✨(backend,frontend) add per-room recording permissions with admin panel controls

Allow room admins to override global recording permissions (screen recording
and transcription) on a per-room basis via the admin panel. Non-admin users
see the effective permission through a read-only recording_permissions field.
Includes input validation, fallback to global settings, and i18n support.

Author: gigi206

CHANGELOG.md

@@ -10,7 +10,7 @@ and this project adheres to
 
 ### Added
 
-- ✨(backend,frontend) add configurable recording permissions
+- ✨(backend,frontend) add per-room configurable recording permissions with admin panel controls
 
 ## [1.6.0] - 2026-02-10
 

src/backend/core/api/permissions.py

@@ -106,13 +106,20 @@ class HasRecordingPermission(IsAuthenticated):
 
     message = "You do not have permission to perform this recording action."
 
-    def _get_permission_level(self, mode):
-        """Return the permission level for the given mode."""
+    def _get_permission_level(self, mode, room=None):
+        """Return the permission level for the given mode, checking room config first."""
         if mode == "screen_recording":
-            return getattr(settings, "RECORDING_SCREEN_PERMISSION", "admin_owner")
-        if mode == "transcript":
-            return getattr(settings, "RECORDING_TRANSCRIPT_PERMISSION", "admin_owner")
-        return "admin_owner"
+            key = "screen_recording_permission"
+            default = getattr(settings, "RECORDING_SCREEN_PERMISSION", "admin_owner")
+        elif mode == "transcript":
+            key = "transcript_permission"
+            default = getattr(settings, "RECORDING_TRANSCRIPT_PERMISSION", "admin_owner")
+        else:
+            return "admin_owner"
+
+        if room and room.configuration:
+            return room.configuration.get(key, default)
+        return default
 
     def has_object_permission(self, request, view, obj):
         """Check object-level permissions based on recording mode."""
@@ -129,7 +136,7 @@ def has_object_permission(self, request, view, obj):
                 # No active recording, let the view handle the error
                 return True
 
-        permission_level = self._get_permission_level(mode)
+        permission_level = self._get_permission_level(mode, room=obj)
 
         if permission_level == "authenticated":
             # Already authenticated via IsAuthenticated.has_permission

src/backend/core/api/serializers.py

@@ -2,6 +2,7 @@
 
 # pylint: disable=abstract-method,no-name-in-module
 
+from django.conf import settings
 from django.utils.translation import gettext_lazy as _
 
 from livekit.api import ParticipantPermission
@@ -103,6 +104,9 @@ class Meta:
         read_only_fields = ["id", "slug"]
 
 
+VALID_RECORDING_PERMISSIONS = {"admin_owner", "authenticated"}
+
+
 class RoomSerializer(serializers.ModelSerializer):
     """Serialize Room model for the API."""
 
@@ -111,6 +115,19 @@ class Meta:
         fields = ["id", "name", "slug", "configuration", "access_level", "pin_code"]
         read_only_fields = ["id", "slug", "pin_code"]
 
+    def validate_configuration(self, value):
+        """Validate recording permission values in configuration."""
+        if not isinstance(value, dict):
+            return value
+
+        for key in ("screen_recording_permission", "transcript_permission"):
+            if key in value and value[key] not in VALID_RECORDING_PERMISSIONS:
+                raise serializers.ValidationError(
+                    {key: f"Must be one of: {', '.join(sorted(VALID_RECORDING_PERMISSIONS))}"}
+                )
+
+        return value
+
     def to_representation(self, instance):
         """
         Add users only for administrator users.
@@ -137,6 +154,17 @@ def to_representation(self, instance):
 
         configuration = output["configuration"]
 
+        output["recording_permissions"] = {
+            "screen_recording_permission": configuration.get(
+                "screen_recording_permission",
+                settings.RECORDING_SCREEN_PERMISSION,
+            ),
+            "transcript_permission": configuration.get(
+                "transcript_permission",
+                settings.RECORDING_TRANSCRIPT_PERMISSION,
+            ),
+        }
+
         if not is_admin_or_owner:
             del output["configuration"]
 

src/backend/core/tests/rooms/test_api_rooms_recording_permissions.py

@@ -418,3 +418,231 @@ def test_stop_recording_follows_mode_permission_authenticated(
     # Any authenticated user should be able to stop
     response = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")
     assert response.status_code == 200
+
+
+# =============================================================================
+# Tests for per-room recording permission overrides via room.configuration
+# =============================================================================
+
+
+def test_room_config_overrides_global_screen_recording_permission(
+    mock_worker_service_factory, mock_worker_manager, settings
+):
+    """Room configuration should override global screen recording permission."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_SCREEN_PERMISSION = "admin_owner"
+
+    room = RoomFactory(configuration={"screen_recording_permission": "authenticated"})
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Global is admin_owner, but room overrides to authenticated
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 201
+    assert Recording.objects.count() == 1
+
+
+def test_room_config_overrides_global_transcript_permission(
+    mock_worker_service_factory, mock_worker_manager, settings
+):
+    """Room configuration should override global transcript permission."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_TRANSCRIPT_PERMISSION = "admin_owner"
+
+    room = RoomFactory(configuration={"transcript_permission": "authenticated"})
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Global is admin_owner, but room overrides to authenticated
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "transcript"},
+    )
+    assert response.status_code == 201
+    assert Recording.objects.count() == 1
+
+
+def test_room_config_restricts_when_global_is_permissive(settings):
+    """Room configuration can restrict permissions even when global is permissive."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_SCREEN_PERMISSION = "authenticated"
+
+    room = RoomFactory(configuration={"screen_recording_permission": "admin_owner"})
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Global is authenticated, but room overrides to admin_owner
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 403
+    assert Recording.objects.count() == 0
+
+
+def test_room_config_empty_falls_back_to_global(settings):
+    """Without room configuration override, global permission applies."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_SCREEN_PERMISSION = "admin_owner"
+
+    room = RoomFactory(configuration={})
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # No room override, global admin_owner applies
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 403
+    assert Recording.objects.count() == 0
+
+
+def test_recording_permissions_in_room_response_for_admin(settings):
+    """recording_permissions should be present in room response for admin users."""
+    settings.RECORDING_SCREEN_PERMISSION = "admin_owner"
+    settings.RECORDING_TRANSCRIPT_PERMISSION = "authenticated"
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="administrator")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/rooms/{room.id}/")
+    assert response.status_code == 200
+    assert "recording_permissions" in response.json()
+    assert (
+        response.json()["recording_permissions"]["screen_recording_permission"]
+        == "admin_owner"
+    )
+    assert (
+        response.json()["recording_permissions"]["transcript_permission"]
+        == "authenticated"
+    )
+
+
+def test_recording_permissions_in_room_response_for_non_admin(settings):
+    """recording_permissions should be present in room response for non-admin users."""
+    settings.RECORDING_SCREEN_PERMISSION = "authenticated"
+    settings.RECORDING_TRANSCRIPT_PERMISSION = "admin_owner"
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="member")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/rooms/{room.id}/")
+    assert response.status_code == 200
+    assert "recording_permissions" in response.json()
+    assert (
+        response.json()["recording_permissions"]["screen_recording_permission"]
+        == "authenticated"
+    )
+    assert (
+        response.json()["recording_permissions"]["transcript_permission"]
+        == "admin_owner"
+    )
+    # configuration should NOT be visible to non-admin
+    assert "configuration" not in response.json()
+
+
+def test_recording_permissions_reflect_room_override(settings):
+    """recording_permissions should reflect room configuration override."""
+    settings.RECORDING_SCREEN_PERMISSION = "admin_owner"
+    settings.RECORDING_TRANSCRIPT_PERMISSION = "admin_owner"
+
+    room = RoomFactory(
+        configuration={
+            "screen_recording_permission": "authenticated",
+            "transcript_permission": "authenticated",
+        }
+    )
+    user = UserFactory()
+    room.accesses.create(user=user, role="member")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/rooms/{room.id}/")
+    assert response.status_code == 200
+    assert (
+        response.json()["recording_permissions"]["screen_recording_permission"]
+        == "authenticated"
+    )
+    assert (
+        response.json()["recording_permissions"]["transcript_permission"]
+        == "authenticated"
+    )
+
+
+def test_admin_can_patch_room_recording_config(settings):
+    """Admin should be able to patch room configuration with recording permissions."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_SCREEN_PERMISSION = "admin_owner"
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="administrator")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id}/",
+        {"configuration": {"screen_recording_permission": "authenticated"}},
+        format="json",
+    )
+    assert response.status_code == 200
+    assert (
+        response.json()["recording_permissions"]["screen_recording_permission"]
+        == "authenticated"
+    )
+
+
+def test_patch_room_rejects_invalid_recording_permission(settings):
+    """Invalid recording permission values should be rejected with 400."""
+    settings.RECORDING_ENABLE = True
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="administrator")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id}/",
+        {"configuration": {"screen_recording_permission": "everyone"}},
+        format="json",
+    )
+    assert response.status_code == 400
+
+
+def test_patch_room_rejects_invalid_transcript_permission(settings):
+    """Invalid transcript permission values should be rejected with 400."""
+    settings.RECORDING_ENABLE = True
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="administrator")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id}/",
+        {"configuration": {"transcript_permission": "foobar"}},
+        format="json",
+    )
+    assert response.status_code == 400

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -10,6 +10,10 @@ import { decodeNotificationDataReceived } from './utils'
 import { useNotificationSound } from '@/features/notifications/hooks/useSoundNotification'
 import { ToastProvider, toastQueue } from './components/ToastProvider'
 import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'
+import { queryClient } from '@/api/queryClient'
+import { keys } from '@/api/queryKeys'
+import { fetchRoom } from '@/features/rooms/api/fetchRoom'
+import { useParams } from 'wouter'
 import {
   Emoji,
   Reaction,
@@ -22,6 +26,7 @@ import {
 export const MainNotificationToast = () => {
   const room = useRoomContext()
   const { triggerNotificationSound } = useNotificationSound()
+  const { roomId } = useParams()
 
   const [reactions, setReactions] = useState<Reaction[]>([])
   const instanceIdRef = useRef(0)
@@ -127,6 +132,12 @@ export const MainNotificationToast = () => {
           )
           break
         }
+        case NotificationType.RecordingPermissionsChanged:
+          queryClient.fetchQuery({
+            queryKey: [keys.room, roomId],
+            queryFn: () => fetchRoom({ roomId: roomId! }),
+          })
+          break
         default:
           return
       }

src/frontend/src/features/notifications/NotificationType.ts

@@ -16,4 +16,5 @@ export enum NotificationType {
   ScreenRecordingLimitReached = 'screenRecordingLimitReached',
   RecordingSaving = 'recordingSaving',
   PermissionsRemoved = 'permissionsRemoved',
+  RecordingPermissionsChanged = 'recordingPermissionsChanged',
 }