry_sdk
 from configurations import Configuration, values
 from lasuite.configuration.values import SecretFileValue
@@ -93,11 +92,7 @@ class Base(Configuration):

    # Database
    DATABASES = {
-        "default": dj_database_url.config()
-        if values.DatabaseURLValue(
-            None, environ_name="DATABASE_URL", environ_prefix=None
-        )
-        else {
+        "default": {
            "ENGINE": values.Value(
                "django.db.backends.postgresql_psycopg2",
                environ_name="DB_ENGINE",
@@ -297,9 +292,6 @@ class Base(Configuration):
            ),
        },
    }
-    MONITORED_THROTTLE_FAILURE_CALLBACK = (
-        "core.api.throttling.sentry_monitoring_throttle_failure"
-    )

    SPECTACULAR_SETTINGS = {
        "TITLE": "Meet API",
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "meet"
-version = "1.6.0"
+version = "1.5.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -29,7 +29,6 @@ dependencies = [
    "Brotli==1.2.0",
    "brevo-python==1.2.0",
    "celery[redis]==5.5.3",
-    "dj-database-url==3.1.0",
    "django-configurations==2.5.1",
    "django-cors-headers==4.9.0",
    "django-countries==8.0.0",
@@ -5,12 +5,6 @@ server {

  root /usr/share/nginx/html;

-  location = /.wellknown/windows-app-web-link {
-      default_type application/json;
-      alias /usr/share/nginx/html/.wellknown/windows-app-web-link;
-      add_header Content-Disposition "attachment; filename=windows-app-web-link";
-  }
-
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
@@ -1,12 +1,12 @@
 {
  "name": "meet",
-  "version": "1.6.0",
+  "version": "1.5.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "meet",
-      "version": "1.6.0",
+      "version": "1.5.0",
      "dependencies": {
        "@fontsource-variable/material-symbols-outlined": "5.2.30",
        "@fontsource/material-icons-outlined": "5.2.6",
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.6.0",
+  "version": "1.5.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -1,6 +0,0 @@
-[
-{
-  "packageFamilyName" : "Visio_g3z6ba6vek6vg",
-  "paths" : [ "*" ]
-}
-]
@@ -1,4 +1,4 @@
-import { A, Button, Dialog, H, P, ScreenReaderAnnouncer } from '@/primitives'
+import { Button, Dialog, H, P, ScreenReaderAnnouncer } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { css } from '@/styled-system/css'
 import { useSnapshot } from 'valtio'
@@ -9,8 +9,6 @@ import { navigateTo } from '@/navigation/navigateTo'
 import humanizeDuration from 'humanize-duration'
 import i18n from 'i18next'
 import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
-import { useSettingsDialog } from '@/features/settings/hook/useSettingsDialog'
-import { SettingsDialogExtendedKey } from '@/features/settings/type'

 const IDLE_DISCONNECT_TIMEOUT_MS = 120000 // 2 minutes
 const COUNTDOWN_ANNOUNCEMENT_SECONDS = [90, 60, 30]
@@ -20,7 +18,6 @@ export const IsIdleDisconnectModal = () => {
  const connectionObserverSnap = useSnapshot(connectionObserverStore)
  const [timeRemaining, setTimeRemaining] = useState(IDLE_DISCONNECT_TIMEOUT_MS)
  const lastAnnouncementRef = useRef<number | null>(null)
-  const { openSettingsDialog } = useSettingsDialog()

  const { t } = useTranslation('rooms', { keyPrefix: 'isIdleDisconnectModal' })
  const announce = useScreenReaderAnnounce()
@@ -120,19 +117,7 @@ export const IsIdleDisconnectModal = () => {
                }),
              })}
            </P>
-            <P>
-              {t('settingsPrefix')}{' '}
-              <A
-                color="primary"
-                onPress={() => {
-                  connectionObserverStore.isIdleDisconnectModalOpen = false
-                  openSettingsDialog(SettingsDialogExtendedKey.GENERAL)
-                }}
-              >
-                {t('settingsLink')}
-              </A>
-              {t('settingsSuffix')}
-            </P>
+            <P>{t('settings')}</P>
            <HStack marginTop="2rem">
              <Button
                onPress={() => {
@@ -6,7 +6,6 @@ import { ToggleButton } from '@/primitives'
 import { chatStore } from '@/stores/chat'
 import { useSidePanel } from '../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
-import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ChatToggle = ({
  onPress,
@@ -19,11 +18,6 @@ export const ChatToggle = ({
  const { isChatOpen, toggleChat } = useSidePanel()
  const tooltipLabel = isChatOpen ? 'open' : 'closed'

-  useRegisterKeyboardShortcut({
-    id: 'toggle-chat',
-    handler: toggleChat,
-  })
-
  return (
    <div
      className={css({
@@ -18,7 +18,6 @@ import { useCannotUseDevice } from '../../../hooks/useCannotUseDevice'
 import { useDeviceIcons } from '../../../hooks/useDeviceIcons'
 import { useDeviceShortcut } from '../../../hooks/useDeviceShortcut'
 import { ToggleSource, CaptureOptionsBySource } from '@livekit/components-core'
-import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'

 type ToggleDeviceStyleProps = {
  variant?: NonNullable<ButtonRecipeProps>['variant']
@@ -89,14 +88,12 @@ export const ToggleDevice = <T extends ToggleSource>({
  const deviceShortcut = useDeviceShortcut(kind)

  useRegisterKeyboardShortcut({
-    id: deviceShortcut?.id,
+    shortcut: deviceShortcut,
    handler: async () => await toggle(),
    isDisabled: cannotUseDevice,
  })
-
-  const pushToTalkShortcut = getShortcutDescriptorById('push-to-talk')
  useLongPress({
-    keyCode: kind === 'audioinput' ? pushToTalkShortcut?.code : undefined,
+    keyCode: kind === 'audioinput' ? 'KeyV' : undefined,
    onKeyDown,
    onKeyUp,
    isDisabled: cannotUseDevice,
@@ -106,9 +103,7 @@ export const ToggleDevice = <T extends ToggleSource>({
    const label = t(enabled ? 'disable' : 'enable', {
      keyPrefix: `selectDevice.${kind}`,
    })
-    return deviceShortcut?.shortcut
-      ? appendShortcutLabel(label, deviceShortcut.shortcut)
-      : label
+    return deviceShortcut ? appendShortcutLabel(label, deviceShortcut) : label
  }, [enabled, kind, deviceShortcut, t])

  const Icon =
@@ -9,7 +9,6 @@ import {
  closeLowerHandToasts,
  showLowerHandToast,
 } from '@/features/notifications/utils'
-import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 const SPEAKING_DETECTION_DELAY = 3000

@@ -34,16 +33,6 @@ export const HandToggle = () => {
    closeLowerHandToasts()
  }, [isHandRaised])

-  const handleToggle = () => {
-    toggleRaisedHand()
-    resetToastState()
-  }
-
-  useRegisterKeyboardShortcut({
-    id: 'raise-hand',
-    handler: handleToggle,
-  })
-
  useEffect(() => {
    const shouldShowToast = isSpeaking && isHandRaised && !hasShownToast

@@ -79,7 +68,10 @@ export const HandToggle = () => {
        aria-label={t(tooltipLabel)}
        tooltip={t(tooltipLabel)}
        isSelected={isHandRaised}
-        onPress={handleToggle}
+        onPress={() => {
+          toggleRaisedHand()
+          resetToastState()
+        }}
        data-attr={`controls-hand-${tooltipLabel}`}
      >
        <RiHand />
@@ -11,7 +11,6 @@ import {
  ReactionPortals,
 } from '@/features/rooms/livekit/components/ReactionPortal'
 import { getEmojiLabel } from '@/features/rooms/livekit/utils/reactionUtils'
-import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
 import { Toolbar as RACToolbar } from 'react-aria-components'
 import { Participant } from 'livekit-client'
 import useRateLimiter from '@/hooks/useRateLimiter'
@@ -42,11 +41,6 @@ export const ReactionsToggle = () => {

  const [isVisible, setIsVisible] = useState(false)

-  useRegisterKeyboardShortcut({
-    id: 'reaction',
-    handler: () => setIsVisible((prev) => !prev),
-  })
-
  const sendReaction = async (emoji: string) => {
    const encoder = new TextEncoder()
    const payload: NotificationPayload = {
@@ -1,16 +1,19 @@
 import { useMemo } from 'react'
-import {
-  getShortcutDescriptorById,
-  ShortcutDescriptor,
-} from '@/features/shortcuts/catalog'
+import { Shortcut } from '@/features/shortcuts/types'

 export const useDeviceShortcut = (kind: MediaDeviceKind) => {
-  return useMemo<ShortcutDescriptor | undefined>(() => {
+  return useMemo<Shortcut | undefined>(() => {
    switch (kind) {
      case 'audioinput':
-        return getShortcutDescriptorById('toggle-microphone')
+        return {
+          key: 'd',
+          ctrlKey: true,
+        }
      case 'videoinput':
-        return getShortcutDescriptorById('toggle-camera')
+        return {
+          key: 'e',
+          ctrlKey: true,
+        }
      default:
        return undefined
    }
@@ -22,7 +22,7 @@ export function DesktopControlBar({
  const desktopControlBarEl = useRef<HTMLDivElement>(null)

  useRegisterKeyboardShortcut({
-    id: 'focus-toolbar',
+    shortcut: { key: 'F2' },
    handler: () => {
      const root = desktopControlBarEl.current
      if (!root) return
@@ -1,83 +0,0 @@
-import { Shortcut } from './types'
-
-// Central list of current keyboard shortcuts.
-// Keep a single source of truth for display and, later, customization
-export type ShortcutCategory = 'navigation' | 'media' | 'interaction'
-
-export type ShortcutId =
-  | 'focus-toolbar'
-  | 'toggle-microphone'
-  | 'toggle-camera'
-  | 'push-to-talk'
-  | 'toggle-chat'
-  | 'toggle-participants'
-  | 'raise-hand'
-  | 'recording'
-  | 'reaction'
-  | 'fullscreen'
-
-export const getShortcutDescriptorById = (id: ShortcutId) =>
-  shortcutCatalog.find((item) => item.id === id)
-
-export type ShortcutDescriptor = {
-  id: ShortcutId
-  category: ShortcutCategory
-  shortcut?: Shortcut
-  kind?: 'press' | 'longPress'
-  code?: string // used when kind === 'longPress' (KeyboardEvent.code)
-  description?: string
-}
-
-export const shortcutCatalog: ShortcutDescriptor[] = [
-  {
-    id: 'focus-toolbar',
-    category: 'navigation',
-    shortcut: { key: 'F2' },
-  },
-  {
-    id: 'toggle-microphone',
-    category: 'media',
-    shortcut: { key: 'd', ctrlKey: true },
-  },
-  {
-    id: 'toggle-camera',
-    category: 'media',
-    shortcut: { key: 'e', ctrlKey: true },
-  },
-  {
-    id: 'push-to-talk',
-    category: 'media',
-    kind: 'longPress',
-    code: 'KeyV',
-  },
-  {
-    id: 'reaction',
-    category: 'interaction',
-    shortcut: { key: 'E', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'fullscreen',
-    category: 'interaction',
-    shortcut: { key: 'F', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'recording',
-    category: 'interaction',
-    shortcut: { key: 'L', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'raise-hand',
-    category: 'interaction',
-    shortcut: { key: 'H', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'toggle-chat',
-    category: 'interaction',
-    shortcut: { key: 'M', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'toggle-participants',
-    category: 'interaction',
-    shortcut: { key: 'P', ctrlKey: true, shiftKey: true },
-  },
-]
@@ -1,6 +1,4 @@
 export type Shortcut = {
  key: string
  ctrlKey?: boolean
-  shiftKey?: boolean
-  altKey?: boolean
 }
@@ -11,13 +11,11 @@ export const useKeyboardShortcuts = () => {
    // This approach handles basic shortcuts but isn't comprehensive.
    // Issues might occur. First draft.
    const onKeyDown = async (e: KeyboardEvent) => {
-      const { key, metaKey, ctrlKey, shiftKey, altKey } = e
+      const { key, metaKey, ctrlKey } = e
      if (!key) return
      const shortcutKey = formatShortcutKey({
        key,
        ctrlKey: ctrlKey || (isMacintosh() && metaKey),
-        shiftKey,
-        altKey,
      })
      const shortcut = shortcutsSnap.shortcuts.get(shortcutKey)
      if (!shortcut) return
@@ -1,28 +1,26 @@
 import { useEffect } from 'react'
 import { keyboardShortcutsStore } from '@/stores/keyboardShortcuts'
 import { formatShortcutKey } from '@/features/shortcuts/utils'
-import { ShortcutId, getShortcutDescriptorById } from './catalog'
+import { Shortcut } from '@/features/shortcuts/types'

 export type useRegisterKeyboardShortcutProps = {
-  id?: ShortcutId
+  shortcut?: Shortcut
  handler: () => Promise<void | boolean | undefined> | void
  isDisabled?: boolean
 }

 export const useRegisterKeyboardShortcut = ({
-  id,
+  shortcut,
  handler,
  isDisabled = false,
 }: useRegisterKeyboardShortcutProps) => {
  useEffect(() => {
-    if (!id) return
-    const descriptor = getShortcutDescriptorById(id)
-    if (!descriptor?.shortcut) return
-    const formattedKey = formatShortcutKey(descriptor.shortcut)
+    if (!shortcut) return
+    const formattedKey = formatShortcutKey(shortcut)
    if (isDisabled) {
      keyboardShortcutsStore.shortcuts.delete(formattedKey)
    } else {
      keyboardShortcutsStore.shortcuts.set(formattedKey, handler)
    }
-  }, [handler, id, isDisabled])
+  }, [handler, shortcut, isDisabled])
 }
@@ -4,27 +4,15 @@ import { Shortcut } from '@/features/shortcuts/types'
 export const CTRL = 'ctrl'

 export const formatShortcutKey = (shortcut: Shortcut) => {
-  const parts = []
-  if (shortcut.ctrlKey) parts.push(CTRL)
-  if (shortcut.altKey) parts.push('alt')
-  if (shortcut.shiftKey) parts.push('shift')
-  parts.push(shortcut.key.toUpperCase())
-  return parts.join('+')
+  if (shortcut.ctrlKey) return `${CTRL}+${shortcut.key.toUpperCase()}`
+  return shortcut.key.toUpperCase()
 }

 export const appendShortcutLabel = (label: string, shortcut: Shortcut) => {
  if (!shortcut.key) return
-  const parts: string[] = []
+  let formattedKeyLabel = shortcut.key.toLowerCase()
  if (shortcut.ctrlKey) {
-    parts.push(isMacintosh() ? '⌘' : 'Ctrl')
+    formattedKeyLabel = `${isMacintosh() ? '⌘' : 'Ctrl'}+${formattedKeyLabel}`
  }
-  if (shortcut.altKey) {
-    parts.push(isMacintosh() ? '⌥' : 'Alt')
-  }
-  if (shortcut.shiftKey) {
-    parts.push('Shift')
-  }
-  parts.push(shortcut.key.toLowerCase())
-  const formattedKeyLabel = parts.join('+')
  return `${label} (${formattedKeyLabel})`
 }
@@ -154,9 +154,7 @@
  "isIdleDisconnectModal": {
    "title": "Bist du noch da?",
    "body": "Du bist der einzige Teilnehmer. Dieses Gespräch endet in {{duration}}. Möchtest du das Gespräch fortsetzen?",
-    "settingsPrefix": "Um diese Nachricht nicht mehr zu sehen, gehe zu",
-    "settingsLink": "Einstellungen > Allgemein",
-    "settingsSuffix": ".",
+    "settings": "Um diese Nachricht nicht mehr zu sehen, gehe zu Einstellungen > Allgemein.",
    "stayButton": "Gespräch fortsetzen",
    "leaveButton": "Jetzt verlassen",
    "countdownAnnouncement": "Das Gespräch endet in {{duration}}."
@@ -154,9 +154,7 @@
  "isIdleDisconnectModal": {
    "title": "Are you still there?",
    "body": "You are the only participant. This call will end in {{duration}}. Would you like to continue the call?",
-    "settingsPrefix": "To stop seeing this message, go to",
-    "settingsLink": "Settings > General",
-    "settingsSuffix": ".",
+    "settings": "To stop seeing this message, go to Settings > General.",
    "stayButton": "Continue the call",
    "leaveButton": "Leave now",
    "countdownAnnouncement": "Call ends in {{duration}}."
@@ -154,9 +154,7 @@
  "isIdleDisconnectModal": {
    "title": "Êtes-vous toujours là ?",
    "body": "Vous êtes le seul participant. Cet appel va donc se terminer dans {{duration}}. Voulez-vous poursuivre l'appel ?",
-    "settingsPrefix": "Pour ne plus voir ce message, allez dans",
-    "settingsLink": "Paramètres > Général",
-    "settingsSuffix": ".",
+    "settings": "Pour ne plus voir ce message, accèder à Paramètres > Général.",
    "stayButton": "Poursuivre l'appel",
    "leaveButton": "Quitter maintenant",
    "countdownAnnouncement": "L'appel se termine dans {{duration}}."
@@ -154,9 +154,7 @@
  "isIdleDisconnectModal": {
    "title": "Ben je er nog?",
    "body": "Je bent de enige deelnemer. Dit gesprek wordt over {{duration}} beëindigd. Wil je het gesprek voortzetten?",
-    "settingsPrefix": "Om dit bericht niet meer te zien, ga naar",
-    "settingsLink": "Instellingen > Algemeen",
-    "settingsSuffix": ".",
+    "settings": "Om dit bericht niet meer te zien, ga naar Instellingen > Algemeen.",
    "stayButton": "Gesprek voortzetten",
    "leaveButton": "Nu verlaten",
    "countdownAnnouncement": "Het gesprek eindigt over {{duration}}."
@@ -1,12 +1,12 @@
 {
  "name": "mail_mjml",
-  "version": "1.6.0",
+  "version": "1.5.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "mail_mjml",
-      "version": "1.6.0",
+      "version": "1.5.0",
      "license": "MIT",
      "dependencies": {
        "@html-to/text-cli": "0.5.4",
@@ -1,6 +1,6 @@
 {
  "name": "mail_mjml",
-  "version": "1.6.0",
+  "version": "1.5.0",
  "description": "An util to generate html and text django's templates from mjml templates",
  "type": "module",
  "dependencies": {
@@ -1,12 +1,12 @@
 {
  "name": "sdk",
-  "version": "1.6.0",
+  "version": "1.5.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sdk",
-      "version": "1.6.0",
+      "version": "1.5.0",
      "license": "ISC",
      "workspaces": [
        "./library",
@@ -1,6 +1,6 @@
 {
  "name": "sdk",
-  "version": "1.6.0",
+  "version": "1.5.0",
  "author": "",
  "license": "ISC",
  "description": "",
@@ -1,7 +1,7 @@

 [project]
 name = "summary"
-version = "1.6.0"
+version = "1.5.0"
 dependencies = [
    "fastapi[standard]>=0.105.0",
    "uvicorn>=0.24.0",