masks-server 0.11.0 → 0.12.0

data/config/locales/de/manage/forward_auth_rules.yml

@@ -0,0 +1,29 @@
+de:
+  manage:
+    forward_auth_rules:
+      title: "Regeln"
+      lede: "Die erste Regel, die eine Anfrage abdeckt, entscheidet sie. Eine Anfrage ohne passende Regel braucht eine angemeldete Person, die sich anmelden darf."
+      empty: "Es gibt keine Regeln. Jede Anfrage braucht eine angemeldete Person, die sich anmelden darf."
+      paths: "Pfade"
+      paths_hint: "Einer pro Zeile. * deckt ein Segment ab und ** jede Tiefe, also deckt /admin/** /admin und alles darunter ab. Leer deckt jeden Pfad ab."
+      methods: "Methoden"
+      methods_hint: "GET, POST und so weiter. Leer deckt jede Methode ab."
+      networks: "Netzwerke"
+      networks_hint: "Adressen oder Bereiche wie 192.168.0.0/16. Leer deckt jede Adresse ab."
+      groups: "Gruppen"
+      groups_hint: "Gruppenschlüssel oder Rollen als schlüssel:rolle. Leer deckt alle ab."
+      outcome: "Ergebnis"
+      outcomes:
+        open: "Offen für alle, ohne Anmeldung"
+        one_factor: "Eine angemeldete Person, ohne zweiten Faktor"
+        two_factor: "Eine angemeldete Person, mit ihrem zweiten Faktor"
+        token: "Eine angemeldete Person oder ein Skript mit einem Zugriffstoken"
+        deny: "Für alle gesperrt"
+      rule: "Regel %{number}"
+      add: "Regel hinzufügen"
+      remove: "Entfernen"
+      up: "Nach oben"
+      down: "Nach unten"
+      save: "Regeln speichern"
+      saved: "Regeln gespeichert."
+      trust: "Eine Netzwerkregel vertraut der Adresse, die der Proxy sendet. Stellen Sie sicher, dass der Proxy X-Forwarded-For selbst setzt."

data/config/locales/de/manage/group_sources.yml

@@ -0,0 +1,44 @@
+de:
+  manage:
+    group_sources:
+      source: "Füllt sich aus"
+      sources:
+        manual: "Von Hand hinzugefügte Personen"
+        rule: "Einer Regel"
+        provider: "Einem Anbieter"
+        group: "Anderen Gruppen"
+      ledes:
+        manual: "Ein Verwalter fügt Personen auf deren eigenen Seiten hinzu und entfernt sie dort."
+        rule: "Alle, die jede Bedingung erfüllen. Eine E-Mail-Adresse zählt, sobald sie bestätigt ist. Ein Profilfeld zählt nur, wenn ein Verzeichnis es setzt, denn solche Felder können Personen nicht ändern. Geprüft bei jeder Profiländerung und jede Stunde."
+        provider: "Alle, deren letzte Anmeldung über den Anbieter die Gruppe aufgeführt hat."
+        group: "Alle in einer der übergeordneten Gruppen oder Organisationsrollen."
+      change: "Ändern, wie sich %{name} füllt"
+      kinds:
+        email_domain: "E-Mail-Adresse endet auf"
+        profile: "Profilfeld ist gleich"
+      field: "Feld"
+      value: "Wert"
+      add_condition: "Bedingung hinzufügen"
+      remove_condition: "Bedingung entfernen"
+      provider: "Anbieter"
+      choose_provider: "Anbieter wählen"
+      no_providers: "Fügen Sie zuerst einen Anbieter hinzu."
+      upstream_group: "Gruppenname beim Anbieter"
+      parent_labels: "Übergeordnete Gruppen"
+      parent_labels_hint: "Gruppenschlüssel oder Organisationsrollen als schlüssel:rolle, durch Kommas getrennt."
+      save: "Speichern"
+      cancel: "Abbrechen"
+      saved: "%{name} füllt sich jetzt aus %{source}."
+      refresh: "Jetzt auffrischen"
+      refreshed: "%{name} ist aufgefrischt."
+      refreshed_at: "Aufgefrischt %{when}."
+      never_refreshed: "Noch nicht aufgefrischt."
+      summary:
+        rule: "Füllt sich per Regel"
+        provider: "Füllt sich aus %{provider}"
+        group: "Füllt sich aus %{parents}"
+      by_hand: "Von Hand hinzugefügt, daher entfernt nur ein Verwalter die Person."
+      from:
+        rule: "Durch die Regel in der Gruppe, daher entscheidet die Regel."
+        provider: "Durch eine Anmeldung beim Anbieter in der Gruppe, daher entscheidet der Anbieter."
+        group: "Über eine übergeordnete Gruppe in der Gruppe, daher entscheidet diese."

data/config/locales/de/manage/health.yml

@@ -0,0 +1,78 @@
+de:
+  manage:
+    health:
+      title: "Zustand"
+      lede: "Die Prüfungen laufen alle 10 Minuten. Jede sagt, was sie gefunden hat und was zu tun ist."
+      check_now: "Jetzt prüfen"
+      checking: "Prüft"
+      checked: "Geprüft %{when}"
+      never: "Die Prüfungen sind noch nicht gelaufen. Sie laufen alle 10 Minuten, sobald ein Worker läuft."
+      failed: "Die Prüfungen konnten nicht laufen: %{failure}"
+      statuses:
+        ok: "In Ordnung"
+        warning: "Braucht einen Blick"
+        failing: "Fehlgeschlagen"
+      checks:
+        jobs:
+          title: "Hintergrundjobs"
+          elsewhere: "Jobs laufen auf einem anderen Server."
+          none: "Am letzten Tag ist kein Job fehlgeschlagen."
+          failed:
+            one: "Eine Art Job ist am letzten Tag fehlgeschlagen: %{jobs}."
+            other: "%{count} Arten von Jobs sind am letzten Tag fehlgeschlagen: %{jobs}."
+          advice: "Lesen Sie den Fehler im Serverprotokoll. Jeder Job läuft nach seinem Zeitplan erneut."
+        worker:
+          title: "Worker"
+          elsewhere: "Jobs laufen auf einem anderen Server."
+          unchecked: "Die Worker-Prüfung ist aus."
+          reporting: "Ein Worker läuft."
+          silent: "In den letzten %{minutes} Minuten hat sich kein Worker gemeldet."
+          advice: "Starten Sie den Jobs-Prozess, oder setzen Sie MASKS_JOBS_IN_WEB_SERVER auf true, damit der Webserver die Jobs ausführt."
+        queue:
+          title: "Warteschlange"
+          elsewhere: "Jobs laufen auf einem anderen Server."
+          unchecked: "Die Warteschlangen-Prüfung ist aus."
+          moving: "Jobs starten pünktlich."
+          stuck: "Ein Job wartet seit %{since} auf seinen Start, länger als %{minutes} Minuten."
+          advice: "Fügen Sie einen Worker hinzu, oder erhöhen Sie JOB_CONCURRENCY, damit mehr Jobs gleichzeitig laufen."
+        ldap:
+          title: "LDAP"
+          tls: "LDAP antwortet mit TLS."
+          local: "LDAP antwortet nur auf der eigenen Maschine des Servers."
+          plain: "LDAP antwortet auf Port %{port} ohne TLS, also gehen Passwörter im Klartext durchs Netz."
+          advice: "Setzen Sie MASKS_LDAP_CERT und MASKS_LDAP_KEY, oder entfernen Sie MASKS_LDAP_PLAINTEXT."
+        metrics:
+          title: "Metriken"
+          "off": "Die Metrikseite ist aus."
+          "on": "Die Metrikseite beantwortet Anfragen, die ihr Token tragen."
+          short: "Das Metrik-Token ist %{length} Zeichen lang und lässt sich erraten."
+          advice: "Setzen Sie MASKS_METRICS_TOKEN auf mindestens %{needed} zufällige Zeichen."
+        mail:
+          title: "E-Mail"
+          none: "Kein E-Mail-Dienst ist eingerichtet."
+          answers: "Der Mailserver antwortet."
+          silent: "Der Mailserver hat nicht geantwortet: %{error}."
+          advice: "Prüfen Sie Server, Port und TLS-Einstellung auf der Seite Nachrichten, und ob der Server Verbindungen von hier zulässt."
+        origin:
+          title: "Öffentliche Adresse"
+          unset: "Keine öffentliche Adresse ist gesetzt, also folgt masks dem Host-Header jeder Anfrage."
+          matches: "Anfragen kommen an der öffentlichen Adresse dieses Mandanten an."
+          mismatch: "Anfragen kommen als %{seen} an, aber die Adresse dieses Mandanten ist %{origin}."
+          advice: "Lassen Sie den Proxy X-Forwarded-Proto und X-Forwarded-Host senden, und tragen Sie ihn in MASKS_TRUSTED_PROXIES ein."
+        domains:
+          title: "Domains"
+          none: "Keine Domain ist beansprucht."
+          proven: "Jede beanspruchte Domain hat noch ihren TXT-Eintrag."
+          missing: "Der TXT-Eintrag fehlt für %{domains}. Ein Anspruch wird eine Woche nach dem Verschwinden seines Eintrags freigegeben."
+          advice: "Legen Sie den TXT-Eintrag wieder unter dem Namen an, der auf der Seite Domains steht."
+        keys:
+          title: "Signaturschlüssel"
+          missing: "Dieser Mandant hat keinen aktiven Signaturschlüssel, also kann nichts signiert werden."
+          manual: "Schlüssel werden von Hand rotiert. Der aktive Schlüssel ist %{days} Tage alt."
+          fresh: "Der aktive Schlüssel ist %{days} Tage alt und rotiert alle %{period} Tage."
+          stale: "Der aktive Schlüssel ist %{days} Tage alt, älter als seine Rotation von %{period} Tagen."
+          advice: "Rotieren Sie den Schlüssel auf der Seite Einstellungen, oder lesen Sie den Job signing_keys im Serverprotokoll."
+      release:
+        available: "Version %{version} ist verfügbar."
+        operator: "Diese Version braucht einen Schritt von einem Betreiber. Lesen Sie ihre Hinweise vor dem Upgrade."
+        notes: "Versionshinweise"

data/config/locales/de/manage/links.yml

@@ -0,0 +1,20 @@
+de:
+  manage:
+    links:
+      title: "Links"
+      help: "Wie lange jeder Link gültig ist, den masks per E-Mail sendet. Ein bereits gesendeter Link behält die Gültigkeit, mit der er gesendet wurde. Eine Einladung in eine Organisation zählt ab dem letzten Senden."
+      invitation: "Einladung zu einem Konto"
+      organization_invitation: "Einladung in eine Organisation"
+      password_reset: "Passwort zurücksetzen"
+      email_verification: "E-Mail-Bestätigung"
+      default: "%{length} (Standard)"
+      updated: "Gültigkeit des Links gespeichert."
+      minutes:
+        one: "%{count} Minute"
+        other: "%{count} Minuten"
+      hours:
+        one: "%{count} Stunde"
+        other: "%{count} Stunden"
+      days:
+        one: "%{count} Tag"
+        other: "%{count} Tage"

data/config/locales/en/access_requests.yml

@@ -0,0 +1,43 @@
+en:
+  authorize:
+    error:
+      asking: "Your account is not in a group that may use %{app}. You can ask for access. The people who run %{app} decide, and you get an email either way."
+      ask: "Ask for access"
+      asked: "Your request was sent. You get an email once it is decided."
+      waiting: "Your request to use %{app} is waiting. You get an email once it is decided."
+      slow_down: "You asked for access to this app less than an hour ago. Wait for the answer."
+      back: "Back to %{app}"
+      the_app: "the app"
+
+  account:
+    index:
+      access:
+        heading: "Asked for access"
+        lede: "These people were turned away from an app that admits members of %{organization}. Approving makes them a member with the role you pick."
+        asked: "Asked to use %{app} %{age} ago"
+        role_of: "Role for %{name}"
+        grant: "Approve"
+        decline: "Decline"
+        confirm_decline: "Decline %{identifier}'s request to use %{app}? They get an email, and they can ask again in an hour."
+
+  organization_access:
+    granted: "%{identifier} is %{role} of %{organization} now and can use %{app}."
+    declined: "%{identifier}'s request to use %{app} is declined."
+    unknown: "That request is not waiting on %{organization}."
+
+  actor_mailer:
+    access_granted:
+      subject: "You can use %{app} now"
+      lede: "Your request to use %{app} at %{tenant} was approved. Sign in to %{app} again and you are let in."
+      action: "Open %{app}"
+    access_declined:
+      subject: "Your request to use %{app} was declined"
+      lede: "Somebody who runs %{app} at %{tenant} declined your request for access."
+      again: "If you think this is a mistake, ask them directly. You can ask again in an hour."
+
+  events:
+    actions:
+      access:
+        requested: "Asked for access to an app"
+        granted: "Access to an app granted"
+        declined: "Access to an app declined"

data/config/locales/en/account/app_passwords.yml

@@ -0,0 +1,42 @@
+en:
+  account:
+    index:
+      app_passwords:
+        heading: "App passwords"
+        entry: "App passwords"
+        state:
+          none: "None"
+        lede: "An app password lets one app, such as a media server or a NAS, sign in as you without your second factor. It works for the app it was made for and nothing else."
+        shown_once: "This is the app password for %{name}. It is shown once. Enter it in %{app} now."
+        made_ago: "made %{age} ago"
+        used_ago: "last used %{age} ago"
+        never_used: "never used"
+        revoke: "Revoke"
+        confirm_revoke: "Revoke %{name}? The app stops signing in with it right away."
+        name: "Name"
+        name_placeholder: "Jellyfin on the TV"
+        app: "App"
+        make: "Make app password"
+        make_again: "Sign in again to make one"
+        hint: "Your own password and passkeys stay as they are. Revoking an app password changes nothing else."
+        none_offered: "No app accepts app passwords yet."
+  app_passwords:
+    again: "Sign in again to make an app password. It has been a while since you did."
+    unknown: "There is no such app password on this account."
+    revoked: "%{name} is revoked."
+    refused:
+      name: "Give the app password a name of up to 64 characters."
+      app: "That app does not accept app passwords."
+      too_many: "You already have %{most} app passwords. Revoke one first."
+  events:
+    actions:
+      app_password:
+        created: "App password made"
+        used: "Signed in with an app password"
+        revoked: "App password revoked"
+  actor_mailer:
+    notification:
+      said:
+        app_password:
+          created: "An app password was made on your %{tenant} account. It signs in to one app without your second factor."
+          revoked: "An app password on your %{tenant} account was revoked."

data/config/locales/en/events.yml

@@ -159,6 +159,11 @@ en:
         updated: "Email template changed"
       job:
         failed: "Background job failed for this tenant"
+      health:
+        failing: "Health check failing"
+        recovered: "Health check recovered"
+      release:
+        available: "New release available"
       stream:
         created: "Event stream added"
         updated: "Event stream changed"

data/config/locales/en/flashes.yml

@@ -163,3 +163,4 @@ en:
   forward_auth:
     unknown: "No app behind a proxy is registered at that address."
     not_admitted: "Your account may not use %{app}."
+    denied: "This page of %{app} is closed to everyone."

data/config/locales/en/group_sources.yml

@@ -0,0 +1,5 @@
+en:
+  events:
+    actions:
+      group:
+        refreshed: "Group filled from its source"

data/config/locales/en/manage/access_requests.yml

@@ -0,0 +1,12 @@
+en:
+  manage:
+    access_requests:
+      title: "Access requests"
+      lede: "Actors who were turned away from this client and asked for access. Approving puts them in one of the groups it allows, and they get an email either way."
+      empty: "Nobody is waiting for access."
+      asked: "Asked %{day}"
+      as: "Group to put them in"
+      grant: "Approve"
+      decline: "Decline"
+      granted: "%{identifier} is in %{label} now and can sign in."
+      declined: "%{identifier}'s request is declined."

data/config/locales/en/manage/app_passwords.yml

@@ -0,0 +1,16 @@
+en:
+  manage:
+    client:
+      sign_in:
+        app_passwords: "Accept app passwords"
+        app_passwords_help: "People make an app password for this client on their account page. It signs them in over LDAP and forward auth without a second factor, for this client alone."
+      notices:
+        app_passwords_on: "People can make an app password for it now."
+        app_passwords_off: "Its app passwords are refused from now on."
+    ldap:
+      connect:
+        app: "App"
+        no_app: "No app"
+        app_help: "Choose the client the service is registered as. People's app passwords for that client then bind on a connection that bound with this credential first."
+      credentials:
+        app: "Accepts app passwords for %{name}"

data/config/locales/en/manage/forward_auth_rules.yml

@@ -0,0 +1,29 @@
+en:
+  manage:
+    forward_auth_rules:
+      title: "Rules"
+      lede: "The first rule that covers a request decides it. A request no rule covers needs a signed-in person who may sign in."
+      empty: "There are no rules. Every request needs a signed-in person who may sign in."
+      paths: "Paths"
+      paths_hint: "One per line. * covers one segment and ** covers any depth, so /admin/** covers /admin and everything under it. Empty covers every path."
+      methods: "Methods"
+      methods_hint: "GET, POST, and so on. Empty covers every method."
+      networks: "Networks"
+      networks_hint: "Addresses or ranges, such as 192.168.0.0/16. Empty covers every address."
+      groups: "Groups"
+      groups_hint: "Group keys, or roles as key:role. Empty covers everyone."
+      outcome: "Outcome"
+      outcomes:
+        open: "Open to everyone, with no sign-in"
+        one_factor: "A signed-in person, without a second factor"
+        two_factor: "A signed-in person, with their second factor"
+        token: "A signed-in person, or a script with an access token"
+        deny: "Closed to everyone"
+      rule: "Rule %{number}"
+      add: "Add rule"
+      remove: "Remove"
+      up: "Move up"
+      down: "Move down"
+      save: "Save rules"
+      saved: "Rules saved."
+      trust: "A network rule trusts the address the proxy sends. Make sure the proxy sets X-Forwarded-For itself."

data/config/locales/en/manage/group_sources.yml

@@ -0,0 +1,44 @@
+en:
+  manage:
+    group_sources:
+      source: "Fills from"
+      sources:
+        manual: "People added by hand"
+        rule: "A rule"
+        provider: "A provider"
+        group: "Other groups"
+      ledes:
+        manual: "A manager adds and removes people on their own pages."
+        rule: "Everyone who matches every condition. An email address counts once it is verified. A profile field counts only when a directory sets it, since people cannot change those. Checked when a profile changes and every hour."
+        provider: "Everyone whose last sign-in through the provider listed the group."
+        group: "Everyone in any of the parent groups or organization roles."
+      change: "Change how %{name} fills"
+      kinds:
+        email_domain: "Email address ends with"
+        profile: "Profile field equals"
+      field: "Field"
+      value: "Value"
+      add_condition: "Add condition"
+      remove_condition: "Remove condition"
+      provider: "Provider"
+      choose_provider: "Choose a provider"
+      no_providers: "Add a provider first."
+      upstream_group: "Group name at the provider"
+      parent_labels: "Parent groups"
+      parent_labels_hint: "Group keys or organization roles as key:role, separated by commas."
+      save: "Save"
+      cancel: "Cancel"
+      saved: "%{name} now fills from %{source}."
+      refresh: "Refresh now"
+      refreshed: "%{name} is refreshed."
+      refreshed_at: "Refreshed %{when}."
+      never_refreshed: "Not refreshed yet."
+      summary:
+        rule: "Fills by rule"
+        provider: "Fills from %{provider}"
+        group: "Fills from %{parents}"
+      by_hand: "Added by hand, so only a manager removes them."
+      from:
+        rule: "In the group by its rule, so the rule decides."
+        provider: "In the group from a provider sign-in, so the provider decides."
+        group: "In the group through a parent group, so the parent decides."

data/config/locales/en/manage/health.yml

@@ -0,0 +1,78 @@
+en:
+  manage:
+    health:
+      title: "Health"
+      lede: "Checks run every 10 minutes. Each one says what it found and what to do."
+      check_now: "Check now"
+      checking: "Checking"
+      checked: "Checked %{when}"
+      never: "The checks have not run yet. They run every 10 minutes once a worker is up."
+      failed: "The checks could not run: %{failure}"
+      statuses:
+        ok: "Fine"
+        warning: "Needs a look"
+        failing: "Failing"
+      checks:
+        jobs:
+          title: "Background jobs"
+          elsewhere: "Jobs run on another server."
+          none: "No job failed in the last day."
+          failed:
+            one: "One kind of job failed in the last day: %{jobs}."
+            other: "%{count} kinds of job failed in the last day: %{jobs}."
+          advice: "Read the error in the server log. Each job runs again on its schedule."
+        worker:
+          title: "Worker"
+          elsewhere: "Jobs run on another server."
+          unchecked: "The worker check is off."
+          reporting: "A worker is running."
+          silent: "No worker has reported in the last %{minutes} minutes."
+          advice: "Start the jobs process, or set MASKS_JOBS_IN_WEB_SERVER to true so the web server runs jobs."
+        queue:
+          title: "Queue"
+          elsewhere: "Jobs run on another server."
+          unchecked: "The queue check is off."
+          moving: "Jobs start on time."
+          stuck: "A job has waited to start since %{since}, longer than %{minutes} minutes."
+          advice: "Add a worker, or raise JOB_CONCURRENCY so more jobs run at once."
+        ldap:
+          title: "LDAP"
+          tls: "LDAP answers with TLS."
+          local: "LDAP answers only on the server's own machine."
+          plain: "LDAP answers on port %{port} without TLS, so passwords cross the network in the clear."
+          advice: "Set MASKS_LDAP_CERT and MASKS_LDAP_KEY, or unset MASKS_LDAP_PLAINTEXT."
+        metrics:
+          title: "Metrics"
+          "off": "The metrics page is off."
+          "on": "The metrics page answers a request that carries its token."
+          short: "The metrics token is %{length} characters long, so it can be guessed."
+          advice: "Set MASKS_METRICS_TOKEN to at least %{needed} random characters."
+        mail:
+          title: "Mail"
+          none: "No mail service is set up."
+          answers: "The mail server answers."
+          silent: "The mail server did not answer: %{error}."
+          advice: "Check the server, port, and TLS setting on the Messages page, and that the server allows this one to connect."
+        origin:
+          title: "Public address"
+          unset: "No public address is set, so masks follows each request's Host header."
+          matches: "Requests arrive at this tenant's public address."
+          mismatch: "Requests arrive as %{seen}, but this tenant's address is %{origin}."
+          advice: "Have the proxy send X-Forwarded-Proto and X-Forwarded-Host, and list it in MASKS_TRUSTED_PROXIES."
+        domains:
+          title: "Domains"
+          none: "No domain is claimed."
+          proven: "Every claimed domain still has its TXT record."
+          missing: "The TXT record is gone for %{domains}. A claim is released a week after its record disappears."
+          advice: "Put the TXT record back at the name shown on the Domains page."
+        keys:
+          title: "Signing keys"
+          missing: "This tenant has no active signing key, so nothing can be signed."
+          manual: "Keys rotate by hand. The active key is %{days} days old."
+          fresh: "The active key is %{days} days old and rotates every %{period} days."
+          stale: "The active key is %{days} days old, past its %{period} day rotation."
+          advice: "Rotate the key on the Settings page, or read the signing_keys job in the server log."
+      release:
+        available: "Version %{version} is available."
+        operator: "This release needs a step from an operator. Read its notes before you upgrade."
+        notes: "Release notes"

data/config/locales/en/manage/links.yml

@@ -0,0 +1,20 @@
+en:
+  manage:
+    links:
+      title: "Links"
+      help: "How long each link masks emails stays valid. A link already sent keeps the lifetime it was sent with. An invitation to an organization counts from when it was last sent."
+      invitation: "Invitation to an account"
+      organization_invitation: "Invitation to an organization"
+      password_reset: "Password reset"
+      email_verification: "Email confirmation"
+      default: "%{length} (default)"
+      updated: "Link lifetime saved."
+      minutes:
+        one: "%{count} minute"
+        other: "%{count} minutes"
+      hours:
+        one: "%{count} hour"
+        other: "%{count} hours"
+      days:
+        one: "%{count} day"
+        other: "%{count} days"

data/config/locales/es/access_requests.yml

@@ -0,0 +1,43 @@
+es:
+  authorize:
+    error:
+      asking: "Tu cuenta no está en ningún grupo que pueda usar %{app}. Puedes pedir acceso. Quienes gestionan %{app} deciden, y recibirás un correo en cualquier caso."
+      ask: "Pedir acceso"
+      asked: "Tu solicitud se envió. Recibirás un correo cuando se decida."
+      waiting: "Tu solicitud para usar %{app} está pendiente. Recibirás un correo cuando se decida."
+      slow_down: "Pediste acceso a esta aplicación hace menos de una hora. Espera la respuesta."
+      back: "Volver a %{app}"
+      the_app: "la aplicación"
+
+  account:
+    index:
+      access:
+        heading: "Pidieron acceso"
+        lede: "Estas personas fueron rechazadas por una aplicación que admite a los miembros de %{organization}. Al aprobar, pasan a ser miembros con el rol que elijas."
+        asked: "Pidió usar %{app} hace %{age}"
+        role_of: "Rol para %{name}"
+        grant: "Aprobar"
+        decline: "Rechazar"
+        confirm_decline: "¿Rechazar la solicitud de %{identifier} para usar %{app}? Recibirá un correo y podrá volver a pedirlo en una hora."
+
+  organization_access:
+    granted: "%{identifier} ahora es %{role} de %{organization} y puede usar %{app}."
+    declined: "La solicitud de %{identifier} para usar %{app} fue rechazada."
+    unknown: "Esa solicitud no está pendiente de %{organization}."
+
+  actor_mailer:
+    access_granted:
+      subject: "Ya puedes usar %{app}"
+      lede: "Tu solicitud para usar %{app} en %{tenant} fue aprobada. Vuelve a iniciar sesión en %{app} y entrarás."
+      action: "Abrir %{app}"
+    access_declined:
+      subject: "Tu solicitud para usar %{app} fue rechazada"
+      lede: "Alguien que gestiona %{app} en %{tenant} rechazó tu solicitud de acceso."
+      again: "Si crees que es un error, pregúntale directamente. Puedes volver a pedirlo en una hora."
+
+  events:
+    actions:
+      access:
+        requested: "Pidió acceso a una aplicación"
+        granted: "Acceso a una aplicación concedido"
+        declined: "Acceso a una aplicación rechazado"

data/config/locales/es/account/app_passwords.yml

@@ -0,0 +1,42 @@
+es:
+  account:
+    index:
+      app_passwords:
+        heading: "Contraseñas de aplicación"
+        entry: "Contraseñas de aplicación"
+        state:
+          none: "Ninguna"
+        lede: "Una contraseña de aplicación permite que una sola aplicación, como un servidor multimedia o un NAS, inicie sesión como tú sin tu segundo factor. Solo sirve para la aplicación para la que se creó."
+        shown_once: "Esta es la contraseña de aplicación de %{name}. Se muestra una sola vez. Introdúcela ahora en %{app}."
+        made_ago: "creada hace %{age}"
+        used_ago: "usada por última vez hace %{age}"
+        never_used: "nunca usada"
+        revoke: "Revocar"
+        confirm_revoke: "¿Revocar %{name}? La aplicación deja de iniciar sesión con ella de inmediato."
+        name: "Nombre"
+        name_placeholder: "Jellyfin en la tele"
+        app: "Aplicación"
+        make: "Crear contraseña de aplicación"
+        make_again: "Vuelve a iniciar sesión para crear una"
+        hint: "Tu propia contraseña y tus llaves de acceso no cambian. Revocar una contraseña de aplicación no cambia nada más."
+        none_offered: "Ninguna aplicación acepta contraseñas de aplicación todavía."
+  app_passwords:
+    again: "Vuelve a iniciar sesión para crear una contraseña de aplicación. Hace tiempo que no lo haces."
+    unknown: "No hay tal contraseña de aplicación en esta cuenta."
+    revoked: "%{name} está revocada."
+    refused:
+      name: "Da a la contraseña de aplicación un nombre de hasta 64 caracteres."
+      app: "Esa aplicación no acepta contraseñas de aplicación."
+      too_many: "Ya tienes %{most} contraseñas de aplicación. Revoca una primero."
+  events:
+    actions:
+      app_password:
+        created: "Contraseña de aplicación creada"
+        used: "Sesión iniciada con una contraseña de aplicación"
+        revoked: "Contraseña de aplicación revocada"
+  actor_mailer:
+    notification:
+      said:
+        app_password:
+          created: "Se creó una contraseña de aplicación en tu cuenta de %{tenant}. Con ella una aplicación inicia sesión sin tu segundo factor."
+          revoked: "Se revocó una contraseña de aplicación de tu cuenta de %{tenant}."

data/config/locales/es/events.yml

@@ -159,6 +159,11 @@ es:
         updated: "Plantilla de correo cambiada"
       job:
         failed: "Tarea en segundo plano fallida para este inquilino"
+      health:
+        failing: "Comprobación de estado fallando"
+        recovered: "Comprobación de estado recuperada"
+      release:
+        available: "Nueva versión disponible"
       stream:
         created: "Flujo de eventos añadido"
         updated: "Flujo de eventos cambiado"

data/config/locales/es/flashes.yml

@@ -163,3 +163,4 @@ es:
   forward_auth:
     unknown: "No hay ninguna aplicación detrás de un proxy registrada en esa dirección."
     not_admitted: "Tu cuenta no puede usar %{app}."
+    denied: "Esta página de %{app} está cerrada para todos."

data/config/locales/es/group_sources.yml

@@ -0,0 +1,5 @@
+es:
+  events:
+    actions:
+      group:
+        refreshed: "Grupo llenado desde su origen"

data/config/locales/es/manage/access_requests.yml

@@ -0,0 +1,12 @@
+es:
+  manage:
+    access_requests:
+      title: "Solicitudes de acceso"
+      lede: "Actores que fueron rechazados por este cliente y pidieron acceso. Al aprobar, pasan a uno de los grupos que admite, y reciben un correo en cualquier caso."
+      empty: "Nadie está esperando acceso."
+      asked: "Pedido %{day}"
+      as: "Grupo al que pasan"
+      grant: "Aprobar"
+      decline: "Rechazar"
+      granted: "%{identifier} ya está en %{label} y puede iniciar sesión."
+      declined: "La solicitud de %{identifier} fue rechazada."

data/config/locales/es/manage/app_passwords.yml

@@ -0,0 +1,16 @@
+es:
+  manage:
+    client:
+      sign_in:
+        app_passwords: "Aceptar contraseñas de aplicación"
+        app_passwords_help: "Los actores crean una contraseña de aplicación para este cliente en su página de cuenta. Les inicia sesión por LDAP y forward auth sin segundo factor, solo en este cliente."
+      notices:
+        app_passwords_on: "Los actores ya pueden crear una contraseña de aplicación para él."
+        app_passwords_off: "Sus contraseñas de aplicación se rechazan a partir de ahora."
+    ldap:
+      connect:
+        app: "Aplicación"
+        no_app: "Sin aplicación"
+        app_help: "Elige el cliente con el que está registrado el servicio. Las contraseñas de aplicación de los actores para ese cliente se enlazan entonces en una conexión que se enlazó primero con esta credencial."
+      credentials:
+        app: "Acepta contraseñas de aplicación de %{name}"