lato 3.24.0 → 3.26.0

data/app/views/lato/authentication/_form-web3-signin.html.erb

@@ -12,7 +12,7 @@ user ||= Lato::User.new
     <% if session[:web3_nonce] %>
     
       <div class="alert alert-light mb-0 text-center">
-        <h4 class="alert-heading">Connecting..</h4>
+        <h4 class="alert-heading" role="status"><%= I18n.t('lato.connecting') %></h4>
         <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
           <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
         </div>
@@ -21,13 +21,14 @@ user ||= Lato::User.new
       <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
       <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
       <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
+      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
 
       <script>
         (async () => {
+          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
           const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
 
-          const nonce = document.getElementById('account_form-web3__nonce').innerText
+          const nonce = document.getElementById('account_form-web3__nonce').textContent
           const inputAddress = document.getElementById('account_form-web3__input-web3_address')
           const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
           const submitButton = document.getElementById('account_form-web3__submit')

data/app/views/lato/components/_index.html.erb

@@ -9,9 +9,10 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
 
 <%= turbo_frame_tag "lato_index_#{key}_#{model_name_underscore}", class: "lato-index #{browser.device.mobile? ? 'lato-index-mob' : 'lato-index-desk'}" do %>
 
-  <%= form_tag request.path, method: :get, data: { controller: 'lato-form lato-index', turbo_frame: '_self' } do %>
+  <%= form_tag request.path, method: :get, data: { controller: 'lato-form lato-index', lato_index_key_value: key, turbo_frame: '_self' } do %>
     <%= hidden_field_tag :key, key %>
-    <% params.each do |k, v| %>
+    <% params.except(:controller, :action, :key).each do |k, v| %>
+      <% next unless v.is_a?(String) %>
       <%= hidden_field_tag k, v %>
     <% end %>
 
@@ -33,7 +34,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
         <% if custom_actions.any? %>
           <div class="btn-group ms-2">
             <% custom_actions.each do |action_key, action_params| %>
-              <%= link_to action_params[:path], { class: 'btn btn-primary' }.merge(action_params) do %>
+              <%= link_to action_params[:path], { class: 'btn btn-primary', 'aria-label': action_params[:title] }.merge(action_params) do %>
                 <i class="<%= action_params[:icon] %>"></i>
               <% end %>
             <% end %>
@@ -42,7 +43,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
 
         <% if dropdown_actions %>
           <div class="dropdown ms-2">
-            <%= content_tag :button, { class: 'btn btn-primary dropdown-toggle', 'data-bs-toggle': 'dropdown' }.merge(dropdown_actions) do %>
+            <%= content_tag :button, { class: 'btn btn-primary dropdown-toggle', 'data-bs-toggle': 'dropdown', 'aria-label': dropdown_actions[:title] }.merge(dropdown_actions) do %>
               <i class="<%= dropdown_actions[:icon] %>"></i>
             <% end %>
             <ul class="dropdown-menu">
@@ -109,28 +110,32 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
           <thead>
             <tr class="align-middle">
               <% columns.each do |column| %>
-                <th scope="col" class="lato-index-desk-col-label lato-index-desk-col-label-<%= column %>">
+                <% column_label = collection_test_istance.respond_to?(column) ? collection.model.human_attribute_name(column) : lato_index_dynamic_label({
+                  key: key,
+                  model_name: model_name,
+                  column: column
+                }) %>
+                <% sort_direction = sortable_columns.include?(column) ? { "#{column}|ASC" => 'ascending', "#{column}|DESC" => 'descending' }[params["#{key}_sort_by"]] : nil %>
+                <%= content_tag :th, scope: 'col', class: "lato-index-desk-col-label lato-index-desk-col-label-#{column}", 'aria-sort': sort_direction do %>
                   <div class="d-flex align-items-center justify-content-between">
-                    <span><%= collection_test_istance.respond_to?(column) ? collection.model.human_attribute_name(column) : lato_index_dynamic_label({
-                      key: key,
-                      model_name: model_name,
-                      column: column
-                    }) %></span>
+                    <span><%= column_label %></span>
                     <% if sortable_columns.include?(column) %>
                       <div class="btn-group ms-3 lato-index-col-sort">
-                        <div class="position-relative btn btn-sm <%= params["#{key}_sort_by"] == "#{column}|ASC" ? 'btn-primary' : 'btn-outline-primary' %>">
-                          <input type="submit" name="<%= "#{key}_sort_by" %>" value="<%= column %>|ASC" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0">
-                          <i class="bi bi-sort-up"></i>
-                        </div>
-
-                        <div class="position-relative btn btn-sm <%= params["#{key}_sort_by"] == "#{column}|DESC" ? 'btn-primary' : 'btn-outline-primary' %>">
-                          <input type="submit" name="<%= "#{key}_sort_by" %>" value="<%= column %>|DESC" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0">
-                          <i class="bi bi-sort-down"></i>
-                        </div>
+                        <% [['ASC', 'ascending', 'bi-sort-up'], ['DESC', 'descending', 'bi-sort-down']].each do |direction, direction_name, icon| %>
+                          <% active = params["#{key}_sort_by"] == "#{column}|#{direction}" %>
+                          <button
+                            type="submit"
+                            name="<%= "#{key}_sort_by" %>"
+                            value="<%= column %>|<%= direction %>"
+                            class="btn btn-sm <%= active ? 'btn-primary' : 'btn-outline-primary' %>"
+                            aria-label="<%= I18n.t("lato.sort_#{direction_name}", column: strip_tags(column_label.to_s)) %>"
+                            aria-pressed="<%= active %>"
+                          ><i class="bi <%= icon %>" aria-hidden="true"></i></button>
+                        <% end %>
                       </div>
                     <% end %>
                   </div>
-                </th>
+                <% end %>
               <% end %>
             </tr>
           </thead>

data/app/views/lato/components/_navbar_nav_item.html.erb

@@ -1,5 +1,5 @@
 <li class="nav-item">
-  <%= link_to path, class: ['nav-link', ('active' if active)] do %>
+  <%= link_to path, class: ['nav-link', ('active' if active)], aria: { current: ('page' if active) } do %>
     <%= yield %>
   <% end %>
 </li>

data/app/views/lato/components/_operation.html.erb

@@ -47,7 +47,10 @@
 
         <% if operation.output_action? %>
           <div class="mt-3 d-flex justify-content-center">
-            <%= link_to operation.output_action['label'], operation.output_action['href'], { class: 'btn btn-primary' }.merge(operation.output_action['attributes']) %>
+            <%# Only http(s) and relative links: a javascript: href built from job input would run on click. %>
+            <% output_href = operation.output_action['href'].to_s %>
+            <% output_href = '#' unless output_href.start_with?('/', 'http://', 'https://') && !output_href.start_with?('//') %>
+            <%= link_to operation.output_action['label'], output_href, { class: 'btn btn-primary' }.merge(operation.output_action['attributes'] || {}) %>
           </div>
         <% end %>
       </div>

data/app/views/lato/components/_page_head.html.erb

@@ -9,7 +9,7 @@
     </ol>
   <% end %>
 
-  <h1><%= raw title %></h1>
+  <h1><%= title %></h1>
 
   <%= yield %>
 </div>

data/app/views/lato/components/_sidebar_nav_item.html.erb

@@ -9,6 +9,7 @@ unless has_children
     class: ['nav-link position-relative', (active ? 'active' : 'link-dark')].join(' '),
   }
   link_to_options[:target] = '_blank' if external
+  link_to_options[:aria] = { current: 'page' } if active
 end
 
 %>
@@ -28,7 +29,7 @@ end
         <ul class="list-unstyled mt-2 border-start border-1 ps-2">
           <% children.each do |child| %>
             <li class="py-1">
-              <%= link_to child[:path], class: ['nav-link py-1', (active == child[:key] ? 'active' : 'link-dark')].join(' ') do %>
+              <%= link_to child[:path], class: ['nav-link py-1', (active == child[:key] ? 'active' : 'link-dark')].join(' '), aria: { current: ('page' if active == child[:key]) } do %>
                 <%= child[:label] %>
               <% end %>
             </li>

data/app/views/lato/mailer/invitation/invite_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 You have received an invitation to use <%= Lato.config.application_title %>.
 <br><br>

data/app/views/lato/mailer/user/email_verification_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 To have access to all the features of <%= Lato.config.application_title %> you must confirm your email address.
 <br><br>

data/app/views/lato/mailer/user/password_update_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 An update to your <%= Lato.config.application_title %> account password has been requested.
 <br><br>

data/app/views/lato/mailer/user/signin_success_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 An access to your <b><%= Lato.config.application_title %></b> account has been made with the IP address <b><%= @ip_address %></b>.
 <br><br>

data/app/views/layouts/lato/_action.html.erb

@@ -1,11 +1,11 @@
 <% 10.times do %>
 
-<div class="modal fade" data-lato-action-target="modal" tabindex="-1" aria-hidden="true" data-bs-backdrop="static" data-bs-keyboard="false">
+<div class="modal fade" data-lato-action-target="modal" tabindex="-1" aria-hidden="true" data-bs-backdrop="static">
   <div class="modal-dialog modal-dialog-centered modal-dialog-scrollable" data-lato-action-target="modalDialog">
     <div class="modal-content">
       <div class="modal-header">
         <h2 class="mb-0 mt-0 fs-4" data-lato-action-target="modalTitle"></h2>
-        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="<%= I18n.t('lato.close') %>"></button>
       </div>
       <div class="modal-body" data-lato-action-target="modalBody">
         ...

data/app/views/layouts/lato/_aside-opener.html.erb

@@ -2,7 +2,7 @@
   class="aside-opener shadow"
   data-controller="lato-aside-opener"
   data-action="click->lato-aside-opener#onClickToggle"
-  aria-label="Toggle sidebar"
+  aria-label="<%= I18n.t('lato.toggle_sidebar') %>"
 >
-  <i class="bi bi-layout-text-sidebar-reverse"></i>
+  <i class="bi bi-layout-text-sidebar-reverse" aria-hidden="true"></i>
 </button>

data/app/views/layouts/lato/_confirm.html.erb

@@ -1,26 +1,24 @@
-<div class="lato-confirm modal fade" data-controller="lato-confirm" tabindex="-1" aria-hidden="true" data-bs-keyboard="false">
+<div class="lato-confirm modal fade" data-controller="lato-confirm" tabindex="-1" aria-hidden="true" aria-labelledby="latoConfirmTitle">
   <div class="modal-dialog modal-dialog-centered modal-dialog-scrollable">
     <div class="modal-content">
       <div class="modal-header">
-        <h2 class="mb-0 mt-0 fs-4"><%= I18n.t('lato.confirm_title') %></h2>
-        <button type="button" class="btn-close" data-action="click->lato-confirm#confirmCancel" aria-label="Close"></button>
+        <h2 class="mb-0 mt-0 fs-4" id="latoConfirmTitle"><%= I18n.t('lato.confirm_title') %></h2>
+        <button type="button" class="btn-close" data-action="click->lato-confirm#confirmCancel" aria-label="<%= I18n.t('lato.close') %>"></button>
       </div>
       <div class="modal-body" data-lato-confirm-target="modalBody">
       </div>
       <div class="modal-footer">
         <button
           type="button"
-          class="btn btn-danger"
+          class="btn btn-secondary"
           data-action="click->lato-confirm#confirmCancel"
-          aria-label="<%= I18n.t('lato.confirm_no') %>"
         ><%= I18n.t('lato.confirm_no') %></button>
         <button
           type="button"
-          class="btn btn-success"
+          class="btn btn-primary"
           data-action="click->lato-confirm#confirmSuccess"
-          aria-label="<%= I18n.t('lato.confirm_yes') %>"
         ><%= I18n.t('lato.confirm_yes') %></button>
       </div>
     </div>
   </div>
-</div>
+</div>

data/app/views/layouts/lato/_feedbacks.html.erb

@@ -1,11 +1,11 @@
 <div class="toast-container">
   <% if notice %>
     <div class="position-fixed end-0 bottom-0 p-3" style="z-index: 11;">
-      <div data-controller="lato-feedback" id="feedbackNotice" class="toast hide" role="alert" aria-live="assertive" aria-atomic="true">
+      <div data-controller="lato-feedback" id="feedbackNotice" class="toast hide" role="status" aria-live="polite" aria-atomic="true">
         <div class="toast-header">
-          <i class="bi bi-check-circle-fill text-success me-2"></i>
-          <strong class="me-auto"><%= I18n.t('lato.operation_completed') %></strong>
-          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="Close"></button>
+          <i class="bi bi-check-circle-fill text-success me-2" aria-hidden="true"></i>
+          <strong class="me-auto"><%= I18n.t('lato.notice_title') %></strong>
+          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="<%= I18n.t('lato.close') %>"></button>
         </div>
         <div class="toast-body">
           <%= notice %>
@@ -16,11 +16,12 @@
 
   <% if alert %>
     <div class="position-fixed end-0 bottom-0 p-3" style="z-index: 11;">
-      <div data-controller="lato-feedback" id="feedbackAlert" class="toast hide" role="alert" aria-live="assertive" aria-atomic="true">
+      <%# Errors stay visible until dismissed: auto hiding gives no time to read them. %>
+      <div data-controller="lato-feedback" id="feedbackAlert" class="toast hide" role="alert" aria-live="assertive" aria-atomic="true" data-bs-autohide="false">
         <div class="toast-header">
-          <i class="bi bi-check-circle-fill text-danger me-2"></i>
-          <strong class="me-auto"><%= I18n.t('lato.operation_failed') %></strong>
-          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="Close"></button>
+          <i class="bi bi-exclamation-triangle-fill text-danger me-2" aria-hidden="true"></i>
+          <strong class="me-auto"><%= I18n.t('lato.alert_title') %></strong>
+          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="<%= I18n.t('lato.close') %>"></button>
         </div>
         <div class="toast-body">
           <%= alert %>

data/app/views/layouts/lato/_mailer-head_content.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
   Hello,
   <br><br>
 <% else %>

data/app/views/layouts/lato/_network.html.erb

@@ -1,4 +1,4 @@
-<div class="fixed-bottom p-3 d-none" data-controller="lato-network">
-  <span class="badge rounded-pill text-bg-danger fs-6 d-none" data-lato-network-target="offline">You are offline</span>
-  <span class="badge rounded-pill text-bg-success fs-6 d-none" data-lato-network-target="online">You are online</span>
+<div class="fixed-bottom p-3 d-none" data-controller="lato-network" role="status" aria-live="polite">
+  <span class="badge rounded-pill text-bg-danger fs-6 d-none" data-lato-network-target="offline"><%= I18n.t('lato.network_offline') %></span>
+  <span class="badge rounded-pill text-bg-success fs-6 d-none" data-lato-network-target="online"><%= I18n.t('lato.network_online') %></span>
 </div>

data/app/views/layouts/lato/application.html.erb

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no,interactive-widget=resizes-content">
-  <title><%= @layout_page_title %></title>
+  <title><%= @layout_page_title.presence || Lato.config.application_title %></title>
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
 
@@ -27,6 +27,7 @@
   class="controller-<%= controller_name %> action-<%= action_name %> <%= @layout_body_classes.join(' ') %> <%= cookies[:lato_aside_hidden] == 'true' ? 'aside-hidden' : '' %>"
   data-controller="lato-action lato-guide"
 >
+  <a class="visually-hidden-focusable position-absolute top-0 start-0 p-2 bg-white" style="z-index: 2100;" href="#main"><%= I18n.t('lato.skip_to_content') %></a>
   <header>
     <%= render 'layouts/lato/navbar' %>
   </header>
@@ -39,7 +40,7 @@
       </aside>
     <% end %>
 
-    <main class="<%= @layout_sidebar ? 'layout_sidebar' : '' %>">
+    <main id="main" tabindex="-1" class="<%= @layout_sidebar ? 'layout_sidebar' : '' %>">
       <%= render 'layouts/lato/content' %>
     </main>
   </div>

data/config/locales/en.yml

@@ -1,5 +1,28 @@
 en:
   lato:
+    close: "Close"
+    notice_title: "Notification"
+    alert_title: "Error"
+    sort_ascending: "Sort by %{column} ascending"
+    sort_descending: "Sort by %{column} descending"
+    password_requirements: "At least %{count} characters."
+    too_many_requests: "Too many requests, please wait %{minutes} minutes to retry."
+    hcaptcha_missing: "Please complete the captcha verification."
+    hcaptcha_failed: "Captcha verification failed, please retry."
+    security_confirmation_required: "Confirm your current password and enabled second factor to continue."
+    current_password: "Current password"
+    current_authenticator_code: "Current authenticator code"
+    security_key_confirmation_help: "Confirm with your registered security key when submitting."
+    confirm_authenticator_code: "Confirm authenticator code"
+    authenticator_qr_code_alt: "Authenticator enrollment QR code"
+    authenticator_manual_key: "Or enter this key manually in your authenticator app"
+    connecting: "Connecting..."
+    back_to_account: "Back to your account"
+    network_offline: "You are offline"
+    network_online: "You are online"
+    toggle_sidebar: "Toggle sidebar"
+    skip_to_content: "Skip to main content"
+    copied: "Copied to clipboard"
     account: Account
     signout: Logout
     signin: Login
@@ -144,6 +167,7 @@ en:
               credentials_not_correct: Email or password not correct
               privacy_policy_invalid: To accept the privacy policy you must select the confirmation checkbox
               terms_and_conditions_invalid: To accept the terms and conditions you must select the confirmation checkbox
+              invitation_invalid: Invalid invitation
               web3_address_invalid: The address you send is not corretly signed
               web3_connection_error: Impossible to connect the wallet
               authenticator_code_invalid: The code you inserted is not correct
@@ -153,6 +177,8 @@ en:
               webauthn_authentication_failed: Passkey authentication failed. Please try again or use another method.
             password:
               not_correct: not correct
+            password_confirmation:
+              confirmation: does not match the password
             email:
               taken: already used with another account
               not_registered: not registered
@@ -163,8 +189,14 @@ en:
               inclusion: not accepted
             web3_address:
               not_correct: not correct
+        lato/operation:
+          attributes:
+            base:
+              start_error: "Unable to start the job"
         lato/invitation:
           attributes:
+            email:
+              taken: "already used by another user"
             base:
               already_accepted: Invitation already accepted
               email_sending_error:  Unable to send mail

data/config/locales/fr.yml

@@ -2,6 +2,29 @@
 
 fr:
   lato:
+    close: "Fermer"
+    notice_title: "Notification"
+    alert_title: "Erreur"
+    sort_ascending: "Trier par %{column} croissant"
+    sort_descending: "Trier par %{column} d\u00E9croissant"
+    password_requirements: "Au moins %{count} caract\u00E8res."
+    too_many_requests: "Trop de requ\u00EAtes, veuillez attendre %{minutes} minutes avant de r\u00E9essayer."
+    hcaptcha_missing: "Veuillez compl\u00E9ter la v\u00E9rification captcha."
+    hcaptcha_failed: "La v\u00E9rification captcha a \u00E9chou\u00E9, veuillez r\u00E9essayer."
+    security_confirmation_required: "Confirmez votre mot de passe actuel et le second facteur activ\u00E9 pour continuer."
+    current_password: "Mot de passe actuel"
+    current_authenticator_code: "Code authenticator actuel"
+    security_key_confirmation_help: "Confirmez avec votre cl\u00E9 de s\u00E9curit\u00E9 enregistr\u00E9e lors de l'envoi."
+    confirm_authenticator_code: "Confirmer le code authenticator"
+    authenticator_qr_code_alt: "QR code de configuration de l'authenticator"
+    authenticator_manual_key: "Ou saisissez cette cl\u00E9 manuellement dans votre application authenticator"
+    connecting: "Connexion en cours..."
+    back_to_account: "Retour \u00E0 votre compte"
+    network_offline: "Vous \u00EAtes hors ligne"
+    network_online: "Vous \u00EAtes en ligne"
+    toggle_sidebar: "Afficher/masquer la barre lat\u00E9rale"
+    skip_to_content: "Aller au contenu principal"
+    copied: "Copi\u00E9 dans le presse-papiers"
     account: Compte
     signout: Déconnexion
     signin: Connexion
@@ -173,8 +196,14 @@ fr:
               inclusion: non acceptées
             web3_address:
               not_correct: incorrect
+        lato/operation:
+          attributes:
+            base:
+              start_error: "Impossible de lancer le job"
         lato/invitation:
           attributes:
+            email:
+              taken: "d\u00E9j\u00E0 utilis\u00E9e par un autre utilisateur"
             base:
               already_accepted: Invitation déjà acceptée par l'utilisateur
               email_sending_error: Impossible d'envoyer l'e-mail

data/config/locales/it.yml

@@ -2,6 +2,29 @@
 
 it:
   lato:
+    close: "Chiudi"
+    notice_title: "Notifica"
+    alert_title: "Errore"
+    sort_ascending: "Ordina per %{column} crescente"
+    sort_descending: "Ordina per %{column} decrescente"
+    password_requirements: "Almeno %{count} caratteri."
+    too_many_requests: "Troppe richieste, attendi %{minutes} minuti prima di riprovare."
+    hcaptcha_missing: "Completa la verifica captcha."
+    hcaptcha_failed: "Verifica captcha non riuscita, riprova."
+    security_confirmation_required: "Conferma la password attuale e il secondo fattore attivo per continuare."
+    current_password: "Password attuale"
+    current_authenticator_code: "Codice authenticator attuale"
+    security_key_confirmation_help: "Conferma con la tua chiave di sicurezza registrata al momento dell'invio."
+    confirm_authenticator_code: "Conferma codice authenticator"
+    authenticator_qr_code_alt: "Codice QR per configurare l'authenticator"
+    authenticator_manual_key: "Oppure inserisci manualmente questa chiave nella tua app authenticator"
+    connecting: "Connessione in corso..."
+    back_to_account: "Torna al tuo account"
+    network_offline: "Sei offline"
+    network_online: "Sei online"
+    toggle_sidebar: "Mostra/nascondi barra laterale"
+    skip_to_content: "Vai al contenuto principale"
+    copied: "Copiato negli appunti"
     account: Account
     signout: Esci
     signin: Accedi
@@ -173,8 +196,14 @@ it:
               inclusion: non accettati
             web3_address:
               not_correct: non corretto
+        lato/operation:
+          attributes:
+            base:
+              start_error: "Impossibile eseguire il job"
         lato/invitation:
           attributes:
+            email:
+              taken: "gi\u00E0 utilizzata da un altro utente"
             base:
               already_accepted: Invito già accettato dall'utente
               email_sending_error: Impossibile inviare mail

data/config/locales/ro.yml

@@ -2,6 +2,29 @@
 
 ro:
   lato:
+    close: "\u00CEnchide"
+    notice_title: "Notificare"
+    alert_title: "Eroare"
+    sort_ascending: "Sorteaz\u0103 dup\u0103 %{column} cresc\u0103tor"
+    sort_descending: "Sorteaz\u0103 dup\u0103 %{column} descresc\u0103tor"
+    password_requirements: "Cel pu\u021Bin %{count} caractere."
+    too_many_requests: "Prea multe cereri, a\u0219tepta\u021Bi %{minutes} minute \u00EEnainte de a re\u00EEncerca."
+    hcaptcha_missing: "Completa\u021Bi verificarea captcha."
+    hcaptcha_failed: "Verificarea captcha a e\u0219uat, re\u00EEncerca\u021Bi."
+    security_confirmation_required: "Confirma\u021Bi parola curent\u0103 \u0219i al doilea factor activ pentru a continua."
+    current_password: "Parola curent\u0103"
+    current_authenticator_code: "Codul authenticator curent"
+    security_key_confirmation_help: "Confirma\u021Bi cu cheia de securitate \u00EEnregistrat\u0103 la trimitere."
+    confirm_authenticator_code: "Confirma\u021Bi codul authenticator"
+    authenticator_qr_code_alt: "Cod QR pentru configurarea authenticator"
+    authenticator_manual_key: "Sau introduce\u021Bi manual aceast\u0103 cheie \u00EEn aplica\u021Bia authenticator"
+    connecting: "Se conecteaz\u0103..."
+    back_to_account: "\u00CEnapoi la contul t\u0103u"
+    network_offline: "Sunte\u021Bi offline"
+    network_online: "Sunte\u021Bi online"
+    toggle_sidebar: "Afi\u0219eaz\u0103/ascunde bara lateral\u0103"
+    skip_to_content: "Salt la con\u021Binutul principal"
+    copied: "Copiat \u00EEn clipboard"
     account: Cont
     signout: Deconectare
     signin: Conectare
@@ -173,8 +196,14 @@ ro:
               inclusion: neacceptați
             web3_address:
               not_correct: incorect
+        lato/operation:
+          attributes:
+            base:
+              start_error: "Imposibil de pornit jobul"
         lato/invitation:
           attributes:
+            email:
+              taken: "deja folosit de alt utilizator"
             base:
               already_accepted: Invitația deja acceptată de utilizator
               email_sending_error: Imposibil să se trimită email-ul

data/config/routes.rb

@@ -40,6 +40,7 @@ Lato::Engine.routes.draw do
 
   scope :account do
     get '', to: 'account#index', as: :account
+    post 'security_challenge', to: 'account#security_challenge', as: :account_security_challenge
     patch 'update_user_action', to: 'account#update_user_action', as: :account_update_user_action
     patch 'update_authenticator_action', to: 'account#update_authenticator_action', as: :account_update_authenticator_action
     patch 'update_webauthn_action', to: 'account#update_webauthn_action', as: :account_update_webauthn_action

data/db/migrate/20261024000000_create_lato_session_records.rb

@@ -0,0 +1,16 @@
+class CreateLatoSessionRecords < ActiveRecord::Migration[7.1]
+  def change
+    create_table :lato_session_records do |t|
+      t.references :lato_user, null: false, foreign_key: true
+      t.string :token_digest, null: false
+      t.datetime :expires_at, null: false
+      t.string :security_grant_action
+      t.datetime :security_grant_expires_at
+      t.string :security_challenge
+      t.datetime :security_challenge_expires_at
+      t.timestamps
+    end
+    add_index :lato_session_records, :token_digest, unique: true
+    add_index :lato_session_records, :expires_at
+  end
+end

data/db/migrate/20261110000000_add_second_factor_counters_to_lato_users.rb

@@ -0,0 +1,6 @@
+class AddSecondFactorCountersToLatoUsers < ActiveRecord::Migration[7.1]
+  def change
+    add_column :lato_users, :authenticator_last_used_at, :datetime
+    add_column :lato_users, :webauthn_sign_count, :integer, null: false, default: 0
+  end
+end

data/lib/lato/config.rb

@@ -15,6 +15,9 @@ module Lato
     # Max password recovery emails sent per hour across all users (nil disables the cap)
     attr_accessor :auth_recover_password_hourly_limit
 
+    # Minimum password length, checked whenever a password is set
+    attr_accessor :auth_password_min_length
+
     # Hcaptcha configs
     attr_accessor :hcaptcha_site_key, :hcaptcha_secret
 
@@ -53,6 +56,7 @@ module Lato
       @auth_disable_webauthn = false
       @auth_disable_signin_success_mail = false
       @auth_recover_password_hourly_limit = 100
+      @auth_password_min_length = 8
 
       @hcaptcha_site_key = nil
       @hcaptcha_secret = nil

data/lib/lato/engine.rb

@@ -12,7 +12,16 @@ module Lato
       app.config.assets.precompile << "lato_manifest.js"
     end
 
+    initializer "lato.filter_credentials" do |app|
+      app.config.filter_parameters += %i[current_password current_authenticator_code current_webauthn_credential authenticator_code authenticator_secret webauthn_credential web3_signed_nonce code accepted_code]
+    end
+
     config.after_initialize do
+      # Recovery codes, verification codes and rate limits live in Rails.cache: a null store silently disables them.
+      if Rails.env.production? && Rails.cache.is_a?(ActiveSupport::Cache::NullStore)
+        Rails.logger.warn("[Lato] Rails.cache is a NullStore: password recovery, email verification and rate limiting will not work. Configure a shared cache store (Redis, Solid Cache, Memcache).")
+      end
+
       if Lato.config.webauthn_connection
         WebAuthn.configure do |config|
           config.allowed_origins = Lato.config.webauthn_origin.is_a?(Array) ? Lato.config.webauthn_origin : [Lato.config.webauthn_origin]

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.24.0"
+  VERSION = "3.26.0"
 end