401 reauth experiments

doc
nextjs magic
2025-12-20 20:29:06 +00:00 · 2025-09-05 14:20:00 -04:00 · 2025-09-05 13:05:00 -04:00 · 2025-09-05 12:59:18 -04:00 · 2025-09-05 12:44:12 -04:00 · 2025-09-04 22:16:01 -04:00
59 changed files with 2551 additions and 1900 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,37 +1,5 @@
 # Changelog

-## [0.10.0](https://github.com/Monadical-SAS/reflector/compare/v0.9.0...v0.10.0) (2025-09-11)
-
-
-### Features
-
-* replace nextjs-config with environment variables ([#632](https://github.com/Monadical-SAS/reflector/issues/632)) ([369ecdf](https://github.com/Monadical-SAS/reflector/commit/369ecdff13f3862d926a9c0b87df52c9d94c4dde))
-
-
-### Bug Fixes
-
-* anonymous users transcript permissions ([#621](https://github.com/Monadical-SAS/reflector/issues/621)) ([f81fe99](https://github.com/Monadical-SAS/reflector/commit/f81fe9948a9237b3e0001b2d8ca84f54d76878f9))
-* auth post ([#624](https://github.com/Monadical-SAS/reflector/issues/624)) ([cde99ca](https://github.com/Monadical-SAS/reflector/commit/cde99ca2716f84ba26798f289047732f0448742e))
-* auth post ([#626](https://github.com/Monadical-SAS/reflector/issues/626)) ([3b85ff3](https://github.com/Monadical-SAS/reflector/commit/3b85ff3bdf4fb053b103070646811bc990c0e70a))
-* auth post ([#627](https://github.com/Monadical-SAS/reflector/issues/627)) ([962038e](https://github.com/Monadical-SAS/reflector/commit/962038ee3f2a555dc3c03856be0e4409456e0996))
-* missing follow_redirects=True on modal endpoint ([#630](https://github.com/Monadical-SAS/reflector/issues/630)) ([fc363bd](https://github.com/Monadical-SAS/reflector/commit/fc363bd49b17b075e64f9186e5e0185abc325ea7))
-* sync backend and frontend token refresh logic ([#614](https://github.com/Monadical-SAS/reflector/issues/614)) ([5a5b323](https://github.com/Monadical-SAS/reflector/commit/5a5b3233820df9536da75e87ce6184a983d4713a))
-
-## [0.9.0](https://github.com/Monadical-SAS/reflector/compare/v0.8.2...v0.9.0) (2025-09-06)
-
-
-### Features
-
-* frontend openapi react query ([#606](https://github.com/Monadical-SAS/reflector/issues/606)) ([c4d2825](https://github.com/Monadical-SAS/reflector/commit/c4d2825c81f81ad8835629fbf6ea8c7383f8c31b))
-
-
-### Bug Fixes
-
-* align whisper transcriber api with parakeet ([#602](https://github.com/Monadical-SAS/reflector/issues/602)) ([0663700](https://github.com/Monadical-SAS/reflector/commit/0663700a615a4af69a03c96c410f049e23ec9443))
-* kv use tls explicit ([#610](https://github.com/Monadical-SAS/reflector/issues/610)) ([08d88ec](https://github.com/Monadical-SAS/reflector/commit/08d88ec349f38b0d13e0fa4cb73486c8dfd31836))
-* source kind for file processing ([#601](https://github.com/Monadical-SAS/reflector/issues/601)) ([dc82f8b](https://github.com/Monadical-SAS/reflector/commit/dc82f8bb3bdf3ab3d4088e592a30fd63907319e1))
-* token refresh locking ([#613](https://github.com/Monadical-SAS/reflector/issues/613)) ([7f5a4c9](https://github.com/Monadical-SAS/reflector/commit/7f5a4c9ddc7fd098860c8bdda2ca3b57f63ded2f))
-
 ## [0.8.2](https://github.com/Monadical-SAS/reflector/compare/v0.8.1...v0.8.2) (2025-08-29)


--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -66,6 +66,7 @@ pnpm install

 # Copy configuration templates
 cp .env_template .env
+cp config-template.ts config.ts
 ```

 **Development:**
--- a/README.md
+++ b/README.md
@@ -99,10 +99,11 @@ Start with `cd www`.

 ```bash
 pnpm install
-cp .env.example .env
+cp .env_template .env
+cp config-template.ts config.ts
 ```

-Then, fill in the environment variables in `.env` as needed. If you are unsure on how to proceed, ask in Zulip.
+Then, fill in the environment variables in `.env` and the configuration in `config.ts` as needed. If you are unsure on how to proceed, ask in Zulip.

 **Run in development mode**

@@ -167,34 +168,3 @@ You can manually process an audio file by calling the process tool:
 ```bash
 uv run python -m reflector.tools.process path/to/audio.wav
 ```
-
-
-## Feature Flags
-
-Reflector uses environment variable-based feature flags to control application functionality. These flags allow you to enable or disable features without code changes.
-
-### Available Feature Flags
-
-| Feature Flag | Environment Variable |
-|-------------|---------------------|
-| `requireLogin` | `NEXT_PUBLIC_FEATURE_REQUIRE_LOGIN` |
-| `privacy` | `NEXT_PUBLIC_FEATURE_PRIVACY` |
-| `browse` | `NEXT_PUBLIC_FEATURE_BROWSE` |
-| `sendToZulip` | `NEXT_PUBLIC_FEATURE_SEND_TO_ZULIP` |
-| `rooms` | `NEXT_PUBLIC_FEATURE_ROOMS` |
-
-### Setting Feature Flags
-
-Feature flags are controlled via environment variables using the pattern `NEXT_PUBLIC_FEATURE_{FEATURE_NAME}` where `{FEATURE_NAME}` is the SCREAMING_SNAKE_CASE version of the feature name.
-
-**Examples:**
-```bash
-# Enable user authentication requirement
-NEXT_PUBLIC_FEATURE_REQUIRE_LOGIN=true
-
-# Disable browse functionality
-NEXT_PUBLIC_FEATURE_BROWSE=false
-
-# Enable Zulip integration
-NEXT_PUBLIC_FEATURE_SEND_TO_ZULIP=true
-```
--- a/server/docs/gpu/api-transcription.md
+++ b/server/docs/gpu/api-transcription.md
@@ -1,194 +0,0 @@
-## Reflector GPU Transcription API (Specification)
-
-This document defines the Reflector GPU transcription API that all implementations must adhere to. Current implementations include NVIDIA Parakeet (NeMo) and Whisper (faster-whisper), both deployed on Modal.com. The API surface and response shapes are OpenAI/Whisper-compatible, so clients can switch implementations by changing only the base URL.
-
-### Base URL and Authentication
-
- Example base URLs (Modal web endpoints):
-
-  - Parakeet: `https://<account>--reflector-transcriber-parakeet-web.modal.run`
-  - Whisper: `https://<account>--reflector-transcriber-web.modal.run`
-
- All endpoints are served under `/v1` and require a Bearer token:
-
-```
-Authorization: Bearer <REFLECTOR_GPU_APIKEY>
-```
-
-Note: To switch implementations, deploy the desired variant and point `TRANSCRIPT_URL` to its base URL. The API is identical.
-
-### Supported file types
-
-`mp3, mp4, mpeg, mpga, m4a, wav, webm`
-
-### Models and languages
-
- Parakeet (NVIDIA NeMo): default `nvidia/parakeet-tdt-0.6b-v2`
-  - Language support: only `en`. Other languages return HTTP 400.
- Whisper (faster-whisper): default `large-v2` (or deployment-specific)
-  - Language support: multilingual (per Whisper model capabilities).
-
-Note: The `model` parameter is accepted by all implementations for interface parity. Some backends may treat it as informational.
-
-### Endpoints
-
-#### POST /v1/audio/transcriptions
-
-Transcribe one or more uploaded audio files.
-
-Request: multipart/form-data
-
- `file` (File) — optional. Single file to transcribe.
- `files` (File[]) — optional. One or more files to transcribe.
- `model` (string) — optional. Defaults to the implementation-specific model (see above).
- `language` (string) — optional, defaults to `en`.
-  - Parakeet: only `en` is accepted; other values return HTTP 400
-  - Whisper: model-dependent; typically multilingual
- `batch` (boolean) — optional, defaults to `false`.
-
-Notes:
-
- Provide either `file` or `files`, not both. If neither is provided, HTTP 400.
- `batch` requires `files`; using `batch=true` without `files` returns HTTP 400.
- Response shape for multiple files is the same regardless of `batch`.
- Files sent to this endpoint are processed in a single pass (no VAD/chunking). This is intended for short clips (roughly ≤ 30s; depends on GPU memory/model). For longer audio, prefer `/v1/audio/transcriptions-from-url` which supports VAD-based chunking.
-
-Responses
-
-Single file response:
-
-```json
-{
-  "text": "transcribed text",
-  "words": [
-    { "word": "hello", "start": 0.0, "end": 0.5 },
-    { "word": "world", "start": 0.5, "end": 1.0 }
-  ],
-  "filename": "audio.mp3"
-}
-```
-
-Multiple files response:
-
-```json
-{
-  "results": [
-    {"filename": "a1.mp3", "text": "...", "words": [...]},
-    {"filename": "a2.mp3", "text": "...", "words": [...]}]
-}
-```
-
-Notes:
-
- Word objects always include keys: `word`, `start`, `end`.
- Some implementations may include a trailing space in `word` to match Whisper tokenization behavior; clients should trim if needed.
-
-Example curl (single file):
-
-```bash
-curl -X POST \
-  -H "Authorization: Bearer $REFLECTOR_GPU_APIKEY" \
-  -F "file=@/path/to/audio.mp3" \
-  -F "language=en" \
-  "$BASE_URL/v1/audio/transcriptions"
-```
-
-Example curl (multiple files, batch):
-
-```bash
-curl -X POST \
-  -H "Authorization: Bearer $REFLECTOR_GPU_APIKEY" \
-  -F "files=@/path/a1.mp3" -F "files=@/path/a2.mp3" \
-  -F "batch=true" -F "language=en" \
-  "$BASE_URL/v1/audio/transcriptions"
-```
-
-#### POST /v1/audio/transcriptions-from-url
-
-Transcribe a single remote audio file by URL.
-
-Request: application/json
-
-Body parameters:
-
- `audio_file_url` (string) — required. URL of the audio file to transcribe.
- `model` (string) — optional. Defaults to the implementation-specific model (see above).
- `language` (string) — optional, defaults to `en`. Parakeet only accepts `en`.
- `timestamp_offset` (number) — optional, defaults to `0.0`. Added to each word's `start`/`end` in the response.
-
-```json
-{
-  "audio_file_url": "https://example.com/audio.mp3",
-  "model": "nvidia/parakeet-tdt-0.6b-v2",
-  "language": "en",
-  "timestamp_offset": 0.0
-}
-```
-
-Response:
-
-```json
-{
-  "text": "transcribed text",
-  "words": [
-    { "word": "hello", "start": 10.0, "end": 10.5 },
-    { "word": "world", "start": 10.5, "end": 11.0 }
-  ]
-}
-```
-
-Notes:
-
- `timestamp_offset` is added to each word’s `start`/`end` in the response.
- Implementations may perform VAD-based chunking and batching for long-form audio; word timings are adjusted accordingly.
-
-Example curl:
-
-```bash
-curl -X POST \
-  -H "Authorization: Bearer $REFLECTOR_GPU_APIKEY" \
-  -H "Content-Type: application/json" \
-  -d '{
-        "audio_file_url": "https://example.com/audio.mp3",
-        "language": "en",
-        "timestamp_offset": 0
-      }' \
-  "$BASE_URL/v1/audio/transcriptions-from-url"
-```
-
-### Error handling
-
- 400 Bad Request
-  - Parakeet: `language` other than `en`
-  - Missing required parameters (`file`/`files` for upload; `audio_file_url` for URL endpoint)
-  - Unsupported file extension
- 401 Unauthorized
-  - Missing or invalid Bearer token
- 404 Not Found
-  - `audio_file_url` does not exist
-
-### Implementation details
-
- GPUs: A10G for small-file/live, L40S for large-file URL transcription (subject to deployment)
- VAD chunking and segment batching; word timings adjusted and overlapping ends constrained
- Pads very short segments (< 0.5s) to avoid model crashes on some backends
-
-### Server configuration (Reflector API)
-
-Set the Reflector server to use the Modal backend and point `TRANSCRIPT_URL` to your chosen deployment:
-
-```
-TRANSCRIPT_BACKEND=modal
-TRANSCRIPT_URL=https://<account>--reflector-transcriber-parakeet-web.modal.run
-TRANSCRIPT_MODAL_API_KEY=<REFLECTOR_GPU_APIKEY>
-```
-
-### Conformance tests
-
-Use the pytest-based conformance tests to validate any new implementation (including self-hosted) against this spec:
-
-```
-TRANSCRIPT_URL=https://<your-deployment-base> \
-TRANSCRIPT_MODAL_API_KEY=your-api-key \
-uv run -m pytest -m gpu_modal --no-cov server/tests/test_gpu_modal_transcript.py
-```
--- a/server/gpu/modal_deployments/reflector_transcriber.py
+++ b/server/gpu/modal_deployments/reflector_transcriber.py
@@ -1,78 +1,41 @@
 import os
-import sys
+import tempfile
 import threading
-import uuid
-from typing import Generator, Mapping, NamedTuple, NewType, TypedDict
-from urllib.parse import urlparse

 import modal
+from pydantic import BaseModel
+
+MODELS_DIR = "/models"

 MODEL_NAME = "large-v2"
 MODEL_COMPUTE_TYPE: str = "float16"
 MODEL_NUM_WORKERS: int = 1
+
 MINUTES = 60  # seconds
-SAMPLERATE = 16000
-UPLOADS_PATH = "/uploads"
-CACHE_PATH = "/models"
-SUPPORTED_FILE_EXTENSIONS = ["mp3", "mp4", "mpeg", "mpga", "m4a", "wav", "webm"]
-VAD_CONFIG = {
-    "batch_max_duration": 30.0,
-    "silence_padding": 0.5,
-    "window_size": 512,
-}

-
-WhisperUniqFilename = NewType("WhisperUniqFilename", str)
-AudioFileExtension = NewType("AudioFileExtension", str)
+volume = modal.Volume.from_name("models", create_if_missing=True)

 app = modal.App("reflector-transcriber")

-model_cache = modal.Volume.from_name("models", create_if_missing=True)
-upload_volume = modal.Volume.from_name("whisper-uploads", create_if_missing=True)
-
-
-class TimeSegment(NamedTuple):
-    """Represents a time segment with start and end times."""
-
-    start: float
-    end: float
-
-
-class AudioSegment(NamedTuple):
-    """Represents an audio segment with timing and audio data."""
-
-    start: float
-    end: float
-    audio: any
-
-
-class TranscriptResult(NamedTuple):
-    """Represents a transcription result with text and word timings."""
-
-    text: str
-    words: list["WordTiming"]
-
-
-class WordTiming(TypedDict):
-    """Represents a word with its timing information."""
-
-    word: str
-    start: float
-    end: float
-

 def download_model():
    from faster_whisper import download_model

-    model_cache.reload()
+    volume.reload()

-    download_model(MODEL_NAME, cache_dir=CACHE_PATH)
+    download_model(MODEL_NAME, cache_dir=MODELS_DIR)

-    model_cache.commit()
+    volume.commit()


 image = (
    modal.Image.debian_slim(python_version="3.12")
+    .pip_install(
+        "huggingface_hub==0.27.1",
+        "hf-transfer==0.1.9",
+        "torch==2.5.1",
+        "faster-whisper==1.1.1",
+    )
    .env(
        {
            "HF_HUB_ENABLE_HF_TRANSFER": "1",
@@ -82,98 +45,19 @@ image = (
            ),
        }
    )
-    .apt_install("ffmpeg")
-    .pip_install(
-        "huggingface_hub==0.27.1",
-        "hf-transfer==0.1.9",
-        "torch==2.5.1",
-        "faster-whisper==1.1.1",
-        "fastapi==0.115.12",
-        "requests",
-        "librosa==0.10.1",
-        "numpy<2",
-        "silero-vad==5.1.0",
-    )
-    .run_function(download_model, volumes={CACHE_PATH: model_cache})
+    .run_function(download_model, volumes={MODELS_DIR: volume})
 )


-def detect_audio_format(url: str, headers: Mapping[str, str]) -> AudioFileExtension:
-    parsed_url = urlparse(url)
-    url_path = parsed_url.path
-
-    for ext in SUPPORTED_FILE_EXTENSIONS:
-        if url_path.lower().endswith(f".{ext}"):
-            return AudioFileExtension(ext)
-
-    content_type = headers.get("content-type", "").lower()
-    if "audio/mpeg" in content_type or "audio/mp3" in content_type:
-        return AudioFileExtension("mp3")
-    if "audio/wav" in content_type:
-        return AudioFileExtension("wav")
-    if "audio/mp4" in content_type:
-        return AudioFileExtension("mp4")
-
-    raise ValueError(
-        f"Unsupported audio format for URL: {url}. "
-        f"Supported extensions: {', '.join(SUPPORTED_FILE_EXTENSIONS)}"
-    )
-
-
-def download_audio_to_volume(
-    audio_file_url: str,
-) -> tuple[WhisperUniqFilename, AudioFileExtension]:
-    import requests
-    from fastapi import HTTPException
-
-    response = requests.head(audio_file_url, allow_redirects=True)
-    if response.status_code == 404:
-        raise HTTPException(status_code=404, detail="Audio file not found")
-
-    response = requests.get(audio_file_url, allow_redirects=True)
-    response.raise_for_status()
-
-    audio_suffix = detect_audio_format(audio_file_url, response.headers)
-    unique_filename = WhisperUniqFilename(f"{uuid.uuid4()}.{audio_suffix}")
-    file_path = f"{UPLOADS_PATH}/{unique_filename}"
-
-    with open(file_path, "wb") as f:
-        f.write(response.content)
-
-    upload_volume.commit()
-    return unique_filename, audio_suffix
-
-
-def pad_audio(audio_array, sample_rate: int = SAMPLERATE):
-    """Add 0.5s of silence if audio is shorter than the silence_padding window.
-
-    Whisper does not require this strictly, but aligning behavior with Parakeet
-    avoids edge-case crashes on extremely short inputs and makes comparisons easier.
-    """
-    import numpy as np
-
-    audio_duration = len(audio_array) / sample_rate
-    if audio_duration < VAD_CONFIG["silence_padding"]:
-        silence_samples = int(sample_rate * VAD_CONFIG["silence_padding"])
-        silence = np.zeros(silence_samples, dtype=np.float32)
-        return np.concatenate([audio_array, silence])
-    return audio_array
-
-
@app.cls(
    gpu="A10G",
    timeout=5 * MINUTES,
    scaledown_window=5 * MINUTES,
+    allow_concurrent_inputs=6,
    image=image,
-    volumes={CACHE_PATH: model_cache, UPLOADS_PATH: upload_volume},
+    volumes={MODELS_DIR: volume},
 )
-@modal.concurrent(max_inputs=10)
-class TranscriberWhisperLive:
-    """Live transcriber class for small audio segments (A10G).
-
-    Mirrors the Parakeet live class API but uses Faster-Whisper under the hood.
-    """
-
+class Transcriber:
    @modal.enter()
    def enter(self):
        import faster_whisper
@@ -187,200 +71,23 @@ class TranscriberWhisperLive:
            device=self.device,
            compute_type=MODEL_COMPUTE_TYPE,
            num_workers=MODEL_NUM_WORKERS,
-            download_root=CACHE_PATH,
+            download_root=MODELS_DIR,
            local_files_only=True,
        )
-        print(f"Model is on device: {self.device}")

    @modal.method()
    def transcribe_segment(
        self,
-        filename: str,
-        language: str = "en",
+        audio_data: str,
+        audio_suffix: str,
+        language: str,
    ):
-        """Transcribe a single uploaded audio file by filename."""
-        upload_volume.reload()
-
-        file_path = f"{UPLOADS_PATH}/{filename}"
-        if not os.path.exists(file_path):
-            raise FileNotFoundError(f"File not found: {file_path}")
-
-        with self.lock:
-            with NoStdStreams():
-                segments, _ = self.model.transcribe(
-                    file_path,
-                    language=language,
-                    beam_size=5,
-                    word_timestamps=True,
-                    vad_filter=True,
-                    vad_parameters={"min_silence_duration_ms": 500},
-                )
-
-        segments = list(segments)
-        text = "".join(segment.text for segment in segments).strip()
-        words = [
-            {
-                "word": word.word,
-                "start": round(float(word.start), 2),
-                "end": round(float(word.end), 2),
-            }
-            for segment in segments
-            for word in segment.words
-        ]
-
-        return {"text": text, "words": words}
-
-    @modal.method()
-    def transcribe_batch(
-        self,
-        filenames: list[str],
-        language: str = "en",
-    ):
-        """Transcribe multiple uploaded audio files and return per-file results."""
-        upload_volume.reload()
-
-        results = []
-        for filename in filenames:
-            file_path = f"{UPLOADS_PATH}/{filename}"
-            if not os.path.exists(file_path):
-                raise FileNotFoundError(f"Batch file not found: {file_path}")
-
-            with self.lock:
-                with NoStdStreams():
-                    segments, _ = self.model.transcribe(
-                        file_path,
-                        language=language,
-                        beam_size=5,
-                        word_timestamps=True,
-                        vad_filter=True,
-                        vad_parameters={"min_silence_duration_ms": 500},
-                    )
-
-            segments = list(segments)
-            text = "".join(seg.text for seg in segments).strip()
-            words = [
-                {
-                    "word": w.word,
-                    "start": round(float(w.start), 2),
-                    "end": round(float(w.end), 2),
-                }
-                for seg in segments
-                for w in seg.words
-            ]
-
-            results.append(
-                {
-                    "filename": filename,
-                    "text": text,
-                    "words": words,
-                }
-            )
-
-        return results
-
-
-@app.cls(
-    gpu="L40S",
-    timeout=15 * MINUTES,
-    image=image,
-    volumes={CACHE_PATH: model_cache, UPLOADS_PATH: upload_volume},
-)
-class TranscriberWhisperFile:
-    """File transcriber for larger/longer audio, using VAD-driven batching (L40S)."""
-
-    @modal.enter()
-    def enter(self):
-        import faster_whisper
-        import torch
-        from silero_vad import load_silero_vad
-
-        self.lock = threading.Lock()
-        self.use_gpu = torch.cuda.is_available()
-        self.device = "cuda" if self.use_gpu else "cpu"
-        self.model = faster_whisper.WhisperModel(
-            MODEL_NAME,
-            device=self.device,
-            compute_type=MODEL_COMPUTE_TYPE,
-            num_workers=MODEL_NUM_WORKERS,
-            download_root=CACHE_PATH,
-            local_files_only=True,
-        )
-        self.vad_model = load_silero_vad(onnx=False)
-
-    @modal.method()
-    def transcribe_segment(
-        self, filename: str, timestamp_offset: float = 0.0, language: str = "en"
-    ):
-        import librosa
-        import numpy as np
-        from silero_vad import VADIterator
-
-        def vad_segments(
-            audio_array,
-            sample_rate: int = SAMPLERATE,
-            window_size: int = VAD_CONFIG["window_size"],
-        ) -> Generator[TimeSegment, None, None]:
-            """Generate speech segments as TimeSegment using Silero VAD."""
-            iterator = VADIterator(self.vad_model, sampling_rate=sample_rate)
-            start = None
-            for i in range(0, len(audio_array), window_size):
-                chunk = audio_array[i : i + window_size]
-                if len(chunk) < window_size:
-                    chunk = np.pad(
-                        chunk, (0, window_size - len(chunk)), mode="constant"
-                    )
-                speech = iterator(chunk)
-                if not speech:
-                    continue
-                if "start" in speech:
-                    start = speech["start"]
-                    continue
-                if "end" in speech and start is not None:
-                    end = speech["end"]
-                    yield TimeSegment(
-                        start / float(SAMPLERATE), end / float(SAMPLERATE)
-                    )
-                    start = None
-            iterator.reset_states()
-
-        upload_volume.reload()
-        file_path = f"{UPLOADS_PATH}/{filename}"
-        if not os.path.exists(file_path):
-            raise FileNotFoundError(f"File not found: {file_path}")
-
-        audio_array, _sr = librosa.load(file_path, sr=SAMPLERATE, mono=True)
-
-        # Batch segments up to ~30s windows by merging contiguous VAD segments
-        merged_batches: list[TimeSegment] = []
-        batch_start = None
-        batch_end = None
-        max_duration = VAD_CONFIG["batch_max_duration"]
-        for segment in vad_segments(audio_array):
-            seg_start, seg_end = segment.start, segment.end
-            if batch_start is None:
-                batch_start, batch_end = seg_start, seg_end
-                continue
-            if seg_end - batch_start <= max_duration:
-                batch_end = seg_end
-            else:
-                merged_batches.append(TimeSegment(batch_start, batch_end))
-                batch_start, batch_end = seg_start, seg_end
-        if batch_start is not None and batch_end is not None:
-            merged_batches.append(TimeSegment(batch_start, batch_end))
-
-        all_text = []
-        all_words = []
-
-        for segment in merged_batches:
-            start_time, end_time = segment.start, segment.end
-            s_idx = int(start_time * SAMPLERATE)
-            e_idx = int(end_time * SAMPLERATE)
-            segment = audio_array[s_idx:e_idx]
-            segment = pad_audio(segment, SAMPLERATE)
+        with tempfile.NamedTemporaryFile("wb+", suffix=f".{audio_suffix}") as fp:
+            fp.write(audio_data)

            with self.lock:
                segments, _ = self.model.transcribe(
-                    segment,
+                    fp.name,
                    language=language,
                    beam_size=5,
                    word_timestamps=True,
@@ -389,220 +96,66 @@ class TranscriberWhisperFile:
                )

            segments = list(segments)
-            text = "".join(seg.text for seg in segments).strip()
+            text = "".join(segment.text for segment in segments)
            words = [
-                {
-                    "word": w.word,
-                    "start": round(float(w.start) + start_time + timestamp_offset, 2),
-                    "end": round(float(w.end) + start_time + timestamp_offset, 2),
-                }
-                for seg in segments
-                for w in seg.words
+                {"word": word.word, "start": word.start, "end": word.end}
+                for segment in segments
+                for word in segment.words
            ]
-            if text:
-                all_text.append(text)
-            all_words.extend(words)

-        return {"text": " ".join(all_text), "words": all_words}
-
-
-def detect_audio_format(url: str, headers: dict) -> str:
-    from urllib.parse import urlparse
-
-    from fastapi import HTTPException
-
-    url_path = urlparse(url).path
-    for ext in SUPPORTED_FILE_EXTENSIONS:
-        if url_path.lower().endswith(f".{ext}"):
-            return ext
-
-    content_type = headers.get("content-type", "").lower()
-    if "audio/mpeg" in content_type or "audio/mp3" in content_type:
-        return "mp3"
-    if "audio/wav" in content_type:
-        return "wav"
-    if "audio/mp4" in content_type:
-        return "mp4"
-
-    raise HTTPException(
-        status_code=400,
-        detail=(
-            f"Unsupported audio format for URL. Supported extensions: {', '.join(SUPPORTED_FILE_EXTENSIONS)}"
-        ),
-    )
-
-
-def download_audio_to_volume(audio_file_url: str) -> tuple[str, str]:
-    import requests
-    from fastapi import HTTPException
-
-    response = requests.head(audio_file_url, allow_redirects=True)
-    if response.status_code == 404:
-        raise HTTPException(status_code=404, detail="Audio file not found")
-
-    response = requests.get(audio_file_url, allow_redirects=True)
-    response.raise_for_status()
-
-    audio_suffix = detect_audio_format(audio_file_url, response.headers)
-    unique_filename = f"{uuid.uuid4()}.{audio_suffix}"
-    file_path = f"{UPLOADS_PATH}/{unique_filename}"
-
-    with open(file_path, "wb") as f:
-        f.write(response.content)
-
-    upload_volume.commit()
-    return unique_filename, audio_suffix
+            return {"text": text, "words": words}


@app.function(
    scaledown_window=60,
-    timeout=600,
+    timeout=60,
+    allow_concurrent_inputs=40,
    secrets=[
        modal.Secret.from_name("reflector-gpu"),
    ],
-    volumes={CACHE_PATH: model_cache, UPLOADS_PATH: upload_volume},
-    image=image,
+    volumes={MODELS_DIR: volume},
 )
-@modal.concurrent(max_inputs=40)
@modal.asgi_app()
 def web():
-    from fastapi import (
-        Body,
-        Depends,
-        FastAPI,
-        Form,
-        HTTPException,
-        UploadFile,
-        status,
-    )
+    from fastapi import Body, Depends, FastAPI, HTTPException, UploadFile, status
    from fastapi.security import OAuth2PasswordBearer
+    from typing_extensions import Annotated

-    transcriber_live = TranscriberWhisperLive()
-    transcriber_file = TranscriberWhisperFile()
+    transcriber = Transcriber()

    app = FastAPI()

    oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

-    def apikey_auth(apikey: str = Depends(oauth2_scheme)):
-        if apikey == os.environ["REFLECTOR_GPU_APIKEY"]:
-            return
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid API key",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
+    supported_file_types = ["mp3", "mp4", "mpeg", "mpga", "m4a", "wav", "webm"]

-    class TranscriptResponse(dict):
-        pass
+    def apikey_auth(apikey: str = Depends(oauth2_scheme)):
+        if apikey != os.environ["REFLECTOR_GPU_APIKEY"]:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid API key",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+    class TranscriptResponse(BaseModel):
+        result: dict

    @app.post("/v1/audio/transcriptions", dependencies=[Depends(apikey_auth)])
    def transcribe(
-        file: UploadFile = None,
-        files: list[UploadFile] | None = None,
-        model: str = Form(MODEL_NAME),
-        language: str = Form("en"),
-        batch: bool = Form(False),
-    ):
-        if not file and not files:
-            raise HTTPException(
-                status_code=400, detail="Either 'file' or 'files' parameter is required"
-            )
-        if batch and not files:
-            raise HTTPException(
-                status_code=400, detail="Batch transcription requires 'files'"
-            )
+        file: UploadFile,
+        model: str = "whisper-1",
+        language: Annotated[str, Body(...)] = "en",
+    ) -> TranscriptResponse:
+        audio_data = file.file.read()
+        audio_suffix = file.filename.split(".")[-1]
+        assert audio_suffix in supported_file_types

-        upload_files = [file] if file else files
-
-        uploaded_filenames: list[str] = []
-        for upload_file in upload_files:
-            audio_suffix = upload_file.filename.split(".")[-1]
-            if audio_suffix not in SUPPORTED_FILE_EXTENSIONS:
-                raise HTTPException(
-                    status_code=400,
-                    detail=(
-                        f"Unsupported audio format. Supported extensions: {', '.join(SUPPORTED_FILE_EXTENSIONS)}"
-                    ),
-                )
-
-            unique_filename = f"{uuid.uuid4()}.{audio_suffix}"
-            file_path = f"{UPLOADS_PATH}/{unique_filename}"
-            with open(file_path, "wb") as f:
-                content = upload_file.file.read()
-                f.write(content)
-            uploaded_filenames.append(unique_filename)
-
-        upload_volume.commit()
-
-        try:
-            if batch and len(upload_files) > 1:
-                func = transcriber_live.transcribe_batch.spawn(
-                    filenames=uploaded_filenames,
-                    language=language,
-                )
-                results = func.get()
-                return {"results": results}
-
-            results = []
-            for filename in uploaded_filenames:
-                func = transcriber_live.transcribe_segment.spawn(
-                    filename=filename,
-                    language=language,
-                )
-                result = func.get()
-                result["filename"] = filename
-                results.append(result)
-
-            return {"results": results} if len(results) > 1 else results[0]
-        finally:
-            for filename in uploaded_filenames:
-                try:
-                    file_path = f"{UPLOADS_PATH}/{filename}"
-                    os.remove(file_path)
-                except Exception:
-                    pass
-            upload_volume.commit()
-
-    @app.post("/v1/audio/transcriptions-from-url", dependencies=[Depends(apikey_auth)])
-    def transcribe_from_url(
-        audio_file_url: str = Body(
-            ..., description="URL of the audio file to transcribe"
-        ),
-        model: str = Body(MODEL_NAME),
-        language: str = Body("en"),
-        timestamp_offset: float = Body(0.0),
-    ):
-        unique_filename, _audio_suffix = download_audio_to_volume(audio_file_url)
-        try:
-            func = transcriber_file.transcribe_segment.spawn(
-                filename=unique_filename,
-                timestamp_offset=timestamp_offset,
-                language=language,
-            )
-            result = func.get()
-            return result
-        finally:
-            try:
-                file_path = f"{UPLOADS_PATH}/{unique_filename}"
-                os.remove(file_path)
-                upload_volume.commit()
-            except Exception:
-                pass
+        func = transcriber.transcribe_segment.spawn(
+            audio_data=audio_data,
+            audio_suffix=audio_suffix,
+            language=language,
+        )
+        result = func.get()
+        return result

    return app
-
-
-class NoStdStreams:
-    def __init__(self):
-        self.devnull = open(os.devnull, "w")
-
-    def __enter__(self):
-        self._stdout, self._stderr = sys.stdout, sys.stderr
-        self._stdout.flush()
-        self._stderr.flush()
-        sys.stdout, sys.stderr = self.devnull, self.devnull
-
-    def __exit__(self, exc_type, exc_value, traceback):
-        sys.stdout, sys.stderr = self._stdout, self._stderr
-        self.devnull.close()
--- a/server/reflector/db/meetings.py
+++ b/server/reflector/db/meetings.py
@@ -2,6 +2,7 @@ from datetime import datetime
 from typing import Literal

 import sqlalchemy as sa
+from fastapi import HTTPException
 from pydantic import BaseModel, Field

 from reflector.db import get_database, metadata
@@ -177,6 +178,23 @@ class MeetingController:
            return None
        return Meeting(**result)

+    async def get_by_id_for_http(self, meeting_id: str, user_id: str | None) -> Meeting:
+        """
+        Get a meeting by ID for HTTP request.
+
+        If not found, it will raise a 404 error.
+        """
+        query = meetings.select().where(meetings.c.id == meeting_id)
+        result = await get_database().fetch_one(query)
+        if not result:
+            raise HTTPException(status_code=404, detail="Meeting not found")
+
+        meeting = Meeting(**result)
+        if result["user_id"] != user_id:
+            meeting.host_room_url = ""
+
+        return meeting
+
    async def update_meeting(self, meeting_id: str, **kwargs):
        query = meetings.update().where(meetings.c.id == meeting_id).values(**kwargs)
        await get_database().execute(query)
--- a/server/reflector/db/search.py
+++ b/server/reflector/db/search.py
@@ -23,7 +23,7 @@ from pydantic import (

 from reflector.db import get_database
 from reflector.db.rooms import rooms
-from reflector.db.transcripts import SourceKind, TranscriptStatus, transcripts
+from reflector.db.transcripts import SourceKind, transcripts
 from reflector.db.utils import is_postgresql
 from reflector.logger import logger
 from reflector.utils.string import NonEmptyString, try_parse_non_empty_string
@@ -161,7 +161,7 @@ class SearchResult(BaseModel):
    room_name: str | None = None
    source_kind: SourceKind
    created_at: datetime
-    status: TranscriptStatus = Field(..., min_length=1)
+    status: str = Field(..., min_length=1)
    rank: float = Field(..., ge=0, le=1)
    duration: NonNegativeFloat | None = Field(..., description="Duration in seconds")
    search_snippets: list[str] = Field(
--- a/server/reflector/processors/file_diarization_modal.py
+++ b/server/reflector/processors/file_diarization_modal.py
@@ -47,7 +47,6 @@ class FileDiarizationModalProcessor(FileDiarizationProcessor):
                    "audio_file_url": data.audio_url,
                    "timestamp": 0,
                },
-                follow_redirects=True,
            )
            response.raise_for_status()
            diarization_data = response.json()["diarization"]
--- a/server/reflector/processors/file_transcript_modal.py
+++ b/server/reflector/processors/file_transcript_modal.py
@@ -54,7 +54,6 @@ class FileTranscriptModalProcessor(FileTranscriptProcessor):
                    "language": data.language,
                    "batch": True,
                },
-                follow_redirects=True,
            )
            response.raise_for_status()
            result = response.json()
--- a/server/reflector/settings.py
+++ b/server/reflector/settings.py
@@ -1,8 +1,6 @@
 from pydantic.types import PositiveInt
 from pydantic_settings import BaseSettings, SettingsConfigDict

-from reflector.utils.string import NonEmptyString
-

 class Settings(BaseSettings):
    model_config = SettingsConfigDict(
@@ -122,7 +120,7 @@ class Settings(BaseSettings):

    # Whereby integration
    WHEREBY_API_URL: str = "https://api.whereby.dev/v1"
-    WHEREBY_API_KEY: NonEmptyString | None = None
+    WHEREBY_API_KEY: str | None = None
    WHEREBY_WEBHOOK_SECRET: str | None = None
    AWS_WHEREBY_ACCESS_KEY_ID: str | None = None
    AWS_WHEREBY_ACCESS_KEY_SECRET: str | None = None
--- a/server/reflector/utils/string.py
+++ b/server/reflector/utils/string.py
@@ -10,11 +10,8 @@ NonEmptyString = Annotated[
 non_empty_string_adapter = TypeAdapter(NonEmptyString)


-def parse_non_empty_string(s: str, error: str | None = None) -> NonEmptyString:
-    try:
-        return non_empty_string_adapter.validate_python(s)
-    except Exception as e:
-        raise ValueError(f"{e}: {error}" if error else e) from e
+def parse_non_empty_string(s: str) -> NonEmptyString:
+    return non_empty_string_adapter.validate_python(s)


 def try_parse_non_empty_string(s: str) -> NonEmptyString | None:
--- a/server/reflector/views/rooms.py
+++ b/server/reflector/views/rooms.py
@@ -215,10 +215,14 @@ async def rooms_create_meeting(
        except (asyncpg.exceptions.UniqueViolationError, sqlite3.IntegrityError):
            # Another request already created a meeting for this room
            # Log this race condition occurrence
-            logger.warning(
-                "Race condition detected for room %s and meeting %s - fetching existing meeting",
+            logger.info(
+                "Race condition detected for room %s - fetching existing meeting",
                room.name,
+            )
+            logger.warning(
+                "Whereby meeting %s was created but not used (resource leak) for room %s",
                whereby_meeting["meetingId"],
+                room.name,
            )

            # Fetch the meeting that was created by the other request
@@ -228,9 +232,7 @@ async def rooms_create_meeting(
            if meeting is None:
                # Edge case: meeting was created but expired/deleted between checks
                logger.error(
-                    "Meeting disappeared after race condition for room %s",
-                    room.name,
-                    exc_info=True,
+                    "Meeting disappeared after race condition for room %s", room.name
                )
                raise HTTPException(
                    status_code=503, detail="Unable to join meeting - please try again"
--- a/server/reflector/views/transcripts.py
+++ b/server/reflector/views/transcripts.py
@@ -350,6 +350,8 @@ async def transcript_update(
    transcript = await transcripts_controller.get_by_id_for_http(
        transcript_id, user_id=user_id
    )
+    if not transcript:
+        raise HTTPException(status_code=404, detail="Transcript not found")
    values = info.dict(exclude_unset=True)
    updated_transcript = await transcripts_controller.update(transcript, values)
    return updated_transcript
--- a/server/reflector/whereby.py
+++ b/server/reflector/whereby.py
@@ -1,60 +1,18 @@
-import logging
 from datetime import datetime

 import httpx

 from reflector.db.rooms import Room
 from reflector.settings import settings
-from reflector.utils.string import parse_non_empty_string
-
-logger = logging.getLogger(__name__)
-
-
-def _get_headers():
-    api_key = parse_non_empty_string(
-        settings.WHEREBY_API_KEY, "WHEREBY_API_KEY value is required."
-    )
-    return {
-        "Content-Type": "application/json; charset=utf-8",
-        "Authorization": f"Bearer {api_key}",
-    }
-

+HEADERS = {
+    "Content-Type": "application/json; charset=utf-8",
+    "Authorization": f"Bearer {settings.WHEREBY_API_KEY}",
+}
 TIMEOUT = 10  # seconds


-def _get_whereby_s3_auth():
-    errors = []
-    try:
-        bucket_name = parse_non_empty_string(
-            settings.RECORDING_STORAGE_AWS_BUCKET_NAME,
-            "RECORDING_STORAGE_AWS_BUCKET_NAME value is required.",
-        )
-    except Exception as e:
-        errors.append(e)
-    try:
-        key_id = parse_non_empty_string(
-            settings.AWS_WHEREBY_ACCESS_KEY_ID,
-            "AWS_WHEREBY_ACCESS_KEY_ID value is required.",
-        )
-    except Exception as e:
-        errors.append(e)
-    try:
-        key_secret = parse_non_empty_string(
-            settings.AWS_WHEREBY_ACCESS_KEY_SECRET,
-            "AWS_WHEREBY_ACCESS_KEY_SECRET value is required.",
-        )
-    except Exception as e:
-        errors.append(e)
-    if len(errors) > 0:
-        raise Exception(
-            f"Failed to get Whereby auth settings: {', '.join(str(e) for e in errors)}"
-        )
-    return bucket_name, key_id, key_secret
-
-
 async def create_meeting(room_name_prefix: str, end_date: datetime, room: Room):
-    s3_bucket_name, s3_key_id, s3_key_secret = _get_whereby_s3_auth()
    data = {
        "isLocked": room.is_locked,
        "roomNamePrefix": room_name_prefix,
@@ -65,26 +23,23 @@ async def create_meeting(room_name_prefix: str, end_date: datetime, room: Room):
            "type": room.recording_type,
            "destination": {
                "provider": "s3",
-                "bucket": s3_bucket_name,
-                "accessKeyId": s3_key_id,
-                "accessKeySecret": s3_key_secret,
+                "bucket": settings.RECORDING_STORAGE_AWS_BUCKET_NAME,
+                "accessKeyId": settings.AWS_WHEREBY_ACCESS_KEY_ID,
+                "accessKeySecret": settings.AWS_WHEREBY_ACCESS_KEY_SECRET,
                "fileFormat": "mp4",
            },
            "startTrigger": room.recording_trigger,
        },
        "fields": ["hostRoomUrl"],
    }
+
    async with httpx.AsyncClient() as client:
        response = await client.post(
            f"{settings.WHEREBY_API_URL}/meetings",
-            headers=_get_headers(),
+            headers=HEADERS,
            json=data,
            timeout=TIMEOUT,
        )
-        if response.status_code == 403:
-            logger.warning(
-                f"Failed to create meeting: access denied on Whereby: {response.text}"
-            )
        response.raise_for_status()
        return response.json()

@@ -93,7 +48,7 @@ async def get_room_sessions(room_name: str):
    async with httpx.AsyncClient() as client:
        response = await client.get(
            f"{settings.WHEREBY_API_URL}/insights/room-sessions?roomName={room_name}",
-            headers=_get_headers(),
+            headers=HEADERS,
            timeout=TIMEOUT,
        )
        response.raise_for_status()
--- a/server/tests/test_gpu_modal_transcript.py
+++ b/server/tests/test_gpu_modal_transcript.py
@@ -272,9 +272,6 @@ class TestGPUModalTranscript:
                for f in temp_files:
                    Path(f).unlink(missing_ok=True)

-    @pytest.mark.skipif(
-        not "parakeet" in get_model_name(), reason="Parakeet only supports English"
-    )
    def test_transcriptions_error_handling(self):
        """Test error handling for invalid requests."""
        url = get_modal_transcript_url()
--- a/server/tests/test_search.py
+++ b/server/tests/test_search.py
@@ -58,7 +58,7 @@ async def test_empty_transcript_title_only_match():
            "id": test_id,
            "name": "Empty Transcript",
            "title": "Empty Meeting",
-            "status": "ended",
+            "status": "completed",
            "locked": False,
            "duration": 0.0,
            "created_at": datetime.now(timezone.utc),
@@ -109,7 +109,7 @@ async def test_search_with_long_summary():
            "id": test_id,
            "name": "Test Long Summary",
            "title": "Regular Meeting",
-            "status": "ended",
+            "status": "completed",
            "locked": False,
            "duration": 1800.0,
            "created_at": datetime.now(timezone.utc),
@@ -165,7 +165,7 @@ async def test_postgresql_search_with_data():
            "id": test_id,
            "name": "Test Search Transcript",
            "title": "Engineering Planning Meeting Q4 2024",
-            "status": "ended",
+            "status": "completed",
            "locked": False,
            "duration": 1800.0,
            "created_at": datetime.now(timezone.utc),
@@ -221,7 +221,7 @@ We need to implement PostgreSQL tsvector for better performance.""",
        test_result = next((r for r in results if r.id == test_id), None)
        if test_result:
            assert test_result.title == "Engineering Planning Meeting Q4 2024"
-            assert test_result.status == "ended"
+            assert test_result.status == "completed"
            assert test_result.duration == 1800.0
            assert 0 <= test_result.rank <= 1, "Rank should be normalized to 0-1"

@@ -268,7 +268,7 @@ def mock_db_result():
        "title": "Test Transcript",
        "created_at": datetime(2024, 6, 15, tzinfo=timezone.utc),
        "duration": 3600.0,
-        "status": "ended",
+        "status": "completed",
        "user_id": "test-user",
        "room_id": "room1",
        "source_kind": SourceKind.LIVE,
@@ -433,7 +433,7 @@ class TestSearchResultModel:
            room_id="room-456",
            source_kind=SourceKind.ROOM,
            created_at=datetime(2024, 6, 15, tzinfo=timezone.utc),
-            status="ended",
+            status="completed",
            rank=0.85,
            duration=1800.5,
            search_snippets=["snippet 1", "snippet 2"],
@@ -443,7 +443,7 @@ class TestSearchResultModel:
        assert result.title == "Test Title"
        assert result.user_id == "user-123"
        assert result.room_id == "room-456"
-        assert result.status == "ended"
+        assert result.status == "completed"
        assert result.rank == 0.85
        assert result.duration == 1800.5
        assert len(result.search_snippets) == 2
@@ -474,7 +474,7 @@ class TestSearchResultModel:
            id="test-id",
            source_kind=SourceKind.LIVE,
            created_at=datetime(2024, 6, 15, 12, 30, 45, tzinfo=timezone.utc),
-            status="ended",
+            status="completed",
            rank=0.9,
            duration=None,
            search_snippets=[],
--- a/server/tests/test_search_long_summary.py
+++ b/server/tests/test_search_long_summary.py
@@ -25,7 +25,7 @@ async def test_long_summary_snippet_prioritization():
            "id": test_id,
            "name": "Test Snippet Priority",
            "title": "Meeting About Projects",
-            "status": "ended",
+            "status": "completed",
            "locked": False,
            "duration": 1800.0,
            "created_at": datetime.now(timezone.utc),
@@ -106,7 +106,7 @@ async def test_long_summary_only_search():
            "id": test_id,
            "name": "Test Long Only",
            "title": "Standard Meeting",
-            "status": "ended",
+            "status": "completed",
            "locked": False,
            "duration": 1800.0,
            "created_at": datetime.now(timezone.utc),
--- a/www/.env.example
+++ b/www/.env.example
@@ -1,34 +0,0 @@
-# Environment
-ENVIRONMENT=development
-NEXT_PUBLIC_ENV=development
-
-# Site Configuration
-NEXT_PUBLIC_SITE_URL=http://localhost:3000
-
-# Nextauth envs
-# not used in app code but in lib code
-NEXTAUTH_URL=http://localhost:3000
-NEXTAUTH_SECRET=your-nextauth-secret-here
-# / Nextauth envs
-
-# Authentication (Authentik OAuth/OIDC)
-AUTHENTIK_ISSUER=https://authentik.example.com/application/o/reflector
-AUTHENTIK_REFRESH_TOKEN_URL=https://authentik.example.com/application/o/token/
-AUTHENTIK_CLIENT_ID=your-client-id-here
-AUTHENTIK_CLIENT_SECRET=your-client-secret-here
-
-# Feature Flags
-# NEXT_PUBLIC_FEATURE_REQUIRE_LOGIN=true
-# NEXT_PUBLIC_FEATURE_PRIVACY=false
-# NEXT_PUBLIC_FEATURE_BROWSE=true
-# NEXT_PUBLIC_FEATURE_SEND_TO_ZULIP=true
-# NEXT_PUBLIC_FEATURE_ROOMS=true
-
-# API URLs
-NEXT_PUBLIC_API_URL=http://127.0.0.1:1250
-NEXT_PUBLIC_WEBSOCKET_URL=ws://127.0.0.1:1250
-NEXT_PUBLIC_AUTH_CALLBACK_URL=http://localhost:3000/auth-callback
-
-# Sentry
-# SENTRY_DSN=https://your-dsn@sentry.io/project-id
-# SENTRY_IGNORE_API_RESOLUTION_ERROR=1
--- a/www/.gitignore
+++ b/www/.gitignore
@@ -40,6 +40,7 @@ next-env.d.ts
 # Sentry Auth Token
 .sentryclirc

+config.ts

 # openapi logs
 openapi-ts-error-*.log
--- a/www/app/(app)/AuthWrapper.tsx
+++ b/www/app/(app)/AuthWrapper.tsx
@@ -2,7 +2,6 @@

 import { Flex, Spinner } from "@chakra-ui/react";
 import { useAuth } from "../lib/AuthProvider";
-import { useLoginRequiredPages } from "../lib/useLoginRequiredPages";

 export default function AuthWrapper({
  children,
@@ -10,10 +9,8 @@ export default function AuthWrapper({
  children: React.ReactNode;
 }) {
  const auth = useAuth();
-  const redirectPath = useLoginRequiredPages();
-  const redirectHappens = !!redirectPath;

-  if (auth.status === "loading" || redirectHappens) {
+  if (auth.status === "loading") {
    return (
      <Flex
        flexDir="column"
--- a/www/app/(app)/browse/_components/TranscriptStatusIcon.tsx
+++ b/www/app/(app)/browse/_components/TranscriptStatusIcon.tsx
@@ -7,10 +7,9 @@ import {
  FaMicrophone,
  FaGear,
 } from "react-icons/fa6";
-import { TranscriptStatus } from "../../../lib/transcript";

 interface TranscriptStatusIconProps {
-  status: TranscriptStatus;
+  status: string;
 }

 export default function TranscriptStatusIcon({
--- a/www/app/(app)/layout.tsx
+++ b/www/app/(app)/layout.tsx
@@ -1,5 +1,5 @@
 import { Container, Flex, Link } from "@chakra-ui/react";
-import { featureEnabled } from "../lib/features";
+import { getConfig } from "../lib/edgeConfig";
 import NextLink from "next/link";
 import Image from "next/image";
 import UserInfo from "../(auth)/userInfo";
@@ -11,6 +11,8 @@ export default async function AppLayout({
 }: {
  children: React.ReactNode;
 }) {
+  const config = await getConfig();
+  const { requireLogin, privacy, browse, rooms } = config.features;
  return (
    <Container
      minW="100vw"
@@ -56,7 +58,7 @@ export default async function AppLayout({
          >
            Create
          </Link>
-          {featureEnabled("browse") ? (
+          {browse ? (
            <>
              &nbsp;·&nbsp;
              <Link href="/browse" as={NextLink} className="font-light px-2">
@@ -66,7 +68,7 @@ export default async function AppLayout({
          ) : (
            <></>
          )}
-          {featureEnabled("rooms") ? (
+          {rooms ? (
            <>
              &nbsp;·&nbsp;
              <Link href="/rooms" as={NextLink} className="font-light px-2">
@@ -76,7 +78,7 @@ export default async function AppLayout({
          ) : (
            <></>
          )}
-          {featureEnabled("requireLogin") ? (
+          {requireLogin ? (
            <>
              &nbsp;·&nbsp;
              <UserInfo />
--- a/www/app/(app)/transcripts/[transcriptId]/_components/TopicList.tsx
+++ b/www/app/(app)/transcripts/[transcriptId]/_components/TopicList.tsx
@@ -3,10 +3,8 @@ import ScrollToBottom from "../../scrollToBottom";
 import { Topic } from "../../webSocketTypes";
 import useParticipants from "../../useParticipants";
 import { Box, Flex, Text, Accordion } from "@chakra-ui/react";
+import { featureEnabled } from "../../../../domainContext";
 import { TopicItem } from "./TopicItem";
-import { TranscriptStatus } from "../../../../lib/transcript";
-
-import { featureEnabled } from "../../../../lib/features";

 type TopicListProps = {
  topics: Topic[];
@@ -16,7 +14,7 @@ type TopicListProps = {
  ];
  autoscroll: boolean;
  transcriptId: string;
-  status: TranscriptStatus | null;
+  status: string;
  currentTranscriptText: any;
 };

--- a/www/app/(app)/transcripts/[transcriptId]/correct/page.tsx
+++ b/www/app/(app)/transcripts/[transcriptId]/correct/page.tsx
@@ -9,10 +9,8 @@ import ParticipantList from "./participantList";
 import type { components } from "../../../../reflector-api";
 type GetTranscriptTopic = components["schemas"]["GetTranscriptTopic"];
 import { SelectedText, selectedTextIsTimeSlice } from "./types";
-import {
-  useTranscriptGet,
-  useTranscriptUpdate,
-} from "../../../../lib/apiHooks";
+import { useTranscriptUpdate } from "../../../../lib/apiHooks";
+import useTranscript from "../../useTranscript";
 import { useError } from "../../../../(errors)/errorContext";
 import { useRouter } from "next/navigation";
 import { Box, Grid } from "@chakra-ui/react";
@@ -27,7 +25,7 @@ export default function TranscriptCorrect({
  params: { transcriptId },
 }: TranscriptCorrect) {
  const updateTranscriptMutation = useTranscriptUpdate();
-  const transcript = useTranscriptGet(transcriptId);
+  const transcript = useTranscript(transcriptId);
  const stateCurrentTopic = useState<GetTranscriptTopic>();
  const [currentTopic, _sct] = stateCurrentTopic;
  const stateSelectedText = useState<SelectedText>();
@@ -38,7 +36,7 @@ export default function TranscriptCorrect({
  const router = useRouter();

  const markAsDone = async () => {
-    if (transcript.data && !transcript.data.reviewed) {
+    if (transcript.response && !transcript.response.reviewed) {
      try {
        await updateTranscriptMutation.mutateAsync({
          params: {
@@ -116,7 +114,7 @@ export default function TranscriptCorrect({
          }}
        />
      </Grid>
-      {transcript.data && !transcript.data?.reviewed && (
+      {transcript.response && !transcript.response?.reviewed && (
        <div className="flex flex-row justify-end">
          <button
            className="p-2 px-4 rounded bg-green-400"
--- a/www/app/(app)/transcripts/[transcriptId]/page.tsx
+++ b/www/app/(app)/transcripts/[transcriptId]/page.tsx
@@ -1,5 +1,6 @@
 "use client";
 import Modal from "../modal";
+import useTranscript from "../useTranscript";
 import useTopics from "../useTopics";
 import useWaveform from "../useWaveform";
 import useMp3 from "../useMp3";
@@ -11,8 +12,6 @@ import TranscriptTitle from "../transcriptTitle";
 import Player from "../player";
 import { useRouter } from "next/navigation";
 import { Box, Flex, Grid, GridItem, Skeleton, Text } from "@chakra-ui/react";
-import { useTranscriptGet } from "../../../lib/apiHooks";
-import { TranscriptStatus } from "../../../lib/transcript";

 type TranscriptDetails = {
  params: {
@@ -23,15 +22,11 @@ type TranscriptDetails = {
 export default function TranscriptDetails(details: TranscriptDetails) {
  const transcriptId = details.params.transcriptId;
  const router = useRouter();
-  const statusToRedirect = [
-    "idle",
-    "recording",
-    "processing",
-  ] satisfies TranscriptStatus[] as TranscriptStatus[];
+  const statusToRedirect = ["idle", "recording", "processing"];

-  const transcript = useTranscriptGet(transcriptId);
-  const waiting =
-    transcript.data && statusToRedirect.includes(transcript.data.status);
+  const transcript = useTranscript(transcriptId);
+  const transcriptStatus = transcript.response?.status;
+  const waiting = statusToRedirect.includes(transcriptStatus || "");

  const mp3 = useMp3(transcriptId, waiting);
  const topics = useTopics(transcriptId);
@@ -61,7 +56,7 @@ export default function TranscriptDetails(details: TranscriptDetails) {
    );
  }

-  if (transcript?.isLoading || topics?.loading) {
+  if (transcript?.loading || topics?.loading) {
    return <Modal title="Loading" text={"Loading transcript..."} />;
  }

@@ -91,7 +86,7 @@ export default function TranscriptDetails(details: TranscriptDetails) {
                useActiveTopic={useActiveTopic}
                waveform={waveform.waveform}
                media={mp3.media}
-                mediaDuration={transcript.data?.duration || null}
+                mediaDuration={transcript.response?.duration || null}
              />
            ) : !mp3.loading && (waveform.error || mp3.error) ? (
              <Box p={4} bg="red.100" borderRadius="md">
@@ -121,10 +116,10 @@ export default function TranscriptDetails(details: TranscriptDetails) {
            <Flex direction="column" gap={0}>
              <Flex alignItems="center" gap={2}>
                <TranscriptTitle
-                  title={transcript.data?.title || "Unnamed Transcript"}
+                  title={transcript.response?.title || "Unnamed Transcript"}
                  transcriptId={transcriptId}
                  onUpdate={(newTitle) => {
-                    transcript.refetch().then(() => {});
+                    transcript.reload();
                  }}
                />
              </Flex>
@@ -141,23 +136,23 @@ export default function TranscriptDetails(details: TranscriptDetails) {
            useActiveTopic={useActiveTopic}
            autoscroll={false}
            transcriptId={transcriptId}
-            status={transcript.data?.status || null}
+            status={transcript.response?.status}
            currentTranscriptText=""
          />
-          {transcript.data && topics.topics ? (
+          {transcript.response && topics.topics ? (
            <>
              <FinalSummary
-                transcriptResponse={transcript.data}
+                transcriptResponse={transcript.response}
                topicsResponse={topics.topics}
-                onUpdate={() => {
-                  transcript.refetch();
+                onUpdate={(newSummary) => {
+                  transcript.reload();
                }}
              />
            </>
          ) : (
            <Flex justify={"center"} alignItems={"center"} h={"100%"}>
              <div className="flex flex-col h-full justify-center content-center">
-                {transcript?.data?.status == "processing" ? (
+                {transcript.response.status == "processing" ? (
                  <Text>Loading Transcript</Text>
                ) : (
                  <Text>
--- a/www/app/(app)/transcripts/[transcriptId]/record/page.tsx
+++ b/www/app/(app)/transcripts/[transcriptId]/record/page.tsx
@@ -2,6 +2,7 @@
 import { useEffect, useState } from "react";
 import Recorder from "../../recorder";
 import { TopicList } from "../_components/TopicList";
+import useTranscript from "../../useTranscript";
 import { useWebSockets } from "../../useWebSockets";
 import { Topic } from "../../webSocketTypes";
 import { lockWakeState, releaseWakeState } from "../../../../lib/wakeLock";
@@ -10,8 +11,6 @@ import useMp3 from "../../useMp3";
 import WaveformLoading from "../../waveformLoading";
 import { Box, Text, Grid, Heading, VStack, Flex } from "@chakra-ui/react";
 import LiveTrancription from "../../liveTranscription";
-import { useTranscriptGet } from "../../../../lib/apiHooks";
-import { TranscriptStatus } from "../../../../lib/transcript";

 type TranscriptDetails = {
  params: {
@@ -20,7 +19,7 @@ type TranscriptDetails = {
 };

 const TranscriptRecord = (details: TranscriptDetails) => {
-  const transcript = useTranscriptGet(details.params.transcriptId);
+  const transcript = useTranscript(details.params.transcriptId);
  const [transcriptStarted, setTranscriptStarted] = useState(false);
  const useActiveTopic = useState<Topic | null>(null);

@@ -30,8 +29,8 @@ const TranscriptRecord = (details: TranscriptDetails) => {

  const router = useRouter();

-  const [status, setStatus] = useState<TranscriptStatus>(
-    webSockets.status?.value || transcript.data?.status || "idle",
+  const [status, setStatus] = useState(
+    webSockets.status.value || transcript.response?.status || "idle",
  );

  useEffect(() => {
@@ -42,7 +41,7 @@ const TranscriptRecord = (details: TranscriptDetails) => {
  useEffect(() => {
    //TODO HANDLE ERROR STATUS BETTER
    const newStatus =
-      webSockets.status?.value || transcript.data?.status || "idle";
+      webSockets.status.value || transcript.response?.status || "idle";
    setStatus(newStatus);
    if (newStatus && (newStatus == "ended" || newStatus == "error")) {
      console.log(newStatus, "redirecting");
@@ -50,7 +49,7 @@ const TranscriptRecord = (details: TranscriptDetails) => {
      const newUrl = "/transcripts/" + details.params.transcriptId;
      router.replace(newUrl);
    }
-  }, [webSockets.status?.value, transcript.data?.status]);
+  }, [webSockets.status.value, transcript.response?.status]);

  useEffect(() => {
    if (webSockets.waveform && webSockets.waveform) mp3.getNow();
--- a/www/app/(app)/transcripts/[transcriptId]/upload/page.tsx
+++ b/www/app/(app)/transcripts/[transcriptId]/upload/page.tsx
@@ -1,12 +1,12 @@
 "use client";
 import { useEffect, useState } from "react";
+import useTranscript from "../../useTranscript";
 import { useWebSockets } from "../../useWebSockets";
 import { lockWakeState, releaseWakeState } from "../../../../lib/wakeLock";
 import { useRouter } from "next/navigation";
 import useMp3 from "../../useMp3";
 import { Center, VStack, Text, Heading, Button } from "@chakra-ui/react";
 import FileUploadButton from "../../fileUploadButton";
-import { useTranscriptGet } from "../../../../lib/apiHooks";

 type TranscriptUpload = {
  params: {
@@ -15,7 +15,7 @@ type TranscriptUpload = {
 };

 const TranscriptUpload = (details: TranscriptUpload) => {
-  const transcript = useTranscriptGet(details.params.transcriptId);
+  const transcript = useTranscript(details.params.transcriptId);
  const [transcriptStarted, setTranscriptStarted] = useState(false);

  const webSockets = useWebSockets(details.params.transcriptId);
@@ -25,13 +25,13 @@ const TranscriptUpload = (details: TranscriptUpload) => {
  const router = useRouter();

  const [status_, setStatus] = useState(
-    webSockets.status?.value || transcript.data?.status || "idle",
+    webSockets.status.value || transcript.response?.status || "idle",
  );

  // status is obviously done if we have transcript
  const status =
-    !transcript.isLoading && transcript.data?.status === "ended"
-      ? transcript.data?.status
+    !transcript.loading && transcript.response?.status === "ended"
+      ? transcript.response?.status
      : status_;

  useEffect(() => {
@@ -43,9 +43,9 @@ const TranscriptUpload = (details: TranscriptUpload) => {
    //TODO HANDLE ERROR STATUS BETTER
    // TODO deprecate webSockets.status.value / depend on transcript.response?.status from query lib
    const newStatus =
-      transcript.data?.status === "ended"
+      transcript.response?.status === "ended"
        ? "ended"
-        : webSockets.status?.value || transcript.data?.status || "idle";
+        : webSockets.status.value || transcript.response?.status || "idle";
    setStatus(newStatus);
    if (newStatus && (newStatus == "ended" || newStatus == "error")) {
      console.log(newStatus, "redirecting");
@@ -53,7 +53,7 @@ const TranscriptUpload = (details: TranscriptUpload) => {
      const newUrl = "/transcripts/" + details.params.transcriptId;
      router.replace(newUrl);
    }
-  }, [webSockets.status?.value, transcript.data?.status]);
+  }, [webSockets.status.value, transcript.response?.status]);

  useEffect(() => {
    if (webSockets.waveform && webSockets.waveform) mp3.getNow();
--- a/www/app/(app)/transcripts/new/page.tsx
+++ b/www/app/(app)/transcripts/new/page.tsx
@@ -9,6 +9,7 @@ import { useRouter } from "next/navigation";
 import useCreateTranscript from "../createTranscript";
 import SelectSearch from "react-select-search";
 import { supportedLanguages } from "../../../supportedLanguages";
+import { featureEnabled } from "../../../domainContext";
 import {
  Flex,
  Box,
@@ -20,9 +21,10 @@ import {
  Spacer,
 } from "@chakra-ui/react";
 import { useAuth } from "../../../lib/AuthProvider";
-import { featureEnabled } from "../../../lib/features";
+import type { components } from "../../../reflector-api";

 const TranscriptCreate = () => {
+  const isClient = typeof window !== "undefined";
  const router = useRouter();
  const auth = useAuth();
  const isAuthenticated = auth.status === "authenticated";
@@ -174,7 +176,7 @@ const TranscriptCreate = () => {
                    placeholder="Choose your language"
                  />
                </Box>
-                {!loading ? (
+                {isClient && !loading ? (
                  permissionOk ? (
                    <Spacer />
                  ) : permissionDenied ? (
--- a/www/app/(app)/transcripts/recorder.tsx
+++ b/www/app/(app)/transcripts/recorder.tsx
@@ -11,11 +11,10 @@ import useAudioDevice from "./useAudioDevice";
 import { Box, Flex, IconButton, Menu, RadioGroup } from "@chakra-ui/react";
 import { LuScreenShare, LuMic, LuPlay, LuCircleStop } from "react-icons/lu";
 import { RECORD_A_MEETING_URL } from "../../api/urls";
-import { TranscriptStatus } from "../../lib/transcript";

 type RecorderProps = {
  transcriptId: string;
-  status: TranscriptStatus;
+  status: string;
 };

 export default function Recorder(props: RecorderProps) {
--- a/www/app/(app)/transcripts/shareAndPrivacy.tsx
+++ b/www/app/(app)/transcripts/shareAndPrivacy.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useState } from "react";
+import { featureEnabled } from "../../domainContext";

 import { ShareMode, toShareMode } from "../../lib/shareMode";
 import type { components } from "../../reflector-api";
@@ -23,8 +24,6 @@ import ShareCopy from "./shareCopy";
 import ShareZulip from "./shareZulip";
 import { useAuth } from "../../lib/AuthProvider";

-import { featureEnabled } from "../../lib/features";
-
 type ShareAndPrivacyProps = {
  finalSummaryRef: any;
  transcriptResponse: GetTranscript;
--- a/www/app/(app)/transcripts/shareLink.tsx
+++ b/www/app/(app)/transcripts/shareLink.tsx
@@ -1,9 +1,8 @@
 import React, { useState, useRef, useEffect, use } from "react";
+import { featureEnabled } from "../../domainContext";
 import { Button, Flex, Input, Text } from "@chakra-ui/react";
 import QRCode from "react-qr-code";

-import { featureEnabled } from "../../lib/features";
-
 type ShareLinkProps = {
  transcriptId: string;
 };
--- a/www/app/(app)/transcripts/shareZulip.tsx
+++ b/www/app/(app)/transcripts/shareZulip.tsx
@@ -1,4 +1,5 @@
 import { useState, useEffect, useMemo } from "react";
+import { featureEnabled } from "../../domainContext";
 import type { components } from "../../reflector-api";

 type GetTranscript = components["schemas"]["GetTranscript"];
@@ -24,8 +25,6 @@ import {
  useTranscriptPostToZulip,
 } from "../../lib/apiHooks";

-import { featureEnabled } from "../../lib/features";
-
 type ShareZulipProps = {
  transcriptResponse: GetTranscript;
  topicsResponse: GetTranscriptTopic[];
--- a/www/app/(app)/transcripts/useMp3.ts
+++ b/www/app/(app)/transcripts/useMp3.ts
@@ -1,7 +1,7 @@
-import { useEffect, useState } from "react";
+import { useContext, useEffect, useState } from "react";
+import { DomainContext } from "../../domainContext";
 import { useTranscriptGet } from "../../lib/apiHooks";
 import { useAuth } from "../../lib/AuthProvider";
-import { API_URL } from "../../lib/apiClient";

 export type Mp3Response = {
  media: HTMLMediaElement | null;
@@ -19,6 +19,7 @@ const useMp3 = (transcriptId: string, waiting?: boolean): Mp3Response => {
    null,
  );
  const [audioDeleted, setAudioDeleted] = useState<boolean | null>(null);
+  const { api_url } = useContext(DomainContext);
  const auth = useAuth();
  const accessTokenInfo =
    auth.status === "authenticated" ? auth.accessToken : null;
@@ -77,7 +78,7 @@ const useMp3 = (transcriptId: string, waiting?: boolean): Mp3Response => {

    // Audio is not deleted, proceed to load it
    audioElement = document.createElement("audio");
-    audioElement.src = `${API_URL}/v1/transcripts/${transcriptId}/audio/mp3`;
+    audioElement.src = `${api_url}/v1/transcripts/${transcriptId}/audio/mp3`;
    audioElement.crossOrigin = "anonymous";
    audioElement.preload = "auto";

@@ -109,7 +110,7 @@ const useMp3 = (transcriptId: string, waiting?: boolean): Mp3Response => {
        if (handleError) audioElement.removeEventListener("error", handleError);
      }
    };
-  }, [transcriptId, transcript, later]);
+  }, [transcriptId, transcript, later, api_url]);

  const getNow = () => {
    setLater(false);
--- a/www/app/(app)/transcripts/useTranscript.ts
+++ b/www/app/(app)/transcripts/useTranscript.ts
@@ -0,0 +1,69 @@
+import type { components } from "../../reflector-api";
+import { useTranscriptGet } from "../../lib/apiHooks";
+
+type GetTranscript = components["schemas"]["GetTranscript"];
+
+type ErrorTranscript = {
+  error: Error;
+  loading: false;
+  response: null;
+  reload: () => void;
+};
+
+type LoadingTranscript = {
+  response: null;
+  loading: true;
+  error: false;
+  reload: () => void;
+};
+
+type SuccessTranscript = {
+  response: GetTranscript;
+  loading: false;
+  error: null;
+  reload: () => void;
+};
+
+const useTranscript = (
+  id: string | null,
+): ErrorTranscript | LoadingTranscript | SuccessTranscript => {
+  const { data, isLoading, error, refetch } = useTranscriptGet(id);
+
+  // Map to the expected return format
+  if (isLoading) {
+    return {
+      response: null,
+      loading: true,
+      error: false,
+      reload: refetch,
+    };
+  }
+
+  if (error) {
+    return {
+      error: error as Error,
+      loading: false,
+      response: null,
+      reload: refetch,
+    };
+  }
+
+  // Check if data is undefined or null
+  if (!data) {
+    return {
+      response: null,
+      loading: true,
+      error: false,
+      reload: refetch,
+    };
+  }
+
+  return {
+    response: data,
+    loading: false,
+    error: null,
+    reload: refetch,
+  };
+};
+
+export default useTranscript;
--- a/www/app/(app)/transcripts/useWebSockets.ts
+++ b/www/app/(app)/transcripts/useWebSockets.ts
@@ -1,12 +1,13 @@
-import { useEffect, useState } from "react";
+import { useContext, useEffect, useState } from "react";
 import { Topic, FinalSummary, Status } from "./webSocketTypes";
 import { useError } from "../../(errors)/errorContext";
+import { DomainContext } from "../../domainContext";
 import type { components } from "../../reflector-api";
 type AudioWaveform = components["schemas"]["AudioWaveform"];
 type GetTranscriptSegmentTopic =
  components["schemas"]["GetTranscriptSegmentTopic"];
 import { useQueryClient } from "@tanstack/react-query";
-import { $api, WEBSOCKET_URL } from "../../lib/apiClient";
+import { $api } from "../../lib/apiClient";

 export type UseWebSockets = {
  transcriptTextLive: string;
@@ -15,7 +16,7 @@ export type UseWebSockets = {
  title: string;
  topics: Topic[];
  finalSummary: FinalSummary;
-  status: Status | null;
+  status: Status;
  waveform: AudioWaveform | null;
  duration: number | null;
 };
@@ -33,9 +34,10 @@ export const useWebSockets = (transcriptId: string | null): UseWebSockets => {
  const [finalSummary, setFinalSummary] = useState<FinalSummary>({
    summary: "",
  });
-  const [status, setStatus] = useState<Status | null>(null);
+  const [status, setStatus] = useState<Status>({ value: "" });
  const { setError } = useError();

+  const { websocket_url: websocketUrl } = useContext(DomainContext);
  const queryClient = useQueryClient();

  const [accumulatedText, setAccumulatedText] = useState<string>("");
@@ -326,7 +328,7 @@ export const useWebSockets = (transcriptId: string | null): UseWebSockets => {

    if (!transcriptId) return;

-    const url = `${WEBSOCKET_URL}/v1/transcripts/${transcriptId}/events`;
+    const url = `${websocketUrl}/v1/transcripts/${transcriptId}/events`;
    let ws = new WebSocket(url);

    ws.onopen = () => {
@@ -492,7 +494,7 @@ export const useWebSockets = (transcriptId: string | null): UseWebSockets => {
    return () => {
      ws.close();
    };
-  }, [transcriptId]);
+  }, [transcriptId, websocketUrl]);

  return {
    transcriptTextLive,
--- a/www/app/(app)/transcripts/webSocketTypes.ts
+++ b/www/app/(app)/transcripts/webSocketTypes.ts
@@ -1,5 +1,4 @@
 import type { components } from "../../reflector-api";
-import type { TranscriptStatus } from "../../lib/transcript";

 type GetTranscriptTopic = components["schemas"]["GetTranscriptTopic"];

@@ -14,7 +13,7 @@ export type FinalSummary = {
 };

 export type Status = {
-  value: TranscriptStatus;
+  value: string;
 };

 export type TranslatedTopic = {
--- a/www/app/domainContext.tsx
+++ b/www/app/domainContext.tsx
@@ -0,0 +1,49 @@
+"use client";
+import { createContext, useContext, useEffect, useState } from "react";
+import { DomainConfig } from "./lib/edgeConfig";
+
+type DomainContextType = Omit<DomainConfig, "auth_callback_url">;
+
+export const DomainContext = createContext<DomainContextType>({
+  features: {
+    requireLogin: false,
+    privacy: true,
+    browse: false,
+    sendToZulip: false,
+  },
+  api_url: "",
+  websocket_url: "",
+});
+
+export const DomainContextProvider = ({
+  config,
+  children,
+}: {
+  config: DomainConfig;
+  children: any;
+}) => {
+  const [context, setContext] = useState<DomainContextType>();
+
+  useEffect(() => {
+    if (!config) return;
+    const { auth_callback_url, ...others } = config;
+    setContext(others);
+  }, [config]);
+
+  if (!context) return;
+
+  return (
+    <DomainContext.Provider value={context}>{children}</DomainContext.Provider>
+  );
+};
+
+// Get feature config client-side with
+export const featureEnabled = (
+  featureName: "requireLogin" | "privacy" | "browse" | "sendToZulip",
+) => {
+  const context = useContext(DomainContext);
+
+  return context.features[featureName] as boolean | undefined;
+};
+
+// Get config server-side (out of react) : see lib/edgeConfig.
--- a/www/app/layout.tsx
+++ b/www/app/layout.tsx
@@ -3,7 +3,9 @@ import { Metadata, Viewport } from "next";
 import { Poppins } from "next/font/google";
 import { ErrorProvider } from "./(errors)/errorContext";
 import ErrorMessage from "./(errors)/errorMessage";
+import { DomainContextProvider } from "./domainContext";
 import { RecordingConsentProvider } from "./recordingConsentContext";
+import { getConfig } from "./lib/edgeConfig";
 import { ErrorBoundary } from "@sentry/nextjs";
 import { Providers } from "./providers";

@@ -66,17 +68,21 @@ export default async function RootLayout({
 }: {
  children: React.ReactNode;
 }) {
+  const config = await getConfig();
+
  return (
    <html lang="en" className={poppins.className} suppressHydrationWarning>
      <body className={"h-[100svh] w-[100svw] overflow-x-hidden relative"}>
-        <RecordingConsentProvider>
-          <ErrorBoundary fallback={<p>"something went really wrong"</p>}>
-            <ErrorProvider>
-              <ErrorMessage />
-              <Providers>{children}</Providers>
-            </ErrorProvider>
-          </ErrorBoundary>
-        </RecordingConsentProvider>
+        <DomainContextProvider config={config}>
+          <RecordingConsentProvider>
+            <ErrorBoundary fallback={<p>"something went really wrong"</p>}>
+              <ErrorProvider>
+                <ErrorMessage />
+                <Providers>{children}</Providers>
+              </ErrorProvider>
+            </ErrorBoundary>
+          </RecordingConsentProvider>
+        </DomainContextProvider>
      </body>
    </html>
  );
--- a/www/app/lib/AuthProvider.tsx
+++ b/www/app/lib/AuthProvider.tsx
@@ -1,18 +1,17 @@
 "use client";

-import { createContext, useContext } from "react";
+import { createContext, useContext, useEffect } from "react";
 import { useSession as useNextAuthSession } from "next-auth/react";
 import { signOut, signIn } from "next-auth/react";
-import { configureApiAuth } from "./apiClient";
+import { configureApiAuth, configureApiAuthRefresh } from "./apiClient";
 import { assertCustomSession, CustomSession } from "./types";
 import { Session } from "next-auth";
 import { SessionAutoRefresh } from "./SessionAutoRefresh";
 import { REFRESH_ACCESS_TOKEN_ERROR } from "./auth";
-import { assertExists } from "./utils";

 type AuthContextType = (
  | { status: "loading" }
-  | { status: "refreshing"; user: CustomSession["user"] }
+  | { status: "refreshing" }
  | { status: "unauthenticated"; error?: string }
  | {
      status: "authenticated";
@@ -42,10 +41,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
              return { status };
            }
            case true: {
-              return {
-                status: "refreshing" as const,
-                user: assertExists(customSession).user,
-              };
+              return { status: "refreshing" as const };
            }
            default: {
              const _: never = sessionIsHere;
@@ -88,15 +84,16 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
  };

  // not useEffect, we need it ASAP
-  // apparently, still no guarantee this code runs before mutations are fired
  configureApiAuth(
-    contextValue.status === "authenticated"
-      ? contextValue.accessToken
-      : contextValue.status === "loading"
-        ? undefined
-        : null,
+    contextValue.status === "authenticated" ? contextValue.accessToken : null,
  );

+  useEffect(() => {
+    configureApiAuthRefresh(
+      contextValue.status === "authenticated" ? contextValue.update : null,
+    );
+  }, [contextValue.status === "authenticated" && contextValue.update]);
+
  return (
    <AuthContext.Provider value={contextValue}>
      <SessionAutoRefresh>{children}</SessionAutoRefresh>
--- a/www/app/lib/SessionAutoRefresh.tsx
+++ b/www/app/lib/SessionAutoRefresh.tsx
@@ -9,11 +9,12 @@

 import { useEffect } from "react";
 import { useAuth } from "./AuthProvider";
-import { shouldRefreshToken } from "./auth";
+import { REFRESH_ACCESS_TOKEN_BEFORE } from "./auth";
+
+const REFRESH_BEFORE = REFRESH_ACCESS_TOKEN_BEFORE;

 export function SessionAutoRefresh({ children }) {
  const auth = useAuth();
-
  const accessTokenExpires =
    auth.status === "authenticated" ? auth.accessTokenExpires : null;

@@ -22,15 +23,18 @@ export function SessionAutoRefresh({ children }) {
    // and not too slow (debuggable)
    const INTERVAL_REFRESH_MS = 5000;
    const interval = setInterval(() => {
-      if (accessTokenExpires === null) return;
-      if (shouldRefreshToken(accessTokenExpires)) {
-        auth
-          .update()
-          .then(() => {})
-          .catch((e) => {
-            // note: 401 won't be considered error here
-            console.error("error refreshing auth token", e);
-          });
+      if (accessTokenExpires !== null) {
+        const timeLeft = accessTokenExpires - Date.now();
+        console.log("time left", timeLeft);
+        // if (timeLeft < REFRESH_BEFORE) {
+        //   auth
+        //     .update()
+        //     .then(() => {})
+        //     .catch((e) => {
+        //       // note: 401 won't be considered error here
+        //       console.error("error refreshing auth token", e);
+        //     });
+        // }
      }
    }, INTERVAL_REFRESH_MS);

--- a/www/app/lib/apiClient.tsx
+++ b/www/app/lib/apiClient.tsx
@@ -2,46 +2,46 @@

 import createClient from "openapi-fetch";
 import type { paths } from "../reflector-api";
+import {
+  queryOptions,
+  useMutation,
+  useQuery,
+  useSuspenseQuery,
+} from "@tanstack/react-query";
 import createFetchClient from "openapi-react-query";
 import { assertExistsAndNonEmptyString } from "./utils";
 import { isBuildPhase } from "./next";
+import { Session } from "next-auth";
+import { assertCustomSession } from "./types";
+import { HttpMethod, PathsWithMethod } from "openapi-typescript-helpers";

-export const API_URL = !isBuildPhase
+const API_URL = !isBuildPhase
  ? assertExistsAndNonEmptyString(process.env.NEXT_PUBLIC_API_URL)
  : "http://localhost";

-// TODO decide strict validation or not
-export const WEBSOCKET_URL =
-  process.env.NEXT_PUBLIC_WEBSOCKET_URL || "ws://127.0.0.1:1250";
-
+// Create the base openapi-fetch client with a default URL
+// The actual URL will be set via middleware in AuthProvider
 export const client = createClient<paths>({
  baseUrl: API_URL,
 });

-const waitForAuthTokenDefinitivePresenceOrAbscence = async () => {
-  let tries = 0;
-  let time = 0;
-  const STEP = 100;
-  while (currentAuthToken === undefined) {
-    await new Promise((resolve) => setTimeout(resolve, STEP));
-    time += STEP;
-    tries++;
-    // most likely first try is more than enough, if it's more there's already something weird happens
-    if (tries > 10) {
-      // even when there's no auth assumed at all, we probably should explicitly call configureApiAuth(null)
-      throw new Error(
-        `Could not get auth token definitive presence/absence in ${time}ms. not calling configureApiAuth?`,
-      );
-    }
+export const $api = createFetchClient<paths>(client);
+
+let currentAuthToken: string | null | undefined = null;
+let refreshAuthCallback: (() => Promise<Session | null>) | null = null;
+
+const injectAuth = (request: Request, accessToken: string | null) => {
+  if (accessToken) {
+    request.headers.set("Authorization", `Bearer ${currentAuthToken}`);
+  } else {
+    request.headers.delete("Authorization");
  }
+  return request;
 };

 client.use({
-  async onRequest({ request }) {
-    await waitForAuthTokenDefinitivePresenceOrAbscence();
-    if (currentAuthToken) {
-      request.headers.set("Authorization", `Bearer ${currentAuthToken}`);
-    }
+  onRequest({ request }) {
+    request = injectAuth(request, currentAuthToken || null);
    // XXX Only set Content-Type if not already set (FormData will set its own boundary)
    // This is a work around for uploading file, we're passing a formdata
    // but the content type was still application/json
@@ -55,13 +55,46 @@ client.use({
  },
 });

-export const $api = createFetchClient<paths>(client);
-
-let currentAuthToken: string | null | undefined = undefined;
+client.use({
+  async onResponse({ response, request, params, schemaPath }) {
+    if (response.status === 401) {
+      console.log(
+        "response.status is 401!",
+        refreshAuthCallback,
+        request,
+        schemaPath,
+      );
+    }
+    if (response.status === 401 && refreshAuthCallback) {
+      try {
+        const session = await refreshAuthCallback();
+        if (!session) {
+          console.warn("Token refresh failed, no session returned");
+          return response;
+        }
+        const customSession = assertCustomSession(session);
+        currentAuthToken = customSession.accessToken;
+        const r = await client.request(
+          request.method as HttpMethod,
+          schemaPath as PathsWithMethod<paths, HttpMethod>,
+          ...params,
+        );
+        return r.response;
+      } catch (error) {
+        console.error("Token refresh failed during 401 retry:", error);
+      }
+    }
+    return response;
+  },
+});

 // the function contract: lightweight, idempotent
 export const configureApiAuth = (token: string | null | undefined) => {
-  // watch only for the initial loading; "reloading" state assumes token presence/absence
-  if (token === undefined && currentAuthToken !== undefined) return;
  currentAuthToken = token;
 };
+
+export const configureApiAuthRefresh = (
+  callback: (() => Promise<Session | null>) | null,
+) => {
+  refreshAuthCallback = callback;
+};
--- a/www/app/lib/apiHooks.ts
+++ b/www/app/lib/apiHooks.ts
@@ -96,6 +96,8 @@ export function useTranscriptProcess() {
 }

 export function useTranscriptGet(transcriptId: string | null) {
+  const { isAuthenticated } = useAuthReady();
+
  return $api.useQuery(
    "get",
    "/v1/transcripts/{transcript_id}",
@@ -107,7 +109,7 @@ export function useTranscriptGet(transcriptId: string | null) {
      },
    },
    {
-      enabled: !!transcriptId,
+      enabled: !!transcriptId && isAuthenticated,
    },
  );
 }
@@ -290,16 +292,18 @@ export function useTranscriptUploadAudio() {
 }

 export function useTranscriptWaveform(transcriptId: string | null) {
+  const { isAuthenticated } = useAuthReady();
+
  return $api.useQuery(
    "get",
    "/v1/transcripts/{transcript_id}/audio/waveform",
    {
      params: {
-        path: { transcript_id: transcriptId! },
+        path: { transcript_id: transcriptId || "" },
      },
    },
    {
-      enabled: !!transcriptId,
+      enabled: !!transcriptId && isAuthenticated,
    },
  );
 }
@@ -312,7 +316,7 @@ export function useTranscriptMP3(transcriptId: string | null) {
    "/v1/transcripts/{transcript_id}/audio/mp3",
    {
      params: {
-        path: { transcript_id: transcriptId! },
+        path: { transcript_id: transcriptId || "" },
      },
    },
    {
@@ -322,6 +326,8 @@ export function useTranscriptMP3(transcriptId: string | null) {
 }

 export function useTranscriptTopics(transcriptId: string | null) {
+  const { isAuthenticated } = useAuthReady();
+
  return $api.useQuery(
    "get",
    "/v1/transcripts/{transcript_id}/topics",
@@ -331,7 +337,7 @@ export function useTranscriptTopics(transcriptId: string | null) {
      },
    },
    {
-      enabled: !!transcriptId,
+      enabled: !!transcriptId && isAuthenticated,
    },
  );
 }
--- a/www/app/lib/auth.ts
+++ b/www/app/lib/auth.ts
@@ -1,20 +1,3 @@
-import { assertExistsAndNonEmptyString } from "./utils";
-
 export const REFRESH_ACCESS_TOKEN_ERROR = "RefreshAccessTokenError" as const;
 // 4 min is 1 min less than default authentic value. here we assume that authentic won't be set to access tokens < 4 min
 export const REFRESH_ACCESS_TOKEN_BEFORE = 4 * 60 * 1000;
-
-export const shouldRefreshToken = (accessTokenExpires: number): boolean => {
-  const timeLeft = accessTokenExpires - Date.now();
-  return timeLeft < REFRESH_ACCESS_TOKEN_BEFORE;
-};
-
-export const LOGIN_REQUIRED_PAGES = [
-  "/transcripts/[!new]",
-  "/browse(.*)",
-  "/rooms(.*)",
-];
-
-export const PROTECTED_PAGES = new RegExp(
-  LOGIN_REQUIRED_PAGES.map((page) => `^${page}$`).join("|"),
-);
--- a/www/app/lib/authBackend.ts
+++ b/www/app/lib/authBackend.ts
@@ -2,25 +2,24 @@ import { AuthOptions } from "next-auth";
 import AuthentikProvider from "next-auth/providers/authentik";
 import type { JWT } from "next-auth/jwt";
 import { JWTWithAccessToken, CustomSession } from "./types";
-import {
-  assertExists,
-  assertExistsAndNonEmptyString,
-  assertNotExists,
-} from "./utils";
+import { assertExists, assertExistsAndNonEmptyString } from "./utils";
 import {
  REFRESH_ACCESS_TOKEN_BEFORE,
  REFRESH_ACCESS_TOKEN_ERROR,
-  shouldRefreshToken,
 } from "./auth";
 import {
  getTokenCache,
  setTokenCache,
  deleteTokenCache,
 } from "./redisTokenCache";
-import { tokenCacheRedis, redlock } from "./redisClient";
+import { tokenCacheRedis } from "./redisClient";
 import { isBuildPhase } from "./next";

+// REFRESH_ACCESS_TOKEN_BEFORE because refresh is based on access token expiration (imagine we cache it 30 days)
 const TOKEN_CACHE_TTL = REFRESH_ACCESS_TOKEN_BEFORE;
+
+const refreshLocks = new Map<string, Promise<JWTWithAccessToken>>();
+
 const CLIENT_ID = !isBuildPhase
  ? assertExistsAndNonEmptyString(process.env.AUTHENTIK_CLIENT_ID)
  : "noop";
@@ -46,53 +45,40 @@ export const authOptions: AuthOptions = {
  },
  callbacks: {
    async jwt({ token, account, user }) {
-      if (account && !account.access_token) {
-        await deleteTokenCache(tokenCacheRedis, `token:${token.sub}`);
-      }
+      console.log("token.sub jwt callback", token.sub);
+      const KEY = `token:${token.sub}`;

      if (account && user) {
        // called only on first login
        // XXX account.expires_in used in example is not defined for authentik backend, but expires_at is
-        if (account.access_token) {
-          const expiresAtS = assertExists(account.expires_at);
-          const expiresAtMs = expiresAtS * 1000;
+        const expiresAtS = assertExists(account.expires_at);
+        const expiresAtMs = expiresAtS * 1000;
+        if (!account.access_token) {
+          await deleteTokenCache(tokenCacheRedis, KEY);
+        } else {
          const jwtToken: JWTWithAccessToken = {
            ...token,
            accessToken: account.access_token,
            accessTokenExpires: expiresAtMs,
            refreshToken: account.refresh_token,
          };
-          if (jwtToken.error) {
-            await deleteTokenCache(tokenCacheRedis, `token:${token.sub}`);
-          } else {
-            assertNotExists(
-              jwtToken.error,
-              `panic! trying to cache token with error in jwt: ${jwtToken.error}`,
-            );
-            await setTokenCache(tokenCacheRedis, `token:${token.sub}`, {
-              token: jwtToken,
-              timestamp: Date.now(),
-            });
-            return jwtToken;
-          }
+          await setTokenCache(tokenCacheRedis, KEY, {
+            token: jwtToken,
+            timestamp: Date.now(),
+          });
+          return jwtToken;
        }
      }

-      const currentToken = await getTokenCache(
-        tokenCacheRedis,
-        `token:${token.sub}`,
+      const currentToken = await getTokenCache(tokenCacheRedis, KEY);
+      console.log(
+        "currentToken.token.accessTokenExpires",
+        currentToken?.token?.accessTokenExpires,
+        currentToken?.token?.accessTokenExpires
+          ? Date.now() < currentToken?.token?.accessTokenExpires
+          : "?",
      );
-      console.debug(
-        "currentToken from cache",
-        JSON.stringify(currentToken, null, 2),
-        "will be returned?",
-        currentToken &&
-          !shouldRefreshToken(currentToken.token.accessTokenExpires),
-      );
-      if (
-        currentToken &&
-        !shouldRefreshToken(currentToken.token.accessTokenExpires)
-      ) {
+      if (currentToken && Date.now() < currentToken.token.accessTokenExpires) {
        return currentToken.token;
      }

@@ -119,22 +105,20 @@ export const authOptions: AuthOptions = {
 async function lockedRefreshAccessToken(
  token: JWT,
 ): Promise<JWTWithAccessToken> {
-  const lockKey = `${token.sub}-lock`;
+  const lockKey = `${token.sub}-refresh`;

-  return redlock
-    .using([lockKey], 10000, async () => {
+  const existingRefresh = refreshLocks.get(lockKey);
+  if (existingRefresh) {
+    return await existingRefresh;
+  }
+
+  const refreshPromise = (async () => {
+    try {
      const cached = await getTokenCache(tokenCacheRedis, `token:${token.sub}`);
-      if (cached)
-        console.debug(
-          "received cached token. to delete?",
-          Date.now() - cached.timestamp > TOKEN_CACHE_TTL,
-        );
-      else console.debug("no cached token received");
      if (cached) {
        if (Date.now() - cached.timestamp > TOKEN_CACHE_TTL) {
          await deleteTokenCache(tokenCacheRedis, `token:${token.sub}`);
-        } else if (!shouldRefreshToken(cached.token.accessTokenExpires)) {
-          console.debug("returning cached token", cached.token);
+        } else if (Date.now() < cached.token.accessTokenExpires) {
          return cached.token;
        }
      }
@@ -142,35 +126,19 @@ async function lockedRefreshAccessToken(
      const currentToken = cached?.token || (token as JWTWithAccessToken);
      const newToken = await refreshAccessToken(currentToken);

-      console.debug("current token during refresh", currentToken);
-      console.debug("new token during refresh", newToken);
-
-      if (newToken.error) {
-        await deleteTokenCache(tokenCacheRedis, `token:${token.sub}`);
-        return newToken;
-      }
-
-      assertNotExists(
-        newToken.error,
-        `panic! trying to cache token with error during refresh: ${newToken.error}`,
-      );
      await setTokenCache(tokenCacheRedis, `token:${token.sub}`, {
        token: newToken,
        timestamp: Date.now(),
      });

      return newToken;
-    })
-    .catch((e) => {
-      console.error("error refreshing token", e);
-      deleteTokenCache(tokenCacheRedis, `token:${token.sub}`).catch((e) => {
-        console.error("error deleting errored token", e);
-      });
-      return {
-        ...token,
-        error: REFRESH_ACCESS_TOKEN_ERROR,
-      } as JWTWithAccessToken;
-    });
+    } finally {
+      setTimeout(() => refreshLocks.delete(lockKey), 100);
+    }
+  })();
+
+  refreshLocks.set(lockKey, refreshPromise);
+  return refreshPromise;
 }

 async function refreshAccessToken(token: JWT): Promise<JWTWithAccessToken> {
--- a/www/app/lib/edgeConfig.ts
+++ b/www/app/lib/edgeConfig.ts
@@ -0,0 +1,54 @@
+import { get } from "@vercel/edge-config";
+import { isBuildPhase } from "./next";
+
+type EdgeConfig = {
+  [domainWithDash: string]: {
+    features: {
+      [featureName in
+        | "requireLogin"
+        | "privacy"
+        | "browse"
+        | "sendToZulip"]: boolean;
+    };
+    auth_callback_url: string;
+    websocket_url: string;
+    api_url: string;
+  };
+};
+
+export type DomainConfig = EdgeConfig["domainWithDash"];
+
+// Edge config main keys can only be alphanumeric and _ or -
+export function edgeKeyToDomain(key: string) {
+  return key.replaceAll("_", ".");
+}
+
+export function edgeDomainToKey(domain: string) {
+  return domain.replaceAll(".", "_");
+}
+
+// get edge config server-side (prefer DomainContext when available), domain is the hostname
+export async function getConfig() {
+  if (process.env.NEXT_PUBLIC_ENV === "development") {
+    try {
+      return require("../../config").localConfig;
+    } catch (e) {
+      // next build() WILL try to execute the require above even if conditionally protected
+      // but thank god it at least runs catch{} block properly
+      if (!isBuildPhase) throw new Error(e);
+      return require("../../config-template").localConfig;
+    }
+  }
+
+  const domain = new URL(process.env.NEXT_PUBLIC_SITE_URL!).hostname;
+  let config = await get(edgeDomainToKey(domain));
+
+  if (typeof config !== "object") {
+    console.warn("No config for this domain, falling back to default");
+    config = await get(edgeDomainToKey("default"));
+  }
+
+  if (typeof config !== "object") throw Error("Error fetching config");
+
+  return config as DomainConfig;
+}
--- a/www/app/lib/features.ts
+++ b/www/app/lib/features.ts
@@ -1,55 +0,0 @@
-export const FEATURES = [
-  "requireLogin",
-  "privacy",
-  "browse",
-  "sendToZulip",
-  "rooms",
-] as const;
-
-export type FeatureName = (typeof FEATURES)[number];
-
-export type Features = Readonly<Record<FeatureName, boolean>>;
-
-export const DEFAULT_FEATURES: Features = {
-  requireLogin: false,
-  privacy: true,
-  browse: false,
-  sendToZulip: false,
-  rooms: false,
-} as const;
-
-function parseBooleanEnv(
-  value: string | undefined,
-  defaultValue: boolean = false,
-): boolean {
-  if (!value) return defaultValue;
-  return value.toLowerCase() === "true";
-}
-
-// WARNING: keep process.env.* as-is, next.js won't see them if you generate dynamically
-const features: Features = {
-  requireLogin: parseBooleanEnv(
-    process.env.NEXT_PUBLIC_FEATURE_REQUIRE_LOGIN,
-    DEFAULT_FEATURES.requireLogin,
-  ),
-  privacy: parseBooleanEnv(
-    process.env.NEXT_PUBLIC_FEATURE_PRIVACY,
-    DEFAULT_FEATURES.privacy,
-  ),
-  browse: parseBooleanEnv(
-    process.env.NEXT_PUBLIC_FEATURE_BROWSE,
-    DEFAULT_FEATURES.browse,
-  ),
-  sendToZulip: parseBooleanEnv(
-    process.env.NEXT_PUBLIC_FEATURE_SEND_TO_ZULIP,
-    DEFAULT_FEATURES.sendToZulip,
-  ),
-  rooms: parseBooleanEnv(
-    process.env.NEXT_PUBLIC_FEATURE_ROOMS,
-    DEFAULT_FEATURES.rooms,
-  ),
-};
-
-export const featureEnabled = (featureName: FeatureName): boolean => {
-  return features[featureName];
-};
--- a/www/app/lib/redisClient.ts
+++ b/www/app/lib/redisClient.ts
@@ -1,41 +1,30 @@
 import Redis from "ioredis";
 import { isBuildPhase } from "./next";
-import Redlock, { ResourceLockedError } from "redlock";

 export type RedisClient = Pick<Redis, "get" | "setex" | "del">;
-export type RedlockClient = {
-  using: <T>(
-    keys: string | string[],
-    ttl: number,
-    cb: () => Promise<T>,
-  ) => Promise<T>;
-};
-const KV_USE_TLS = process.env.KV_USE_TLS
-  ? process.env.KV_USE_TLS === "true"
-  : undefined;
-
-let redisClient: Redis | null = null;

 const getRedisClient = (): RedisClient => {
-  if (redisClient) return redisClient;
  const redisUrl = process.env.KV_URL;
  if (!redisUrl) {
    throw new Error("KV_URL environment variable is required");
  }
-  redisClient = new Redis(redisUrl, {
+  const redis = new Redis(redisUrl, {
    maxRetriesPerRequest: 3,
-    ...(KV_USE_TLS === true
-      ? {
-          tls: {},
-        }
-      : {}),
+    lazyConnect: true,
  });

-  redisClient.on("error", (error) => {
+  redis.on("error", (error) => {
    console.error("Redis error:", error);
  });

-  return redisClient;
+  // not necessary but will indicate redis config errors by failfast at startup
+  // happens only once; after that connection is allowed to die and the lib is assumed to be able to restore it eventually
+  redis.connect().catch((e) => {
+    console.error("Failed to connect to Redis:", e);
+    process.exit(1);
+  });
+
+  return redis;
 };

 // next.js buildtime usage - we want to isolate next.js "build" time concepts here
@@ -54,25 +43,4 @@ const noopClient: RedisClient = (() => {
    del: noopDel,
  };
 })();
-
-const noopRedlock: RedlockClient = {
-  using: <T>(resource: string | string[], ttl: number, cb: () => Promise<T>) =>
-    cb(),
-};
-
-export const redlock: RedlockClient = isBuildPhase
-  ? noopRedlock
-  : (() => {
-      const r = new Redlock([getRedisClient()], {});
-      r.on("error", (error) => {
-        if (error instanceof ResourceLockedError) {
-          return;
-        }
-
-        // Log all other errors.
-        console.error(error);
-      });
-      return r;
-    })();
-
 export const tokenCacheRedis = isBuildPhase ? noopClient : getRedisClient();
--- a/www/app/lib/redisTokenCache.ts
+++ b/www/app/lib/redisTokenCache.ts
@@ -9,6 +9,7 @@ const TokenCacheEntrySchema = z.object({
    accessToken: z.string(),
    accessTokenExpires: z.number(),
    refreshToken: z.string().optional(),
+    error: z.string().optional(),
  }),
  timestamp: z.number(),
 });
@@ -45,15 +46,14 @@ export async function getTokenCache(
  }
 }

-const TTL_SECONDS = 30 * 24 * 60 * 60;
-
 export async function setTokenCache(
  redis: KV,
  key: string,
  value: TokenCacheEntry,
 ): Promise<void> {
  const encodedValue = TokenCacheEntryCodec.encode(value);
-  await redis.setex(key, TTL_SECONDS, encodedValue);
+  const ttlSeconds = Math.floor(REFRESH_ACCESS_TOKEN_BEFORE / 1000);
+  await redis.setex(key, ttlSeconds, encodedValue);
 }

 export async function deleteTokenCache(redis: KV, key: string): Promise<void> {
--- a/www/app/lib/transcript.ts
+++ b/www/app/lib/transcript.ts
@@ -1,5 +0,0 @@
-import { components } from "../reflector-api";
-
-type ApiTranscriptStatus = components["schemas"]["GetTranscript"]["status"];
-
-export type TranscriptStatus = ApiTranscriptStatus;
--- a/www/app/lib/types.ts
+++ b/www/app/lib/types.ts
@@ -72,7 +72,3 @@ export const assertCustomSession = <S extends Session>(s: S): CustomSession => {
  // no other checks for now
  return r as CustomSession;
 };
-
-export type Mutable<T> = {
-  -readonly [P in keyof T]: T[P];
-};
--- a/www/app/lib/useLoginRequiredPages.ts
+++ b/www/app/lib/useLoginRequiredPages.ts
@@ -1,26 +0,0 @@
-// for paths that are not supposed to be public
-import { PROTECTED_PAGES } from "./auth";
-import { usePathname } from "next/navigation";
-import { useAuth } from "./AuthProvider";
-import { useEffect } from "react";
-
-const HOME = "/" as const;
-
-export const useLoginRequiredPages = () => {
-  const pathname = usePathname();
-  const isProtected = PROTECTED_PAGES.test(pathname);
-  const auth = useAuth();
-  const isNotLoggedIn = auth.status === "unauthenticated";
-  // safety
-  const isLastDestination = pathname === HOME;
-  const shouldRedirect = isNotLoggedIn && isProtected && !isLastDestination;
-  useEffect(() => {
-    if (!shouldRedirect) return;
-    // on the backend, the redirect goes straight to the auth provider, but we don't have it because it's hidden inside next-auth middleware
-    // so we just "softly" lead the user to the main page
-    // warning: if HOME redirects somewhere else, we won't be protected by isLastDestination
-    window.location.href = HOME;
-  }, [shouldRedirect]);
-  // optionally save from blink, since window.location.href takes a bit of time
-  return shouldRedirect ? HOME : null;
-};
--- a/www/app/lib/useUserName.ts
+++ b/www/app/lib/useUserName.ts
@@ -2,7 +2,6 @@ import { useAuth } from "./AuthProvider";

 export const useUserName = (): string | null | undefined => {
  const auth = useAuth();
-  if (auth.status !== "authenticated" && auth.status !== "refreshing")
-    return undefined;
+  if (auth.status !== "authenticated") return undefined;
  return auth.user?.name || null;
 };
--- a/www/app/lib/utils.ts
+++ b/www/app/lib/utils.ts
@@ -158,19 +158,7 @@ export const assertExists = <T>(
  return value;
 };

-export const assertNotExists = <T>(
-  value: T | null | undefined,
-  err?: string,
-): void => {
-  if (value !== null && value !== undefined) {
-    throw new Error(
-      `Assertion failed: ${err ?? "value is not null or undefined"}`,
-    );
-  }
-};
-
 export const assertExistsAndNonEmptyString = (
  value: string | null | undefined,
-  err?: string,
 ): NonEmptyString =>
-  parseNonEmptyString(assertExists(value, err || "Expected non-empty string"));
+  parseNonEmptyString(assertExists(value, "Expected non-empty string"));
--- a/www/app/providers.tsx
+++ b/www/app/providers.tsx
@@ -2,8 +2,8 @@

 import { ChakraProvider } from "@chakra-ui/react";
 import system from "./styles/theme";
-import dynamic from "next/dynamic";

+import { WherebyProvider } from "@whereby.com/browser-sdk/react";
 import { Toaster } from "./components/ui/toaster";
 import { NuqsAdapter } from "nuqs/adapters/next/app";
 import { QueryClientProvider } from "@tanstack/react-query";
@@ -11,14 +11,6 @@ import { queryClient } from "./lib/queryClient";
 import { AuthProvider } from "./lib/AuthProvider";
 import { SessionProvider as SessionProviderNextAuth } from "next-auth/react";

-const WherebyProvider = dynamic(
-  () =>
-    import("@whereby.com/browser-sdk/react").then((mod) => ({
-      default: mod.WherebyProvider,
-    })),
-  { ssr: false },
-);
-
 export function Providers({ children }: { children: React.ReactNode }) {
  return (
    <NuqsAdapter>
--- a/www/app/reflector-api.d.ts
+++ b/www/app/reflector-api.d.ts
@@ -926,17 +926,8 @@ export interface components {
      source_kind: components["schemas"]["SourceKind"];
      /** Created At */
      created_at: string;
-      /**
-       * Status
-       * @enum {string}
-       */
-      status:
-        | "idle"
-        | "uploaded"
-        | "recording"
-        | "processing"
-        | "error"
-        | "ended";
+      /** Status */
+      status: string;
      /** Rank */
      rank: number;
      /**
--- a/www/config-template.ts
+++ b/www/config-template.ts
@@ -0,0 +1,13 @@
+export const localConfig = {
+  features: {
+    requireLogin: true,
+    privacy: true,
+    browse: true,
+    sendToZulip: true,
+    rooms: true,
+  },
+  api_url: "http://127.0.0.1:1250",
+  websocket_url: "ws://127.0.0.1:1250",
+  auth_callback_url: "http://localhost:3000/auth-callback",
+  zulip_streams: "", // Find the value on zulip
+};
--- a/www/middleware.ts
+++ b/www/middleware.ts
@@ -1,7 +1,16 @@
 import { withAuth } from "next-auth/middleware";
-import { featureEnabled } from "./app/lib/features";
+import { getConfig } from "./app/lib/edgeConfig";
 import { NextResponse } from "next/server";
-import { PROTECTED_PAGES } from "./app/lib/auth";
+
+const LOGIN_REQUIRED_PAGES = [
+  "/transcripts/[!new]",
+  "/browse(.*)",
+  "/rooms(.*)",
+];
+
+const PROTECTED_PAGES = new RegExp(
+  LOGIN_REQUIRED_PAGES.map((page) => `^${page}$`).join("|"),
+);

 export const config = {
  matcher: [
@@ -19,12 +28,13 @@ export const config = {

 export default withAuth(
  async function middleware(request) {
+    const config = await getConfig();
    const pathname = request.nextUrl.pathname;

    // feature-flags protected paths
    if (
-      (!featureEnabled("browse") && pathname.startsWith("/browse")) ||
-      (!featureEnabled("rooms") && pathname.startsWith("/rooms"))
+      (!config.features.browse && pathname.startsWith("/browse")) ||
+      (!config.features.rooms && pathname.startsWith("/rooms"))
    ) {
      return NextResponse.redirect(request.nextUrl.origin);
    }
@@ -32,8 +42,10 @@ export default withAuth(
  {
    callbacks: {
      async authorized({ req, token }) {
+        const config = await getConfig();
+
        if (
-          featureEnabled("requireLogin") &&
+          config.features.requireLogin &&
          PROTECTED_PAGES.test(req.nextUrl.pathname)
        ) {
          return !!token;
--- a/www/package.json
+++ b/www/package.json
@@ -20,6 +20,7 @@
    "@sentry/nextjs": "^7.77.0",
    "@tanstack/react-query": "^5.85.9",
    "@types/ioredis": "^5.0.0",
+    "@vercel/edge-config": "^0.4.1",
    "@whereby.com/browser-sdk": "^3.3.4",
    "autoprefixer": "10.4.20",
    "axios": "^1.8.2",
@@ -44,7 +45,6 @@
    "react-markdown": "^9.0.0",
    "react-qr-code": "^2.0.12",
    "react-select-search": "^4.1.7",
-    "redlock": "5.0.0-beta.2",
    "sass": "^1.63.6",
    "simple-peer": "^9.11.1",
    "tailwindcss": "^3.3.2",
@@ -62,7 +62,8 @@
    "jest": "^30.1.3",
    "openapi-typescript": "^7.9.1",
    "prettier": "^3.0.0",
-    "ts-jest": "^29.4.1"
+    "ts-jest": "^29.4.1",
+    "vercel": "^37.3.0"
  },
  "packageManager": "pnpm@10.14.0+sha512.ad27a79641b49c3e481a16a805baa71817a04bbe06a38d17e60e2eaee83f6a146c6a688125f5792e48dd5ba30e7da52a5cda4c3992b9ccf333f9ce223af84748"
 }
--- a/www/pnpm-lock.yaml
+++ b/www/pnpm-lock.yaml
Author	SHA1	Message	Date
Igor Loskutov	2e94f4ccbe	401 reauth experiments	2025-09-05 14:20:00 -04:00
Igor Loskutov	01c969b8a9	doc	2025-09-05 13:05:00 -04:00
Igor Loskutov	462a897882	nextjs magic	2025-09-05 12:59:18 -04:00
Igor Loskutov	83f3d0bc9d	nextjs magic	2025-09-05 12:44:12 -04:00
Igor Loskutov	2962ba5a7b	CI debug	2025-09-04 22:16:01 -04:00
Igor Loskutov	c08a8d0cc0	CI debug	2025-09-04 22:03:52 -04:00
Igor Loskutov	c4c975eb7b	github debug	2025-09-04 22:00:35 -04:00
Igor Loskutov	988586ee42	github debug	2025-09-04 21:58:06 -04:00
Igor Loskutov	9453ebe356	github debug	2025-09-04 21:43:52 -04:00
Igor Loskutov	50d4bcc0ac	github debug	2025-09-04 21:39:45 -04:00
Igor Loskutov	03f2d2a30b	github debug	2025-09-04 21:35:16 -04:00
Igor Loskutov	24869cb825	github debug	2025-09-04 21:27:41 -04:00
Igor Loskutov	92f5d76d43	github debug	2025-09-04 21:25:01 -04:00
Igor Loskutov	82cc1d26d5	github debug	2025-09-04 21:16:06 -04:00
Igor Loskutov	c62c64362f	github debug	2025-09-04 21:10:23 -04:00
Igor Loskutov	8a94f6d8bb	github debug	2025-09-04 21:02:50 -04:00
Igor Loskutov	1f4ec01e2d	github debug	2025-09-04 20:55:50 -04:00
Igor Loskutov	a5124b599d	node version 20 for tests	2025-09-04 20:49:11 -04:00
Igor Loskutov	cacdcbfba2	INTERVAL_REFRESH_MS	2025-09-04 19:39:55 -04:00
Igor Loskutov	e9318708e1	proper api address from env	2025-09-04 19:22:43 -04:00
Igor Loskutov	89dd05ec84	prettier auth state ternary	2025-09-04 15:13:31 -04:00
Igor Loskutov	6f29d08d1c	prettier auth state ternary	2025-09-04 15:11:16 -04:00
Igor Loskutov	ad780551b7	file upload real-time state management fix	2025-09-04 14:13:49 -04:00
Igor Loskutov	0751d01f13	added vs edited room state cleanup	2025-09-04 13:37:10 -04:00
Igor Loskutov	790a61be0d	less edgy config (ci)	2025-09-04 12:32:15 -04:00
Igor Loskutov	9695cc4bdf	ci randomness	2025-09-04 12:12:46 -04:00
Igor Loskutov	669ebe74d8	ci randomness	2025-09-04 12:08:01 -04:00
Igor Loskutov	41c92b8aeb	ci randomness	2025-09-04 12:02:57 -04:00
Igor Loskutov	3170605d9a	ci randomness	2025-09-04 11:58:22 -04:00
Igor Loskutov	3e629a1ace	less edgy config (ci)	2025-09-04 11:48:26 -04:00
Igor Loskutov	2811540d9a	less edgy config (ci)	2025-09-04 11:45:24 -04:00
Igor Loskutov	8af6bf4998	less edgy config (ci)	2025-09-04 11:38:26 -04:00
Igor Loskutov	c28af33b25	ci randomness	2025-09-04 11:27:43 -04:00
Igor Loskutov	912e009ede	merge	2025-09-04 11:21:34 -04:00
Igor Loskutov	f0eba2b2cd	test ts server	2025-09-04 10:54:09 -04:00
Igor Loskutov	40fe4c1bc7	redis cache	2025-09-04 10:41:31 -04:00
Igor Loskutov	23a119dc3b	invalidate room on room update	2025-09-03 13:11:20 -04:00
Igor Loskutov	2e53eeb5d5	websocket dupe react devmode protection	2025-09-03 13:00:22 -04:00
Igor Loskutov	110d1e53fc	remove react-query tab sharing cache	2025-09-03 12:52:05 -04:00
Igor Loskutov	4f66f14761	remove react-query tab sharing cache	2025-09-03 12:47:35 -04:00
Igor Loskutov	6a793edfb5	clarify access token refresh logic a bit	2025-09-03 12:31:50 -04:00
Igor Loskutov	0cbbd24c65	protect from zombie auth	2025-09-03 10:53:03 -04:00
Igor Loskutov	611e258d96	schema generator error type doc	2025-09-03 09:04:40 -04:00
Igor Loskutov	1b22eabb3f	session auto refresh blink	2025-09-03 08:33:13 -04:00
Igor Loskutov	cff662709d	cover TODOs + cross-tab cache	2025-09-03 07:57:11 -04:00
Igor Loskutov	048ebbd654	room edition state granular management	2025-09-03 07:25:22 -04:00
Igor Loskutov	08b82c76ce	normalize auth provider	2025-09-03 07:10:20 -04:00
Igor Loskutov	97f6db5556	room edit fix	2025-09-02 20:00:35 -04:00
Igor Loskutov	5e4f519c83	compile fix	2025-09-02 19:12:04 -04:00
Igor Loskutov	1d5a22ad1d	room detail page fix	2025-09-02 18:52:31 -04:00
Igor Loskutov	05be6e7f19	fix compose	2025-09-02 18:07:15 -04:00
Igor Loskutov	31c44ac0bb	fix auth	2025-09-02 14:44:10 -04:00
Igor Loskutov	5ffc312d4a	authReady callback simplify	2025-09-02 14:00:13 -04:00
Igor Loskutov	11ed585cea	self-review-fix	2025-09-02 13:04:43 -04:00
Igor Loskutov	bdd899774a	merge	2025-09-02 12:04:30 -04:00
Igor Monadical	ca75a4c95e	Igor/mathieu/frontend openapi react query (#597 ) * small typing * typing fixes --------- Co-authored-by: Igor Loskutov <igor.loskutoff@gmail.com>	2025-09-02 11:49:00 -04:00
Mathieu Virbel	0df1b224f2	fix: handle undefined access tokens in auth.ts Added fallback to empty string for potentially undefined access_token and refresh_token from NextAuth account object to satisfy JWTWithAccessToken type requirements.	2025-08-29 18:56:08 -06:00
Mathieu Virbel	790b7992bb	fix: remove infinite re-render loop in useSessionAccessToken The hook was maintaining redundant local state that caused re-renders on every update, which triggered NextAuth to continuously refetch the session, resulting in hundreds of POST requests to /api/auth/session. Simplified the hook to directly return session values without unnecessary state duplication.	2025-08-29 18:52:13 -06:00
Mathieu Virbel	bb04407143	fix: add staleTime to prevent cross-tab staled data	2025-08-29 18:33:53 -06:00
Mathieu Virbel	485a263c0d	refactor: remove Redis dependencies from frontend authentication - Replace Redis/Redlock with in-memory cache for token management - Remove @vercel/kv, ioredis, and redlock dependencies from package.json - Implement simple lock mechanism for concurrent token refresh prevention - Use Map-based cache with TTL for token storage - Maintain same authentication flow without external dependencies This simplifies the infrastructure requirements and removes the need for Redis while maintaining the same functionality through in-memory caching.	2025-08-29 17:10:49 -06:00
Mathieu Virbel	449dd23c8f	chore: clean up migration comments from React Query refactoring - Remove temporary "// Use new React Query hooks" comments - Remove "// React Query hooks" comments from browse and rooms pages - Update package.json script name from codegen to openapi for consistency	2025-08-29 17:03:39 -06:00
Mathieu Virbel	c3ea514465	refactor: remove SK helper object and use inline type casting in FilterSidebar Replace the SK (SourceKind) helper object with direct inline type casting to simplify the code and reduce unnecessary abstraction.	2025-08-29 16:53:02 -06:00
Mathieu Virbel	52301d89a7	chore: add .playwright-mcp to .gitignore	2025-08-29 16:47:10 -06:00
Mathieu Virbel	d479d9d4e6	refactor: rename api-hooks.ts to apiHooks.ts for consistency - Renamed api-hooks.ts to apiHooks.ts to follow camelCase convention - Updated all 21 import statements across the codebase - Maintains consistency with other non-component files (apiClient.tsx, useAuthReady.ts, etc.) - Follows established naming pattern: PascalCase for components, camelCase for utilities/hooks	2025-08-29 16:44:21 -06:00
Mathieu Virbel	7ddae5ddd5	refactor: remove api-types.ts compatibility layer - Migrated all 29 files from api-types.ts to use reflector-api.d.ts directly - Removed $SourceKind manual enum in favor of OpenAPI-generated types - Fixed unrelated Spinner component TypeScript error in AuthWrapper.tsx - All imports now use: import type { components } from "path/to/reflector-api" - Deleted api-types.ts file completely	2025-08-29 16:35:33 -06:00
Mathieu Virbel	8c525e09e8	refactor: clean up api-hooks.ts comments and improve search invalidation - Remove redundant function category comments (exports are self-explanatory) - Remove obvious inline comments for query invalidation - Fix search endpoint invalidation to clear all queries regardless of parameters	2025-08-29 16:07:25 -06:00
Mathieu Virbel	a58a49aeb6	fix: resolve authentication race condition with React Query Previously, API calls were being made before the auth token was configured, causing initial 401 errors that would retry with 200 after token setup. Changes: - Add global auth readiness tracking in apiClient - Create useAuthReady hook that checks both session and token state - Update all API hooks to use isAuthReady instead of just session status - Add AuthWrapper component at layout level for consistent loading UX - Show spinner while authentication initializes across all pages This ensures API calls only fire after authentication is fully configured, eliminating the 401/retry pattern and improving user experience.	2025-08-29 15:53:51 -06:00
Mathieu Virbel	59d4c56a48	fix: correct content-type header for FormData uploads Previously, the API client was setting a default Content-Type of application/json for all requests, which broke file uploads that need multipart/form-data. Now the client only sets application/json when the body is not FormData, allowing FormData to automatically set the correct multipart boundary.	2025-08-29 09:49:29 -06:00
Mathieu Virbel	18d656529c	fix: use direct status check for API query authentication Changed all query hooks to use direct `status === "authenticated"` check instead of derived `isAuthenticated && !isLoading` to avoid race conditions where queries might fire before the authentication token is properly set. This prevents the brief 401 errors that occur on page refresh when the session is being restored.	2025-08-29 09:36:55 -06:00
Mathieu Virbel	75fa9ea859	refactor: remove redundant client-side AuthGuard The authentication is already properly handled by Next.js middleware in middleware.ts with LOGIN_REQUIRED_PAGES. The middleware approach is superior as it: - Provides server-side protection before page loads - Prevents flash of unauthorized content - Centralizes auth logic in one place - Better performance (no client-side JS needed) Keep the API hooks conditional to prevent 401 errors before token is ready.	2025-08-29 09:36:55 -06:00
Mathieu Virbel	26154af25c	fix: prevent unauthorized API calls before authentication - Add global AuthGuard component to handle authentication at layout level - Make all API query hooks conditional on authentication status - Define public routes (like /transcripts/new) that don't require auth - Fix login flow to use NextAuth signIn instead of non-existent /login route - Prevent 401 errors by waiting for auth token before making API calls Previously, all routes under (app) were publicly accessible with each page handling auth individually. Now authentication is enforced globally while still allowing specific routes to remain public.	2025-08-29 09:36:55 -06:00
Mathieu Virbel	0eac7501c5	fix: authentication flow with React Query migration - Fix middleware management in apiClient to properly handle auth tokens - Update ApiAuthProvider to correctly configure base URL and auth - Add missing NextAuth API route handler at app/api/auth/[...nextauth]/route.ts - Remove middleware ejection attempts (not supported by openapi-fetch) - Use global variables to store current auth token and API URL - Setup middleware once on initialization instead of repeatedly adding This fixes the login/logout flow that was broken after migrating from the useApi compatibility layer to native React Query hooks.	2025-08-29 09:36:55 -06:00
Mathieu Virbel	fbeeff4c4d	feat: complete migration from @hey-api/openapi-ts to openapi-react-query - Migrated all components from useApi compatibility layer to direct React Query hooks - Added new hooks for participant operations, room meetings, and speaker operations - Updated all imports from old api module to api-types - Fixed TypeScript types and API endpoint signatures - Removed deprecated useApi.ts compatibility layer - Fixed SourceKind enum values to match OpenAPI spec - Added @ts-ignore for Zulip endpoints not in OpenAPI spec yet - Fixed all compilation errors and type issues	2025-08-29 09:36:55 -06:00
Mathieu Virbel	55f83cf5f4	feat: migrate components to React Query hooks - Add comprehensive API hooks for all operations - Migrate rooms page to use React Query mutations - Update transcript title component to use mutation hook - Refactor share/privacy component with proper error handling - Remove direct API client usage in favor of hooks	2025-08-29 09:36:55 -06:00
Mathieu Virbel	68c161ee7e	fix: resolve import errors and add missing api hooks - Create constants.ts for RECORD_A_MEETING_URL - Add api-types.ts for backward compatible type exports - Update all imports from deleted api folder to new locations - Add missing React Query hooks for rooms and zulip operations - Create useApi compatibility layer for unmigrated components	2025-08-29 09:36:55 -06:00
Mathieu Virbel	e8afe82acd	refactor: migrate from @hey-api/openapi-ts to openapi-react-query - Replace @hey-api/openapi-ts with openapi-typescript and openapi-react-query - Generate TypeScript types from OpenAPI spec - Set up React Query infrastructure with QueryClientProvider - Migrate all API hooks to use React Query patterns - Maintain backward compatibility for existing components - Remove old API infrastructure and dependencies	2025-08-29 09:36:55 -06:00