🚸(frontend) hide back button when a user is ejected by an admin

Avoid showing a back button when a user is kicked out of a meeting by an admin, to prevent them from repeatedly rejoining the room.
2026-01-13 15:23:05 +01:00
237 changed files with 4283 additions and 14410 deletions
@@ -24,15 +24,13 @@ data
 .cache
 .circleci
 .git
+.vscode
 .iml
+.idea
 db.sqlite3
+.mypy_cache
 .pylint.d
-
-**/.idea
-**/.vscode
-**/.pytest_cache
-**/.mypy_cache
-**/.ruff_cache
+.pytest_cache

 # Frontend
-**/node_modules
+node_modules
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Download Crowdin files
        uses: crowdin/github-action@v2
@@ -23,13 +23,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -43,19 +37,18 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '--target backend-production -f Dockerfile'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '--target backend-production -f Dockerfile'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          target: backend-production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -66,13 +59,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -86,12 +73,12 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -99,7 +86,6 @@ jobs:
          context: .
          file: ./src/frontend/Dockerfile
          target: frontend-production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -110,13 +96,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -130,12 +110,12 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -143,7 +123,6 @@ jobs:
          context: .
          file: ./docker/dinum-frontend/Dockerfile
          target: frontend-production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -154,13 +133,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -174,13 +147,13 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        continue-on-error: true
-#        with:
-#          docker-build-args: '-f src/summary/Dockerfile --target production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/summary/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
          docker-context: './src/summary'
      -
        name: Build and push
@@ -189,7 +162,6 @@ jobs:
          context: ./src/summary
          file: ./src/summary/Dockerfile
          target: production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -200,13 +172,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -220,14 +186,14 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        continue-on-error: true
-#        with:
-#          docker-build-args: '-f src/agents/Dockerfile --target production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
-#          docker-context: './src/agents'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/agents/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+          docker-context: './src/agents'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -235,7 +201,6 @@ jobs:
          context: ./src/agents
          file: ./src/agents/Dockerfile
          target: production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -7,18 +7,14 @@ on:
  pull_request:
    branches:
      - "*"
-permissions:
-  contents: read

 jobs:
  lint-git:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
-    permissions:
-      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: show
@@ -43,11 +39,9 @@ jobs:
    if: |
      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
      github.event_name == 'pull_request'
-    permissions:
-        contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -55,11 +49,9 @@ jobs:

  lint-changelog:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -70,22 +62,20 @@ jobs:

  build-mails:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
        with:
          node-version: "18"

      - name: Restore the mail templates
-        uses: actions/cache@v5
+        uses: actions/cache@v4
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -105,23 +95,21 @@ jobs:

      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@v4
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}

  lint-back:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -136,16 +124,14 @@ jobs:

  lint-agents:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/agents
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -158,16 +144,14 @@ jobs:

  lint-summary:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/summary
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -181,8 +165,7 @@ jobs:
  test-back:
    runs-on: ubuntu-latest
    needs: build-mails
-    permissions:
-      contents: read
+
    defaults:
      run:
        working-directory: src/backend
@@ -230,11 +213,10 @@ jobs:
      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
      OIDC_OP_URL: https://oidc.example.com
-      MEDIA_BASE_URL: http://localhost:8083

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Create writable /data
        run: |
@@ -242,7 +224,7 @@ jobs:
          sudo mkdir -p /data/static

      - name: Restore the mail templates
-        uses: actions/cache@v5
+        uses: actions/cache@v4
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -276,7 +258,7 @@ jobs:
            mc mb meet/meet-media-storage"

      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -297,11 +279,9 @@ jobs:

  lint-front:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install dependencies
        run: cd src/frontend/ && npm ci
@@ -314,14 +294,12 @@ jobs:

  lint-sdk:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci
@@ -334,15 +312,13 @@ jobs:

  build-sdk:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    needs: lint-sdk
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

@@ -1,29 +0,0 @@
-# /!\
-# Security Note: This action is not hardened against prompt injection attacks and should only be used
-# to review trusted PRs. Configure your repository with "Require approval for all external contributors"
-# to ensure workflows only run after a maintainer has reviewed the PR.
-name: Security Review
-
-permissions:
-  pull-requests: write  # Needed for leaving PR comments
-  contents: read
-
-on:
-  pull_request:
-    branches:
-      - 'main'
-
-jobs:
-  security:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          fetch-depth: 2
-
-      - uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
-        with:
-          comment-pr: true
-          exclude-directories: docs,gitlint,LICENSES,bin
-          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
@@ -8,163 +8,6 @@ and this project adheres to

 ## [Unreleased]

-### Added
-
- ✨(helm) support celery with our Django backend #1124
- ✨(helm) support ingress for custom background image #1124
- ✨(backend) add authenticated user rate throttling on request-entry #1129
-
-### Changed
-
- ♿️(frontend) Caption text size setting for accessibility #1062
- ♿️(frontend) sync html lang attribute with i18n for screen readers #1111
- ♿️(frontend) improve MoreLink a11y and UX on home page #1112
- ♿(frontend) improve chat toast a11y for screen readers #1109
- ♿(frontend) improve ui and aria labels for help article links #1108
- 🌐(frontend) improve German translation #1125
-
-### Fixed
-
- 🐛(frontend) fix hand icon and queue position alignment and position #1119
- 🩹(backend) add page_size to pagination for room endpoints #1131
- 🐛(backend) refactor lobby throttling to use participant id #1129
-
-## [1.10.0] - 2026-03-05
-
-### Changed
-
- 🔒️(backend) enhance API input validation to strengthen security #1053
- 🦺(backend) strengthen API validation for recording options #1063
- ⚡️(frontend) optimize few performance caveats #1073
- 🔒️(helm) introduce a dedicated Kubernetes Ingress for webhook-livekit #1066
- ⬆️(deps) bump rollup from 4.44.2 to 4.59.0 in /src/frontend #1088
-
-### Fixed
-
- 🐛(migrations) use settings in migrations #1058
- 💄(frontend) truncate pinned participant name with ellipsis on overflow #1056
- ♿(frontend) prevent focus ring clipping on invite dialog #1078
- ♿(frontend) dynamic tab title when connected to meeting #1060
- 🩹(frontend) remove incorrect reference to ProConnect on the prejoin #1080
- ✨(frontend) add Ctrl+Shift+/ to open shortcuts settings #1050
- ♿(frontend) announce selected state to screen readers #1081
- 💄(frontend) truncate long names with ellipsis in reaction overlay #1099
-
-### Added
-
- ✨(backend) add file upload feature #1030
-
-## [1.9.0] - 2026-03-02
-
-### Added
-
- 👷(docker) add arm64 platform support for image builds
- ✨(summary) add localization support for transcription context text
-
-### Changed
-
- ♻️(frontend) replace custom reactions toolbar with react aria popover #985
- 🔒️(frontend) uninstall curl from the frontend production image #987
- 💄(frontend) add focus ring to reaction emoji buttons
- ✨(frontend) introduce a shortcut settings tab #975
- 🚚(frontend) rename "wellknown" directory to "well-known" #1009
- 🌐(frontend) localize SR modifier labels #1010
- ⬆️(backend) update python dependencies #1011
- ♿️(frontend) fix focus ring on tab container components #1012
- ♿️(frontend) upgrade join meeting modal accessibility #1027
- ⬆️(python) bump minimal required python version to 3.13 #1033
- ♿️(frontend) improve accessibility of the IntroSlider carousel #1026
- ♿️(frontend) add skip link component for keyboard navigation #1019
- ♿️(frontend) announce mic/camera state to SR on shortcut toggle #1052
-
-### Fixed
-
- 🩹(frontend) fix German language preference update #1021
-
-## [1.8.0] - 2026-02-20
-
-### Changed
-
- 🔒️(agents) uninstall pip from the agents image
- 🔒️(summary) switch to Alpine base image
- 🔒️(backend) uninstall pip in the production image
-
-### Fixed
-
- 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
- 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
-
-## [1.7.0] - 2026-02-19
-
-### Added
-
- ✨(frontend) expose Windows app web link #976
- ✨(frontend) support additional shortcuts to broaden accessibility
-
-### Changed
-
- ✨(frontend) add clickable settings general link in idle modal #974
- ♻️(backend) refactor external API token-related items #1006
-
-## [1.6.0] - 2026-02-10
-
-### Added
-
- ✨(backend) monitor throttling rate failure through sentry #964
- 🚀(paas) add PaaS deployment scripts, tested on Scalingo #957
-
-### Changed
-
- ♿️(frontend) improve spinner reduced‑motion fallback #931
- ♿️(frontend) fix form labels and autocomplete wiring #932
- 🥅(summary) catch file-related exceptions when handling recording #944
- 📝(frontend) update legal terms #956
- ⚡️(backend) enhance django admin's loading performance #954
- 🌐(frontend) add missing DE translation for accessibility settings
-
-### Fixed
-
- 🔐(backend) enforce object-level permission checks on room endpoint #959
- 🔒️(backend) add application validation when consuming external JWT #963
-
-## [1.5.0] - 2026-01-28
-
-### Changed
-
- ♿️(frontend) adjust visual-only tooltip a11y labels #910
- ♿️(frontend) sr pin/unpin announcements with dedicated messages #898
- ♿(frontend) adjust sr announcements for idle disconnect timer #908
- ♿️(frontend) add global screen reader announcer#922
-
-### Fixed
-
- 🔒️(frontend) fix an XSS vulnerability on the recording page #911
-
-## [1.4.0] - 2026-01-25
-
-### Added
-
- ✨(frontend) add configurable redirect for unauthenticated users #904
-
-### Changed
-
- ♿️(frontend) add accessible back button in side panel #881
- ♿️(frontend) improve participants toggle a11y label #880
- ♿️(frontend) make carousel image decorative #871
- ♿️(frontend) reactions are now vocalized and configurable #849
- ♿️(frontend) improve background effect announcements #879
-
-### Fixed
-
- 🔒(backend) prevent automatic upgrade setuptools
- ♿(frontend) improve contrast for selected options #863
- ♿️(frontend) announce copy state in invite dialog #877
- 📝(frontend) align close dialog label in rooms locale #878
- 🩹(backend) use case-insensitive email matching in the external api #887
- 🐛(frontend) ensure transcript segments are sorted by their timestamp #899
- 🐛(frontend) scope scrollbar gutter override to video rooms #882
-
-## [1.3.0] - 2026-01-13

 ### Added

@@ -182,7 +25,7 @@ and this project adheres to

 ### Fixed

- 🐛(frontend) remove unexpected F2 tooltip when clicking video screen
+- 🐛(frontend) remove unexpected F2 tooltip when clicking video screen 
 - 🩹(frontend) icon font loading to avoid text/icon flickering

 ## [1.2.0] - 2026-01-05
@@ -4,7 +4,7 @@
 FROM python:3.13.5-alpine3.21 AS base

 # Upgrade pip to its latest release to speed up dependencies installation
-RUN python -m pip install --upgrade pip
+RUN python -m pip install --upgrade pip setuptools

 # Upgrade system packages to install security updates
 RUN apk update && \
@@ -39,7 +39,6 @@ ARG MEET_STATIC_ROOT=/data/static

 RUN apk add \
  pango \
-  libmagic \
  rdfind

 # Copy installed python dependencies
@@ -69,7 +68,6 @@ RUN apk --no-cache add \
  gettext \
  libffi-dev \
  pango \
-  libmagic \
  shared-mime-info


@@ -129,9 +127,6 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py

-# Remove pip to reduce attack surface in production
-RUN pip uninstall -y pip
-
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
@@ -23,10 +23,9 @@
 # ==============================================================================
 # VARIABLES

-ESC := $(shell printf '\033')
-BOLD := $(ESC)[1m
-RESET := $(ESC)[0m
-GREEN := $(ESC)[1;32m
+BOLD := \033[1m
+RESET := \033[0m
+GREEN := \033[1;32m


 # -- Database
@@ -86,8 +85,7 @@ bootstrap: \
 	demo \
 	back-i18n-compile \
 	mails-install \
-	mails-build \
-	run
+	mails-build
 .PHONY: bootstrap

 # -- Docker/compose
@@ -114,8 +112,7 @@ logs: ## display app-dev logs (follow mode)
 .PHONY: logs

 run-backend: ## start only the backend application and all needed services
-	@$(COMPOSE) up --force-recreate -d celery-dev --remove-orphans
-	@$(COMPOSE) up --force-recreate -d nginx
+	@$(COMPOSE) up --force-recreate -d celery-dev
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
 .PHONY: run-backend
@@ -1,2 +0,0 @@
-web: bin/buildpack_start.sh
-postdeploy: python manage.py migrate
@@ -50,9 +50,6 @@ La Suite Meet is fully self-hostable and released under the MIT License, ensurin

 We’re continuously adding new features to enhance your experience, with the latest updates coming soon!

-### 🚀 Major roll out to all French public servants
-
-On the 25th of January 2026, David Amiel, France’s Minister for Civil Service and State Reform, announced the full deployment of Visio—the French government’s dedicated Meet platform—to all public servants. ([Source in French](https://www.latribune.fr/article/la-tribune-dimanche/politique/73157688099661/david-amiel-ministre-delegue-de-la-fonction-publique-nous-allons-sortir-de-la-dependance-aux-outils-americains))

 ## Table of Contents

@@ -89,7 +86,7 @@ We hope to see many more, here is an incomplete list of public La Suite Meet ins
 | [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM    | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up|
 | [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT    | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up|
 | [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop    | Free and open demo to all. Content and accounts are reset after one month |
-| [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |
+| [meet.demo.mosacloud.eu](https://meet.demo.mosacloud.eu/)     | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |


 ## Contributing
@@ -70,7 +70,7 @@ docker_build(
    'localhost:5001/meet-agents:latest',
    context='../src/agents',
    dockerfile='../src/agents/Dockerfile',
-    only=['.'],
+   only=['.'],
    target = 'production',
    live_update=[
        sync('../src/agents', '/app'),
@@ -99,9 +99,6 @@ k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev} template .

 k8s_resource('minio-bucket', resource_deps=['minio'])
 k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
-k8s_resource('meet-celery-backend', resource_deps=['redis'])
-k8s_resource('meet-celery-summarize', resource_deps=['redis'])
-k8s_resource('meet-celery-transcribe', resource_deps=['redis'])
 k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
 k8s_resource('keycloak', resource_deps=['kc-postgresql'])
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-set -o errexit    # always exit on error
-set -o pipefail   # don't ignore exit codes when piping output
-
-echo "-----> Running post-compile script"
-
-# Cleanup
-rm -rf docker docs env.d gitlint
@@ -1,50 +0,0 @@
-#!/bin/bash
-
-set -o errexit    # always exit on error
-set -o pipefail   # don't ignore exit codes when piping output
-
-echo "-----> Running post-frontend script"
-
-# Move the frontend build to the nginx root and clean up
-mkdir -p build/
-mv src/frontend/dist build/frontend-out
-
-ASSETS_DIR=build/frontend-out/assets
-if [ -n "$CUSTOM_LOGO_URL" ]; then
-    # Ensure https
-    [[ ! "$CUSTOM_LOGO_URL" =~ ^https:// ]] && echo "[custom-logo] ERROR: URL must use HTTPS" >&2 && exit 1
-
-    # Prevent SSRF
-    HOSTNAME=$(echo "$CUSTOM_LOGO_URL" | sed -E 's|^https://([^/:]+).*|\1|')
-    [[ "$HOSTNAME" =~ ^(localhost|127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|0\.0\.0\.0|\[::1\]) ]] && echo "[custom-logo] ERROR: SSRF blocked: $HOSTNAME" >&2 && exit 1
-
-    LOGO_FILE="${ASSETS_DIR}/logo.svg"
-    TMP_FILE=$(mktemp "${LOGO_FILE}.XXXXXX.tmp")
-
-    # Actual download
-    echo "[custom-logo] INFO: Downloading custom logo from: $CUSTOM_LOGO_URL"
-    curl -fsSL --tlsv1.2 -o "$TMP_FILE" "$CUSTOM_LOGO_URL"
-
-    # Validate filesize
-    FILESIZE=$(stat -c%s "$TMP_FILE" 2>/dev/null || stat -f%z "$TMP_FILE")
-    [[ "$FILESIZE" -eq 0 ]] && echo "[custom-logo] ERROR: empty file" >&2 && exit 1
-    [[ "$FILESIZE" -gt 5242880 ]] && echo "[custom-logo] ERROR: file too large (${FILESIZE}B > 5MB)" >&2 && exit 1
-
-    # Validate file type
-    IS_SVG=false
-
-    HEADER=$(head -c 100 "$TMP_FILE" | tr -d '\0' | tr '[:upper:]' '[:lower:]')
-    [[ "$HEADER" =~ ^.*"<svg".*$ ]] && IS_SVG=true
-    [[ "$HEADER" =~ ^.*"<?xml".*"<svg".*$ ]] && IS_SVG=true
-
-    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
-
-    mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
-fi
-
-mv src/backend/* ./
-mv deploy/paas/* ./
-
-echo "3.13" > .python-version
-echo "." > requirements.txt
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-# Start the Django backend server
-gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
-
-# Start the Nginx server
-bin/run &
-
-# if the current shell is killed, also terminate all its children     
-trap "pkill SIGTERM -P $$" SIGTERM
-
-# wait for a single child to finish,
-wait -n
-# then kill all the other tasks
-pkill -P $$
@@ -58,7 +58,7 @@ services:
      /usr/bin/mc admin config set meet notify_webhook:meet-webhook endpoint='http://app-dev:8000/api/v1.0/recordings/storage-hook/' auth_token='Bearer password' &&
      /usr/bin/mc admin service restart meet --wait --json &&
      sleep 15 &&
-      /usr/bin/mc event add meet/meet-media-storage arn:minio:sqs::meet-webhook:webhook --event put --prefix "recordings" &&
+      /usr/bin/mc event add meet/meet-media-storage arn:minio:sqs::meet-webhook:webhook --event put &&
      exit 0;"

  app-dev:
@@ -84,6 +84,7 @@ services:
        - postgresql
        - mailcatcher
        - redis
+        - nginx
        - livekit
        - createbuckets
        - createwebhook
@@ -147,7 +148,6 @@ services:
      - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
    depends_on:
      - keycloak
-      - app-dev
    networks:
      - resource-server
      - default
@@ -1,52 +0,0 @@
-# ERB templated nginx configuration
-# see https://doc.scalingo.com/platform/deployment/buildpacks/nginx
-
-upstream backend_server {
-	server localhost:8000 fail_timeout=0;
-}
-
-server {
-  listen <%= ENV["PORT"] %>;
-  server_name _;
-  server_tokens off;
-
-  root /app/build/frontend-out;
-
-  # Django rest framework
-  location ^~ /api/ {
-      proxy_set_header X-Forwarded-Proto https;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-      proxy_redirect off;
-      proxy_pass http://backend_server;
-  }
-
-  # Django admin
-  location ^~ /admin/ {
-      proxy_set_header X-Forwarded-Proto https;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-      proxy_redirect off;
-      proxy_pass http://backend_server;
-  }
-
-  # Serve static files with caching
-  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
-      expires 30d;
-      add_header Cache-Control "public, max-age=2592000";
-  }
-
-  # Serve static files
-  location / {
-      try_files $uri $uri/ /index.html;
-      # Add no-cache headers
-      add_header Cache-Control "no-cache, no-store, must-revalidate";
-      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
-      add_header Expires 0;
-  }
-
-  # Optionally, handle 404 errors by redirecting to index.html
-  error_page 404 =200 /index.html;
-}
@@ -4,47 +4,10 @@ server {
    server_name localhost;
    charset utf-8;

-    # Proxy auth for media
-    location /media/ {
-        # Auth request configuration
-        auth_request /media-auth;
-        auth_request_set $authHeader $upstream_http_authorization;
-        auth_request_set $authDate $upstream_http_x_amz_date;
-        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
-
-        # Pass specific headers from the auth response
-        proxy_set_header Authorization $authHeader;
-        proxy_set_header X-Amz-Date $authDate;
-        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
-
-        # Get resource from Minio
-        proxy_pass http://minio:9000/meet-media-storage/;
-        proxy_set_header Host minio:9000;
-        # To use with ds_proxy
-        # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
-        # proxy_set_header Host ds-proxy:4444;
-        add_header Content-Disposition "attachment";
-    }
-
-    location /media-auth {
-        proxy_pass http://app-dev:8000/api/v1.0/files/media-auth/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Original-URL $request_uri;
-        
-        # Prevent the body from being passed
-        proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-        proxy_set_header X-Original-Method $request_method;
-    }
-
    location / {
        proxy_pass http://keycloak:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Port $server_port;
    }
 }
@@ -1,9 +1,9 @@
 upstream meet_backend {
-    server ${BACKEND_INTERNAL_HOST}:8000 fail_timeout=0;
+    server ${BACKEND_HOST}:8000 fail_timeout=0;
 }

 upstream meet_frontend {
-    server ${FRONTEND_INTERNAL_HOST}:8080 fail_timeout=0;
+    server ${FRONTEND_HOST}:8080 fail_timeout=0;
 }

 server {
@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.9.4
+FROM livekit/livekit-server:v1.9.0

 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
@@ -3,8 +3,3 @@ redis:
  address: redis:6379
 keys:
  devkey: secret
-
-webhook:
-  api_key: devkey
-  urls:
-      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
@@ -10,7 +10,7 @@ services:
    - env.d/postgresql
    - env.d/common
    volumes:
-    - ./data/databases/backend:/var/lib/postgresql/data
+    - ./data/databases/backend:/var/lib/postgresql/data/pgdata

  redis:
    image: redis:5
@@ -20,8 +20,8 @@ services:
    user: ${DOCKER_USER:-1000}
    restart: always
    env_file:
-    - .env
    - env.d/common
+    - env.d/backend
    - env.d/postgresql
    healthcheck:
      test: ["CMD", "python", "manage.py", "check"]
@@ -45,7 +45,6 @@ services:
    - /docker-entrypoint.sh
    command: ["nginx", "-g", "daemon off;"]
    env_file:
-    - .env
    - env.d/common
    # Uncomment and set your values if using our nginx proxy example
    # environment:
@@ -8,7 +8,7 @@
 ### Step 1: Prepare your working environment:

 ```bash
-mkdir -p keycloak/env.d && cd keycloak
+mkdir keycloak/env.d && cd keycloak
 curl -o compose.yaml https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docs/examples/compose/keycloak/compose.yaml
 curl -o env.d/kc_postgresql https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/kc_postgresql
 curl -o env.d/keycloak https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/keycloak
@@ -89,4 +89,4 @@ Your keycloak instance is now available on https://doc.yourdomain.tld
 #### Step 3: Get Client Credentials

 1. Go to the "Credentials" tab.
-2. Copy the client ID (`meet` in this example) and the client secret.
+2. Copy the client ID (`meet` in this example) and the client secret.
@@ -68,13 +68,13 @@ backend:
        python manage.py createsuperuser --email admin@example.com --password admin
    restartPolicy: Never

-  # Extra volume to manage our local custom CA and avoid to set ssl_verify: false
+  # Exra volume to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumeMounts:
    - name: certs
      mountPath: /usr/local/lib/python3.12/site-packages/certifi/cacert.pem
      subPath: cacert.pem

-  # Extra volume to manage our local custom CA and avoid to set ssl_verify: false
+  # Exra volume to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumes:
    - name: certs
      configMap:
@@ -9,10 +9,6 @@ La Suite Meet maintainers use only the Kubernetes deployment method in productio
 We understand that not everyone has a Kubernetes cluster available, please follow the instructions provided [here](/docs/installation/compose.md) to set up a docker compose instance.
 We also provide [Docker images](https://hub.docker.com/u/lasuite?page=1&search=meet) that can be deployed using Compose.

-## Scalingo
-
-La Suite Meet can be deployed on Scalingo PaaS using the Suite Numérique buildpack. See the [Scalingo deployment guide](./scalingo.md) for detailed instructions.
-
 ## Other ways to install La Suite Meet
 Community members have contributed alternative ways to install La Suite Meet 🙏. While maintainers may not provide direct support, we help keep these instructions up to date, and you can reach out to contributors or the community for assistance.

@@ -1,6 +1,6 @@
 # Installation with docker compose

-We provide a sample configuration for running Meet using Docker Compose. Please note that this configuration is experimental, and the official way to deploy Meet in production is to use [k8s](../installation/kubernetes.md).
+We provide a sample configuration for running Meet using Docker Compose. Please note that this configuration is experimental, and the official way to deploy Meet in production is to use [k8s](../installation/k8s.md)

 ## Requirements

@@ -47,7 +47,7 @@ curl -o default.conf.template https://raw.githubusercontent.com/suitenumerique/m

 ## Step 2: Configuration

-Meet configuration is achieved through environment variables. We provide a [detailed description of all variables](../../src/helm/meet/README.md).
+Meet configuration is achieved through environment variables. We provide a [detailed description of all variables](../env.md).

 In this example, we assume the following services:

@@ -87,12 +87,12 @@ If you are using an external service, you need to set `REDIS_URL` environment va

 Generate a secure key for `LIVEKIT_API_SECRET` in `env.d/common`.

-We provide a minimal recommended config for production environment in `livekit-server.yaml`. Set the previously generated API secret key in the config file.
+We provide a minimal recommanded config for production environment in `livekit-server.yaml`. Set the previously generated API secret key in the config file.

 To view other customization options, see [config-sample.yaml](https://github.com/livekit/livekit/blob/master/config-sample.yaml)

 > [!NOTE]
-> In this example, we configured multiplexing on a single UDP port. For better performance, you can configure a range of UDP ports. 
+> In this example, we configured multiplexing on a single UDP port. For better performances, you can configure a range of UDP ports. 

 ### Meet

@@ -129,7 +129,7 @@ The following ports will need to be opened:
 - 7881/tcp - WebRTC ICE over TCP
 - 7882/udp - for WebRTC multiplexing over UDP

-If you are using ufw, enter the following:
+If you are using ufw, enter the follwoing:
 ```
 ufw allow 80/tcp
 ufw allow 443/tcp
@@ -177,15 +177,6 @@ You will need to uncomment the environment and network sections in compose file
 #    external: true
 ```

-#### Caddy Reverse Proxy
-Expose the Frontend port to the host
-```yaml
-frontend:
-  …
-  ports:
-    - "8086:8086"
-```
-
 ## Step 5: Start Meet

 You are ready to start your Meet application !
@@ -207,7 +198,7 @@ Replace `<admin email>` with the email of your admin user and generate a secure

 Your Meet instance is now available on the domain you defined, https://meet.yourdomain.tld.

-The admin interface is available on https://meet.yourdomain.tld/admin with the admin user you just created.
+THe admin interface is available on https://meet.yourdomain.tld/admin with the admin user you just created.

 ## How to upgrade your Meet application

@@ -122,11 +122,11 @@ If you haven't run the script **bin/start-kind.sh**, you'll need to manually cre
 $ kubectl create namespace meet
 ```

-If you have already run the script, you can skip this step and proceed to the next instruction. NOTE: Before you proceed, and is using the kind method, make sure you download this repo examples/helm directory and its contents to the location where you will be executing the helm command. Helm will look for "examples/helm/<name>values.yaml" from based on the path it is being executed.
+If you have already run the script, you can skip this step and proceed to the next instruction. NOTE: Before you proceed, and is using the kind method, make sure you download this repo examples/ directory and its contents to the location where you will be executing the helm command. Helm will look for "examples/<name>values.yaml" from based on the path it is being executed.

 ```
 $ kubectl config set-context --current --namespace=meet
-$ helm install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak -f examples/helm/keycloak.values.yaml
+$ helm install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak -f examples/keycloak.values.yaml
 $ #wait until
 $ kubectl get po
 NAME                    READY   STATUS    RESTARTS   AGE
@@ -150,7 +150,7 @@ OIDC_RP_SIGN_ALGO: RS256
 OIDC_RP_SCOPES: "openid email"
 ```

-You can find these values in **examples/helm/keycloak.values.yaml**
+You can find these values in **examples/keycloak.values.yaml**

 ### Find livekit server connexion values

@@ -159,7 +159,7 @@ LaSuite Meet use livekit for streaming part so if you have a livekit provider, o
 Livekit need a redis (and meet too) so we will start by deploying a redis :

 ```
-$ helm install redis oci://registry-1.docker.io/bitnamicharts/redis -f examples/helm/redis.values.yaml
+$ helm install redis oci://registry-1.docker.io/bitnamicharts/redis -f examples/redis.values.yaml
 $ kubectl get po
 NAME                    READY   STATUS    RESTARTS   AGE
 keycloak-0              1/1     Running   0          26m
@@ -172,7 +172,7 @@ When the redis is ready we can deploy livekit-server.
 ```
 $ helm repo add livekit https://helm.livekit.io
 $ helm repo update
-$ helm install livekit livekit/livekit-server -f examples/helm/livekit.values.yaml
+$ helm install livekit livekit/livekit-server -f examples/livekit.values.yaml
 $ kubectl get po
 NAME                                      READY   STATUS    RESTARTS   AGE
 keycloak-0                                1/1     Running   0          30m
@@ -199,7 +199,7 @@ CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
 LaSuite Meet uses a postgresql db as backend so if you have a provider, obtain the necessary information to use it. If you do not have, you can install a postgresql testing environment as follows:

 ```
-$ helm install postgresql oci://registry-1.docker.io/bitnamicharts/postgresql -f examples/helm/postgresql.values.yaml
+$ helm install postgresql oci://registry-1.docker.io/bitnamicharts/postgresql -f examples/postgresql.values.yaml
 $ kubectl get po
 NAME                                      READY   STATUS    RESTARTS   AGE
 keycloak-0                                1/1     Running   0          45m
@@ -226,7 +226,7 @@ Now you are ready to deploy LaSuite Meet without AI. AI required more dependenci
 ```
 $ helm repo add meet https://suitenumerique.github.io/meet/
 $ helm repo update
-$ helm install meet meet/meet -f examples/helm/meet.values.yaml
+$ helm install meet meet/meet -f examples/meet.values.yaml
 ```

 ## Test your deployment
@@ -1,185 +0,0 @@
-# Deployment on Scalingo
-
-This guide explains how to deploy La Suite Meet on [Scalingo](https://scalingo.com/) using the [Suite Numérique buildpack](https://github.com/suitenumerique/buildpack).
-
-## Overview
-
-Scalingo is a Platform-as-a-Service (PaaS) that simplifies application deployment. This setup uses a custom buildpack to handle both the frontend (Vite) and backend (Django) builds, serving them through Nginx.
-
-## Prerequisites
-
- A Scalingo account
- Scalingo CLI installed (optional but recommended)
- A PostgreSQL database addon
- A Redis addon (for caching and sessions)
-
-## Step 1: Create Your App
-
-Create a new app on Scalingo using `scalingo` cli or using the [Scalingo dashboard](https://dashboard.scalingo.com/).
-
-## Step 2: Provision Addons
-
-Add the required PostgreSQL and Redis services.
-
-This will set the following environment variables automatically:
- `SCALINGO_POSTGRESQL_URL` - Database connection string
- `SCALINGO_REDIS_URL` - Redis connection string
-
-## Step 3: Configure Environment Variables
-
-Set the following environment variables in your Scalingo app:
-
-### Buildpack Configuration
-
-```bash
-scalingo env-set BUILDPACK_URL="https://github.com/suitenumerique/buildpack#main"
-scalingo env-set LASUITE_APP_NAME="meet"
-scalingo env-set LASUITE_BACKEND_DIR="."
-scalingo env-set LASUITE_FRONTEND_DIR="src/frontend/"
-scalingo env-set LASUITE_NGINX_DIR="."
-scalingo env-set LASUITE_SCRIPT_POSTCOMPILE="bin/buildpack_postcompile.sh"
-scalingo env-set LASUITE_SCRIPT_POSTFRONTEND="bin/buildpack_postfrontend.sh"
-```
-
-### Database and Cache
-
-```bash
-scalingo env-set DATABASE_URL="\$SCALINGO_POSTGRESQL_URL"
-scalingo env-set REDIS_URL="\$SCALINGO_REDIS_URL"
-```
-
-### Django Settings
-
-```bash
-scalingo env-set DJANGO_SETTINGS_MODULE="meet.settings"
-scalingo env-set DJANGO_CONFIGURATION="Production"
-scalingo env-set DJANGO_SECRET_KEY="<generate-a-secure-secret-key>"
-scalingo env-set DJANGO_ALLOWED_HOSTS="my-meet-app.osc-fr1.scalingo.io"
-```
-
-### OIDC Authentication
-
-Configure your OIDC provider (e.g., Keycloak, Authentik):
-
-```bash
-scalingo env-set OIDC_OP_BASE_URL="https://auth.yourdomain.com/realms/meet"
-scalingo env-set OIDC_RP_CLIENT_ID="meet-client-id"
-scalingo env-set OIDC_RP_CLIENT_SECRET="<your-client-secret>"
-scalingo env-set OIDC_RP_SIGN_ALGO="RS256"
-```
-
-### LiveKit Configuration
-
-Meet requires a LiveKit server for video conferencing:
-
-```bash
-scalingo env-set LIVEKIT_API_URL="wss://livekit.yourdomain.com"
-scalingo env-set LIVEKIT_API_KEY="<your-livekit-api-key>"
-scalingo env-set LIVEKIT_API_SECRET="<your-livekit-api-secret>"
-```
-
-### Email Configuration (Optional)
-
-For email notifications see https://doc.scalingo.com/platform/app/sending-emails:
-
-```bash
-scalingo env-set DJANGO_EMAIL_HOST="smtp.example.org"
-scalingo env-set DJANGO_EMAIL_PORT="587"
-scalingo env-set DJANGO_EMAIL_HOST_USER="<smtp-user>"
-scalingo env-set DJANGO_EMAIL_HOST_PASSWORD="<smtp-password>"
-scalingo env-set DJANGO_EMAIL_USE_TLS="True"
-scalingo env-set DJANGO_EMAIL_FROM="meet@yourdomain.com"
-```
-
-## Step 4: Deploy
-
-Deploy your application:
-
-```bash
-git push scalingo main
-```
-
-The Procfile will automatically:
-1. Build the frontend (Vite)
-2. Build the backend (Django)
-3. Run the post-compile script (cleanup)
-4. Run the post-frontend script (move assets and prepare for deployment)
-5. Start Nginx and Gunicorn
-6. Run django migrations
-
-## Step 5: Create superuser
-
-After the first deployment, create an admin user:
-
-```bash
-scalingo run python manage.py createsuperuser
-```
-
-## Custom Domain (Optional)
-
-To use a custom domain:
-
-1. Add the domain in Scalingo dashboard
-2. Update `DJANGO_ALLOWED_HOSTS` with your custom domain
-3. Configure your DNS to point to Scalingo
-
-```bash
-scalingo domains-add meet.yourdomain.com
-scalingo env-set DJANGO_ALLOWED_HOSTS="meet.yourdomain.com,my-meet-app.osc-fr1.scalingo.io"
-```
-
-## Custom Logo (Optional)
-
-To use a custom logo, set the `CUSTOM_LOGO_URL` environment variable with an HTTPS URL pointing to an SVG item (max 5MB):
-
-```bash
-scalingo env-set CUSTOM_LOGO_URL="https://cdn.yourdomain.com/logo.svg"
-```
-
-## Troubleshooting
-
-### Check Logs
-
-```bash
-scalingo logs --tail
-```
-
-### Common Issues
-
-1. **Build fails**: Check that all required environment variables are set
-2. **Database connection error**: Verify `DATABASE_URL` is correctly set to `$SCALINGO_POSTGRESQL_URL`
-3. **Static files not served**: Ensure the buildpack post-frontend script ran successfully
-4. **OIDC errors**: Verify your OIDC provider configuration and callback URLs
-
-### Useful Commands
-
-```bash
-# Open a console
-scalingo run bash
-
-# Restart the app
-scalingo restart
-
-# Scale containers
-scalingo scale web:2
-
-# One-off command
-scalingo run python manage.py shell
-```
-
-## Architecture
-
-On Scalingo, the application runs as follows:
-
-1. **Build Phase**: The buildpack compiles both frontend and backend
-2. **Runtime**:
-   - Nginx serves static files and proxies to the backend
-   - Gunicorn runs the Django WSGI application
-   - Both processes are managed by the `bin/buildpack_start.sh` script
-
-## Additional Resources
-
- [Scalingo Documentation](https://doc.scalingo.com/)
- [Suite Numérique Buildpack](https://github.com/suitenumerique/buildpack)
- [Meet Environment Variables](../../src/helm/meet/README.md)
- [Django Configurations Documentation](https://django-configurations.readthedocs.io/)
@@ -23,11 +23,9 @@ MEET_BASE_URL="http://localhost:8072"

 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
-AWS_S3_DOMAIN_REPLACE=http://localhost:9000
 AWS_S3_ENDPOINT_URL=http://minio:9000
 AWS_S3_ACCESS_KEY_ID=meet
 AWS_S3_SECRET_ACCESS_KEY=password
-MEDIA_BASE_URL=http://localhost:8083

 # OIDC
 OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/certs
@@ -20,7 +20,7 @@ DJANGO_EMAIL_FROM=<your email address>
 #DJANGO_EMAIL_USE_SSL=true # A flag to enable or disable SSL for email sending.

 DJANGO_EMAIL_BRAND_NAME="La Suite Numérique" 
-DJANGO_EMAIL_LOGO_IMG="https://${MEET_HOST}/assets/logo-suite-numerique.png"
+DJANGO_EMAIL_LOGO_IMG="https://${meet_HOST}/assets/logo-suite-numerique.png"

 # Backend url
 MEET_BASE_URL="https://${MEET_HOST}"
@@ -2,7 +2,6 @@
 Gitlint extra rule to validate that the message title is of the form
 "<gitmoji>(<scope>) <subject>"
 """
-
 from __future__ import unicode_literals

 import re
@@ -3,21 +3,6 @@
  "dependencyDashboard": true,
  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
-    {
-        "groupName": "js dependencies",
-        "matchManagers": ["npm"],
-        "schedule": ["on the first day of the month"],
-        "matchPackagePatterns": ["*"],
-        "minimumReleaseAge": "7 days",
-        "internalChecksFilter": "strict"
-      },
-      {
-        "groupName": "python dependencies",
-        "matchManagers": ["setup-cfg", "pep621"],
-        "schedule": ["on the first day of the month"],
-        "matchPackagePatterns": ["*"],
-        "minimumReleaseAge": "7 days"
-      },
    {
      "enabled": false,
      "groupName": "ignored python dependencies",
@@ -30,12 +15,6 @@
      "matchPackageNames": ["pylint"],
      "allowedVersions": "<4.0.0"
    },
-    {
-        "groupName": "allowed django versions",
-        "matchManagers": ["pep621"],
-        "matchPackageNames": ["django"],
-        "allowedVersions": "<6.0.0"
-    },
    {
      "enabled": false,
      "groupName": "ignored js dependencies",
@@ -4,8 +4,6 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libgobject-2.0-0 \
-    "openssl=3.5.4-1~deb13u2" \
-    "libssl3t64=3.5.4-1~deb13u2" \
    && rm -rf /var/lib/apt/lists/*

 FROM base AS builder
@@ -21,9 +19,6 @@ FROM base AS production

 WORKDIR /app

-# Remove pip to reduce attack surface in production
-RUN pip uninstall -y pip
-
 ARG DOCKER_USER
 USER ${DOCKER_USER}

@@ -1,15 +1,14 @@

 [project]
 name = "agents"
-version = "1.10.0"
+version = "1.2.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.3.10",
    "livekit-plugins-deepgram==1.3.10",
    "livekit-plugins-silero==1.3.10",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1",
-    "protobuf==6.33.5"
+    "python-dotenv==1.2.1"
 ]

 [project.optional-dependencies]
@@ -115,10 +115,6 @@ class RoomAdmin(admin.ModelAdmin):
    list_filter = ["access_level", "created_at"]
    readonly_fields = ["id", "created_at", "updated_at"]

-    def get_queryset(self, request):
-        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
-        return super().get_queryset(request).prefetch_related("accesses__user")
-
    def get_owner(self, obj):
        """Return the owner of the room for display in the admin list."""

@@ -142,7 +138,6 @@ class RecordingAccessInline(admin.TabularInline):

    model = models.RecordingAccess
    extra = 0
-    autocomplete_fields = ["user"]


@admin.action(description=_("Resend notification to external service"))
@@ -212,18 +207,8 @@ class RecordingAdmin(admin.ModelAdmin):
        "created_at",
        "worker_id",
    )
-    list_filter = ["created_at"]
-    list_select_related = ("room",)
-    readonly_fields = (
-        "id",
-        "created_at",
-        "options",
-        "mode",
-        "room",
-        "status",
-        "updated_at",
-        "worker_id",
-    )
+    list_filter = ["status", "room", "created_at"]
+    readonly_fields = ["id", "created_at", "updated_at"]
    actions = [resend_notification]

    def get_queryset(self, request):
@@ -1,67 +0,0 @@
-"""API filters for meet' core application."""
-
-from django.utils.translation import gettext_lazy as _
-
-import django_filters
-from django_filters import BooleanFilter
-
-from core import models
-
-
-class FileFilter(django_filters.FilterSet):
-    """
-    Custom filter for filtering files.
-    """
-
-    class Meta:
-        model = models.File
-        fields = ["type"]
-
-
-class ListFileFilter(FileFilter):
-    """Filter class dedicated to the file viewset list method."""
-
-    is_creator_me = django_filters.BooleanFilter(
-        method="filter_is_creator_me", label=_("Creator is me")
-    )
-
-    is_deleted = BooleanFilter(field_name="deleted_at", method="filter_is_deleted")
-
-    class Meta:
-        model = models.File
-        fields = ["is_creator_me", "type", "upload_state", "is_deleted"]
-
-    def filter_is_deleted(self, queryset, name, value):
-        """
-        Filter files based on whether they are deleted or not.
-
-        Example:
-            - /api/v1.0/files/?is_deleted=false
-                → Filters files that were not deleted
-        """
-        if value is None:
-            return queryset
-
-        lookup = "__".join([name, "isnull"])
-        return queryset.filter(**{lookup: not value})
-
-    # pylint: disable=unused-argument
-    def filter_is_creator_me(self, queryset, name, value):
-        """
-        Filter files based on the `creator` being the current user.
-
-        Example:
-            - /api/v1.0/files/?is_creator_me=true
-                → Filters files created by the logged-in user
-            - /api/v1.0/files/?is_creator_me=false
-                → Filters files created by other users
-        """
-        user = self.request.user
-
-        if not user.is_authenticated:
-            return queryset
-
-        if value:
-            return queryset.filter(creator=user)
-
-        return queryset.exclude(creator=user)
@@ -1,7 +1,5 @@
 """Permission handlers for the Meet core app."""

-from django.http import Http404
-
 from rest_framework import permissions

 from ..models import RoleChoices
@@ -108,23 +106,3 @@ class HasLiveKitRoomAccess(permissions.BasePermission):
        if not request.auth or not hasattr(request.auth, "video"):
            return False
        return request.auth.video.room == str(obj.id)
-
-
-class FilePermission(IsAuthenticated):
-    """
-    Permissions applying to the file API endpoint.
-    Handling soft deletions specificities
-    """
-
-    def has_object_permission(self, request, view, obj):
-        """
-        Return a 404 on deleted files or if the user is not the owner
-        """
-
-        if obj.deleted_at is not None or obj.hard_deleted_at is not None:
-            raise Http404
-
-        if obj.creator != request.user:
-            raise Http404
-
-        return obj.get_abilities(request.user).get(view.action, False)
@@ -1,27 +1,16 @@
 """Client serializers for the Meet core app."""

 # pylint: disable=abstract-method,no-name-in-module
-import logging
-from os.path import splitext
-from typing import Literal
-from urllib.parse import quote

-from django.conf import settings
-from django.core.exceptions import SuspiciousOperation
-
-# pylint: disable=abstract-method,no-name-in-module
 from django.utils.translation import gettext_lazy as _

-from django_pydantic_field.rest_framework import SchemaField
-from pydantic import BaseModel, Field
+from livekit.api import ParticipantPermission
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
 from timezone_field.rest_framework import TimeZoneSerializerField

 from core import models, utils

-logger = logging.getLogger(__name__)
-

 class UserSerializer(serializers.ModelSerializer):
    """Serialize users."""
@@ -34,15 +23,6 @@ class UserSerializer(serializers.ModelSerializer):
        read_only_fields = ["id", "email", "full_name", "short_name"]


-class UserLightSerializer(serializers.ModelSerializer):
-    """Serialize users with limited fields."""
-
-    class Meta:
-        model = models.User
-        fields = ["id", "full_name", "short_name"]
-        read_only_fields = ["id", "full_name", "short_name"]
-
-
 class ResourceAccessSerializerMixin:
    """
    A serializer mixin to share controlling that the logged-in user submitting a room access object
@@ -221,27 +201,6 @@ class BaseValidationOnlySerializer(serializers.Serializer):
        raise NotImplementedError(f"{self.__class__.__name__} is validation-only")


-class RecordingOptions(BaseModel):
-    """Configuration options for recording.
-
-    Attributes:
-        language: ISO 639-1 language code compatible with whisperX.
-            When `None`, the transcription engine will attempt to
-            auto-detect the spoken language.
-        transcribe: Whether to transcribe the recorded audio.
-            When `None`, falls back to the application default.
-        original_mode: The original recording mode before any override.
-            Must be one of the valid RecordingModeChoices values when provided.
-
-    """
-
-    language: str | None = None
-    transcribe: bool | None = None
-    original_mode: Literal["screen_recording", "transcript"] | None = None
-
-    model_config = {"extra": "forbid"}
-
-
 class StartRecordingSerializer(BaseValidationOnlySerializer):
    """Validate start recording requests."""

@@ -254,11 +213,10 @@ class StartRecordingSerializer(BaseValidationOnlySerializer):
            "screen_recording or transcript.",
        },
    )
-    options = SchemaField(
-        schema=RecordingOptions | None,
+    options = serializers.JSONField(
        required=False,
        allow_null=True,
-        help_text="Recording options",
+        default=dict,
    )


@@ -303,28 +261,6 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
    )


-class ParticipantPermission(BaseModel):
-    """Mirror the LiveKit ParticipantPermission protobuf.
-
-    Control what a participant is allowed to publish, subscribe, and do within a room.
-    Unknown fields are rejected.
-    """
-
-    can_subscribe: bool | None = None
-    can_publish: bool | None = None
-    can_publish_data: bool | None = None
-    can_publish_sources: list[int] = Field(
-        default_factory=list
-    )  # TrackSource enum values
-    hidden: bool | None = None
-    recorder: bool | None = None
-    can_update_metadata: bool | None = None
-    agent: bool | None = None
-    can_subscribe_metrics: bool | None = None
-
-    model_config = {"extra": "forbid"}
-
-
 class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
    """Validate participant update data."""

@@ -336,11 +272,10 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
        allow_null=True,
        help_text="Participant attributes as JSON object",
    )
-    permission = SchemaField(
-        schema=ParticipantPermission | None,
+    permission = serializers.DictField(
        required=False,
        allow_null=True,
-        help_text="Participant permissions",
+        help_text="Participant permission as JSON object",
    )
    name = serializers.CharField(
        max_length=255,
@@ -350,33 +285,6 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
        help_text="Display name for the participant",
    )

-    def validate_permission(self, permission):
-        """Validate that the given permission does not include forbidden or unimplemented fields."""
-
-        if permission is None:
-            return None
-
-        suspicious_fields = [
-            field
-            for field in settings.PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS
-            if getattr(permission, field) is not None
-        ]
-        if suspicious_fields:
-            raise SuspiciousOperation(
-                f"Setting the following participant permissions is not allowed: "
-                f"{', '.join(suspicious_fields)}."
-            )
-        if permission.can_subscribe_metrics is not None:
-            raise serializers.ValidationError(
-                {
-                    "permission": {
-                        "can_subscribe_metrics": "This permission is not implemented."
-                    }
-                }
-            )
-
-        return permission
-
    def validate(self, attrs):
        """Ensure at least one update field is provided."""
        update_fields = ["metadata", "attributes", "permission", "name"]
@@ -392,144 +300,12 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
                f"{', '.join(update_fields)}."
            )

-        return attrs
-
-
-class ListFileSerializer(serializers.ModelSerializer):
-    """Serialize File model for the API."""
-
-    url = serializers.SerializerMethodField(read_only=True)
-    creator = UserLightSerializer(read_only=True)
-    abilities = serializers.SerializerMethodField(read_only=True)
-
-    class Meta:
-        model = models.File
-        fields = [
-            "id",
-            "created_at",
-            "updated_at",
-            "title",
-            "type",
-            "creator",
-            "deleted_at",
-            "hard_deleted_at",
-            "filename",
-            "upload_state",
-            "mimetype",
-            "size",
-            "description",
-            "url",
-            "abilities",
-        ]
-        read_only_fields = [
-            "id",
-            "created_at",
-            "updated_at",
-            "creator",
-            "deleted_at",
-            "hard_deleted_at",
-            "filename",
-            "upload_state",
-            "mimetype",
-            "size",
-            "url",
-            "abilities",
-        ]
-
-    def get_url(self, obj):
-        """Return the URL of the file."""
-        if obj.is_pending_upload:
-            return None
-
-        return f"{settings.MEDIA_BASE_URL}{settings.MEDIA_URL}{quote(obj.file_key)}"
-
-    def get_abilities(self, file) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if not request:
-            return {}
-
-        return file.get_abilities(request.user)
-
-
-class FileSerializer(ListFileSerializer):
-    """Default serializer File model for the API."""
-
-    def create(self, validated_data):
-        raise NotImplementedError("Create method can not be used.")
-
-
-class CreateFileSerializer(ListFileSerializer):
-    """Serializer used to create a new file"""
-
-    title = serializers.CharField(max_length=255, required=False)
-    policy = serializers.SerializerMethodField()
-
-    class Meta:
-        model = models.File
-        fields = [*ListFileSerializer.Meta.fields, "policy"]
-        read_only_fields = [
-            *(
-                field
-                for field in ListFileSerializer.Meta.read_only_fields
-                if field != "filename"
-            ),
-            "policy",
-        ]
-
-    def get_fields(self):
-        """Force the id field to be writable."""
-        fields = super().get_fields()
-        fields["id"].read_only = False
-
-        return fields
-
-    def validate_id(self, value):
-        """Ensure the provided ID does not already exist when creating a new file."""
-        request = self.context.get("request")
-
-        # Only check this on POST (creation)
-        if request and models.File.objects.filter(id=value).exists():
-            raise serializers.ValidationError(
-                "A file with this ID already exists. You cannot override it.",
-                code="file_create_existing_id",
-            )
-
-        return value
-
-    def validate(self, attrs):
-        """Validate extension and fill title."""
-        # we run the default validation first to make sure the base data in attrs is ok
-        attrs = super().validate(attrs)
-
-        filename_root, ext = splitext(attrs["filename"])
-
-        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
-            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[attrs["type"]]
-            if ext.lower() not in config_for_file_type["allowed_extensions"]:
-                logger.info(
-                    "create_item: file extension not allowed %s for filename %s",
-                    ext,
-                    attrs["filename"],
-                )
+        if "permission" in attrs:
+            try:
+                ParticipantPermission(**attrs["permission"])
+            except ValueError as e:
                raise serializers.ValidationError(
-                    {"filename": _("This file extension is not allowed.")},
-                    code="item_create_file_extension_not_allowed",
-                )
-
-        # The title will be the filename if not provided
-        if not attrs.get("title", None):
-            attrs["title"] = filename_root
+                    {"permission": f"Invalid permission: {str(e)}"}
+                ) from e

        return attrs
-
-    def get_policy(self, file):
-        """Return the policy to use if the item is a file."""
-
-        if file.upload_state == models.FileUploadStateChoices.READY:
-            return None
-
-        return utils.generate_upload_policy(file)
-
-    def update(self, instance, validated_data):
-        raise NotImplementedError("Update method can not be used.")
@@ -1,75 +0,0 @@
-"""Throttling modules for the API."""
-
-from django.conf import settings
-
-from lasuite.drf.throttling import MonitoredThrottleMixin
-from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
-from sentry_sdk import capture_message
-
-
-def sentry_monitoring_throttle_failure(message):
-    """Log when a failure occurs to detect rate limiting issues."""
-    capture_message(message, "warning")
-
-
-class MonitoredAnonRateThrottle(MonitoredThrottleMixin, AnonRateThrottle):
-    """Throttle for the monitored scoped rate throttle."""
-
-
-class MonitoredUserRateThrottle(MonitoredThrottleMixin, UserRateThrottle):
-    """Throttle for the monitored scoped rate throttle."""
-
-
-class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
-    """Throttle authenticated user requesting room entry"""
-
-    scope = "request_entry"
-
-    def get_cache_key(self, request, view):
-        """Use the authenticated user ID as the throttle cache key."""
-
-        if request.user and not request.user.is_authenticated:
-            return None  # Defer to RequestEntryAnonRateThrottle for anonymous users.
-
-        return super().get_cache_key(request, view)
-
-
-class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle Anonymous user requesting room entry"""
-
-    scope = "request_entry"
-
-    def get_cache_key(self, request, view):
-        """Use the lobby participant cookie ID as the throttle cache key.
-
-        Only throttle if a cookie is already set. If no cookie exists yet,
-        return None to skip throttling — the cookie will be set on the first
-        response, and throttling will apply from the second request onward.
-
-        Keying on the cookie rather than the IP address prevents penalising
-        multiple users behind the same NAT/proxy, and is consistent with how
-        LobbyService identifies participants.
-
-        Note: as per DRF documentation, application-level throttling is not a
-        security measure against brute-force or DoS attacks. This throttle exists
-        solely to guard against accidental hammering from buggy clients.
-        """
-
-        if request.user and request.user.is_authenticated:
-            return None  # Only throttle unauthenticated requests.
-
-        participant_id = request.COOKIES.get(settings.LOBBY_COOKIE_NAME)
-
-        if participant_id is None:
-            return None  # No throttling for cookieless requests
-
-        return self.cache_format % {
-            "scope": self.scope,
-            "ident": participant_id,
-        }
-
-
-class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle Anonymous user requesting room generation callback"""
-
-    scope = "creation_callback"
@@ -1,26 +1,16 @@
 """API endpoints"""
-# pylint: disable=too-many-lines

-import re
 import uuid
 from logging import getLogger
-from urllib.parse import unquote, urlparse
+from urllib.parse import urlparse

 from django.conf import settings
-from django.core.files.storage import default_storage
 from django.db.models import Q
 from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.text import slugify

-from django_filters import rest_framework as django_filters
-from rest_framework import (
-    decorators,
-    filters,
-    mixins,
-    pagination,
-    viewsets,
-)
+from rest_framework import decorators, mixins, pagination, throttling, viewsets
 from rest_framework import (
    exceptions as drf_exceptions,
 )
@@ -32,7 +22,6 @@ from rest_framework import (
 )

 from core import enums, models, utils
-from core.api.filters import ListFileFilter
 from core.recording.enums import FileExtension
 from core.recording.event.authentication import StorageEventAuthentication
 from core.recording.event.exceptions import (
@@ -67,10 +56,9 @@ from core.services.participants_management import (
 )
 from core.services.room_creation import RoomCreation
 from core.services.subtitle import SubtitleException, SubtitleService
-from core.tasks.file import process_file_deletion

 from ..authentication.livekit import LiveKitTokenAuthentication
-from . import permissions, serializers, throttling
+from . import permissions, serializers
 from .feature_flag import FeatureFlag

 # pylint: disable=too-many-ancestors
@@ -78,17 +66,6 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)


-FILE_FOLDER = settings.FILE_UPLOAD_PATH
-UUID_REGEX = (
-    r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
-)
-FILE_EXT_REGEX = r"[\d\w]+"
-MEDIA_STORAGE_URL_PATTERN = re.compile(
-    f"{settings.MEDIA_URL:s}"
-    rf"(?P<key>{FILE_FOLDER:s}/(?P<pk>{UUID_REGEX:s})/\.{FILE_EXT_REGEX:s})$"
-)
-
-
 class NestedGenericViewSet(viewsets.GenericViewSet):
    """
    A generic Viewset aims to be used in a nested route context.
@@ -100,20 +77,20 @@ class NestedGenericViewSet(viewsets.GenericViewSet):
    lookup_fields: list[str] = ["pk"]
    lookup_url_kwargs: list[str] = []

-    def __getattribute__(self, file):
+    def __getattribute__(self, item):
        """
        This method is overridden to allow to get the last lookup field or lookup url kwarg
        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
        to keep compatibility with all methods used by the parent class `GenericViewSet`.
        """
-        if file in ["lookup_field", "lookup_url_kwarg"]:
-            return getattr(self, file + "s", [None])[-1]
+        if item in ["lookup_field", "lookup_url_kwarg"]:
+            return getattr(self, item + "s", [None])[-1]

-        return super().__getattribute__(file)
+        return super().__getattribute__(item)

    def get_queryset(self):
        """
-        Get the list of files for this view.
+        Get the list of items for this view.

        `lookup_fields` attribute is enumerated here to perform the nested lookup.
        """
@@ -214,6 +191,18 @@ class UserViewSet(
        )


+class RequestEntryAnonRateThrottle(throttling.AnonRateThrottle):
+    """Throttle Anonymous user requesting room entry"""
+
+    scope = "request_entry"
+
+
+class CreationCallbackAnonRateThrottle(throttling.AnonRateThrottle):
+    """Throttle Anonymous user requesting room generation callback"""
+
+    scope = "creation_callback"
+
+
 class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.DestroyModelMixin,
@@ -224,7 +213,6 @@ class RoomViewSet(
    API endpoints to access and perform actions on rooms.
    """

-    pagination_class = Pagination
    permission_classes = [permissions.RoomPermissions]
    queryset = models.Room.objects.all()
    serializer_class = serializers.RoomSerializer
@@ -320,14 +308,12 @@ class RoomViewSet(
            )

        mode = serializer.validated_data["mode"]
-        options = serializer.validated_data.get("options")
+        options = serializer.validated_data["options"]
        room = self.get_object()

        # May raise exception if an active or initiated recording already exist for the room
        recording = models.Recording.objects.create(
-            room=room,
-            mode=mode,
-            options=options.model_dump(exclude_none=True) if options else {},
+            room=room, mode=mode, options=options
        )

        models.RecordingAccess.objects.create(
@@ -393,10 +379,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="request-entry",
        permission_classes=[],
-        throttle_classes=[
-            throttling.RequestEntryAuthenticatedUserRateThrottle,
-            throttling.RequestEntryAnonRateThrottle,
-        ],
+        throttle_classes=[RequestEntryAnonRateThrottle],
    )
    def request_entry(self, request, pk=None):  # pylint: disable=unused-argument
        """Request entry to a room"""
@@ -506,7 +489,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="creation-callback",
        permission_classes=[],
-        throttle_classes=[throttling.CreationCallbackAnonRateThrottle],
+        throttle_classes=[CreationCallbackAnonRateThrottle],
    )
    def creation_callback(self, request):
        """Retrieve cached room data via an unauthenticated request with a unique ID.
@@ -636,15 +619,13 @@ class RoomViewSet(
        serializer = serializers.UpdateParticipantSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)

-        permission = serializer.validated_data.get("permission")
-
        try:
            ParticipantsManagement().update(
                room_name=str(room.pk),
                identity=str(serializer.validated_data["participant_identity"]),
                metadata=serializer.validated_data.get("metadata"),
                attributes=serializer.validated_data.get("attributes"),
-                permission=permission.model_dump() if permission else None,
+                permission=serializer.validated_data.get("permission"),
                name=serializer.validated_data.get("name"),
            )
        except ParticipantsManagementException:
@@ -820,7 +801,7 @@ class RecordingViewSet(
        # Extract the original URL from the request header
        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
        if not original_url:
-            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            logger.debug("Missing HTTP_X_ORIGINAL_URL header in subrequest")
            raise drf_exceptions.PermissionDenied()

        logger.debug("Original url: '%s'", original_url)
@@ -837,7 +818,7 @@ class RecordingViewSet(
        try:
            return match.groupdict()
        except (ValueError, AttributeError) as exc:
-            logger.warning("Failed to extract parameters from subrequest URL: %s", exc)
+            logger.debug("Failed to extract parameters from subrequest URL: %s", exc)
            raise drf_exceptions.PermissionDenied() from exc

    @decorators.action(detail=False, methods=["get"], url_path="media-auth")
@@ -861,7 +842,7 @@ class RecordingViewSet(
        recording_id = url_params["recording_id"]

        extension = url_params["extension"]
-        if extension not in [file.value for file in FileExtension]:
+        if extension not in [item.value for item in FileExtension]:
            raise drf_exceptions.ValidationError({"detail": "Unsupported extension."})

        try:
@@ -885,302 +866,3 @@ class RecordingViewSet(
        request = utils.generate_s3_authorization_headers(recording.key)

        return drf_response.Response("authorized", headers=request.headers, status=200)
-
-
-# pylint: disable=too-many-public-methods
-class FileViewSet(
-    SerializerPerActionMixin,
-    mixins.CreateModelMixin,
-    mixins.DestroyModelMixin,
-    mixins.UpdateModelMixin,
-    mixins.ListModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    FileViewSet API.
-
-    This viewset provides CRUD operations and additional actions for managing files.
-
-    ### API Endpoints:
-    1. **List**: Retrieve a paginated list of files.
-       Example: GET /files/?page=2
-    2. **Retrieve**: Get a specific file by its ID.
-       Example: GET /files/{id}/
-    3. **Create**: Create a new file.
-       Example: POST /files/
-    4. **Update**: Update a file by its ID.
-       Example: PUT /files/{id}/
-    5. **Delete**: Soft delete a file by its ID.
-       Example: DELETE /files/{id}/
-
-
-    ### Ordering: created_at, updated_at, title
-
-        Example:
-        - Ascending: GET /api/v1.0/files/?ordering=created_at
-
-    ### Filtering:
-        - `is_creator_me=true`: Returns files created by the current user.
-        - `is_creator_me=false`: Returns files created by other users.
-        - `is_deleted=false`: Returns files that are not (soft) deleted
-
-        Example:
-        - GET /api/v1.0/files/?is_creator_me=true
-        - GET /api/v1.0/files/?is_creator_me=false&is_deleted=false
-
-    ### Notes:
-    - Implements soft delete logic to retain file
-    """
-
-    ordering = ["-updated_at"]
-    ordering_fields = ["created_at", "updated_at", "title"]
-    pagination_class = Pagination
-    permission_classes = [
-        permissions.FilePermission,
-    ]
-    queryset = models.File.objects.filter(hard_deleted_at__isnull=True)
-    default_serializer_class = serializers.FileSerializer
-    serializer_classes = {
-        "list": serializers.ListFileSerializer,
-        "create": serializers.CreateFileSerializer,
-    }
-    filter_backends = (django_filters.DjangoFilterBackend, filters.OrderingFilter)
-    filterset_class = ListFileFilter
-
-    def get_queryset(self):
-        """Get queryset that defaults to the current request user."""
-        user = self.request.user
-        queryset = super().get_queryset().select_related("creator")
-
-        if not user.is_authenticated:
-            return queryset.none()
-
-        # For now, we force the filtering on the current user in all cases, might evolve later
-        queryset = queryset.filter(creator=user)
-        return queryset
-
-    def get_response_for_queryset(self, queryset, context=None):
-        """Return paginated response for the queryset if requested."""
-        context = context or self.get_serializer_context()
-        page = self.paginate_queryset(queryset)
-        if page is not None:
-            serializer = self.get_serializer(page, many=True, context=context)
-            result = self.get_paginated_response(serializer.data)
-            return result
-
-        serializer = self.get_serializer(queryset, many=True, context=context)
-        return drf_response.Response(serializer.data)
-
-    def perform_create(self, serializer):
-        """Set the current user as creator of the newly created file."""
-        serializer.save(creator=self.request.user)
-
-    def perform_destroy(self, instance):
-        """Override to implement a soft delete instead of dumping the record in database."""
-        instance.soft_delete()
-
-    @decorators.action(detail=True, methods=["post"], url_path="upload-ended")
-    def upload_ended(self, request, *args, **kwargs):
-        """
-        Check the actual uploaded file and mark it as ready.
-        """
-
-        file = self.get_object()
-
-        if not file.is_pending_upload:
-            raise drf_exceptions.ValidationError(
-                {"file": "This action is only available for files in PENDING state."},
-                code="file_upload_state_not_pending",
-            )
-
-        s3_client = default_storage.connection.meta.client
-
-        head_response = s3_client.head_object(
-            Bucket=default_storage.bucket_name, Key=file.file_key
-        )
-        file_size = head_response["ContentLength"]
-
-        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
-            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
-            if file_size > config_for_file_type["max_size"]:
-                self._complete_file_deletion(file)
-                logger.info(
-                    "upload_ended: file size (%s) for file %s higher than the allowed max size",
-                    file_size,
-                    file.file_key,
-                )
-                raise drf_exceptions.ValidationError(
-                    detail="The file size is higher than the allowed max size.",
-                    code="file_size_exceeded",
-                )
-
-        # python-magic recommends using at least the first 2048 bytes
-        # to reduce incorrect identification.
-        # This is a tradeoff between pulling in the whole file and the most likely relevant bytes
-        # of the file for mime type identification.
-        if file_size > 2048:
-            range_response = s3_client.get_object(
-                Bucket=default_storage.bucket_name,
-                Key=file.file_key,
-                Range="bytes=0-2047",
-            )
-            file_head = range_response["Body"].read()
-        else:
-            file_head = s3_client.get_object(
-                Bucket=default_storage.bucket_name, Key=file.file_key
-            )["Body"].read()
-
-        # Use improved MIME type detection combining magic bytes and file extension
-        logger.info("upload_ended: detecting mimetype for file: %s", file.file_key)
-        mimetype = utils.detect_mimetype(file_head, filename=file.filename)
-
-        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
-            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
-            allowed_file_mimetypes = config_for_file_type["allowed_mimetypes"]
-            if mimetype not in allowed_file_mimetypes:
-                self._complete_file_deletion(file)
-                logger.warning(
-                    "upload_ended: mimetype not allowed %s for file %s",
-                    mimetype,
-                    file.file_key,
-                )
-                raise drf_exceptions.ValidationError(
-                    detail="The file type is not allowed.",
-                    code="file_type_not_allowed",
-                )
-
-        file.upload_state = models.FileUploadStateChoices.READY
-        file.mimetype = mimetype
-        file.size = file_size
-
-        file.save(update_fields=["upload_state", "mimetype", "size"])
-
-        if head_response["ContentType"] != mimetype:
-            logger.info(
-                "upload_ended: content type mismatch between object storage and file,"
-                " updating from %s to %s",
-                head_response["ContentType"],
-                mimetype,
-            )
-            s3_client.copy_object(
-                Bucket=default_storage.bucket_name,
-                Key=file.file_key,
-                CopySource={
-                    "Bucket": default_storage.bucket_name,
-                    "Key": file.file_key,
-                },
-                ContentType=mimetype,
-                Metadata=head_response["Metadata"],
-                MetadataDirective="REPLACE",
-            )
-
-        # Not yet implemented
-        # Change the file.upload_state when this will be done
-        # malware_detection.analyse_file(file.file_key, file_id=file.id)
-
-        serializer = self.get_serializer(file)
-
-        return drf_response.Response(serializer.data, status=drf_status.HTTP_200_OK)
-
-    def _complete_file_deletion(self, file):
-        """Delete a file completely."""
-        file.soft_delete()
-        file.hard_delete()
-        process_file_deletion.delay(file.id)
-
-    def _authorize_subrequest(self, request, pattern):
-        """
-        Authorize access based on the original URL of an Nginx subrequest
-        and user permissions. Returns a dictionary of URL parameters if authorized.
-
-        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
-        See corresponding ingress configuration in Helm chart and read about the
-        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
-        is configured to do this.
-
-        Based on the original url and the logged in user, we must decide if we authorize Nginx
-        to let this request go through (by returning a 200 code) or if we block it (by returning
-        a 403 error). Note that we return 403 errors without any further details for security
-        reasons.
-
-        Parameters:
-        - pattern: The regex pattern to extract identifiers from the URL.
-
-        Returns:
-        - A dictionary of URL parameters if the request is authorized.
-        Raises:
-        - PermissionDenied if authorization fails.
-        """
-        # Extract the original URL from the request header
-        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
-        if not original_url:
-            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
-            raise drf_exceptions.PermissionDenied()
-
-        parsed_url = urlparse(original_url)
-        match = pattern.search(unquote(parsed_url.path))
-
-        if not match:
-            logger.warning(
-                "Subrequest URL '%s' did not match pattern '%s'",
-                parsed_url.path,
-                pattern,
-            )
-            raise drf_exceptions.PermissionDenied()
-
-        try:
-            url_params = match.groupdict()
-        except (ValueError, AttributeError) as exc:
-            logger.warning("Failed to extract parameters from subrequest URL: %s", exc)
-            raise drf_exceptions.PermissionDenied() from exc
-
-        pk = url_params.get("pk")
-        if not pk:
-            logger.warning("File ID (pk) not found in URL parameters: %s", url_params)
-            raise drf_exceptions.PermissionDenied()
-
-        # Fetch the file and check if the user has access
-        queryset = models.File.objects.all()
-        # No suspicious analysis implemented yet
-        # queryset = self._filter_suspicious_files(queryset, request.user)
-        try:
-            file = queryset.get(pk=pk)
-        except models.File.DoesNotExist as exc:
-            logger.warning("File with ID '%s' does not exist", pk)
-            raise drf_exceptions.PermissionDenied() from exc
-
-        user_abilities = file.get_abilities(request.user)
-        if not user_abilities.get(self.action, False):
-            logger.warning(
-                "User '%s' lacks permission for file '%s'", request.user.id, pk
-            )
-            raise drf_exceptions.PermissionDenied()
-
-        logger.debug(
-            "Subrequest authorization successful. Extracted parameters: %s", url_params
-        )
-        return url_params, request.user.id, file
-
-    @decorators.action(detail=False, methods=["get"], url_path="media-auth")
-    def media_auth(self, request, *args, **kwargs):
-        """
-        This view is used by an Nginx subrequest to control access to an file's
-        attachment file.
-
-        When we let the request go through, we compute authorization headers that will be added to
-        the request going through thanks to the nginx.ingress.kubernetes.io/auth-response-headers
-        annotation. The request will then be proxied to the object storage backend who will
-        respond with the file after checking the signature included in headers.
-        """
-        url_params, _, file = self._authorize_subrequest(
-            request, MEDIA_STORAGE_URL_PATTERN
-        )
-
-        if file.is_pending_upload:
-            logger.warning("File '%s' is not ready", file.id)
-            raise drf_exceptions.PermissionDenied()
-
-        # Generate S3 authorization headers using the extracted URL parameters
-        request = utils.generate_s3_authorization_headers(f"{url_params.get('key'):s}")
-
-        return drf_response.Response("authorized", headers=request.headers, status=200)
@@ -1,51 +1,25 @@
 """Authentication Backends for external application to the Meet core app."""

-# pylint: disable=R0913,R0917
-# ruff: noqa: PLR0913
-
 import logging

 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.core.exceptions import SuspiciousOperation

+import jwt as pyJwt
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
 from rest_framework import authentication, exceptions

-from core.models import Application
-from core.services import jwt_token
-
 User = get_user_model()
 logger = logging.getLogger(__name__)


-class BaseJWTAuthentication(authentication.BaseAuthentication):
-    """Base JWT authentication class."""
+class ApplicationJWTAuthentication(authentication.BaseAuthentication):
+    """JWT authentication for application-delegated API access.

-    def __init__(
-        self, secret_key, algorithm, issuer, audience, expiration_seconds, token_type
-    ):
-        """Initialize the JWT authentication backend with the given token service configuration.
-
-        Args:
-            secret_key: Secret key for JWT encoding/decoding
-            algorithm: JWT algorithm (e.g. HS256)
-            issuer: Expected token issuer identifier
-            audience: Expected token audience identifier
-            expiration_seconds: Token expiration time in seconds
-            token_type: Token type (e.g. Bearer)
-        """
-
-        super().__init__()
-
-        self._token_service = jwt_token.JwtTokenService(
-            secret_key=secret_key,
-            algorithm=algorithm,
-            issuer=issuer,
-            audience=audience,
-            expiration_seconds=expiration_seconds,
-            token_type=token_type,
-        )
+    Validates JWT tokens issued to applications that are acting on behalf
+    of users. Tokens must include user_id, client_id, and delegation flag.
+    """

    def authenticate(self, request):
        """Extract and validate JWT from Authorization header.
@@ -72,78 +46,6 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):

        return self.authenticate_credentials(token)

-    def decode_jwt(self, token):
-        """Decode and validate JWT token.
-
-        Args:
-            token: JWT token string
-
-        Returns:
-            Decoded payload dict, or None if token is invalid
-
-        Raises:
-            AuthenticationFailed: If token is expired or has invalid issuer/audience
-        """
-
-        try:
-            payload = self._token_service.decode_jwt(token)
-            return payload
-        except jwt_token.TokenExpiredError as e:
-            logger.warning("Token expired")
-            raise exceptions.AuthenticationFailed("Token expired.") from e
-        except jwt_token.TokenInvalidError as e:
-            logger.warning("Invalid JWT issuer or audience: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except jwt_token.TokenDecodeError:
-            # Invalid JWT token - defer to next authentication backend
-            return None
-
-    def validate_payload(self, payload):
-        """Validate JWT payload claims.
-
-        Override in subclasses to add custom validation.
-
-        Args:
-            payload: Decoded JWT payload
-
-        Raises:
-            AuthenticationFailed: If required claims are missing or invalid
-        """
-
-    def get_user(self, payload):
-        """Retrieve and validate user from payload.
-
-        Args:
-            payload: Decoded JWT payload
-
-        Returns:
-            User instance
-
-        Raises:
-            AuthenticationFailed: If user not found or inactive
-        """
-        user_id = payload.get("user_id")
-
-        if not user_id:
-            logger.warning("Missing 'user_id' in JWT payload")
-            raise exceptions.AuthenticationFailed("Invalid token claims.")
-
-        try:
-            user = User.objects.get(id=user_id)
-        except User.DoesNotExist as e:
-            logger.warning("User not found: %s", user_id)
-            raise exceptions.AuthenticationFailed("User not found.") from e
-
-        if not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user_id)
-            raise exceptions.AuthenticationFailed("User account is disabled.")
-
-        return user
-
-    def authenticate_header(self, request):
-        """Return authentication scheme for WWW-Authenticate header."""
-        return "Bearer"
-
    def authenticate_credentials(self, token):
        """Validate JWT token and return authenticated user.

@@ -158,61 +60,60 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
        Raises:
            AuthenticationFailed: If token is expired, or user not found
        """
-
-        payload = self.decode_jwt(token)
-
-        if payload is None:
+        # Decode and validate JWT
+        try:
+            payload = pyJwt.decode(
+                token,
+                settings.APPLICATION_JWT_SECRET_KEY,
+                algorithms=[settings.APPLICATION_JWT_ALG],
+                issuer=settings.APPLICATION_JWT_ISSUER,
+                audience=settings.APPLICATION_JWT_AUDIENCE,
+            )
+        except pyJwt.ExpiredSignatureError as e:
+            logger.warning("Token expired")
+            raise exceptions.AuthenticationFailed("Token expired.") from e
+        except pyJwt.InvalidIssuerError as e:
+            logger.warning("Invalid JWT issuer: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token.") from e
+        except pyJwt.InvalidAudienceError as e:
+            logger.warning("Invalid JWT audience: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token.") from e
+        except pyJwt.InvalidTokenError:
+            # Invalid JWT token - defer to next authentication backend
            return None

-        self.validate_payload(payload)
-        user = self.get_user(payload)
-
-        return (user, payload)
-
-
-class ApplicationJWTAuthentication(BaseJWTAuthentication):
-    """JWT authentication for application-delegated API access.
-
-    Validates JWT tokens issued to applications that are acting on behalf
-    of users. Tokens must include user_id, client_id, and delegation flag.
-    """
-
-    def __init__(self):
-        """Initialize authentication backend with application JWT settings from Django settings."""
-        super().__init__(
-            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
-            algorithm=settings.APPLICATION_JWT_ALG,
-            issuer=settings.APPLICATION_JWT_ISSUER,
-            audience=settings.APPLICATION_JWT_AUDIENCE,
-            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
-            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
-        )
-
-    def validate_payload(self, payload):
-        """Validate application-specific claims."""
+        user_id = payload.get("user_id")
        client_id = payload.get("client_id")
        is_delegated = payload.get("delegated", False)

+        if not user_id:
+            logger.warning("Missing 'user_id' in JWT payload")
+            raise exceptions.AuthenticationFailed("Invalid token claims.")
+
        if not client_id:
            logger.warning("Missing 'client_id' in JWT payload")
            raise exceptions.AuthenticationFailed("Invalid token claims.")

-        try:
-            application = Application.objects.get(client_id=client_id)
-        except Application.DoesNotExist as e:
-            logger.warning("Application not found: %s", client_id)
-            raise exceptions.AuthenticationFailed("Application not found.") from e
-
-        if not application.active:
-            logger.warning(
-                "Inactive application attempted authentication: %s", client_id
-            )
-            raise exceptions.AuthenticationFailed("Application is disabled.")
-
        if not is_delegated:
            logger.warning("Token is not marked as delegated")
            raise exceptions.AuthenticationFailed("Invalid token type.")

+        try:
+            user = User.objects.get(id=user_id)
+        except User.DoesNotExist as e:
+            logger.warning("User not found: %s", user_id)
+            raise exceptions.AuthenticationFailed("User not found.") from e
+
+        if not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user_id)
+            raise exceptions.AuthenticationFailed("User account is disabled.")
+
+        return (user, payload)
+
+    def authenticate_header(self, request):
+        """Return authentication scheme for WWW-Authenticate header."""
+        return "Bearer"
+

 class ResourceServerBackend(LaSuiteBackend):
    """OIDC Resource Server backend for user creation and retrieval."""
@@ -33,11 +33,12 @@ class BaseScopePermission(permissions.BasePermission):
        Raises:
            PermissionDenied: If required scope is missing from token
        """
-        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
+        # Get the current action (e.g., 'list', 'create')
        action = getattr(view, "action", None)
        if not action:
-            # DRF routers return a 405 for unsupported methods
-            return True
+            raise exceptions.PermissionDenied(
+                "Insufficient permissions. Unknown action."
+            )

        required_scope = self.scope_map.get(action)
        if not required_scope:
@@ -56,12 +57,9 @@ class BaseScopePermission(permissions.BasePermission):
        if isinstance(token_scopes, str):
            token_scopes = token_scopes.split()

-        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
-        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
-
        if settings.OIDC_RS_SCOPES_PREFIX:
            token_scopes = [
-                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
+                scope.replace(f"{settings.OIDC_RS_SCOPES_PREFIX}:", "")
                for scope in token_scopes
            ]

@@ -84,23 +82,3 @@ class HasRequiredRoomScope(BaseScopePermission):
        "partial_update": models.ApplicationScope.ROOMS_UPDATE,
        "destroy": models.ApplicationScope.ROOMS_DELETE,
    }
-
-
-class RoomPermissions(permissions.BasePermission):
-    """Permissions applying to the room API endpoint."""
-
-    def has_permission(self, request, view):
-        """Allow access only to authenticated users."""
-        return request.user.is_authenticated
-
-    def has_object_permission(self, request, view, obj):
-        """Enforce role-based access: read=any role, delete=owner, write=admin or owner."""
-        user = request.user
-
-        if request.method in permissions.SAFE_METHODS:
-            return obj.has_any_role(user)
-
-        if request.method == "DELETE":
-            return obj.is_owner(user)
-
-        return obj.is_administrator_or_owner(user)
@@ -1,12 +1,14 @@
 """External API endpoints"""

+from datetime import datetime, timedelta, timezone
 from logging import getLogger

 from django.conf import settings
 from django.contrib.auth.hashers import check_password
-from django.core.exceptions import SuspiciousOperation, ValidationError
+from django.core.exceptions import ValidationError
 from django.core.validators import validate_email

+import jwt
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework import decorators, mixins, viewsets
 from rest_framework import (
@@ -20,14 +22,13 @@ from rest_framework import (
 )

 from core import api, models
-from core.services.jwt_token import JwtTokenService

 from . import authentication, permissions, serializers

 logger = getLogger(__name__)


-class ApplicationViewSet(viewsets.ViewSet):
+class ApplicationViewSet(viewsets.GenericViewSet):
    """API endpoints for application authentication and token generation."""

    @decorators.action(
@@ -92,7 +93,7 @@ class ApplicationViewSet(viewsets.ViewSet):
            )

        try:
-            user = models.User.objects.get(email__iexact=email)
+            user = models.User.objects.get(email=email)
        except models.User.DoesNotExist as e:
            if (
                settings.APPLICATION_ALLOW_USER_CREATION
@@ -122,33 +123,34 @@ class ApplicationViewSet(viewsets.ViewSet):
                )
            else:
                raise drf_exceptions.NotFound("User not found.") from e
-        except models.User.MultipleObjectsReturned as e:
-            raise SuspiciousOperation(
-                "Multiple user accounts share a common email."
-            ) from e

+        now = datetime.now(timezone.utc)
        scope = " ".join(application.scopes or [])

-        token_service = JwtTokenService(
-            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
-            algorithm=settings.APPLICATION_JWT_ALG,
-            issuer=settings.APPLICATION_JWT_ISSUER,
-            audience=settings.APPLICATION_JWT_AUDIENCE,
-            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
-            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
-        )
+        payload = {
+            "iss": settings.APPLICATION_JWT_ISSUER,
+            "aud": settings.APPLICATION_JWT_AUDIENCE,
+            "iat": now,
+            "exp": now + timedelta(seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS),
+            "client_id": client_id,
+            "scope": scope,
+            "user_id": str(user.id),
+            "delegated": True,
+        }

-        data = token_service.generate_jwt(
-            user,
-            scope,
-            {
-                "client_id": client_id,
-                "delegated": True,
-            },
+        token = jwt.encode(
+            payload,
+            settings.APPLICATION_JWT_SECRET_KEY,
+            algorithm=settings.APPLICATION_JWT_ALG,
        )

        return drf_response.Response(
-            data,
+            {
+                "access_token": token,
+                "token_type": settings.APPLICATION_JWT_TOKEN_TYPE,
+                "expires_in": settings.APPLICATION_JWT_EXPIRATION_SECONDS,
+                "scope": scope,
+            },
            status=drf_status.HTTP_200_OK,
        )

@@ -176,9 +178,7 @@ class RoomViewSet(
        ResourceServerAuthentication,
    ]
    permission_classes = [
-        api.permissions.IsAuthenticated
-        & permissions.HasRequiredRoomScope
-        & permissions.RoomPermissions
+        api.permissions.IsAuthenticated & permissions.HasRequiredRoomScope
    ]
    queryset = models.Room.objects.all()
    serializer_class = serializers.RoomSerializer
@@ -2,11 +2,8 @@
 Core application factories
 """

-from io import BytesIO
-
 from django.conf import settings
 from django.contrib.auth.hashers import make_password
-from django.core.files.storage import default_storage
 from django.utils.text import slugify

 import factory.fuzzy
@@ -156,42 +153,3 @@ class ApplicationDomainFactory(factory.django.DjangoModelFactory):

    domain = factory.Faker("domain_name")
    application = factory.SubFactory(ApplicationFactory)
-
-
-class FileFactory(factory.django.DjangoModelFactory):
-    """A factory to create files"""
-
-    class Meta:
-        model = models.File
-        skip_postgeneration_save = True
-
-    title = factory.Sequence(lambda n: f"file{n}")
-    creator = factory.SubFactory(UserFactory)
-    deleted_at = None
-    type = factory.fuzzy.FuzzyChoice([t[0] for t in models.FileTypeChoices.choices])
-    filename = factory.lazy_attribute(lambda o: fake.file_name())
-    upload_state = None
-    size = None
-
-    @factory.post_generation
-    def update_upload_state(self, create, extracted, **kwargs):
-        """Change the upload state of a file."""
-        if create and extracted:
-            self.upload_state = extracted
-            self.save()
-
-    @factory.post_generation
-    def upload_bytes(self, create, extracted, **kwargs):
-        """Save content of the file into the storage"""
-        if create and extracted is not None:
-            content = (
-                extracted
-                if isinstance(extracted, bytes)
-                else str(extracted).encode("utf-8")
-            )
-
-            self.filename = kwargs.get("filename", self.filename or "content.txt")
-            self.size = len(content)
-            self.save()
-
-            default_storage.save(self.file_key, BytesIO(content))
@@ -44,7 +44,7 @@ class Migration(migrations.Migration):
                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
-                ('language', models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
+                ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
                ('timezone', timezone_field.fields.TimeZoneField(choices_display='WITH_GMT_OFFSET', default='UTC', help_text='The timezone in which the user wants to see times.', use_pytz=False)),
                ('is_device', models.BooleanField(default=False, help_text='Whether the user is a device or a real user.', verbose_name='device')),
                ('is_staff', models.BooleanField(default=False, help_text='Whether the user can log into this admin site.', verbose_name='staff status')),
@@ -96,7 +96,7 @@ class Migration(migrations.Migration):
        migrations.AddField(
            model_name='resource',
            name='users',
-            field=models.ManyToManyField(related_name='resources', through='core.ResourceAccess', through_fields=('resource', 'user'), to=settings.AUTH_USER_MODEL),
+            field=models.ManyToManyField(related_name='resources', through='core.ResourceAccess', to=settings.AUTH_USER_MODEL),
        ),
        migrations.AddConstraint(
            model_name='resourceaccess',
@@ -1,5 +1,5 @@
 # Generated by Django 5.0.7 on 2024-08-07 14:39
-from django.conf import settings
+
 from django.db import migrations, models


@@ -13,6 +13,6 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name='user',
            name='language',
-            field=models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
        ),
    ]
@@ -1,5 +1,5 @@
 # Generated by Django 5.1.8 on 2025-04-22 14:52
-from django.conf import settings
+
 from django.db import migrations, models


@@ -13,6 +13,6 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name='user',
            name='language',
-            field=models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'), ('nl-nl', 'Dutch'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
        ),
    ]
@@ -1,42 +0,0 @@
-# Generated by Django 5.2.11 on 2026-03-03 15:22
-
-import django.db.models.deletion
-import uuid
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0016_recording_options'),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='File',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
-                ('type', models.CharField(choices=[('background_image', 'Background image')], max_length=25)),
-                ('title', models.CharField(max_length=255, verbose_name='title')),
-                ('deleted_at', models.DateTimeField(blank=True, null=True)),
-                ('hard_deleted_at', models.DateTimeField(blank=True, null=True)),
-                ('filename', models.CharField(max_length=255)),
-                ('upload_state', models.CharField(choices=[('pending', 'Pending'), ('ready', 'Ready')], max_length=25)),
-                ('mimetype', models.CharField(blank=True, max_length=255, null=True)),
-                ('size', models.BigIntegerField(blank=True, null=True)),
-                ('description', models.TextField(blank=True, null=True)),
-                ('malware_detection_info', models.JSONField(blank=True, default=dict, help_text='Malware detection info when the analysis status is unsafe.', null=True)),
-                ('creator', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.RESTRICT, related_name='files_created', to=settings.AUTH_USER_MODEL)),
-            ],
-            options={
-                'verbose_name': 'File',
-                'verbose_name_plural': 'Files',
-                'db_table': 'file',
-                'ordering': ('created_at',),
-                'indexes': [models.Index(fields=['creator', 'type', '-created_at'], name='file_creator_730cce_idx')],
-            },
-        ),
-    ]
@@ -1,14 +1,11 @@
 """
 Declare and configure the models for the Meet core application
-# pylint: disable=too-many-lines
 """
-# pylint: disable=too-many-lines

 import secrets
 import uuid
 from datetime import datetime, timedelta
 from logging import getLogger
-from os.path import splitext
 from typing import List, Optional

 from django.conf import settings
@@ -17,7 +14,7 @@ from django.contrib.auth.base_user import AbstractBaseUser
 from django.contrib.postgres.fields import ArrayField
 from django.core import mail, validators
 from django.core.exceptions import PermissionDenied, ValidationError
-from django.db import models, transaction
+from django.db import models
 from django.utils import timezone
 from django.utils.text import capfirst, slugify
 from django.utils.translation import gettext_lazy as _
@@ -295,10 +292,6 @@ class Resource(BaseModel):
                role = RoleChoices.MEMBER
        return role

-    def has_any_role(self, user):
-        """Check if a user has any role on the resource."""
-        return self.get_role(user) is not None
-
    def is_administrator_or_owner(self, user):
        """
        Check if a user is administrator or owner of the resource."""
@@ -832,186 +825,3 @@ class ApplicationDomain(BaseModel):

        self.domain = self.domain.lower().strip()
        super().save(*args, **kwargs)
-
-
-class FileUploadStateChoices(models.TextChoices):
-    """Possible states of a file."""
-
-    PENDING = "pending", _("Pending")
-    # Commented out for now, as we may need this when we implement the malware detection logic.
-    # ANALYZING = "analyzing", _("Analyzing")
-    # SUSPICIOUS = "suspicious", _("Suspicious")
-    # FILE_TOO_LARGE_TO_ANALYZE = (
-    #     "file_too_large_to_analyze",
-    #     _("File too large to analyze"),
-    # )
-    READY = "ready", _("Ready")
-
-
-class FileTypeChoices(models.TextChoices):
-    """Defines the possible types of a file."""
-
-    BACKGROUND_IMAGE = "background_image", _("Background image")
-
-
-class File(BaseModel):
-    """File uploaded by a user."""
-
-    type = models.CharField(
-        max_length=25,
-        choices=FileTypeChoices.choices,
-        null=False,
-        blank=False,
-    )
-    title = models.CharField(_("title"), max_length=255)
-    creator = models.ForeignKey(
-        User,
-        on_delete=models.RESTRICT,
-        related_name="files_created",
-        blank=True,
-        null=True,
-    )
-    deleted_at = models.DateTimeField(null=True, blank=True)
-    hard_deleted_at = models.DateTimeField(null=True, blank=True)
-
-    filename = models.CharField(max_length=255, null=False, blank=False)
-
-    upload_state = models.CharField(
-        max_length=25,
-        choices=FileUploadStateChoices.choices,
-    )
-    mimetype = models.CharField(max_length=255, null=True, blank=True)
-    size = models.BigIntegerField(null=True, blank=True)
-    description = models.TextField(null=True, blank=True)
-    malware_detection_info = models.JSONField(
-        null=True,
-        blank=True,
-        default=dict,
-        help_text=_("Malware detection info when the analysis status is unsafe."),
-    )
-
-    class Meta:
-        db_table = "file"
-        verbose_name = _("File")
-        verbose_name_plural = _("Files")
-        ordering = ("created_at",)
-        indexes = [
-            models.Index(fields=["creator", "type", "-created_at"]),
-        ]
-
-    def __str__(self):
-        return str(self.title)
-
-    def save(self, *args, **kwargs):
-        """Set the upload state to pending if it's the first save and it's a file."""
-
-        if self.created_at is None:
-            self.upload_state = FileUploadStateChoices.PENDING
-
-        return super().save(*args, **kwargs)
-
-    def delete(self, using=None, keep_parents=False):
-        if self.deleted_at is None:
-            raise RuntimeError("The file must be soft deleted before being deleted.")
-
-        return super().delete(using, keep_parents)
-
-    @property
-    def is_pending_upload(self):
-        """Return whether the file is in a pending upload state"""
-        return self.upload_state == FileUploadStateChoices.PENDING
-
-    @property
-    def extension(self):
-        """Return the extension related to the filename."""
-        if self.filename is None:
-            raise RuntimeError(
-                "The file must have a filename to compute its extension."
-            )
-
-        _, extension = splitext(self.filename)
-
-        if extension:
-            return extension.lstrip(".")
-
-        return None
-
-    @property
-    def key_base(self):
-        """Key base of the location where the file is stored in object storage."""
-        if not self.pk:
-            raise RuntimeError(
-                "The file instance must be saved before requesting a storage key."
-            )
-
-        return f"{settings.FILE_UPLOAD_PATH}/{self.pk!s}"
-
-    @property
-    def file_key(self):
-        """Key used to store the file in object storage."""
-        _, extension = splitext(self.filename)
-        # We store only the extension in the storage system to avoid
-        # leaking Personal Information in logs, etc.
-        return f"{self.key_base}/{extension!s}"
-
-    def get_abilities(self, user):
-        """
-        Compute and return abilities for a given user on the file.
-        """
-        # Characteristics that are based only on specific access
-        is_creator = user == self.creator
-        retrieve = is_creator
-        is_deleted = self.deleted_at is not None
-        can_update = is_creator and not is_deleted and user.is_authenticated
-        can_hard_delete = is_creator and user.is_authenticated
-        can_destroy = can_hard_delete and not is_deleted
-
-        return {
-            "destroy": can_destroy,
-            "hard_delete": can_hard_delete,
-            "retrieve": retrieve,
-            "media_auth": retrieve and not is_deleted,
-            "partial_update": can_update,
-            "update": can_update,
-            "upload_ended": can_update and user.is_authenticated,
-        }
-
-    @transaction.atomic
-    def soft_delete(self):
-        """
-        Soft delete the file.
-        We still keep the .delete() method untouched for programmatic purposes.
-        """
-        if self.deleted_at:
-            raise RuntimeError("This file is already deleted.")
-
-        self.deleted_at = timezone.now()
-        self.save(update_fields=["deleted_at"])
-
-    def hard_delete(self):
-        """
-        Hard delete the file.
-        We still keep the .delete() method untouched for programmatic purposes.
-        """
-        if self.hard_deleted_at:
-            raise ValidationError(
-                {
-                    "hard_deleted_at": ValidationError(
-                        _("This file is already hard deleted."),
-                        code="file_hard_delete_already_effective",
-                    )
-                }
-            )
-
-        if self.deleted_at is None:
-            raise ValidationError(
-                {
-                    "hard_deleted_at": ValidationError(
-                        _("To hard delete a file, it must first be soft deleted."),
-                        code="file_hard_delete_should_soft_delete_first",
-                    )
-                }
-            )
-
-        self.hard_deleted_at = timezone.now()
-        self.save(update_fields=["hard_deleted_at"])
@@ -167,7 +167,6 @@ class NotificationService:
                owner_access.user.timezone
            ).strftime("%H:%M"),
            "download_link": f"{get_recording_download_base_url()}/{recording.id}",
-            "context_language": owner_access.user.language,
        }

        headers = {
@@ -16,7 +16,7 @@ class RecordingEventsError(Exception):


 class RecordingEventsService:
-    """Handles recording-related LiveKit webhook events."""
+    """Handles recording-related Livekit webhook events."""

    @staticmethod
    def handle_update(recording, egress_status):
@@ -1,153 +0,0 @@
-"""JWT token service."""
-
-# pylint: disable=R0913,R0917
-# ruff: noqa: PLR0913
-
-from datetime import datetime, timedelta, timezone
-from typing import Optional
-
-from django.core.exceptions import ImproperlyConfigured
-
-import jwt
-
-
-class JWTError(Exception):
-    """Base exception for all JWT token errors."""
-
-
-class TokenExpiredError(JWTError):
-    """Raised when the JWT token has expired."""
-
-
-class TokenInvalidError(JWTError):
-    """Raised when the JWT token has an invalid issuer or audience."""
-
-
-class TokenDecodeError(JWTError):
-    """Raised for any other unrecoverable JWT decode failure."""
-
-
-class JwtTokenService:
-    """Generic JWT token service with configurable settings."""
-
-    def __init__(
-        self,
-        secret_key: str,
-        algorithm: str,
-        issuer: str,
-        audience: str,
-        expiration_seconds: int,
-        token_type: str,
-    ):
-        """
-        Initialize the token service with custom settings.
-
-        Args:
-            secret_key: Secret key for JWT encoding/decoding
-            algorithm: JWT algorithm
-            issuer: Token issuer identifier
-            audience: Token audience identifier
-            expiration_seconds: Token expiration time in seconds
-            token_type: Token type
-
-        Raises:
-            ImproperlyConfigured: If secret_key is None or empty
-        """
-        if not secret_key:
-            raise ImproperlyConfigured("Secret key is required.")
-        if not algorithm:
-            raise ImproperlyConfigured("Algorithm is required.")
-        if not token_type:
-            raise ImproperlyConfigured("Token's type is required.")
-        if expiration_seconds is None:
-            raise ImproperlyConfigured("Expiration's seconds is required.")
-
-        self._key = secret_key
-        self._algorithm = algorithm
-        self._issuer = issuer
-        self._audience = audience
-        self._expiration_seconds = expiration_seconds
-        self._token_type = token_type
-
-    def generate_jwt(
-        self, user, scope: str, extra_payload: Optional[dict] = None
-    ) -> dict:
-        """
-        Generate an access token for the given user.
-
-        Note: any extra_payload variables named iat, exp, or user_id will
-        be overwritten by this service
-
-        Args:
-            user: User instance for whom to generate the token
-            scope: Space-separated scope string
-
-        Returns:
-            Dictionary containing access_token, token_type, expires_in, and scope optionally
-        """
-        now = datetime.now(timezone.utc)
-
-        payload = extra_payload.copy() if extra_payload else {}
-
-        payload.update(
-            {
-                "iat": now,
-                "exp": now + timedelta(seconds=self._expiration_seconds),
-                "user_id": str(user.id),
-            }
-        )
-
-        if self._issuer:
-            payload["iss"] = self._issuer
-        if self._audience:
-            payload["aud"] = self._audience
-        if scope:
-            payload["scope"] = scope
-
-        token = jwt.encode(
-            payload,
-            self._key,
-            algorithm=self._algorithm,
-        )
-
-        response = {
-            "access_token": token,
-            "token_type": self._token_type,
-            "expires_in": self._expiration_seconds,
-        }
-
-        if scope:
-            response["scope"] = scope
-
-        return response
-
-    def decode_jwt(self, token):
-        """Decode and validate JWT token.
-
-        Args:
-            token: JWT token string
-
-        Returns:
-            Decoded payload dict.
-
-        Raises:
-            TokenExpiredError: If the token has expired.
-            TokenInvalidError: If the token has an invalid issuer or audience.
-            TokenDecodeError: If the token is malformed or cannot be decoded.
-        """
-
-        try:
-            payload = jwt.decode(
-                token,
-                self._key,
-                algorithms=[self._algorithm],
-                issuer=self._issuer,
-                audience=self._audience,
-            )
-            return payload
-        except jwt.ExpiredSignatureError as e:
-            raise TokenExpiredError("Token expired.") from e
-        except (jwt.InvalidIssuerError, jwt.InvalidAudienceError) as e:
-            raise TokenInvalidError("Invalid token.") from e
-        except jwt.InvalidTokenError as e:
-            raise TokenDecodeError("Token decode error.") from e
@@ -129,7 +129,7 @@ class LobbyService:
    ) -> Tuple[LobbyParticipant, Optional[Dict]]:
        """Request entry to a room for a participant.

-        The usual status transitions are:
+        This usual status transitions is:
        UNKNOWN -> WAITING -> (ACCEPTED | DENIED)

        Flow:
@@ -1,49 +0,0 @@
-# ruff: noqa: PLC0415
-
-from django.conf import settings
-
-
-def task(*d_args, **d_kwargs):
-    """
-    Decorator compatible with Celery's @app.task, but works without Celery.
-
-    If Celery is available, returns a real Celery task.
-    If not, returns the original function and provides `.delay()`/`.apply_async()`
-    as synchronous fallbacks (so existing call sites don't break).
-
-    Notes:
-        Mostly LLM-generated.
-    """
-
-    def _fallback_wrap(func):
-        def delay(*args, **kwargs):
-            return func(*args, **kwargs)
-
-        def apply_async(args=None, kwargs=None, **_options):
-            return func(*(args or ()), **(kwargs or {}))
-
-        func.delay = delay
-        func.apply_async = apply_async
-        return func
-
-    # Handle bare decorator usage: @task
-    if len(d_args) == 1 and callable(d_args[0]) and not d_kwargs:
-        func = d_args[0]
-        if settings.CELERY_ENABLED:
-            from meet.celery_app import app as _celery_app
-
-            return _celery_app.task(func)
-        return _fallback_wrap(func)
-
-    # Handle parameterized usage: @task(...), e.g. @task(bind=True)
-    def _decorate(func):
-        if settings.CELERY_ENABLED:
-            from meet.celery_app import app as _celery_app
-
-            return _celery_app.task(*d_args, **d_kwargs)(func)
-        return _fallback_wrap(func)
-
-    return _decorate
-
-
-__all__ = ("task",)
@@ -1,36 +0,0 @@
-"""
-Tasks related to files.
-"""
-
-import logging
-
-from django.core.files.storage import default_storage
-
-from core.models import File
-from core.tasks._task import task
-
-logger = logging.getLogger(__name__)
-
-
-@task
-def process_file_deletion(file_id):
-    """
-    Process the deletion of a file.
-    Definitely delete it in the database.
-    Delete the files from the storage.
-    """
-    logger.info("Processing item deletion for %s", file_id)
-    try:
-        file = File.objects.get(id=file_id)
-    except File.DoesNotExist:
-        logger.error("Item %s does not exist", file_id)
-        return
-
-    if file.hard_deleted_at is None:
-        logger.error("To process an item deletion, it must be hard deleted first.")
-        return
-
-    logger.info("Deleting file %s", file.file_key)
-    default_storage.delete(file.file_key)
-
-    file.delete()
@@ -1,4 +1,4 @@
-"""Custom template tags for the core application of Meet."""
+"""Custom template tags for the core application of People."""

 import base64

@@ -1,323 +0,0 @@
-"""
-Tests for files API endpoint in meet's core app: create
-"""
-
-from concurrent.futures import ThreadPoolExecutor
-from urllib.parse import parse_qs, urlparse
-from uuid import uuid4
-
-from django.utils import timezone
-
-import pytest
-from freezegun import freeze_time
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import factories
-from core.models import File, FileTypeChoices, FileUploadStateChoices
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_files_create_anonymous():
-    """Anonymous users should not be allowed to create items."""
-    response = APIClient().post(
-        "/api/v1.0/files/",
-        {
-            "title": "My file",
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-        },
-    )
-
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-    assert not File.objects.exists()
-
-
-def test_api_files_create_authenticated_success():
-    """
-    Authenticated users should be able to create files and should automatically be declared
-    as the owner of the newly created file.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "title": "my file",
-            "filename": "my_file.png",
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201, response.json()
-    file = File.objects.get()
-    assert file.title == "my file"
-    assert file.creator == user
-    assert file.type == FileTypeChoices.BACKGROUND_IMAGE
-    assert file.upload_state == FileUploadStateChoices.PENDING
-
-
-def test_api_files_create_file_authenticated_no_filename():
-    """
-    Creating a file item without providing a filename should fail.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "title": "my item",
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-        },
-        format="json",
-    )
-    assert response.status_code == 400
-    assert response.json() == {"filename": ["This field is required."]}
-
-
-def test_api_files_create_file_authenticated_success():
-    """
-    Authenticated users should be able to create a file file and must provide a filename.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    now = timezone.now()
-    with freeze_time(now):
-        response = client.post(
-            "/api/v1.0/files/",
-            {
-                "type": FileTypeChoices.BACKGROUND_IMAGE,
-                "title": "Eiffle tower",
-                "filename": "file.png",
-            },
-            format="json",
-        )
-    assert response.status_code == 201
-    file = File.objects.get()
-    assert file.title == "Eiffle tower"
-    assert file.type == FileTypeChoices.BACKGROUND_IMAGE
-    assert file.filename == "file.png"
-
-    response_data = response.json()
-    assert response_data["creator"] is not None, response_data
-
-    assert response.json().get("policy") is not None
-
-    policy = response.json()["policy"]
-    policy_parsed = urlparse(policy)
-
-    assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc == "localhost:9000"
-    assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}/.png"
-
-    query_params = parse_qs(policy_parsed.query)
-
-    assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
-    assert query_params.pop("X-Amz-Credential") == [
-        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
-    ]
-    assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
-    assert query_params.pop("X-Amz-Expires") == ["60"]
-    assert query_params.pop("X-Amz-SignedHeaders") == ["host;x-amz-acl"]
-    assert query_params.pop("X-Amz-Signature") is not None
-
-    assert len(query_params) == 0
-
-
-def test_api_files_create_file_authenticated_extension_not_allowed():
-    """
-    Creating a file item with an extension not allowed should fail.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-            "title": "Paris tower",
-            "filename": "file.notallowed",
-        },
-        format="json",
-    )
-    assert response.status_code == 400
-    assert response.json() == {"filename": ["This file extension is not allowed."]}
-
-
-def test_api_files_create_file_authenticated_extension_case_insensitive():
-    """
-    Creating a file item with an extension, no matter the case used, should be allowed.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-            "filename": "file.JPG",
-        },
-        format="json",
-    )
-    assert response.status_code == 201, response.json()
-    file = File.objects.get()
-    assert file.title == "file"
-
-
-def test_api_files_create_file_authenticated_not_checking_extension(settings):
-    """
-    Creating a file with an extension not allowed should not fail when restrictions are disabled.
-    """
-    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = False
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-            "filename": "file.notallowed",
-        },
-        format="json",
-    )
-    assert response.status_code == 201, response.json()
-    file = File.objects.get()
-    assert file.title == "file"
-
-
-def test_api_files_create_file_authenticated_no_extension_but_checking_it_should_fail(
-    settings,
-):
-    """
-    Creating a file without an extension but checking the extension should fail.
-    """
-    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-            "filename": "file",
-        },
-        format="json",
-    )
-    assert response.status_code == 400
-    assert response.json() == {"filename": ["This file extension is not allowed."]}
-
-
-def test_api_files_create_file_authenticated_hidden_file_but_checking_extension_should_fail(
-    settings,
-):
-    """
-    Creating a hidden file (starting with a dot) but checking the extension should fail.
-    """
-    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-            "filename": ".file",
-        },
-    )
-
-    assert response.status_code == 400
-    assert response.json() == {"filename": ["This file extension is not allowed."]}
-
-
-def test_api_files_create_force_id_success():
-    """It should be possible to force the item ID when creating a   item."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    forced_id = uuid4()
-
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "id": str(forced_id),
-            "title": "my item",
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-            "filename": "my_file.png",
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201, response.json()
-    files = File.objects.all()
-    assert len(files) == 1
-    assert files[0].id == forced_id
-
-
-def test_api_files_create_force_id_existing():
-    """
-    It should not be possible to use the ID of an existing file when forcing ID on creation.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory()
-
-    response = client.post(
-        "/api/v1.0/files/",
-        {
-            "id": str(file.id),
-            "title": "my file",
-            "type": FileTypeChoices.BACKGROUND_IMAGE,
-            "filename": "my_file.png",
-        },
-        format="json",
-    )
-
-    assert response.status_code == 400
-    assert response.json() == {
-        "id": ["A file with this ID already exists. You cannot override it."]
-    }
-
-
-@pytest.mark.django_db(transaction=True)
-def test_api_files_create_file_race_condition():
-    """
-    It should be possible to create several files at the same time
-    without causing any race conditions or data integrity issues.
-    """
-
-    def create_item(title):
-        user = factories.UserFactory()
-        client = APIClient()
-        client.force_login(user)
-        return client.post(
-            "/api/v1.0/files/",
-            {
-                "title": title,
-                "type": FileTypeChoices.BACKGROUND_IMAGE,
-                "filename": "my_file.png",
-            },
-            format="json",
-        )
-
-    with ThreadPoolExecutor(max_workers=2) as executor:
-        future1 = executor.submit(create_item, "my item 1")
-        future2 = executor.submit(create_item, "my item 2")
-
-        response1 = future1.result()
-        response2 = future2.result()
-
-        assert response1.status_code == 201
-        assert response2.status_code == 201
@@ -1,45 +0,0 @@
-"""
-Tests for files API endpoint in meet's core app: delete
-"""
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_files_delete_anonymous():
-    """Anonymous users should not be allowed to destroy a file."""
-    file = factories.FileFactory()
-    existing_items = models.File.objects.all().count()
-
-    response = APIClient().delete(
-        f"/api/v1.0/files/{file.id!s}/",
-    )
-
-    assert response.status_code == 401
-    assert models.File.objects.count() == existing_items
-
-
-def test_api_files_delete_authenticated_owner():
-    """
-    Authenticated users should be able to delete a item they own.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(creator=user)
-
-    response = client.delete(
-        f"/api/v1.0/files/{file.id}/",
-    )
-
-    assert response.status_code == 204
-
-    # Make sure it is only a soft delete
-    file.refresh_from_db()
-    assert file.deleted_at is not None
@@ -1,160 +0,0 @@
-"""
-Tests for files API endpoint in meet's core app: list
-"""
-
-from unittest import mock
-
-from django.utils import timezone
-
-import pytest
-from faker import Faker
-from rest_framework.pagination import PageNumberPagination
-from rest_framework.test import APIClient
-
-from core import factories, models
-
-fake = Faker()
-pytestmark = pytest.mark.django_db
-
-
-def test_api_files_list_anonymous_not_allowed():
-    """
-    Anonymous users should not be allowed to list files whatever the
-    """
-    response = APIClient().get("/api/v1.0/files/")
-    assert response.status_code == 401
-
-
-def test_api_files_list_authentificated_user_allowed():
-    """
-    Authentificated users should be allowed to list files
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get("/api/v1.0/files/")
-    assert response.status_code == 200
-    assert response.data == {"count": 0, "next": None, "previous": None, "results": []}
-
-
-def test_api_files_list_format():
-    """Validate the format of files as returned by the list view."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        title="item 1",
-        creator=user,
-    )
-
-    # A file from another user should not appear
-    factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        title="item 2",
-    )
-
-    # hard deleted item should not appear
-    factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        hard_deleted_at=timezone.now(),
-        title="hard deleted item",
-        creator=user,
-    )
-
-    response = client.get("/api/v1.0/files/")
-
-    assert response.status_code == 200
-    content = response.json()
-    results = content.pop("results")
-    assert content == {
-        "count": 1,
-        "next": None,
-        "previous": None,
-    }
-    assert len(results) == 1
-    assert results == [
-        {
-            "id": str(file.id),
-            "created_at": file.created_at.isoformat().replace("+00:00", "Z"),
-            "creator": {
-                "id": str(file.creator.id),
-                "full_name": file.creator.full_name,
-                "short_name": file.creator.short_name,
-            },
-            "title": file.title,
-            "updated_at": file.updated_at.isoformat().replace("+00:00", "Z"),
-            "type": models.FileTypeChoices.BACKGROUND_IMAGE,
-            "upload_state": file.upload_state,
-            "url": None,
-            "mimetype": file.mimetype,
-            "filename": file.filename,
-            "size": None,
-            "description": None,
-            "deleted_at": None,
-            "hard_deleted_at": None,
-            "abilities": {
-                "destroy": True,
-                "hard_delete": True,
-                "media_auth": True,
-                "partial_update": True,
-                "retrieve": True,
-                "update": True,
-                "upload_ended": True,
-            },
-        }
-    ]
-
-
-@mock.patch.object(PageNumberPagination, "get_page_size", return_value=2)
-def test_api_files_list_pagination(
-    _mock_page_size,
-):
-    """Pagination should work as expected."""
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    file_ids = [
-        str(file.id)
-        for file in factories.FileFactory.create_batch(
-            3,
-            creator=user,
-            type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        )
-    ]
-    # Get page 1
-    response = client.get(
-        "/api/v1.0/files/",
-    )
-
-    assert response.status_code == 200
-    content = response.json()
-
-    assert content["count"] == 3
-    assert content["next"] == "http://testserver/api/v1.0/files/?page=2"
-    assert content["previous"] is None
-
-    assert len(content["results"]) == 2
-    for item in content["results"]:
-        file_ids.remove(item["id"])
-
-    # Get page 2
-    response = client.get(
-        "/api/v1.0/files/?page=2",
-    )
-
-    assert response.status_code == 200
-    content = response.json()
-
-    assert content["count"] == 3
-    assert content["next"] is None
-    assert content["previous"] == "http://testserver/api/v1.0/files/"
-
-    assert len(content["results"]) == 1
-    for item in content["results"]:
-        file_ids.remove(item["id"])
-    assert file_ids == []
@@ -1,216 +0,0 @@
-"""
-Tests for files API endpoint in meet's core app: list
-"""
-
-import pytest
-from faker import Faker
-from rest_framework.test import APIClient
-
-from core import factories, models
-
-fake = Faker()
-pytestmark = pytest.mark.django_db
-
-
-# Filters: unknown field
-
-
-def test_api_files_list_filter_unknown_field():
-    """
-    Trying to filter by an unknown field should do nothing.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.FileFactory(type=models.FileTypeChoices.BACKGROUND_IMAGE)
-    expected_ids = {
-        str(file.id)
-        for file in factories.FileFactory.create_batch(
-            2, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
-        )
-    }
-
-    response = client.get("/api/v1.0/files/?unknown=true")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 2
-    assert {result["id"] for result in results} == expected_ids
-
-
-# Filters: is_creator_me
-
-
-def test_api_files_list_filter_is_creator_me_true():
-    """
-    Authenticated users should be able to filter files they created.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.FileFactory.create_batch(
-        2, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
-    )
-    factories.FileFactory.create_batch(2, type=models.FileTypeChoices.BACKGROUND_IMAGE)
-
-    response = client.get("/api/v1.0/files/?is_creator_me=true")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 2
-
-    # Ensure all results are created by the current user
-    for result in results:
-        assert result["creator"] == {
-            "id": str(user.id),
-            "full_name": user.full_name,
-            "short_name": user.short_name,
-        }
-
-
-def test_api_files_list_filter_is_creator_me_invalid():
-    """Filtering with an invalid `is_creator_me` value should do nothing."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.FileFactory.create_batch(
-        3, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
-    )
-
-    response = client.get("/api/v1.0/files/?is_creator_me=invalid")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 3
-
-
-# Filters: type
-
-
-def test_api_files_list_filter_type_and_upload_status():
-    """
-    Authenticated users should be able to filter files by their type and upload status.
-
-    This test will make more sense when other types are added to the API
-    """
-
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        creator=user,
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.PENDING,
-    )
-    assert file.upload_state == models.FileUploadStateChoices.PENDING
-
-    expected_files = factories.FileFactory.create_batch(
-        2,
-        creator=user,
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-    )
-    expected_files_ids = {str(file.id) for file in expected_files}
-
-    # Filter by type: background_image & upload state
-    response = client.get("/api/v1.0/files/?type=background_image&upload_state=ready")
-
-    assert response.status_code == 200
-    assert response.json()["count"] == 2
-
-    results = response.json()["results"]
-
-    # Ensure all results are background images
-    results_ids = {result["id"] for result in results}
-    assert results_ids == expected_files_ids
-    for result in results:
-        assert result["type"] == models.FileTypeChoices.BACKGROUND_IMAGE
-        assert result["upload_state"] == models.FileUploadStateChoices.READY
-
-    # Second request without the upload_state filter, to check that all 3 show up
-    response = client.get("/api/v1.0/files/?type=background_image")
-
-    assert response.status_code == 200
-    assert response.json()["count"] == 3
-
-    results = response.json()["results"]
-
-    # Ensure all results are background images
-    results_ids = {result["id"] for result in results}
-    assert results_ids == {str(file.id) for file in expected_files + [file]}
-    for result in results:
-        assert result["type"] == models.FileTypeChoices.BACKGROUND_IMAGE
-
-
-def test_api_files_list_filter_is_deleted():
-    """
-    Authenticated users should be able to filter files by their deletion status.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    not_deleted_file = factories.FileFactory(creator=user)
-
-    deleted_files = factories.FileFactory.create_batch(2, creator=user)
-    for file in deleted_files:
-        file.soft_delete()
-
-    # No filters
-    response_no_filters = client.get("/api/v1.0/files/")
-
-    assert response_no_filters.status_code == 200
-    assert response_no_filters.json()["count"] == 3
-
-    results = response_no_filters.json()["results"]
-
-    results_ids = {result["id"] for result in results}
-    assert results_ids == {str(file.id) for file in [*deleted_files, not_deleted_file]}
-
-    # Filters deleted
-    response_filter_deleted = client.get("/api/v1.0/files/?is_deleted=true")
-
-    assert response_filter_deleted.status_code == 200
-    assert response_filter_deleted.json()["count"] == 2
-
-    results = response_filter_deleted.json()["results"]
-
-    results_ids = {result["id"] for result in results}
-    assert results_ids == {str(file.id) for file in deleted_files}
-
-    # Filters not deleted
-    response_filter_not_deleted = client.get("/api/v1.0/files/?is_deleted=false")
-
-    assert response_filter_not_deleted.status_code == 200
-    assert response_filter_not_deleted.json()["count"] == 1
-
-    results = response_filter_not_deleted.json()["results"]
-
-    # Ensure all results are deleted
-    results_ids = {result["id"] for result in results}
-    assert results_ids == {str(file.id) for file in [not_deleted_file]}
-
-
-def test_api_files_list_filter_unknown_type():
-    """
-    Filtering by an unknown type should return an empty list
-    """
-
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    factories.FileFactory.create_batch(3, creator=user)
-
-    response = client.get("/api/v1.0/files/?type=unknown")
-
-    assert response.status_code == 400
-    assert response.json() == {
-        "type": ["Select a valid choice. unknown is not one of the available choices."]
-    }
@@ -1,71 +0,0 @@
-"""Test the ordering of items."""
-
-import operator
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_files_list_ordering_default():
-    """items should be ordered by descending "updated_at" by default"""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.FileFactory.create_batch(
-        4, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
-    )
-    response = client.get("/api/v1.0/files/")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 4
-
-    # Check that results are sorted by descending "updated_at" as expected
-    for i in range(3):
-        assert operator.ge(results[i]["updated_at"], results[i + 1]["updated_at"])
-
-
-def test_api_files_list_ordering_by_fields():
-    """It should be possible to order by several fields"""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.FileFactory.create_batch(
-        4, creator=user, type=models.FileTypeChoices.BACKGROUND_IMAGE
-    )
-
-    for parameter in [
-        "created_at",
-        "-created_at",
-        "updated_at",
-        "-updated_at",
-    ]:
-        is_descending = parameter.startswith("-")
-        field = parameter.lstrip("-")
-        querystring = f"?ordering={parameter}"
-
-        response = client.get(f"/api/v1.0/files/{querystring:s}")
-        assert response.status_code == 200
-        results = response.json()["results"]
-        assert len(results) == 4
-
-        # Check that results are sorted by the field in querystring as expected
-        compare = operator.ge if is_descending else operator.le
-        for i in range(3):
-            operator1 = (
-                results[i][field].lower()
-                if isinstance(results[i][field], str)
-                else results[i][field]
-            )
-            operator2 = (
-                results[i + 1][field].lower()
-                if isinstance(results[i + 1][field], str)
-                else results[i + 1][field]
-            )
-            assert compare(operator1, operator2)
@@ -1,141 +0,0 @@
-"""
-Test file uploads API endpoint for users in meet's core app.
-"""
-
-from io import BytesIO
-from urllib.parse import quote, urlparse
-
-from django.conf import settings
-from django.core.files.storage import default_storage
-from django.utils import timezone
-
-import pytest
-import requests
-from freezegun import freeze_time
-from rest_framework.test import APIClient
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_files_media_auth_anonymous_not_authorized():
-    """Anonymous users should not be allowed to retrieve a file"""
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-    )
-
-    original_url = f"http://localhost/media/{file.file_key:s}"
-    response = APIClient().get(
-        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
-
-    assert response.status_code == 401
-
-
-def test_api_files_media_get_own():
-    """
-    Authenticated user should be allowed to retrieve their own file.
-    """
-    user = factories.UserFactory()
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-        creator=user,
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    default_storage.save(
-        file.file_key,
-        BytesIO(b"my prose"),
-    )
-
-    original_url = f"http://localhost/media/{file.file_key:s}"
-    now = timezone.now()
-    with freeze_time(now):
-        response = client.get(
-            "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-        )
-
-    assert response.status_code == 200
-
-    authorization = response["Authorization"]
-    assert "AWS4-HMAC-SHA256 Credential=" in authorization
-    assert (
-        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
-        in authorization
-    )
-    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
-
-    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
-    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/meet-media-storage/{file.file_key:s}"
-    response = requests.get(
-        file_url,
-        headers={
-            "authorization": authorization,
-            "x-amz-date": response["x-amz-date"],
-            "x-amz-content-sha256": response["x-amz-content-sha256"],
-            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
-        },
-        timeout=1,
-    )
-    assert response.content.decode("utf-8") == "my prose"
-
-
-def test_api_files_media_auth_file_pending():
-    """
-    Users who have a specific access to an file, whatever the role, should not be able to
-    retrieve related attachments if the file is not ready.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        upload_state=models.FileUploadStateChoices.PENDING,
-        creator=user,
-    )
-
-    key = file.file_key
-
-    original_url = quote(f"http://localhost/media/{key:s}")
-    response = client.get(
-        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
-
-    assert response.status_code == 403
-
-
-def test_api_files_media_auth_own_file_deleted():
-    """
-    This function tests the access restrictions on deleted files through the media
-    authorization API endpoint. It ensures that a user cannot retrieve a file that is deleted.
-    """
-    user = factories.UserFactory()
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-        creator=user,
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    default_storage.save(
-        file.file_key,
-        BytesIO(b"my prose"),
-    )
-    file.soft_delete()
-
-    original_url = f"http://localhost/media/{file.file_key:s}"
-    response = client.get(
-        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
-
-    assert response.status_code == 403
@@ -1,67 +0,0 @@
-"""
-Tests for files API endpoint in meet's core app: update
-"""
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories
-from core.api import serializers
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_files_update_anonymous_forbidden():
-    """
-    Anonymous users should not be allowed to update an file when link
-    configuration does not allow it.
-    """
-
-    file = factories.FileFactory()
-
-    old_file_values = serializers.FileSerializer(instance=file).data
-    new_file_values = serializers.FileSerializer(instance=factories.FileFactory()).data
-
-    response = APIClient().put(
-        f"/api/v1.0/files/{file.id!s}/",
-        new_file_values,
-        format="json",
-    )
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-    file.refresh_from_db()
-    item_values = serializers.FileSerializer(instance=file).data
-    assert item_values == old_file_values
-
-
-def test_api_files_update_description_and_title():
-    """
-    Test the description and title of an file can be updated.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        description="Old description",
-        title="Old title",
-        creator=user,
-    )
-
-    response = client.patch(
-        f"/api/v1.0/files/{file.id!s}/",
-        {"description": "New description", "title": "New title"},
-        format="json",
-    )
-    assert response.status_code == 200
-    result = response.json()
-    assert result["description"] == "New description"
-    assert result["title"] == "New title"
-
-    file.refresh_from_db()
-    assert file.description == "New description"
-    assert file.title == "New title"
@@ -1,272 +0,0 @@
-"""Test related to item upload ended API."""
-
-import logging
-from io import BytesIO
-
-from django.core.files.storage import default_storage
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories, models
-from core.models import FileTypeChoices, FileUploadStateChoices
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_file_upload_ended_anonymous():
-    """Anonymous users should not be allowed to end an upload."""
-    file = factories.FileFactory()
-    response = APIClient().post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-
-    assert response.status_code == 401
-
-
-def test_api_file_upload_ended_non_creator_not_found():
-    """Users without write permissions should not be allowed to end an upload."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory()
-
-    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-
-    assert response.status_code == 404
-
-
-def test_api_file_upload_ended_on_wrong_upload_state():
-    """
-    Users should not be allowed to end an upload on files that are not in the PENDING upload state.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        type=FileTypeChoices.BACKGROUND_IMAGE,
-        creator=user,
-        update_upload_state=FileUploadStateChoices.READY,
-    )
-
-    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-
-    assert response.status_code == 400
-    assert response.json() == {
-        "file": "This action is only available for files in PENDING state."
-    }
-
-
-def test_api_file_upload_ended_success(settings):
-    """
-    Users should be able to end an upload on files that are files and in the UPLOADING upload state.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
-    settings.FILE_UPLOAD_RESTRICTIONS = {
-        "background_image": {
-            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
-            "allowed_mimetypes": ["text/html", "text/plain"],
-        },
-    }
-
-    file = factories.FileFactory(
-        type=FileTypeChoices.BACKGROUND_IMAGE,
-        filename="my_file.txt",
-        mimetype="text/html",
-        creator=user,
-    )
-
-    default_storage.save(
-        file.file_key,
-        BytesIO(b"my prose"),
-    )
-
-    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-
-    assert response.status_code == 200
-
-    file.refresh_from_db()
-    assert file.upload_state == FileUploadStateChoices.READY
-    assert file.mimetype == "text/plain"
-    assert file.size == 8
-
-    assert response.json()["mimetype"] == "text/plain"
-
-
-def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
-    """
-    Test that the API returns a 400 when the mimetype is not allowed.
-    File should be deleted and the file should be deleted from the storage.
-    """
-    settings.RESTRICT_UPLOAD_FILE_TYPE = True
-    settings.FILE_UPLOAD_RESTRICTIONS = {
-        "background_image": {
-            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
-            "allowed_mimetypes": ["application/pdf"],
-        }
-    }
-
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        type=FileTypeChoices.BACKGROUND_IMAGE, filename="my_file.txt", creator=user
-    )
-
-    default_storage.save(
-        file.file_key,
-        BytesIO(b"my prose"),
-    )
-
-    with caplog.at_level(logging.WARNING):
-        response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-
-    assert response.status_code == 400
-    assert (
-        f"upload_ended: mimetype not allowed text/plain for file {file.file_key}"
-        in caplog.text
-    )
-
-    assert not models.File.objects.filter(id=file.id).exists()
-    assert not default_storage.exists(file.file_key)
-
-
-def test_api_file_upload_ended_mimetype_not_allowed_not_checking_mimetype(settings):
-    """
-    Test that the API returns a 200 when the mimetype is not allowed but not checking the mimetype.
-    """
-    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = False
-    settings.FILE_UPLOAD_RESTRICTIONS = {
-        "background_image": {
-            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
-            "allowed_mimetypes": ["application/pdf"],
-        }
-    }
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        type=FileTypeChoices.BACKGROUND_IMAGE, filename="my_file.txt", creator=user
-    )
-
-    default_storage.save(
-        file.file_key,
-        BytesIO(b"my prose"),
-    )
-
-    response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-
-    assert response.status_code == 200
-
-    file.refresh_from_db()
-    assert file.upload_state == FileUploadStateChoices.READY
-    assert file.mimetype == "text/plain"
-    assert file.size == 8
-
-    assert response.json()["mimetype"] == "text/plain"
-
-
-def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog):
-    """
-    Object on storage should have the same mimetype than the one saved in the
-    File object.
-    """
-    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
-    settings.FILE_UPLOAD_RESTRICTIONS = {
-        "background_image": {
-            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
-            "allowed_mimetypes": ["text/html", "application/pdf"],
-        }
-    }
-
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        type=FileTypeChoices.BACKGROUND_IMAGE,
-        filename="my_file.pdf",
-        title="my_file.pdf",
-        creator=user,
-    )
-
-    s3_client = default_storage.connection.meta.client
-
-    s3_client.put_object(
-        Bucket=default_storage.bucket_name,
-        Key=file.file_key,
-        ContentType="text/html",
-        Body=BytesIO(
-            b'<meta http-equiv="refresh" content="0; url=https://fichiers.numerique.gouv.fr">'
-        ),
-        Metadata={
-            "foo": "bar",
-        },
-    )
-
-    head_object = s3_client.head_object(
-        Bucket=default_storage.bucket_name, Key=file.file_key
-    )
-
-    assert head_object["ContentType"] == "text/html"
-    with caplog.at_level(logging.INFO, logger="core.api.viewsets"):
-        response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-    assert (
-        "upload_ended: content type mismatch between object storage and file,"
-        " updating from text/html to application/pdf" in caplog.text
-    )
-    assert response.status_code == 200
-
-    file.refresh_from_db()
-
-    assert file.mimetype == "application/pdf"
-
-    head_object = s3_client.head_object(
-        Bucket=default_storage.bucket_name, Key=file.file_key
-    )
-    assert head_object["ContentType"] == "application/pdf"
-    assert head_object["Metadata"] == {"foo": "bar"}
-
-
-def test_api_upload_ended_file_size_exceeded(settings, caplog):
-    """
-    Test when the file size exceed the allowed max upload file size
-    should return a 400 and delete the file.
-    """
-
-    settings.FILE_UPLOAD_RESTRICTIONS = {
-        "background_image": {
-            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
-            "max_size": 0,
-        }
-    }
-
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    file = factories.FileFactory(
-        type=FileTypeChoices.BACKGROUND_IMAGE, filename="my_file.txt", creator=user
-    )
-
-    default_storage.save(
-        file.file_key,
-        BytesIO(b"my prose"),
-    )
-
-    with caplog.at_level(logging.INFO, logger="core.api.viewsets"):
-        response = client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
-    assert (
-        f"upload_ended: file size (8) for file {file.file_key} higher than the allowed max size"
-        in caplog.text
-    )
-    assert response.status_code == 400
-
-    assert not models.File.objects.filter(id=file.id).exists()
-    assert not default_storage.exists(file.file_key)
@@ -102,7 +102,6 @@ def test_notify_user_by_email_success(mocked_current_site, settings):
    settings.EMAIL_SUPPORT_EMAIL = "support@acme.com"
    settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
    settings.SCREEN_RECORDING_BASE_URL = "https://acme.com/recordings"
-    settings.RECORDING_DOWNLOAD_BASE_URL = None
    settings.EMAIL_FROM = "notifications@acme.com"

    recording = factories.RecordingFactory(room__name="Conference Room A")
@@ -120,39 +120,3 @@ def test_api_rooms_list_authenticated_distinct():
    content = response.json()
    assert len(content["results"]) == 1
    assert content["results"][0]["id"] == str(room.id)
-
-
-def test_api_rooms_list_pagination_page_size():
-    """Users should be able to customize the number of results per page via page_size param."""
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    RoomFactory.create_batch(11, users=[user])
-
-    response = client.get("/api/v1.0/rooms/?page_size=2")
-
-    assert response.status_code == 200
-    content = response.json()
-    assert content["count"] == 11
-    assert len(content["results"]) == 2
-    assert content["next"] == "http://testserver/api/v1.0/rooms/?page=2&page_size=2"
-    assert content["previous"] is None
-
-    response = client.get("/api/v1.0/rooms/?page=6&page_size=2")
-
-    assert response.status_code == 200
-    content = response.json()
-    assert content["count"] == 11
-    assert len(content["results"]) == 1
-    assert content["next"] is None
-    assert content["previous"] == "http://testserver/api/v1.0/rooms/?page=5&page_size=2"
-
-    response = client.get("/api/v1.0/rooms/?page_size=3")
-
-    assert response.status_code == 200
-    content = response.json()
-    assert content["count"] == 11
-    assert len(content["results"]) == 3
-    assert content["next"] == "http://testserver/api/v1.0/rooms/?page=2&page_size=3"
-    assert content["previous"] is None
@@ -631,109 +631,3 @@ def test_list_waiting_participants_empty(settings):

    assert response.status_code == 200
    assert response.json() == {"participants": []}
-
-
-@mock.patch.object(utils, "notify_participants", return_value=None)
-@mock.patch.object(
-    utils, "generate_livekit_config", return_value={"token": "test-token"}
-)
-def test_request_entry_throttling_anonymous_without_cookie(
-    mock_notify_participants, mock_generate_livekit_config, settings
-):
-    """Anonymous users without a cookie should not be throttled."""
-
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
-    settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "1/minute"
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-
-    assert response.status_code == 200
-    assert response.cookies.get("mocked-cookie") is not None
-
-    client.cookies.clear()  # Simulate a new cookieless request
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-
-    assert response.status_code == 200
-
-
-@mock.patch.object(utils, "notify_participants", return_value=None)
-@mock.patch.object(
-    utils, "generate_livekit_config", return_value={"token": "test-token"}
-)
-def test_request_entry_throttling_anonymous_with_cookie(
-    mock_notify_participants, mock_generate_livekit_config, settings
-):
-    """Anonymous users with a cookie should be throttled after exceeding the rate limit."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
-    settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
-
-    participant_id = str(uuid.uuid4())
-    client.cookies.load({"mocked-cookie": participant_id})
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-    assert response.status_code == 200
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-    assert response.status_code == 200
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-
-    assert response.status_code == 429
-
-
-@mock.patch.object(utils, "notify_participants", return_value=None)
-@mock.patch.object(
-    utils, "generate_livekit_config", return_value={"token": "test-token"}
-)
-def test_request_entry_throttling_authenticated_user(
-    mock_notify_participants, mock_generate_livekit_config, settings
-):
-    """Authenticated users should be throttled."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
-    settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-    assert response.status_code == 200
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-    assert response.status_code == 200
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
-    )
-
-    assert response.status_code == 429
@@ -8,7 +8,6 @@ import random
 from unittest import mock
 from uuid import uuid4

-from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse

 import pytest
@@ -133,7 +132,11 @@ def test_update_participant_success(mock_livekit_client):
                1,
                2,
            ],  # [TrackSource.CAMERA, TrackSource.MICROPHONE]
+            "hidden": False,
+            "recorder": False,
            "can_update_metadata": True,
+            "agent": False,
+            "can_subscribe_metrics": False,
        },
        "name": "John Doe",
    }
@@ -148,151 +151,6 @@ def test_update_participant_success(mock_livekit_client):
    mock_livekit_client.aclose.assert_called_once()


-@pytest.mark.parametrize(
-    "permission_payload",
-    [
-        {},  # empty dict is valid
-        {"can_subscribe": True},
-        {"can_publish": True},
-        {"can_publish_data": True},
-        {"can_publish_sources": [1, 2]},
-        {"can_update_metadata": True},
-    ],
-)
-def test_update_participant_permission_fields_are_optional(
-    mock_livekit_client, permission_payload
-):
-    """Test that each required permission field can be passed individually."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    payload = {
-        "participant_identity": str(uuid4()),
-        "permission": permission_payload,
-    }
-
-    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_livekit_client.room.update_participant.assert_called_once()
-    mock_livekit_client.aclose.assert_called_once()
-
-
-@pytest.mark.parametrize(
-    "value,permission_key",
-    [
-        (False, "hidden"),
-        (True, "hidden"),
-        (False, "recorder"),
-        (True, "recorder"),
-        (False, "agent"),
-        (True, "agent"),
-    ],
-)
-@mock.patch("core.api.serializers.SuspiciousOperation", side_effect=SuspiciousOperation)
-def test_update_participant_suspicious_permission(
-    mock_suspicious, value, permission_key
-):
-    """Test update participant raises 400 when a restricted permission is set."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    payload = {
-        "participant_identity": str(uuid4()),
-        "permission": {
-            "can_subscribe": True,
-            "can_publish": True,
-            "can_publish_data": True,
-            "can_update_metadata": False,
-            permission_key: value,
-        },
-    }
-
-    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    mock_suspicious.assert_called_once_with(
-        f"Setting the following participant permissions is not allowed: {permission_key}."
-    )
-
-
-@mock.patch("core.api.serializers.SuspiciousOperation", side_effect=SuspiciousOperation)
-def test_update_participant_suspicious_permission_multiple(mock_suspicious):
-    """Test update participant raises 400 when multiple suspicious permissions are set."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    payload = {
-        "participant_identity": str(uuid4()),
-        "permission": {
-            "can_subscribe": True,
-            "can_publish": True,
-            "can_publish_data": True,
-            "hidden": True,
-            "recorder": False,
-            "can_update_metadata": False,
-            "agent": True,
-            "can_subscribe_metrics": False,
-        },
-    }
-
-    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    mock_suspicious.assert_called_once_with(
-        "Setting the following participant permissions is not allowed: hidden, recorder, agent."
-    )
-
-
-@pytest.mark.parametrize("value", (False, True))
-def test_update_participant_unimplemented_can_subscribe_metrics(value):
-    """Test update participant raises 400 when can_subscribe_metrics is set."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    payload = {
-        "participant_identity": str(uuid4()),
-        "permission": {
-            "can_subscribe": True,
-            "can_publish": True,
-            "can_publish_data": True,
-            "can_update_metadata": False,
-            "can_subscribe_metrics": value,
-        },
-    }
-
-    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert "can_subscribe_metrics" in str(response.data)
-
-
 def test_update_participant_forbidden_without_access():
    """Test update participant returns 403 when user lacks room privileges."""
    client = APIClient()
@@ -368,17 +226,7 @@ def test_update_participant_invalid_permission():
    response = client.post(url, payload, format="json")

    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert response.json() == {
-        "permission": [
-            {
-                "type": "extra_forbidden",
-                "loc": ["invalid-attributes"],
-                "msg": "Extra inputs are not permitted",
-                "input": "True",
-                "url": "https://errors.pydantic.dev/2.12/v/extra_forbidden",
-            },
-        ]
-    }
+    assert "Invalid permission" in str(response.data)


 def test_update_participant_wrong_metadata_attributes():
@@ -199,308 +199,3 @@ def test_start_recording_success(
    access = recording.accesses.first()
    assert access.user == user
    assert access.role == "owner"
-
-
-@pytest.mark.parametrize("value", ["fr", "en", "nl", "de"])
-def test_start_recording_options_language_valid(
-    settings, mock_worker_service_factory, mock_worker_manager, value
-):
-    """Should accept a valid ISO 639-1 language code."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"language": value}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {"language": value}
-
-
-@pytest.mark.parametrize("value", ["invalid-value", "francais", "123"])
-def test_start_recording_options_language_not_validated(
-    settings, mock_worker_service_factory, mock_worker_manager, value
-):
-    """Invalid language codes are currently accepted — no format validation yet.
-
-    TODO: tighten this once language validation is introduced.
-    """
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"language": value}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-
-
-def test_start_recording_options_language_null(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Should accept null language (triggers auto-detection)."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"language": None}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {}
-
-
-@pytest.mark.parametrize("value", [True, 1, "y", "on", "true", "yes", "t"])
-def test_start_recording_options_transcribe_valid_true(
-    settings, mock_worker_service_factory, mock_worker_manager, value
-):
-    """Should accept transcribe with any valid pydantic true values."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"transcribe": value}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {"transcribe": True}
-
-
-@pytest.mark.parametrize("value", [False, 0, "n", "off", "false", "no", "f"])
-def test_start_recording_options_transcribe_valid_false(
-    settings, mock_worker_service_factory, mock_worker_manager, value
-):
-    """Should accept transcribe with any valid pydantic false values."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"transcribe": value}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {"transcribe": False}
-
-
-def test_start_recording_options_transcribe_null(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Should accept transcribe=null (falls back to application default)."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"transcribe": None}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {}
-
-
-def test_start_recording_options_null(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Should accept options=null."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": None},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {}
-
-
-def test_start_recording_options_omitted(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Should accept a request with no options field at all."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording"},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {}
-
-
-def test_start_recording_options_unknown_field_rejected(settings):
-    """Should reject unknown fields in options (extra='forbid')."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"unknown_field": "value"}},
-        format="json",
-    )
-
-    assert response.status_code == 400
-
-
-@pytest.mark.parametrize("value", ["foo", 12])
-def test_start_recording_options_invalid_transcribe_type(settings, value):
-    """Should reject non-boolean transcribe values."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"transcribe": value}},
-        format="json",
-    )
-
-    assert response.status_code == 400
-
-
-@pytest.mark.parametrize("value", ["screen_recording", "transcript"])
-def test_start_recording_options_original_mode_valid(
-    settings, mock_worker_service_factory, mock_worker_manager, value
-):
-    """Should accept valid recording mode choices for original_mode."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"original_mode": value}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {"original_mode": value}
-
-
-def test_start_recording_options_original_mode_null(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Should accept original_mode=null."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"original_mode": None}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {}
-
-
-def test_start_recording_options_original_mode_omitted(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Should accept a request with original_mode omitted."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {}
-
-
-@pytest.mark.parametrize("value", ["invalid_mode", "foo", 123, "SCREEN_RECORDING"])
-def test_start_recording_options_original_mode_invalid(settings, value):
-    """Should reject invalid recording mode values for original_mode."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"original_mode": value}},
-        format="json",
-    )
-
-    assert response.status_code == 400
@@ -2,21 +2,21 @@
 Tests for external API /room endpoint
 """

-# pylint: disable=W0621,C0302
+# pylint: disable=W0621

-import uuid
 from datetime import datetime, timedelta, timezone
-from unittest import mock

 from django.conf import settings

 import jwt
 import pytest
 import responses
-from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework.test import APIClient

-from core.factories import ApplicationFactory, RoomFactory, UserFactory
+from core.factories import (
+    RoomFactory,
+    UserFactory,
+)
 from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, User

 pytestmark = pytest.mark.django_db
@@ -27,14 +27,12 @@ def generate_test_token(user, scopes):
    now = datetime.now(timezone.utc)
    scope_string = " ".join(scopes)

-    application = ApplicationFactory()
-
    payload = {
        "iss": settings.APPLICATION_JWT_ISSUER,
        "aud": settings.APPLICATION_JWT_AUDIENCE,
        "iat": now,
        "exp": now + timedelta(seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS),
-        "client_id": str(application.client_id),
+        "client_id": "test-client-id",
        "scope": scope_string,
        "user_id": str(user.id),
        "delegated": True,
@@ -55,25 +53,11 @@ def test_api_rooms_list_requires_authentication():
    assert response.status_code == 401


-def test_api_rooms_list_inactive_user():
-    """List should return 401 if user is inactive."""
-
-    user1 = UserFactory(is_active=False)
-    RoomFactory(users=[(user1, RoleChoices.OWNER)])
-
-    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "user account is disabled" in str(response.data).lower()
-
-
-def test_api_rooms_list_with_valid_token():
+def test_api_rooms_list_with_valid_token(settings):
    """Listing rooms with valid token should succeed."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
    user = UserFactory()
    room = RoomFactory(users=[(user, RoleChoices.OWNER)])

@@ -89,25 +73,9 @@ def test_api_rooms_list_with_valid_token():
    assert response.data["results"][0]["id"] == str(room.id)


-def test_api_rooms_list_with_no_rooms():
-    """Listing rooms with a valid token returns an empty list when there are no rooms."""
-
-    user = UserFactory()
-
-    # Generate valid token
-    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    assert response.data["count"] == 0
-    assert response.data["results"] == []
-
-
 def test_api_rooms_list_with_expired_token(settings):
    """Listing rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0

    user = UserFactory()
@@ -124,8 +92,8 @@ def test_api_rooms_list_with_expired_token(settings):


@responses.activate
-def test_api_rooms_list_with_invalid_rs_token(settings):
-    """Listing rooms with invalid resource server token should return 400."""
+def test_api_rooms_list_with_invalid_token(settings):
+    """Listing rooms with invalid token should return 400."""

    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
    settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -148,8 +116,9 @@ def test_api_rooms_list_with_invalid_rs_token(settings):
    assert response.status_code == 400


-def test_api_rooms_list_missing_scope():
+def test_api_rooms_list_missing_scope(settings):
    """Listing rooms without required scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -161,30 +130,12 @@ def test_api_rooms_list_missing_scope():
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 403
-    assert (
-        "insufficient permissions. required scope: rooms:list"
-        in str(response.data).lower()
-    )
+    assert "Insufficient permissions. Required scope: rooms:list" in str(response.data)


-def test_api_rooms_list_no_scope():
-    """Listing rooms without any scope should return 403."""
-
-    user = UserFactory()
-
-    # Token without scope
-    token = generate_test_token(user, [])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 403
-    assert "insufficient permissions." in str(response.data).lower()
-
-
-def test_api_rooms_list_filters_by_user():
+def test_api_rooms_list_filters_by_user(settings):
    """List should only return rooms accessible to the authenticated user."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user1 = UserFactory()
    user2 = UserFactory()
@@ -193,9 +144,7 @@ def test_api_rooms_list_filters_by_user():
    room2 = RoomFactory(users=[(user2, RoleChoices.OWNER)])
    room3 = RoomFactory(users=[(user1, RoleChoices.MEMBER)])

-    token = generate_test_token(
-        user1, [ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE]
-    )
+    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])

    client = APIClient()
    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
@@ -209,82 +158,9 @@ def test_api_rooms_list_filters_by_user():
    assert str(room2.id) not in returned_ids


-def test_api_rooms_retrieve_requires_authentication():
-    """Retrieving rooms without authentication should return 401."""
-
-    user1 = UserFactory()
-    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
-
-    client = APIClient()
-    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
-
-    assert response.status_code == 401
-
-
-def test_api_rooms_retrieve_inactive_user():
-    """Retrieve should return 401 if user is inactive."""
-
-    user1 = UserFactory(is_active=False)
-    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
-
-    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
-
-    assert response.status_code == 401
-    assert "user account is disabled" in str(response.data).lower()
-
-
-def test_api_rooms_retrieve_with_expired_token(settings):
-    """Retrieving rooms with expired token should return 401."""
-    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
-
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    # Generate expired token
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
-
-    assert response.status_code == 401
-    assert "expired" in str(response.data).lower()
-
-
-@responses.activate
-def test_api_rooms_retrieve_with_invalid_rs_token(settings):
-    """Retrieving rooms with invalid resource server token should return 400."""
-
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-
-    responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "active": False,
-        },
-    )
-
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
-    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
-
-    # Return 400 instead of 401 because ResourceServerAuthentication raises
-    # SuspiciousOperation when the introspected user is not active
-    assert response.status_code == 400
-
-
-def test_api_rooms_retrieve_requires_scope():
+def test_api_rooms_retrieve_requires_scope(settings):
    """Retrieving a room requires ROOMS_RETRIEVE scope."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()
    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
@@ -302,25 +178,9 @@ def test_api_rooms_retrieve_requires_scope():
    )


-def test_api_rooms_retrieve_no_scope():
-    """Retrieving rooms without any scope should return 403."""
-
-    user = UserFactory()
-
-    # Token without scope
-    token = generate_test_token(user, [])
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
-
-    assert response.status_code == 403
-    assert "insufficient permissions." in str(response.data).lower()
-
-
 def test_api_rooms_retrieve_success(settings):
    """Retrieving a room with correct scope should succeed."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_BASE_URL = "http://your-application.com"
    settings.ROOM_TELEPHONY_ENABLED = True
    settings.ROOM_TELEPHONY_PHONE_NUMBER = "+1-555-0100"
@@ -352,128 +212,9 @@ def test_api_rooms_retrieve_success(settings):
    }


-def test_api_rooms_retrieve_success_by_user():
-    """Retrieve should only return rooms accessible to the authenticated user."""
-
-    user1 = UserFactory()
-    user2 = UserFactory()
-
-    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
-    room2 = RoomFactory(users=[(user2, RoleChoices.OWNER)])
-    room3 = RoomFactory(users=[(user1, RoleChoices.MEMBER)])
-    room4 = RoomFactory(users=[(user1, RoleChoices.ADMIN)])
-
-    token = generate_test_token(
-        user1, [ApplicationScope.ROOMS_RETRIEVE, ApplicationScope.ROOMS_LIST]
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{room2.id}/")
-
-    assert response.status_code == 403
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
-
-    assert response.status_code == 200
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{room3.id}/")
-
-    assert response.status_code == 200
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{room4.id}/")
-
-    assert response.status_code == 200
-
-
-def test_api_rooms_retrieve_not_found():
-    """Retrieving a non-existing room with correct scope should return a 404."""
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get(f"/external-api/v1.0/rooms/{uuid.uuid4()}/")
-
-    assert response.status_code == 404
-    assert "no room matches the given query." in str(response.data).lower()
-
-
-def test_api_rooms_create_requires_authentication():
-    """Creating rooms without authentication should return 401."""
-
-    client = APIClient()
-    response = client.post("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-
-
-def test_api_rooms_create_with_expired_token(settings):
-    """Creating rooms with expired token should return 401."""
-    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
-
-    user = UserFactory()
-
-    # Generate expired token
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "expired" in str(response.data).lower()
-
-
-@responses.activate
-def test_api_rooms_create_with_invalid_rs_token(settings):
-    """Creating rooms with invalid resource server token should return 400."""
-
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-
-    responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "active": False,
-        },
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
-    response = client.post("/external-api/v1.0/rooms/")
-
-    # Return 400 instead of 401 because ResourceServerAuthentication raises
-    # SuspiciousOperation when the introspected user is not active
-    assert response.status_code == 400
-
-
-def test_api_rooms_create_inactive_user():
-    """Create should return 401 if user is inactive."""
-
-    user1 = UserFactory(is_active=False)
-
-    token = generate_test_token(user1, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "user account is disabled" in str(response.data).lower()
-
-
-def test_api_rooms_create_requires_scope():
+def test_api_rooms_create_requires_scope(settings):
    """Creating a room requires ROOMS_CREATE scope."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()

    # Token without ROOMS_CREATE scope
@@ -484,36 +225,18 @@ def test_api_rooms_create_requires_scope():
    response = client.post("/external-api/v1.0/rooms/", {}, format="json")

    assert response.status_code == 403
-    assert (
-        "insufficient permissions. required scope: rooms:create"
-        in str(response.data).lower()
+    assert "Insufficient permissions. Required scope: rooms:create" in str(
+        response.data
    )


-def test_api_rooms_create_no_scope():
-    """Creating rooms without any scope should return 403."""
-
-    user = UserFactory()
-
-    # Token without scope
-    token = generate_test_token(user, [])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 403
-    assert "insufficient permissions." in str(response.data).lower()
-
-
-def test_api_rooms_create_success():
+def test_api_rooms_create_success(settings):
    """Creating a room with correct scope should succeed."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

-    token = generate_test_token(
-        user, [ApplicationScope.ROOMS_CREATE, ApplicationScope.ROOMS_LIST]
-    )
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])

    client = APIClient()
    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
@@ -522,8 +245,6 @@ def test_api_rooms_create_success():
    assert response.status_code == 201
    assert "id" in response.data
    assert "slug" in response.data
-    assert "name" in response.data
-    assert response.data["name"] == response.data["slug"]

    # Verify room was created with user as owner
    room = Room.objects.get(id=response.data["id"])
@@ -531,72 +252,9 @@ def test_api_rooms_create_success():
    assert room.access_level == "trusted"


-def test_api_rooms_create_readonly_enforcement():
-    """Creating a room succeeds and any provided read-only fields are ignored."""
-
-    user = UserFactory()
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {
-            "id": "fake-id",
-            "slug": "fake-slug",
-            "name": "fake-name",
-            "access_level": "public",
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-    assert "slug" in response.data
-    assert response.data["id"] != "fake-id"
-    assert "name" in response.data
-    assert response.data["slug"] != "fake-slug"
-    assert "id" in response.data
-    assert response.data["name"] != "fake-name"
-
-    # Verify room was created with user as owner
-    room = Room.objects.get(id=response.data["id"])
-    assert room.get_role(user) == RoleChoices.OWNER
-    assert room.access_level == "trusted"
-
-
-def test_api_rooms_unknown_actions():
-    """Updating or deleting a room are not supported yet."""
-
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    token = generate_test_token(
-        user,
-        [
-            ApplicationScope.ROOMS_RETRIEVE,
-            ApplicationScope.ROOMS_DELETE,
-            ApplicationScope.ROOMS_UPDATE,
-        ],
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.delete(f"/external-api/v1.0/rooms/{room.id}/")
-
-    assert response.status_code == 405
-    assert 'method "delete" not allowed.' in str(response.data).lower()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(f"/external-api/v1.0/rooms/{room.id}/")
-
-    assert response.status_code == 405
-    assert 'method "patch" not allowed.' in str(response.data).lower()
-
-
 def test_api_rooms_response_no_url(settings):
    """Response should not include url field when APPLICATION_BASE_URL is None."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_BASE_URL = None

    user = UserFactory()
@@ -615,6 +273,7 @@ def test_api_rooms_response_no_url(settings):

 def test_api_rooms_response_no_telephony(settings):
    """Response should not include telephony field when ROOM_TELEPHONY_ENABLED is False."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.ROOM_TELEPHONY_ENABLED = False

    user = UserFactory()
@@ -631,41 +290,10 @@ def test_api_rooms_response_no_telephony(settings):
    assert response.data["id"] == str(room.id)


-def test_api_rooms_token_scope_case_insensitive(settings):
-    """Token's scope should be case-insensitive."""
-    user = UserFactory()
-    application = ApplicationFactory()
-
-    # Generate token with mixed-case scope "Rooms:List" to verify that scope
-    # validation is case-insensitive (should match "rooms:list")
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": str(application.client_id),
-        "scope": "Rooms:List",  # Mixed case - should be accepted as "rooms:list"
-        "user_id": str(user.id),
-        "delegated": True,
-    }
-    token = jwt.encode(
-        payload,
-        settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=settings.APPLICATION_JWT_ALG,
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 200
-
-
 def test_api_rooms_token_without_delegated_flag(settings):
    """Token without delegated flag should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()
-    application = ApplicationFactory()

    # Generate token without delegated flag
    now = datetime.now(timezone.utc)
@@ -674,7 +302,7 @@ def test_api_rooms_token_without_delegated_flag(settings):
        "aud": settings.APPLICATION_JWT_AUDIENCE,
        "iat": now,
        "exp": now + timedelta(hours=1),
-        "client_id": str(application.client_id),
+        "client_id": "test-client",
        "scope": "rooms:list",
        "user_id": str(user.id),
        "delegated": False,  # Not delegated
@@ -690,75 +318,12 @@ def test_api_rooms_token_without_delegated_flag(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 401
-    assert "invalid token type." in str(response.data).lower()
-
-
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
-    """Token signed with an invalid key should defer to the next authentication."""
-    user = UserFactory()
-    application = ApplicationFactory()
-
-    # Generate token without delegated flag
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": str(application.client_id),
-        "scope": "rooms:list",
-        "user_id": str(user.id),
-        "delegated": True,
-    }
-    token = jwt.encode(
-        payload,
-        "invalid-private-key",
-        algorithm=settings.APPLICATION_JWT_ALG,
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    mock_rs_authenticate.assert_called()
-    assert response.status_code == 401
-
-
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_api_rooms_token_invalid_alg(mock_rs_authenticate, settings):
-    """Token signed with an invalid alg should defer to the next authentication."""
-    settings.APPLICATION_JWT_ALG = "RS256"
-    user = UserFactory()
-
-    # Generate token without delegated flag
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": "test-client",
-        "scope": "rooms:list",
-        "user_id": str(user.id),
-        "delegated": True,
-    }
-    token = jwt.encode(
-        payload,
-        settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm="HS256",  # different value
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    mock_rs_authenticate.assert_called()
-    assert response.status_code == 401
+    assert "Invalid token type." in str(response.data)


 def test_api_rooms_token_missing_client_id(settings):
    """Token without client_id should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()

    now = datetime.now(timezone.utc)
@@ -783,152 +348,7 @@ def test_api_rooms_token_missing_client_id(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 401
-    assert "invalid token claims." in str(response.data).lower()
-
-
-def test_api_rooms_token_missing_user_id(settings):
-    """Token without user_id should be rejected."""
-    application = ApplicationFactory()
-
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": str(application.client_id),
-        "scope": "rooms:list",
-        "delegated": True,
-        # Missing user_id
-    }
-    token = jwt.encode(
-        payload,
-        settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=settings.APPLICATION_JWT_ALG,
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "invalid token claims." in str(response.data).lower()
-
-
-def test_api_rooms_token_invalid_audience(settings):
-    """Token with an invalid audience should be rejected."""
-    user = UserFactory()
-    application = ApplicationFactory()
-
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": "invalid-audience",
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": str(application.client_id),
-        "user_id": str(user.id),
-        "scope": "rooms:list",
-        "delegated": True,
-    }
-    token = jwt.encode(
-        payload,
-        settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=settings.APPLICATION_JWT_ALG,
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "invalid token." in str(response.data).lower()
-
-
-def test_api_rooms_token_unknown_user(settings):
-    """Token for unknown user should be rejected."""
-    application = ApplicationFactory()
-
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": str(application.client_id),
-        "user_id": str(uuid.uuid4()),
-        "scope": "rooms:list",
-        "delegated": True,
-    }
-    token = jwt.encode(
-        payload,
-        settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=settings.APPLICATION_JWT_ALG,
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "user not found." in str(response.data).lower()
-
-
-def test_api_rooms_token_unknown_application(settings):
-    """Token for unknown application should be rejected."""
-
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": "unknown-client-id",
-        "user_id": str(uuid.uuid4()),
-        "scope": "rooms:list",
-        "delegated": True,
-    }
-    token = jwt.encode(
-        payload,
-        settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=settings.APPLICATION_JWT_ALG,
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "application not found." in str(response.data).lower()
-
-
-def test_api_rooms_token_inactive_application(settings):
-    """Token for inactive application should be rejected."""
-    application = ApplicationFactory(active=False)
-
-    now = datetime.now(timezone.utc)
-    payload = {
-        "iss": settings.APPLICATION_JWT_ISSUER,
-        "aud": settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(hours=1),
-        "client_id": str(application.client_id),
-        "user_id": str(uuid.uuid4()),
-        "scope": "rooms:list",
-        "delegated": True,
-    }
-    token = jwt.encode(
-        payload,
-        settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=settings.APPLICATION_JWT_ALG,
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "application is disabled." in str(response.data).lower()
+    assert "Invalid token claims." in str(response.data)


@responses.activate
@@ -1087,7 +507,7 @@ def test_resource_server_authentication_successful(settings):
            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
            "sub": "very-specific-sub",
            "client_id": "some_service_provider",
-            "scope": "openid lasuite_meet lasuite_meet:rooms:list lasuite_meet:rooms:retrieve",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:list",
            "active": True,
        },
    )
@@ -21,7 +21,8 @@ pytestmark = pytest.mark.django_db

 def test_api_applications_generate_token_success(settings):
    """Valid credentials should return a JWT token."""
-    UserFactory(email="User.Family@example.com")
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    user = UserFactory(email="user@example.com")
    application = ApplicationFactory(
        active=True,
        scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
@@ -39,7 +40,7 @@ def test_api_applications_generate_token_success(settings):
            "client_id": application.client_id,
            "client_secret": plain_secret,
            "grant_type": "client_credentials",
-            "scope": "user.family@example.com",
+            "scope": user.email,
        },
        format="json",
    )
@@ -172,8 +173,9 @@ def test_api_applications_generate_token_domain_not_authorized():
    assert "not authorized for this email domain" in str(response.data)


-def test_api_applications_generate_token_domain_authorized():
+def test_api_applications_generate_token_domain_authorized(settings):
    """Application with domain authorization should succeed."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@allowed.com")
    application = ApplicationFactory(
        active=True,
@@ -228,6 +230,7 @@ def test_api_applications_generate_token_user_not_found():
@freeze_time("2023-01-15 12:00:00")
 def test_api_applications_token_payload_structure(settings):
    """Generated token should have correct payload structure."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@example.com")

    application = ApplicationFactory(
@@ -277,6 +280,7 @@ def test_api_applications_token_payload_structure(settings):
 def test_api_applications_token_new_user(settings):
    """Should create a new pending user when creation is allowed and user doesn't exist."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_ALLOW_USER_CREATION = True
    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
@@ -333,6 +337,7 @@ def test_api_applications_token_new_user(settings):
 def test_api_applications_token_existing_user(settings):
    """Application should not create a new user when user exist."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@example.com")

    settings.APPLICATION_ALLOW_USER_CREATION = True
@@ -1,166 +0,0 @@
-"""
-Test utils.detect_mimetype
-Originally taken from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L166  # pylint:disable=line-too-long
-"""
-
-import pytest
-
-from core import utils
-
-
-def test_detect_mimetype_from_content_pdf():
-    """Test detect_mimetype detects PDF from content (magic bytes)."""
-    # PDF magic bytes: %PDF
-    pdf_content = b"%PDF-1.4\n"
-    mimetype = utils.detect_mimetype(pdf_content, filename="document.pdf")
-    assert mimetype == "application/pdf"
-
-
-def test_detect_mimetype_from_content_png():
-    """Test detect_mimetype detects PNG from content (magic bytes)."""
-    # PNG magic bytes: \x89PNG\r\n\x1a\n
-    png_content = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR"
-    mimetype = utils.detect_mimetype(png_content, filename="image.png")
-    assert mimetype == "image/png"
-
-
-def test_detect_mimetype_from_content_jpeg():
-    """Test detect_mimetype detects JPEG from content (magic bytes)."""
-    # JPEG magic bytes: \xff\xd8\xff
-    jpeg_content = b"\xff\xd8\xff\xe0\x00\x10JFIF"
-    mimetype = utils.detect_mimetype(jpeg_content, filename="photo.jpg")
-    assert mimetype == "image/jpeg"
-
-
-def test_detect_mimetype_from_content_text_plain():
-    """Test detect_mimetype detects plain text from content."""
-    text_content = b"This is plain text content"
-    mimetype = utils.detect_mimetype(text_content, filename="file.txt")
-    assert mimetype == "text/plain"
-
-
-def test_detect_mimetype_empty_file():
-    """Test detect_mimetype handles empty files."""
-    empty_content = b""
-    mimetype = utils.detect_mimetype(empty_content, filename="empty.txt")
-    # Empty files should be detected as application/x-empty by magic bytes
-    assert mimetype == "application/x-empty"
-
-
-def test_detect_mimetype_uses_extension_when_content_generic():
-    """Test detect_mimetype uses extension when content detection returns generic type."""
-    # Generic binary content that might be detected as application/octet-stream
-    generic_content = b"\x00\x01\x02\x03\x04\x05"
-    # But if we have a specific extension, we should use it
-    mimetype = utils.detect_mimetype(generic_content, filename="document.pdf")
-    # Should prefer extension-based detection for specific types
-    assert mimetype == "application/pdf"
-
-
-def test_detect_mimetype_uses_extension_for_json():
-    """Test detect_mimetype uses extension for JSON files."""
-    # JSON content might be detected as text/plain
-    json_content = b'{"key": "value"}'
-    mimetype = utils.detect_mimetype(json_content, filename="data.json")
-    # Should use extension to get application/json
-    assert mimetype == "application/json"
-
-
-def test_detect_mimetype_without_filename():
-    """Test detect_mimetype works without filename (content-only detection)."""
-    pdf_content = b"%PDF-1.4\n"
-    mimetype = utils.detect_mimetype(pdf_content, filename=None)
-    assert mimetype == "application/pdf"
-
-
-def test_detect_mimetype_fallback_to_extension():
-    """Test detect_mimetype falls back to extension when content detection is generic."""
-    # Content that might be detected as text/plain
-    content = b"some content"
-    mimetype = utils.detect_mimetype(content, filename="script.js")
-    # Should use extension to get JavaScript MIME type
-    # (can be text/javascript or application/javascript)
-    assert mimetype in ["text/javascript", "application/javascript"]
-
-
-def test_detect_mimetype_generic_content_no_extension():
-    """Test detect_mimetype with generic content and no extension."""
-    generic_content = b"\x00\x01\x02\x03"
-    mimetype = utils.detect_mimetype(generic_content, filename="file")
-    # Should return content-based detection (likely application/octet-stream)
-    assert mimetype in ["application/octet-stream", "application/x-empty"]
-
-
-def test_detect_mimetype_xml_file():
-    """Test detect_mimetype detects XML files."""
-    xml_content = b'<?xml version="1.0"?><root></root>'
-    mimetype = utils.detect_mimetype(xml_content, filename="data.xml")
-    # Should detect as XML (either from content or extension)
-    assert mimetype in ["application/xml", "text/xml"]
-
-
-def test_detect_mimetype_csv_file():
-    """Test detect_mimetype detects CSV files."""
-    csv_content = b"name,age\nJohn,30\nJane,25"
-    mimetype = utils.detect_mimetype(csv_content, filename="data.csv")
-    # CSV might be detected as text/plain, but extension should help
-    assert mimetype in ["text/csv", "text/plain"]
-
-
-def test_detect_mimetype_zip_file():
-    """Test detect_mimetype detects ZIP files from magic bytes."""
-    # ZIP magic bytes: PK\x03\x04
-    zip_content = b"PK\x03\x04\x14\x00\x00\x00"
-    mimetype = utils.detect_mimetype(zip_content, filename="archive.zip")
-    assert mimetype == "application/zip"
-
-
-def test_detect_mimetype_prefers_content_over_extension():
-    """Test detect_mimetype prefers content detection when both are available and specific."""
-    # PDF content but wrong extension
-    pdf_content = b"%PDF-1.4\n"
-    mimetype = utils.detect_mimetype(pdf_content, filename="document.txt")
-    # Should prefer content detection (PDF) over extension (txt)
-    assert mimetype == "application/pdf"
-
-
-@pytest.mark.xfail(
-    reason="Fails in our repo, but passes in the original repo, leaving it there"
-)
-def test_detect_mimetype_powerpoint_pptx():
-    """Test detect_mimetype correctly detects PowerPoint .pptx files."""
-    # .pptx files are ZIP archives, so content might be detected as application/zip or octet-stream
-    # But with the extension, it should be detected as PowerPoint MIME type
-    # Using minimal ZIP-like content that might be detected as generic
-    pptx_content = b"PK\x03\x04"  # ZIP magic bytes (PPTX is a ZIP archive)
-    mimetype = utils.detect_mimetype(pptx_content, filename="presentation.pptx")
-    # Should use extension to get PowerPoint MIME type
-    assert mimetype in [
-        "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-        "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
-    ]
-
-
-def test_detect_mimetype_powerpoint_ppt():
-    """Test detect_mimetype correctly detects PowerPoint .ppt files (older format)."""
-    # .ppt files might be detected as application/octet-stream by magic bytes
-    # But with the extension, it should be detected as PowerPoint MIME type
-    ppt_content = b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"  # OLE2 compound document header
-    mimetype = utils.detect_mimetype(ppt_content, filename="presentation.ppt")
-    # Should use extension to get PowerPoint MIME type
-    assert mimetype in [
-        "application/vnd.ms-powerpoint",
-        "application/mspowerpoint",
-    ]
-
-
-def test_detect_mimetype_ole_storage():
-    """
-    Microsoft files .xls .doc .ppt can use the mimetype application/x-ole-storage
-    for Microsoft OLE2/Compound File Binary Format. In that case we want to rely on the extension
-    """
-
-    xls_ole_content = b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"
-    mimetype = utils.detect_mimetype(xls_ole_content, filename="document.xls")
-
-    assert mimetype == "application/vnd.ms-excel"
@@ -14,7 +14,6 @@ router = DefaultRouter()
 router.register("users", viewsets.UserViewSet, basename="users")
 router.register("rooms", viewsets.RoomViewSet, basename="rooms")
 router.register("recordings", viewsets.RecordingViewSet, basename="recordings")
-router.register("files", viewsets.FileViewSet, basename="files")
 router.register(
    "resource-accesses", viewsets.ResourceAccessViewSet, basename="resource_accesses"
 )
@@ -7,8 +7,6 @@ Utils functions used in the core app

 import hashlib
 import json
-import logging
-import mimetypes
 import random
 import secrets
 import string
@@ -19,9 +17,7 @@ from django.conf import settings
 from django.core.files.storage import default_storage

 import aiohttp
-import boto3
 import botocore
-import magic
 from asgiref.sync import async_to_sync
 from livekit.api import (  # pylint: disable=E0611
    AccessToken,
@@ -33,8 +29,6 @@ from livekit.api import (  # pylint: disable=E0611
    VideoGrants,
 )

-logger = logging.getLogger(__name__)
-

 def generate_color(identity: str) -> str:
    """Generates a consistent HSL color based on a given identity string.
@@ -350,108 +344,3 @@ def generate_room_slug():
        for size in sizes
    ]
    return "-".join(parts)
-
-
-def detect_mimetype(file_buffer: bytes, filename: str | None = None) -> str:
-    """
-    Detect MIME type using multiple methods for better accuracy.
-
-    This function combines:
-    1. Magic bytes detection (python-magic) - most reliable for actual file content
-    2. File extension detection (mimetypes) - useful as fallback or for validation
-
-    Args:
-        file_buffer: The file content buffer (first bytes of the file)
-        filename: Optional filename to extract extension from
-
-    Returns:
-        str: The detected MIME type
-
-    Notes:
-        Originally from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L166 # pylint:disable=line-too-long
-    """
-    # Initialize magic detector
-    mime_detector = magic.Magic(mime=True)
-
-    # Method 1: Detect from file content (magic bytes) - most reliable
-    mimetype_from_content = mime_detector.from_buffer(file_buffer)
-
-    # If we have a filename, try extension-based detection as well
-    mimetype_from_extension = None
-    if filename:
-        # Use mimetypes module to guess from extension
-        # Use guess_file_type (Python 3.13+) instead of deprecated guess_type
-        mimetype_from_extension, _ = mimetypes.guess_file_type(filename, strict=False)
-
-    logger.debug("detect_mimetype: mimetype_from_content: %s", mimetype_from_content)
-    logger.debug(
-        "detect_mimetype: mimetype_from_extension: %s", mimetype_from_extension
-    )
-
-    # Strategy: Prefer content-based detection, but use extension if:
-    # 1. Content detection returns generic types (application/octet-stream, text/plain)
-    # 2. Content detection fails or returns None
-    # 3. Extension detection provides a more specific type
-
-    # Generic/unreliable MIME types that we should try to improve
-    generic_types = {
-        "application/octet-stream",
-        "application/x-ole-storage",  # used by .xls, .doc and .ppt
-        "application/zip",
-        "text/plain",
-    }
-
-    # If content detection gives us a generic type and we have extension info
-    if mimetype_from_content in generic_types and mimetype_from_extension:
-        # Use extension-based detection if it's more specific
-        if mimetype_from_extension not in generic_types:
-            return mimetype_from_extension
-
-    # If content detection failed, returned None or is a generic type, use extension if available
-    if not mimetype_from_content or mimetype_from_content in generic_types:
-        if mimetype_from_extension:
-            return mimetype_from_extension
-
-    # Default to content-based detection (most reliable)
-    return mimetype_from_content or "application/octet-stream"
-
-
-def generate_upload_policy(file):
-    """
-    Generate a S3 upload policy for a given file.
-
-    Notes:
-        Originally taken from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L102  # pylint: disable=line-too-long
-    """
-
-    key = file.file_key
-
-    # This settings should be used if the backend application and the frontend application
-    # can't connect to the object storage with the same domain. This is the case in the
-    # docker compose stack used in development. The frontend application will use localhost
-    # to connect to the object storage while the backend application will use the object storage
-    # service name declared in the docker compose stack.
-    # This is needed because the domain name is used to compute the signature. So it can't be
-    # changed dynamically by the frontend application.
-    if settings.AWS_S3_DOMAIN_REPLACE:
-        s3_client = boto3.client(
-            "s3",
-            aws_access_key_id=settings.AWS_S3_ACCESS_KEY_ID,
-            aws_secret_access_key=settings.AWS_S3_SECRET_ACCESS_KEY,
-            endpoint_url=settings.AWS_S3_DOMAIN_REPLACE,
-            config=botocore.client.Config(
-                region_name=settings.AWS_S3_REGION_NAME,
-                signature_version=settings.AWS_S3_SIGNATURE_VERSION,
-            ),
-        )
-    else:
-        s3_client = default_storage.connection.meta.client
-
-    # Generate the policy
-    policy = s3_client.generate_presigned_url(
-        ClientMethod="put_object",
-        Params={"Bucket": default_storage.bucket_name, "Key": key, "ACL": "private"},
-        ExpiresIn=settings.AWS_S3_UPLOAD_POLICY_EXPIRATION,
-    )
-
-    return policy
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:34+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,149 +29,141 @@ msgstr "Berechtigungen"
 msgid "Important dates"
 msgstr "Wichtige Daten"

-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:128 core/admin.py:228
 msgid "No owner"
 msgstr "Kein Eigentümer"

-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:131 core/admin.py:231
 msgid "Multiple owners"
 msgstr "Mehrere Eigentümer"

-#: core/admin.py:148
+#: core/admin.py:143
 msgid "Resend notification to external service"
 msgstr "Benachrichtigung erneut an externen Dienst senden"

-#: core/admin.py:171
+#: core/admin.py:166
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Benachrichtigung für Aufnahme %(id)s fehlgeschlagen"

-#: core/admin.py:179
+#: core/admin.py:174
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Benachrichtigung für Aufnahme %(id)s fehlgeschlagen: %(error)s"

-#: core/admin.py:187
+#: core/admin.py:182
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Benachrichtigungen für %(count)s Aufnahme(n) erfolgreich gesendet."

-#: core/admin.py:195
+#: core/admin.py:190
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s abgelaufene Aufnahme(n) übersprungen."

-#: core/admin.py:309
+#: core/admin.py:294
 msgid "No scopes"
 msgstr "Keine Scopes"

-#: core/admin.py:311
+#: core/admin.py:296
 msgid "Scopes"
 msgstr "Scopes"

-#: core/api/filters.py:24
-msgid "Creator is me"
-msgstr "Ersteller bin ich"
-
-#: core/api/serializers.py:84
+#: core/api/serializers.py:68
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
 "hinzuzufügen."

-#: core/api/serializers.py:443
-msgid "This file extension is not allowed."
-msgstr "Diese Dateiendung ist nicht erlaubt."
-
-#: core/models.py:35
+#: core/models.py:34
 msgid "Member"
 msgstr "Mitglied"

-#: core/models.py:36
+#: core/models.py:35
 msgid "Administrator"
 msgstr "Administrator"

-#: core/models.py:37
+#: core/models.py:36
 msgid "Owner"
 msgstr "Eigentümer"

-#: core/models.py:53
+#: core/models.py:52
 msgid "Initiated"
 msgstr "Gestartet"

-#: core/models.py:54
+#: core/models.py:53
 msgid "Active"
 msgstr "Aktiv"

-#: core/models.py:55
+#: core/models.py:54
 msgid "Stopped"
 msgstr "Beendet"

-#: core/models.py:56
+#: core/models.py:55
 msgid "Saved"
 msgstr "Gespeichert"

-#: core/models.py:57
+#: core/models.py:56
 msgid "Aborted"
 msgstr "Abgebrochen"

-#: core/models.py:58
+#: core/models.py:57
 msgid "Failed to Start"
 msgstr "Start fehlgeschlagen"

-#: core/models.py:59
+#: core/models.py:58
 msgid "Failed to Stop"
 msgstr "Stopp fehlgeschlagen"

-#: core/models.py:60
+#: core/models.py:59
 msgid "Notification succeeded"
 msgstr "Benachrichtigung erfolgreich"

-#: core/models.py:87
+#: core/models.py:86
 msgid "SCREEN_RECORDING"
 msgstr "BILDSCHIRMAUFZEICHNUNG"

-#: core/models.py:88
+#: core/models.py:87
 msgid "TRANSCRIPT"
 msgstr "TRANSKRIPT"

-#: core/models.py:94
+#: core/models.py:93
 msgid "Public Access"
 msgstr "Öffentlicher Zugriff"

-#: core/models.py:95
+#: core/models.py:94
 msgid "Trusted Access"
 msgstr "Vertrauenswürdiger Zugriff"

-#: core/models.py:96
+#: core/models.py:95
 msgid "Restricted Access"
 msgstr "Eingeschränkter Zugriff"

-#: core/models.py:108
+#: core/models.py:107
 msgid "id"
 msgstr "ID"

-#: core/models.py:109
+#: core/models.py:108
 msgid "primary key for the record as UUID"
 msgstr "Primärschlüssel des Eintrags als UUID"

-#: core/models.py:115
+#: core/models.py:114
 msgid "created on"
 msgstr "erstellt am"

-#: core/models.py:116
+#: core/models.py:115
 msgid "date and time at which a record was created"
 msgstr "Datum und Uhrzeit der Erstellung eines Eintrags"

-#: core/models.py:121
+#: core/models.py:120
 msgid "updated on"
 msgstr "aktualisiert am"

-#: core/models.py:122
+#: core/models.py:121
 msgid "date and time at which a record was last updated"
 msgstr "Datum und Uhrzeit der letzten Aktualisierung eines Eintrags"

-#: core/models.py:142
+#: core/models.py:141
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -179,11 +171,11 @@ msgstr ""
 "Geben Sie einen gültigen Sub ein. Dieser Wert darf nur Buchstaben, Zahlen "
 "und die Zeichen @/./+/-/_ enthalten."

-#: core/models.py:148
+#: core/models.py:147
 msgid "sub"
 msgstr "Sub"

-#: core/models.py:150
+#: core/models.py:149
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -191,55 +183,55 @@ msgstr ""
 "Optional für ausstehende Benutzer; erforderlich nach Kontoaktivierung. "
 "Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ Zeichen erlaubt."

-#: core/models.py:159
+#: core/models.py:158
 msgid "identity email address"
 msgstr "Identitäts-E-Mail-Adresse"

-#: core/models.py:164
+#: core/models.py:163
 msgid "admin email address"
 msgstr "Administrator-E-Mail-Adresse"

-#: core/models.py:166
+#: core/models.py:165
 msgid "full name"
 msgstr "Vollständiger Name"

-#: core/models.py:168
+#: core/models.py:167
 msgid "short name"
 msgstr "Kurzname"

-#: core/models.py:174
+#: core/models.py:173
 msgid "language"
 msgstr "Sprache"

-#: core/models.py:175
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."

-#: core/models.py:181
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."

-#: core/models.py:184
+#: core/models.py:183
 msgid "device"
 msgstr "Gerät"

-#: core/models.py:186
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."

-#: core/models.py:189
+#: core/models.py:188
 msgid "staff status"
 msgstr "Mitarbeiterstatus"

-#: core/models.py:191
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."

-#: core/models.py:194
+#: core/models.py:193
 msgid "active"
 msgstr "aktiv"

-#: core/models.py:197
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -247,66 +239,66 @@ msgstr ""
 "Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
 "anstelle des Löschens des Kontos."

-#: core/models.py:210
+#: core/models.py:209
 msgid "user"
 msgstr "Benutzer"

-#: core/models.py:211
+#: core/models.py:210
 msgid "users"
 msgstr "Benutzer"

-#: core/models.py:270
+#: core/models.py:269
 msgid "Resource"
 msgstr "Ressource"

-#: core/models.py:271
+#: core/models.py:270
 msgid "Resources"
 msgstr "Ressourcen"

-#: core/models.py:329
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Ressourcenzugriff"

-#: core/models.py:330
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Ressourcenzugriffe"

-#: core/models.py:336
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
 "bereits."

-#: core/models.py:392
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Visio-Raumkonfiguration"

-#: core/models.py:393
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."

-#: core/models.py:400
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "PIN-Code für den Raum"

-#: core/models.py:401
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."

-#: core/models.py:407 core/models.py:561
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Raum"

-#: core/models.py:408
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Räume"

-#: core/models.py:572
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "Worker-ID"

-#: core/models.py:574
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -315,149 +307,108 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."

-#: core/models.py:582
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"

-#: core/models.py:583
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."

-#: core/models.py:588 core/models.py:589
+#: core/models.py:583 core/models.py:584
 msgid "Recording options"
 msgstr "Aufnahmeoptionen"

-#: core/models.py:595
+#: core/models.py:590
 msgid "Recording"
 msgstr "Aufzeichnung"

-#: core/models.py:596
+#: core/models.py:591
 msgid "Recordings"
 msgstr "Aufzeichnungen"

-#: core/models.py:704
+#: core/models.py:699
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"

-#: core/models.py:705
+#: core/models.py:700
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"

-#: core/models.py:711
+#: core/models.py:706
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."

-#: core/models.py:717
+#: core/models.py:712
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."

-#: core/models.py:723
+#: core/models.py:718
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."

-#: core/models.py:740
+#: core/models.py:735
 msgid "Create rooms"
 msgstr "Räume erstellen"

-#: core/models.py:741
+#: core/models.py:736
 msgid "List rooms"
 msgstr "Räume auflisten"

-#: core/models.py:742
+#: core/models.py:737
 msgid "Retrieve room details"
 msgstr "Raumdetails abrufen"

-#: core/models.py:743
+#: core/models.py:738
 msgid "Update rooms"
 msgstr "Räume aktualisieren"

-#: core/models.py:744
+#: core/models.py:739
 msgid "Delete rooms"
 msgstr "Räume löschen"

-#: core/models.py:757
+#: core/models.py:752
 msgid "Application name"
 msgstr "Anwendungsname"

-#: core/models.py:758
+#: core/models.py:753
 msgid "Descriptive name for this application."
 msgstr "Beschreibender Name für diese Anwendung."

-#: core/models.py:768
+#: core/models.py:763
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."

-#: core/models.py:779
+#: core/models.py:774
 msgid "Application"
 msgstr "Anwendung"

-#: core/models.py:780
+#: core/models.py:775
 msgid "Applications"
 msgstr "Anwendungen"

-#: core/models.py:803
+#: core/models.py:798
 msgid "Enter a valid domain"
 msgstr "Geben Sie eine gültige Domain ein"

-#: core/models.py:806
+#: core/models.py:801
 msgid "Domain"
 msgstr "Domain"

-#: core/models.py:807
+#: core/models.py:802
 msgid "Email domain this application can act on behalf of."
 msgstr "E-Mail-Domain, im Namen der diese Anwendung handeln kann."

-#: core/models.py:819
+#: core/models.py:814
 msgid "Application domain"
 msgstr "Anwendungsdomain"

-#: core/models.py:820
+#: core/models.py:815
 msgid "Application domains"
 msgstr "Anwendungsdomains"

-#: core/models.py:838
-msgid "Pending"
-msgstr "Ausstehend"
-
-#: core/models.py:846
-msgid "Ready"
-msgstr "Bereit"
-
-#: core/models.py:852
-msgid "Background image"
-msgstr "Hintergrundbild"
-
-#: core/models.py:864
-msgid "title"
-msgstr "Titel"
-
-#: core/models.py:890
-msgid "Malware detection info when the analysis status is unsafe."
-msgstr ""
-"Informationen zur Malware-Erkennung, wenn der Analyse-Status unsicher ist."
-
-#: core/models.py:895
-msgid "File"
-msgstr "Datei"
-
-#: core/models.py:896
-msgid "Files"
-msgstr "Dateien"
-
-#: core/models.py:970
-msgid "This file is already hard deleted."
-msgstr "Diese Datei wurde bereits endgültig gelöscht."
-
-#: core/models.py:980
-#, fuzzy
-#| msgid "To hard delete a file, it must first be soft deleted."
-msgid "To hard delete a file, it must first be soft deleted."
-msgstr ""
-"Um eine Datei endgültig zu löschen, muss sie zuvor weich gelöscht worden "
-"sein."
-
-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Ihre Aufzeichnung ist bereit"

@@ -585,18 +536,18 @@ msgstr ""
 " Wenn Sie Fragen haben oder Unterstützung benötigen, wenden Sie sich bitte "
 "an unser Support-Team unter %(support_email)s. "

-#: meet/settings.py:224
+#: meet/settings.py:169
 msgid "English"
 msgstr "Englisch"

-#: meet/settings.py:225
+#: meet/settings.py:170
 msgid "French"
 msgstr "Französisch"

-#: meet/settings.py:226
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Niederländisch"

-#: meet/settings.py:227
+#: meet/settings.py:172
 msgid "German"
 msgstr "Deutsch"
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:26+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,147 +29,139 @@ msgstr "Permissions"
 msgid "Important dates"
 msgstr "Important dates"

-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:128 core/admin.py:228
 msgid "No owner"
 msgstr "No owner"

-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:131 core/admin.py:231
 msgid "Multiple owners"
 msgstr "Multiple owners"

-#: core/admin.py:148
+#: core/admin.py:143
 msgid "Resend notification to external service"
 msgstr "Resend notification to external service"

-#: core/admin.py:171
+#: core/admin.py:166
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Failed to notify for recording %(id)s"

-#: core/admin.py:179
+#: core/admin.py:174
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Failed to notify for recording %(id)s: %(error)s"

-#: core/admin.py:187
+#: core/admin.py:182
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Successfully sent notifications for %(count)s recording(s)."

-#: core/admin.py:195
+#: core/admin.py:190
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "Skipped %(count)s expired recording(s)."

-#: core/admin.py:309
+#: core/admin.py:294
 msgid "No scopes"
 msgstr "No scopes"

-#: core/admin.py:311
+#: core/admin.py:296
 msgid "Scopes"
 msgstr "Scopes"

-#: core/api/filters.py:24
-msgid "Creator is me"
-msgstr "Creator is me"
-
-#: core/api/serializers.py:84
+#: core/api/serializers.py:68
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr "You must be administrator or owner of a room to add accesses to it."

-#: core/api/serializers.py:443
-msgid "This file extension is not allowed."
-msgstr "This file extension is not allowed."
-
-#: core/models.py:35
+#: core/models.py:34
 msgid "Member"
 msgstr "Member"

-#: core/models.py:36
+#: core/models.py:35
 msgid "Administrator"
 msgstr "Administrator"

-#: core/models.py:37
+#: core/models.py:36
 msgid "Owner"
 msgstr "Owner"

-#: core/models.py:53
+#: core/models.py:52
 msgid "Initiated"
 msgstr "Initiated"

-#: core/models.py:54
+#: core/models.py:53
 msgid "Active"
 msgstr "Active"

-#: core/models.py:55
+#: core/models.py:54
 msgid "Stopped"
 msgstr "Stopped"

-#: core/models.py:56
+#: core/models.py:55
 msgid "Saved"
 msgstr "Saved"

-#: core/models.py:57
+#: core/models.py:56
 msgid "Aborted"
 msgstr "Aborted"

-#: core/models.py:58
+#: core/models.py:57
 msgid "Failed to Start"
 msgstr "Failed to Start"

-#: core/models.py:59
+#: core/models.py:58
 msgid "Failed to Stop"
 msgstr "Failed to Stop"

-#: core/models.py:60
+#: core/models.py:59
 msgid "Notification succeeded"
 msgstr "Notification succeeded"

-#: core/models.py:87
+#: core/models.py:86
 msgid "SCREEN_RECORDING"
 msgstr "SCREEN_RECORDING"

-#: core/models.py:88
+#: core/models.py:87
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"

-#: core/models.py:94
+#: core/models.py:93
 msgid "Public Access"
 msgstr "Public Access"

-#: core/models.py:95
+#: core/models.py:94
 msgid "Trusted Access"
 msgstr "Trusted Access"

-#: core/models.py:96
+#: core/models.py:95
 msgid "Restricted Access"
 msgstr "Restricted Access"

-#: core/models.py:108
+#: core/models.py:107
 msgid "id"
 msgstr "id"

-#: core/models.py:109
+#: core/models.py:108
 msgid "primary key for the record as UUID"
 msgstr "primary key for the record as UUID"

-#: core/models.py:115
+#: core/models.py:114
 msgid "created on"
 msgstr "created on"

-#: core/models.py:116
+#: core/models.py:115
 msgid "date and time at which a record was created"
 msgstr "date and time at which a record was created"

-#: core/models.py:121
+#: core/models.py:120
 msgid "updated on"
 msgstr "updated on"

-#: core/models.py:122
+#: core/models.py:121
 msgid "date and time at which a record was last updated"
 msgstr "date and time at which a record was last updated"

-#: core/models.py:142
+#: core/models.py:141
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -177,11 +169,11 @@ msgstr ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."

-#: core/models.py:148
+#: core/models.py:147
 msgid "sub"
 msgstr "sub"

-#: core/models.py:150
+#: core/models.py:149
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -189,55 +181,55 @@ msgstr ""
 "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
 "characters only."

-#: core/models.py:159
+#: core/models.py:158
 msgid "identity email address"
 msgstr "identity email address"

-#: core/models.py:164
+#: core/models.py:163
 msgid "admin email address"
 msgstr "admin email address"

-#: core/models.py:166
+#: core/models.py:165
 msgid "full name"
 msgstr "full name"

-#: core/models.py:168
+#: core/models.py:167
 msgid "short name"
 msgstr "short name"

-#: core/models.py:174
+#: core/models.py:173
 msgid "language"
 msgstr "language"

-#: core/models.py:175
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "The language in which the user wants to see the interface."

-#: core/models.py:181
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "The timezone in which the user wants to see times."

-#: core/models.py:184
+#: core/models.py:183
 msgid "device"
 msgstr "device"

-#: core/models.py:186
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Whether the user is a device or a real user."

-#: core/models.py:189
+#: core/models.py:188
 msgid "staff status"
 msgstr "staff status"

-#: core/models.py:191
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Whether the user can log into this admin site."

-#: core/models.py:194
+#: core/models.py:193
 msgid "active"
 msgstr "active"

-#: core/models.py:197
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -245,63 +237,63 @@ msgstr ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."

-#: core/models.py:210
+#: core/models.py:209
 msgid "user"
 msgstr "user"

-#: core/models.py:211
+#: core/models.py:210
 msgid "users"
 msgstr "users"

-#: core/models.py:270
+#: core/models.py:269
 msgid "Resource"
 msgstr "Resource"

-#: core/models.py:271
+#: core/models.py:270
 msgid "Resources"
 msgstr "Resources"

-#: core/models.py:329
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Resource access"

-#: core/models.py:330
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Resource accesses"

-#: core/models.py:336
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr "Resource access with this User and Resource already exists."

-#: core/models.py:392
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Visio room configuration"

-#: core/models.py:393
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."

-#: core/models.py:400
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "Room PIN code"

-#: core/models.py:401
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr "Unique n-digit code that identifies this room in telephony mode."

-#: core/models.py:407 core/models.py:561
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Room"

-#: core/models.py:408
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Rooms"

-#: core/models.py:572
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "Worker ID"

-#: core/models.py:574
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -309,151 +301,111 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."

-#: core/models.py:582
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Recording mode"

-#: core/models.py:583
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."

-#: core/models.py:588 core/models.py:589
+#: core/models.py:583 core/models.py:584
 msgid "Recording options"
 msgstr "Recording options"

-#: core/models.py:595
+#: core/models.py:590
 msgid "Recording"
 msgstr "Recording"

-#: core/models.py:596
+#: core/models.py:591
 msgid "Recordings"
 msgstr "Recordings"

-#: core/models.py:704
+#: core/models.py:699
 msgid "Recording/user relation"
 msgstr "Recording/user relation"

-#: core/models.py:705
+#: core/models.py:700
 msgid "Recording/user relations"
 msgstr "Recording/user relations"

-#: core/models.py:711
+#: core/models.py:706
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."

-#: core/models.py:717
+#: core/models.py:712
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."

-#: core/models.py:723
+#: core/models.py:718
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."

-#: core/models.py:740
+#: core/models.py:735
 #, fuzzy
 #| msgid "created on"
 msgid "Create rooms"
 msgstr "Create rooms"

-#: core/models.py:741
+#: core/models.py:736
 msgid "List rooms"
 msgstr "List rooms"

-#: core/models.py:742
+#: core/models.py:737
 msgid "Retrieve room details"
 msgstr "Retrieve room details"

-#: core/models.py:743
+#: core/models.py:738
 #, fuzzy
 #| msgid "updated on"
 msgid "Update rooms"
 msgstr "Update rooms"

-#: core/models.py:744
+#: core/models.py:739
 msgid "Delete rooms"
 msgstr "Delete rooms"

-#: core/models.py:757
+#: core/models.py:752
 msgid "Application name"
 msgstr "Application name"

-#: core/models.py:758
+#: core/models.py:753
 msgid "Descriptive name for this application."
 msgstr "Descriptive name for this application."

-#: core/models.py:768
+#: core/models.py:763
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Hashed on Save. Copy it now if this is a new secret."

-#: core/models.py:779
+#: core/models.py:774
 msgid "Application"
 msgstr "Application"

-#: core/models.py:780
+#: core/models.py:775
 msgid "Applications"
 msgstr "Applications"

-#: core/models.py:803
+#: core/models.py:798
 msgid "Enter a valid domain"
 msgstr "Enter a valid domain"

-#: core/models.py:806
+#: core/models.py:801
 msgid "Domain"
 msgstr "Domain"

-#: core/models.py:807
+#: core/models.py:802
 msgid "Email domain this application can act on behalf of."
 msgstr "Email domain this application can act on behalf of."

-#: core/models.py:819
+#: core/models.py:814
 msgid "Application domain"
 msgstr "Application domain"

-#: core/models.py:820
+#: core/models.py:815
 msgid "Application domains"
 msgstr "Application domains"

-#: core/models.py:838
-#, fuzzy
-#| msgid "Recording"
-msgid "Pending"
-msgstr "Pending"
-
-#: core/models.py:846
-msgid "Ready"
-msgstr "Ready"
-
-#: core/models.py:852
-msgid "Background image"
-msgstr "Background image"
-
-#: core/models.py:864
-msgid "title"
-msgstr "title"
-
-#: core/models.py:890
-msgid "Malware detection info when the analysis status is unsafe."
-msgstr "Malware detection info when the analysis status is unsafe."
-
-#: core/models.py:895
-msgid "File"
-msgstr "File"
-
-#: core/models.py:896
-msgid "Files"
-msgstr "Files"
-
-#: core/models.py:970
-#, fuzzy
-#| msgid "This user is already in this recording."
-msgid "This file is already hard deleted."
-msgstr "This file is already hard deleted."
-
-#: core/models.py:980
-msgid "To hard delete a file, it must first be soft deleted."
-msgstr "To hard delete a file, it must first be soft deleted."
-
-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Your recording is ready"

@@ -581,18 +533,18 @@ msgstr ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "

-#: meet/settings.py:224
+#: meet/settings.py:169
 msgid "English"
 msgstr "English"

-#: meet/settings.py:225
+#: meet/settings.py:170
 msgid "French"
 msgstr "French"

-#: meet/settings.py:226
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Dutch"

-#: meet/settings.py:227
+#: meet/settings.py:172
 msgid "German"
 msgstr "German"
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:26+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,151 +29,143 @@ msgstr "Permissions"
 msgid "Important dates"
 msgstr "Dates importantes"

-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:128 core/admin.py:228
 msgid "No owner"
 msgstr "Pas de propriétaire"

-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:131 core/admin.py:231
 msgid "Multiple owners"
 msgstr "Plusieurs propriétaires"

-#: core/admin.py:148
+#: core/admin.py:143
 msgid "Resend notification to external service"
 msgstr "Renvoyer la notification au service externe"

-#: core/admin.py:171
+#: core/admin.py:166
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Échec de la notification pour l’enregistrement %(id)s"

-#: core/admin.py:179
+#: core/admin.py:174
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Échec de la notification pour l’enregistrement %(id)s : %(error)s"

-#: core/admin.py:187
+#: core/admin.py:182
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Notifications envoyées avec succès pour %(count)s enregistrement(s)."

-#: core/admin.py:195
+#: core/admin.py:190
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s enregistrement(s) expiré(s) ignoré(s)."

-#: core/admin.py:309
+#: core/admin.py:294
 msgid "No scopes"
 msgstr "Aucun scopes"

-#: core/admin.py:311
+#: core/admin.py:296
 msgid "Scopes"
 msgstr "Scopes"

-#: core/api/filters.py:24
-msgid "Creator is me"
-msgstr "Je suis le créateur"
-
-#: core/api/serializers.py:84
+#: core/api/serializers.py:68
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
 "des accès."

-#: core/api/serializers.py:443
-msgid "This file extension is not allowed."
-msgstr "Cette extension n'est pas autorisée"
-
-#: core/models.py:35
+#: core/models.py:34
 msgid "Member"
 msgstr "Membre"

-#: core/models.py:36
+#: core/models.py:35
 msgid "Administrator"
 msgstr "Administrateur"

-#: core/models.py:37
+#: core/models.py:36
 msgid "Owner"
 msgstr "Propriétaire"

-#: core/models.py:53
+#: core/models.py:52
 msgid "Initiated"
 msgstr "Initié"

-#: core/models.py:54
+#: core/models.py:53
 msgid "Active"
 msgstr "Actif"

-#: core/models.py:55
+#: core/models.py:54
 msgid "Stopped"
 msgstr "Arrêté"

-#: core/models.py:56
+#: core/models.py:55
 msgid "Saved"
 msgstr "Enregistré"

-#: core/models.py:57
+#: core/models.py:56
 msgid "Aborted"
 msgstr "Abandonné"

-#: core/models.py:58
+#: core/models.py:57
 msgid "Failed to Start"
 msgstr "Échec au démarrage"

-#: core/models.py:59
+#: core/models.py:58
 msgid "Failed to Stop"
 msgstr "Échec à l'arrêt"

-#: core/models.py:60
+#: core/models.py:59
 msgid "Notification succeeded"
 msgstr "Notification réussie"

-#: core/models.py:87
+#: core/models.py:86
 msgid "SCREEN_RECORDING"
 msgstr "ENREGISTREMENT_ÉCRAN"

-#: core/models.py:88
+#: core/models.py:87
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPTION"

-#: core/models.py:94
+#: core/models.py:93
 msgid "Public Access"
 msgstr "Accès public"

-#: core/models.py:95
+#: core/models.py:94
 msgid "Trusted Access"
 msgstr "Accès de confiance"

-#: core/models.py:96
+#: core/models.py:95
 msgid "Restricted Access"
 msgstr "Accès restreint"

-#: core/models.py:108
+#: core/models.py:107
 msgid "id"
 msgstr "id"

-#: core/models.py:109
+#: core/models.py:108
 msgid "primary key for the record as UUID"
 msgstr "clé primaire pour l'enregistrement sous forme d'UUID"

-#: core/models.py:115
+#: core/models.py:114
 msgid "created on"
 msgstr "créé le"

-#: core/models.py:116
+#: core/models.py:115
 msgid "date and time at which a record was created"
 msgstr "date et heure auxquelles un enregistrement a été créé"

-#: core/models.py:121
+#: core/models.py:120
 msgid "updated on"
 msgstr "mis à jour le"

-#: core/models.py:122
+#: core/models.py:121
 msgid "date and time at which a record was last updated"
 msgstr ""
 "date et heure auxquelles un enregistrement a été mis à jour pour la dernière "
 "fois"

-#: core/models.py:142
+#: core/models.py:141
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -181,11 +173,11 @@ msgstr ""
 "Entrez un sub valide. Cette valeur ne peut contenir que des lettres, des "
 "chiffres et les caractères @/./+/-/_."

-#: core/models.py:148
+#: core/models.py:147
 msgid "sub"
 msgstr "sub"

-#: core/models.py:150
+#: core/models.py:149
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -193,55 +185,55 @@ msgstr ""
 "Optionnel pour les utilisateurs en attente ; requis lors de l'activation du "
 "compte. 255 caractères maximum. Lettres, chiffres et @/./+/-/_ uniquement."

-#: core/models.py:159
+#: core/models.py:158
 msgid "identity email address"
 msgstr "adresse e-mail d'identité"

-#: core/models.py:164
+#: core/models.py:163
 msgid "admin email address"
 msgstr "adresse e-mail d'administrateur"

-#: core/models.py:166
+#: core/models.py:165
 msgid "full name"
 msgstr "nom complet"

-#: core/models.py:168
+#: core/models.py:167
 msgid "short name"
 msgstr "nom court"

-#: core/models.py:174
+#: core/models.py:173
 msgid "language"
 msgstr "langue"

-#: core/models.py:175
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."

-#: core/models.py:181
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."

-#: core/models.py:184
+#: core/models.py:183
 msgid "device"
 msgstr "appareil"

-#: core/models.py:186
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."

-#: core/models.py:189
+#: core/models.py:188
 msgid "staff status"
 msgstr "statut du personnel"

-#: core/models.py:191
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Si l'utilisateur peut se connecter à ce site d'administration."

-#: core/models.py:194
+#: core/models.py:193
 msgid "active"
 msgstr "actif"

-#: core/models.py:197
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -249,65 +241,65 @@ msgstr ""
 "Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
 "au lieu de supprimer des comptes."

-#: core/models.py:210
+#: core/models.py:209
 msgid "user"
 msgstr "utilisateur"

-#: core/models.py:211
+#: core/models.py:210
 msgid "users"
 msgstr "utilisateurs"

-#: core/models.py:270
+#: core/models.py:269
 msgid "Resource"
 msgstr "Ressource"

-#: core/models.py:271
+#: core/models.py:270
 msgid "Resources"
 msgstr "Ressources"

-#: core/models.py:329
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Accès aux ressources"

-#: core/models.py:330
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Accès aux ressources"

-#: core/models.py:336
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."

-#: core/models.py:392
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Configuration de la salle de visioconférence"

-#: core/models.py:393
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."

-#: core/models.py:400
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "Code PIN de la salle"

-#: core/models.py:401
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Code unique à n chiffres qui identifie cette salle en mode téléphonique."

-#: core/models.py:407 core/models.py:561
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Salle"

-#: core/models.py:408
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Salles"

-#: core/models.py:572
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "ID du Worker"

-#: core/models.py:574
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -315,147 +307,109 @@ msgstr ""
 "Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant est "
 "conservé même lorsque le Worker s'arrête, permettant un suivi facile."

-#: core/models.py:582
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"

-#: core/models.py:583
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."

-#: core/models.py:588 core/models.py:589
+#: core/models.py:583 core/models.py:584
 msgid "Recording options"
 msgstr "Options d'enregistrement"

-#: core/models.py:595
+#: core/models.py:590
 msgid "Recording"
 msgstr "Enregistrement"

-#: core/models.py:596
+#: core/models.py:591
 msgid "Recordings"
 msgstr "Enregistrements"

-#: core/models.py:704
+#: core/models.py:699
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"

-#: core/models.py:705
+#: core/models.py:700
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"

-#: core/models.py:711
+#: core/models.py:706
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."

-#: core/models.py:717
+#: core/models.py:712
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."

-#: core/models.py:723
+#: core/models.py:718
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."

-#: core/models.py:740
+#: core/models.py:735
 msgid "Create rooms"
 msgstr "Créer des salles"

-#: core/models.py:741
+#: core/models.py:736
 msgid "List rooms"
 msgstr "Lister les salles"

-#: core/models.py:742
+#: core/models.py:737
 msgid "Retrieve room details"
 msgstr "Afficher les détails d’une salle"

-#: core/models.py:743
+#: core/models.py:738
 msgid "Update rooms"
 msgstr "Mettre à jour les salles"

-#: core/models.py:744
+#: core/models.py:739
 msgid "Delete rooms"
 msgstr "Supprimer les salles"

-#: core/models.py:757
+#: core/models.py:752
 msgid "Application name"
 msgstr "Nom de l’application"

-#: core/models.py:758
+#: core/models.py:753
 msgid "Descriptive name for this application."
 msgstr "Nom descriptif de cette application."

-#: core/models.py:768
+#: core/models.py:763
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un "
 "nouveau secret."

-#: core/models.py:779
+#: core/models.py:774
 msgid "Application"
 msgstr "Application"

-#: core/models.py:780
+#: core/models.py:775
 msgid "Applications"
 msgstr "Applications"

-#: core/models.py:803
+#: core/models.py:798
 msgid "Enter a valid domain"
 msgstr "Saisissez un domaine valide"

-#: core/models.py:806
+#: core/models.py:801
 msgid "Domain"
 msgstr "Domaine"

-#: core/models.py:807
+#: core/models.py:802
 msgid "Email domain this application can act on behalf of."
 msgstr "Domaine de messagerie au nom duquel cette application peut agir."

-#: core/models.py:819
+#: core/models.py:814
 msgid "Application domain"
 msgstr "Domaine d’application"

-#: core/models.py:820
+#: core/models.py:815
 msgid "Application domains"
 msgstr "Domaines d’application"

-#: core/models.py:838
-msgid "Pending"
-msgstr "En attente"
-
-#: core/models.py:846
-msgid "Ready"
-msgstr "Prêt"
-
-#: core/models.py:852
-msgid "Background image"
-msgstr "Image de fond"
-
-#: core/models.py:864
-msgid "title"
-msgstr "Titre"
-
-#: core/models.py:890
-msgid "Malware detection info when the analysis status is unsafe."
-msgstr "Information concernant la détection de Malware cand le statut n'est pas sain"
-
-#: core/models.py:895
-msgid "File"
-msgstr "Fichier"
-
-#: core/models.py:896
-msgid "Files"
-msgstr "Fichiers"
-
-#: core/models.py:970
-#, fuzzy
-#| msgid "This user is already in this recording."
-msgid "This file is already hard deleted."
-msgstr "Ce fichier a été supprimé."
-
-#: core/models.py:980
-msgid "To hard delete a file, it must first be soft deleted."
-msgstr "Pour supprimer définitivement un fichier il doit d'abord avoir été marqué comme supprimé (soft delete)"
-
-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Votre enregistrement est prêt"

@@ -583,18 +537,18 @@ msgstr ""
 " Si vous avez des questions ou besoin d'assistance, veuillez contacter notre "
 "équipe d'assistance à %(support_email)s. "

-#: meet/settings.py:224
+#: meet/settings.py:169
 msgid "English"
 msgstr "Anglais"

-#: meet/settings.py:225
+#: meet/settings.py:170
 msgid "French"
 msgstr "Français"

-#: meet/settings.py:226
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Néerlandais"

-#: meet/settings.py:227
+#: meet/settings.py:172
 msgid "German"
 msgstr "Allemand"
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:34+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,148 +29,140 @@ msgstr "Rechten"
 msgid "Important dates"
 msgstr "Belangrijke datums"

-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:128 core/admin.py:228
 msgid "No owner"
 msgstr "Geen eigenaar"

-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:131 core/admin.py:231
 msgid "Multiple owners"
 msgstr "Meerdere eigenaren"

-#: core/admin.py:148
+#: core/admin.py:143
 msgid "Resend notification to external service"
 msgstr "Melding opnieuw verzenden naar externe dienst"

-#: core/admin.py:171
+#: core/admin.py:166
 #, python-format
 msgid "Failed to notify for recording %(id)s"
 msgstr "Melding voor opname %(id)s mislukt"

-#: core/admin.py:179
+#: core/admin.py:174
 #, python-format
 msgid "Failed to notify for recording %(id)s: %(error)s"
 msgstr "Melding voor opname %(id)s mislukt: %(error)s"

-#: core/admin.py:187
+#: core/admin.py:182
 #, python-format
 msgid "Successfully sent notifications for %(count)s recording(s)."
 msgstr "Meldingen succesvol verzonden voor %(count)s opname(n)."

-#: core/admin.py:195
+#: core/admin.py:190
 #, python-format
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s verlopen opname(n) overgeslagen."

-#: core/admin.py:309
+#: core/admin.py:294
 msgid "No scopes"
 msgstr "Geen scopes"

-#: core/admin.py:311
+#: core/admin.py:296
 msgid "Scopes"
 msgstr "Scopes"

-#: core/api/filters.py:24
-msgid "Creator is me"
-msgstr "Maker ben ik"
-
-#: core/api/serializers.py:84
+#: core/api/serializers.py:68
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."

-#: core/api/serializers.py:443
-msgid "This file extension is not allowed."
-msgstr "Deze bestandsextensie is niet toegestaan."
-
-#: core/models.py:35
+#: core/models.py:34
 msgid "Member"
 msgstr "Lid"

-#: core/models.py:36
+#: core/models.py:35
 msgid "Administrator"
 msgstr "Beheerder"

-#: core/models.py:37
+#: core/models.py:36
 msgid "Owner"
 msgstr "Eigenaar"

-#: core/models.py:53
+#: core/models.py:52
 msgid "Initiated"
 msgstr "Gestart"

-#: core/models.py:54
+#: core/models.py:53
 msgid "Active"
 msgstr "Actief"

-#: core/models.py:55
+#: core/models.py:54
 msgid "Stopped"
 msgstr "Gestopt"

-#: core/models.py:56
+#: core/models.py:55
 msgid "Saved"
 msgstr "Opgeslagen"

-#: core/models.py:57
+#: core/models.py:56
 msgid "Aborted"
 msgstr "Afgebroken"

-#: core/models.py:58
+#: core/models.py:57
 msgid "Failed to Start"
 msgstr "Starten mislukt"

-#: core/models.py:59
+#: core/models.py:58
 msgid "Failed to Stop"
 msgstr "Stoppen mislukt"

-#: core/models.py:60
+#: core/models.py:59
 msgid "Notification succeeded"
 msgstr "Notificatie geslaagd"

-#: core/models.py:87
+#: core/models.py:86
 msgid "SCREEN_RECORDING"
 msgstr "SCHERM_OPNAME"

-#: core/models.py:88
+#: core/models.py:87
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"

-#: core/models.py:94
+#: core/models.py:93
 msgid "Public Access"
 msgstr "Openbare toegang"

-#: core/models.py:95
+#: core/models.py:94
 msgid "Trusted Access"
 msgstr "Vertrouwde toegang"

-#: core/models.py:96
+#: core/models.py:95
 msgid "Restricted Access"
 msgstr "Beperkte toegang"

-#: core/models.py:108
+#: core/models.py:107
 msgid "id"
 msgstr "id"

-#: core/models.py:109
+#: core/models.py:108
 msgid "primary key for the record as UUID"
 msgstr "primaire sleutel voor het record als UUID"

-#: core/models.py:115
+#: core/models.py:114
 msgid "created on"
 msgstr "aangemaakt op"

-#: core/models.py:116
+#: core/models.py:115
 msgid "date and time at which a record was created"
 msgstr "datum en tijd waarop een record werd aangemaakt"

-#: core/models.py:121
+#: core/models.py:120
 msgid "updated on"
 msgstr "bijgewerkt op"

-#: core/models.py:122
+#: core/models.py:121
 msgid "date and time at which a record was last updated"
 msgstr "datum en tijd waarop een record voor het laatst werd bijgewerkt"

-#: core/models.py:142
+#: core/models.py:141
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -178,11 +170,11 @@ msgstr ""
 "Voer een geldige sub in. Deze waarde mag alleen letters, cijfers en @/./+/-/"
 "_ tekens bevatten."

-#: core/models.py:148
+#: core/models.py:147
 msgid "sub"
 msgstr "sub"

-#: core/models.py:150
+#: core/models.py:149
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -190,55 +182,55 @@ msgstr ""
 "Optioneel voor gebruikers in afwachting; vereist bij accountactivering. "
 "Maximum 255 tekens. Alleen letters, cijfers en @/./+/-/_ toegestaan."

-#: core/models.py:159
+#: core/models.py:158
 msgid "identity email address"
 msgstr "identiteit e-mailadres"

-#: core/models.py:164
+#: core/models.py:163
 msgid "admin email address"
 msgstr "beheerder e-mailadres"

-#: core/models.py:166
+#: core/models.py:165
 msgid "full name"
 msgstr "volledige naam"

-#: core/models.py:168
+#: core/models.py:167
 msgid "short name"
 msgstr "korte naam"

-#: core/models.py:174
+#: core/models.py:173
 msgid "language"
 msgstr "taal"

-#: core/models.py:175
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "De taal waarin de gebruiker de interface wil zien."

-#: core/models.py:181
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "De tijdzone waarin de gebruiker tijden wil zien."

-#: core/models.py:184
+#: core/models.py:183
 msgid "device"
 msgstr "apparaat"

-#: core/models.py:186
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Of de gebruiker een apparaat is of een echte gebruiker."

-#: core/models.py:189
+#: core/models.py:188
 msgid "staff status"
 msgstr "personeelsstatus"

-#: core/models.py:191
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Of de gebruiker kan inloggen op deze beheersite."

-#: core/models.py:194
+#: core/models.py:193
 msgid "active"
 msgstr "actief"

-#: core/models.py:197
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -246,64 +238,64 @@ msgstr ""
 "Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
 "plaats van accounts te verwijderen."

-#: core/models.py:210
+#: core/models.py:209
 msgid "user"
 msgstr "gebruiker"

-#: core/models.py:211
+#: core/models.py:210
 msgid "users"
 msgstr "gebruikers"

-#: core/models.py:270
+#: core/models.py:269
 msgid "Resource"
 msgstr "Bron"

-#: core/models.py:271
+#: core/models.py:270
 msgid "Resources"
 msgstr "Bronnen"

-#: core/models.py:329
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Brontoegang"

-#: core/models.py:330
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Brontoegangsrechten"

-#: core/models.py:336
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr "Brontoegang met deze gebruiker en bron bestaat al."

-#: core/models.py:392
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Visio-ruimteconfiguratie"

-#: core/models.py:393
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."

-#: core/models.py:400
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "Pincode van de kamer"

-#: core/models.py:401
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."

-#: core/models.py:407 core/models.py:561
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Ruimte"

-#: core/models.py:408
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Ruimtes"

-#: core/models.py:572
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "Worker ID"

-#: core/models.py:574
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -311,148 +303,108 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."

-#: core/models.py:582
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Opnamemodus"

-#: core/models.py:583
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."

-#: core/models.py:588 core/models.py:589
+#: core/models.py:583 core/models.py:584
 msgid "Recording options"
 msgstr "Opnameopties"

-#: core/models.py:595
+#: core/models.py:590
 msgid "Recording"
 msgstr "Opname"

-#: core/models.py:596
+#: core/models.py:591
 msgid "Recordings"
 msgstr "Opnames"

-#: core/models.py:704
+#: core/models.py:699
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"

-#: core/models.py:705
+#: core/models.py:700
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"

-#: core/models.py:711
+#: core/models.py:706
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."

-#: core/models.py:717
+#: core/models.py:712
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."

-#: core/models.py:723
+#: core/models.py:718
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."

-#: core/models.py:740
+#: core/models.py:735
 msgid "Create rooms"
 msgstr "Ruimtes aanmaken"

-#: core/models.py:741
+#: core/models.py:736
 msgid "List rooms"
 msgstr "Ruimtes weergeven"

-#: core/models.py:742
+#: core/models.py:737
 msgid "Retrieve room details"
 msgstr "Details van een ruimte ophalen"

-#: core/models.py:743
+#: core/models.py:738
 msgid "Update rooms"
 msgstr "Ruimtes bijwerken"

-#: core/models.py:744
+#: core/models.py:739
 msgid "Delete rooms"
 msgstr "Ruimtes verwijderen"

-#: core/models.py:757
+#: core/models.py:752
 msgid "Application name"
 msgstr "Naam van de applicatie"

-#: core/models.py:758
+#: core/models.py:753
 msgid "Descriptive name for this application."
 msgstr "Beschrijvende naam voor deze applicatie."

-#: core/models.py:768
+#: core/models.py:763
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."

-#: core/models.py:779
+#: core/models.py:774
 msgid "Application"
 msgstr "Applicatie"

-#: core/models.py:780
+#: core/models.py:775
 msgid "Applications"
 msgstr "Applicaties"

-#: core/models.py:803
+#: core/models.py:798
 msgid "Enter a valid domain"
 msgstr "Voer een geldig domein in"

-#: core/models.py:806
+#: core/models.py:801
 msgid "Domain"
 msgstr "Domein"

-#: core/models.py:807
+#: core/models.py:802
 msgid "Email domain this application can act on behalf of."
 msgstr "E-maildomein namens welke deze applicatie kan handelen."

-#: core/models.py:819
+#: core/models.py:814
 msgid "Application domain"
 msgstr "Applicatiedomein"

-#: core/models.py:820
+#: core/models.py:815
 msgid "Application domains"
 msgstr "Applicatiedomeinen"

-#: core/models.py:838
-msgid "Pending"
-msgstr "In afwachting"
-
-#: core/models.py:846
-msgid "Ready"
-msgstr "Klaar"
-
-#: core/models.py:852
-msgid "Background image"
-msgstr "Achtergrondafbeelding"
-
-#: core/models.py:864
-msgid "title"
-msgstr "Titel"
-
-#: core/models.py:890
-msgid "Malware detection info when the analysis status is unsafe."
-msgstr "Informatie over malwaredetectie wanneer de analysestatus onveilig is."
-
-#: core/models.py:895
-msgid "File"
-msgstr "Bestand"
-
-#: core/models.py:896
-msgid "Files"
-msgstr "Bestanden"
-
-#: core/models.py:970
-msgid "This file is already hard deleted."
-msgstr "Dit bestand is al definitief verwijderd."
-
-#: core/models.py:980
-#, fuzzy
-#| msgid "To hard delete a file, it must first be soft deleted."
-msgid "To hard delete a file, it must first be soft deleted."
-msgstr ""
-"Om een bestand definitief te verwijderen, moet het eerst zacht verwijderd "
-"zijn."
-
-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Je opname is klaar"

@@ -580,18 +532,18 @@ msgstr ""
 " Als je vragen hebt of hulp nodig hebt, neem dan contact op met ons support "
 "team via %(support_email)s. "

-#: meet/settings.py:224
+#: meet/settings.py:169
 msgid "English"
 msgstr "Engels"

-#: meet/settings.py:225
+#: meet/settings.py:170
 msgid "French"
 msgstr "Frans"

-#: meet/settings.py:226
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Nederlands"

-#: meet/settings.py:227
+#: meet/settings.py:172
 msgid "German"
 msgstr "Duits"
@@ -18,7 +18,6 @@ from socket import gethostbyname, gethostname

 from django.utils.translation import gettext_lazy as _

-import dj_database_url
 import sentry_sdk
 from configurations import Configuration, values
 from lasuite.configuration.values import SecretFileValue
@@ -28,10 +27,6 @@ from sentry_sdk.integrations.logging import ignore_logger
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = path.dirname(path.dirname(path.abspath(__file__)))

-KB = 1024
-MB = 1024 * KB
-GB = 1024 * MB
-

 def get_release():
    """
@@ -97,11 +92,7 @@ class Base(Configuration):

    # Database
    DATABASES = {
-        "default": dj_database_url.config()
-        if values.DatabaseURLValue(
-            None, environ_name="DATABASE_URL", environ_prefix=None
-        )
-        else {
+        "default": {
            "ENGINE": values.Value(
                "django.db.backends.postgresql_psycopg2",
                environ_name="DB_ENGINE",
@@ -125,9 +116,6 @@ class Base(Configuration):
    STATIC_ROOT = path.join(DATA_DIR, "static")
    MEDIA_URL = "/media/"
    MEDIA_ROOT = path.join(DATA_DIR, "media")
-    MEDIA_BASE_URL = values.Value(
-        "", environ_name="MEDIA_BASE_URL", environ_prefix=None
-    )

    SITE_ID = 1

@@ -161,40 +149,6 @@ class Base(Configuration):
        environ_name="AWS_STORAGE_BUCKET_NAME",
        environ_prefix=None,
    )
-    AWS_S3_SIGNATURE_VERSION = values.Value(
-        "s3v4",
-        environ_name="AWS_S3_SIGNATURE_VERSION",
-        environ_prefix=None,
-    )
-    AWS_S3_UPLOAD_POLICY_EXPIRATION = values.Value(
-        60,  # 1 minute
-        environ_name="AWS_S3_UPLOAD_POLICY_EXPIRATION",
-        environ_prefix=None,
-    )
-    AWS_S3_DOMAIN_REPLACE = values.Value(
-        environ_name="AWS_S3_DOMAIN_REPLACE",
-        environ_prefix=None,
-    )
-
-    FILE_UPLOAD_PATH = values.Value(
-        "files", environ_name="FILE_UPLOAD_PATH", environ_prefix=None
-    )
-
-    FILE_UPLOAD_APPLY_RESTRICTIONS = values.BooleanValue(
-        default=True, environ_name="FILE_UPLOAD_APPLY_RESTRICTIONS", environ_prefix=None
-    )
-
-    FILE_UPLOAD_RESTRICTIONS = values.DictValue(
-        {
-            "background_image": {
-                "max_size": 2 * MB,
-                "allowed_extensions": [".jpeg", ".jpg", ".png"],
-                "allowed_mimetypes": ["image/jpeg", "image/png"],
-            },
-        },
-        environ_name="FILE_UPLOAD_RESTRICTIONS",
-        environ_prefix=None,
-    )

    # Internationalization
    # https://docs.djangoproject.com/en/3.1/topics/i18n/
@@ -338,9 +292,6 @@ class Base(Configuration):
            ),
        },
    }
-    MONITORED_THROTTLE_FAILURE_CALLBACK = (
-        "core.api.throttling.sentry_monitoring_throttle_failure"
-    )

    SPECTACULAR_SETTINGS = {
        "TITLE": "Meet API",
@@ -385,9 +336,6 @@ class Base(Configuration):
        "feedback": values.DictValue(
            {}, environ_name="FRONTEND_FEEDBACK", environ_prefix=None
        ),
-        "external_home_url": values.Value(
-            None, environ_name="FRONTEND_EXTERNAL_HOME_URL", environ_prefix=None
-        ),
        "use_french_gov_footer": values.BooleanValue(
            False, environ_name="FRONTEND_USE_FRENCH_GOV_FOOTER", environ_prefix=None
        ),
@@ -435,13 +383,8 @@ class Base(Configuration):
    THUMBNAIL_ALIASES = {}

    # Celery
-    # Defaults to False to avoid breaking change, async task will be run
-    # synchronously
-    CELERY_ENABLED = values.BooleanValue(False, environ_prefix=None)
-    CELERY_TASK_ALWAYS_EAGER = values.BooleanValue(False, environ_prefix=None)
-    CELERY_TASK_DEFAULT_QUEUE = values.Value("meet-backend", environ_prefix=None)
-    CELERY_BROKER_URL = values.Value("redis://redis:6379/0", environ_prefix=None)
-    CELERY_BROKER_TRANSPORT_OPTIONS = values.DictValue({}, environ_prefix=None)
+    CELERY_BROKER_URL = values.Value("redis://redis:6379/0")
+    CELERY_BROKER_TRANSPORT_OPTIONS = values.DictValue({})

    # Session
    SESSION_ENGINE = "django.contrib.sessions.backends.cache"
@@ -642,12 +585,6 @@ class Base(Configuration):
    ALLOW_UNREGISTERED_ROOMS = values.BooleanValue(
        True, environ_name="ALLOW_UNREGISTERED_ROOMS", environ_prefix=None
    )
-    # if provided, treat as suspicious (possible privilege escalation attempt).
-    PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS = values.ListValue(
-        ["hidden", "recorder", "agent"],
-        environ_name="PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS",
-        environ_prefix=None,
-    )

    # Recording settings
    RECORDING_ENABLE = values.BooleanValue(
@@ -719,7 +656,7 @@ class Base(Configuration):
        [],
        environ_name="BREVO_API_CONTACT_LIST_IDS",
        environ_prefix=None,
-        converter=int,
+        converter=lambda x: int(x),  # pylint: disable=unnecessary-lambda
    )
    BREVO_API_CONTACT_ATTRIBUTES = values.DictValue({"VISIO_USER": True})
    BREVO_API_TIMEOUT = values.PositiveIntegerValue(
@@ -969,10 +906,7 @@ class Test(Base):
    USE_SWAGGER = True
    EXTERNAL_API_ENABLED = True

-    APPLICATION_JWT_SECRET_KEY = "devKey"  # noqa:S105
-    APPLICATION_JWT_AUDIENCE = "Test inc."
-
-    CELERY_TASK_ALWAYS_EAGER = True
+    CELERY_TASK_ALWAYS_EAGER = values.BooleanValue(True)

    def __init__(self):
        # pylint: disable=invalid-name
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "meet"
-version = "1.10.0"
+version = "1.2.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -17,50 +17,45 @@ classifiers = [
    "License :: OSI Approved :: MIT License",
    "Natural Language :: English",
    "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.10",
 ]
 description = "A simple video and phone conferencing tool, powered by LiveKit"
 keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = { file = "LICENSE" }
 readme = "README.md"
-requires-python = ">=3.13"
+requires-python = ">=3.10"
 dependencies = [
-    "boto3==1.42.49",
+    "boto3==1.40.69",
    "Brotli==1.2.0",
    "brevo-python==1.2.0",
-    "celery[redis]==5.6.2",
-    "dj-database-url==3.1.0",
+    "celery[redis]==5.5.3",
    "django-configurations==2.5.1",
    "django-cors-headers==4.9.0",
-    "django-countries==8.2.0",
-    "django-filter==25.2",
-    "django-lasuite[all]==0.0.24",
+    "django-countries==8.0.0",
+    "django-lasuite[all]==0.0.19",
    "django-parler==2.3",
    "redis==5.2.1",
    "django-redis==6.0.0",
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
-    "django-pydantic-field==0.5.4",
-    "django==5.2.12",
+    "django==5.2.9",
    "djangorestframework==3.16.1",
    "drf_spectacular==0.29.0",
-    "dockerflow==2026.1.26",
+    "dockerflow==2024.4.2",
    "easy_thumbnails==2.10.1",
    "factory_boy==3.3.3",
-    "gunicorn==25.1.0",
-    "jsonschema==4.26.0",
-    "markdown==3.10.2",
+    "gunicorn==23.0.0",
+    "jsonschema==4.25.1",
+    "markdown==3.10",
    "nested-multipart-parser==1.6.0",
-    "psycopg[binary]==3.3.2",
-    "pydantic==2.12.4",
-    "PyJWT==2.11.0",
+    "psycopg[binary]==3.2.12",
+    "PyJWT==2.10.1",
    "python-frontmatter==1.1.0",
-    "python-magic==0.4.27",
    "requests==2.32.5",
-    "sentry-sdk==2.53.0",
+    "sentry-sdk==2.43.0",
    "whitenoise==6.11.0",
-    "mozilla-django-oidc==5.0.2",
-    "livekit-api==1.1.0",
+    "mozilla-django-oidc==4.0.1",
+    "livekit-api==1.0.7",
    "aiohttp==3.13.3",
 ]

@@ -73,21 +68,21 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
    "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.1.1",
+    "drf-spectacular-sidecar==2025.10.1",
    "freezegun==1.5.5",
    "ipdb==0.13.13",
-    "ipython==9.10.0",
-    "pyfakefs==6.1.1",
-    "pylint-django==2.7.0",
+    "ipython==9.7.0",
+    "pyfakefs==5.10.2",
+    "pylint-django==2.6.1",
    "pylint<4.0.0",
    "pytest-cov==7.0.0",
-    "pytest-django==4.12.0",
-    "pytest==9.0.2",
+    "pytest-django==4.11.1",
+    "pytest==9.0.0",
    "pytest-icdiff==0.9",
    "pytest-xdist==3.8.0",
    "responses==0.25.8",
-    "ruff==0.15.1",
-    "types-requests==2.32.4.20260107",
+    "ruff==0.14.4",
+    "types-requests==2.32.4.20250913",
 ]

 [tool.setuptools]
@@ -43,8 +43,7 @@ RUN apk update && apk upgrade libssl3 \
    libxml2>=2.12.7-r2 \
    libxslt>=1.1.39-r2 \
    libexpat>=2.7.2-r0 \
-    libpng>=1.6.53-r0 \
-    && apk del curl
+    libpng>=1.6.53-r0

 USER nginx

@@ -5,12 +5,6 @@ server {

  root /usr/share/nginx/html;

-  location = /.well-known/windows-app-web-link {
-      default_type application/json;
-      alias /usr/share/nginx/html/.well-known/windows-app-web-link;
-      add_header Content-Disposition "attachment; filename=windows-app-web-link";
-  }
-
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.10.0",
+  "version": "1.2.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -13,56 +13,56 @@
    "check": "prettier --check ./src"
  },
  "dependencies": {
-    "@fontsource-variable/material-symbols-outlined": "5.2.34",
+    "@fontsource-variable/material-symbols-outlined": "5.2.30",
    "@fontsource/material-icons-outlined": "5.2.6",
-    "@livekit/components-react": "2.9.19",
-    "@livekit/components-styles": "1.2.0",
-    "@livekit/track-processors": "0.7.0",
-    "@pandacss/preset-panda": "1.8.2",
-    "@react-aria/toast": "3.0.10",
-    "@react-types/overlays": "3.9.3",
+    "@livekit/components-react": "2.9.13",
+    "@livekit/components-styles": "1.1.6",
+    "@livekit/track-processors": "0.6.1",
+    "@pandacss/preset-panda": "0.54.0",
+    "@react-aria/toast": "3.0.5",
+    "@react-types/overlays": "3.9.0",
    "@remixicon/react": "4.6.0",
-    "@tanstack/react-query": "5.90.21",
+    "@tanstack/react-query": "5.81.5",
    "@timephy/rnnoise-wasm": "1.0.0",
-    "crisp-sdk-web": "1.0.27",
+    "crisp-sdk-web": "1.0.25",
    "derive-valtio": "0.2.0",
    "hoofd": "1.7.3",
-    "humanize-duration": "3.33.2",
-    "i18next": "25.8.8",
-    "i18next-browser-languagedetector": "8.2.1",
+    "humanize-duration": "3.33.0",
+    "i18next": "25.3.1",
+    "i18next-browser-languagedetector": "8.2.0",
    "i18next-parser": "9.3.0",
    "i18next-resources-to-backend": "1.2.1",
    "libphonenumber-js": "1.12.10",
-    "livekit-client": "2.17.1",
-    "posthog-js": "1.342.1",
+    "livekit-client": "2.15.7",
+    "posthog-js": "1.256.2",
    "react": "18.3.1",
-    "react-aria-components": "1.14.0",
+    "react-aria-components": "1.10.1",
    "react-dom": "18.3.1",
    "react-i18next": "15.1.1",
    "use-sound": "5.0.0",
-    "valtio": "2.3.0",
-    "wouter": "3.9.0"
+    "valtio": "2.1.5",
+    "wouter": "3.7.1"
  },
  "devDependencies": {
-    "@pandacss/dev": "1.8.2",
-    "@tanstack/eslint-plugin-query": "5.91.4",
-    "@tanstack/react-query-devtools": "5.91.3",
+    "@pandacss/dev": "0.54.0",
+    "@tanstack/eslint-plugin-query": "5.81.2",
+    "@tanstack/react-query-devtools": "5.81.5",
    "@types/humanize-duration": "3.27.4",
    "@types/node": "22.16.0",
    "@types/react": "18.3.12",
    "@types/react-dom": "18.3.1",
    "@typescript-eslint/eslint-plugin": "8.35.1",
    "@typescript-eslint/parser": "8.35.1",
-    "@vitejs/plugin-react": "5.1.4",
+    "@vitejs/plugin-react": "4.6.0",
    "eslint": "8.57.0",
    "eslint-config-prettier": "10.1.5",
    "eslint-plugin-jsx-a11y": "6.10.2",
    "eslint-plugin-react-hooks": "5.2.0",
    "eslint-plugin-react-refresh": "0.4.20",
    "postcss": "8.5.6",
-    "prettier": "3.8.1",
+    "prettier": "3.6.2",
    "typescript": "5.8.3",
-    "vite": "7.3.1",
-    "vite-tsconfig-paths": "6.1.1"
+    "vite": "7.0.8",
+    "vite-tsconfig-paths": "5.1.4"
  }
 }
@@ -1,6 +0,0 @@
-[
-{
-  "packageFamilyName" : "Visio_g3z6ba6vek6vg",
-  "paths" : [ "*" ]
-}
-]
@@ -4,7 +4,7 @@ import { Suspense } from 'react'
 import { ReactQueryDevtools } from '@tanstack/react-query-devtools'
 import { QueryClientProvider } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
-import { useTitle } from 'hoofd'
+import { useLang } from 'hoofd'
 import { Switch, Route } from 'wouter'
 import { I18nProvider } from 'react-aria-components'
 import { Layout } from './layout/Layout'
@@ -17,7 +17,7 @@ import { useIsSdkContext } from '@/features/sdk/hooks/useIsSdkContext'

 function App() {
  const { i18n } = useTranslation()
-  useTitle(import.meta.env.VITE_APP_TITLE ?? '')
+  useLang(i18n.language)

  const isSDKContext = useIsSdkContext()

@@ -17,7 +17,6 @@ export interface ApiConfig {
  feedback: {
    url: string
  }
-  external_home_url?: string
  silence_livekit_debug_logs?: boolean
  is_silent_login_enabled?: boolean
  custom_css_url?: string
@@ -4,7 +4,6 @@ import { Button } from '@/primitives'
 import { RiArrowLeftSLine, RiArrowRightSLine } from '@remixicon/react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 const Heading = styled('h2', {
  base: {
@@ -145,21 +144,6 @@ type Slide = {
  isAvailableInBeta?: boolean
 }

-const carouselNavButton = css({
-  _focusVisible: {
-    outline: '2px solid var(--colors-focus-ring) !important',
-    outlineOffset: '1px',
-  },
-  _disabled: {
-    color: 'greyscale.400',
-    cursor: 'default',
-    pointerEvents: 'none',
-    _pressed: {
-      backgroundColor: 'transparent',
-    },
-  },
-})
-
 // todo - optimize how images are imported
 const SLIDES: Slide[] = [
  {
@@ -179,45 +163,11 @@ const SLIDES: Slide[] = [
 export const IntroSlider = () => {
  const [slideIndex, setSlideIndex] = useState(0)
  const { t } = useTranslation('home', { keyPrefix: 'introSlider' })
-  const announce = useScreenReaderAnnounce()

  const NUMBER_SLIDES = SLIDES.length

-  const goPrev = () => {
-    if (slideIndex === 0) return
-    const newIndex = slideIndex - 1
-    setSlideIndex(newIndex)
-    announce(
-      t('slidePosition', { current: newIndex + 1, total: NUMBER_SLIDES }),
-      'polite',
-      'global'
-    )
-  }
-
-  const goNext = () => {
-    if (slideIndex === NUMBER_SLIDES - 1) return
-    const newIndex = slideIndex + 1
-    setSlideIndex(newIndex)
-    announce(
-      t('slidePosition', { current: newIndex + 1, total: NUMBER_SLIDES }),
-      'polite',
-      'global'
-    )
-  }
-
-  const ariaLabelParams = {
-    current: slideIndex + 1,
-    total: NUMBER_SLIDES,
-  }
-  const previousAriaLabel = t('previous.labelWithPosition', ariaLabelParams)
-  const nextAriaLabel = t('next.labelWithPosition', ariaLabelParams)
-
  return (
-    <Container
-      role="region"
-      aria-roledescription="carousel"
-      aria-label={t('carouselLabel')}
-    >
+    <Container>
      <div
        className={css({
          display: 'flex',
@@ -230,10 +180,10 @@ export const IntroSlider = () => {
            <Button
              variant="secondaryText"
              square
-              className={carouselNavButton}
-              aria-label={previousAriaLabel}
-              aria-disabled={slideIndex === 0}
-              onPress={goPrev}
+              aria-label={t('previous.label')}
+              tooltip={t('previous.tooltip')}
+              onPress={() => setSlideIndex(slideIndex - 1)}
+              isDisabled={slideIndex == 0}
            >
              <RiArrowLeftSLine />
            </Button>
@@ -241,12 +191,8 @@ export const IntroSlider = () => {
        </ButtonContainer>
        <SlideContainer>
          {SLIDES.map((slide, index) => (
-            <Slide
-              aria-hidden={index !== slideIndex}
-              visible={index === slideIndex}
-              key={index}
-            >
-              <Image src={slide.src} alt="" role="presentation" />
+            <Slide visible={index == slideIndex} key={index}>
+              <Image src={slide.src} alt={t(`${slide.key}.imgAlt`)} />
              <TextAnimation visible={index == slideIndex}>
                <Heading>{t(`${slide.key}.title`)}</Heading>
                <Body>{t(`${slide.key}.body`)}</Body>
@@ -259,10 +205,10 @@ export const IntroSlider = () => {
            <Button
              variant="secondaryText"
              square
-              className={carouselNavButton}
-              aria-label={nextAriaLabel}
-              aria-disabled={slideIndex === NUMBER_SLIDES - 1}
-              onPress={goNext}
+              aria-label={t('next.label')}
+              tooltip={t('next.tooltip')}
+              onPress={() => setSlideIndex(slideIndex + 1)}
+              isDisabled={slideIndex == NUMBER_SLIDES - 1}
            >
              <RiArrowRightSLine />
            </Button>
@@ -5,42 +5,37 @@ import { isRoomValid } from '@/features/rooms'

 export const JoinMeetingDialog = () => {
  const { t } = useTranslation('home')
-
-  const handleSubmit = (data: { roomId?: FormDataEntryValue }) => {
-    const roomId = (data.roomId as string)
-      .trim()
-      .replace(`${window.location.origin}/`, '')
-    navigateTo('room', roomId)
-  }
-
-  const validateRoomId = (value: string) => {
-    const trimmed = value.trim()
-    if (!trimmed) return null
-    return !isRoomValid(trimmed) ? (
-      <>
-        <p>{t('joinInputError')}</p>
-        <Ul>
-          <li>{window.location.origin}/uio-azer-jkl</li>
-          <li>uio-azer-jkl</li>
-        </Ul>
-      </>
-    ) : null
-  }
-
  return (
    <Dialog title={t('joinMeeting')}>
-      <Form onSubmit={handleSubmit} submitLabel={t('joinInputSubmit')}>
-        {/* eslint-disable jsx-a11y/no-autofocus -- Focus on input when modal opens, required for accessibility */}
+      <Form
+        onSubmit={(data) => {
+          navigateTo(
+            'room',
+            (data.roomId as string)
+              .trim()
+              .replace(`${window.location.origin}/`, '')
+          )
+        }}
+        submitLabel={t('joinInputSubmit')}
+      >
        <Field
          type="text"
-          autoFocus
-          isRequired
          name="roomId"
          label={t('joinInputLabel')}
          description={t('joinInputExample', {
            example: window.origin + '/azer-tyu-qsdf',
          })}
-          validate={validateRoomId}
+          validate={(value) => {
+            return !isRoomValid(value.trim()) ? (
+              <>
+                <p>{t('joinInputError')}</p>
+                <Ul>
+                  <li>{window.location.origin}/uio-azer-jkl</li>
+                  <li>uio-azer-jkl</li>
+                </Ul>
+              </>
+            ) : null
+          }}
        />
      </Form>
      <H lvl={2}>{t('joinMeetingTipHeading')}</H>
@@ -2,25 +2,23 @@ import { A, Text } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { useConfig } from '@/api/useConfig'

-const appTitle = import.meta.env.VITE_APP_TITLE ?? 'LaSuite Meet'
-
 export const MoreLink = () => {
  const { t } = useTranslation('home')
  const { data } = useConfig()

-  if (!data?.manifest_link) return null
+  if (!data?.manifest_link) return

  return (
-    <Text as="p" variant="sm" style={{ padding: '1rem 0' }}>
+    <Text as={'p'} variant={'sm'} style={{ padding: '1rem 0' }}>
      <A
        href={data?.manifest_link}
        target="_blank"
        rel="noopener noreferrer"
-        externalIcon
-        aria-label={t('moreLinkLabel', { appTitle })}
+        aria-label={t('moreLinkLabel')}
      >
-        {t('moreLink')} {t('moreAbout', { appTitle })}
-      </A>
+        {t('moreLink')}
+      </A>{' '}
+      {t('moreAbout', { appTitle: `${import.meta.env.VITE_APP_TITLE}` })}
    </Text>
  )
 }
@@ -11,7 +11,7 @@ import { RiAddLine, RiLink } from '@remixicon/react'
 import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
 import { IntroSlider } from '@/features/home/components/IntroSlider'
 import { MoreLink } from '@/features/home/components/MoreLink'
-import { ReactNode, useEffect, useState } from 'react'
+import { ReactNode, useState } from 'react'

 import { css } from '@/styled-system/css'
 import { menuRecipe } from '@/primitives/menuRecipe.ts'
@@ -19,7 +19,6 @@ import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePers
 import { useConfig } from '@/api/useConfig'
 import { LoginButton } from '@/components/LoginButton'
 import { ApiRoom } from '@/features/rooms/api/ApiRoom'
-import { LoadingScreen } from '@/components/LoadingScreen'

 const Columns = ({ children }: { children?: ReactNode }) => {
  return (
@@ -156,34 +155,9 @@ export const Home = () => {

  const { mutateAsync: createRoom } = useCreateRoom()
  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
-  const [redirectFailed, setRedirectFailed] = useState(false)

  const { data } = useConfig()

-  useEffect(() => {
-    const checkSiteAndRedirect = async () => {
-      if (!data?.external_home_url) return
-      if (isLoggedIn === false) {
-        try {
-          await fetch(data.external_home_url, {
-            method: 'HEAD', // Use HEAD to avoid downloading the full page
-            mode: 'no-cors', // Needed for cross-origin requests
-          })
-          window.location.replace(data.external_home_url)
-        } catch (error) {
-          setRedirectFailed(true)
-          console.error('Site is not reachable:', error)
-        }
-      }
-    }
-
-    checkSiteAndRedirect()
-  }, [isLoggedIn, data])
-
-  if (data?.external_home_url && isLoggedIn == false && !redirectFailed) {
-    return <LoadingScreen header={false} footer={false} delay={0} />
-  }
-
  return (
    <UserAware>
      <Screen>
@@ -258,10 +232,23 @@ export const Home = () => {
              </DialogTrigger>
            </div>
            <Separator />
-            <MoreLink />
+            <div
+              className={css({
+                display: { base: 'none', lg: 'inline' },
+              })}
+            >
+              <MoreLink />
+            </div>
          </LeftColumn>
          <RightColumn>
            <IntroSlider />
+            <div
+              className={css({
+                display: { base: 'inline', lg: 'none' },
+              })}
+            >
+              <MoreLink />
+            </div>
          </RightColumn>
        </Columns>
        <LaterMeetingDialog
@@ -25,27 +25,15 @@ export const TermsOfServiceRoute = () => {
        {/* Article 2 */}
        <H lvl={2}>{t('articles.article2.title')}</H>
        <P>{t('articles.article2.content')}</P>
-        {ensureArray(
-          t('articles.article2.paragraphs', {
-            returnObjects: true,
-          })
-        ).map((paragraph, index) => (
-          <P key={index}>{paragraph}</P>
-        ))}
+        <P>{t('articles.article2.purposes')}</P>

        {/* Article 3 */}
        <H lvl={2}>{t('articles.article3.title')}</H>
-        {ensureArray(
-          t('articles.article3.paragraphs', {
-            returnObjects: true,
-          })
-        ).map((paragraph, index) => (
-          <P key={index}>{paragraph}</P>
-        ))}
+        <P>{t('articles.article3.definition')}</P>

        {/* Article 4 */}
        <H lvl={2}>{t('articles.article4.title')}</H>
-        <P>{t('articles.article4.definition')}</P>
+        <P>{t('articles.article4.content')}</P>

        {/* Article 5 */}
        <H lvl={2} margin={false}>
@@ -74,7 +62,6 @@ export const TermsOfServiceRoute = () => {
            __html: t('articles.article5.sections.section1.paragraph3'),
          }}
        ></P>
-        <P>{t('articles.article5.sections.section1.paragraph4')}</P>

        {/* Section 5.2 */}
        <H lvl={3} bold>
@@ -125,6 +112,7 @@ export const TermsOfServiceRoute = () => {

        {/* Article 7 */}
        <H lvl={2}>{t('articles.article7.title')}</H>
+        <P>{t('articles.article7.content')}</P>

        {/* Section 7.1 */}
        <H lvl={3} bold>
@@ -18,15 +18,10 @@ import {
  ANIMATION_DURATION,
  ReactionPortals,
 } from '@/features/rooms/livekit/components/ReactionPortal'
-import { layoutStore } from '@/stores/layout'
-import { PanelId } from '@/features/rooms/livekit/hooks/useSidePanel'
-import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 export const MainNotificationToast = () => {
  const room = useRoomContext()
  const { triggerNotificationSound } = useNotificationSound()
-  const { t } = useTranslation('notifications')
-  const announce = useScreenReaderAnnounce()

  const [reactions, setReactions] = useState<Reaction[]>([])
  const instanceIdRef = useRef(0)
@@ -46,21 +41,12 @@ export const MainNotificationToast = () => {
        },
        { timeout: NotificationDuration.MESSAGE }
      )
-      if (layoutStore.activePanelId !== PanelId.CHAT) {
-        announce(
-          t('chatMessageReceived', {
-            name: participant.name || t('defaultName'),
-            message: chatMessage.message,
-          }),
-          'polite'
-        )
-      }
    }
    room.on(RoomEvent.ChatMessage, handleChatMessage)
    return () => {
      room.off(RoomEvent.ChatMessage, handleChatMessage)
    }
-  }, [room, triggerNotificationSound, announce, t])
+  }, [room, triggerNotificationSound])

  const handleEmoji = (emoji: string, participant: Participant) => {
    if (!emoji || !Object.values(Emoji).includes(emoji as Emoji)) return
@@ -79,20 +79,11 @@ export const NoAccessView = ({
          })}
        >
          {t(`${i18nKey}.body`)}
+          <br />
          {helpArticle && (
-            <>
-              {' '}
-              <A
-                href={helpArticle}
-                target="_blank"
-                rel="noopener noreferrer"
-                externalIcon
-                color="note"
-                aria-label={t(`${i18nKey}.linkAriaLabel`)}
-              >
-                {t(`${i18nKey}.linkMore`)}
-              </A>
-            </>
+            <A href={helpArticle} target="_blank">
+              {t(`${i18nKey}.linkMore`)}
+            </A>
          )}
        </Text>
      </VStack>
@@ -1,6 +1,6 @@
 import { css } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'
-import { useMemo, useRef, useEffect } from 'react'
+import { useMemo, useRef, useState, useEffect } from 'react'
 import { Text } from '@/primitives'
 import {
  RecordingMode,
@@ -13,7 +13,6 @@ import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'
 import { useRoomMetadata } from '../hooks/useRoomMetadata'
 import { RecordingStatusIcon } from './RecordingStatusIcon'
 import { useIsRecording } from '@livekit/components-react'
-import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 export const RecordingStateToast = () => {
  const { t } = useTranslation('rooms', {
@@ -22,8 +21,8 @@ export const RecordingStateToast = () => {

  const { openTranscript, openScreenRecording } = useSidePanel()

+  const [srMessage, setSrMessage] = useState('')
  const lastKeyRef = useRef('')
-  const announce = useScreenReaderAnnounce()

  const hasTranscriptAccess = useHasRecordingAccess(
    RecordingMode.Transcript,
@@ -77,9 +76,16 @@ export const RecordingStateToast = () => {
    if (key && key !== lastKeyRef.current) {
      lastKeyRef.current = key
      const message = t(key)
-      announce(message)
+      setSrMessage(message)
+
+      // Clear message after 3 seconds to prevent it from being announced again
+      const timer = setTimeout(() => {
+        setSrMessage('')
+      }, 3000)
+
+      return () => clearTimeout(timer)
    }
-  }, [announce, key, t])
+  }, [key, t])

  if (!key) return null

@@ -89,6 +95,15 @@ export const RecordingStateToast = () => {

  return (
    <>
+      {/* Screen reader only message to announce state changes once */}
+      <div
+        role="status"
+        aria-live="polite"
+        aria-atomic="true"
+        className="sr-only"
+      >
+        {srMessage}
+      </div>
      {/* Visual banner (without aria-live to avoid duplicate announcements) */}
      <div
        className={css({
--- a/Show More
+++ b/Show More