zombie meetings ignore (no-mistakes)

Co-authored-by: Igor Loskutov <igor.loskutoff@gmail.com>

CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [0.20.0](https://github.com/Monadical-SAS/reflector/compare/v0.19.0...v0.20.0) (2025-11-25)
+
+
+### Features
+
+* link transcript participants ([#737](https://github.com/Monadical-SAS/reflector/issues/737)) ([9bec398](https://github.com/Monadical-SAS/reflector/commit/9bec39808fc6322612d8b87e922a6f7901fc01c1))
+* transcript restart script ([#742](https://github.com/Monadical-SAS/reflector/issues/742)) ([86d5e26](https://github.com/Monadical-SAS/reflector/commit/86d5e26224bb55a0f1cc785aeda52065bb92ee6f))
+
+## [0.19.0](https://github.com/Monadical-SAS/reflector/compare/v0.18.0...v0.19.0) (2025-11-25)
+
+
+### Features
+
+* dailyco api module ([#725](https://github.com/Monadical-SAS/reflector/issues/725)) ([4287f8b](https://github.com/Monadical-SAS/reflector/commit/4287f8b8aeee60e51db7539f4dcbda5f6e696bd8))
+* dailyco poll ([#730](https://github.com/Monadical-SAS/reflector/issues/730)) ([8e438ca](https://github.com/Monadical-SAS/reflector/commit/8e438ca285152bd48fdc42767e706fb448d3525c))
+* multitrack cli ([#735](https://github.com/Monadical-SAS/reflector/issues/735)) ([11731c9](https://github.com/Monadical-SAS/reflector/commit/11731c9d38439b04e93b1c3afbd7090bad11a11f))
+
+
+### Bug Fixes
+
+* default platform fix ([#736](https://github.com/Monadical-SAS/reflector/issues/736)) ([c442a62](https://github.com/Monadical-SAS/reflector/commit/c442a627873ca667656eeaefb63e54ab10b8d19e))
+* parakeet vad not getting the end timestamp ([#728](https://github.com/Monadical-SAS/reflector/issues/728)) ([18ed713](https://github.com/Monadical-SAS/reflector/commit/18ed7133693653ef4ddac6c659a8c14b320d1657))
+* start raw tracks recording ([#729](https://github.com/Monadical-SAS/reflector/issues/729)) ([3e47c2c](https://github.com/Monadical-SAS/reflector/commit/3e47c2c0573504858e0d2e1798b6ed31f16b4a5d))
+
+## [0.18.0](https://github.com/Monadical-SAS/reflector/compare/v0.17.0...v0.18.0) (2025-11-14)
+
+
+### Features
+
+* daily QOL: participants dictionary ([#721](https://github.com/Monadical-SAS/reflector/issues/721)) ([b20cad7](https://github.com/Monadical-SAS/reflector/commit/b20cad76e69fb6a76405af299a005f1ddcf60eae))
+
+
+### Bug Fixes
+
+* add proccessing page to file upload and reprocessing ([#650](https://github.com/Monadical-SAS/reflector/issues/650)) ([28a7258](https://github.com/Monadical-SAS/reflector/commit/28a7258e45317b78e60e6397be2bc503647eaace))
+* copy transcript ([#674](https://github.com/Monadical-SAS/reflector/issues/674)) ([a9a4f32](https://github.com/Monadical-SAS/reflector/commit/a9a4f32324f66c838e081eee42bb9502f38c1db1))
+
 ## [0.17.0](https://github.com/Monadical-SAS/reflector/compare/v0.16.0...v0.17.0) (2025-11-13)
 
 

README.md

@@ -168,6 +168,12 @@ You can manually process an audio file by calling the process tool:
 uv run python -m reflector.tools.process path/to/audio.wav
 ```
 
+## Reprocessing any transcription
+
+```bash
+uv run -m reflector.tools.process_transcript 81ec38d1-9dd7-43d2-b3f8-51f4d34a07cd --sync
+```
+
 ## Build-time env variables
 
 Next.js projects are more used to NEXT_PUBLIC_ prefixed buildtime vars. We don't have those for the reason we need to serve a ccustomizable prebuild docker container.

gpu/modal_deployments/reflector_transcriber_parakeet.py

@@ -81,9 +81,9 @@ image = (
         "cuda-python==12.8.0",
         "fastapi==0.115.12",
         "numpy<2",
-        "librosa==0.10.1",
+        "librosa==0.11.0",
         "requests",
-        "silero-vad==5.1.0",
+        "silero-vad==6.2.0",
         "torch",
     )
     .entrypoint([])  # silence chatty logs by container on start
@@ -306,6 +306,7 @@ class TranscriberParakeetFile:
         ) -> Generator[TimeSegment, None, None]:
             """Generate speech segments using VAD with start/end sample indices"""
             vad_iterator = VADIterator(self.vad_model, sampling_rate=SAMPLERATE)
+            audio_duration = len(audio_array) / float(SAMPLERATE)
             window_size = VAD_CONFIG["window_size"]
             start = None
 
@@ -332,6 +333,10 @@ class TranscriberParakeetFile:
                     yield TimeSegment(start_time, end_time)
                     start = None
 
+            if start is not None:
+                start_time = start / float(SAMPLERATE)
+                yield TimeSegment(start_time, audio_duration)
+
             vad_iterator.reset_states()
 
         def batch_speech_segments(

server/docs/video-platforms/README.md

@@ -89,7 +89,9 @@ This document explains how Reflector receives and identifies multitrack audio re
 
 ---
 
-## Daily.co (Webhook-based)
+## Daily.co
+
+**Note:** Primary discovery via polling (`poll_daily_recordings`), webhooks as backup.
 
 Daily.co uses **webhooks** to notify Reflector when recordings are ready.
 

server/migrations/versions/2b92a1b03caa_add_daily_participant_session_table_.py

@@ -0,0 +1,79 @@
+"""add daily participant session table with immutable left_at
+
+Revision ID: 2b92a1b03caa
+Revises: f8294b31f022
+Create Date: 2025-11-13 20:29:30.486577
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "2b92a1b03caa"
+down_revision: Union[str, None] = "f8294b31f022"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Create table
+    op.create_table(
+        "daily_participant_session",
+        sa.Column("id", sa.String(), nullable=False),
+        sa.Column("meeting_id", sa.String(), nullable=False),
+        sa.Column("room_id", sa.String(), nullable=False),
+        sa.Column("session_id", sa.String(), nullable=False),
+        sa.Column("user_id", sa.String(), nullable=True),
+        sa.Column("user_name", sa.String(), nullable=False),
+        sa.Column("joined_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("left_at", sa.DateTime(timezone=True), nullable=True),
+        sa.ForeignKeyConstraint(["meeting_id"], ["meeting.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["room_id"], ["room.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    with op.batch_alter_table("daily_participant_session", schema=None) as batch_op:
+        batch_op.create_index(
+            "idx_daily_session_meeting_left", ["meeting_id", "left_at"], unique=False
+        )
+        batch_op.create_index("idx_daily_session_room", ["room_id"], unique=False)
+
+    # Create trigger function to prevent left_at from being updated once set
+    op.execute("""
+        CREATE OR REPLACE FUNCTION prevent_left_at_update()
+        RETURNS TRIGGER AS $$
+        BEGIN
+            IF OLD.left_at IS NOT NULL THEN
+                RAISE EXCEPTION 'left_at is immutable once set';
+            END IF;
+            RETURN NEW;
+        END;
+        $$ LANGUAGE plpgsql;
+    """)
+
+    # Create trigger
+    op.execute("""
+        CREATE TRIGGER prevent_left_at_update_trigger
+        BEFORE UPDATE ON daily_participant_session
+        FOR EACH ROW
+        EXECUTE FUNCTION prevent_left_at_update();
+    """)
+
+
+def downgrade() -> None:
+    # Drop trigger
+    op.execute(
+        "DROP TRIGGER IF EXISTS prevent_left_at_update_trigger ON daily_participant_session;"
+    )
+
+    # Drop trigger function
+    op.execute("DROP FUNCTION IF EXISTS prevent_left_at_update();")
+
+    # Drop indexes and table
+    with op.batch_alter_table("daily_participant_session", schema=None) as batch_op:
+        batch_op.drop_index("idx_daily_session_room")
+        batch_op.drop_index("idx_daily_session_meeting_left")
+
+    op.drop_table("daily_participant_session")

server/migrations/versions/5d6b9df9b045_make_room_platform_non_nullable_with_.py

@@ -0,0 +1,30 @@
+"""Make room platform non-nullable with dynamic default
+
+Revision ID: 5d6b9df9b045
+Revises: 2b92a1b03caa
+Create Date: 2025-11-21 13:22:25.756584
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "5d6b9df9b045"
+down_revision: Union[str, None] = "2b92a1b03caa"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.execute("UPDATE room SET platform = 'whereby' WHERE platform IS NULL")
+
+    with op.batch_alter_table("room", schema=None) as batch_op:
+        batch_op.alter_column("platform", existing_type=sa.String(), nullable=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("room", schema=None) as batch_op:
+        batch_op.alter_column("platform", existing_type=sa.String(), nullable=True)

server/migrations/versions/bbafedfa510c_add_user_table.py

@@ -0,0 +1,38 @@
+"""add user table
+
+Revision ID: bbafedfa510c
+Revises: 5d6b9df9b045
+Create Date: 2025-11-19 21:06:30.543262
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "bbafedfa510c"
+down_revision: Union[str, None] = "5d6b9df9b045"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "user",
+        sa.Column("id", sa.String(), nullable=False),
+        sa.Column("email", sa.String(), nullable=False),
+        sa.Column("authentik_uid", sa.String(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+
+    with op.batch_alter_table("user", schema=None) as batch_op:
+        batch_op.create_index("idx_user_authentik_uid", ["authentik_uid"], unique=True)
+        batch_op.create_index("idx_user_email", ["email"], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_table("user")

server/reflector/auth/auth_jwt.py

@@ -6,8 +6,10 @@ from jose import JWTError, jwt
 from pydantic import BaseModel
 
 from reflector.db.user_api_keys import user_api_keys_controller
+from reflector.db.users import user_controller
 from reflector.logger import logger
 from reflector.settings import settings
+from reflector.utils import generate_uuid4
 
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token", auto_error=False)
 api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
@@ -74,9 +76,21 @@ async def _authenticate_user(
     if jwt_token:
         try:
             payload = jwtauth.verify_token(jwt_token)
-            sub = payload["sub"]
+            authentik_uid = payload["sub"]
             email = payload["email"]
-            user_infos.append(UserInfo(sub=sub, email=email))
+
+            user = await user_controller.get_by_authentik_uid(authentik_uid)
+            if not user:
+                logger.info(
+                    f"Creating new user on first login: {authentik_uid} ({email})"
+                )
+                user = await user_controller.create_or_update(
+                    id=generate_uuid4(),
+                    authentik_uid=authentik_uid,
+                    email=email,
+                )
+
+            user_infos.append(UserInfo(sub=user.id, email=email))
         except JWTError as e:
             logger.error(f"JWT error: {e}")
             raise HTTPException(status_code=401, detail="Invalid authentication")

server/reflector/dailyco_api/README.md

@@ -0,0 +1,6 @@
+anything about Daily.co api interaction
+
+- webhook event shapes
+- REST api client
+
+No REST api client existing found in the wild; the official lib is about working with videocall as a bot

server/reflector/dailyco_api/__init__.py

@@ -0,0 +1,108 @@
+"""
+Daily.co API Module
+"""
+
+# Client
+from .client import DailyApiClient, DailyApiError
+
+# Request models
+from .requests import (
+    CreateMeetingTokenRequest,
+    CreateRoomRequest,
+    CreateWebhookRequest,
+    MeetingTokenProperties,
+    RecordingsBucketConfig,
+    RoomProperties,
+    UpdateWebhookRequest,
+)
+
+# Response models
+from .responses import (
+    MeetingParticipant,
+    MeetingParticipantsResponse,
+    MeetingResponse,
+    MeetingTokenResponse,
+    RecordingResponse,
+    RecordingS3Info,
+    RoomPresenceParticipant,
+    RoomPresenceResponse,
+    RoomResponse,
+    WebhookResponse,
+)
+
+# Webhook utilities
+from .webhook_utils import (
+    extract_room_name,
+    parse_participant_joined,
+    parse_participant_left,
+    parse_recording_error,
+    parse_recording_ready,
+    parse_recording_started,
+    parse_webhook_payload,
+    verify_webhook_signature,
+)
+
+# Webhook models
+from .webhooks import (
+    DailyTrack,
+    DailyWebhookEvent,
+    DailyWebhookEventUnion,
+    ParticipantJoinedEvent,
+    ParticipantJoinedPayload,
+    ParticipantLeftEvent,
+    ParticipantLeftPayload,
+    RecordingErrorEvent,
+    RecordingErrorPayload,
+    RecordingReadyEvent,
+    RecordingReadyToDownloadPayload,
+    RecordingStartedEvent,
+    RecordingStartedPayload,
+)
+
+__all__ = [
+    # Client
+    "DailyApiClient",
+    "DailyApiError",
+    # Requests
+    "CreateRoomRequest",
+    "RoomProperties",
+    "RecordingsBucketConfig",
+    "CreateMeetingTokenRequest",
+    "MeetingTokenProperties",
+    "CreateWebhookRequest",
+    "UpdateWebhookRequest",
+    # Responses
+    "RoomResponse",
+    "RoomPresenceResponse",
+    "RoomPresenceParticipant",
+    "MeetingParticipantsResponse",
+    "MeetingParticipant",
+    "MeetingResponse",
+    "RecordingResponse",
+    "RecordingS3Info",
+    "MeetingTokenResponse",
+    "WebhookResponse",
+    # Webhooks
+    "DailyWebhookEvent",
+    "DailyWebhookEventUnion",
+    "DailyTrack",
+    "ParticipantJoinedEvent",
+    "ParticipantJoinedPayload",
+    "ParticipantLeftEvent",
+    "ParticipantLeftPayload",
+    "RecordingStartedEvent",
+    "RecordingStartedPayload",
+    "RecordingReadyEvent",
+    "RecordingReadyToDownloadPayload",
+    "RecordingErrorEvent",
+    "RecordingErrorPayload",
+    # Webhook utilities
+    "verify_webhook_signature",
+    "extract_room_name",
+    "parse_webhook_payload",
+    "parse_participant_joined",
+    "parse_participant_left",
+    "parse_recording_started",
+    "parse_recording_ready",
+    "parse_recording_error",
+]

server/reflector/dailyco_api/client.py

@@ -0,0 +1,573 @@
+"""
+Daily.co API Client
+
+Complete async client for Daily.co REST API with Pydantic models.
+
+Reference: https://docs.daily.co/reference/rest-api
+"""
+
+from http import HTTPStatus
+from typing import Any
+
+import httpx
+import structlog
+
+from reflector.utils.string import NonEmptyString
+
+from .requests import (
+    CreateMeetingTokenRequest,
+    CreateRoomRequest,
+    CreateWebhookRequest,
+    UpdateWebhookRequest,
+)
+from .responses import (
+    MeetingParticipantsResponse,
+    MeetingResponse,
+    MeetingTokenResponse,
+    RecordingResponse,
+    RoomPresenceResponse,
+    RoomResponse,
+    WebhookResponse,
+)
+
+logger = structlog.get_logger(__name__)
+
+
+class DailyApiError(Exception):
+    """Daily.co API error with full request/response context."""
+
+    def __init__(self, operation: str, response: httpx.Response):
+        self.operation = operation
+        self.response = response
+        self.status_code = response.status_code
+        self.response_body = response.text
+        self.url = str(response.url)
+        self.request_body = (
+            response.request.content.decode() if response.request.content else None
+        )
+
+        super().__init__(
+            f"Daily.co API error: {operation} failed with status {self.status_code}"
+        )
+
+
+class DailyApiClient:
+    """
+    Complete async client for Daily.co REST API.
+
+    Usage:
+        # Direct usage
+        client = DailyApiClient(api_key="your_api_key")
+        room = await client.create_room(CreateRoomRequest(name="my-room"))
+        await client.close()  # Clean up when done
+
+        # Context manager (recommended)
+        async with DailyApiClient(api_key="your_api_key") as client:
+            room = await client.create_room(CreateRoomRequest(name="my-room"))
+    """
+
+    BASE_URL = "https://api.daily.co/v1"
+    DEFAULT_TIMEOUT = 10.0
+
+    def __init__(
+        self,
+        api_key: NonEmptyString,
+        webhook_secret: NonEmptyString | None = None,
+        timeout: float = DEFAULT_TIMEOUT,
+        base_url: NonEmptyString | None = None,
+    ):
+        """
+        Initialize Daily.co API client.
+
+        Args:
+            api_key: Daily.co API key (Bearer token)
+            webhook_secret: Base64-encoded HMAC secret for webhook verification.
+                Must match the 'hmac' value provided when creating webhooks.
+                Generate with: base64.b64encode(os.urandom(32)).decode()
+            timeout: Default request timeout in seconds
+            base_url: Override base URL (for testing)
+        """
+        self.api_key = api_key
+        self.webhook_secret = webhook_secret
+        self.timeout = timeout
+        self.base_url = base_url or self.BASE_URL
+
+        self.headers = {
+            "Authorization": f"Bearer {api_key}",
+            "Content-Type": "application/json",
+        }
+
+        self._client: httpx.AsyncClient | None = None
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, exc_val, exc_tb):
+        await self.close()
+
+    async def _get_client(self) -> httpx.AsyncClient:
+        if self._client is None:
+            self._client = httpx.AsyncClient(timeout=self.timeout)
+        return self._client
+
+    async def close(self):
+        if self._client is not None:
+            await self._client.aclose()
+            self._client = None
+
+    async def _handle_response(
+        self, response: httpx.Response, operation: str
+    ) -> dict[str, Any]:
+        """
+        Handle API response with error logging.
+
+        Args:
+            response: HTTP response
+            operation: Operation name for logging (e.g., "create_room")
+
+        Returns:
+            Parsed JSON response
+
+        Raises:
+            DailyApiError: If request failed with full context
+        """
+        if response.status_code >= 400:
+            logger.error(
+                f"Daily.co API error: {operation}",
+                status_code=response.status_code,
+                response_body=response.text,
+                request_body=response.request.content.decode()
+                if response.request.content
+                else None,
+                url=str(response.url),
+            )
+            raise DailyApiError(operation, response)
+
+        return response.json()
+
+    # ============================================================================
+    # ROOMS
+    # ============================================================================
+
+    async def create_room(self, request: CreateRoomRequest) -> RoomResponse:
+        """
+        Create a new Daily.co room.
+
+        Reference: https://docs.daily.co/reference/rest-api/rooms/create-room
+
+        Args:
+            request: Room creation request with name, privacy, and properties
+
+        Returns:
+            Created room data including URL and ID
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.post(
+            f"{self.base_url}/rooms",
+            headers=self.headers,
+            json=request.model_dump(exclude_none=True),
+        )
+
+        data = await self._handle_response(response, "create_room")
+        return RoomResponse(**data)
+
+    async def get_room(self, room_name: NonEmptyString) -> RoomResponse:
+        """
+        Get room configuration.
+
+        Args:
+            room_name: Daily.co room name
+
+        Returns:
+            Room configuration data
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.get(
+            f"{self.base_url}/rooms/{room_name}",
+            headers=self.headers,
+        )
+
+        data = await self._handle_response(response, "get_room")
+        return RoomResponse(**data)
+
+    async def get_room_presence(
+        self, room_name: NonEmptyString
+    ) -> RoomPresenceResponse:
+        """
+        Get current participants in a room (real-time presence).
+
+        Reference: https://docs.daily.co/reference/rest-api/rooms/get-room-presence
+
+        Args:
+            room_name: Daily.co room name
+
+        Returns:
+            List of currently present participants with join time and duration
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.get(
+            f"{self.base_url}/rooms/{room_name}/presence",
+            headers=self.headers,
+        )
+
+        data = await self._handle_response(response, "get_room_presence")
+        return RoomPresenceResponse(**data)
+
+    async def delete_room(self, room_name: NonEmptyString) -> None:
+        """
+        Delete a room (idempotent - succeeds even if room doesn't exist).
+
+        Reference: https://docs.daily.co/reference/rest-api/rooms/delete-room
+
+        Args:
+            room_name: Daily.co room name
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails (except 404)
+        """
+        client = await self._get_client()
+        response = await client.delete(
+            f"{self.base_url}/rooms/{room_name}",
+            headers=self.headers,
+        )
+
+        # Idempotent delete - 404 means already deleted
+        if response.status_code == HTTPStatus.NOT_FOUND:
+            logger.debug("Room not found (already deleted)", room_name=room_name)
+            return
+
+        await self._handle_response(response, "delete_room")
+
+    # ============================================================================
+    # MEETINGS
+    # ============================================================================
+
+    async def get_meeting(self, meeting_id: NonEmptyString) -> MeetingResponse:
+        """
+        Get full meeting information including participants.
+
+        Reference: https://docs.daily.co/reference/rest-api/meetings/get-meeting-information
+
+        Args:
+            meeting_id: Daily.co meeting/session ID
+
+        Returns:
+            Meeting metadata including room, duration, participants, and status
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.get(
+            f"{self.base_url}/meetings/{meeting_id}",
+            headers=self.headers,
+        )
+
+        data = await self._handle_response(response, "get_meeting")
+        return MeetingResponse(**data)
+
+    async def get_meeting_participants(
+        self,
+        meeting_id: NonEmptyString,
+        limit: int | None = None,
+        joined_after: NonEmptyString | None = None,
+        joined_before: NonEmptyString | None = None,
+    ) -> MeetingParticipantsResponse:
+        """
+        Get historical participant data from a completed meeting (paginated).
+
+        Reference: https://docs.daily.co/reference/rest-api/meetings/get-meeting-participants
+
+        Args:
+            meeting_id: Daily.co meeting/session ID
+            limit: Maximum number of participant records to return
+            joined_after: Return participants who joined after this participant_id
+            joined_before: Return participants who joined before this participant_id
+
+        Returns:
+            List of participants with join times and duration
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails (404 when no more participants)
+
+        Note:
+            For pagination, use joined_after with the last participant_id from previous response.
+            Returns 404 when no more participants remain.
+        """
+        params = {}
+        if limit is not None:
+            params["limit"] = limit
+        if joined_after is not None:
+            params["joined_after"] = joined_after
+        if joined_before is not None:
+            params["joined_before"] = joined_before
+
+        client = await self._get_client()
+        response = await client.get(
+            f"{self.base_url}/meetings/{meeting_id}/participants",
+            headers=self.headers,
+            params=params,
+        )
+
+        data = await self._handle_response(response, "get_meeting_participants")
+        return MeetingParticipantsResponse(**data)
+
+    # ============================================================================
+    # RECORDINGS
+    # ============================================================================
+
+    async def get_recording(self, recording_id: NonEmptyString) -> RecordingResponse:
+        """
+        https://docs.daily.co/reference/rest-api/recordings/get-recording-information
+        Get recording metadata and status.
+        """
+        client = await self._get_client()
+        response = await client.get(
+            f"{self.base_url}/recordings/{recording_id}",
+            headers=self.headers,
+        )
+
+        data = await self._handle_response(response, "get_recording")
+        return RecordingResponse(**data)
+
+    async def list_recordings(
+        self,
+        room_name: NonEmptyString | None = None,
+        starting_after: str | None = None,
+        ending_before: str | None = None,
+        limit: int = 100,
+    ) -> list[RecordingResponse]:
+        """
+        List recordings with optional filters.
+
+        Reference: https://docs.daily.co/reference/rest-api/recordings
+
+        Args:
+            room_name: Filter by room name
+            starting_after: Pagination cursor - recording ID to start after
+            ending_before: Pagination cursor - recording ID to end before
+            limit: Max results per page (default 100, max 100)
+
+        Note: starting_after/ending_before are pagination cursors (recording IDs),
+        NOT time filters. API returns recordings in reverse chronological order.
+        """
+        client = await self._get_client()
+
+        params = {"limit": limit}
+        if room_name:
+            params["room_name"] = room_name
+        if starting_after:
+            params["starting_after"] = starting_after
+        if ending_before:
+            params["ending_before"] = ending_before
+
+        response = await client.get(
+            f"{self.base_url}/recordings",
+            headers=self.headers,
+            params=params,
+        )
+
+        data = await self._handle_response(response, "list_recordings")
+
+        if not isinstance(data, dict) or "data" not in data:
+            logger.error(
+                "Daily.co API returned unexpected format for list_recordings",
+                data_type=type(data).__name__,
+                data_keys=list(data.keys()) if isinstance(data, dict) else None,
+                data_sample=str(data)[:500],
+                room_name=room_name,
+                operation="list_recordings",
+            )
+            raise httpx.HTTPStatusError(
+                message=f"Unexpected response format from list_recordings: {type(data).__name__}",
+                request=response.request,
+                response=response,
+            )
+
+        return [RecordingResponse(**r) for r in data["data"]]
+
+    # ============================================================================
+    # MEETING TOKENS
+    # ============================================================================
+
+    async def create_meeting_token(
+        self, request: CreateMeetingTokenRequest
+    ) -> MeetingTokenResponse:
+        """
+        Create a meeting token for participant authentication.
+
+        Reference: https://docs.daily.co/reference/rest-api/meeting-tokens/create-meeting-token
+
+        Args:
+            request: Token properties including room name, user_id, permissions
+
+        Returns:
+            JWT meeting token
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.post(
+            f"{self.base_url}/meeting-tokens",
+            headers=self.headers,
+            json=request.model_dump(exclude_none=True),
+        )
+
+        data = await self._handle_response(response, "create_meeting_token")
+        return MeetingTokenResponse(**data)
+
+    # ============================================================================
+    # WEBHOOKS
+    # ============================================================================
+
+    async def list_webhooks(self) -> list[WebhookResponse]:
+        """
+        List all configured webhooks for this account.
+
+        Reference: https://docs.daily.co/reference/rest-api/webhooks
+
+        Returns:
+            List of webhook configurations
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.get(
+            f"{self.base_url}/webhooks",
+            headers=self.headers,
+        )
+
+        data = await self._handle_response(response, "list_webhooks")
+
+        # Daily.co returns array directly (not paginated)
+        if isinstance(data, list):
+            return [WebhookResponse(**wh) for wh in data]
+
+        # Future-proof: handle potential pagination envelope
+        if isinstance(data, dict) and "data" in data:
+            return [WebhookResponse(**wh) for wh in data["data"]]
+
+        logger.warning("Unexpected webhook list response format", data=data)
+        return []
+
+    async def create_webhook(self, request: CreateWebhookRequest) -> WebhookResponse:
+        """
+        Create a new webhook subscription.
+
+        Reference: https://docs.daily.co/reference/rest-api/webhooks
+
+        Args:
+            request: Webhook configuration with URL, event types, and HMAC secret
+
+        Returns:
+            Created webhook with UUID and state
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.post(
+            f"{self.base_url}/webhooks",
+            headers=self.headers,
+            json=request.model_dump(exclude_none=True),
+        )
+
+        data = await self._handle_response(response, "create_webhook")
+        return WebhookResponse(**data)
+
+    async def update_webhook(
+        self, webhook_uuid: NonEmptyString, request: UpdateWebhookRequest
+    ) -> WebhookResponse:
+        """
+        Update webhook configuration.
+
+        Note: Daily.co may not support PATCH for all fields.
+        Common pattern is delete + recreate.
+
+        Reference: https://docs.daily.co/reference/rest-api/webhooks
+
+        Args:
+            webhook_uuid: Webhook UUID to update
+            request: Updated webhook configuration
+
+        Returns:
+            Updated webhook configuration
+
+        Raises:
+            httpx.HTTPStatusError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.patch(
+            f"{self.base_url}/webhooks/{webhook_uuid}",
+            headers=self.headers,
+            json=request.model_dump(exclude_none=True),
+        )
+
+        data = await self._handle_response(response, "update_webhook")
+        return WebhookResponse(**data)
+
+    async def delete_webhook(self, webhook_uuid: NonEmptyString) -> None:
+        """
+        Delete a webhook.
+
+        Reference: https://docs.daily.co/reference/rest-api/webhooks
+
+        Args:
+            webhook_uuid: Webhook UUID to delete
+
+        Raises:
+            httpx.HTTPStatusError: If webhook not found or deletion fails
+        """
+        client = await self._get_client()
+        response = await client.delete(
+            f"{self.base_url}/webhooks/{webhook_uuid}",
+            headers=self.headers,
+        )
+
+        await self._handle_response(response, "delete_webhook")
+
+    # ============================================================================
+    # HELPER METHODS
+    # ============================================================================
+
+    async def find_webhook_by_url(self, url: NonEmptyString) -> WebhookResponse | None:
+        """
+        Find a webhook by its URL.
+
+        Args:
+            url: Webhook endpoint URL to search for
+
+        Returns:
+            Webhook if found, None otherwise
+        """
+        webhooks = await self.list_webhooks()
+        for webhook in webhooks:
+            if webhook.url == url:
+                return webhook
+        return None
+
+    async def find_webhooks_by_pattern(
+        self, pattern: NonEmptyString
+    ) -> list[WebhookResponse]:
+        """
+        Find webhooks matching a URL pattern (e.g., 'ngrok').
+
+        Args:
+            pattern: String to match in webhook URLs
+
+        Returns:
+            List of matching webhooks
+        """
+        webhooks = await self.list_webhooks()
+        return [wh for wh in webhooks if pattern in wh.url]

server/reflector/dailyco_api/requests.py

@@ -0,0 +1,158 @@
+"""
+Daily.co API Request Models
+
+Reference: https://docs.daily.co/reference/rest-api
+"""
+
+from typing import List, Literal
+
+from pydantic import BaseModel, Field
+
+from reflector.utils.string import NonEmptyString
+
+
+class RecordingsBucketConfig(BaseModel):
+    """
+    S3 bucket configuration for raw-tracks recordings.
+
+    Reference: https://docs.daily.co/reference/rest-api/rooms/create-room
+    """
+
+    bucket_name: NonEmptyString = Field(description="S3 bucket name")
+    bucket_region: NonEmptyString = Field(description="AWS region (e.g., 'us-east-1')")
+    assume_role_arn: NonEmptyString = Field(
+        description="AWS IAM role ARN that Daily.co will assume to write recordings"
+    )
+    allow_api_access: bool = Field(
+        default=True,
+        description="Whether to allow API access to recording metadata",
+    )
+
+
+class RoomProperties(BaseModel):
+    """
+    Room configuration properties.
+    """
+
+    enable_recording: Literal["cloud", "local", "raw-tracks"] | None = Field(
+        default=None,
+        description="Recording mode: 'cloud' for mixed, 'local' for local recording, 'raw-tracks' for multitrack, None to disable",
+    )
+    enable_chat: bool = Field(default=True, description="Enable in-meeting chat")
+    enable_screenshare: bool = Field(default=True, description="Enable screen sharing")
+    start_video_off: bool = Field(
+        default=False, description="Start with video off for all participants"
+    )
+    start_audio_off: bool = Field(
+        default=False, description="Start with audio muted for all participants"
+    )
+    exp: int | None = Field(
+        None, description="Room expiration timestamp (Unix epoch seconds)"
+    )
+    recordings_bucket: RecordingsBucketConfig | None = Field(
+        None, description="S3 bucket configuration for raw-tracks recordings"
+    )
+
+
+class CreateRoomRequest(BaseModel):
+    """
+    Request to create a new Daily.co room.
+
+    Reference: https://docs.daily.co/reference/rest-api/rooms/create-room
+    """
+
+    name: NonEmptyString = Field(description="Room name (must be unique within domain)")
+    privacy: Literal["public", "private"] = Field(
+        default="public", description="Room privacy setting"
+    )
+    properties: RoomProperties = Field(
+        default_factory=RoomProperties, description="Room configuration properties"
+    )
+
+
+class MeetingTokenProperties(BaseModel):
+    """
+    Properties for meeting token creation.
+
+    Reference: https://docs.daily.co/reference/rest-api/meeting-tokens/create-meeting-token
+    """
+
+    room_name: NonEmptyString = Field(description="Room name this token is valid for")
+    user_id: NonEmptyString | None = Field(
+        None, description="User identifier to associate with token"
+    )
+    is_owner: bool = Field(
+        default=False, description="Grant owner privileges to token holder"
+    )
+    start_cloud_recording: bool = Field(
+        default=False, description="Automatically start cloud recording on join"
+    )
+    enable_recording_ui: bool = Field(
+        default=True, description="Show recording controls in UI"
+    )
+    eject_at_token_exp: bool = Field(
+        default=False, description="Eject participant when token expires"
+    )
+    nbf: int | None = Field(
+        None, description="Not-before timestamp (Unix epoch seconds)"
+    )
+    exp: int | None = Field(
+        None, description="Expiration timestamp (Unix epoch seconds)"
+    )
+
+
+class CreateMeetingTokenRequest(BaseModel):
+    """
+    Request to create a meeting token for participant authentication.
+
+    Reference: https://docs.daily.co/reference/rest-api/meeting-tokens/create-meeting-token
+    """
+
+    properties: MeetingTokenProperties = Field(description="Token properties")
+
+
+class CreateWebhookRequest(BaseModel):
+    """
+    Request to create a webhook subscription.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks
+    """
+
+    url: NonEmptyString = Field(description="Webhook endpoint URL (must be HTTPS)")
+    eventTypes: List[
+        Literal[
+            "participant.joined",
+            "participant.left",
+            "recording.started",
+            "recording.ready-to-download",
+            "recording.error",
+        ]
+    ] = Field(
+        description="Array of event types to subscribe to (only events we handle)"
+    )
+    hmac: NonEmptyString = Field(
+        description="Base64-encoded HMAC secret for webhook signature verification"
+    )
+    basicAuth: NonEmptyString | None = Field(
+        None, description="Optional basic auth credentials for webhook endpoint"
+    )
+
+
+class UpdateWebhookRequest(BaseModel):
+    """
+    Request to update an existing webhook.
+
+    Note: Daily.co API may not support PATCH for webhooks.
+    Common pattern is to delete and recreate.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks
+    """
+
+    url: NonEmptyString | None = Field(None, description="New webhook endpoint URL")
+    eventTypes: List[NonEmptyString] | None = Field(
+        None, description="New array of event types"
+    )
+    hmac: NonEmptyString | None = Field(None, description="New HMAC secret")
+    basicAuth: NonEmptyString | None = Field(
+        None, description="New basic auth credentials"
+    )

server/reflector/dailyco_api/responses.py

@@ -0,0 +1,193 @@
+"""
+Daily.co API Response Models
+"""
+
+from typing import Any, Dict, List, Literal
+
+from pydantic import BaseModel, Field
+
+from reflector.dailyco_api.webhooks import DailyTrack
+from reflector.utils.string import NonEmptyString
+
+# not documented in daily; we fill it according to observations
+RecordingStatus = Literal["in-progress", "finished"]
+
+
+class RoomResponse(BaseModel):
+    """
+    Response from room creation or retrieval.
+
+    Reference: https://docs.daily.co/reference/rest-api/rooms/create-room
+    """
+
+    id: NonEmptyString = Field(description="Unique room identifier (UUID)")
+    name: NonEmptyString = Field(description="Room name used in URLs")
+    api_created: bool = Field(description="Whether room was created via API")
+    privacy: Literal["public", "private"] = Field(description="Room privacy setting")
+    url: NonEmptyString = Field(description="Full room URL")
+    created_at: NonEmptyString = Field(description="ISO 8601 creation timestamp")
+    config: Dict[NonEmptyString, Any] = Field(
+        default_factory=dict, description="Room configuration properties"
+    )
+
+
+class RoomPresenceParticipant(BaseModel):
+    """
+    Participant presence information in a room.
+
+    Reference: https://docs.daily.co/reference/rest-api/rooms/get-room-presence
+    """
+
+    room: NonEmptyString = Field(description="Room name")
+    id: NonEmptyString = Field(description="Participant session ID")
+    userId: NonEmptyString | None = Field(None, description="User ID if provided")
+    userName: NonEmptyString | None = Field(None, description="User display name")
+    joinTime: NonEmptyString = Field(description="ISO 8601 join timestamp")
+    duration: int = Field(description="Duration in room (seconds)")
+
+
+class RoomPresenceResponse(BaseModel):
+    """
+    Response from room presence endpoint.
+
+    Reference: https://docs.daily.co/reference/rest-api/rooms/get-room-presence
+    """
+
+    total_count: int = Field(
+        description="Total number of participants currently in room"
+    )
+    data: List[RoomPresenceParticipant] = Field(
+        default_factory=list, description="Array of participant presence data"
+    )
+
+
+class MeetingParticipant(BaseModel):
+    """
+    Historical participant data from a meeting.
+
+    Reference: https://docs.daily.co/reference/rest-api/meetings/get-meeting-participants
+    """
+
+    user_id: NonEmptyString = Field(description="User identifier")
+    participant_id: NonEmptyString = Field(description="Participant session identifier")
+    user_name: NonEmptyString | None = Field(None, description="User display name")
+    join_time: int = Field(description="Join timestamp (Unix epoch seconds)")
+    duration: int = Field(description="Duration in meeting (seconds)")
+
+
+class MeetingParticipantsResponse(BaseModel):
+    """
+    Response from meeting participants endpoint.
+
+    Reference: https://docs.daily.co/reference/rest-api/meetings/get-meeting-participants
+    """
+
+    data: List[MeetingParticipant] = Field(
+        default_factory=list, description="Array of participant data"
+    )
+
+
+class MeetingResponse(BaseModel):
+    """
+    Response from meeting information endpoint.
+
+    Reference: https://docs.daily.co/reference/rest-api/meetings/get-meeting-information
+    """
+
+    id: NonEmptyString = Field(description="Meeting session identifier (UUID)")
+    room: NonEmptyString = Field(description="Room name where meeting occurred")
+    start_time: int = Field(
+        description="Meeting start Unix timestamp (~15s granularity)"
+    )
+    duration: int = Field(description="Total meeting duration in seconds")
+    ongoing: bool = Field(description="Whether meeting is currently active")
+    max_participants: int = Field(description="Peak concurrent participant count")
+    participants: List[MeetingParticipant] = Field(
+        default_factory=list, description="Array of participant session data"
+    )
+
+
+class RecordingS3Info(BaseModel):
+    """
+    S3 bucket information for a recording.
+
+    Reference: https://docs.daily.co/reference/rest-api/recordings
+    """
+
+    bucket_name: NonEmptyString
+    bucket_region: NonEmptyString
+    endpoint: NonEmptyString | None = None
+
+
+class RecordingResponse(BaseModel):
+    """
+    Response from recording retrieval endpoint.
+
+    Reference: https://docs.daily.co/reference/rest-api/recordings
+    """
+
+    id: NonEmptyString = Field(description="Recording identifier")
+    room_name: NonEmptyString = Field(description="Room where recording occurred")
+    start_ts: int = Field(description="Recording start timestamp (Unix epoch seconds)")
+    status: RecordingStatus = Field(
+        description="Recording status ('in-progress' or 'finished')"
+    )
+    max_participants: int | None = Field(
+        None, description="Maximum participants during recording (may be missing)"
+    )
+    duration: int = Field(description="Recording duration in seconds")
+    share_token: NonEmptyString | None = Field(
+        None, description="Token for sharing recording"
+    )
+    s3: RecordingS3Info | None = Field(None, description="S3 bucket information")
+    tracks: list[DailyTrack] = Field(
+        default_factory=list,
+        description="Track list for raw-tracks recordings (always array, never null)",
+    )
+    # this is not a mistake but a deliberate Daily.co naming decision
+    mtgSessionId: NonEmptyString | None = Field(
+        None, description="Meeting session identifier (may be missing)"
+    )
+
+
+class MeetingTokenResponse(BaseModel):
+    """
+    Response from meeting token creation.
+
+    Reference: https://docs.daily.co/reference/rest-api/meeting-tokens/create-meeting-token
+    """
+
+    token: NonEmptyString = Field(
+        description="JWT meeting token for participant authentication"
+    )
+
+
+class WebhookResponse(BaseModel):
+    """
+    Response from webhook creation or retrieval.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks
+    """
+
+    uuid: NonEmptyString = Field(description="Unique webhook identifier")
+    url: NonEmptyString = Field(description="Webhook endpoint URL")
+    hmac: NonEmptyString | None = Field(
+        None, description="Base64-encoded HMAC secret for signature verification"
+    )
+    basicAuth: NonEmptyString | None = Field(
+        None, description="Basic auth credentials if configured"
+    )
+    eventTypes: List[NonEmptyString] = Field(
+        default_factory=list,
+        description="Array of event types (e.g., ['recording.started', 'participant.joined'])",
+    )
+    state: Literal["ACTIVE", "FAILED"] = Field(
+        description="Webhook state - FAILED after 3+ consecutive failures"
+    )
+    failedCount: int = Field(default=0, description="Number of consecutive failures")
+    lastMomentPushed: NonEmptyString | None = Field(
+        None, description="ISO 8601 timestamp of last successful push"
+    )
+    domainId: NonEmptyString = Field(description="Daily.co domain/account identifier")
+    createdAt: NonEmptyString = Field(description="ISO 8601 creation timestamp")
+    updatedAt: NonEmptyString = Field(description="ISO 8601 last update timestamp")

server/reflector/dailyco_api/webhook_utils.py

@@ -0,0 +1,228 @@
+"""
+Daily.co Webhook Utilities
+
+Utilities for verifying and parsing Daily.co webhook events.
+
+Reference: https://docs.daily.co/reference/rest-api/webhooks
+"""
+
+import base64
+import hmac
+from hashlib import sha256
+
+import structlog
+
+from .webhooks import (
+    DailyWebhookEvent,
+    ParticipantJoinedPayload,
+    ParticipantLeftPayload,
+    RecordingErrorPayload,
+    RecordingReadyToDownloadPayload,
+    RecordingStartedPayload,
+)
+
+logger = structlog.get_logger(__name__)
+
+
+def verify_webhook_signature(
+    body: bytes,
+    signature: str,
+    timestamp: str,
+    webhook_secret: str,
+) -> bool:
+    """
+    Verify Daily.co webhook signature using HMAC-SHA256.
+
+    Daily.co signature verification:
+    1. Base64-decode the webhook secret
+    2. Create signed content: timestamp + '.' + body
+    3. Compute HMAC-SHA256(secret, signed_content)
+    4. Base64-encode the result
+    5. Compare with provided signature using constant-time comparison
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks
+
+    Args:
+        body: Raw request body bytes
+        signature: X-Webhook-Signature header value
+        timestamp: X-Webhook-Timestamp header value
+        webhook_secret: Base64-encoded HMAC secret
+
+    Returns:
+        True if signature is valid, False otherwise
+
+    Example:
+        >>> body = b'{"version":"1.0.0","type":"participant.joined",...}'
+        >>> signature = "abc123..."
+        >>> timestamp = "1234567890"
+        >>> secret = "your-base64-secret"
+        >>> is_valid = verify_webhook_signature(body, signature, timestamp, secret)
+    """
+    if not signature or not timestamp or not webhook_secret:
+        logger.warning(
+            "Missing required data for webhook verification",
+            has_signature=bool(signature),
+            has_timestamp=bool(timestamp),
+            has_secret=bool(webhook_secret),
+        )
+        return False
+
+    try:
+        secret_bytes = base64.b64decode(webhook_secret)
+        signed_content = timestamp.encode() + b"." + body
+        expected = hmac.new(secret_bytes, signed_content, sha256).digest()
+        expected_b64 = base64.b64encode(expected).decode()
+
+        # Constant-time comparison to prevent timing attacks
+        return hmac.compare_digest(expected_b64, signature)
+
+    except (base64.binascii.Error, ValueError, TypeError, UnicodeDecodeError) as e:
+        logger.error(
+            "Webhook signature verification failed",
+            error=str(e),
+            error_type=type(e).__name__,
+        )
+        return False
+
+
+def extract_room_name(event: DailyWebhookEvent) -> str | None:
+    """
+    Extract room name from Daily.co webhook event payload.
+
+    Args:
+        event: Parsed webhook event
+
+    Returns:
+        Room name if present and is a string, None otherwise
+
+    Example:
+        >>> event = DailyWebhookEvent(**webhook_payload)
+        >>> room_name = extract_room_name(event)
+    """
+    room = event.payload.get("room_name")
+    # Ensure we return a string, not any falsy value that might be in payload
+    return room if isinstance(room, str) else None
+
+
+def parse_participant_joined(event: DailyWebhookEvent) -> ParticipantJoinedPayload:
+    """
+    Parse participant.joined webhook event payload.
+
+    Args:
+        event: Webhook event with type "participant.joined"
+
+    Returns:
+        Parsed participant joined payload
+
+    Raises:
+        pydantic.ValidationError: If payload doesn't match expected schema
+    """
+    return ParticipantJoinedPayload(**event.payload)
+
+
+def parse_participant_left(event: DailyWebhookEvent) -> ParticipantLeftPayload:
+    """
+    Parse participant.left webhook event payload.
+
+    Args:
+        event: Webhook event with type "participant.left"
+
+    Returns:
+        Parsed participant left payload
+
+    Raises:
+        pydantic.ValidationError: If payload doesn't match expected schema
+    """
+    return ParticipantLeftPayload(**event.payload)
+
+
+def parse_recording_started(event: DailyWebhookEvent) -> RecordingStartedPayload:
+    """
+    Parse recording.started webhook event payload.
+
+    Args:
+        event: Webhook event with type "recording.started"
+
+    Returns:
+        Parsed recording started payload
+
+    Raises:
+        pydantic.ValidationError: If payload doesn't match expected schema
+    """
+    return RecordingStartedPayload(**event.payload)
+
+
+def parse_recording_ready(
+    event: DailyWebhookEvent,
+) -> RecordingReadyToDownloadPayload:
+    """
+    Parse recording.ready-to-download webhook event payload.
+
+    This event is sent when raw-tracks recordings are complete and uploaded to S3.
+    The payload includes a 'tracks' array with individual audio/video files.
+
+    Args:
+        event: Webhook event with type "recording.ready-to-download"
+
+    Returns:
+        Parsed recording ready payload with tracks array
+
+    Raises:
+        pydantic.ValidationError: If payload doesn't match expected schema
+
+    Example:
+        >>> event = DailyWebhookEvent(**webhook_payload)
+        >>> if event.type == "recording.ready-to-download":
+        ...     payload = parse_recording_ready(event)
+        ...     audio_tracks = [t for t in payload.tracks if t.type == "audio"]
+    """
+    return RecordingReadyToDownloadPayload(**event.payload)
+
+
+def parse_recording_error(event: DailyWebhookEvent) -> RecordingErrorPayload:
+    """
+    Parse recording.error webhook event payload.
+
+    Args:
+        event: Webhook event with type "recording.error"
+
+    Returns:
+        Parsed recording error payload
+
+    Raises:
+        pydantic.ValidationError: If payload doesn't match expected schema
+    """
+    return RecordingErrorPayload(**event.payload)
+
+
+WEBHOOK_PARSERS = {
+    "participant.joined": parse_participant_joined,
+    "participant.left": parse_participant_left,
+    "recording.started": parse_recording_started,
+    "recording.ready-to-download": parse_recording_ready,
+    "recording.error": parse_recording_error,
+}
+
+
+def parse_webhook_payload(event: DailyWebhookEvent):
+    """
+    Parse webhook event payload based on event type.
+
+    Args:
+        event: Webhook event
+
+    Returns:
+        Typed payload model based on event type, or raw dict if unknown
+
+    Example:
+        >>> event = DailyWebhookEvent(**webhook_payload)
+        >>> payload = parse_webhook_payload(event)
+        >>> if isinstance(payload, ParticipantJoinedPayload):
+        ...     print(f"User {payload.user_name} joined")
+    """
+    parser = WEBHOOK_PARSERS.get(event.type)
+    if parser:
+        return parser(event)
+    else:
+        logger.warning("Unknown webhook event type", event_type=event.type)
+        return event.payload

server/reflector/dailyco_api/webhooks.py

@@ -0,0 +1,271 @@
+"""
+Daily.co Webhook Event Models
+
+Reference: https://docs.daily.co/reference/rest-api/webhooks
+"""
+
+from typing import Annotated, Any, Dict, Literal, Union
+
+from pydantic import BaseModel, Field, field_validator
+
+from reflector.utils.string import NonEmptyString
+
+
+def normalize_timestamp_to_int(v):
+    """
+    Normalize float timestamps to int by truncating decimal part.
+
+    Daily.co sometimes sends timestamps as floats (e.g., 1708972279.96).
+    Pydantic expects int for fields typed as `int`.
+    """
+    if v is None:
+        return v
+    if isinstance(v, float):
+        return int(v)
+    return v
+
+
+WebhookEventType = Literal[
+    "participant.joined",
+    "participant.left",
+    "recording.started",
+    "recording.ready-to-download",
+    "recording.error",
+]
+
+
+class DailyTrack(BaseModel):
+    """
+    Individual audio or video track from a multitrack recording.
+
+    Reference: https://docs.daily.co/reference/rest-api/recordings
+    """
+
+    type: Literal["audio", "video"]
+    s3Key: NonEmptyString = Field(description="S3 object key for the track file")
+    size: int = Field(description="File size in bytes")
+
+
+class DailyWebhookEvent(BaseModel):
+    """
+    Base structure for all Daily.co webhook events.
+    All events share five common fields documented below.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks
+    """
+
+    version: NonEmptyString = Field(
+        description="Represents the version of the event. This uses semantic versioning to inform a consumer if the payload has introduced any breaking changes"
+    )
+    type: WebhookEventType = Field(
+        description="Represents the type of the event described in the payload"
+    )
+    id: NonEmptyString = Field(
+        description="An identifier representing this specific event"
+    )
+    payload: Dict[NonEmptyString, Any] = Field(
+        description="An object representing the event, whose fields are described in the corresponding payload class"
+    )
+    event_ts: int = Field(
+        description="Documenting when the webhook itself was sent. This timestamp is different than the time of the event the webhook describes. For example, a recording.started event will contain a start_ts timestamp of when the actual recording started, and a slightly later event_ts timestamp indicating when the webhook event was sent"
+    )
+
+    _normalize_event_ts = field_validator("event_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class ParticipantJoinedPayload(BaseModel):
+    """
+    Payload for participant.joined webhook event.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks/events/participant-joined
+    """
+
+    room_name: NonEmptyString | None = Field(None, description="Daily.co room name")
+    session_id: NonEmptyString = Field(description="Daily.co session identifier")
+    user_id: NonEmptyString = Field(description="User identifier (may be encoded)")
+    user_name: NonEmptyString | None = Field(None, description="User display name")
+    joined_at: int = Field(description="Join timestamp in Unix epoch seconds")
+
+    _normalize_joined_at = field_validator("joined_at", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class ParticipantLeftPayload(BaseModel):
+    """
+    Payload for participant.left webhook event.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks/events/participant-left
+    """
+
+    room_name: NonEmptyString | None = Field(None, description="Daily.co room name")
+    session_id: NonEmptyString = Field(description="Daily.co session identifier")
+    user_id: NonEmptyString = Field(description="User identifier (may be encoded)")
+    user_name: NonEmptyString | None = Field(None, description="User display name")
+    joined_at: int = Field(description="Join timestamp in Unix epoch seconds")
+    duration: int | None = Field(
+        None, description="Duration of participation in seconds"
+    )
+
+    _normalize_joined_at = field_validator("joined_at", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class RecordingStartedPayload(BaseModel):
+    """
+    Payload for recording.started webhook event.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks/events/recording-started
+    """
+
+    room_name: NonEmptyString | None = Field(None, description="Daily.co room name")
+    recording_id: NonEmptyString = Field(description="Recording identifier")
+    start_ts: int | None = Field(None, description="Recording start timestamp")
+
+    _normalize_start_ts = field_validator("start_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class RecordingReadyToDownloadPayload(BaseModel):
+    """
+    Payload for recording.ready-to-download webhook event.
+    This is sent when raw-tracks recordings are complete and uploaded to S3.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks/events/recording-ready-to-download
+    """
+
+    type: Literal["cloud", "raw-tracks"] = Field(
+        description="The type of recording that was generated"
+    )
+    recording_id: NonEmptyString = Field(
+        description="An ID identifying the recording that was generated"
+    )
+    room_name: NonEmptyString = Field(
+        description="The name of the room where the recording was made"
+    )
+    start_ts: int = Field(
+        description="The Unix epoch time in seconds representing when the recording started"
+    )
+    status: Literal["finished"] = Field(
+        description="The status of the given recording (always 'finished' in ready-to-download webhook, see RecordingStatus in responses.py for full API statuses)"
+    )
+    max_participants: int = Field(
+        description="The number of participants on the call that were recorded"
+    )
+    duration: int = Field(description="The duration in seconds of the call")
+    s3_key: NonEmptyString = Field(
+        description="The location of the recording in the provided S3 bucket"
+    )
+    share_token: NonEmptyString | None = Field(
+        None, description="undocumented documented secret field"
+    )
+    tracks: list[DailyTrack] | None = Field(
+        None,
+        description="If the recording is a raw-tracks recording, a tracks field will be provided. If role permissions have been removed, the tracks field may be null",
+    )
+
+    _normalize_start_ts = field_validator("start_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class RecordingErrorPayload(BaseModel):
+    """
+    Payload for recording.error webhook event.
+
+    Reference: https://docs.daily.co/reference/rest-api/webhooks/events/recording-error
+    """
+
+    action: Literal["clourd-recording-err", "cloud-recording-error"] = Field(
+        description="A string describing the event that was emitted (both variants are documented)"
+    )
+    error_msg: NonEmptyString = Field(description="The error message returned")
+    instance_id: NonEmptyString = Field(
+        description="The recording instance ID that was passed into the start recording command"
+    )
+    room_name: NonEmptyString = Field(
+        description="The name of the room where the recording was made"
+    )
+    timestamp: int = Field(
+        description="The Unix epoch time in seconds representing when the error was emitted"
+    )
+
+    _normalize_timestamp = field_validator("timestamp", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class ParticipantJoinedEvent(BaseModel):
+    version: NonEmptyString
+    type: Literal["participant.joined"]
+    id: NonEmptyString
+    payload: ParticipantJoinedPayload
+    event_ts: int
+
+    _normalize_event_ts = field_validator("event_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class ParticipantLeftEvent(BaseModel):
+    version: NonEmptyString
+    type: Literal["participant.left"]
+    id: NonEmptyString
+    payload: ParticipantLeftPayload
+    event_ts: int
+
+    _normalize_event_ts = field_validator("event_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class RecordingStartedEvent(BaseModel):
+    version: NonEmptyString
+    type: Literal["recording.started"]
+    id: NonEmptyString
+    payload: RecordingStartedPayload
+    event_ts: int
+
+    _normalize_event_ts = field_validator("event_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class RecordingReadyEvent(BaseModel):
+    version: NonEmptyString
+    type: Literal["recording.ready-to-download"]
+    id: NonEmptyString
+    payload: RecordingReadyToDownloadPayload
+    event_ts: int
+
+    _normalize_event_ts = field_validator("event_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+class RecordingErrorEvent(BaseModel):
+    version: NonEmptyString
+    type: Literal["recording.error"]
+    id: NonEmptyString
+    payload: RecordingErrorPayload
+    event_ts: int
+
+    _normalize_event_ts = field_validator("event_ts", mode="before")(
+        normalize_timestamp_to_int
+    )
+
+
+DailyWebhookEventUnion = Annotated[
+    Union[
+        ParticipantJoinedEvent,
+        ParticipantLeftEvent,
+        RecordingStartedEvent,
+        RecordingReadyEvent,
+        RecordingErrorEvent,
+    ],
+    Field(discriminator="type"),
+]

server/reflector/db/__init__.py

@@ -25,11 +25,13 @@ def get_database() -> databases.Database:
 
 # import models
 import reflector.db.calendar_events  # noqa
+import reflector.db.daily_participant_sessions  # noqa
 import reflector.db.meetings  # noqa
 import reflector.db.recordings  # noqa
 import reflector.db.rooms  # noqa
 import reflector.db.transcripts  # noqa
 import reflector.db.user_api_keys  # noqa
+import reflector.db.users  # noqa
 
 kwargs = {}
 if "postgres" not in settings.DATABASE_URL:

server/reflector/db/daily_participant_sessions.py

@@ -0,0 +1,229 @@
+"""Daily.co participant session tracking.
+
+Stores webhook data for participant.joined and participant.left events to provide
+historical session information (Daily.co API only returns current participants).
+"""
+
+from datetime import datetime
+
+import sqlalchemy as sa
+from pydantic import BaseModel
+from sqlalchemy.dialects.postgresql import insert
+
+from reflector.db import get_database, metadata
+from reflector.utils.string import NonEmptyString
+
+daily_participant_sessions = sa.Table(
+    "daily_participant_session",
+    metadata,
+    sa.Column("id", sa.String, primary_key=True),
+    sa.Column(
+        "meeting_id",
+        sa.String,
+        sa.ForeignKey("meeting.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    sa.Column(
+        "room_id",
+        sa.String,
+        sa.ForeignKey("room.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    sa.Column("session_id", sa.String, nullable=False),
+    sa.Column("user_id", sa.String, nullable=True),
+    sa.Column("user_name", sa.String, nullable=False),
+    sa.Column("joined_at", sa.DateTime(timezone=True), nullable=False),
+    sa.Column("left_at", sa.DateTime(timezone=True), nullable=True),
+    sa.Index("idx_daily_session_meeting_left", "meeting_id", "left_at"),
+    sa.Index("idx_daily_session_room", "room_id"),
+)
+
+
+class DailyParticipantSession(BaseModel):
+    """Daily.co participant session record.
+
+    Tracks when a participant joined and left a meeting. Populated from webhooks:
+    - participant.joined: Creates record with left_at=None
+    - participant.left: Updates record with left_at
+
+    ID format: {meeting_id}:{user_id}:{joined_at_ms}
+    - Ensures idempotency (duplicate webhooks don't create duplicates)
+    - Allows same user to rejoin (different joined_at = different session)
+
+    Duration is calculated as: left_at - joined_at (not stored)
+    """
+
+    id: NonEmptyString
+    meeting_id: NonEmptyString
+    room_id: NonEmptyString
+    session_id: NonEmptyString  # Daily.co's session_id (identifies room session)
+    user_id: NonEmptyString | None = None
+    user_name: str
+    joined_at: datetime
+    left_at: datetime | None = None
+
+
+class DailyParticipantSessionController:
+    """Controller for Daily.co participant session persistence."""
+
+    async def get_by_id(self, id: str) -> DailyParticipantSession | None:
+        """Get a session by its ID."""
+        query = daily_participant_sessions.select().where(
+            daily_participant_sessions.c.id == id
+        )
+        result = await get_database().fetch_one(query)
+        return DailyParticipantSession(**result) if result else None
+
+    async def get_open_session(
+        self, meeting_id: NonEmptyString, session_id: NonEmptyString
+    ) -> DailyParticipantSession | None:
+        """Get the open (not left) session for a user in a meeting."""
+        query = daily_participant_sessions.select().where(
+            sa.and_(
+                daily_participant_sessions.c.meeting_id == meeting_id,
+                daily_participant_sessions.c.session_id == session_id,
+                daily_participant_sessions.c.left_at.is_(None),
+            )
+        )
+        results = await get_database().fetch_all(query)
+
+        if len(results) > 1:
+            raise ValueError(
+                f"Multiple open sessions for daily session {session_id} in meeting {meeting_id}: "
+                f"found {len(results)} sessions"
+            )
+
+        return DailyParticipantSession(**results[0]) if results else None
+
+    async def upsert_joined(self, session: DailyParticipantSession) -> None:
+        """Insert or update when participant.joined webhook arrives.
+
+        Idempotent: Duplicate webhooks with same ID are safely ignored.
+        Out-of-order: If left webhook arrived first, preserves left_at.
+        """
+        query = insert(daily_participant_sessions).values(**session.model_dump())
+        query = query.on_conflict_do_update(
+            index_elements=["id"],
+            set_={"user_name": session.user_name},
+        )
+        await get_database().execute(query)
+
+    async def upsert_left(self, session: DailyParticipantSession) -> None:
+        """Update session when participant.left webhook arrives.
+
+        Finds the open session for this user in this meeting and updates left_at.
+        Works around Daily.co webhook timestamp inconsistency (joined_at differs by ~4ms between webhooks).
+
+        Handles three cases:
+        1. Normal flow: open session exists → updates left_at
+        2. Out-of-order: left arrives first → creates new record with left data
+        3. Duplicate: left arrives again → idempotent (DB trigger prevents left_at modification)
+        """
+        if session.left_at is None:
+            raise ValueError("left_at is required for upsert_left")
+
+        if session.left_at <= session.joined_at:
+            raise ValueError(
+                f"left_at ({session.left_at}) must be after joined_at ({session.joined_at})"
+            )
+
+        # Find existing open session (works around timestamp mismatch in webhooks)
+        existing = await self.get_open_session(session.meeting_id, session.session_id)
+
+        if existing:
+            # Update existing open session
+            query = (
+                daily_participant_sessions.update()
+                .where(daily_participant_sessions.c.id == existing.id)
+                .values(left_at=session.left_at)
+            )
+            await get_database().execute(query)
+        else:
+            # Out-of-order or first webhook: insert new record
+            query = insert(daily_participant_sessions).values(**session.model_dump())
+            query = query.on_conflict_do_nothing(index_elements=["id"])
+            await get_database().execute(query)
+
+    async def get_by_meeting(self, meeting_id: str) -> list[DailyParticipantSession]:
+        """Get all participant sessions for a meeting (active and ended)."""
+        query = daily_participant_sessions.select().where(
+            daily_participant_sessions.c.meeting_id == meeting_id
+        )
+        results = await get_database().fetch_all(query)
+        return [DailyParticipantSession(**result) for result in results]
+
+    async def get_active_by_meeting(
+        self, meeting_id: str
+    ) -> list[DailyParticipantSession]:
+        """Get only active (not left) participant sessions for a meeting."""
+        query = daily_participant_sessions.select().where(
+            sa.and_(
+                daily_participant_sessions.c.meeting_id == meeting_id,
+                daily_participant_sessions.c.left_at.is_(None),
+            )
+        )
+        results = await get_database().fetch_all(query)
+        return [DailyParticipantSession(**result) for result in results]
+
+    async def get_all_sessions_for_meeting(
+        self, meeting_id: NonEmptyString
+    ) -> dict[NonEmptyString, DailyParticipantSession]:
+        query = daily_participant_sessions.select().where(
+            daily_participant_sessions.c.meeting_id == meeting_id
+        )
+        results = await get_database().fetch_all(query)
+        # TODO DailySessionId custom type
+        return {row["session_id"]: DailyParticipantSession(**row) for row in results}
+
+    async def batch_upsert_sessions(
+        self, sessions: list[DailyParticipantSession]
+    ) -> None:
+        """Upsert multiple sessions in single query.
+
+        Uses ON CONFLICT for idempotency. Updates user_name on conflict since they may change it during a meeting.
+
+        """
+        if not sessions:
+            return
+
+        values = [session.model_dump() for session in sessions]
+        query = insert(daily_participant_sessions).values(values)
+        query = query.on_conflict_do_update(
+            index_elements=["id"],
+            set_={
+                # Preserve existing left_at to prevent race conditions
+                "left_at": sa.func.coalesce(
+                    daily_participant_sessions.c.left_at,
+                    query.excluded.left_at,
+                ),
+                "user_name": query.excluded.user_name,
+            },
+        )
+        await get_database().execute(query)
+
+    async def batch_close_sessions(
+        self, session_ids: list[NonEmptyString], left_at: datetime
+    ) -> None:
+        """Mark multiple sessions as left in single query.
+
+        Only updates sessions where left_at is NULL (protects already-closed sessions).
+
+        Left_at mismatch for existing sessions is ignored, assumed to be not important issue if ever happens.
+        """
+        if not session_ids:
+            return
+
+        query = (
+            daily_participant_sessions.update()
+            .where(
+                sa.and_(
+                    daily_participant_sessions.c.id.in_(session_ids),
+                    daily_participant_sessions.c.left_at.is_(None),
+                )
+            )
+            .values(left_at=left_at)
+        )
+        await get_database().execute(query)
+
+
+daily_participant_sessions_controller = DailyParticipantSessionController()

server/reflector/db/meetings.py

@@ -10,7 +10,6 @@ from reflector.db.rooms import Room
 from reflector.schemas.platform import WHEREBY_PLATFORM, Platform
 from reflector.utils import generate_uuid4
 from reflector.utils.string import assert_equal
-from reflector.video_platforms.factory import get_platform
 
 meetings = sa.Table(
     "meeting",
@@ -140,14 +139,17 @@ class MeetingController:
             recording_trigger=room.recording_trigger,
             calendar_event_id=calendar_event_id,
             calendar_metadata=calendar_metadata,
-            platform=get_platform(room.platform),
+            platform=room.platform,
         )
         query = meetings.insert().values(**meeting.model_dump())
         await get_database().execute(query)
         return meeting
 
-    async def get_all_active(self) -> list[Meeting]:
-        query = meetings.select().where(meetings.c.is_active)
+    async def get_all_active(self, platform: str | None = None) -> list[Meeting]:
+        conditions = [meetings.c.is_active]
+        if platform is not None:
+            conditions.append(meetings.c.platform == platform)
+        query = meetings.select().where(sa.and_(*conditions))
         results = await get_database().fetch_all(query)
         return [Meeting(**result) for result in results]
 

server/reflector/db/recordings.py

@@ -44,12 +44,14 @@ class RecordingController:
         await get_database().execute(query)
         return recording
 
-    async def get_by_id(self, id: str) -> Recording:
+    async def get_by_id(self, id: str) -> Recording | None:
         query = recordings.select().where(recordings.c.id == id)
         result = await get_database().fetch_one(query)
         return Recording(**result) if result else None
 
-    async def get_by_object_key(self, bucket_name: str, object_key: str) -> Recording:
+    async def get_by_object_key(
+        self, bucket_name: str, object_key: str
+    ) -> Recording | None:
         query = recordings.select().where(
             recordings.c.bucket_name == bucket_name,
             recordings.c.object_key == object_key,
@@ -61,5 +63,14 @@ class RecordingController:
         query = recordings.delete().where(recordings.c.id == id)
         await get_database().execute(query)
 
+    # no check for existence
+    async def get_by_ids(self, recording_ids: list[str]) -> list[Recording]:
+        if not recording_ids:
+            return []
+
+        query = recordings.select().where(recordings.c.id.in_(recording_ids))
+        results = await get_database().fetch_all(query)
+        return [Recording(**row) for row in results]
+
 
 recordings_controller = RecordingController()

server/reflector/db/rooms.py

@@ -10,6 +10,7 @@ from sqlalchemy.sql import false, or_
 
 from reflector.db import get_database, metadata
 from reflector.schemas.platform import Platform
+from reflector.settings import settings
 from reflector.utils import generate_uuid4
 
 rooms = sqlalchemy.Table(
@@ -54,8 +55,7 @@ rooms = sqlalchemy.Table(
     sqlalchemy.Column(
         "platform",
         sqlalchemy.String,
-        nullable=True,
-        server_default=None,
+        nullable=False,
     ),
     sqlalchemy.Index("idx_room_is_shared", "is_shared"),
     sqlalchemy.Index("idx_room_ics_enabled", "ics_enabled"),
@@ -84,7 +84,7 @@ class Room(BaseModel):
     ics_enabled: bool = False
     ics_last_sync: datetime | None = None
     ics_last_etag: str | None = None
-    platform: Platform | None = None
+    platform: Platform = Field(default_factory=lambda: settings.DEFAULT_VIDEO_PLATFORM)
 
 
 class RoomController:
@@ -138,7 +138,7 @@ class RoomController:
         ics_url: str | None = None,
         ics_fetch_interval: int = 300,
         ics_enabled: bool = False,
-        platform: Platform | None = None,
+        platform: Platform = settings.DEFAULT_VIDEO_PLATFORM,
     ):
         """
         Add a new room
@@ -146,24 +146,26 @@ class RoomController:
         if webhook_url and not webhook_secret:
             webhook_secret = secrets.token_urlsafe(32)
 
-        room = Room(
-            name=name,
-            user_id=user_id,
-            zulip_auto_post=zulip_auto_post,
-            zulip_stream=zulip_stream,
-            zulip_topic=zulip_topic,
-            is_locked=is_locked,
-            room_mode=room_mode,
-            recording_type=recording_type,
-            recording_trigger=recording_trigger,
-            is_shared=is_shared,
-            webhook_url=webhook_url,
-            webhook_secret=webhook_secret,
-            ics_url=ics_url,
-            ics_fetch_interval=ics_fetch_interval,
-            ics_enabled=ics_enabled,
-            platform=platform,
-        )
+        room_data = {
+            "name": name,
+            "user_id": user_id,
+            "zulip_auto_post": zulip_auto_post,
+            "zulip_stream": zulip_stream,
+            "zulip_topic": zulip_topic,
+            "is_locked": is_locked,
+            "room_mode": room_mode,
+            "recording_type": recording_type,
+            "recording_trigger": recording_trigger,
+            "is_shared": is_shared,
+            "webhook_url": webhook_url,
+            "webhook_secret": webhook_secret,
+            "ics_url": ics_url,
+            "ics_fetch_interval": ics_fetch_interval,
+            "ics_enabled": ics_enabled,
+            "platform": platform,
+        }
+
+        room = Room(**room_data)
         query = rooms.insert().values(**room.model_dump())
         try:
             await get_database().execute(query)

server/reflector/db/users.py

@@ -0,0 +1,92 @@
+"""User table for storing Authentik user information."""
+
+from datetime import datetime, timezone
+
+import sqlalchemy
+from pydantic import BaseModel, Field
+
+from reflector.db import get_database, metadata
+from reflector.utils import generate_uuid4
+from reflector.utils.string import NonEmptyString
+
+users = sqlalchemy.Table(
+    "user",
+    metadata,
+    sqlalchemy.Column("id", sqlalchemy.String, primary_key=True),
+    sqlalchemy.Column("email", sqlalchemy.String, nullable=False),
+    sqlalchemy.Column("authentik_uid", sqlalchemy.String, nullable=False),
+    sqlalchemy.Column("created_at", sqlalchemy.DateTime(timezone=True), nullable=False),
+    sqlalchemy.Column("updated_at", sqlalchemy.DateTime(timezone=True), nullable=False),
+    sqlalchemy.Index("idx_user_authentik_uid", "authentik_uid", unique=True),
+    sqlalchemy.Index("idx_user_email", "email", unique=False),
+)
+
+
+class User(BaseModel):
+    id: NonEmptyString = Field(default_factory=generate_uuid4)
+    email: NonEmptyString
+    authentik_uid: NonEmptyString
+    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+
+
+class UserController:
+    @staticmethod
+    async def get_by_id(user_id: NonEmptyString) -> User | None:
+        query = users.select().where(users.c.id == user_id)
+        result = await get_database().fetch_one(query)
+        return User(**result) if result else None
+
+    @staticmethod
+    async def get_by_authentik_uid(authentik_uid: NonEmptyString) -> User | None:
+        query = users.select().where(users.c.authentik_uid == authentik_uid)
+        result = await get_database().fetch_one(query)
+        return User(**result) if result else None
+
+    @staticmethod
+    async def get_by_email(email: NonEmptyString) -> User | None:
+        query = users.select().where(users.c.email == email)
+        result = await get_database().fetch_one(query)
+        return User(**result) if result else None
+
+    @staticmethod
+    async def create_or_update(
+        id: NonEmptyString, authentik_uid: NonEmptyString, email: NonEmptyString
+    ) -> User:
+        existing = await UserController.get_by_authentik_uid(authentik_uid)
+        now = datetime.now(timezone.utc)
+
+        if existing:
+            query = (
+                users.update()
+                .where(users.c.authentik_uid == authentik_uid)
+                .values(email=email, updated_at=now)
+            )
+            await get_database().execute(query)
+            return User(
+                id=existing.id,
+                authentik_uid=authentik_uid,
+                email=email,
+                created_at=existing.created_at,
+                updated_at=now,
+            )
+        else:
+            user = User(
+                id=id,
+                authentik_uid=authentik_uid,
+                email=email,
+                created_at=now,
+                updated_at=now,
+            )
+            query = users.insert().values(**user.model_dump())
+            await get_database().execute(query)
+            return user
+
+    @staticmethod
+    async def list_all() -> list[User]:
+        query = users.select().order_by(users.c.created_at.desc())
+        results = await get_database().fetch_all(query)
+        return [User(**r) for r in results]
+
+
+user_controller = UserController()

server/reflector/llm.py

@@ -1,3 +1,4 @@
+import logging
 from typing import Type, TypeVar
 
 from llama_index.core import Settings
@@ -5,7 +6,7 @@ from llama_index.core.output_parsers import PydanticOutputParser
 from llama_index.core.program import LLMTextCompletionProgram
 from llama_index.core.response_synthesizers import TreeSummarize
 from llama_index.llms.openai_like import OpenAILike
-from pydantic import BaseModel
+from pydantic import BaseModel, ValidationError
 
 T = TypeVar("T", bound=BaseModel)
 
@@ -61,6 +62,8 @@ class LLM:
         tone_name: str | None = None,
     ) -> T:
         """Get structured output from LLM for non-function-calling models"""
+        logger = logging.getLogger(__name__)
+
         summarizer = TreeSummarize(verbose=True)
         response = await summarizer.aget_response(prompt, texts, tone_name=tone_name)
 
@@ -76,8 +79,25 @@ class LLM:
             "Please structure the above information in the following JSON format:"
         )
 
-        output = await program.acall(
-            analysis=str(response), format_instructions=format_instructions
-        )
+        try:
+            output = await program.acall(
+                analysis=str(response), format_instructions=format_instructions
+            )
+        except ValidationError as e:
+            # Extract the raw JSON from the error details
+            errors = e.errors()
+            if errors and "input" in errors[0]:
+                raw_json = errors[0]["input"]
+                logger.error(
+                    f"JSON validation failed for {output_cls.__name__}. "
+                    f"Full raw JSON output:\n{raw_json}\n"
+                    f"Validation errors: {errors}"
+                )
+            else:
+                logger.error(
+                    f"JSON validation failed for {output_cls.__name__}. "
+                    f"Validation errors: {errors}"
+                )
+            raise
 
         return output

server/reflector/pipelines/main_multitrack_pipeline.py

@@ -582,7 +582,8 @@ class PipelineMainMultitrack(PipelineMainBase):
             t = await self.transcribe_file(padded_url, transcript.source_language)
 
             if not t.words:
-                continue
+                self.logger.debug(f"no words in track {idx}")
+                # not skipping, it may be silence or indistinguishable mumbling
 
             for w in t.words:
                 w.speaker = idx

server/reflector/services/transcript_process.py

@@ -0,0 +1,169 @@
+"""
+Transcript processing service - shared logic for HTTP endpoints and Celery tasks.
+
+This module provides result-based error handling that works in both contexts:
+- HTTP endpoint: converts errors to HTTPException
+- Celery task: converts errors to Exception
+"""
+
+from dataclasses import dataclass
+from typing import Literal, Union
+
+import celery
+from celery.result import AsyncResult
+
+from reflector.db.recordings import recordings_controller
+from reflector.db.transcripts import Transcript
+from reflector.pipelines.main_file_pipeline import task_pipeline_file_process
+from reflector.pipelines.main_multitrack_pipeline import (
+    task_pipeline_multitrack_process,
+)
+from reflector.utils.match import absurd
+from reflector.utils.string import NonEmptyString
+
+
+@dataclass
+class ProcessError:
+    detail: NonEmptyString
+
+
+@dataclass
+class FileProcessingConfig:
+    transcript_id: NonEmptyString
+    mode: Literal["file"] = "file"
+
+
+@dataclass
+class MultitrackProcessingConfig:
+    transcript_id: NonEmptyString
+    bucket_name: NonEmptyString
+    track_keys: list[str]
+    mode: Literal["multitrack"] = "multitrack"
+
+
+ProcessingConfig = Union[FileProcessingConfig, MultitrackProcessingConfig]
+PrepareResult = Union[ProcessingConfig, ProcessError]
+
+
+@dataclass
+class ValidationOk:
+    # transcript currently doesnt always have recording_id
+    recording_id: NonEmptyString | None
+    transcript_id: NonEmptyString
+
+
+@dataclass
+class ValidationLocked:
+    detail: NonEmptyString
+
+
+@dataclass
+class ValidationNotReady:
+    detail: NonEmptyString
+
+
+@dataclass
+class ValidationAlreadyScheduled:
+    detail: NonEmptyString
+
+
+ValidationError = Union[
+    ValidationNotReady, ValidationLocked, ValidationAlreadyScheduled
+]
+ValidationResult = Union[ValidationOk, ValidationError]
+
+
+@dataclass
+class DispatchOk:
+    status: Literal["ok"] = "ok"
+
+
+@dataclass
+class DispatchAlreadyRunning:
+    status: Literal["already_running"] = "already_running"
+
+
+DispatchResult = Union[
+    DispatchOk, DispatchAlreadyRunning, ProcessError, ValidationError
+]
+
+
+async def validate_transcript_for_processing(
+    transcript: Transcript,
+) -> ValidationResult:
+    if transcript.locked:
+        return ValidationLocked(detail="Recording is locked")
+
+    if transcript.status == "idle":
+        return ValidationNotReady(detail="Recording is not ready for processing")
+
+    if task_is_scheduled_or_active(
+        "reflector.pipelines.main_file_pipeline.task_pipeline_file_process",
+        transcript_id=transcript.id,
+    ) or task_is_scheduled_or_active(
+        "reflector.pipelines.main_multitrack_pipeline.task_pipeline_multitrack_process",
+        transcript_id=transcript.id,
+    ):
+        return ValidationAlreadyScheduled(detail="already running")
+
+    return ValidationOk(
+        recording_id=transcript.recording_id, transcript_id=transcript.id
+    )
+
+
+async def prepare_transcript_processing(validation: ValidationOk) -> PrepareResult:
+    """
+    Determine processing mode from transcript/recording data.
+    """
+    bucket_name: str | None = None
+    track_keys: list[str] | None = None
+
+    if validation.recording_id:
+        recording = await recordings_controller.get_by_id(validation.recording_id)
+        if recording:
+            bucket_name = recording.bucket_name
+            track_keys = recording.track_keys
+
+            if track_keys is not None and len(track_keys) == 0:
+                return ProcessError(
+                    detail="No track keys found, must be either > 0 or None",
+                )
+            if track_keys is not None and not bucket_name:
+                return ProcessError(
+                    detail="Bucket name must be specified",
+                )
+
+    if track_keys:
+        return MultitrackProcessingConfig(
+            bucket_name=bucket_name,  # type: ignore (validated above)
+            track_keys=track_keys,
+            transcript_id=validation.transcript_id,
+        )
+
+    return FileProcessingConfig(
+        transcript_id=validation.transcript_id,
+    )
+
+
+def dispatch_transcript_processing(config: ProcessingConfig) -> AsyncResult:
+    if isinstance(config, MultitrackProcessingConfig):
+        return task_pipeline_multitrack_process.delay(
+            transcript_id=config.transcript_id,
+            bucket_name=config.bucket_name,
+            track_keys=config.track_keys,
+        )
+    elif isinstance(config, FileProcessingConfig):
+        return task_pipeline_file_process.delay(transcript_id=config.transcript_id)
+    else:
+        absurd(config)
+
+
+def task_is_scheduled_or_active(task_name: str, **kwargs):
+    inspect = celery.current_app.control.inspect()
+
+    for worker, tasks in (inspect.scheduled() | inspect.active()).items():
+        for task in tasks:
+            if task["name"] == task_name and task["kwargs"] == kwargs:
+                return True
+
+    return False

server/reflector/settings.py

@@ -138,7 +138,6 @@ class Settings(BaseSettings):
     DAILY_WEBHOOK_UUID: str | None = (
         None  # Webhook UUID for this environment. Not used by production code
     )
-
     # Platform Configuration
     DEFAULT_VIDEO_PLATFORM: Platform = WHEREBY_PLATFORM
 

server/reflector/tools/cli_multitrack.py

@@ -0,0 +1,347 @@
+import asyncio
+import sys
+import time
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional, Protocol
+
+import structlog
+from celery.result import AsyncResult
+
+from reflector.db import get_database
+from reflector.db.transcripts import SourceKind, Transcript, transcripts_controller
+from reflector.pipelines.main_multitrack_pipeline import (
+    task_pipeline_multitrack_process,
+)
+from reflector.storage import get_transcripts_storage
+from reflector.tools.process import (
+    extract_result_from_entry,
+    parse_s3_url,
+    validate_s3_objects,
+)
+
+logger = structlog.get_logger(__name__)
+
+DEFAULT_PROCESSING_TIMEOUT_SECONDS = 3600
+
+MAX_ERROR_MESSAGE_LENGTH = 500
+
+TASK_POLL_INTERVAL_SECONDS = 2
+
+
+class StatusCallback(Protocol):
+    def __call__(self, state: str, elapsed_seconds: int) -> None: ...
+
+
+@dataclass
+class MultitrackTaskResult:
+    success: bool
+    transcript_id: str
+    error: Optional[str] = None
+
+
+async def create_multitrack_transcript(
+    bucket_name: str,
+    track_keys: List[str],
+    source_language: str,
+    target_language: str,
+    user_id: Optional[str] = None,
+) -> Transcript:
+    num_tracks = len(track_keys)
+    track_word = "track" if num_tracks == 1 else "tracks"
+    transcript_name = f"Multitrack ({num_tracks} {track_word})"
+
+    transcript = await transcripts_controller.add(
+        transcript_name,
+        source_kind=SourceKind.FILE,
+        source_language=source_language,
+        target_language=target_language,
+        user_id=user_id,
+    )
+
+    logger.info(
+        "Created multitrack transcript",
+        transcript_id=transcript.id,
+        name=transcript_name,
+        bucket=bucket_name,
+        num_tracks=len(track_keys),
+    )
+
+    return transcript
+
+
+def submit_multitrack_task(
+    transcript_id: str, bucket_name: str, track_keys: List[str]
+) -> AsyncResult:
+    result = task_pipeline_multitrack_process.delay(
+        transcript_id=transcript_id,
+        bucket_name=bucket_name,
+        track_keys=track_keys,
+    )
+
+    logger.info(
+        "Multitrack task submitted",
+        transcript_id=transcript_id,
+        task_id=result.id,
+        bucket=bucket_name,
+        num_tracks=len(track_keys),
+    )
+
+    return result
+
+
+async def wait_for_task(
+    result: AsyncResult,
+    transcript_id: str,
+    timeout_seconds: int = DEFAULT_PROCESSING_TIMEOUT_SECONDS,
+    poll_interval: int = TASK_POLL_INTERVAL_SECONDS,
+    status_callback: Optional[StatusCallback] = None,
+) -> MultitrackTaskResult:
+    start_time = time.time()
+    last_status = None
+
+    while not result.ready():
+        elapsed = time.time() - start_time
+        if elapsed > timeout_seconds:
+            error_msg = (
+                f"Task {result.id} did not complete within {timeout_seconds}s "
+                f"for transcript {transcript_id}"
+            )
+            logger.error(
+                "Task timeout",
+                task_id=result.id,
+                transcript_id=transcript_id,
+                elapsed_seconds=elapsed,
+            )
+            raise TimeoutError(error_msg)
+
+        if result.state != last_status:
+            if status_callback:
+                status_callback(result.state, int(elapsed))
+            last_status = result.state
+
+        await asyncio.sleep(poll_interval)
+
+    if result.failed():
+        error_info = result.info
+        traceback_info = getattr(result, "traceback", None)
+
+        logger.error(
+            "Multitrack task failed",
+            transcript_id=transcript_id,
+            task_id=result.id,
+            error=str(error_info),
+            has_traceback=bool(traceback_info),
+        )
+
+        error_detail = str(error_info)
+        if traceback_info:
+            error_detail += f"\nTraceback:\n{traceback_info}"
+
+        return MultitrackTaskResult(
+            success=False, transcript_id=transcript_id, error=error_detail
+        )
+
+    logger.info(
+        "Multitrack task completed",
+        transcript_id=transcript_id,
+        task_id=result.id,
+        state=result.state,
+    )
+
+    return MultitrackTaskResult(success=True, transcript_id=transcript_id)
+
+
+async def update_transcript_status(
+    transcript_id: str,
+    status: str,
+    error: Optional[str] = None,
+    max_error_length: int = MAX_ERROR_MESSAGE_LENGTH,
+) -> None:
+    database = get_database()
+    connected = False
+
+    try:
+        await database.connect()
+        connected = True
+
+        transcript = await transcripts_controller.get_by_id(transcript_id)
+        if transcript:
+            update_data: Dict[str, Any] = {"status": status}
+
+            if error:
+                if len(error) > max_error_length:
+                    error = error[: max_error_length - 3] + "..."
+                update_data["error"] = error
+
+            await transcripts_controller.update(transcript, update_data)
+
+            logger.info(
+                "Updated transcript status",
+                transcript_id=transcript_id,
+                status=status,
+                has_error=bool(error),
+            )
+    except Exception as e:
+        logger.warning(
+            "Failed to update transcript status",
+            transcript_id=transcript_id,
+            error=str(e),
+        )
+    finally:
+        if connected:
+            try:
+                await database.disconnect()
+            except Exception as e:
+                logger.warning(f"Database disconnect failed: {e}")
+
+
+async def process_multitrack(
+    bucket_name: str,
+    track_keys: List[str],
+    source_language: str,
+    target_language: str,
+    user_id: Optional[str] = None,
+    timeout_seconds: int = DEFAULT_PROCESSING_TIMEOUT_SECONDS,
+    status_callback: Optional[StatusCallback] = None,
+) -> MultitrackTaskResult:
+    """High-level orchestration for multitrack processing."""
+    database = get_database()
+    transcript = None
+    connected = False
+
+    try:
+        await database.connect()
+        connected = True
+
+        transcript = await create_multitrack_transcript(
+            bucket_name=bucket_name,
+            track_keys=track_keys,
+            source_language=source_language,
+            target_language=target_language,
+            user_id=user_id,
+        )
+
+        result = submit_multitrack_task(
+            transcript_id=transcript.id, bucket_name=bucket_name, track_keys=track_keys
+        )
+
+    except Exception as e:
+        if transcript:
+            try:
+                await update_transcript_status(
+                    transcript_id=transcript.id, status="failed", error=str(e)
+                )
+            except Exception as update_error:
+                logger.error(
+                    "Failed to update transcript status after error",
+                    original_error=str(e),
+                    update_error=str(update_error),
+                    transcript_id=transcript.id,
+                )
+        raise
+    finally:
+        if connected:
+            try:
+                await database.disconnect()
+            except Exception as e:
+                logger.warning(f"Database disconnect failed: {e}")
+
+    # Poll outside database connection
+    task_result = await wait_for_task(
+        result=result,
+        transcript_id=transcript.id,
+        timeout_seconds=timeout_seconds,
+        poll_interval=2,
+        status_callback=status_callback,
+    )
+
+    if not task_result.success:
+        await update_transcript_status(
+            transcript_id=transcript.id, status="failed", error=task_result.error
+        )
+
+    return task_result
+
+
+def print_progress(message: str) -> None:
+    """Print progress message to stderr for CLI visibility."""
+    print(f"{message}", file=sys.stderr)
+
+
+def create_status_callback() -> StatusCallback:
+    """Create callback for task status updates during polling."""
+
+    def callback(state: str, elapsed_seconds: int) -> None:
+        print_progress(
+            f"Multitrack pipeline status: {state} (elapsed: {elapsed_seconds}s)"
+        )
+
+    return callback
+
+
+async def process_multitrack_cli(
+    s3_urls: List[str],
+    source_language: str,
+    target_language: str,
+    output_path: Optional[str] = None,
+) -> None:
+    if not s3_urls:
+        raise ValueError("At least one track required for multitrack processing")
+
+    bucket_keys = []
+    for url in s3_urls:
+        try:
+            bucket, key = parse_s3_url(url)
+            bucket_keys.append((bucket, key))
+        except ValueError as e:
+            raise ValueError(f"Invalid S3 URL '{url}': {e}") from e
+
+    buckets = set(bucket for bucket, _ in bucket_keys)
+    if len(buckets) > 1:
+        raise ValueError(
+            f"All tracks must be in the same S3 bucket. "
+            f"Found {len(buckets)} different buckets: {sorted(buckets)}. "
+            f"Please upload all files to a single bucket."
+        )
+
+    primary_bucket = bucket_keys[0][0]
+    track_keys = [key for _, key in bucket_keys]
+
+    print_progress(
+        f"Starting multitrack CLI processing: "
+        f"bucket={primary_bucket}, num_tracks={len(track_keys)}, "
+        f"source_language={source_language}, target_language={target_language}"
+    )
+
+    storage = get_transcripts_storage()
+    await validate_s3_objects(storage, bucket_keys)
+    print_progress(f"S3 validation complete: {len(bucket_keys)} objects verified")
+
+    result = await process_multitrack(
+        bucket_name=primary_bucket,
+        track_keys=track_keys,
+        source_language=source_language,
+        target_language=target_language,
+        user_id=None,
+        timeout_seconds=3600,
+        status_callback=create_status_callback(),
+    )
+
+    if not result.success:
+        error_msg = (
+            f"Multitrack pipeline failed for transcript {result.transcript_id}\n"
+        )
+        if result.error:
+            error_msg += f"Error: {result.error}\n"
+        raise RuntimeError(error_msg)
+
+    print_progress(
+        f"Multitrack processing complete for transcript {result.transcript_id}"
+    )
+
+    database = get_database()
+    await database.connect()
+    try:
+        await extract_result_from_entry(result.transcript_id, output_path)
+    finally:
+        await database.disconnect()

server/reflector/tools/process.py

@@ -9,7 +9,10 @@ import shutil
 import sys
 import time
 from pathlib import Path
-from typing import Any, Dict, List, Literal
+from typing import Any, Dict, List, Literal, Tuple
+from urllib.parse import unquote, urlparse
+
+from botocore.exceptions import BotoCoreError, ClientError, NoCredentialsError
 
 from reflector.db.transcripts import SourceKind, TranscriptTopic, transcripts_controller
 from reflector.logger import logger
@@ -20,10 +23,119 @@ from reflector.pipelines.main_live_pipeline import pipeline_post as live_pipelin
 from reflector.pipelines.main_live_pipeline import (
     pipeline_process as live_pipeline_process,
 )
+from reflector.storage import Storage
+
+
+def validate_s3_bucket_name(bucket: str) -> None:
+    if not bucket:
+        raise ValueError("Bucket name cannot be empty")
+    if len(bucket) > 255:  # Absolute max for any region
+        raise ValueError(f"Bucket name too long: {len(bucket)} characters (max 255)")
+
+
+def validate_s3_key(key: str) -> None:
+    if not key:
+        raise ValueError("S3 key cannot be empty")
+    if len(key) > 1024:
+        raise ValueError(f"S3 key too long: {len(key)} characters (max 1024)")
+
+
+def parse_s3_url(url: str) -> Tuple[str, str]:
+    parsed = urlparse(url)
+
+    if parsed.scheme == "s3":
+        bucket = parsed.netloc
+        key = parsed.path.lstrip("/")
+        if parsed.fragment:
+            logger.debug(
+                "URL fragment ignored (not part of S3 key)",
+                url=url,
+                fragment=parsed.fragment,
+            )
+        if not bucket or not key:
+            raise ValueError(f"Invalid S3 URL: {url} (missing bucket or key)")
+        bucket = unquote(bucket)
+        key = unquote(key)
+        validate_s3_bucket_name(bucket)
+        validate_s3_key(key)
+        return bucket, key
+
+    elif parsed.scheme in ("http", "https"):
+        if ".s3." in parsed.netloc or parsed.netloc.endswith(".s3.amazonaws.com"):
+            bucket = parsed.netloc.split(".")[0]
+            key = parsed.path.lstrip("/")
+            if parsed.fragment:
+                logger.debug("URL fragment ignored", url=url, fragment=parsed.fragment)
+            if not bucket or not key:
+                raise ValueError(f"Invalid S3 URL: {url} (missing bucket or key)")
+            bucket = unquote(bucket)
+            key = unquote(key)
+            validate_s3_bucket_name(bucket)
+            validate_s3_key(key)
+            return bucket, key
+
+        elif parsed.netloc.startswith("s3.") and "amazonaws.com" in parsed.netloc:
+            path_parts = parsed.path.lstrip("/").split("/", 1)
+            if len(path_parts) != 2:
+                raise ValueError(f"Invalid S3 URL: {url} (missing bucket or key)")
+            bucket, key = path_parts
+            if parsed.fragment:
+                logger.debug("URL fragment ignored", url=url, fragment=parsed.fragment)
+            bucket = unquote(bucket)
+            key = unquote(key)
+            validate_s3_bucket_name(bucket)
+            validate_s3_key(key)
+            return bucket, key
+
+        else:
+            raise ValueError(f"Invalid S3 URL format: {url} (not recognized as S3 URL)")
+
+    else:
+        raise ValueError(f"Invalid S3 URL scheme: {url} (must be s3:// or https://)")
+
+
+async def validate_s3_objects(
+    storage: Storage, bucket_keys: List[Tuple[str, str]]
+) -> None:
+    async with storage.session.client("s3") as client:
+
+        async def check_object(bucket: str, key: str) -> None:
+            try:
+                await client.head_object(Bucket=bucket, Key=key)
+            except ClientError as e:
+                error_code = e.response["Error"]["Code"]
+                if error_code in ("404", "NoSuchKey"):
+                    raise ValueError(f"S3 object not found: s3://{bucket}/{key}") from e
+                elif error_code in ("403", "Forbidden", "AccessDenied"):
+                    raise ValueError(
+                        f"Access denied for S3 object: s3://{bucket}/{key}. "
+                        f"Check AWS credentials and permissions"
+                    ) from e
+                else:
+                    raise ValueError(
+                        f"S3 error {error_code} for s3://{bucket}/{key}: "
+                        f"{e.response['Error'].get('Message', 'Unknown error')}"
+                    ) from e
+            except NoCredentialsError as e:
+                raise ValueError(
+                    "AWS credentials not configured. Set AWS_ACCESS_KEY_ID and "
+                    "AWS_SECRET_ACCESS_KEY environment variables"
+                ) from e
+            except BotoCoreError as e:
+                raise ValueError(
+                    f"AWS service error for s3://{bucket}/{key}: {str(e)}"
+                ) from e
+            except Exception as e:
+                raise ValueError(
+                    f"Unexpected error validating s3://{bucket}/{key}: {str(e)}"
+                ) from e
+
+        await asyncio.gather(
+            *(check_object(bucket, key) for bucket, key in bucket_keys)
+        )
 
 
 def serialize_topics(topics: List[TranscriptTopic]) -> List[Dict[str, Any]]:
-    """Convert TranscriptTopic objects to JSON-serializable dicts"""
     serialized = []
     for topic in topics:
         topic_dict = topic.model_dump()
@@ -32,7 +144,6 @@ def serialize_topics(topics: List[TranscriptTopic]) -> List[Dict[str, Any]]:
 
 
 def debug_print_speakers(serialized_topics: List[Dict[str, Any]]) -> None:
-    """Print debug info about speakers found in topics"""
     all_speakers = set()
     for topic_dict in serialized_topics:
         for word in topic_dict.get("words", []):
@@ -47,8 +158,6 @@ def debug_print_speakers(serialized_topics: List[Dict[str, Any]]) -> None:
 TranscriptId = str
 
 
-# common interface for every flow: it needs an Entry in db with specific ceremony (file path + status + actual file in file system)
-# ideally we want to get rid of it at some point
 async def prepare_entry(
     source_path: str,
     source_language: str,
@@ -65,9 +174,7 @@ async def prepare_entry(
         user_id=None,
     )
 
-    logger.info(
-        f"Created empty transcript {transcript.id} for file {file_path.name} because technically we need an empty transcript before we start transcript"
-    )
+    logger.info(f"Created transcript {transcript.id} for {file_path.name}")
 
     # pipelines expect files as upload.*
 
@@ -83,7 +190,6 @@ async def prepare_entry(
     return transcript.id
 
 
-# same reason as prepare_entry
 async def extract_result_from_entry(
     transcript_id: TranscriptId, output_path: str
 ) -> None:
@@ -193,13 +299,20 @@ if __name__ == "__main__":
     parser = argparse.ArgumentParser(
         description="Process audio files with speaker diarization"
     )
-    parser.add_argument("source", help="Source file (mp3, wav, mp4...)")
+    parser.add_argument(
+        "source",
+        help="Source file (mp3, wav, mp4...) or comma-separated S3 URLs with --multitrack",
+    )
     parser.add_argument(
         "--pipeline",
-        required=True,
         choices=["live", "file"],
         help="Pipeline type to use for processing (live: streaming/incremental, file: batch/parallel)",
     )
+    parser.add_argument(
+        "--multitrack",
+        action="store_true",
+        help="Process multiple audio tracks from comma-separated S3 URLs",
+    )
     parser.add_argument(
         "--source-language", default="en", help="Source language code (default: en)"
     )
@@ -209,12 +322,40 @@ if __name__ == "__main__":
     parser.add_argument("--output", "-o", help="Output file (output.jsonl)")
     args = parser.parse_args()
 
-    asyncio.run(
-        process(
-            args.source,
-            args.source_language,
-            args.target_language,
-            args.pipeline,
-            args.output,
+    if args.multitrack:
+        if not args.source:
+            parser.error("Source URLs required for multitrack processing")
+
+        s3_urls = [url.strip() for url in args.source.split(",") if url.strip()]
+
+        if not s3_urls:
+            parser.error("At least one S3 URL required for multitrack processing")
+
+        from reflector.tools.cli_multitrack import process_multitrack_cli
+
+        asyncio.run(
+            process_multitrack_cli(
+                s3_urls,
+                args.source_language,
+                args.target_language,
+                args.output,
+            )
+        )
+    else:
+        if not args.pipeline:
+            parser.error("--pipeline is required for single-track processing")
+
+        if "," in args.source:
+            parser.error(
+                "Multiple files detected. Use --multitrack flag for multitrack processing"
+            )
+
+        asyncio.run(
+            process(
+                args.source,
+                args.source_language,
+                args.target_language,
+                args.pipeline,
+                args.output,
+            )
         )
-    )

server/reflector/tools/process_transcript.py

@@ -0,0 +1,127 @@
+"""
+Process transcript by ID - auto-detects multitrack vs file pipeline.
+
+Usage:
+    uv run -m reflector.tools.process_transcript <transcript_id>
+
+    # Or via docker:
+    docker compose exec server uv run -m reflector.tools.process_transcript <transcript_id>
+"""
+
+import argparse
+import asyncio
+import sys
+import time
+from typing import Callable
+
+from celery.result import AsyncResult
+
+from reflector.db.transcripts import Transcript, transcripts_controller
+from reflector.services.transcript_process import (
+    FileProcessingConfig,
+    MultitrackProcessingConfig,
+    PrepareResult,
+    ProcessError,
+    ValidationError,
+    ValidationResult,
+    dispatch_transcript_processing,
+    prepare_transcript_processing,
+    validate_transcript_for_processing,
+)
+
+
+async def process_transcript_inner(
+    transcript: Transcript,
+    on_validation: Callable[[ValidationResult], None],
+    on_preprocess: Callable[[PrepareResult], None],
+) -> AsyncResult:
+    validation = await validate_transcript_for_processing(transcript)
+    on_validation(validation)
+    config = await prepare_transcript_processing(validation)
+    on_preprocess(config)
+    return dispatch_transcript_processing(config)
+
+
+async def process_transcript(transcript_id: str, sync: bool = False) -> None:
+    """
+    Process a transcript by ID, auto-detecting multitrack vs file pipeline.
+
+    Args:
+        transcript_id: The transcript UUID
+        sync: If True, wait for task completion. If False, dispatch and exit.
+    """
+    from reflector.db import get_database
+
+    database = get_database()
+    await database.connect()
+
+    try:
+        transcript = await transcripts_controller.get_by_id(transcript_id)
+        if not transcript:
+            print(f"Error: Transcript {transcript_id} not found", file=sys.stderr)
+            sys.exit(1)
+
+        print(f"Found transcript: {transcript.title or transcript_id}", file=sys.stderr)
+        print(f"  Status: {transcript.status}", file=sys.stderr)
+        print(f"  Recording ID: {transcript.recording_id or 'None'}", file=sys.stderr)
+
+        def on_validation(validation: ValidationResult) -> None:
+            if isinstance(validation, ValidationError):
+                print(f"Error: {validation.detail}", file=sys.stderr)
+                sys.exit(1)
+
+        def on_preprocess(config: PrepareResult) -> None:
+            if isinstance(config, ProcessError):
+                print(f"Error: {config.detail}", file=sys.stderr)
+                sys.exit(1)
+            elif isinstance(config, MultitrackProcessingConfig):
+                print(f"Dispatching multitrack pipeline", file=sys.stderr)
+                print(f"  Bucket: {config.bucket_name}", file=sys.stderr)
+                print(f"  Tracks: {len(config.track_keys)}", file=sys.stderr)
+            elif isinstance(config, FileProcessingConfig):
+                print(f"Dispatching file pipeline", file=sys.stderr)
+
+        result = await process_transcript_inner(
+            transcript, on_validation=on_validation, on_preprocess=on_preprocess
+        )
+
+        if sync:
+            print("Waiting for task completion...", file=sys.stderr)
+            while not result.ready():
+                print(f"  Status: {result.state}", file=sys.stderr)
+                time.sleep(5)
+
+            if result.successful():
+                print("Task completed successfully", file=sys.stderr)
+            else:
+                print(f"Task failed: {result.result}", file=sys.stderr)
+                sys.exit(1)
+        else:
+            print(
+                "Task dispatched (use --sync to wait for completion)", file=sys.stderr
+            )
+
+    finally:
+        await database.disconnect()
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Process transcript by ID - auto-detects multitrack vs file pipeline"
+    )
+    parser.add_argument(
+        "transcript_id",
+        help="Transcript UUID to process",
+    )
+    parser.add_argument(
+        "--sync",
+        action="store_true",
+        help="Wait for task completion instead of just dispatching",
+    )
+
+    args = parser.parse_args()
+    asyncio.run(process_transcript(args.transcript_id, sync=args.sync))
+
+
+if __name__ == "__main__":
+    main()

server/reflector/utils/daily.py

@@ -1,6 +1,67 @@
+import os
+import re
+from typing import NamedTuple
+
 from reflector.utils.string import NonEmptyString
 
-DailyRoomName = str
+DailyRoomName = NonEmptyString
+
+
+class DailyRecordingFilename(NamedTuple):
+    """Parsed components from Daily.co recording filename.
+
+    Format: {recording_start_ts}-{participant_id}-cam-audio-{track_start_ts}
+    Example: 1763152299562-12f0b87c-97d4-4dd3-a65c-cee1f854a79c-cam-audio-1763152314582
+
+    Note: S3 object keys have no extension, but browsers add .webm when downloading
+    from S3 UI due to MIME type headers. If you download manually and wonder.
+    """
+
+    recording_start_ts: int
+    participant_id: str
+    track_start_ts: int
+
+
+def parse_daily_recording_filename(filename: str) -> DailyRecordingFilename:
+    """Parse Daily.co recording filename to extract timestamps and participant ID.
+
+    Args:
+        filename: Full path or basename of Daily.co recording file
+                 Format: {recording_start_ts}-{participant_id}-cam-audio-{track_start_ts}
+
+    Returns:
+        DailyRecordingFilename with parsed components
+
+    Raises:
+        ValueError: If filename doesn't match expected format
+
+    Examples:
+        >>> parse_daily_recording_filename("1763152299562-12f0b87c-97d4-4dd3-a65c-cee1f854a79c-cam-audio-1763152314582")
+        DailyRecordingFilename(recording_start_ts=1763152299562, participant_id='12f0b87c-97d4-4dd3-a65c-cee1f854a79c', track_start_ts=1763152314582)
+    """
+    base = os.path.basename(filename)
+    pattern = r"(\d{13,})-([0-9a-fA-F-]{36})-cam-audio-(\d{13,})"
+    match = re.search(pattern, base)
+
+    if not match:
+        raise ValueError(
+            f"Invalid Daily.co recording filename: {filename}. "
+            f"Expected format: {{recording_start_ts}}-{{participant_id}}-cam-audio-{{track_start_ts}}"
+        )
+
+    recording_start_ts = int(match.group(1))
+    participant_id = match.group(2)
+    track_start_ts = int(match.group(3))
+
+    return DailyRecordingFilename(
+        recording_start_ts=recording_start_ts,
+        participant_id=participant_id,
+        track_start_ts=track_start_ts,
+    )
+
+
+def recording_lock_key(recording_id: NonEmptyString) -> NonEmptyString:
+    return f"recording:{recording_id}"
 
 
 def extract_base_room_name(daily_room_name: DailyRoomName) -> NonEmptyString:

server/reflector/utils/match.py

@@ -0,0 +1,10 @@
+from typing import NoReturn
+
+
+def assert_exhaustiveness(x: NoReturn) -> NoReturn:
+    """Provide an assertion at type-check time that this function is never called."""
+    raise AssertionError(f"Invalid value: {x!r}")
+
+
+def absurd(x: NoReturn) -> NoReturn:
+    return assert_exhaustiveness(x)

server/reflector/video_platforms/base.py

@@ -1,10 +1,10 @@
 from abc import ABC, abstractmethod
 from datetime import datetime
-from typing import TYPE_CHECKING, Any, Dict, List, Optional
+from typing import TYPE_CHECKING, Any, Dict, Optional
 
 from ..schemas.platform import Platform
 from ..utils.string import NonEmptyString
-from .models import MeetingData, VideoPlatformConfig
+from .models import MeetingData, SessionData, VideoPlatformConfig
 
 if TYPE_CHECKING:
     from reflector.db.rooms import Room
@@ -26,11 +26,8 @@ class VideoPlatformClient(ABC):
         pass
 
     @abstractmethod
-    async def get_room_sessions(self, room_name: str) -> List[Any] | None:
-        pass
-
-    @abstractmethod
-    async def delete_room(self, room_name: str) -> bool:
+    async def get_room_sessions(self, room_name: str) -> list[SessionData]:
+        """Get session history for a room."""
         pass
 
     @abstractmethod

server/reflector/video_platforms/daily.py

@@ -1,37 +1,45 @@
-import base64
-import hmac
 from datetime import datetime
-from hashlib import sha256
-from http import HTTPStatus
-from typing import Any, Dict, List, Optional
-
-import httpx
 
+from reflector.dailyco_api import (
+    CreateMeetingTokenRequest,
+    CreateRoomRequest,
+    DailyApiClient,
+    MeetingParticipantsResponse,
+    MeetingTokenProperties,
+    RecordingResponse,
+    RecordingsBucketConfig,
+    RoomPresenceResponse,
+    RoomProperties,
+    verify_webhook_signature,
+)
+from reflector.db.daily_participant_sessions import (
+    daily_participant_sessions_controller,
+)
 from reflector.db.rooms import Room
 from reflector.logger import logger
 from reflector.storage import get_dailyco_storage
 
+from ..dailyco_api.responses import RecordingStatus
 from ..schemas.platform import Platform
 from ..utils.daily import DailyRoomName
 from ..utils.string import NonEmptyString
 from .base import ROOM_PREFIX_SEPARATOR, VideoPlatformClient
-from .models import MeetingData, RecordingType, VideoPlatformConfig
+from .models import MeetingData, RecordingType, SessionData, VideoPlatformConfig
 
 
 class DailyClient(VideoPlatformClient):
     PLATFORM_NAME: Platform = "daily"
-    TIMEOUT = 10
-    BASE_URL = "https://api.daily.co/v1"
     TIMESTAMP_FORMAT = "%Y%m%d%H%M%S"
     RECORDING_NONE: RecordingType = "none"
     RECORDING_CLOUD: RecordingType = "cloud"
 
     def __init__(self, config: VideoPlatformConfig):
         super().__init__(config)
-        self.headers = {
-            "Authorization": f"Bearer {config.api_key}",
-            "Content-Type": "application/json",
-        }
+        self._api_client = DailyApiClient(
+            api_key=config.api_key,
+            webhook_secret=config.webhook_secret,
+            timeout=10.0,
+        )
 
     async def create_meeting(
         self, room_name_prefix: NonEmptyString, end_date: datetime, room: Room
@@ -46,153 +54,144 @@ class DailyClient(VideoPlatformClient):
         timestamp = datetime.now().strftime(self.TIMESTAMP_FORMAT)
         room_name = f"{room_name_prefix}{ROOM_PREFIX_SEPARATOR}{timestamp}"
 
-        data = {
-            "name": room_name,
-            "privacy": "private" if room.is_locked else "public",
-            "properties": {
-                "enable_recording": "raw-tracks"
-                if room.recording_type != self.RECORDING_NONE
-                else False,
-                "enable_chat": True,
-                "enable_screenshare": True,
-                "start_video_off": False,
-                "start_audio_off": False,
-                "exp": int(end_date.timestamp()),
-            },
-        }
-
-        # Get storage config for passing to Daily API
-        daily_storage = get_dailyco_storage()
-        assert daily_storage.bucket_name, "S3 bucket must be configured"
-        data["properties"]["recordings_bucket"] = {
-            "bucket_name": daily_storage.bucket_name,
-            "bucket_region": daily_storage.region,
-            "assume_role_arn": daily_storage.role_credential,
-            "allow_api_access": True,
-        }
-
-        async with httpx.AsyncClient() as client:
-            response = await client.post(
-                f"{self.BASE_URL}/rooms",
-                headers=self.headers,
-                json=data,
-                timeout=self.TIMEOUT,
-            )
-            if response.status_code >= 400:
-                logger.error(
-                    "Daily.co API error",
-                    status_code=response.status_code,
-                    response_body=response.text,
-                    request_data=data,
-                )
-            response.raise_for_status()
-            result = response.json()
-
-        room_url = result["url"]
-
-        return MeetingData(
-            meeting_id=result["id"],
-            room_name=result["name"],
-            room_url=room_url,
-            host_room_url=room_url,
-            platform=self.PLATFORM_NAME,
-            extra_data=result,
+        properties = RoomProperties(
+            enable_recording="raw-tracks"
+            if room.recording_type != self.RECORDING_NONE
+            else False,
+            enable_chat=True,
+            enable_screenshare=True,
+            start_video_off=False,
+            start_audio_off=False,
+            exp=int(end_date.timestamp()),
         )
 
-    async def get_room_sessions(self, room_name: str) -> List[Any] | None:
-        # no such api
-        return None
-
-    async def get_room_presence(self, room_name: str) -> Dict[str, Any]:
-        async with httpx.AsyncClient() as client:
-            response = await client.get(
-                f"{self.BASE_URL}/rooms/{room_name}/presence",
-                headers=self.headers,
-                timeout=self.TIMEOUT,
+        # Only configure recordings_bucket if recording is enabled
+        if room.recording_type != self.RECORDING_NONE:
+            daily_storage = get_dailyco_storage()
+            assert daily_storage.bucket_name, "S3 bucket must be configured"
+            properties.recordings_bucket = RecordingsBucketConfig(
+                bucket_name=daily_storage.bucket_name,
+                bucket_region=daily_storage.region,
+                assume_role_arn=daily_storage.role_credential,
+                allow_api_access=True,
             )
-            response.raise_for_status()
-            return response.json()
 
-    async def get_meeting_participants(self, meeting_id: str) -> Dict[str, Any]:
-        async with httpx.AsyncClient() as client:
-            response = await client.get(
-                f"{self.BASE_URL}/meetings/{meeting_id}/participants",
-                headers=self.headers,
-                timeout=self.TIMEOUT,
-            )
-            response.raise_for_status()
-            return response.json()
+        request = CreateRoomRequest(
+            name=room_name,
+            privacy="private" if room.is_locked else "public",
+            properties=properties,
+        )
 
-    async def get_recording(self, recording_id: str) -> Dict[str, Any]:
-        async with httpx.AsyncClient() as client:
-            response = await client.get(
-                f"{self.BASE_URL}/recordings/{recording_id}",
-                headers=self.headers,
-                timeout=self.TIMEOUT,
-            )
-            response.raise_for_status()
-            return response.json()
+        result = await self._api_client.create_room(request)
 
-    async def delete_room(self, room_name: str) -> bool:
-        async with httpx.AsyncClient() as client:
-            response = await client.delete(
-                f"{self.BASE_URL}/rooms/{room_name}",
-                headers=self.headers,
-                timeout=self.TIMEOUT,
+        return MeetingData(
+            meeting_id=result.id,
+            room_name=result.name,
+            room_url=result.url,
+            host_room_url=result.url,
+            platform=self.PLATFORM_NAME,
+            extra_data=result.model_dump(),
+        )
+
+    async def get_room_sessions(self, room_name: str) -> list[SessionData]:
+        """Get room session history from database (webhook-stored sessions).
+
+        Daily.co doesn't provide historical session API, so we query our database
+        where participant.joined/left webhooks are stored.
+        """
+        from reflector.db.meetings import meetings_controller  # noqa: PLC0415
+
+        meeting = await meetings_controller.get_by_room_name(room_name)
+        if not meeting:
+            return []
+
+        sessions = await daily_participant_sessions_controller.get_by_meeting(
+            meeting.id
+        )
+
+        return [
+            SessionData(
+                session_id=s.id,
+                started_at=s.joined_at,
+                ended_at=s.left_at,
             )
-            return response.status_code in (HTTPStatus.OK, HTTPStatus.NOT_FOUND)
+            for s in sessions
+        ]
+
+    async def get_room_presence(self, room_name: str) -> RoomPresenceResponse:
+        """Get room presence/session data for a Daily.co room."""
+        return await self._api_client.get_room_presence(room_name)
+
+    async def get_meeting_participants(
+        self, meeting_id: str
+    ) -> MeetingParticipantsResponse:
+        """Get participant data for a specific Daily.co meeting."""
+        return await self._api_client.get_meeting_participants(meeting_id)
+
+    async def get_recording(self, recording_id: str) -> RecordingResponse:
+        return await self._api_client.get_recording(recording_id)
+
+    async def list_recordings(
+        self,
+        room_name: NonEmptyString | None = None,
+        starting_after: str | None = None,
+        ending_before: str | None = None,
+        limit: int = 100,
+    ) -> list[RecordingResponse]:
+        return await self._api_client.list_recordings(
+            room_name=room_name,
+            starting_after=starting_after,
+            ending_before=ending_before,
+            limit=limit,
+        )
+
+    async def get_recording_status(
+        self, recording_id: NonEmptyString
+    ) -> RecordingStatus:
+        recording = await self.get_recording(recording_id)
+        return recording.status
 
     async def upload_logo(self, room_name: str, logo_path: str) -> bool:
         return True
 
     def verify_webhook_signature(
-        self, body: bytes, signature: str, timestamp: Optional[str] = None
+        self, body: bytes, signature: str, timestamp: str | None = None
     ) -> bool:
-        """Verify Daily.co webhook signature.
-
-        Daily.co uses:
-        - X-Webhook-Signature header
-        - X-Webhook-Timestamp header
-        - Signature format: HMAC-SHA256(base64_decode(secret), timestamp + '.' + body)
-        - Result is base64 encoded
-        """
-        if not signature or not timestamp:
+        """Verify Daily.co webhook signature using dailyco_api module."""
+        if not self.config.webhook_secret:
+            logger.warning("Webhook secret not configured")
             return False
 
-        try:
-            secret_bytes = base64.b64decode(self.config.webhook_secret)
-
-            signed_content = timestamp.encode() + b"." + body
-
-            expected = hmac.new(secret_bytes, signed_content, sha256).digest()
-            expected_b64 = base64.b64encode(expected).decode()
-
-            return hmac.compare_digest(expected_b64, signature)
-        except Exception as e:
-            logger.error("Daily.co webhook signature verification failed", exc_info=e)
-            return False
+        return verify_webhook_signature(
+            body=body,
+            signature=signature,
+            timestamp=timestamp or "",
+            webhook_secret=self.config.webhook_secret,
+        )
 
     async def create_meeting_token(
         self,
         room_name: DailyRoomName,
         enable_recording: bool,
-        user_id: Optional[str] = None,
+        user_id: str | None = None,
     ) -> str:
-        data = {"properties": {"room_name": room_name}}
+        properties = MeetingTokenProperties(
+            room_name=room_name,
+            user_id=user_id,
+            start_cloud_recording=enable_recording,
+            enable_recording_ui=not enable_recording,
+        )
 
-        if enable_recording:
-            data["properties"]["start_cloud_recording"] = True
-            data["properties"]["enable_recording_ui"] = False
+        request = CreateMeetingTokenRequest(properties=properties)
+        result = await self._api_client.create_meeting_token(request)
+        return result.token
 
-        if user_id:
-            data["properties"]["user_id"] = user_id
+    async def close(self):
+        """Clean up API client resources."""
+        await self._api_client.close()
 
-        async with httpx.AsyncClient() as client:
-            response = await client.post(
-                f"{self.BASE_URL}/meeting-tokens",
-                headers=self.headers,
-                json=data,
-                timeout=self.TIMEOUT,
-            )
-            response.raise_for_status()
-            return response.json()["token"]
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, exc_val, exc_tb):
+        await self.close()

server/reflector/video_platforms/factory.py

@@ -1,5 +1,3 @@
-from typing import Optional
-
 from reflector.settings import settings
 from reflector.storage import get_dailyco_storage, get_whereby_storage
 
@@ -53,10 +51,3 @@ def get_platform_config(platform: Platform) -> VideoPlatformConfig:
 def create_platform_client(platform: Platform) -> VideoPlatformClient:
     config = get_platform_config(platform)
     return get_platform_client(platform, config)
-
-
-def get_platform(room_platform: Optional[Platform] = None) -> Platform:
-    if room_platform:
-        return room_platform
-
-    return settings.DEFAULT_VIDEO_PLATFORM

server/reflector/video_platforms/models.py

@@ -1,18 +1,38 @@
+from datetime import datetime
 from typing import Any, Dict, Literal, Optional
 
 from pydantic import BaseModel, Field
 
 from reflector.schemas.platform import WHEREBY_PLATFORM, Platform
+from reflector.utils.string import NonEmptyString
 
 RecordingType = Literal["none", "local", "cloud"]
 
 
+class SessionData(BaseModel):
+    """Platform-agnostic session data.
+
+    Represents a participant session in a meeting room, regardless of platform.
+    Used to determine if a meeting is still active or has ended.
+    """
+
+    session_id: NonEmptyString = Field(description="Unique session identifier")
+    started_at: datetime = Field(description="When session started (UTC)")
+    ended_at: datetime | None = Field(
+        description="When session ended (UTC), None if still active"
+    )
+
+
 class MeetingData(BaseModel):
     platform: Platform
-    meeting_id: str = Field(description="Platform-specific meeting identifier")
-    room_url: str = Field(description="URL for participants to join")
-    host_room_url: str = Field(description="URL for hosts (may be same as room_url)")
-    room_name: str = Field(description="Human-readable room name")
+    meeting_id: NonEmptyString = Field(
+        description="Platform-specific meeting identifier"
+    )
+    room_url: NonEmptyString = Field(description="URL for participants to join")
+    host_room_url: NonEmptyString = Field(
+        description="URL for hosts (may be same as room_url)"
+    )
+    room_name: NonEmptyString = Field(description="Human-readable room name")
     extra_data: Dict[str, Any] = Field(default_factory=dict)
 
     class Config:

server/reflector/video_platforms/whereby.py

@@ -4,7 +4,7 @@ import re
 import time
 from datetime import datetime
 from hashlib import sha256
-from typing import Any, Dict, Optional
+from typing import Optional
 
 import httpx
 
@@ -13,11 +13,8 @@ from reflector.storage import get_whereby_storage
 
 from ..schemas.platform import WHEREBY_PLATFORM, Platform
 from ..utils.string import NonEmptyString
-from .base import (
-    MeetingData,
-    VideoPlatformClient,
-    VideoPlatformConfig,
-)
+from .base import VideoPlatformClient
+from .models import MeetingData, SessionData, VideoPlatformConfig
 from .whereby_utils import whereby_room_name_prefix
 
 
@@ -80,18 +77,50 @@ class WherebyClient(VideoPlatformClient):
             extra_data=result,
         )
 
-    async def get_room_sessions(self, room_name: str) -> Dict[str, Any]:
+    async def get_room_sessions(self, room_name: str) -> list[SessionData]:
+        """Get room session history from Whereby API.
+
+        Whereby API returns: [{"sessionId": "...", "startedAt": "...", "endedAt": "..." | null}, ...]
+        """
         async with httpx.AsyncClient() as client:
+            """
+                        {
+              "cursor": "text",
+              "results": [
+                {
+                  "roomSessionId": "e2f29530-46ec-4cee-8b27-e565cb5bb2e9",
+                  "roomName": "/room-prefix-793e9ec1-c686-423d-9043-9b7a10c553fd",
+                  "startedAt": "2025-01-01T00:00:00.000Z",
+                  "endedAt": "2025-01-01T01:00:00.000Z",
+                  "totalParticipantMinutes": 124,
+                  "totalRecorderMinutes": 120,
+                  "totalStreamerMinutes": 120,
+                  "totalUniqueParticipants": 4,
+                  "totalUniqueRecorders": 3,
+                  "totalUniqueStreamers": 2
+                }
+              ]
+            }"""
             response = await client.get(
                 f"{self.config.api_url}/insights/room-sessions?roomName={room_name}",
                 headers=self.headers,
                 timeout=self.TIMEOUT,
             )
             response.raise_for_status()
-            return response.json().get("results", [])
+            results = response.json().get("results", [])
 
-    async def delete_room(self, room_name: str) -> bool:
-        return True
+            return [
+                SessionData(
+                    session_id=s["roomSessionId"],
+                    started_at=datetime.fromisoformat(
+                        s["startedAt"].replace("Z", "+00:00")
+                    ),
+                    ended_at=datetime.fromisoformat(s["endedAt"].replace("Z", "+00:00"))
+                    if s.get("endedAt")
+                    else None,
+                )
+                for s in results
+            ]
 
     async def upload_logo(self, room_name: str, logo_path: str) -> bool:
         async with httpx.AsyncClient() as client:

server/reflector/views/daily.py

@@ -1,49 +1,53 @@
 import json
-from typing import Any, Dict, Literal
+from typing import assert_never
 
 from fastapi import APIRouter, HTTPException, Request
-from pydantic import BaseModel
+from pydantic import TypeAdapter
 
+from reflector.dailyco_api import (
+    DailyWebhookEventUnion,
+    ParticipantJoinedEvent,
+    ParticipantLeftEvent,
+    RecordingErrorEvent,
+    RecordingReadyEvent,
+    RecordingStartedEvent,
+)
 from reflector.db.meetings import meetings_controller
 from reflector.logger import logger as _logger
 from reflector.settings import settings
-from reflector.utils.daily import DailyRoomName
 from reflector.video_platforms.factory import create_platform_client
-from reflector.worker.process import process_multitrack_recording
+from reflector.worker.process import (
+    poll_daily_room_presence_task,
+    process_multitrack_recording,
+)
 
 router = APIRouter()
 
 logger = _logger.bind(platform="daily")
 
 
-class DailyTrack(BaseModel):
-    type: Literal["audio", "video"]
-    s3Key: str
-    size: int
-
-
-class DailyWebhookEvent(BaseModel):
-    version: str
-    type: str
-    id: str
-    payload: Dict[str, Any]
-    event_ts: float
-
-
-def _extract_room_name(event: DailyWebhookEvent) -> DailyRoomName | None:
-    """Extract room name from Daily event payload.
-
-    Daily.co API inconsistency:
-    - participant.* events use "room" field
-    - recording.* events use "room_name" field
-    """
-    return event.payload.get("room_name") or event.payload.get("room")
-
-
 @router.post("/webhook")
 async def webhook(request: Request):
     """Handle Daily webhook events.
 
+    Example webhook payload:
+    {
+      "version": "1.0.0",
+      "type": "recording.ready-to-download",
+      "id": "rec-rtd-c3df927c-f738-4471-a2b7-066fa7e95a6b-1692124192",
+      "payload": {
+        "recording_id": "08fa0b24-9220-44c5-846c-3f116cf8e738",
+        "room_name": "Xcm97xRZ08b2dePKb78g",
+        "start_ts": 1692124183,
+        "status": "finished",
+        "max_participants": 1,
+        "duration": 9,
+        "share_token": "ntDCL5k98Ulq", #gitleaks:allow
+        "s3_key": "api-test-1j8fizhzd30c/Xcm97xRZ08b2dePKb78g/1692124183028"
+      },
+      "event_ts": 1692124192
+    }
+
     Daily.co circuit-breaker: After 3+ failed responses (4xx/5xx), webhook
     state→FAILED, stops sending events. Reset: scripts/recreate_daily_webhook.py
     """
@@ -53,18 +57,14 @@ async def webhook(request: Request):
 
     client = create_platform_client("daily")
 
-    # TEMPORARY: Bypass signature check for testing
-    # TODO: Remove this after testing is complete
-    BYPASS_FOR_TESTING = True
-    if not BYPASS_FOR_TESTING:
-        if not client.verify_webhook_signature(body, signature, timestamp):
-            logger.warning(
-                "Invalid webhook signature",
-                signature=signature,
-                timestamp=timestamp,
-                has_body=bool(body),
-            )
-            raise HTTPException(status_code=401, detail="Invalid webhook signature")
+    if not client.verify_webhook_signature(body, signature, timestamp):
+        logger.warning(
+            "Invalid webhook signature",
+            signature=signature,
+            timestamp=timestamp,
+            has_body=bool(body),
+        )
+        raise HTTPException(status_code=401, detail="Invalid webhook signature")
 
     try:
         body_json = json.loads(body)
@@ -75,68 +75,83 @@ async def webhook(request: Request):
         logger.info("Received Daily webhook test event")
         return {"status": "ok"}
 
-    # Parse as actual event
+    event_adapter = TypeAdapter(DailyWebhookEventUnion)
     try:
-        event = DailyWebhookEvent(**body_json)
+        event = event_adapter.validate_python(body_json)
     except Exception as e:
         logger.error("Failed to parse webhook event", error=str(e), body=body.decode())
         raise HTTPException(status_code=422, detail="Invalid event format")
 
-    # Handle participant events
-    if event.type == "participant.joined":
-        await _handle_participant_joined(event)
-    elif event.type == "participant.left":
-        await _handle_participant_left(event)
-    elif event.type == "recording.started":
-        await _handle_recording_started(event)
-    elif event.type == "recording.ready-to-download":
-        await _handle_recording_ready(event)
-    elif event.type == "recording.error":
-        await _handle_recording_error(event)
-    else:
-        logger.warning(
-            "Unhandled Daily webhook event type",
-            event_type=event.type,
-            payload=event.payload,
-        )
+    match event:
+        case ParticipantJoinedEvent():
+            await _handle_participant_joined(event)
+        case ParticipantLeftEvent():
+            await _handle_participant_left(event)
+        case RecordingStartedEvent():
+            await _handle_recording_started(event)
+        case RecordingReadyEvent():
+            await _handle_recording_ready(event)
+        case RecordingErrorEvent():
+            await _handle_recording_error(event)
+        case _:
+            assert_never(event)
 
     return {"status": "ok"}
 
 
-async def _handle_participant_joined(event: DailyWebhookEvent):
-    daily_room_name = _extract_room_name(event)
-    if not daily_room_name:
-        logger.warning("participant.joined: no room in payload", payload=event.payload)
-        return
-
-    meeting = await meetings_controller.get_by_room_name(daily_room_name)
-    if meeting:
-        await meetings_controller.increment_num_clients(meeting.id)
-        logger.info(
-            "Participant joined",
-            meeting_id=meeting.id,
-            room_name=daily_room_name,
-            recording_type=meeting.recording_type,
-            recording_trigger=meeting.recording_trigger,
-        )
-    else:
-        logger.warning(
-            "participant.joined: meeting not found", room_name=daily_room_name
-        )
-
-
-async def _handle_participant_left(event: DailyWebhookEvent):
-    room_name = _extract_room_name(event)
+async def _queue_poll_for_room(
+    room_name: str | None,
+    event_type: str,
+    user_id: str | None,
+    session_id: str | None,
+    **log_kwargs,
+) -> None:
+    """Queue poll task for room by name, handling missing room/meeting cases."""
     if not room_name:
+        logger.warning(f"{event_type}: no room in payload")
         return
 
     meeting = await meetings_controller.get_by_room_name(room_name)
-    if meeting:
-        await meetings_controller.decrement_num_clients(meeting.id)
+    if not meeting:
+        logger.warning(f"{event_type}: meeting not found", room_name=room_name)
+        return
+
+    poll_daily_room_presence_task.delay(meeting.id)
+
+    logger.info(
+        f"{event_type.replace('.', ' ').title()} - poll queued",
+        meeting_id=meeting.id,
+        room_name=room_name,
+        user_id=user_id,
+        session_id=session_id,
+        **log_kwargs,
+    )
 
 
-async def _handle_recording_started(event: DailyWebhookEvent):
-    room_name = _extract_room_name(event)
+async def _handle_participant_joined(event: ParticipantJoinedEvent):
+    """Queue poll task for presence reconciliation."""
+    await _queue_poll_for_room(
+        event.payload.room_name,
+        "participant.joined",
+        event.payload.user_id,
+        event.payload.session_id,
+        user_name=event.payload.user_name,
+    )
+
+
+async def _handle_participant_left(event: ParticipantLeftEvent):
+    """Queue poll task for presence reconciliation."""
+    await _queue_poll_for_room(
+        event.payload.room_name,
+        "participant.left",
+        event.payload.user_id,
+        event.payload.session_id,
+        duration=event.payload.duration,
+    )
+
+
+async def _handle_recording_started(event: RecordingStartedEvent):
+    room_name = event.payload.room_name
     if not room_name:
         logger.warning(
             "recording.started: no room_name in payload", payload=event.payload
@@ -149,49 +164,27 @@ async def _handle_recording_started(event: DailyWebhookEvent):
             "Recording started",
             meeting_id=meeting.id,
             room_name=room_name,
-            recording_id=event.payload.get("recording_id"),
+            recording_id=event.payload.recording_id,
             platform="daily",
         )
     else:
         logger.warning("recording.started: meeting not found", room_name=room_name)
 
 
-async def _handle_recording_ready(event: DailyWebhookEvent):
-    """Handle recording ready for download event.
+async def _handle_recording_ready(event: RecordingReadyEvent):
+    room_name = event.payload.room_name
+    recording_id = event.payload.recording_id
+    tracks = event.payload.tracks
 
-    Daily.co webhook payload for raw-tracks recordings:
-    {
-      "recording_id": "...",
-      "room_name": "test2-20251009192341",
-      "tracks": [
-        {"type": "audio", "s3Key": "monadical/test2-.../uuid-cam-audio-123.webm", "size": 400000},
-        {"type": "video", "s3Key": "monadical/test2-.../uuid-cam-video-456.webm", "size": 30000000}
-      ]
-    }
-    """
-    room_name = _extract_room_name(event)
-    recording_id = event.payload.get("recording_id")
-    tracks_raw = event.payload.get("tracks", [])
-
-    if not room_name or not tracks_raw:
+    if not tracks:
         logger.warning(
-            "recording.ready-to-download: missing room_name or tracks",
+            "recording.ready-to-download: missing tracks",
             room_name=room_name,
-            has_tracks=bool(tracks_raw),
+            recording_id=recording_id,
             payload=event.payload,
         )
         return
 
-    try:
-        tracks = [DailyTrack(**t) for t in tracks_raw]
-    except Exception as e:
-        logger.error(
-            "recording.ready-to-download: invalid tracks structure",
-            error=str(e),
-            tracks=tracks_raw,
-        )
-        return
-
     logger.info(
         "Recording ready for download",
         room_name=room_name,
@@ -209,6 +202,12 @@ async def _handle_recording_ready(event: DailyWebhookEvent):
 
     track_keys = [t.s3Key for t in tracks if t.type == "audio"]
 
+    logger.info(
+        "Recording webhook queuing processing",
+        recording_id=recording_id,
+        room_name=room_name,
+    )
+
     process_multitrack_recording.delay(
         bucket_name=bucket_name,
         daily_room_name=room_name,
@@ -217,17 +216,18 @@ async def _handle_recording_ready(event: DailyWebhookEvent):
     )
 
 
-async def _handle_recording_error(event: DailyWebhookEvent):
-    room_name = _extract_room_name(event)
-    error = event.payload.get("error", "Unknown error")
+async def _handle_recording_error(event: RecordingErrorEvent):
+    payload = event.payload
+    room_name = payload.room_name
 
-    if room_name:
-        meeting = await meetings_controller.get_by_room_name(room_name)
-        if meeting:
-            logger.error(
-                "Recording error",
-                meeting_id=meeting.id,
-                room_name=room_name,
-                error=error,
-                platform="daily",
-            )
+    meeting = await meetings_controller.get_by_room_name(room_name)
+    if meeting:
+        logger.error(
+            "Recording error",
+            meeting_id=meeting.id,
+            room_name=room_name,
+            error=payload.error_msg,
+            platform="daily",
+        )
+    else:
+        logger.warning("recording.error: meeting not found", room_name=room_name)

server/reflector/views/rooms.py

@@ -19,10 +19,7 @@ from reflector.schemas.platform import Platform
 from reflector.services.ics_sync import ics_sync_service
 from reflector.settings import settings
 from reflector.utils.url import add_query_param
-from reflector.video_platforms.factory import (
-    create_platform_client,
-    get_platform,
-)
+from reflector.video_platforms.factory import create_platform_client
 from reflector.worker.webhook import test_webhook
 
 logger = logging.getLogger(__name__)
@@ -190,9 +187,6 @@ async def rooms_list(
         ),
     )
 
-    for room in paginated.items:
-        room.platform = get_platform(room.platform)
-
     return paginated
 
 
@@ -207,7 +201,6 @@ async def rooms_get(
         raise HTTPException(status_code=404, detail="Room not found")
     if not room.is_shared and (user_id is None or room.user_id != user_id):
         raise HTTPException(status_code=403, detail="Room access denied")
-    room.platform = get_platform(room.platform)
     return room
 
 
@@ -229,8 +222,6 @@ async def rooms_get_by_name(
         room_dict["webhook_url"] = None
         room_dict["webhook_secret"] = None
 
-    room_dict["platform"] = get_platform(room.platform)
-
     return RoomDetails(**room_dict)
 
 
@@ -275,7 +266,6 @@ async def rooms_update(
         raise HTTPException(status_code=403, detail="Not authorized")
     values = info.dict(exclude_unset=True)
     await rooms_controller.update(room, values)
-    room.platform = get_platform(room.platform)
     return room
 
 
@@ -323,7 +313,7 @@ async def rooms_create_meeting(
             if meeting is None:
                 end_date = current_time + timedelta(hours=8)
 
-                platform = get_platform(room.platform)
+                platform = room.platform
                 client = create_platform_client(platform)
 
                 meeting_data = await client.create_meeting(
@@ -347,19 +337,7 @@ async def rooms_create_meeting(
             status_code=503, detail="Meeting creation in progress, please try again"
         )
 
-    if meeting.platform == "daily" and room.recording_trigger != "none":
-        client = create_platform_client(meeting.platform)
-        token = await client.create_meeting_token(
-            meeting.room_name,
-            enable_recording=True,
-            user_id=user_id,
-        )
-        meeting = meeting.model_copy()
-        meeting.room_url = add_query_param(meeting.room_url, "t", token)
-        if meeting.host_room_url:
-            meeting.host_room_url = add_query_param(meeting.host_room_url, "t", token)
-
-    if user_id != room.user_id:
+    if user_id != room.user_id and meeting.platform == "whereby":
         meeting.host_room_url = ""
 
     return meeting
@@ -513,13 +491,13 @@ async def rooms_list_active_meetings(
         room=room, current_time=current_time
     )
 
-    effective_platform = get_platform(room.platform)
     for meeting in meetings:
-        meeting.platform = effective_platform
+        meeting.platform = room.platform
 
     if user_id != room.user_id:
         for meeting in meetings:
-            meeting.host_room_url = ""
+            if meeting.platform == "whereby":
+                meeting.host_room_url = ""
 
     return meetings
 
@@ -541,7 +519,7 @@ async def rooms_get_meeting(
     if not meeting:
         raise HTTPException(status_code=404, detail="Meeting not found")
 
-    if user_id != room.user_id and not room.is_shared:
+    if user_id != room.user_id and not room.is_shared and meeting.platform == "whereby":
         meeting.host_room_url = ""
 
     return meeting
@@ -571,7 +549,20 @@ async def rooms_join_meeting(
     if meeting.end_date <= current_time:
         raise HTTPException(status_code=400, detail="Meeting has ended")
 
-    if user_id != room.user_id:
+    if meeting.platform == "daily":
+        client = create_platform_client(meeting.platform)
+        enable_recording = room.recording_trigger != "none"
+        token = await client.create_meeting_token(
+            meeting.room_name,
+            enable_recording=enable_recording,
+            user_id=user_id,
+        )
+        meeting = meeting.model_copy()
+        meeting.room_url = add_query_param(meeting.room_url, "t", token)
+        if meeting.host_room_url:
+            meeting.host_room_url = add_query_param(meeting.host_room_url, "t", token)
+
+    if user_id != room.user_id and meeting.platform == "whereby":
         meeting.host_room_url = ""
 
     return meeting

server/reflector/views/transcripts_process.py

@@ -1,16 +1,21 @@
 from typing import Annotated, Optional
 
-import celery
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
 
 import reflector.auth as auth
-from reflector.db.recordings import recordings_controller
 from reflector.db.transcripts import transcripts_controller
-from reflector.pipelines.main_file_pipeline import task_pipeline_file_process
-from reflector.pipelines.main_multitrack_pipeline import (
-    task_pipeline_multitrack_process,
+from reflector.services.transcript_process import (
+    ProcessError,
+    ValidationAlreadyScheduled,
+    ValidationError,
+    ValidationLocked,
+    ValidationOk,
+    dispatch_transcript_processing,
+    prepare_transcript_processing,
+    validate_transcript_for_processing,
 )
+from reflector.utils.match import absurd
 
 router = APIRouter()
 
@@ -23,59 +28,28 @@ class ProcessStatus(BaseModel):
 async def transcript_process(
     transcript_id: str,
     user: Annotated[Optional[auth.UserInfo], Depends(auth.current_user_optional)],
-):
+) -> ProcessStatus:
     user_id = user["sub"] if user else None
     transcript = await transcripts_controller.get_by_id_for_http(
         transcript_id, user_id=user_id
     )
 
-    if transcript.locked:
-        raise HTTPException(status_code=400, detail="Transcript is locked")
-
-    if transcript.status == "idle":
-        raise HTTPException(
-            status_code=400, detail="Recording is not ready for processing"
-        )
-
-    # avoid duplicate scheduling for either pipeline
-    if task_is_scheduled_or_active(
-        "reflector.pipelines.main_file_pipeline.task_pipeline_file_process",
-        transcript_id=transcript_id,
-    ) or task_is_scheduled_or_active(
-        "reflector.pipelines.main_multitrack_pipeline.task_pipeline_multitrack_process",
-        transcript_id=transcript_id,
-    ):
-        return ProcessStatus(status="already running")
-
-    # Determine processing mode strictly from DB to avoid S3 scans
-    bucket_name = None
-    track_keys: list[str] = []
-
-    if transcript.recording_id:
-        recording = await recordings_controller.get_by_id(transcript.recording_id)
-        if recording:
-            bucket_name = recording.bucket_name
-            track_keys = list(getattr(recording, "track_keys", []) or [])
-
-    if bucket_name:
-        task_pipeline_multitrack_process.delay(
-            transcript_id=transcript_id,
-            bucket_name=bucket_name,
-            track_keys=track_keys,
-        )
+    validation = await validate_transcript_for_processing(transcript)
+    if isinstance(validation, ValidationLocked):
+        raise HTTPException(status_code=400, detail=validation.detail)
+    elif isinstance(validation, ValidationError):
+        raise HTTPException(status_code=400, detail=validation.detail)
+    elif isinstance(validation, ValidationAlreadyScheduled):
+        return ProcessStatus(status=validation.detail)
+    elif isinstance(validation, ValidationOk):
+        pass
     else:
-        # Default single-file pipeline
-        task_pipeline_file_process.delay(transcript_id=transcript_id)
+        absurd(validation)
 
-    return ProcessStatus(status="ok")
+    config = await prepare_transcript_processing(validation)
 
-
-def task_is_scheduled_or_active(task_name: str, **kwargs):
-    inspect = celery.current_app.control.inspect()
-
-    for worker, tasks in (inspect.scheduled() | inspect.active()).items():
-        for task in tasks:
-            if task["name"] == task_name and task["kwargs"] == kwargs:
-                return True
-
-    return False
+    if isinstance(config, ProcessError):
+        raise HTTPException(status_code=500, detail=config.detail)
+    else:
+        dispatch_transcript_processing(config)
+        return ProcessStatus(status="ok")

server/reflector/views/user_websocket.py

@@ -3,6 +3,7 @@ from typing import Optional
 from fastapi import APIRouter, WebSocket
 
 from reflector.auth.auth_jwt import JWTAuth  # type: ignore
+from reflector.db.users import user_controller
 from reflector.ws_manager import get_ws_manager
 
 router = APIRouter()
@@ -29,7 +30,18 @@ async def user_events_websocket(websocket: WebSocket):
 
     try:
         payload = JWTAuth().verify_token(token)
-        user_id = payload.get("sub")
+        authentik_uid = payload.get("sub")
+
+        if authentik_uid:
+            user = await user_controller.get_by_authentik_uid(authentik_uid)
+            if user:
+                user_id = user.id
+            else:
+                await websocket.close(code=UNAUTHORISED)
+                return
+        else:
+            await websocket.close(code=UNAUTHORISED)
+            return
     except Exception:
         await websocket.close(code=UNAUTHORISED)
         return

server/reflector/worker/app.py

@@ -38,6 +38,14 @@ else:
             "task": "reflector.worker.process.reprocess_failed_recordings",
             "schedule": crontab(hour=5, minute=0),  # Midnight EST
         },
+        "poll_daily_recordings": {
+            "task": "reflector.worker.process.poll_daily_recordings",
+            "schedule": 180.0,  # Every 3 minutes (configurable lookback window)
+        },
+        "trigger_daily_reconciliation": {
+            "task": "reflector.worker.process.trigger_daily_reconciliation",
+            "schedule": 30.0,  # Every 30 seconds (queues poll tasks for all active meetings)
+        },
         "sync_all_ics_calendars": {
             "task": "reflector.worker.ics_sync.sync_all_ics_calendars",
             "schedule": 60.0,  # Run every minute to check which rooms need sync

server/reflector/worker/ics_sync.py

@@ -10,7 +10,7 @@ from reflector.db.meetings import meetings_controller
 from reflector.db.rooms import Room, rooms_controller
 from reflector.redis_cache import RedisAsyncLock
 from reflector.services.ics_sync import SyncStatus, ics_sync_service
-from reflector.video_platforms.factory import create_platform_client, get_platform
+from reflector.video_platforms.factory import create_platform_client
 
 logger = structlog.wrap_logger(get_task_logger(__name__))
 
@@ -104,10 +104,10 @@ async def create_upcoming_meetings_for_event(event, create_window, room: Room):
     try:
         end_date = event.end_time or (event.start_time + MEETING_DEFAULT_DURATION)
 
-        client = create_platform_client(get_platform(room.platform))
+        client = create_platform_client(room.platform)
 
         meeting_data = await client.create_meeting(
-            "",
+            room.name,
             end_date=end_date,
             room=room,
         )

server/reflector/worker/process.py

@@ -10,8 +10,12 @@ import structlog
 from celery import shared_task
 from celery.utils.log import get_task_logger
 from pydantic import ValidationError
-from redis.exceptions import LockError
 
+from reflector.dailyco_api import MeetingParticipantsResponse
+from reflector.db.daily_participant_sessions import (
+    DailyParticipantSession,
+    daily_participant_sessions_controller,
+)
 from reflector.db.meetings import meetings_controller
 from reflector.db.recordings import Recording, recordings_controller
 from reflector.db.rooms import rooms_controller
@@ -28,10 +32,15 @@ from reflector.pipelines.main_multitrack_pipeline import (
 from reflector.pipelines.topic_processing import EmptyPipeline
 from reflector.processors import AudioFileWriterProcessor
 from reflector.processors.audio_waveform_processor import AudioWaveformProcessor
-from reflector.redis_cache import get_redis_client
+from reflector.redis_cache import RedisAsyncLock
 from reflector.settings import settings
 from reflector.storage import get_transcripts_storage
-from reflector.utils.daily import DailyRoomName, extract_base_room_name
+from reflector.utils.daily import (
+    DailyRoomName,
+    extract_base_room_name,
+    parse_daily_recording_filename,
+    recording_lock_key,
+)
 from reflector.video_platforms.factory import create_platform_client
 from reflector.video_platforms.whereby_utils import (
     parse_whereby_recording_filename,
@@ -178,6 +187,42 @@ async def process_multitrack_recording(
         logger.warning("No audio track keys provided")
         return
 
+    lock_key = recording_lock_key(recording_id)
+    async with RedisAsyncLock(
+        key=lock_key,
+        timeout=600,  # 10min for processing (includes API calls, DB writes)
+        extend_interval=60,  # Auto-extend every 60s
+        skip_if_locked=True,
+        blocking=False,
+    ) as lock:
+        if not lock.acquired:
+            logger.warning(
+                "Recording processing skipped - lock already held (duplicate task or concurrent worker)",
+                recording_id=recording_id,
+                lock_key=lock_key,
+                reason="duplicate_task_or_concurrent_worker",
+            )
+            return
+
+        logger.info(
+            "Recording worker acquired lock - starting processing",
+            recording_id=recording_id,
+            lock_key=lock_key,
+        )
+
+        await _process_multitrack_recording_inner(
+            bucket_name, daily_room_name, recording_id, track_keys
+        )
+
+
+async def _process_multitrack_recording_inner(
+    bucket_name: str,
+    daily_room_name: DailyRoomName,
+    recording_id: str,
+    track_keys: list[str],
+):
+    """Inner function containing the actual processing logic."""
+
     tz = timezone.utc
     recorded_at = datetime.now(tz)
     try:
@@ -195,6 +240,8 @@ async def process_multitrack_recording(
         )
 
     meeting = await meetings_controller.get_by_room_name(daily_room_name)
+    if not meeting:
+        raise Exception(f"Meeting not found: {daily_room_name}")
 
     room_name_base = extract_base_room_name(daily_room_name)
 
@@ -202,9 +249,6 @@ async def process_multitrack_recording(
     if not room:
         raise Exception(f"Room not found: {room_name_base}")
 
-    if not meeting:
-        raise Exception(f"Meeting not found: {room_name_base}")
-
     logger.info(
         "Found existing Meeting for recording",
         meeting_id=meeting.id,
@@ -225,9 +269,7 @@ async def process_multitrack_recording(
                 track_keys=track_keys,
             )
         )
-    else:
-        # Recording already exists; assume metadata was set at creation time
-        pass
+    # else: Recording already exists; metadata set at creation time
 
     transcript = await transcripts_controller.get_by_recording_id(recording.id)
     if transcript:
@@ -252,60 +294,70 @@ async def process_multitrack_recording(
         )
 
     try:
-        daily_client = create_platform_client("daily")
+        async with create_platform_client("daily") as daily_client:
+            id_to_name = {}
+            id_to_user_id = {}
 
-        id_to_name = {}
-        id_to_user_id = {}
-
-        mtg_session_id = None
-        try:
-            rec_details = await daily_client.get_recording(recording_id)
-            mtg_session_id = rec_details.get("mtgSessionId")
-        except Exception as e:
-            logger.warning(
-                "Failed to fetch Daily recording details",
-                error=str(e),
-                recording_id=recording_id,
-                exc_info=True,
-            )
-
-        if mtg_session_id:
             try:
-                payload = await daily_client.get_meeting_participants(mtg_session_id)
-                for p in payload.get("data", []):
-                    pid = p.get("participant_id")
-                    name = p.get("user_name")
-                    user_id = p.get("user_id")
-                    if pid and name:
-                        id_to_name[pid] = name
-                    if pid and user_id:
-                        id_to_user_id[pid] = user_id
+                rec_details = await daily_client.get_recording(recording_id)
+                mtg_session_id = rec_details.mtgSessionId
+                if mtg_session_id:
+                    try:
+                        payload: MeetingParticipantsResponse = (
+                            await daily_client.get_meeting_participants(mtg_session_id)
+                        )
+                        for p in payload.data:
+                            pid = p.participant_id
+                            assert (
+                                pid is not None
+                            ), "panic! participant id cannot be None"
+                            name = p.user_name
+                            user_id = p.user_id
+                            if name:
+                                id_to_name[pid] = name
+                            if user_id:
+                                id_to_user_id[pid] = user_id
+                    except Exception as e:
+                        logger.warning(
+                            "Failed to fetch Daily meeting participants",
+                            error=str(e),
+                            mtg_session_id=mtg_session_id,
+                            exc_info=True,
+                        )
+                else:
+                    logger.warning(
+                        "No mtgSessionId found for recording; participant names may be generic",
+                        recording_id=recording_id,
+                    )
             except Exception as e:
                 logger.warning(
-                    "Failed to fetch Daily meeting participants",
+                    "Failed to fetch Daily recording details",
                     error=str(e),
-                    mtg_session_id=mtg_session_id,
+                    recording_id=recording_id,
                     exc_info=True,
                 )
-        else:
-            logger.warning(
-                "No mtgSessionId found for recording; participant names may be generic",
-                recording_id=recording_id,
-            )
 
-        for idx, key in enumerate(track_keys):
-            base = os.path.basename(key)
-            m = re.search(r"\d{13,}-([0-9a-fA-F-]{36})-cam-audio-", base)
-            participant_id = m.group(1) if m else None
+            for idx, key in enumerate(track_keys):
+                try:
+                    parsed = parse_daily_recording_filename(key)
+                    participant_id = parsed.participant_id
+                except ValueError as e:
+                    logger.error(
+                        "Failed to parse Daily recording filename",
+                        error=str(e),
+                        key=key,
+                        exc_info=True,
+                    )
+                    continue
 
-            default_name = f"Speaker {idx}"
-            name = id_to_name.get(participant_id, default_name)
-            user_id = id_to_user_id.get(participant_id)
+                default_name = f"Speaker {idx}"
+                name = id_to_name.get(participant_id, default_name)
+                user_id = id_to_user_id.get(participant_id)
 
-            participant = TranscriptParticipant(
-                id=participant_id, speaker=idx, name=name, user_id=user_id
-            )
-            await transcripts_controller.upsert_participant(transcript, participant)
+                participant = TranscriptParticipant(
+                    id=participant_id, speaker=idx, name=name, user_id=user_id
+                )
+                await transcripts_controller.upsert_participant(transcript, participant)
 
     except Exception as e:
         logger.warning("Failed to map participant names", error=str(e), exc_info=True)
@@ -317,6 +369,216 @@ async def process_multitrack_recording(
     )
 
 
+@shared_task
+@asynctask
+async def poll_daily_recordings():
+    """Poll Daily.co API for recordings and process missing ones.
+
+    Fetches latest recordings from Daily.co API (default limit 100), compares with DB,
+    and queues processing for recordings not already in DB.
+
+    For each missing recording, uses audio tracks from API response.
+
+    Worker-level locking provides idempotency (see process_multitrack_recording).
+    """
+    bucket_name = settings.DAILYCO_STORAGE_AWS_BUCKET_NAME
+    if not bucket_name:
+        logger.debug(
+            "DAILYCO_STORAGE_AWS_BUCKET_NAME not configured; skipping recording poll"
+        )
+        return
+
+    async with create_platform_client("daily") as daily_client:
+        # latest 100. TODO cursor-based state
+        api_recordings = await daily_client.list_recordings()
+
+    if not api_recordings:
+        logger.debug(
+            "No recordings found from Daily.co API",
+        )
+        return
+
+    recording_ids = [rec.id for rec in api_recordings]
+    existing_recordings = await recordings_controller.get_by_ids(recording_ids)
+    existing_ids = {rec.id for rec in existing_recordings}
+
+    missing_recordings = [rec for rec in api_recordings if rec.id not in existing_ids]
+
+    if not missing_recordings:
+        logger.debug(
+            "All recordings already in DB",
+            api_count=len(api_recordings),
+            existing_count=len(existing_recordings),
+        )
+        return
+
+    logger.info(
+        "Found recordings missing from DB",
+        missing_count=len(missing_recordings),
+        total_api_count=len(api_recordings),
+        existing_count=len(existing_recordings),
+    )
+
+    for recording in missing_recordings:
+        if not recording.tracks:
+            assert recording.status != "finished", (
+                f"Recording {recording.id} has status='finished' but no tracks. "
+                f"Daily.co API guarantees finished recordings have tracks available. "
+                f"room_name={recording.room_name}"
+            )
+            logger.debug(
+                "No tracks in recording yet",
+                recording_id=recording.id,
+                room_name=recording.room_name,
+                status=recording.status,
+            )
+            continue
+
+        track_keys = [t.s3Key for t in recording.tracks if t.type == "audio"]
+
+        if not track_keys:
+            logger.warning(
+                "No audio tracks found in recording (only video tracks)",
+                recording_id=recording.id,
+                room_name=recording.room_name,
+                total_tracks=len(recording.tracks),
+            )
+            continue
+
+        meeting = await meetings_controller.get_by_room_name(recording.room_name)
+        if not meeting:
+            logger.warning(
+                "Skipping recording - no matching meeting",
+                recording_id=recording.id,
+                room_name=recording.room_name,
+            )
+            continue
+
+        logger.info(
+            "Queueing missing recording for processing",
+            recording_id=recording.id,
+            room_name=recording.room_name,
+            track_count=len(track_keys),
+        )
+
+        process_multitrack_recording.delay(
+            bucket_name=bucket_name,
+            daily_room_name=recording.room_name,
+            recording_id=recording.id,
+            track_keys=track_keys,
+        )
+
+
+async def poll_daily_room_presence(meeting_id: str) -> None:
+    """Poll Daily.co room presence and reconcile with DB sessions. New presence is added, old presence is marked as closed.
+    Warning: Daily api returns only current state, so there could be missed presence updates, people who went and left the room quickly.
+    Therefore, set(presences) != set(recordings) even if everyone said something. This is not a problem but should be noted."""
+
+    async with RedisAsyncLock(
+        key=f"meeting_presence_poll:{meeting_id}",
+        timeout=120,
+        extend_interval=30,
+        skip_if_locked=True,
+        blocking=False,
+    ) as lock:
+        if not lock.acquired:
+            logger.debug(
+                "Concurrent poll skipped (duplicate task)", meeting_id=meeting_id
+            )
+            return
+
+        meeting = await meetings_controller.get_by_id(meeting_id)
+        if not meeting:
+            logger.warning("Meeting not found", meeting_id=meeting_id)
+            return
+
+        async with create_platform_client("daily") as daily_client:
+            try:
+                presence = await daily_client.get_room_presence(meeting.room_name)
+            except Exception as e:
+                logger.error(
+                    "Daily.co API fetch failed",
+                    meeting_id=meeting.id,
+                    room_name=meeting.room_name,
+                    error=str(e),
+                    exc_info=True,
+                )
+                return
+
+        api_participants = {p.id: p for p in presence.data}
+        db_sessions = (
+            await daily_participant_sessions_controller.get_all_sessions_for_meeting(
+                meeting.id
+            )
+        )
+
+        active_session_ids = {
+            sid for sid, s in db_sessions.items() if s.left_at is None
+        }
+        missing_session_ids = set(api_participants.keys()) - active_session_ids
+        stale_session_ids = active_session_ids - set(api_participants.keys())
+
+        if missing_session_ids:
+            missing_sessions = []
+            for session_id in missing_session_ids:
+                p = api_participants[session_id]
+                session = DailyParticipantSession(
+                    id=f"{meeting.id}:{session_id}",
+                    meeting_id=meeting.id,
+                    room_id=meeting.room_id,
+                    session_id=session_id,
+                    user_id=p.userId,
+                    user_name=p.userName,
+                    joined_at=datetime.fromisoformat(p.joinTime),
+                    left_at=None,
+                )
+                missing_sessions.append(session)
+
+            await daily_participant_sessions_controller.batch_upsert_sessions(
+                missing_sessions
+            )
+            logger.info(
+                "Sessions added",
+                meeting_id=meeting.id,
+                count=len(missing_sessions),
+            )
+
+        if stale_session_ids:
+            composite_ids = [f"{meeting.id}:{sid}" for sid in stale_session_ids]
+            await daily_participant_sessions_controller.batch_close_sessions(
+                composite_ids,
+                left_at=datetime.now(timezone.utc),
+            )
+            logger.info(
+                "Stale sessions closed",
+                meeting_id=meeting.id,
+                count=len(composite_ids),
+            )
+
+        final_active_count = len(api_participants)
+        if meeting.num_clients != final_active_count:
+            await meetings_controller.update_meeting(
+                meeting.id,
+                num_clients=final_active_count,
+            )
+            logger.info(
+                "num_clients updated",
+                meeting_id=meeting.id,
+                old_value=meeting.num_clients,
+                new_value=final_active_count,
+            )
+
+
+@shared_task
+@asynctask
+async def poll_daily_room_presence_task(meeting_id: str) -> None:
+    """Celery task wrapper for poll_daily_room_presence.
+
+    Queued by webhooks or reconciliation timer.
+    """
+    await poll_daily_room_presence(meeting_id)
+
+
 @shared_task
 @asynctask
 async def process_meetings():
@@ -335,72 +597,71 @@ async def process_meetings():
     Uses distributed locking to prevent race conditions when multiple workers
     process the same meeting simultaneously.
     """
-    logger.debug("Processing meetings")
+
     meetings = await meetings_controller.get_all_active()
+    logger.info(f"Processing {len(meetings)} meetings")
     current_time = datetime.now(timezone.utc)
-    redis_client = get_redis_client()
     processed_count = 0
     skipped_count = 0
-
     for meeting in meetings:
         logger_ = logger.bind(meeting_id=meeting.id, room_name=meeting.room_name)
-        lock_key = f"meeting_process_lock:{meeting.id}"
-        lock = redis_client.lock(lock_key, timeout=120)
+        logger_.info("Processing meeting")
 
         try:
-            if not lock.acquire(blocking=False):
-                logger_.debug("Meeting is being processed by another worker, skipping")
-                skipped_count += 1
-                continue
+            async with RedisAsyncLock(
+                key=f"meeting_process_lock:{meeting.id}",
+                timeout=120,
+                extend_interval=30,
+                skip_if_locked=True,
+                blocking=False,
+            ) as lock:
+                if not lock.acquired:
+                    logger_.debug(
+                        "Meeting is being processed by another worker, skipping"
+                    )
+                    skipped_count += 1
+                    continue
 
-            # Process the meeting
-            should_deactivate = False
-            end_date = meeting.end_date
-            if end_date.tzinfo is None:
-                end_date = end_date.replace(tzinfo=timezone.utc)
+                # Process the meeting
+                should_deactivate = False
+                end_date = meeting.end_date
+                if end_date.tzinfo is None:
+                    end_date = end_date.replace(tzinfo=timezone.utc)
 
-            # This API call could be slow, extend lock if needed
-            client = create_platform_client(meeting.platform)
-            room_sessions = await client.get_room_sessions(meeting.room_name)
+                client = create_platform_client(meeting.platform)
+                room_sessions = await client.get_room_sessions(meeting.room_name)
 
-            try:
-                # Extend lock after slow operation to ensure we still hold it
-                lock.extend(120, replace_ttl=True)
-            except LockError:
-                logger_.warning("Lost lock for meeting, skipping")
-                continue
-
-            has_active_sessions = room_sessions and any(
-                rs["endedAt"] is None for rs in room_sessions
-            )
-            has_had_sessions = bool(room_sessions)
-
-            if has_active_sessions:
-                logger_.debug("Meeting still has active sessions, keep it")
-            elif has_had_sessions:
-                should_deactivate = True
-                logger_.info("Meeting ended - all participants left")
-            elif current_time > end_date:
-                should_deactivate = True
-                logger_.info(
-                    "Meeting deactivated - scheduled time ended with no participants",
+                has_active_sessions = room_sessions and any(
+                    s.ended_at is None for s in room_sessions
+                )
+                has_had_sessions = bool(room_sessions)
+                logger_.info(
+                    f"found {has_active_sessions} active sessions, had {has_had_sessions}"
                 )
-            else:
-                logger_.debug("Meeting not yet started, keep it")
 
-            if should_deactivate:
-                await meetings_controller.update_meeting(meeting.id, is_active=False)
-                logger_.info("Meeting is deactivated")
+                if has_active_sessions:
+                    logger_.debug("Meeting still has active sessions, keep it")
+                elif has_had_sessions:
+                    should_deactivate = True
+                    logger_.info("Meeting ended - all participants left")
+                elif current_time > end_date:
+                    should_deactivate = True
+                    logger_.info(
+                        "Meeting deactivated - scheduled time ended with no participants",
+                    )
+                else:
+                    logger_.debug("Meeting not yet started, keep it")
 
-            processed_count += 1
+                if should_deactivate:
+                    await meetings_controller.update_meeting(
+                        meeting.id, is_active=False
+                    )
+                    logger_.info("Meeting is deactivated")
+
+                processed_count += 1
 
         except Exception:
             logger_.error("Error processing meeting", exc_info=True)
-        finally:
-            try:
-                lock.release()
-            except LockError:
-                pass  # Lock already released or expired
 
     logger.debug(
         "Processed meetings finished",
@@ -522,3 +783,34 @@ async def reprocess_failed_recordings():
 
     logger.info(f"Reprocessing complete. Requeued {reprocessed_count} recordings")
     return reprocessed_count
+
+
+@shared_task
+@asynctask
+async def trigger_daily_reconciliation() -> None:
+    """Daily.co pull"""
+    try:
+        active_meetings = await meetings_controller.get_all_active(platform="daily")
+        queued_count = 0
+
+        for meeting in active_meetings:
+            try:
+                poll_daily_room_presence_task.delay(meeting.id)
+                queued_count += 1
+            except Exception as e:
+                logger.error(
+                    "Failed to queue reconciliation poll",
+                    meeting_id=meeting.id,
+                    error=str(e),
+                    exc_info=True,
+                )
+                raise
+
+        if queued_count > 0:
+            logger.debug(
+                "Reconciliation polls queued",
+                count=queued_count,
+            )
+
+    except Exception as e:
+        logger.error("Reconciliation trigger failed", error=str(e), exc_info=True)

server/scripts/list_daily_webhooks.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+
+import asyncio
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from reflector.dailyco_api import DailyApiClient
+from reflector.settings import settings
+
+
+async def list_webhooks():
+    """List all Daily.co webhooks for this account using dailyco_api module."""
+    if not settings.DAILY_API_KEY:
+        print("Error: DAILY_API_KEY not set")
+        return 1
+
+    async with DailyApiClient(api_key=settings.DAILY_API_KEY) as client:
+        try:
+            webhooks = await client.list_webhooks()
+
+            if not webhooks:
+                print("No webhooks found")
+                return 0
+
+            print(f"Found {len(webhooks)} webhook(s):\n")
+
+            for webhook in webhooks:
+                print("=" * 80)
+                print(f"UUID:         {webhook.uuid}")
+                print(f"URL:          {webhook.url}")
+                print(f"State:        {webhook.state}")
+                print(f"Event Types:  {', '.join(webhook.eventTypes)}")
+                print(
+                    f"HMAC Secret:  {'✓ Configured' if webhook.hmac else '✗ Not set'}"
+                )
+                print()
+
+            print("=" * 80)
+            print(
+                f"\nCurrent DAILY_WEBHOOK_UUID in settings: {settings.DAILY_WEBHOOK_UUID or '(not set)'}"
+            )
+
+            return 0
+
+        except Exception as e:
+            print(f"Error fetching webhooks: {e}")
+            return 1
+
+
+if __name__ == "__main__":
+    sys.exit(asyncio.run(list_webhooks()))

server/scripts/migrate_user_ids.py

@@ -0,0 +1,292 @@
+#!/usr/bin/env python3
+"""
+Manual Migration Script: Migrate user_id from Authentik UID to internal user.id
+
+This script should be run manually AFTER applying the database schema migrations.
+
+Usage:
+    AUTHENTIK_API_URL=https://your-authentik-url \
+    AUTHENTIK_API_TOKEN=your-token \
+    DATABASE_URL=postgresql://... \
+    python scripts/migrate_user_ids.py
+
+What this script does:
+1. Collects all unique Authentik UIDs currently used in the database
+2. Fetches only those users from Authentik API to populate the users table
+3. Updates user_id in: user_api_key, transcript, room, meeting_consent
+4. Uses user.authentik_uid to lookup the corresponding user.id
+
+The script is idempotent:
+- User inserts use ON CONFLICT DO NOTHING (safe if users already exist)
+- Update queries only match authentik_uid->uuid pairs (no-op if already migrated)
+- Safe to run multiple times without side effects
+
+Prerequisites:
+- AUTHENTIK_API_URL environment variable must be set
+- AUTHENTIK_API_TOKEN environment variable must be set
+- DATABASE_URL environment variable must be set
+- Authentik API must be accessible
+"""
+
+import asyncio
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+import httpx
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
+
+TABLES_WITH_USER_ID = ["user_api_key", "transcript", "room", "meeting_consent"]
+NULLABLE_USER_ID_TABLES = {"transcript", "meeting_consent"}
+AUTHENTIK_PAGE_SIZE = 100
+HTTP_TIMEOUT = 30.0
+
+
+class AuthentikClient:
+    def __init__(self, api_url: str, api_token: str):
+        self.api_url = api_url
+        self.api_token = api_token
+
+    def _get_headers(self) -> dict[str, str]:
+        return {
+            "Authorization": f"Bearer {self.api_token}",
+            "Accept": "application/json",
+        }
+
+    async def fetch_all_users(self) -> list[dict[str, Any]]:
+        all_users = []
+        page = 1
+
+        try:
+            async with httpx.AsyncClient(timeout=HTTP_TIMEOUT) as client:
+                while True:
+                    url = f"{self.api_url}/api/v3/core/users/"
+                    params = {
+                        "page": page,
+                        "page_size": AUTHENTIK_PAGE_SIZE,
+                        "include_groups": "false",
+                    }
+
+                    print(f"  Fetching users from Authentik (page {page})...")
+                    response = await client.get(
+                        url, headers=self._get_headers(), params=params
+                    )
+                    response.raise_for_status()
+                    data = response.json()
+
+                    results = data.get("results", [])
+                    if not results:
+                        break
+
+                    all_users.extend(results)
+                    print(f"  Fetched {len(results)} users from page {page}")
+
+                    if not data.get("next"):
+                        break
+
+                    page += 1
+
+            print(f"  Total: {len(all_users)} users fetched from Authentik")
+            return all_users
+
+        except httpx.HTTPError as e:
+            raise Exception(f"Failed to fetch users from Authentik: {e}") from e
+
+
+async def collect_used_authentik_uids(connection: AsyncConnection) -> set[str]:
+    print("\nStep 1: Collecting Authentik UIDs from database tables...")
+    used_authentik_uids = set()
+
+    for table in TABLES_WITH_USER_ID:
+        result = await connection.execute(
+            text(f'SELECT DISTINCT user_id FROM "{table}" WHERE user_id IS NOT NULL')
+        )
+        authentik_uids = [row[0] for row in result.fetchall()]
+        used_authentik_uids.update(authentik_uids)
+        print(f"  Found {len(authentik_uids)} unique Authentik UIDs in {table}")
+
+    print(f"  Total unique user IDs found: {len(used_authentik_uids)}")
+
+    if used_authentik_uids:
+        sample_id = next(iter(used_authentik_uids))
+        if len(sample_id) == 36 and sample_id.count("-") == 4:
+            print(
+                f"\n✅ User IDs are already in UUID format (e.g., {sample_id[:20]}...)"
+            )
+            print("Migration has already been completed!")
+            return set()
+
+    return used_authentik_uids
+
+
+def filter_users_by_authentik_uid(
+    authentik_users: list[dict[str, Any]], used_authentik_uids: set[str]
+) -> tuple[list[dict[str, Any]], set[str]]:
+    used_authentik_users = [
+        user for user in authentik_users if user.get("uid") in used_authentik_uids
+    ]
+
+    missing_ids = used_authentik_uids - {u.get("uid") for u in used_authentik_users}
+
+    print(
+        f"  Found {len(used_authentik_users)} matching users in Authentik "
+        f"(out of {len(authentik_users)} total)"
+    )
+
+    if missing_ids:
+        print(
+            f"  ⚠ Warning: {len(missing_ids)} Authentik UIDs in database not found in Authentik:"
+        )
+        for user_id in sorted(missing_ids):
+            print(f"    - {user_id}")
+
+    return used_authentik_users, missing_ids
+
+
+async def sync_users_to_database(
+    connection: AsyncConnection, authentik_users: list[dict[str, Any]]
+) -> tuple[int, int]:
+    created = 0
+    skipped = 0
+    now = datetime.now(timezone.utc)
+
+    for authentik_user in authentik_users:
+        user_id = authentik_user["uuid"]
+        authentik_uid = authentik_user["uid"]
+        email = authentik_user.get("email")
+
+        if not email:
+            print(f"  ⚠ Skipping user {authentik_uid} (no email)")
+            skipped += 1
+            continue
+
+        result = await connection.execute(
+            text("""
+                INSERT INTO "user" (id, email, authentik_uid, created_at, updated_at)
+                VALUES (:id, :email, :authentik_uid, :created_at, :updated_at)
+                ON CONFLICT (id) DO NOTHING
+            """),
+            {
+                "id": user_id,
+                "email": email,
+                "authentik_uid": authentik_uid,
+                "created_at": now,
+                "updated_at": now,
+            },
+        )
+        if result.rowcount > 0:
+            created += 1
+
+    return created, skipped
+
+
+async def migrate_all_user_ids(connection: AsyncConnection) -> int:
+    print("\nStep 3: Migrating user_id columns from Authentik UID to internal UUID...")
+    print("(If no rows are updated, migration may have already been completed)")
+
+    total_updated = 0
+
+    for table in TABLES_WITH_USER_ID:
+        null_check = (
+            f"AND {table}.user_id IS NOT NULL"
+            if table in NULLABLE_USER_ID_TABLES
+            else ""
+        )
+
+        query = f"""
+            UPDATE {table}
+            SET user_id = u.id
+            FROM "user" u
+            WHERE {table}.user_id = u.authentik_uid
+            {null_check}
+        """
+
+        print(f"  Updating {table}.user_id...")
+        result = await connection.execute(text(query))
+        rows = result.rowcount
+        print(f"    ✓ Updated {rows} rows")
+        total_updated += rows
+
+    return total_updated
+
+
+async def run_migration(
+    database_url: str, authentik_api_url: str, authentik_api_token: str
+) -> None:
+    engine = create_async_engine(database_url)
+
+    try:
+        async with engine.begin() as connection:
+            used_authentik_uids = await collect_used_authentik_uids(connection)
+            if not used_authentik_uids:
+                print("\n⚠️  No user IDs found in database. Nothing to migrate.")
+                print("Migration complete (no-op)!")
+                return
+
+            print("\nStep 2: Fetching user data from Authentik and syncing users...")
+            print("(This script is idempotent - safe to run multiple times)")
+            print(f"Authentik API URL: {authentik_api_url}")
+
+            client = AuthentikClient(authentik_api_url, authentik_api_token)
+            authentik_users = await client.fetch_all_users()
+
+            if not authentik_users:
+                print("\nERROR: No users returned from Authentik API.")
+                print(
+                    "Please verify your Authentik configuration and ensure users exist."
+                )
+                sys.exit(1)
+
+            used_authentik_users, _ = filter_users_by_authentik_uid(
+                authentik_users, used_authentik_uids
+            )
+            created, skipped = await sync_users_to_database(
+                connection, used_authentik_users
+            )
+
+            if created > 0:
+                print(f"✓ Created {created} users from Authentik")
+            else:
+                print("✓ No new users created (users may already exist)")
+
+            if skipped > 0:
+                print(f"  ⚠ Skipped {skipped} users without email")
+
+            result = await connection.execute(text('SELECT COUNT(*) FROM "user"'))
+            user_count = result.scalar()
+            print(f"✓ Users table now has {user_count} users")
+
+            total_updated = await migrate_all_user_ids(connection)
+
+            if total_updated > 0:
+                print(f"\n✅ Migration complete! Updated {total_updated} total rows.")
+            else:
+                print(
+                    "\n✅ Migration complete! (No rows updated - migration may have already been completed)"
+                )
+
+    except Exception as e:
+        print(f"\n❌ ERROR: Migration failed: {e}")
+        sys.exit(1)
+    finally:
+        await engine.dispose()
+
+
+async def main() -> None:
+    database_url = os.getenv("DATABASE_URL")
+    authentik_api_url = os.getenv("AUTHENTIK_API_URL")
+    authentik_api_token = os.getenv("AUTHENTIK_API_TOKEN")
+
+    if not database_url or not authentik_api_url or not authentik_api_token:
+        print(
+            "ERROR: DATABASE_URL, AUTHENTIK_API_URL, and AUTHENTIK_API_TOKEN must be set"
+        )
+        sys.exit(1)
+
+    await run_migration(database_url, authentik_api_url, authentik_api_token)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

server/scripts/recreate_daily_webhook.py

@@ -6,56 +6,60 @@ from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
-import httpx
-
+from reflector.dailyco_api import (
+    CreateWebhookRequest,
+    DailyApiClient,
+)
 from reflector.settings import settings
 
 
 async def setup_webhook(webhook_url: str):
     """
-    Create or update Daily.co webhook for this environment.
+    Create or update Daily.co webhook for this environment using dailyco_api module.
     Uses DAILY_WEBHOOK_UUID to identify existing webhook.
     """
     if not settings.DAILY_API_KEY:
         print("Error: DAILY_API_KEY not set")
         return 1
 
-    headers = {
-        "Authorization": f"Bearer {settings.DAILY_API_KEY}",
-        "Content-Type": "application/json",
-    }
+    if not settings.DAILY_WEBHOOK_SECRET:
+        print("Error: DAILY_WEBHOOK_SECRET not set")
+        return 1
 
-    webhook_data = {
-        "url": webhook_url,
-        "eventTypes": [
-            "participant.joined",
-            "participant.left",
-            "recording.started",
-            "recording.ready-to-download",
-            "recording.error",
-        ],
-        "hmac": settings.DAILY_WEBHOOK_SECRET,
-    }
+    event_types = [
+        "participant.joined",
+        "participant.left",
+        "recording.started",
+        "recording.ready-to-download",
+        "recording.error",
+    ]
 
-    async with httpx.AsyncClient() as client:
+    async with DailyApiClient(api_key=settings.DAILY_API_KEY) as client:
         webhook_uuid = settings.DAILY_WEBHOOK_UUID
 
         if webhook_uuid:
-            # Update existing webhook
             print(f"Updating existing webhook {webhook_uuid}...")
             try:
-                resp = await client.patch(
-                    f"https://api.daily.co/v1/webhooks/{webhook_uuid}",
-                    headers=headers,
-                    json=webhook_data,
+                # Note: Daily.co doesn't support PATCH well, so we delete + recreate
+                await client.delete_webhook(webhook_uuid)
+                print(f"Deleted old webhook {webhook_uuid}")
+
+                request = CreateWebhookRequest(
+                    url=webhook_url,
+                    eventTypes=event_types,
+                    hmac=settings.DAILY_WEBHOOK_SECRET,
                 )
-                resp.raise_for_status()
-                result = resp.json()
-                print(f"✓ Updated webhook {result['uuid']} (state: {result['state']})")
-                print(f"  URL: {result['url']}")
-                return 0
-            except httpx.HTTPStatusError as e:
-                if e.response.status_code == 404:
+                result = await client.create_webhook(request)
+
+                print(
+                    f"✓ Created replacement webhook {result.uuid} (state: {result.state})"
+                )
+                print(f"  URL: {result.url}")
+
+                webhook_uuid = result.uuid
+
+            except Exception as e:
+                if hasattr(e, "response") and e.response.status_code == 404:
                     print(f"Webhook {webhook_uuid} not found, creating new one...")
                     webhook_uuid = None  # Fall through to creation
                 else:
@@ -63,17 +67,17 @@ async def setup_webhook(webhook_url: str):
                     return 1
 
         if not webhook_uuid:
-            # Create new webhook
             print("Creating new webhook...")
-            resp = await client.post(
-                "https://api.daily.co/v1/webhooks", headers=headers, json=webhook_data
+            request = CreateWebhookRequest(
+                url=webhook_url,
+                eventTypes=event_types,
+                hmac=settings.DAILY_WEBHOOK_SECRET,
             )
-            resp.raise_for_status()
-            result = resp.json()
-            webhook_uuid = result["uuid"]
+            result = await client.create_webhook(request)
+            webhook_uuid = result.uuid
 
-            print(f"✓ Created webhook {webhook_uuid} (state: {result['state']})")
-            print(f"  URL: {result['url']}")
+            print(f"✓ Created webhook {webhook_uuid} (state: {result.state})")
+            print(f"  URL: {result.url}")
             print()
             print("=" * 60)
             print("IMPORTANT: Add this to your environment variables:")
@@ -114,7 +118,7 @@ if __name__ == "__main__":
         )
         print()
         print("Behavior:")
-        print("  - If DAILY_WEBHOOK_UUID set: Updates existing webhook")
+        print("  - If DAILY_WEBHOOK_UUID set: Deletes old webhook, creates new one")
         print(
             "  - If DAILY_WEBHOOK_UUID empty: Creates new webhook, saves UUID to .env"
         )

server/tests/mocks/mock_platform.py

@@ -3,9 +3,11 @@ from datetime import datetime
 from typing import Any, Dict, Literal, Optional
 
 from reflector.db.rooms import Room
+from reflector.utils.string import NonEmptyString
 from reflector.video_platforms.base import (
     ROOM_PREFIX_SEPARATOR,
     MeetingData,
+    SessionData,
     VideoPlatformClient,
     VideoPlatformConfig,
 )
@@ -49,28 +51,18 @@ class MockPlatformClient(VideoPlatformClient):
             extra_data={"mock": True},
         )
 
-    async def get_room_sessions(self, room_name: str) -> Dict[str, Any]:
+    async def get_room_sessions(self, room_name: NonEmptyString) -> list[SessionData]:
         if room_name not in self._rooms:
-            return {"error": "Room not found"}
+            return []
 
         room_data = self._rooms[room_name]
-        return {
-            "roomName": room_name,
-            "sessions": [
-                {
-                    "sessionId": room_data["id"],
-                    "startTime": datetime.utcnow().isoformat(),
-                    "participants": room_data["participants"],
-                    "isActive": room_data["is_active"],
-                }
-            ],
-        }
-
-    async def delete_room(self, room_name: str) -> bool:
-        if room_name in self._rooms:
-            self._rooms[room_name]["is_active"] = False
-            return True
-        return False
+        return [
+            SessionData(
+                session_id=room_data["id"],
+                started_at=datetime.utcnow(),
+                ended_at=None if room_data["is_active"] else datetime.utcnow(),
+            )
+        ]
 
     async def upload_logo(self, room_name: str, logo_path: str) -> bool:
         if room_name in self._rooms:

server/tests/test_daily_room_presence_polling.py

@@ -0,0 +1,466 @@
+"""Tests for Daily.co room presence polling functionality.
+
+TDD tests for Task 3.2: Room Presence Polling
+- Query Daily.co API for current room participants
+- Reconcile with DB sessions (add missing, close stale)
+- Update meeting.num_clients if different
+- Use batch operations for efficiency
+"""
+
+from datetime import datetime, timedelta, timezone
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from reflector.dailyco_api.responses import (
+    RoomPresenceParticipant,
+    RoomPresenceResponse,
+)
+from reflector.db.daily_participant_sessions import DailyParticipantSession
+from reflector.db.meetings import Meeting
+from reflector.worker.process import poll_daily_room_presence
+
+
+@pytest.fixture
+def mock_meeting():
+    """Mock meeting with Daily.co room."""
+    return Meeting(
+        id="meeting-123",
+        room_id="room-456",
+        room_name="test-room-20251118120000",
+        room_url="https://daily.co/test-room-20251118120000",
+        host_room_url="https://daily.co/test-room-20251118120000?t=host-token",
+        platform="daily",
+        num_clients=2,
+        is_active=True,
+        start_date=datetime.now(timezone.utc),
+        end_date=datetime.now(timezone.utc),
+    )
+
+
+@pytest.fixture
+def mock_api_participants():
+    """Mock Daily.co API presence response."""
+    now = datetime.now(timezone.utc)
+    return RoomPresenceResponse(
+        total_count=2,
+        data=[
+            RoomPresenceParticipant(
+                room="test-room-20251118120000",
+                id="participant-1",
+                userName="Alice",
+                userId="user-alice",
+                joinTime=(now - timedelta(minutes=10)).isoformat(),
+                duration=600,
+            ),
+            RoomPresenceParticipant(
+                room="test-room-20251118120000",
+                id="participant-2",
+                userName="Bob",
+                userId="user-bob",
+                joinTime=(now - timedelta(minutes=5)).isoformat(),
+                duration=300,
+            ),
+        ],
+    )
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.get_all_sessions_for_meeting"
+)
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.batch_upsert_sessions"
+)
+async def test_poll_presence_adds_missing_sessions(
+    mock_batch_upsert,
+    mock_get_sessions,
+    mock_create_client,
+    mock_get_by_id,
+    mock_meeting,
+    mock_api_participants,
+):
+    """Test that polling creates sessions for participants not in DB."""
+    mock_get_by_id.return_value = mock_meeting
+
+    mock_daily_client = AsyncMock()
+    mock_daily_client.get_room_presence = AsyncMock(return_value=mock_api_participants)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    mock_get_sessions.return_value = {}
+    mock_batch_upsert.return_value = None
+
+    await poll_daily_room_presence(mock_meeting.id)
+
+    assert mock_batch_upsert.call_count == 1
+    sessions = mock_batch_upsert.call_args.args[0]
+    assert len(sessions) == 2
+    session_ids = {s.session_id for s in sessions}
+    assert session_ids == {"participant-1", "participant-2"}
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.get_all_sessions_for_meeting"
+)
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.batch_upsert_sessions"
+)
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.batch_close_sessions"
+)
+async def test_poll_presence_closes_stale_sessions(
+    mock_batch_close,
+    mock_batch_upsert,
+    mock_get_sessions,
+    mock_create_client,
+    mock_get_by_id,
+    mock_meeting,
+    mock_api_participants,
+):
+    """Test that polling closes sessions for participants no longer in room."""
+    mock_get_by_id.return_value = mock_meeting
+
+    mock_daily_client = AsyncMock()
+    mock_daily_client.get_room_presence = AsyncMock(return_value=mock_api_participants)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    now = datetime.now(timezone.utc)
+    mock_get_sessions.return_value = {
+        "participant-1": DailyParticipantSession(
+            id=f"meeting-123:participant-1",
+            meeting_id="meeting-123",
+            room_id="room-456",
+            session_id="participant-1",
+            user_id="user-alice",
+            user_name="Alice",
+            joined_at=now,
+            left_at=None,
+        ),
+        "participant-stale": DailyParticipantSession(
+            id=f"meeting-123:participant-stale",
+            meeting_id="meeting-123",
+            room_id="room-456",
+            session_id="participant-stale",
+            user_id="user-stale",
+            user_name="Stale User",
+            joined_at=now - timedelta(seconds=120),  # Joined 2 minutes ago
+            left_at=None,
+        ),
+    }
+
+    await poll_daily_room_presence(mock_meeting.id)
+
+    assert mock_batch_close.call_count == 1
+    composite_ids = mock_batch_close.call_args.args[0]
+    left_at = mock_batch_close.call_args.kwargs["left_at"]
+    assert len(composite_ids) == 1
+    assert "meeting-123:participant-stale" in composite_ids
+    assert left_at is not None
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.get_all_sessions_for_meeting"
+)
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.batch_upsert_sessions"
+)
+@patch("reflector.worker.process.meetings_controller.update_meeting")
+async def test_poll_presence_updates_num_clients(
+    mock_update_meeting,
+    mock_batch_upsert,
+    mock_get_sessions,
+    mock_create_client,
+    mock_get_by_id,
+    mock_meeting,
+    mock_api_participants,
+):
+    """Test that polling updates num_clients when different from API."""
+    meeting_with_wrong_count = mock_meeting
+    meeting_with_wrong_count.num_clients = 5
+    mock_get_by_id.return_value = meeting_with_wrong_count
+
+    mock_daily_client = AsyncMock()
+    mock_daily_client.get_room_presence = AsyncMock(return_value=mock_api_participants)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    mock_get_sessions.return_value = {}
+    mock_batch_upsert.return_value = None
+
+    await poll_daily_room_presence(meeting_with_wrong_count.id)
+
+    assert mock_update_meeting.call_count == 1
+    assert mock_update_meeting.call_args.kwargs["num_clients"] == 2
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.get_all_sessions_for_meeting"
+)
+async def test_poll_presence_no_changes_if_synced(
+    mock_get_sessions,
+    mock_create_client,
+    mock_get_by_id,
+    mock_meeting,
+    mock_api_participants,
+):
+    """Test that polling skips updates when DB already synced with API."""
+    mock_get_by_id.return_value = mock_meeting
+
+    mock_daily_client = AsyncMock()
+    mock_daily_client.get_room_presence = AsyncMock(return_value=mock_api_participants)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    now = datetime.now(timezone.utc)
+    mock_get_sessions.return_value = {
+        "participant-1": DailyParticipantSession(
+            id=f"meeting-123:participant-1",
+            meeting_id="meeting-123",
+            room_id="room-456",
+            session_id="participant-1",
+            user_id="user-alice",
+            user_name="Alice",
+            joined_at=now,
+            left_at=None,
+        ),
+        "participant-2": DailyParticipantSession(
+            id=f"meeting-123:participant-2",
+            meeting_id="meeting-123",
+            room_id="room-456",
+            session_id="participant-2",
+            user_id="user-bob",
+            user_name="Bob",
+            joined_at=now,
+            left_at=None,
+        ),
+    }
+
+    await poll_daily_room_presence(mock_meeting.id)
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.get_all_sessions_for_meeting"
+)
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.batch_upsert_sessions"
+)
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.batch_close_sessions"
+)
+async def test_poll_presence_mixed_add_and_remove(
+    mock_batch_close,
+    mock_batch_upsert,
+    mock_get_sessions,
+    mock_create_client,
+    mock_get_by_id,
+    mock_meeting,
+):
+    """Test that polling handles simultaneous joins and leaves in single poll."""
+    mock_get_by_id.return_value = mock_meeting
+
+    now = datetime.now(timezone.utc)
+
+    # API returns: participant-1 and participant-3 (new)
+    api_response = RoomPresenceResponse(
+        total_count=2,
+        data=[
+            RoomPresenceParticipant(
+                room="test-room-20251118120000",
+                id="participant-1",
+                userName="Alice",
+                userId="user-alice",
+                joinTime=(now - timedelta(minutes=10)).isoformat(),
+                duration=600,
+            ),
+            RoomPresenceParticipant(
+                room="test-room-20251118120000",
+                id="participant-3",
+                userName="Charlie",
+                userId="user-charlie",
+                joinTime=now.isoformat(),
+                duration=0,
+            ),
+        ],
+    )
+
+    mock_daily_client = AsyncMock()
+    mock_daily_client.get_room_presence = AsyncMock(return_value=api_response)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    # DB has: participant-1 and participant-2 (left but not in API)
+    mock_get_sessions.return_value = {
+        "participant-1": DailyParticipantSession(
+            id=f"meeting-123:participant-1",
+            meeting_id="meeting-123",
+            room_id="room-456",
+            session_id="participant-1",
+            user_id="user-alice",
+            user_name="Alice",
+            joined_at=now - timedelta(minutes=10),
+            left_at=None,
+        ),
+        "participant-2": DailyParticipantSession(
+            id=f"meeting-123:participant-2",
+            meeting_id="meeting-123",
+            room_id="room-456",
+            session_id="participant-2",
+            user_id="user-bob",
+            user_name="Bob",
+            joined_at=now - timedelta(minutes=5),
+            left_at=None,
+        ),
+    }
+
+    mock_batch_upsert.return_value = None
+    mock_batch_close.return_value = None
+
+    await poll_daily_room_presence(mock_meeting.id)
+
+    # Verify participant-3 was added (missing in DB)
+    assert mock_batch_upsert.call_count == 1
+    sessions_added = mock_batch_upsert.call_args.args[0]
+    assert len(sessions_added) == 1
+    assert sessions_added[0].session_id == "participant-3"
+    assert sessions_added[0].user_name == "Charlie"
+
+    # Verify participant-2 was closed (stale in DB)
+    assert mock_batch_close.call_count == 1
+    composite_ids = mock_batch_close.call_args.args[0]
+    assert len(composite_ids) == 1
+    assert "meeting-123:participant-2" in composite_ids
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+async def test_poll_presence_handles_api_error(
+    mock_create_client,
+    mock_get_by_id,
+    mock_meeting,
+):
+    """Test that polling handles Daily.co API errors gracefully."""
+    mock_get_by_id.return_value = mock_meeting
+
+    mock_daily_client = AsyncMock()
+    mock_daily_client.get_room_presence = AsyncMock(side_effect=Exception("API error"))
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    await poll_daily_room_presence(mock_meeting.id)
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.get_all_sessions_for_meeting"
+)
+@patch(
+    "reflector.worker.process.daily_participant_sessions_controller.batch_close_sessions"
+)
+async def test_poll_presence_closes_all_when_room_empty(
+    mock_batch_close,
+    mock_get_sessions,
+    mock_create_client,
+    mock_get_by_id,
+    mock_meeting,
+):
+    """Test that polling closes all sessions when room is empty."""
+    mock_get_by_id.return_value = mock_meeting
+
+    mock_daily_client = AsyncMock()
+    mock_daily_client.get_room_presence = AsyncMock(
+        return_value=RoomPresenceResponse(total_count=0, data=[])
+    )
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    now = datetime.now(timezone.utc)
+    mock_get_sessions.return_value = {
+        "participant-1": DailyParticipantSession(
+            id=f"meeting-123:participant-1",
+            meeting_id="meeting-123",
+            room_id="room-456",
+            session_id="participant-1",
+            user_id="user-alice",
+            user_name="Alice",
+            joined_at=now
+            - timedelta(seconds=120),  # Joined 2 minutes ago (beyond grace period)
+            left_at=None,
+        ),
+    }
+
+    await poll_daily_room_presence(mock_meeting.id)
+
+    assert mock_batch_close.call_count == 1
+    composite_ids = mock_batch_close.call_args.args[0]
+    left_at = mock_batch_close.call_args.kwargs["left_at"]
+    assert len(composite_ids) == 1
+    assert "meeting-123:participant-1" in composite_ids
+    assert left_at is not None
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.RedisAsyncLock")
+@patch("reflector.worker.process.meetings_controller.get_by_id")
+@patch("reflector.worker.process.create_platform_client")
+async def test_poll_presence_skips_if_locked(
+    mock_create_client,
+    mock_get_by_id,
+    mock_redis_lock_class,
+    mock_meeting,
+):
+    """Test that concurrent polling is prevented by Redis lock."""
+    mock_get_by_id.return_value = mock_meeting
+
+    # Mock the RedisAsyncLock to simulate lock not acquired
+    mock_lock_instance = AsyncMock()
+    mock_lock_instance.acquired = False  # Lock not acquired
+    mock_lock_instance.__aenter__ = AsyncMock(return_value=mock_lock_instance)
+    mock_lock_instance.__aexit__ = AsyncMock()
+
+    mock_redis_lock_class.return_value = mock_lock_instance
+
+    mock_daily_client = AsyncMock()
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    await poll_daily_room_presence(mock_meeting.id)
+
+    # Verify RedisAsyncLock was instantiated
+    assert mock_redis_lock_class.call_count == 1
+    # Verify get_room_presence was NOT called (lock not acquired, so function returned early)
+    assert mock_daily_client.get_room_presence.call_count == 0

server/tests/test_poll_daily_recordings.py

@@ -0,0 +1,258 @@
+"""Tests for poll_daily_recordings task."""
+
+from datetime import datetime, timedelta, timezone
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from reflector.dailyco_api.responses import RecordingResponse
+from reflector.dailyco_api.webhooks import DailyTrack
+
+
+# Import the unwrapped async function for testing
+# The function is decorated with @shared_task and @asynctask,
+# but we need to test the underlying async implementation
+def _get_poll_daily_recordings_fn():
+    """Get the underlying async function without Celery/asynctask decorators."""
+    from reflector.worker import process
+
+    # Access the actual async function before decorators
+    fn = process.poll_daily_recordings
+    # Get through both decorator layers
+    if hasattr(fn, "__wrapped__"):
+        fn = fn.__wrapped__
+    if hasattr(fn, "__wrapped__"):
+        fn = fn.__wrapped__
+    return fn
+
+
+@pytest.fixture
+def mock_recording_response():
+    """Mock Daily.co API recording response with tracks."""
+    now = datetime.now(timezone.utc)
+    return [
+        RecordingResponse(
+            id="rec-123",
+            room_name="test-room-20251118120000",
+            start_ts=int((now - timedelta(hours=1)).timestamp()),
+            status="finished",
+            max_participants=2,
+            duration=3600,
+            share_token="share-token-123",
+            tracks=[
+                DailyTrack(type="audio", s3Key="track1.webm", size=1024),
+                DailyTrack(type="audio", s3Key="track2.webm", size=2048),
+            ],
+        ),
+        RecordingResponse(
+            id="rec-456",
+            room_name="test-room-20251118130000",
+            start_ts=int((now - timedelta(hours=2)).timestamp()),
+            status="finished",
+            max_participants=3,
+            duration=7200,
+            share_token="share-token-456",
+            tracks=[
+                DailyTrack(type="audio", s3Key="track1.webm", size=1024),
+            ],
+        ),
+    ]
+
+
+@pytest.fixture
+def mock_meeting():
+    """Mock meeting object."""
+    from reflector.db.meetings import Meeting
+
+    return Meeting(
+        id="meeting-123",
+        room_name="test-room-20251118120000",
+        room_url="https://daily.co/test-room",
+        host_room_url="https://daily.co/test-room",
+        start_date=datetime.now(timezone.utc),
+        end_date=datetime.now(timezone.utc) + timedelta(hours=1),
+        room_id="room-123",
+        platform="daily",
+    )
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.settings")
+@patch("reflector.worker.process.create_platform_client")
+@patch("reflector.worker.process.recordings_controller.get_by_ids")
+@patch("reflector.worker.process.meetings_controller.get_by_room_name")
+@patch("reflector.worker.process.process_multitrack_recording.delay")
+async def test_poll_daily_recordings_processes_missing_recordings(
+    mock_process_delay,
+    mock_get_meeting,
+    mock_get_recordings,
+    mock_create_client,
+    mock_settings,
+    mock_recording_response,
+    mock_meeting,
+):
+    """Test that poll_daily_recordings queues processing for recordings not in DB."""
+    mock_settings.DAILYCO_STORAGE_AWS_BUCKET_NAME = "test-bucket"
+
+    # Mock Daily.co API client
+    mock_daily_client = AsyncMock()
+    mock_daily_client.list_recordings = AsyncMock(return_value=mock_recording_response)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    # Mock DB controller - no existing recordings
+    mock_get_recordings.return_value = []
+
+    # Mock meeting exists for all recordings
+    mock_get_meeting.return_value = mock_meeting
+
+    # Execute - call the unwrapped async function
+    poll_fn = _get_poll_daily_recordings_fn()
+    await poll_fn()
+
+    # Verify Daily.co API was called without time parameters (uses default limit=100)
+    assert mock_daily_client.list_recordings.call_count == 1
+    call_kwargs = mock_daily_client.list_recordings.call_args.kwargs
+
+    # Should not have time-based parameters (uses cursor-based pagination)
+    assert "start_time" not in call_kwargs
+    assert "end_time" not in call_kwargs
+
+    # Verify processing was queued for both missing recordings
+    assert mock_process_delay.call_count == 2
+
+    # Verify the processing calls have correct parameters
+    calls = mock_process_delay.call_args_list
+    assert calls[0].kwargs["bucket_name"] == "test-bucket"
+    assert calls[0].kwargs["recording_id"] == "rec-123"
+    assert calls[0].kwargs["daily_room_name"] == "test-room-20251118120000"
+    assert calls[0].kwargs["track_keys"] == ["track1.webm", "track2.webm"]
+
+    assert calls[1].kwargs["bucket_name"] == "test-bucket"
+    assert calls[1].kwargs["recording_id"] == "rec-456"
+    assert calls[1].kwargs["daily_room_name"] == "test-room-20251118130000"
+    assert calls[1].kwargs["track_keys"] == ["track1.webm"]
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.settings")
+@patch("reflector.worker.process.create_platform_client")
+@patch("reflector.worker.process.recordings_controller.get_by_ids")
+@patch("reflector.worker.process.meetings_controller.get_by_room_name")
+@patch("reflector.worker.process.process_multitrack_recording.delay")
+async def test_poll_daily_recordings_skips_recordings_without_meeting(
+    mock_process_delay,
+    mock_get_meeting,
+    mock_get_recordings,
+    mock_create_client,
+    mock_settings,
+    mock_recording_response,
+):
+    """Test that poll_daily_recordings skips recordings without matching meeting."""
+    mock_settings.DAILYCO_STORAGE_AWS_BUCKET_NAME = "test-bucket"
+
+    # Mock Daily.co API client
+    mock_daily_client = AsyncMock()
+    mock_daily_client.list_recordings = AsyncMock(return_value=mock_recording_response)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    # Mock DB controller - no existing recordings
+    mock_get_recordings.return_value = []
+
+    # Mock no meeting found
+    mock_get_meeting.return_value = None
+
+    # Execute - call the unwrapped async function
+    poll_fn = _get_poll_daily_recordings_fn()
+    await poll_fn()
+
+    # Verify Daily.co API was called
+    assert mock_daily_client.list_recordings.call_count == 1
+
+    # Verify NO processing was queued (no matching meetings)
+    assert mock_process_delay.call_count == 0
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.settings")
+@patch("reflector.worker.process.create_platform_client")
+@patch("reflector.worker.process.recordings_controller.get_by_ids")
+@patch("reflector.worker.process.process_multitrack_recording.delay")
+async def test_poll_daily_recordings_skips_existing_recordings(
+    mock_process_delay,
+    mock_get_recordings,
+    mock_create_client,
+    mock_settings,
+    mock_recording_response,
+):
+    """Test that poll_daily_recordings skips recordings already in DB."""
+    mock_settings.DAILYCO_STORAGE_AWS_BUCKET_NAME = "test-bucket"
+
+    # Mock Daily.co API client
+    mock_daily_client = AsyncMock()
+    mock_daily_client.list_recordings = AsyncMock(return_value=mock_recording_response)
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    # Mock DB controller - all recordings already exist
+    from reflector.db.recordings import Recording
+
+    mock_get_recordings.return_value = [
+        Recording(
+            id="rec-123",
+            bucket_name="test-bucket",
+            object_key="",
+            recorded_at=datetime.now(timezone.utc),
+            meeting_id="meeting-1",
+        ),
+        Recording(
+            id="rec-456",
+            bucket_name="test-bucket",
+            object_key="",
+            recorded_at=datetime.now(timezone.utc),
+            meeting_id="meeting-1",
+        ),
+    ]
+
+    # Execute - call the unwrapped async function
+    poll_fn = _get_poll_daily_recordings_fn()
+    await poll_fn()
+
+    # Verify Daily.co API was called
+    assert mock_daily_client.list_recordings.call_count == 1
+
+    # Verify NO processing was queued (all recordings already exist)
+    assert mock_process_delay.call_count == 0
+
+
+@pytest.mark.asyncio
+@patch("reflector.worker.process.settings")
+@patch("reflector.worker.process.create_platform_client")
+async def test_poll_daily_recordings_skips_when_bucket_not_configured(
+    mock_create_client,
+    mock_settings,
+):
+    """Test that poll_daily_recordings returns early when bucket is not configured."""
+    # No bucket configured
+    mock_settings.DAILYCO_STORAGE_AWS_BUCKET_NAME = None
+
+    # Mock should not be called
+    mock_daily_client = AsyncMock()
+    mock_create_client.return_value.__aenter__ = AsyncMock(
+        return_value=mock_daily_client
+    )
+    mock_create_client.return_value.__aexit__ = AsyncMock()
+
+    # Execute - call the unwrapped async function
+    poll_fn = _get_poll_daily_recordings_fn()
+    await poll_fn()
+
+    # Verify API was never called
+    mock_daily_client.list_recordings.assert_not_called()

server/tests/test_s3_url_parser.py

@@ -0,0 +1,136 @@
+"""Tests for S3 URL parsing functionality in reflector.tools.process"""
+
+import pytest
+
+from reflector.tools.process import parse_s3_url
+
+
+class TestParseS3URL:
+    """Test cases for parse_s3_url function"""
+
+    def test_parse_s3_protocol(self):
+        """Test parsing s3:// protocol URLs"""
+        bucket, key = parse_s3_url("s3://my-bucket/path/to/file.webm")
+        assert bucket == "my-bucket"
+        assert key == "path/to/file.webm"
+
+    def test_parse_s3_protocol_deep_path(self):
+        """Test s3:// with deeply nested paths"""
+        bucket, key = parse_s3_url("s3://bucket-name/very/deep/path/to/audio.mp4")
+        assert bucket == "bucket-name"
+        assert key == "very/deep/path/to/audio.mp4"
+
+    def test_parse_https_subdomain_format(self):
+        """Test parsing https://bucket.s3.amazonaws.com/key format"""
+        bucket, key = parse_s3_url("https://my-bucket.s3.amazonaws.com/path/file.webm")
+        assert bucket == "my-bucket"
+        assert key == "path/file.webm"
+
+    def test_parse_https_regional_subdomain(self):
+        """Test parsing regional endpoint with subdomain"""
+        bucket, key = parse_s3_url(
+            "https://my-bucket.s3.us-west-2.amazonaws.com/path/file.webm"
+        )
+        assert bucket == "my-bucket"
+        assert key == "path/file.webm"
+
+    def test_parse_https_path_style(self):
+        """Test parsing https://s3.amazonaws.com/bucket/key format"""
+        bucket, key = parse_s3_url("https://s3.amazonaws.com/my-bucket/path/file.webm")
+        assert bucket == "my-bucket"
+        assert key == "path/file.webm"
+
+    def test_parse_https_regional_path_style(self):
+        """Test parsing regional endpoint with path style"""
+        bucket, key = parse_s3_url(
+            "https://s3.us-east-1.amazonaws.com/my-bucket/path/file.webm"
+        )
+        assert bucket == "my-bucket"
+        assert key == "path/file.webm"
+
+    def test_parse_url_encoded_keys(self):
+        """Test parsing URL-encoded keys"""
+        bucket, key = parse_s3_url(
+            "s3://my-bucket/path%20with%20spaces/file%2Bname.webm"
+        )
+        assert bucket == "my-bucket"
+        assert key == "path with spaces/file+name.webm"  # Should be decoded
+
+    def test_parse_url_encoded_https(self):
+        """Test URL-encoded keys with HTTPS format"""
+        bucket, key = parse_s3_url(
+            "https://my-bucket.s3.amazonaws.com/file%20with%20spaces.webm"
+        )
+        assert bucket == "my-bucket"
+        assert key == "file with spaces.webm"
+
+    def test_invalid_url_no_scheme(self):
+        """Test that URLs without scheme raise ValueError"""
+        with pytest.raises(ValueError, match="Invalid S3 URL scheme"):
+            parse_s3_url("my-bucket/path/file.webm")
+
+    def test_invalid_url_wrong_scheme(self):
+        """Test that non-S3 schemes raise ValueError"""
+        with pytest.raises(ValueError, match="Invalid S3 URL scheme"):
+            parse_s3_url("ftp://my-bucket/path/file.webm")
+
+    def test_invalid_s3_missing_bucket(self):
+        """Test s3:// URL without bucket raises ValueError"""
+        with pytest.raises(ValueError, match="missing bucket or key"):
+            parse_s3_url("s3:///path/file.webm")
+
+    def test_invalid_s3_missing_key(self):
+        """Test s3:// URL without key raises ValueError"""
+        with pytest.raises(ValueError, match="missing bucket or key"):
+            parse_s3_url("s3://my-bucket/")
+
+    def test_invalid_s3_empty_key(self):
+        """Test s3:// URL with empty key raises ValueError"""
+        with pytest.raises(ValueError, match="missing bucket or key"):
+            parse_s3_url("s3://my-bucket")
+
+    def test_invalid_https_not_s3(self):
+        """Test HTTPS URL that's not S3 raises ValueError"""
+        with pytest.raises(ValueError, match="not recognized as S3 URL"):
+            parse_s3_url("https://example.com/path/file.webm")
+
+    def test_invalid_https_subdomain_missing_key(self):
+        """Test HTTPS subdomain format without key raises ValueError"""
+        with pytest.raises(ValueError, match="missing bucket or key"):
+            parse_s3_url("https://my-bucket.s3.amazonaws.com/")
+
+    def test_invalid_https_path_style_missing_parts(self):
+        """Test HTTPS path style with missing bucket/key raises ValueError"""
+        with pytest.raises(ValueError, match="missing bucket or key"):
+            parse_s3_url("https://s3.amazonaws.com/")
+
+    def test_bucket_with_dots(self):
+        """Test parsing bucket names with dots"""
+        bucket, key = parse_s3_url("s3://my.bucket.name/path/file.webm")
+        assert bucket == "my.bucket.name"
+        assert key == "path/file.webm"
+
+    def test_bucket_with_hyphens(self):
+        """Test parsing bucket names with hyphens"""
+        bucket, key = parse_s3_url("s3://my-bucket-name-123/path/file.webm")
+        assert bucket == "my-bucket-name-123"
+        assert key == "path/file.webm"
+
+    def test_key_with_special_chars(self):
+        """Test keys with various special characters"""
+        # Note: # is treated as URL fragment separator, not part of key
+        bucket, key = parse_s3_url("s3://bucket/2024-01-01_12:00:00/file.webm")
+        assert bucket == "bucket"
+        assert key == "2024-01-01_12:00:00/file.webm"
+
+    def test_fragment_handling(self):
+        """Test that URL fragments are properly ignored"""
+        bucket, key = parse_s3_url("s3://bucket/path/to/file.webm#fragment123")
+        assert bucket == "bucket"
+        assert key == "path/to/file.webm"  # Fragment not included
+
+    def test_http_scheme_s3_url(self):
+        """Test that HTTP (not HTTPS) S3 URLs are supported"""
+        bucket, key = parse_s3_url("http://my-bucket.s3.amazonaws.com/path/file.webm")
+        assert bucket == "my-bucket"
+        assert key == "path/file.webm"

server/tests/test_transcripts_process.py

@@ -1,5 +1,6 @@
 import asyncio
 import time
+from unittest.mock import patch
 
 import pytest
 from httpx import ASGITransport, AsyncClient
@@ -101,3 +102,113 @@ async def test_transcript_process(
     assert response.status_code == 200
     assert len(response.json()) == 1
     assert "Hello world. How are you today?" in response.json()[0]["transcript"]
+
+
+@pytest.mark.usefixtures("setup_database")
+@pytest.mark.asyncio
+async def test_whereby_recording_uses_file_pipeline(client):
+    """Test that Whereby recordings (bucket_name but no track_keys) use file pipeline"""
+    from datetime import datetime, timezone
+
+    from reflector.db.recordings import Recording, recordings_controller
+    from reflector.db.transcripts import transcripts_controller
+
+    # Create transcript with Whereby recording (has bucket_name, no track_keys)
+    transcript = await transcripts_controller.add(
+        "",
+        source_kind="room",
+        source_language="en",
+        target_language="en",
+        user_id="test-user",
+        share_mode="public",
+    )
+
+    recording = await recordings_controller.create(
+        Recording(
+            bucket_name="whereby-bucket",
+            object_key="test-recording.mp4",  # gitleaks:allow
+            meeting_id="test-meeting",
+            recorded_at=datetime.now(timezone.utc),
+            track_keys=None,  # Whereby recordings have no track_keys
+        )
+    )
+
+    await transcripts_controller.update(
+        transcript, {"recording_id": recording.id, "status": "uploaded"}
+    )
+
+    with (
+        patch(
+            "reflector.services.transcript_process.task_pipeline_file_process"
+        ) as mock_file_pipeline,
+        patch(
+            "reflector.services.transcript_process.task_pipeline_multitrack_process"
+        ) as mock_multitrack_pipeline,
+    ):
+        response = await client.post(f"/transcripts/{transcript.id}/process")
+
+        assert response.status_code == 200
+        assert response.json()["status"] == "ok"
+
+        # Whereby recordings should use file pipeline
+        mock_file_pipeline.delay.assert_called_once_with(transcript_id=transcript.id)
+        mock_multitrack_pipeline.delay.assert_not_called()
+
+
+@pytest.mark.usefixtures("setup_database")
+@pytest.mark.asyncio
+async def test_dailyco_recording_uses_multitrack_pipeline(client):
+    """Test that Daily.co recordings (bucket_name + track_keys) use multitrack pipeline"""
+    from datetime import datetime, timezone
+
+    from reflector.db.recordings import Recording, recordings_controller
+    from reflector.db.transcripts import transcripts_controller
+
+    # Create transcript with Daily.co multitrack recording
+    transcript = await transcripts_controller.add(
+        "",
+        source_kind="room",
+        source_language="en",
+        target_language="en",
+        user_id="test-user",
+        share_mode="public",
+    )
+
+    track_keys = [
+        "recordings/test-room/track1.webm",
+        "recordings/test-room/track2.webm",
+    ]
+    recording = await recordings_controller.create(
+        Recording(
+            bucket_name="daily-bucket",
+            object_key="recordings/test-room",
+            meeting_id="test-meeting",
+            track_keys=track_keys,
+            recorded_at=datetime.now(timezone.utc),
+        )
+    )
+
+    await transcripts_controller.update(
+        transcript, {"recording_id": recording.id, "status": "uploaded"}
+    )
+
+    with (
+        patch(
+            "reflector.services.transcript_process.task_pipeline_file_process"
+        ) as mock_file_pipeline,
+        patch(
+            "reflector.services.transcript_process.task_pipeline_multitrack_process"
+        ) as mock_multitrack_pipeline,
+    ):
+        response = await client.post(f"/transcripts/{transcript.id}/process")
+
+        assert response.status_code == 200
+        assert response.json()["status"] == "ok"
+
+        # Daily.co multitrack recordings should use multitrack pipeline
+        mock_multitrack_pipeline.delay.assert_called_once_with(
+            transcript_id=transcript.id,
+            bucket_name="daily-bucket",
+            track_keys=track_keys,
+        )
+        mock_file_pipeline.delay.assert_not_called()

server/tests/test_user_websocket_auth.py

@@ -120,7 +120,15 @@ async def test_user_ws_accepts_valid_token_and_receives_events(appserver_ws_user
     host, port = appserver_ws_user
     base_ws = f"http://{host}:{port}/v1/events"
 
-    token = _make_dummy_jwt("user-abc")
+    # Create a test user in the database
+    from reflector.db.users import user_controller
+
+    test_uid = "user-abc"
+    user = await user_controller.create_or_update(
+        id="test-user-id-abc", authentik_uid=test_uid, email="user-abc@example.com"
+    )
+
+    token = _make_dummy_jwt(test_uid)
     subprotocols = ["bearer", token]
 
     # Connect and then trigger an event via HTTP create
@@ -132,12 +140,13 @@ async def test_user_ws_accepts_valid_token_and_receives_events(appserver_ws_user
         from reflector.auth import current_user, current_user_optional
 
         # Override auth dependencies so HTTP request is performed as the same user
+        # Use the internal user.id (not the Authentik UID)
         app.dependency_overrides[current_user] = lambda: {
-            "sub": "user-abc",
+            "sub": user.id,
             "email": "user-abc@example.com",
         }
         app.dependency_overrides[current_user_optional] = lambda: {
-            "sub": "user-abc",
+            "sub": user.id,
             "email": "user-abc@example.com",
         }
 

server/tests/test_utils_daily.py

@@ -1,6 +1,6 @@
 import pytest
 
-from reflector.utils.daily import extract_base_room_name
+from reflector.utils.daily import extract_base_room_name, parse_daily_recording_filename
 
 
 @pytest.mark.parametrize(
@@ -15,3 +15,50 @@ from reflector.utils.daily import extract_base_room_name
 )
 def test_extract_base_room_name(daily_room_name, expected):
     assert extract_base_room_name(daily_room_name) == expected
+
+
+@pytest.mark.parametrize(
+    "filename,expected_recording_ts,expected_participant_id,expected_track_ts",
+    [
+        (
+            "1763152299562-12f0b87c-97d4-4dd3-a65c-cee1f854a79c-cam-audio-1763152314582",
+            1763152299562,
+            "12f0b87c-97d4-4dd3-a65c-cee1f854a79c",
+            1763152314582,
+        ),
+        (
+            "1760988935484-52f7f48b-fbab-431f-9a50-87b9abfc8255-cam-audio-1760988935922",
+            1760988935484,
+            "52f7f48b-fbab-431f-9a50-87b9abfc8255",
+            1760988935922,
+        ),
+        (
+            "1760988935484-a37c35e3-6f8e-4274-a482-e9d0f102a732-cam-audio-1760988943823",
+            1760988935484,
+            "a37c35e3-6f8e-4274-a482-e9d0f102a732",
+            1760988943823,
+        ),
+        (
+            "path/to/1763151171834-b6719a43-4481-483a-a8fc-2ae18b69283c-cam-audio-1763151180561",
+            1763151171834,
+            "b6719a43-4481-483a-a8fc-2ae18b69283c",
+            1763151180561,
+        ),
+    ],
+)
+def test_parse_daily_recording_filename(
+    filename, expected_recording_ts, expected_participant_id, expected_track_ts
+):
+    result = parse_daily_recording_filename(filename)
+
+    assert result.recording_start_ts == expected_recording_ts
+    assert result.participant_id == expected_participant_id
+    assert result.track_start_ts == expected_track_ts
+
+
+def test_parse_daily_recording_filename_invalid():
+    with pytest.raises(ValueError, match="Invalid Daily.co recording filename"):
+        parse_daily_recording_filename("invalid-filename")
+
+    with pytest.raises(ValueError, match="Invalid Daily.co recording filename"):
+        parse_daily_recording_filename("123-not-a-uuid-cam-audio-456")

server/tests/test_video_platforms_factory.py

@@ -1,58 +0,0 @@
-"""Tests for video_platforms.factory module."""
-
-from unittest.mock import patch
-
-from reflector.video_platforms.factory import get_platform
-
-
-class TestGetPlatformF:
-    """Test suite for get_platform function."""
-
-    @patch("reflector.video_platforms.factory.settings")
-    def test_with_room_platform(self, mock_settings):
-        """When room_platform provided, should return room_platform."""
-        mock_settings.DEFAULT_VIDEO_PLATFORM = "whereby"
-
-        # Should return the room's platform when provided
-        assert get_platform(room_platform="daily") == "daily"
-        assert get_platform(room_platform="whereby") == "whereby"
-
-    @patch("reflector.video_platforms.factory.settings")
-    def test_without_room_platform_uses_default(self, mock_settings):
-        """When no room_platform, should return DEFAULT_VIDEO_PLATFORM."""
-        mock_settings.DEFAULT_VIDEO_PLATFORM = "whereby"
-
-        # Should return default when room_platform is None
-        assert get_platform(room_platform=None) == "whereby"
-
-    @patch("reflector.video_platforms.factory.settings")
-    def test_with_daily_default(self, mock_settings):
-        """When DEFAULT_VIDEO_PLATFORM is 'daily', should return 'daily' when no room_platform."""
-        mock_settings.DEFAULT_VIDEO_PLATFORM = "daily"
-
-        # Should return default 'daily' when room_platform is None
-        assert get_platform(room_platform=None) == "daily"
-
-    @patch("reflector.video_platforms.factory.settings")
-    def test_no_room_id_provided(self, mock_settings):
-        """Should work correctly even when room_id is not provided."""
-        mock_settings.DEFAULT_VIDEO_PLATFORM = "whereby"
-
-        # Should use room_platform when provided
-        assert get_platform(room_platform="daily") == "daily"
-
-        # Should use default when room_platform not provided
-        assert get_platform(room_platform=None) == "whereby"
-
-    @patch("reflector.video_platforms.factory.settings")
-    def test_room_platform_always_takes_precedence(self, mock_settings):
-        """room_platform should always be used when provided."""
-        mock_settings.DEFAULT_VIDEO_PLATFORM = "whereby"
-
-        # room_platform should take precedence over default
-        assert get_platform(room_platform="daily") == "daily"
-        assert get_platform(room_platform="whereby") == "whereby"
-
-        # Different default shouldn't matter when room_platform provided
-        mock_settings.DEFAULT_VIDEO_PLATFORM = "daily"
-        assert get_platform(room_platform="whereby") == "whereby"

www/.env.example

@@ -22,9 +22,10 @@ AUTHENTIK_CLIENT_SECRET=your-client-secret-here
 
 # API URLs
 API_URL=http://127.0.0.1:1250
+SERVER_API_URL=http://server:1250
 WEBSOCKET_URL=ws://127.0.0.1:1250
 AUTH_CALLBACK_URL=http://localhost:3000/auth-callback
 
 # Sentry
 # SENTRY_DSN=https://your-dsn@sentry.io/project-id
-# SENTRY_IGNORE_API_RESOLUTION_ERROR=1
+# SENTRY_IGNORE_API_RESOLUTION_ERROR=1

www/app/(app)/transcripts/[transcriptId]/page.tsx

@@ -10,7 +10,15 @@ import FinalSummary from "./finalSummary";
 import TranscriptTitle from "../transcriptTitle";
 import Player from "../player";
 import { useRouter } from "next/navigation";
-import { Box, Flex, Grid, GridItem, Skeleton, Text } from "@chakra-ui/react";
+import {
+  Box,
+  Flex,
+  Grid,
+  GridItem,
+  Skeleton,
+  Text,
+  Spinner,
+} from "@chakra-ui/react";
 import { useTranscriptGet } from "../../../lib/apiHooks";
 import { TranscriptStatus } from "../../../lib/transcript";
 
@@ -28,6 +36,7 @@ export default function TranscriptDetails(details: TranscriptDetails) {
     "idle",
     "recording",
     "processing",
+    "uploaded",
   ] satisfies TranscriptStatus[] as TranscriptStatus[];
 
   const transcript = useTranscriptGet(transcriptId);
@@ -45,15 +54,55 @@ export default function TranscriptDetails(details: TranscriptDetails) {
     useState<HTMLDivElement | null>(null);
 
   useEffect(() => {
-    if (waiting) {
-      const newUrl = "/transcripts/" + params.transcriptId + "/record";
+    if (!waiting || !transcript.data) return;
+
+    const status = transcript.data.status;
+    let newUrl: string | null = null;
+
+    if (status === "processing" || status === "uploaded") {
+      newUrl = `/transcripts/${params.transcriptId}/processing`;
+    } else if (status === "recording") {
+      newUrl = `/transcripts/${params.transcriptId}/record`;
+    } else if (status === "idle") {
+      newUrl =
+        transcript.data.source_kind === "file"
+          ? `/transcripts/${params.transcriptId}/upload`
+          : `/transcripts/${params.transcriptId}/record`;
+    }
+
+    if (newUrl) {
       // Shallow redirection does not work on NextJS 13
       // https://github.com/vercel/next.js/discussions/48110
       // https://github.com/vercel/next.js/discussions/49540
       router.replace(newUrl);
-      // history.replaceState({}, "", newUrl);
     }
-  }, [waiting]);
+  }, [waiting, transcript.data?.status, transcript.data?.source_kind]);
+
+  if (waiting) {
+    return (
+      <Box>
+        <Box
+          w="full"
+          background="gray.bg"
+          border={"2px solid"}
+          borderColor={"gray.bg"}
+          borderRadius={8}
+          p={6}
+          minH="100%"
+          display="flex"
+          alignItems="center"
+          justifyContent="center"
+        >
+          <Flex direction="column" align="center" gap={3}>
+            <Spinner size="xl" color="blue.500" />
+            <Text color="gray.600" textAlign="center">
+              Loading transcript...
+            </Text>
+          </Flex>
+        </Box>
+      </Box>
+    );
+  }
 
   if (transcript.error || topics?.error) {
     return (

www/app/(app)/transcripts/[transcriptId]/processing/page.tsx

@@ -0,0 +1,97 @@
+"use client";
+import { useEffect, use } from "react";
+import {
+  Heading,
+  Text,
+  VStack,
+  Spinner,
+  Button,
+  Center,
+} from "@chakra-ui/react";
+import { useRouter } from "next/navigation";
+import { useTranscriptGet } from "../../../../lib/apiHooks";
+
+type TranscriptProcessing = {
+  params: Promise<{
+    transcriptId: string;
+  }>;
+};
+
+export default function TranscriptProcessing(details: TranscriptProcessing) {
+  const params = use(details.params);
+  const transcriptId = params.transcriptId;
+  const router = useRouter();
+
+  const transcript = useTranscriptGet(transcriptId);
+
+  useEffect(() => {
+    const status = transcript.data?.status;
+    if (!status) return;
+
+    if (status === "ended" || status === "error") {
+      router.replace(`/transcripts/${transcriptId}`);
+    } else if (status === "recording") {
+      router.replace(`/transcripts/${transcriptId}/record`);
+    } else if (status === "idle") {
+      const dest =
+        transcript.data?.source_kind === "file"
+          ? `/transcripts/${transcriptId}/upload`
+          : `/transcripts/${transcriptId}/record`;
+      router.replace(dest);
+    }
+  }, [
+    transcript.data?.status,
+    transcript.data?.source_kind,
+    router,
+    transcriptId,
+  ]);
+
+  if (transcript.isLoading) {
+    return (
+      <VStack align="center" py={8}>
+        <Heading size="lg">Loading transcript...</Heading>
+      </VStack>
+    );
+  }
+
+  if (transcript.error) {
+    return (
+      <VStack align="center" py={8}>
+        <Heading size="lg">Transcript not found</Heading>
+        <Text>We couldn't load this transcript.</Text>
+      </VStack>
+    );
+  }
+
+  return (
+    <>
+      <VStack
+        align={"left"}
+        minH="100vh"
+        pt={4}
+        mx="auto"
+        w={{ base: "full", md: "container.xl" }}
+      >
+        <Center h={"full"} w="full">
+          <VStack gap={10} bg="gray.100" p={10} borderRadius="md" maxW="500px">
+            <Spinner size="xl" color="blue.500" />
+            <Heading size={"md"} textAlign="center">
+              Processing recording
+            </Heading>
+            <Text color="gray.600" textAlign="center">
+              You can safely return to the library while your recording is being
+              processed.
+            </Text>
+            <Button
+              onClick={() => {
+                router.push("/browse");
+              }}
+            >
+              Browse
+            </Button>
+          </VStack>
+        </Center>
+      </VStack>
+    </>
+  );
+}

www/app/(app)/transcripts/[transcriptId]/upload/page.tsx

@@ -4,7 +4,7 @@ import { useWebSockets } from "../../useWebSockets";
 import { lockWakeState, releaseWakeState } from "../../../../lib/wakeLock";
 import { useRouter } from "next/navigation";
 import useMp3 from "../../useMp3";
-import { Center, VStack, Text, Heading, Button } from "@chakra-ui/react";
+import { Center, VStack, Text, Heading } from "@chakra-ui/react";
 import FileUploadButton from "../../fileUploadButton";
 import { useTranscriptGet } from "../../../../lib/apiHooks";
 
@@ -53,6 +53,12 @@ const TranscriptUpload = (details: TranscriptUpload) => {
 
       const newUrl = "/transcripts/" + params.transcriptId;
       router.replace(newUrl);
+    } else if (
+      newStatus &&
+      (newStatus == "uploaded" || newStatus == "processing")
+    ) {
+      // After upload finishes (or if already processing), redirect to the unified processing page
+      router.replace(`/transcripts/${params.transcriptId}/processing`);
     }
   }, [webSockets.status?.value, transcript.data?.status]);
 
@@ -71,7 +77,7 @@ const TranscriptUpload = (details: TranscriptUpload) => {
     <>
       <VStack
         align={"left"}
-        h="full"
+        minH="100vh"
         pt={4}
         mx="auto"
         w={{ base: "full", md: "container.xl" }}
@@ -79,34 +85,16 @@ const TranscriptUpload = (details: TranscriptUpload) => {
         <Heading size={"lg"}>Upload meeting</Heading>
         <Center h={"full"} w="full">
           <VStack gap={10} bg="gray.100" p={10} borderRadius="md" maxW="500px">
-            {status && status == "idle" && (
-              <>
-                <Text>
-                  Please select the file, supported formats: .mp3, m4a, .wav,
-                  .mp4, .mov or .webm
-                </Text>
-                <FileUploadButton transcriptId={params.transcriptId} />
-              </>
-            )}
-            {status && status == "uploaded" && (
-              <Text>File is uploaded, processing...</Text>
-            )}
-            {(status == "recording" || status == "processing") && (
-              <>
-                <Heading size={"lg"}>Processing your recording...</Heading>
-                <Text>
-                  You can safely return to the library while your file is being
-                  processed.
-                </Text>
-                <Button
-                  onClick={() => {
-                    router.push("/browse");
-                  }}
-                >
-                  Browse
-                </Button>
-              </>
-            )}
+            <Text>
+              Please select the file, supported formats: .mp3, m4a, .wav, .mp4,
+              .mov or .webm
+            </Text>
+            <FileUploadButton
+              transcriptId={params.transcriptId}
+              onUploadComplete={() =>
+                router.replace(`/transcripts/${params.transcriptId}/processing`)
+              }
+            />
           </VStack>
         </Center>
       </VStack>

www/app/(app)/transcripts/buildTranscriptWithTopics.ts

@@ -0,0 +1,60 @@
+import type { components } from "../../reflector-api";
+import { formatTime } from "../../lib/time";
+
+type GetTranscriptTopic = components["schemas"]["GetTranscriptTopic"];
+type Participant = components["schemas"]["Participant"];
+
+function getSpeakerName(
+  speakerNumber: number,
+  participants?: Participant[] | null,
+): string {
+  const name = participants?.find((p) => p.speaker === speakerNumber)?.name;
+  return name && name.trim().length > 0 ? name : `Speaker ${speakerNumber}`;
+}
+
+export function buildTranscriptWithTopics(
+  topics: GetTranscriptTopic[],
+  participants?: Participant[] | null,
+  transcriptTitle?: string | null,
+): string {
+  const blocks: string[] = [];
+
+  if (transcriptTitle && transcriptTitle.trim()) {
+    blocks.push(`# ${transcriptTitle.trim()}`);
+    blocks.push("");
+  }
+
+  for (const topic of topics) {
+    // Topic header
+    const topicTime = formatTime(Math.floor(topic.timestamp || 0));
+    const title = topic.title?.trim() || "Untitled Topic";
+    blocks.push(`## ${title} [${topicTime}]`);
+
+    if (topic.segments && topic.segments.length > 0) {
+      for (const seg of topic.segments) {
+        const ts = formatTime(Math.floor(seg.start || 0));
+        const speaker = getSpeakerName(seg.speaker as number, participants);
+        const text = (seg.text || "").replace(/\s+/g, " ").trim();
+        if (text) {
+          blocks.push(`[${ts}] ${speaker}: ${text}`);
+        }
+      }
+    } else if (topic.transcript) {
+      // Fallback: plain transcript when segments are not present
+      const text = topic.transcript.replace(/\s+/g, " ").trim();
+      if (text) {
+        blocks.push(text);
+      }
+    }
+
+    // Blank line between topics
+    blocks.push("");
+  }
+
+  // Trim trailing blank line
+  while (blocks.length > 0 && blocks[blocks.length - 1] === "") {
+    blocks.pop();
+  }
+
+  return blocks.join("\n");
+}

www/app/(app)/transcripts/fileUploadButton.tsx

@@ -5,6 +5,7 @@ import { useError } from "../../(errors)/errorContext";
 
 type FileUploadButton = {
   transcriptId: string;
+  onUploadComplete?: () => void;
 };
 
 export default function FileUploadButton(props: FileUploadButton) {
@@ -31,6 +32,7 @@ export default function FileUploadButton(props: FileUploadButton) {
       const uploadNextChunk = async () => {
         if (chunkNumber == totalChunks) {
           setProgress(0);
+          props.onUploadComplete?.();
           return;
         }
 

www/app/(app)/transcripts/shareCopy.tsx

@@ -3,6 +3,8 @@ import type { components } from "../../reflector-api";
 type GetTranscript = components["schemas"]["GetTranscript"];
 type GetTranscriptTopic = components["schemas"]["GetTranscriptTopic"];
 import { Button, BoxProps, Box } from "@chakra-ui/react";
+import { buildTranscriptWithTopics } from "./buildTranscriptWithTopics";
+import { useTranscriptParticipants } from "../../lib/apiHooks";
 
 type ShareCopyProps = {
   finalSummaryElement: HTMLDivElement | null;
@@ -18,6 +20,7 @@ export default function ShareCopy({
 }: ShareCopyProps & BoxProps) {
   const [isCopiedSummary, setIsCopiedSummary] = useState(false);
   const [isCopiedTranscript, setIsCopiedTranscript] = useState(false);
+  const participantsQuery = useTranscriptParticipants(transcript?.id || null);
 
   const onCopySummaryClick = () => {
     const text_to_copy = finalSummaryElement?.innerText;
@@ -32,12 +35,12 @@ export default function ShareCopy({
   };
 
   const onCopyTranscriptClick = () => {
-    let text_to_copy =
-      topics
-        ?.map((topic) => topic.transcript)
-        .join("\n\n")
-        .replace(/ +/g, " ")
-        .trim() || "";
+    const text_to_copy =
+      buildTranscriptWithTopics(
+        topics || [],
+        participantsQuery?.data || null,
+        transcript?.title || null,
+      ) || "";
 
     text_to_copy &&
       navigator.clipboard.writeText(text_to_copy).then(() => {

www/app/(app)/transcripts/transcriptTitle.tsx

@@ -4,10 +4,15 @@ import type { components } from "../../reflector-api";
 type UpdateTranscript = components["schemas"]["UpdateTranscript"];
 type GetTranscript = components["schemas"]["GetTranscript"];
 type GetTranscriptTopic = components["schemas"]["GetTranscriptTopic"];
-import { useTranscriptUpdate } from "../../lib/apiHooks";
+import {
+  useTranscriptUpdate,
+  useTranscriptParticipants,
+} from "../../lib/apiHooks";
 import { Heading, IconButton, Input, Flex, Spacer } from "@chakra-ui/react";
-import { LuPen } from "react-icons/lu";
+import { LuPen, LuCopy, LuCheck } from "react-icons/lu";
 import ShareAndPrivacy from "./shareAndPrivacy";
+import { buildTranscriptWithTopics } from "./buildTranscriptWithTopics";
+import { toaster } from "../../components/ui/toaster";
 
 type TranscriptTitle = {
   title: string;
@@ -25,6 +30,9 @@ const TranscriptTitle = (props: TranscriptTitle) => {
   const [preEditTitle, setPreEditTitle] = useState(props.title);
   const [isEditing, setIsEditing] = useState(false);
   const updateTranscriptMutation = useTranscriptUpdate();
+  const participantsQuery = useTranscriptParticipants(
+    props.transcript?.id || null,
+  );
 
   const updateTitle = async (newTitle: string, transcriptId: string) => {
     try {
@@ -118,11 +126,57 @@ const TranscriptTitle = (props: TranscriptTitle) => {
             <LuPen />
           </IconButton>
           {props.transcript && props.topics && (
-            <ShareAndPrivacy
-              finalSummaryElement={props.finalSummaryElement}
-              transcript={props.transcript}
-              topics={props.topics}
-            />
+            <>
+              <IconButton
+                aria-label="Copy Transcript"
+                size="sm"
+                variant="subtle"
+                onClick={() => {
+                  const text = buildTranscriptWithTopics(
+                    props.topics || [],
+                    participantsQuery?.data || null,
+                    props.transcript?.title || null,
+                  );
+                  if (!text) return;
+                  navigator.clipboard
+                    .writeText(text)
+                    .then(() => {
+                      toaster
+                        .create({
+                          placement: "top",
+                          duration: 2500,
+                          render: () => (
+                            <div className="chakra-ui-light">
+                              <div
+                                style={{
+                                  background: "#38A169",
+                                  color: "white",
+                                  padding: "8px 12px",
+                                  borderRadius: 6,
+                                  display: "flex",
+                                  alignItems: "center",
+                                  gap: 8,
+                                  boxShadow: "rgba(0,0,0,0.25) 0px 4px 12px",
+                                }}
+                              >
+                                <LuCheck /> Transcript copied
+                              </div>
+                            </div>
+                          ),
+                        })
+                        .then(() => {});
+                    })
+                    .catch(() => {});
+                }}
+              >
+                <LuCopy />
+              </IconButton>
+              <ShareAndPrivacy
+                finalSummaryElement={props.finalSummaryElement}
+                transcript={props.transcript}
+                topics={props.topics}
+              />
+            </>
           )}
         </Flex>
       )}

www/app/[roomName]/components/DailyRoom.tsx

@@ -1,8 +1,8 @@
 "use client";
 
-import { useCallback, useEffect, useRef } from "react";
-import { Box } from "@chakra-ui/react";
-import { useRouter } from "next/navigation";
+import { useCallback, useEffect, useRef, useState } from "react";
+import { Box, Spinner, Center, Text } from "@chakra-ui/react";
+import { useRouter, useParams } from "next/navigation";
 import DailyIframe, { DailyCall } from "@daily-co/daily-js";
 import type { components } from "../../reflector-api";
 import { useAuth } from "../../lib/AuthProvider";
@@ -10,6 +10,7 @@ import {
   ConsentDialogButton,
   recordingTypeRequiresConsent,
 } from "../../lib/consent";
+import { useRoomJoinMeeting } from "../../lib/apiHooks";
 
 type Meeting = components["schemas"]["Meeting"];
 
@@ -19,13 +20,41 @@ interface DailyRoomProps {
 
 export default function DailyRoom({ meeting }: DailyRoomProps) {
   const router = useRouter();
+  const params = useParams();
   const auth = useAuth();
   const status = auth.status;
   const containerRef = useRef<HTMLDivElement>(null);
+  const joinMutation = useRoomJoinMeeting();
+  const [joinedMeeting, setJoinedMeeting] = useState<Meeting | null>(null);
 
-  const roomUrl = meeting?.host_room_url || meeting?.room_url;
+  const roomName = params?.roomName as string;
 
-  const isLoading = status === "loading";
+  // Always call /join to get a fresh token with user_id
+  useEffect(() => {
+    if (status === "loading" || !meeting?.id || !roomName) return;
+
+    const join = async () => {
+      try {
+        const result = await joinMutation.mutateAsync({
+          params: {
+            path: {
+              room_name: roomName,
+              meeting_id: meeting.id,
+            },
+          },
+        });
+        setJoinedMeeting(result);
+      } catch (error) {
+        console.error("Failed to join meeting:", error);
+      }
+    };
+
+    join();
+  }, [meeting?.id, roomName, status]);
+
+  const roomUrl = joinedMeeting?.host_room_url || joinedMeeting?.room_url;
+  const isLoading =
+    status === "loading" || joinMutation.isPending || !joinedMeeting;
 
   const handleLeave = useCallback(() => {
     router.push("/browse");
@@ -60,6 +89,15 @@ export default function DailyRoom({ meeting }: DailyRoomProps) {
         }
 
         frame.on("left-meeting", handleLeave);
+
+        frame.on("joined-meeting", async () => {
+          try {
+            await frame.startRecording({ type: "raw-tracks" });
+          } catch (error) {
+            console.error("Failed to start recording:", error);
+          }
+        });
+
         await frame.join({ url: roomUrl });
       } catch (error) {
         console.error("Error creating Daily frame:", error);
@@ -78,6 +116,22 @@ export default function DailyRoom({ meeting }: DailyRoomProps) {
     };
   }, [roomUrl, isLoading, handleLeave]);
 
+  if (isLoading) {
+    return (
+      <Center width="100vw" height="100vh">
+        <Spinner size="xl" />
+      </Center>
+    );
+  }
+
+  if (joinMutation.isError) {
+    return (
+      <Center width="100vw" height="100vh">
+        <Text color="red.500">Failed to join meeting. Please try again.</Text>
+      </Center>
+    );
+  }
+
   if (!roomUrl) {
     return null;
   }

www/app/lib/authBackend.ts

@@ -22,6 +22,27 @@ import { sequenceThrows } from "./errorUtils";
 import { featureEnabled } from "./features";
 import { getNextEnvVar } from "./nextBuild";
 
+async function getUserId(accessToken: string): Promise<string | null> {
+  try {
+    const apiUrl = getNextEnvVar("SERVER_API_URL");
+    const response = await fetch(`${apiUrl}/v1/me`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+      },
+    });
+
+    if (!response.ok) {
+      return null;
+    }
+
+    const userInfo = await response.json();
+    return userInfo.sub || null;
+  } catch (error) {
+    console.error("Error fetching user ID from backend:", error);
+    return null;
+  }
+}
+
 const TOKEN_CACHE_TTL = REFRESH_ACCESS_TOKEN_BEFORE;
 const getAuthentikClientId = () => getNextEnvVar("AUTHENTIK_CLIENT_ID");
 const getAuthentikClientSecret = () => getNextEnvVar("AUTHENTIK_CLIENT_SECRET");
@@ -122,13 +143,16 @@ export const authOptions = (): AuthOptions =>
           },
           async session({ session, token }) {
             const extendedToken = token as JWTWithAccessToken;
+
+            const userId = await getUserId(extendedToken.accessToken);
+
             return {
               ...session,
               accessToken: extendedToken.accessToken,
               accessTokenExpires: extendedToken.accessTokenExpires,
               error: extendedToken.error,
               user: {
-                id: assertExists(extendedToken.sub),
+                id: assertExistsAndNonEmptyString(userId, "User ID required"),
                 name: extendedToken.name,
                 email: extendedToken.email,
               },