masks-server 0.10.0 → 0.12.0

data/config/locales/de/manage/namespaces.yml

@@ -1,7 +1,7 @@
 de:
   manage:
     namespaces:
-      title: "Namespaces"
+      title: "Namensräume"
       release_confirm: "%{name} freigeben? Der nächste Client, der ihn anfordert, erhält ihn, und die Scopes darunter bedeuten nicht mehr, was sie jetzt bedeuten."
       released: "%{name} kann wieder beansprucht werden."
       columns:

data/config/locales/en/access_requests.yml

@@ -0,0 +1,43 @@
+en:
+  authorize:
+    error:
+      asking: "Your account is not in a group that may use %{app}. You can ask for access. The people who run %{app} decide, and you get an email either way."
+      ask: "Ask for access"
+      asked: "Your request was sent. You get an email once it is decided."
+      waiting: "Your request to use %{app} is waiting. You get an email once it is decided."
+      slow_down: "You asked for access to this app less than an hour ago. Wait for the answer."
+      back: "Back to %{app}"
+      the_app: "the app"
+
+  account:
+    index:
+      access:
+        heading: "Asked for access"
+        lede: "These people were turned away from an app that admits members of %{organization}. Approving makes them a member with the role you pick."
+        asked: "Asked to use %{app} %{age} ago"
+        role_of: "Role for %{name}"
+        grant: "Approve"
+        decline: "Decline"
+        confirm_decline: "Decline %{identifier}'s request to use %{app}? They get an email, and they can ask again in an hour."
+
+  organization_access:
+    granted: "%{identifier} is %{role} of %{organization} now and can use %{app}."
+    declined: "%{identifier}'s request to use %{app} is declined."
+    unknown: "That request is not waiting on %{organization}."
+
+  actor_mailer:
+    access_granted:
+      subject: "You can use %{app} now"
+      lede: "Your request to use %{app} at %{tenant} was approved. Sign in to %{app} again and you are let in."
+      action: "Open %{app}"
+    access_declined:
+      subject: "Your request to use %{app} was declined"
+      lede: "Somebody who runs %{app} at %{tenant} declined your request for access."
+      again: "If you think this is a mistake, ask them directly. You can ask again in an hour."
+
+  events:
+    actions:
+      access:
+        requested: "Asked for access to an app"
+        granted: "Access to an app granted"
+        declined: "Access to an app declined"

data/config/locales/en/account/app_passwords.yml

@@ -0,0 +1,42 @@
+en:
+  account:
+    index:
+      app_passwords:
+        heading: "App passwords"
+        entry: "App passwords"
+        state:
+          none: "None"
+        lede: "An app password lets one app, such as a media server or a NAS, sign in as you without your second factor. It works for the app it was made for and nothing else."
+        shown_once: "This is the app password for %{name}. It is shown once. Enter it in %{app} now."
+        made_ago: "made %{age} ago"
+        used_ago: "last used %{age} ago"
+        never_used: "never used"
+        revoke: "Revoke"
+        confirm_revoke: "Revoke %{name}? The app stops signing in with it right away."
+        name: "Name"
+        name_placeholder: "Jellyfin on the TV"
+        app: "App"
+        make: "Make app password"
+        make_again: "Sign in again to make one"
+        hint: "Your own password and passkeys stay as they are. Revoking an app password changes nothing else."
+        none_offered: "No app accepts app passwords yet."
+  app_passwords:
+    again: "Sign in again to make an app password. It has been a while since you did."
+    unknown: "There is no such app password on this account."
+    revoked: "%{name} is revoked."
+    refused:
+      name: "Give the app password a name of up to 64 characters."
+      app: "That app does not accept app passwords."
+      too_many: "You already have %{most} app passwords. Revoke one first."
+  events:
+    actions:
+      app_password:
+        created: "App password made"
+        used: "Signed in with an app password"
+        revoked: "App password revoked"
+  actor_mailer:
+    notification:
+      said:
+        app_password:
+          created: "An app password was made on your %{tenant} account. It signs in to one app without your second factor."
+          revoked: "An app password on your %{tenant} account was revoked."

data/config/locales/en/events.yml

@@ -157,6 +157,13 @@ en:
         exported: "Activity exported"
       mail_template:
         updated: "Email template changed"
+      job:
+        failed: "Background job failed for this tenant"
+      health:
+        failing: "Health check failing"
+        recovered: "Health check recovered"
+      release:
+        available: "New release available"
       stream:
         created: "Event stream added"
         updated: "Event stream changed"
@@ -171,6 +178,8 @@ en:
       signal:
         undelivered: "Shared signal not delivered"
         received: "Provider signaled sign-out"
+      text:
+        undelivered: "Text message not delivered"
       organization:
         created: "Organization added"
         updated: "Organization changed"

data/config/locales/en/flashes.yml

@@ -163,3 +163,4 @@ en:
   forward_auth:
     unknown: "No app behind a proxy is registered at that address."
     not_admitted: "Your account may not use %{app}."
+    denied: "This page of %{app} is closed to everyone."

data/config/locales/en/group_sources.yml

@@ -0,0 +1,5 @@
+en:
+  events:
+    actions:
+      group:
+        refreshed: "Group filled from its source"

data/config/locales/en/manage/access_requests.yml

@@ -0,0 +1,12 @@
+en:
+  manage:
+    access_requests:
+      title: "Access requests"
+      lede: "Actors who were turned away from this client and asked for access. Approving puts them in one of the groups it allows, and they get an email either way."
+      empty: "Nobody is waiting for access."
+      asked: "Asked %{day}"
+      as: "Group to put them in"
+      grant: "Approve"
+      decline: "Decline"
+      granted: "%{identifier} is in %{label} now and can sign in."
+      declined: "%{identifier}'s request is declined."

data/config/locales/en/manage/app_passwords.yml

@@ -0,0 +1,16 @@
+en:
+  manage:
+    client:
+      sign_in:
+        app_passwords: "Accept app passwords"
+        app_passwords_help: "People make an app password for this client on their account page. It signs them in over LDAP and forward auth without a second factor, for this client alone."
+      notices:
+        app_passwords_on: "People can make an app password for it now."
+        app_passwords_off: "Its app passwords are refused from now on."
+    ldap:
+      connect:
+        app: "App"
+        no_app: "No app"
+        app_help: "Choose the client the service is registered as. People's app passwords for that client then bind on a connection that bound with this credential first."
+      credentials:
+        app: "Accepts app passwords for %{name}"

data/config/locales/en/manage/forward_auth_rules.yml

@@ -0,0 +1,29 @@
+en:
+  manage:
+    forward_auth_rules:
+      title: "Rules"
+      lede: "The first rule that covers a request decides it. A request no rule covers needs a signed-in person who may sign in."
+      empty: "There are no rules. Every request needs a signed-in person who may sign in."
+      paths: "Paths"
+      paths_hint: "One per line. * covers one segment and ** covers any depth, so /admin/** covers /admin and everything under it. Empty covers every path."
+      methods: "Methods"
+      methods_hint: "GET, POST, and so on. Empty covers every method."
+      networks: "Networks"
+      networks_hint: "Addresses or ranges, such as 192.168.0.0/16. Empty covers every address."
+      groups: "Groups"
+      groups_hint: "Group keys, or roles as key:role. Empty covers everyone."
+      outcome: "Outcome"
+      outcomes:
+        open: "Open to everyone, with no sign-in"
+        one_factor: "A signed-in person, without a second factor"
+        two_factor: "A signed-in person, with their second factor"
+        token: "A signed-in person, or a script with an access token"
+        deny: "Closed to everyone"
+      rule: "Rule %{number}"
+      add: "Add rule"
+      remove: "Remove"
+      up: "Move up"
+      down: "Move down"
+      save: "Save rules"
+      saved: "Rules saved."
+      trust: "A network rule trusts the address the proxy sends. Make sure the proxy sets X-Forwarded-For itself."

data/config/locales/en/manage/group_sources.yml

@@ -0,0 +1,44 @@
+en:
+  manage:
+    group_sources:
+      source: "Fills from"
+      sources:
+        manual: "People added by hand"
+        rule: "A rule"
+        provider: "A provider"
+        group: "Other groups"
+      ledes:
+        manual: "A manager adds and removes people on their own pages."
+        rule: "Everyone who matches every condition. An email address counts once it is verified. A profile field counts only when a directory sets it, since people cannot change those. Checked when a profile changes and every hour."
+        provider: "Everyone whose last sign-in through the provider listed the group."
+        group: "Everyone in any of the parent groups or organization roles."
+      change: "Change how %{name} fills"
+      kinds:
+        email_domain: "Email address ends with"
+        profile: "Profile field equals"
+      field: "Field"
+      value: "Value"
+      add_condition: "Add condition"
+      remove_condition: "Remove condition"
+      provider: "Provider"
+      choose_provider: "Choose a provider"
+      no_providers: "Add a provider first."
+      upstream_group: "Group name at the provider"
+      parent_labels: "Parent groups"
+      parent_labels_hint: "Group keys or organization roles as key:role, separated by commas."
+      save: "Save"
+      cancel: "Cancel"
+      saved: "%{name} now fills from %{source}."
+      refresh: "Refresh now"
+      refreshed: "%{name} is refreshed."
+      refreshed_at: "Refreshed %{when}."
+      never_refreshed: "Not refreshed yet."
+      summary:
+        rule: "Fills by rule"
+        provider: "Fills from %{provider}"
+        group: "Fills from %{parents}"
+      by_hand: "Added by hand, so only a manager removes them."
+      from:
+        rule: "In the group by its rule, so the rule decides."
+        provider: "In the group from a provider sign-in, so the provider decides."
+        group: "In the group through a parent group, so the parent decides."

data/config/locales/en/manage/health.yml

@@ -0,0 +1,78 @@
+en:
+  manage:
+    health:
+      title: "Health"
+      lede: "Checks run every 10 minutes. Each one says what it found and what to do."
+      check_now: "Check now"
+      checking: "Checking"
+      checked: "Checked %{when}"
+      never: "The checks have not run yet. They run every 10 minutes once a worker is up."
+      failed: "The checks could not run: %{failure}"
+      statuses:
+        ok: "Fine"
+        warning: "Needs a look"
+        failing: "Failing"
+      checks:
+        jobs:
+          title: "Background jobs"
+          elsewhere: "Jobs run on another server."
+          none: "No job failed in the last day."
+          failed:
+            one: "One kind of job failed in the last day: %{jobs}."
+            other: "%{count} kinds of job failed in the last day: %{jobs}."
+          advice: "Read the error in the server log. Each job runs again on its schedule."
+        worker:
+          title: "Worker"
+          elsewhere: "Jobs run on another server."
+          unchecked: "The worker check is off."
+          reporting: "A worker is running."
+          silent: "No worker has reported in the last %{minutes} minutes."
+          advice: "Start the jobs process, or set MASKS_JOBS_IN_WEB_SERVER to true so the web server runs jobs."
+        queue:
+          title: "Queue"
+          elsewhere: "Jobs run on another server."
+          unchecked: "The queue check is off."
+          moving: "Jobs start on time."
+          stuck: "A job has waited to start since %{since}, longer than %{minutes} minutes."
+          advice: "Add a worker, or raise JOB_CONCURRENCY so more jobs run at once."
+        ldap:
+          title: "LDAP"
+          tls: "LDAP answers with TLS."
+          local: "LDAP answers only on the server's own machine."
+          plain: "LDAP answers on port %{port} without TLS, so passwords cross the network in the clear."
+          advice: "Set MASKS_LDAP_CERT and MASKS_LDAP_KEY, or unset MASKS_LDAP_PLAINTEXT."
+        metrics:
+          title: "Metrics"
+          "off": "The metrics page is off."
+          "on": "The metrics page answers a request that carries its token."
+          short: "The metrics token is %{length} characters long, so it can be guessed."
+          advice: "Set MASKS_METRICS_TOKEN to at least %{needed} random characters."
+        mail:
+          title: "Mail"
+          none: "No mail service is set up."
+          answers: "The mail server answers."
+          silent: "The mail server did not answer: %{error}."
+          advice: "Check the server, port, and TLS setting on the Messages page, and that the server allows this one to connect."
+        origin:
+          title: "Public address"
+          unset: "No public address is set, so masks follows each request's Host header."
+          matches: "Requests arrive at this tenant's public address."
+          mismatch: "Requests arrive as %{seen}, but this tenant's address is %{origin}."
+          advice: "Have the proxy send X-Forwarded-Proto and X-Forwarded-Host, and list it in MASKS_TRUSTED_PROXIES."
+        domains:
+          title: "Domains"
+          none: "No domain is claimed."
+          proven: "Every claimed domain still has its TXT record."
+          missing: "The TXT record is gone for %{domains}. A claim is released a week after its record disappears."
+          advice: "Put the TXT record back at the name shown on the Domains page."
+        keys:
+          title: "Signing keys"
+          missing: "This tenant has no active signing key, so nothing can be signed."
+          manual: "Keys rotate by hand. The active key is %{days} days old."
+          fresh: "The active key is %{days} days old and rotates every %{period} days."
+          stale: "The active key is %{days} days old, past its %{period} day rotation."
+          advice: "Rotate the key on the Settings page, or read the signing_keys job in the server log."
+      release:
+        available: "Version %{version} is available."
+        operator: "This release needs a step from an operator. Read its notes before you upgrade."
+        notes: "Release notes"

data/config/locales/en/manage/links.yml

@@ -0,0 +1,20 @@
+en:
+  manage:
+    links:
+      title: "Links"
+      help: "How long each link masks emails stays valid. A link already sent keeps the lifetime it was sent with. An invitation to an organization counts from when it was last sent."
+      invitation: "Invitation to an account"
+      organization_invitation: "Invitation to an organization"
+      password_reset: "Password reset"
+      email_verification: "Email confirmation"
+      default: "%{length} (default)"
+      updated: "Link lifetime saved."
+      minutes:
+        one: "%{count} minute"
+        other: "%{count} minutes"
+      hours:
+        one: "%{count} hour"
+        other: "%{count} hours"
+      days:
+        one: "%{count} day"
+        other: "%{count} days"

data/config/locales/en/manage/machines.yml

@@ -0,0 +1,13 @@
+en:
+  manage:
+    machines:
+      title: "Machines"
+      lede: "Clients this app enrolled with an enrollment token. Each one signs in with its own key."
+      empty: "This app has not enrolled a machine yet."
+      last_seen: "Last signed in %{day}"
+      never: "Never signed in"
+      enrolled: "Enrolled %{day}"
+      enrolled_by: "A machine enrolled by"
+      revoke: "Revoke"
+      revoke_confirm: "Revoke %{name}? It is archived, every token it holds ends, and it can no longer sign in."
+      revoked: "%{name} is revoked and can no longer sign in."

data/config/locales/es/access_requests.yml

@@ -0,0 +1,43 @@
+es:
+  authorize:
+    error:
+      asking: "Tu cuenta no está en ningún grupo que pueda usar %{app}. Puedes pedir acceso. Quienes gestionan %{app} deciden, y recibirás un correo en cualquier caso."
+      ask: "Pedir acceso"
+      asked: "Tu solicitud se envió. Recibirás un correo cuando se decida."
+      waiting: "Tu solicitud para usar %{app} está pendiente. Recibirás un correo cuando se decida."
+      slow_down: "Pediste acceso a esta aplicación hace menos de una hora. Espera la respuesta."
+      back: "Volver a %{app}"
+      the_app: "la aplicación"
+
+  account:
+    index:
+      access:
+        heading: "Pidieron acceso"
+        lede: "Estas personas fueron rechazadas por una aplicación que admite a los miembros de %{organization}. Al aprobar, pasan a ser miembros con el rol que elijas."
+        asked: "Pidió usar %{app} hace %{age}"
+        role_of: "Rol para %{name}"
+        grant: "Aprobar"
+        decline: "Rechazar"
+        confirm_decline: "¿Rechazar la solicitud de %{identifier} para usar %{app}? Recibirá un correo y podrá volver a pedirlo en una hora."
+
+  organization_access:
+    granted: "%{identifier} ahora es %{role} de %{organization} y puede usar %{app}."
+    declined: "La solicitud de %{identifier} para usar %{app} fue rechazada."
+    unknown: "Esa solicitud no está pendiente de %{organization}."
+
+  actor_mailer:
+    access_granted:
+      subject: "Ya puedes usar %{app}"
+      lede: "Tu solicitud para usar %{app} en %{tenant} fue aprobada. Vuelve a iniciar sesión en %{app} y entrarás."
+      action: "Abrir %{app}"
+    access_declined:
+      subject: "Tu solicitud para usar %{app} fue rechazada"
+      lede: "Alguien que gestiona %{app} en %{tenant} rechazó tu solicitud de acceso."
+      again: "Si crees que es un error, pregúntale directamente. Puedes volver a pedirlo en una hora."
+
+  events:
+    actions:
+      access:
+        requested: "Pidió acceso a una aplicación"
+        granted: "Acceso a una aplicación concedido"
+        declined: "Acceso a una aplicación rechazado"

data/config/locales/es/account/app_passwords.yml

@@ -0,0 +1,42 @@
+es:
+  account:
+    index:
+      app_passwords:
+        heading: "Contraseñas de aplicación"
+        entry: "Contraseñas de aplicación"
+        state:
+          none: "Ninguna"
+        lede: "Una contraseña de aplicación permite que una sola aplicación, como un servidor multimedia o un NAS, inicie sesión como tú sin tu segundo factor. Solo sirve para la aplicación para la que se creó."
+        shown_once: "Esta es la contraseña de aplicación de %{name}. Se muestra una sola vez. Introdúcela ahora en %{app}."
+        made_ago: "creada hace %{age}"
+        used_ago: "usada por última vez hace %{age}"
+        never_used: "nunca usada"
+        revoke: "Revocar"
+        confirm_revoke: "¿Revocar %{name}? La aplicación deja de iniciar sesión con ella de inmediato."
+        name: "Nombre"
+        name_placeholder: "Jellyfin en la tele"
+        app: "Aplicación"
+        make: "Crear contraseña de aplicación"
+        make_again: "Vuelve a iniciar sesión para crear una"
+        hint: "Tu propia contraseña y tus llaves de acceso no cambian. Revocar una contraseña de aplicación no cambia nada más."
+        none_offered: "Ninguna aplicación acepta contraseñas de aplicación todavía."
+  app_passwords:
+    again: "Vuelve a iniciar sesión para crear una contraseña de aplicación. Hace tiempo que no lo haces."
+    unknown: "No hay tal contraseña de aplicación en esta cuenta."
+    revoked: "%{name} está revocada."
+    refused:
+      name: "Da a la contraseña de aplicación un nombre de hasta 64 caracteres."
+      app: "Esa aplicación no acepta contraseñas de aplicación."
+      too_many: "Ya tienes %{most} contraseñas de aplicación. Revoca una primero."
+  events:
+    actions:
+      app_password:
+        created: "Contraseña de aplicación creada"
+        used: "Sesión iniciada con una contraseña de aplicación"
+        revoked: "Contraseña de aplicación revocada"
+  actor_mailer:
+    notification:
+      said:
+        app_password:
+          created: "Se creó una contraseña de aplicación en tu cuenta de %{tenant}. Con ella una aplicación inicia sesión sin tu segundo factor."
+          revoked: "Se revocó una contraseña de aplicación de tu cuenta de %{tenant}."

data/config/locales/es/events.yml

@@ -157,6 +157,13 @@ es:
         exported: "Actividad exportada"
       mail_template:
         updated: "Plantilla de correo cambiada"
+      job:
+        failed: "Tarea en segundo plano fallida para este inquilino"
+      health:
+        failing: "Comprobación de estado fallando"
+        recovered: "Comprobación de estado recuperada"
+      release:
+        available: "Nueva versión disponible"
       stream:
         created: "Flujo de eventos añadido"
         updated: "Flujo de eventos cambiado"
@@ -171,6 +178,8 @@ es:
       signal:
         undelivered: "Señal compartida no entregada"
         received: "El proveedor señaló un cierre de sesión"
+      text:
+        undelivered: "Mensaje de texto no entregado"
       organization:
         created: "Organización añadida"
         updated: "Organización cambiada"

data/config/locales/es/flashes.yml

@@ -163,3 +163,4 @@ es:
   forward_auth:
     unknown: "No hay ninguna aplicación detrás de un proxy registrada en esa dirección."
     not_admitted: "Tu cuenta no puede usar %{app}."
+    denied: "Esta página de %{app} está cerrada para todos."

data/config/locales/es/group_sources.yml

@@ -0,0 +1,5 @@
+es:
+  events:
+    actions:
+      group:
+        refreshed: "Grupo llenado desde su origen"

data/config/locales/es/handshakes.yml

@@ -26,7 +26,7 @@ es:
       area_yours: " Tú los recibes todos ahora."
       also: "%{name} también puede"
       details: "Detalles técnicos"
-      scopes: "Scopes"
+      scopes: "Alcances"
       client: "Credenciales"
       credentials:
         public: "Pública. No guarda ningún secreto."

data/config/locales/es/manage/access_requests.yml

@@ -0,0 +1,12 @@
+es:
+  manage:
+    access_requests:
+      title: "Solicitudes de acceso"
+      lede: "Actores que fueron rechazados por este cliente y pidieron acceso. Al aprobar, pasan a uno de los grupos que admite, y reciben un correo en cualquier caso."
+      empty: "Nadie está esperando acceso."
+      asked: "Pedido %{day}"
+      as: "Grupo al que pasan"
+      grant: "Aprobar"
+      decline: "Rechazar"
+      granted: "%{identifier} ya está en %{label} y puede iniciar sesión."
+      declined: "La solicitud de %{identifier} fue rechazada."

data/config/locales/es/manage/app_passwords.yml

@@ -0,0 +1,16 @@
+es:
+  manage:
+    client:
+      sign_in:
+        app_passwords: "Aceptar contraseñas de aplicación"
+        app_passwords_help: "Los actores crean una contraseña de aplicación para este cliente en su página de cuenta. Les inicia sesión por LDAP y forward auth sin segundo factor, solo en este cliente."
+      notices:
+        app_passwords_on: "Los actores ya pueden crear una contraseña de aplicación para él."
+        app_passwords_off: "Sus contraseñas de aplicación se rechazan a partir de ahora."
+    ldap:
+      connect:
+        app: "Aplicación"
+        no_app: "Sin aplicación"
+        app_help: "Elige el cliente con el que está registrado el servicio. Las contraseñas de aplicación de los actores para ese cliente se enlazan entonces en una conexión que se enlazó primero con esta credencial."
+      credentials:
+        app: "Acepta contraseñas de aplicación de %{name}"

data/config/locales/es/manage/forward_auth_rules.yml

@@ -0,0 +1,29 @@
+es:
+  manage:
+    forward_auth_rules:
+      title: "Reglas"
+      lede: "La primera regla que cubre una solicitud la decide. Una solicitud sin regla necesita una persona con sesión iniciada que pueda iniciar sesión."
+      empty: "No hay reglas. Cada solicitud necesita una persona con sesión iniciada que pueda iniciar sesión."
+      paths: "Rutas"
+      paths_hint: "Una por línea. * cubre un segmento y ** cualquier profundidad, así que /admin/** cubre /admin y todo lo que hay debajo. Vacío cubre todas las rutas."
+      methods: "Métodos"
+      methods_hint: "GET, POST y los demás. Vacío cubre todos los métodos."
+      networks: "Redes"
+      networks_hint: "Direcciones o rangos, como 192.168.0.0/16. Vacío cubre todas las direcciones."
+      groups: "Grupos"
+      groups_hint: "Claves de grupo, o roles como clave:rol. Vacío cubre a todos."
+      outcome: "Resultado"
+      outcomes:
+        open: "Abierto a todos, sin iniciar sesión"
+        one_factor: "Una persona con sesión iniciada, sin segundo factor"
+        two_factor: "Una persona con sesión iniciada, con su segundo factor"
+        token: "Una persona con sesión iniciada, o un script con un token de acceso"
+        deny: "Cerrado para todos"
+      rule: "Regla %{number}"
+      add: "Añadir regla"
+      remove: "Quitar"
+      up: "Subir"
+      down: "Bajar"
+      save: "Guardar reglas"
+      saved: "Reglas guardadas."
+      trust: "Una regla de red confía en la dirección que envía el proxy. Asegúrate de que el proxy establece X-Forwarded-For por sí mismo."

data/config/locales/es/manage/group_sources.yml

@@ -0,0 +1,44 @@
+es:
+  manage:
+    group_sources:
+      source: "Se llena desde"
+      sources:
+        manual: "Personas añadidas a mano"
+        rule: "Una regla"
+        provider: "Un proveedor"
+        group: "Otros grupos"
+      ledes:
+        manual: "Un gestor añade y quita personas desde sus propias páginas."
+        rule: "Todas las personas que cumplen cada condición. Una dirección de correo cuenta cuando está verificada. Un campo del perfil cuenta solo cuando lo fija un directorio, porque las personas no pueden cambiarlo. Se comprueba al cambiar un perfil y cada hora."
+        provider: "Todas las personas cuyo último inicio de sesión con el proveedor incluyó el grupo."
+        group: "Todas las personas en alguno de los grupos o roles de organización superiores."
+      change: "Cambiar cómo se llena %{name}"
+      kinds:
+        email_domain: "La dirección de correo termina en"
+        profile: "El campo del perfil es igual a"
+      field: "Campo"
+      value: "Valor"
+      add_condition: "Añadir condición"
+      remove_condition: "Quitar condición"
+      provider: "Proveedor"
+      choose_provider: "Elige un proveedor"
+      no_providers: "Añade primero un proveedor."
+      upstream_group: "Nombre del grupo en el proveedor"
+      parent_labels: "Grupos superiores"
+      parent_labels_hint: "Claves de grupo o roles de organización como clave:rol, separados por comas."
+      save: "Guardar"
+      cancel: "Cancelar"
+      saved: "%{name} ahora se llena desde %{source}."
+      refresh: "Actualizar ahora"
+      refreshed: "%{name} se actualizó."
+      refreshed_at: "Actualizado %{when}."
+      never_refreshed: "Aún no se actualizó."
+      summary:
+        rule: "Se llena por regla"
+        provider: "Se llena desde %{provider}"
+        group: "Se llena desde %{parents}"
+      by_hand: "Añadido a mano, así que solo un gestor lo quita."
+      from:
+        rule: "En el grupo por su regla, así que la regla decide."
+        provider: "En el grupo por un inicio de sesión con el proveedor, así que el proveedor decide."
+        group: "En el grupo a través de un grupo superior, así que ese grupo decide."