doorkeeper 4.4.3 → 5.0.3

data/app/controllers/doorkeeper/applications_controller.rb

@@ -1,24 +1,27 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class ApplicationsController < Doorkeeper::ApplicationController
-    layout 'doorkeeper/admin'
+    layout 'doorkeeper/admin' unless Doorkeeper.configuration.api_only
 
     before_action :authenticate_admin!
-    before_action :set_application, only: [:show, :edit, :update, :destroy]
+    before_action :set_application, only: %i[show edit update destroy]
 
     def index
-      @applications = if Application.respond_to?(:ordered_by)
-                        Application.ordered_by(:created_at)
-                      else
-                        ActiveSupport::Deprecation.warn <<-MSG.squish
-                          Doorkeeper #{Doorkeeper.configuration.orm} extension must implement #ordered_by
-                          method for it's models as it will be used by default in Doorkeeper 5.
-                        MSG
-
-                        Application.all
-                      end
+      @applications = Application.ordered_by(:created_at)
+
+      respond_to do |format|
+        format.html
+        format.json { head :no_content }
+      end
     end
 
-    def show; end
+    def show
+      respond_to do |format|
+        format.html
+        format.json { render json: @application, as_owner: true }
+      end
+    end
 
     def new
       @application = Application.new
@@ -26,28 +29,47 @@ module Doorkeeper
 
     def create
       @application = Application.new(application_params)
+
       if @application.save
-        flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :create])
-        redirect_to oauth_application_url(@application)
+        flash[:notice] = I18n.t(:notice, scope: %i[doorkeeper flash applications create])
+
+        respond_to do |format|
+          format.html { redirect_to oauth_application_url(@application) }
+          format.json { render json: @application, as_owner: true }
+        end
       else
-        render :new
+        respond_to do |format|
+          format.html { render :new }
+          format.json { render json: { errors: @application.errors.full_messages }, status: :unprocessable_entity }
+        end
       end
     end
 
     def edit; end
 
     def update
-      if @application.update_attributes(application_params)
-        flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :update])
-        redirect_to oauth_application_url(@application)
+      if @application.update(application_params)
+        flash[:notice] = I18n.t(:notice, scope: %i[doorkeeper flash applications update])
+
+        respond_to do |format|
+          format.html { redirect_to oauth_application_url(@application) }
+          format.json { render json: @application, as_owner: true }
+        end
       else
-        render :edit
+        respond_to do |format|
+          format.html { render :edit }
+          format.json { render json: { errors: @application.errors.full_messages }, status: :unprocessable_entity }
+        end
       end
     end
 
     def destroy
-      flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :destroy]) if @application.destroy
-      redirect_to oauth_applications_url
+      flash[:notice] = I18n.t(:notice, scope: %i[doorkeeper flash applications destroy]) if @application.destroy
+
+      respond_to do |format|
+        format.html { redirect_to oauth_applications_url }
+        format.json { head :no_content }
+      end
     end
 
     private
@@ -57,8 +79,8 @@ module Doorkeeper
     end
 
     def application_params
-      params.require(:doorkeeper_application).
-        permit(:name, :redirect_uri, :scopes, :confidential)
+      params.require(:doorkeeper_application)
+        .permit(:name, :redirect_uri, :scopes, :confidential)
     end
   end
 end

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -1,23 +1,20 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AuthorizationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
 
     def new
       if pre_auth.authorizable?
-        if skip_authorization? || matching_token?
-          auth = authorization.authorize
-          redirect_to auth.redirect_uri
-        else
-          render :new
-        end
+        render_success
       else
-        render :error
+        render_error
       end
     end
 
     # TODO: Handle raise invalid authorization
     def create
-      redirect_or_render authorization.authorize
+      redirect_or_render authorize_response
     end
 
     def destroy
@@ -26,15 +23,43 @@ module Doorkeeper
 
     private
 
+    def render_success
+      if skip_authorization? || matching_token?
+        redirect_or_render authorize_response
+      elsif Doorkeeper.configuration.api_only
+        render json: pre_auth
+      else
+        render :new
+      end
+    end
+
+    def render_error
+      if Doorkeeper.configuration.api_only
+        render json: pre_auth.error_response.body,
+               status: :bad_request
+      else
+        render :error
+      end
+    end
+
     def matching_token?
-      AccessToken.matching_token_for pre_auth.client,
-                                     current_resource_owner.id,
-                                     pre_auth.scopes
+      AccessToken.matching_token_for(
+        pre_auth.client,
+        current_resource_owner.id,
+        pre_auth.scopes
+      )
     end
 
     def redirect_or_render(auth)
       if auth.redirectable?
-        redirect_to auth.redirect_uri
+        if Doorkeeper.configuration.api_only
+          render(
+            json: { status: :redirect, redirect_uri: auth.redirect_uri },
+            status: auth.status
+          )
+        else
+          redirect_to auth.redirect_uri
+        end
       else
         render json: auth.body, status: auth.status
       end
@@ -53,5 +78,23 @@ module Doorkeeper
     def strategy
       @strategy ||= server.authorization_request pre_auth.response_type
     end
+
+    def authorize_response
+      @authorize_response ||= begin
+        authorizable = pre_auth.authorizable?
+        before_successful_authorization if authorizable
+        auth = strategy.authorize
+        after_successful_authorization if authorizable
+        auth
+      end
+    end
+
+    def after_successful_authorization
+      Doorkeeper.configuration.after_successful_authorization.call(self)
+    end
+
+    def before_successful_authorization
+      Doorkeeper.configuration.before_successful_authorization.call(self)
+    end
   end
 end

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -1,14 +1,33 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AuthorizedApplicationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
 
     def index
       @applications = Application.authorized_for(current_resource_owner)
+
+      respond_to do |format|
+        format.html
+        format.json { render json: @applications, current_resource_owner: current_resource_owner }
+      end
     end
 
     def destroy
-      AccessToken.revoke_all_for params[:id], current_resource_owner
-      redirect_to oauth_authorized_applications_url, notice: I18n.t(:notice, scope: [:doorkeeper, :flash, :authorized_applications, :destroy])
+      Application.revoke_tokens_and_grants_for(
+        params[:id],
+        current_resource_owner
+      )
+
+      respond_to do |format|
+        format.html do
+          redirect_to oauth_authorized_applications_url, notice: I18n.t(
+            :notice, scope: %i[doorkeeper flash authorized_applications destroy]
+          )
+        end
+
+        format.json { render :no_content }
+      end
     end
   end
 end

data/app/controllers/doorkeeper/token_info_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class TokenInfoController < Doorkeeper::ApplicationMetalController
     def show

data/app/controllers/doorkeeper/tokens_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class TokensController < Doorkeeper::ApplicationMetalController
     def create
@@ -17,9 +19,7 @@ module Doorkeeper
       # Doorkeeper does not use the token_type_hint logic described in the
       # RFC 7009 due to the refresh token implementation that is a field in
       # the access token model.
-      if authorized?
-        revoke_token
-      end
+      revoke_token if authorized?
 
       # The authorization server responds with HTTP status code 200 if the token
       # has been revoked successfully or if the client submitted an invalid
@@ -71,9 +71,7 @@ module Doorkeeper
     end
 
     def revoke_token
-      if token.accessible?
-        token.revoke
-      end
+      token.revoke if token.accessible?
     end
 
     def token

data/app/helpers/doorkeeper/dashboard_helper.rb

@@ -1,15 +1,17 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module DashboardHelper
     def doorkeeper_errors_for(object, method)
-      if object.errors[method].present?
-        output = object.errors[method].map do |msg|
-          content_tag(:span, class: 'help-block') do
-            msg.capitalize
-          end
-        end
+      return if object.errors[method].blank?
 
-        safe_join(output)
+      output = object.errors[method].map do |msg|
+        content_tag(:span, class: 'form-text') do
+          msg.capitalize
+        end
       end
+
+      safe_join(output)
     end
 
     def doorkeeper_submit_path(application)

data/app/validators/redirect_uri_validator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'uri'
 
 class RedirectUriValidator < ActiveModel::EachValidator
@@ -34,11 +36,12 @@ class RedirectUriValidator < ActiveModel::EachValidator
 
   def invalid_ssl_uri?(uri)
     forces_ssl = Doorkeeper.configuration.force_ssl_in_redirect_uri
+    non_https = uri.try(:scheme) == 'http'
 
     if forces_ssl.respond_to?(:call)
-      forces_ssl.call(uri)
+      forces_ssl.call(uri) && non_https
     else
-      forces_ssl && uri.try(:scheme) == 'http'
+      forces_ssl && non_https
     end
   end
 end

data/app/views/doorkeeper/applications/_delete_form.html.erb

@@ -1,4 +1,6 @@
 <%- submit_btn_css ||= 'btn btn-link' %>
 <%= form_tag oauth_application_path(application), method: :delete do %>
-  <%= submit_tag t('doorkeeper.applications.buttons.destroy'), onclick: "return confirm('#{ t('doorkeeper.applications.confirmations.destroy') }')", class: submit_btn_css %>
+  <%= submit_tag t('doorkeeper.applications.buttons.destroy'),
+                 onclick: "return confirm('#{ t('doorkeeper.applications.confirmations.destroy') }')",
+                 class: submit_btn_css %>
 <% end %>

data/app/views/doorkeeper/applications/_form.html.erb

@@ -1,58 +1,59 @@
-<%= form_for application, url: doorkeeper_submit_path(application), html: {class: 'form-horizontal', role: 'form'} do |f| %>
+<%= form_for application, url: doorkeeper_submit_path(application), html: { role: 'form' } do |f| %>
   <% if application.errors.any? %>
     <div class="alert alert-danger" data-alert><p><%= t('doorkeeper.applications.form.error') %></p></div>
   <% end %>
 
-  <%= content_tag :div, class: "form-group#{' has-error' if application.errors[:name].present?}" do %>
-    <%= f.label :name, class: 'col-sm-2 control-label' %>
+  <div class="form-group row">
+    <%= f.label :name, class: 'col-sm-2 col-form-label font-weight-bold' %>
     <div class="col-sm-10">
-      <%= f.text_field :name, class: 'form-control' %>
+      <%= f.text_field :name, class: "form-control #{ 'is-invalid' if application.errors[:name].present? }", required: true %>
       <%= doorkeeper_errors_for application, :name %>
     </div>
-  <% end %>
+  </div>
 
-  <%= content_tag :div, class: "form-group#{' has-error' if application.errors[:redirect_uri].present?}" do %>
-    <%= f.label :redirect_uri, class: 'col-sm-2 control-label' %>
+  <div class="form-group row">
+    <%= f.label :redirect_uri, class: 'col-sm-2 col-form-label font-weight-bold' %>
     <div class="col-sm-10">
-      <%= f.text_area :redirect_uri, class: 'form-control' %>
+      <%= f.text_area :redirect_uri, class: "form-control #{ 'is-invalid' if application.errors[:redirect_uri].present? }" %>
       <%= doorkeeper_errors_for application, :redirect_uri %>
-      <span class="help-block">
+      <span class="form-text text-secondary">
         <%= t('doorkeeper.applications.help.redirect_uri') %>
       </span>
+
       <% if Doorkeeper.configuration.native_redirect_uri %>
-          <span class="help-block">
-            <%= raw t('doorkeeper.applications.help.native_redirect_uri', native_redirect_uri: content_tag(:code) { Doorkeeper.configuration.native_redirect_uri }) %>
+          <span class="form-text text-secondary">
+            <%= raw t('doorkeeper.applications.help.native_redirect_uri', native_redirect_uri: content_tag(:code, class: 'bg-light') { Doorkeeper.configuration.native_redirect_uri }) %>
           </span>
       <% end %>
     </div>
-  <% end %>
+  </div>
 
-  <%= content_tag :div, class: "form-group#{' has-error' if application.errors[:confidential].present?}" do %>
-    <%= f.label :confidential, class: 'col-sm-2 control-label' %>
+  <div class="form-group row">
+    <%= f.label :confidential, class: 'col-sm-2 form-check-label font-weight-bold' %>
     <div class="col-sm-10">
-      <%= f.check_box :confidential, class: 'form-control', disabled: !Doorkeeper::Application.supports_confidentiality? %>
+      <%= f.check_box :confidential, class: "checkbox #{ 'is-invalid' if application.errors[:confidential].present? }" %>
       <%= doorkeeper_errors_for application, :confidential %>
-      <span class="help-block">
+      <span class="form-text text-secondary">
         <%= t('doorkeeper.applications.help.confidential') %>
       </span>
     </div>
-  <% end %>
+  </div>
 
-  <%= content_tag :div, class: "form-group#{' has-error' if application.errors[:scopes].present?}" do %>
-    <%= f.label :scopes, class: 'col-sm-2 control-label' %>
+  <div class="form-group row">
+    <%= f.label :scopes, class: 'col-sm-2 col-form-label font-weight-bold' %>
     <div class="col-sm-10">
-      <%= f.text_field :scopes, class: 'form-control' %>
+      <%= f.text_field :scopes, class: "form-control #{ 'has-error' if application.errors[:scopes].present? }" %>
       <%= doorkeeper_errors_for application, :scopes %>
-      <span class="help-block">
+      <span class="form-text text-secondary">
         <%= t('doorkeeper.applications.help.scopes') %>
       </span>
     </div>
-  <% end %>
+  </div>
 
   <div class="form-group">
     <div class="col-sm-offset-2 col-sm-10">
-      <%= f.submit t('doorkeeper.applications.buttons.submit'), class: "btn btn-primary" %>
-      <%= link_to t('doorkeeper.applications.buttons.cancel'), oauth_applications_path, class: "btn btn-default" %>
+      <%= f.submit t('doorkeeper.applications.buttons.submit'), class: 'btn btn-primary' %>
+      <%= link_to t('doorkeeper.applications.buttons.cancel'), oauth_applications_path, class: 'btn btn-secondary' %>
     </div>
   </div>
 <% end %>

data/app/views/doorkeeper/applications/edit.html.erb

@@ -1,4 +1,4 @@
-<div class="page-header">
+<div class="border-bottom mb-4">
   <h1><%= t('.title') %></h1>
 </div>
 

data/app/views/doorkeeper/applications/index.html.erb

@@ -1,4 +1,4 @@
-<div class="page-header">
+<div class="border-bottom mb-4">
   <h1><%= t('.title') %></h1>
 </div>
 
@@ -10,18 +10,28 @@
     <th><%= t('.name') %></th>
     <th><%= t('.callback_url') %></th>
     <th><%= t('.confidential') %></th>
-    <th></th>
+    <th><%= t('.actions') %></th>
     <th></th>
   </tr>
   </thead>
   <tbody>
   <% @applications.each do |application| %>
     <tr id="application_<%= application.id %>">
-      <td><%= link_to application.name, oauth_application_path(application) %></td>
-      <td><%= application.redirect_uri %></td>
-      <td><%= application.confidential? ? t('doorkeeper.applications.index.confidentiality.yes') : t('doorkeeper.applications.index.confidentiality.no') %></td>
-      <td><%= link_to t('doorkeeper.applications.buttons.edit'), edit_oauth_application_path(application), class: 'btn btn-link' %></td>
-      <td><%= render 'delete_form', application: application %></td>
+      <td class="align-middle">
+        <%= link_to application.name, oauth_application_path(application) %>
+      </td>
+      <td class="align-middle">
+        <%= simple_format(application.redirect_uri) %>
+      </td>
+      <td class="align-middle">
+        <%= application.confidential? ? t('doorkeeper.applications.index.confidentiality.yes') : t('doorkeeper.applications.index.confidentiality.no') %>
+      </td>
+      <td class="align-middle">
+        <%= link_to t('doorkeeper.applications.buttons.edit'), edit_oauth_application_path(application), class: 'btn btn-link' %>
+      </td>
+      <td class="align-middle">
+        <%= render 'delete_form', application: application %>
+      </td>
     </tr>
   <% end %>
   </tbody>

data/app/views/doorkeeper/applications/new.html.erb

@@ -1,4 +1,4 @@
-<div class="page-header">
+<div class="border-bottom mb-4">
   <h1><%= t('.title') %></h1>
 </div>
 

data/app/views/doorkeeper/applications/show.html.erb

@@ -1,20 +1,20 @@
-<div class="page-header">
+<div class="border-bottom mb-4">
   <h1><%= t('.title', name: @application.name) %></h1>
 </div>
 
 <div class="row">
   <div class="col-md-8">
     <h4><%= t('.application_id') %>:</h4>
-    <p><code id="application_id"><%= @application.uid %></code></p>
+    <p><code class="bg-light" id="application_id"><%= @application.uid %></code></p>
 
     <h4><%= t('.secret') %>:</h4>
-    <p><code id="secret"><%= @application.secret %></code></p>
+    <p><code class="bg-light" id="secret"><%= @application.secret %></code></p>
 
     <h4><%= t('.scopes') %>:</h4>
-    <p><code id="scopes"><%= @application.scopes %></code></p>
+    <p><code class="bg-light" id="scopes"><%= @application.scopes.presence || raw('&nbsp;') %></code></p>
 
     <h4><%= t('.confidential') %>:</h4>
-    <p><code id="confidential"><%= @application.confidential? %></code></p>
+    <p><code class="bg-light" id="confidential"><%= @application.confidential? %></code></p>
 
     <h4><%= t('.callback_urls') %>:</h4>
 
@@ -22,7 +22,7 @@
       <% @application.redirect_uri.split.each do |uri| %>
         <tr>
           <td>
-            <code><%= uri %></code>
+            <code class="bg-light"><%= uri %></code>
           </td>
           <td>
             <%= link_to t('doorkeeper.applications.buttons.authorize'), oauth_authorization_path(client_id: @application.uid, redirect_uri: uri, response_type: 'code', scope: @application.scopes), class: 'btn btn-success', target: '_blank' %>

data/app/views/doorkeeper/authorizations/error.html.erb

@@ -1,4 +1,4 @@
-<div class="page-header">
+<div class="border-bottom mb-4">
   <h1><%= t('doorkeeper.authorizations.error.title') %></h1>
 </div>
 

data/app/views/doorkeeper/authorizations/new.html.erb

@@ -26,6 +26,8 @@
       <%= hidden_field_tag :state, @pre_auth.state %>
       <%= hidden_field_tag :response_type, @pre_auth.response_type %>
       <%= hidden_field_tag :scope, @pre_auth.scope %>
+      <%= hidden_field_tag :code_challenge, @pre_auth.code_challenge %>
+      <%= hidden_field_tag :code_challenge_method, @pre_auth.code_challenge_method %>
       <%= submit_tag t('doorkeeper.authorizations.buttons.authorize'), class: "btn btn-success btn-lg btn-block" %>
     <% end %>
     <%= form_tag oauth_authorization_path, method: :delete do %>
@@ -34,6 +36,8 @@
       <%= hidden_field_tag :state, @pre_auth.state %>
       <%= hidden_field_tag :response_type, @pre_auth.response_type %>
       <%= hidden_field_tag :scope, @pre_auth.scope %>
+      <%= hidden_field_tag :code_challenge, @pre_auth.code_challenge %>
+      <%= hidden_field_tag :code_challenge_method, @pre_auth.code_challenge_method %>
       <%= submit_tag t('doorkeeper.authorizations.buttons.deny'), class: "btn btn-danger btn-lg btn-block" %>
     <% end %>
   </div>

data/app/views/layouts/doorkeeper/admin.html.erb

@@ -4,27 +4,27 @@
   <meta charset="utf-8">
   <meta http-equiv="X-UA-Compatible" content="IE=edge">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Doorkeeper</title>
+  <title><%= t('doorkeeper.layouts.admin.title') %></title>
   <%= stylesheet_link_tag "doorkeeper/admin/application" %>
   <%= csrf_meta_tags %>
 </head>
 <body>
-<div class="navbar navbar-inverse navbar-static-top" role="navigation">
-  <div class="container-fluid">
-    <div class="navbar-header">
-      <%= link_to t('doorkeeper.layouts.admin.nav.oauth2_provider'), oauth_applications_path, class: 'navbar-brand' %>
-    </div>
-    <ul class="nav navbar-nav">
-      <%= content_tag :li, class: "#{'active' if request.path == oauth_applications_path}" do %>
-        <%= link_to t('doorkeeper.layouts.admin.nav.applications'), oauth_applications_path %>
-      <% end %>
-      <%= content_tag :li do %>
-        <%= link_to t('doorkeeper.layouts.admin.nav.home'), root_path %>
-      <% end %>
+<nav class="navbar navbar-expand-lg navbar-dark bg-dark mb-5">
+  <%= link_to t('doorkeeper.layouts.admin.nav.oauth2_provider'), oauth_applications_path, class: 'navbar-brand' %>
+
+  <div class="collapse navbar-collapse">
+    <ul class="navbar-nav mr-auto">
+      <li class="nav-item <%= 'active' if request.path == oauth_applications_path %>">
+        <%= link_to t('doorkeeper.layouts.admin.nav.applications'), oauth_applications_path, class: 'nav-link' %>
+      </li>
+      <li class="nav-item">
+        <%= link_to t('doorkeeper.layouts.admin.nav.home'), root_path, class: 'nav-link' %>
+      </li>
     </ul>
   </div>
-</div>
-<div class="container">
+</nav>
+
+<div class="doorkeeper-admin container">
   <%- if flash[:notice].present? %>
     <div class="alert alert-info">
       <%= flash[:notice] %>

data/config/locales/en.yml

@@ -14,6 +14,8 @@ en:
               relative_uri: 'must be an absolute URI.'
               secured_uri: 'must be an HTTPS/SSL URI.'
               forbidden_uri: 'is forbidden by the server.'
+            scopes:
+              not_match_configured: "doesn't match configured on the server."
 
   doorkeeper:
     applications:
@@ -40,6 +42,7 @@ en:
         name: 'Name'
         callback_url: 'Callback URL'
         confidential: 'Confidential?'
+        actions: 'Actions'
         confidentiality:
           'yes': 'Yes'
           'no': 'No'
@@ -47,7 +50,7 @@ en:
         title: 'New Application'
       show:
         title: 'Application: %{name}'
-        application_id: 'Application Id'
+        application_id: 'Application UID'
         secret: 'Secret'
         scopes: 'Scopes'
         confidential: 'Confidential'
@@ -78,6 +81,9 @@ en:
         created_at: 'Created At'
         date_format: '%Y-%m-%d %H:%M:%S'
 
+    pre_authorization:
+      status: 'Pre-authorization'
+
     errors:
       messages:
         # Common error messages
@@ -86,12 +92,14 @@ en:
         unauthorized_client: 'The client is not authorized to perform this request using this method.'
         access_denied: 'The resource owner or authorization server denied the request.'
         invalid_scope: 'The requested scope is invalid, unknown, or malformed.'
+        invalid_code_challenge_method: 'The code challenge method must be plain or S256.'
         server_error: 'The authorization server encountered an unexpected condition which prevented it from fulfilling the request.'
         temporarily_unavailable: 'The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server.'
 
         # Configuration error messages
         credential_flow_not_configured: 'Resource Owner Password Credentials flow failed due to Doorkeeper.configure.resource_owner_from_credentials being unconfigured.'
         resource_owner_authenticator_not_configured: 'Resource Owner find failed due to Doorkeeper.configure.resource_owner_authenticator being unconfigured.'
+        admin_authenticator_not_configured: 'Access to admin panel is forbidden due to Doorkeeper.configure.admin_authenticator being unconfigured.'
 
         # Access grant errors
         unsupported_response_type: 'The authorization server does not support this response type.'
@@ -120,6 +128,7 @@ en:
 
     layouts:
       admin:
+        title: 'Doorkeeper'
         nav:
           oauth2_provider: 'OAuth2 Provider'
           applications: 'Applications'