masks-server 0.11.0 → 0.13.0

data/app/models/masks/server/tenant.rb

@@ -31,6 +31,21 @@ module Masks
         end
       end
 
+      class Pooled < StandardError
+        def initialize(message = nil)
+          super(
+            message ||
+            "this server reaches Postgres through a pooler that hands out a different server " \
+            "connection for each transaction. The tenant masks sets on one connection is gone from " \
+            "the next, so a query would see no tenant's rows, or another tenant's. Connect masks to " \
+            "Postgres directly, or run the pooler in session mode."
+          )
+        end
+      end
+
+      POOL_PROBE = "masks.pool_probe".freeze
+      POOL_PROBE_ROUNDS = 3
+
       encrypts :pairwise_salt, :setup_token, key_provider: Server.tenant_key_provider
 
       attribute :uuid, default: -> { SecureRandom.uuid }
@@ -64,6 +79,12 @@ module Masks
 
       IDLE_DAYS = (60..3650)
       RETENTION_DAYS = (30..2555)
+      LINK_LIFETIMES = {
+        invitation_lifetime: (1.hour.to_i..30.days.to_i),
+        organization_invitation_lifetime: (1.hour.to_i..30.days.to_i),
+        password_reset_lifetime: (5.minutes.to_i..1.day.to_i),
+        email_verification_lifetime: (1.hour.to_i..14.days.to_i)
+      }.freeze
 
       validates :named_by, inclusion: { in: NAMES }, allow_nil: true
       validates :accent_color, format: { with: ACCENT }, allow_nil: true
@@ -71,6 +92,18 @@ module Masks
       validates :dynamic_registration, inclusion: { in: REGISTRATIONS }, allow_nil: true
       validates :suspend_after, :delete_after, numericality: { only_integer: true, in: IDLE_DAYS }, allow_nil: true
       validates :event_retention_days, numericality: { only_integer: true, in: RETENTION_DAYS }, allow_nil: true
+      def self.spoken(seconds)
+        unit, length = { "day" => 1.day, "hour" => 1.hour, "minute" => 1.minute }.find { |_, held| (seconds % held).zero? }
+        count = seconds / length
+
+        "#{count} #{unit.pluralize(count)}"
+      end
+
+      LINK_LIFETIMES.each do |name, range|
+        shortest, longest = [ range.begin, range.end ].map { |seconds| spoken(seconds) }
+
+        validates name, numericality: { only_integer: true, in: range, message: "must be from #{shortest} to #{longest}" }
+      end
       validates :delete_after, comparison: { greater_than: :suspend_after, message: "must be longer than suspend after" },
                                if: -> { suspend_after && delete_after }
 
@@ -104,8 +137,20 @@ module Masks
         event_retention_days&.days || Event::RETENTION
       end
 
+      def self.link_lifetime(name, tenant = Current.tenant)
+        (tenant ? tenant[name] : column_defaults.fetch(name.to_s)).seconds
+      end
+
+      def self.default_link_lifetime(name)
+        column_defaults.fetch(name.to_s)
+      end
+
       def public_origin
-        custom_origin || templated_origin
+        custom_origin || templated_origin || held_origin
+      end
+
+      def held_origin
+        pinned_origin if self.class.pins_origin?
       end
 
       def templated_origin
@@ -246,6 +291,10 @@ module Masks
           serving(host) || named(host)
         end
 
+        def pins_origin?
+          ::Rails.configuration.masks.public_origin_template.nil? && ::Rails.configuration.masks.pin_origin
+        end
+
         def served_domain
           template = ::Rails.configuration.masks.public_origin_template
 
@@ -314,10 +363,28 @@ module Masks
 
           raise Exposed, held&.fetch("rolname", nil) unless held && held["bypasses"] == false
           raise Owner, held["rolname"] if held["owns"] && guards_ownership?
+          raise Pooled if pooled?
 
           @isolated = true
         end
 
+        def pooled?
+          return false if connection_pool.size < 2
+
+          POOL_PROBE_ROUNDS.times do
+            mine = SecureRandom.hex(8)
+            connection.exec_query("SELECT set_config($1, $2, false)", "probe", [ POOL_PROBE, mine ])
+
+            return false unless touched_another_connection?
+
+            return true unless connection.select_value("SELECT current_setting('#{POOL_PROBE}', true)") == mine
+          end
+
+          false
+        rescue ActiveRecord::ConnectionTimeoutError
+          false
+        end
+
         def role_privileges
           connection.select_one(<<~SQL)
             SELECT rolname, rolsuper OR rolbypassrls AS bypasses,
@@ -349,23 +416,34 @@ module Masks
         end
 
         def clear!
-          enter(nil)
+          enter(nil, for_transaction: false)
         end
 
         private
 
-          def enter(tenant)
+          def enter(tenant, for_transaction: connection.transaction_open?)
             Current.tenant = tenant
 
             connection.exec_query(
-              "SELECT set_config($1, $2, false)", "tenant",
-              [ TenantIsolation::SETTING, tenant&.id.to_s ]
+              "SELECT set_config($1, $2, $3)", "tenant",
+              [ TenantIsolation::SETTING, tenant&.id.to_s, for_transaction ]
             )
 
             connection.clear_query_cache
           rescue ActiveRecord::ConnectionNotEstablished, ActiveRecord::ConnectionFailed
             nil
           end
+
+          def touched_another_connection?
+            other = connection_pool.checkout
+
+            return false if other.equal?(connection)
+
+            other.exec_query("SELECT set_config($1, $2, false)", "probe", [ POOL_PROBE, "another connection" ])
+            true
+          ensure
+            connection_pool.checkin(other) if other
+          end
       end
 
       def signing_key
@@ -403,7 +481,10 @@ module Masks
       end
 
       def set_up!
-        update!(setup_token: nil) if setup_token.present?
+        self.setup_token = nil
+        self.pinned_origin ||= Current.origin.presence if self.class.pins_origin?
+
+        save! if changed?
       end
 
       def setup_announcement

data/app/models/masks/server/throttle.rb

@@ -0,0 +1,165 @@
+module Masks
+  module Server
+    module Throttle
+      class Invalid < StandardError; end
+
+      Budget = Struct.new(:name, :to, :within, :about, :variable, keyword_init: true) do
+        def key
+          name.to_s
+        end
+
+        def limits
+          { to: to, within: within }
+        end
+
+        def reference
+          "| `#{variable}` | `#{key}` | #{to} in #{within.inspect} | #{about} |"
+        end
+      end
+
+      DEFAULTS = [
+        Budget.new(name: :attempt, to: 10, within: 3.minutes, variable: "MASKS_ATTEMPT_LIMIT",
+                   about: "Sign-in attempts from one IP address. Includes sign-in through a provider, failed LDAP binds, and app passwords."),
+        Budget.new(name: :account_attempt, to: 5, within: 3.minutes, variable: "MASKS_ACCOUNT_ATTEMPT_LIMIT",
+                   about: "Sign-in attempts against one account, from any IP address. Includes failed LDAP binds and app passwords. " \
+                          "Also how often a signed-in account changes its password, email address, or phone number, adds an " \
+                          "authenticator app, or approves a sign-in on another device."),
+        Budget.new(name: :recovery, to: 5, within: 15.minutes, variable: "MASKS_RECOVERY_LIMIT",
+                   about: "Codes and links sent by email or text message. Counted by IP address during sign-in, and by account for " \
+                          "every address or phone number a code goes to, including a phone added or changed during sign-in."),
+        Budget.new(name: :registration, to: 10, within: 10.minutes, variable: "MASKS_REGISTRATION_LIMIT",
+                   about: "Dynamic client registrations from one IP address, and new client metadata documents."),
+        Budget.new(name: :device_code, to: 30, within: 3.minutes, variable: "MASKS_DEVICE_CODE_LIMIT",
+                   about: "Device user codes entered from one IP address."),
+        Budget.new(name: :claim, to: 3, within: 1.hour, variable: "MASKS_CLAIM_LIMIT",
+                   about: "Tenants claimed from one IP address, when a subdomain template claims a tenant on its first visit. " \
+                          "Counted across the whole server."),
+        Budget.new(name: :claim_ceiling, to: 30, within: 1.hour, variable: "MASKS_CLAIM_CEILING",
+                   about: "Tenants claimed from all IP addresses together, under the same template. Counted across the whole server."),
+        Budget.new(name: :token, to: 60, within: 1.minute, variable: "MASKS_TOKEN_LIMIT", about: "Token requests from one IP address."),
+        Budget.new(name: :pushed_authorization, to: 60, within: 1.minute, variable: "MASKS_PUSHED_AUTHORIZATION_LIMIT", about: "Pushed authorization requests from one IP address."),
+        Budget.new(name: :device_authorization, to: 60, within: 1.minute, variable: "MASKS_DEVICE_AUTHORIZATION_LIMIT", about: "Device authorization requests from one IP address."),
+        Budget.new(name: :introspection, to: 120, within: 1.minute, variable: "MASKS_INTROSPECTION_LIMIT", about: "Token introspections from one IP address."),
+        Budget.new(name: :revocation, to: 120, within: 1.minute, variable: "MASKS_REVOCATION_LIMIT", about: "Token revocations from one IP address."),
+        Budget.new(name: :saml, to: 60, within: 1.minute, variable: "MASKS_SAML_LIMIT", about: "SAML sign-in and logout requests from one IP address."),
+        Budget.new(name: :forward_auth, to: 30, within: 1.minute, variable: "MASKS_FORWARD_AUTH_LIMIT", about: "Forward auth sign-ins started or finished from one IP address."),
+        Budget.new(name: :enrollment, to: 30, within: 1.minute, variable: "MASKS_ENROLLMENT_LIMIT", about: "Enrollment tokens redeemed from one IP address."),
+        Budget.new(name: :app_enrollment, to: 60, within: 1.hour, variable: "MASKS_APP_ENROLLMENT_LIMIT", about: "Enrollment tokens one app mints."),
+        Budget.new(name: :invitation, to: 30, within: 1.minute, variable: "MASKS_INVITATION_LIMIT", about: "Organization invitations one account sends or sends again."),
+        Budget.new(name: :export, to: 5, within: 1.hour, variable: "MASKS_EXPORT_LIMIT", about: "Account exports one account asks for."),
+        Budget.new(name: :access_request, to: 1, within: 1.hour, variable: "MASKS_ACCESS_REQUEST_LIMIT", about: "Times one account asks for access to one app."),
+        Budget.new(name: :signal, to: 600, within: 1.minute, variable: "MASKS_SIGNAL_LIMIT", about: "Security events received from one IP address."),
+        Budget.new(name: :scim, to: 600, within: 1.minute, variable: "MASKS_SCIM_LIMIT", about: "SCIM provisioning requests from one IP address.")
+      ].freeze
+
+      NAMES = DEFAULTS.map(&:key).freeze
+
+      module_function
+
+      def budgets
+        @budgets ||= DEFAULTS.to_h { |budget| [ budget.name, budget.dup.tap { |held| held.to = limit_for(budget) } ] }
+      end
+
+      def budget(name)
+        budgets.fetch(name.to_sym) { raise Invalid, "no limit is called #{name}. The limits are #{NAMES.join(', ')}." }
+      end
+
+      def limit(name)
+        budget(name).to
+      end
+
+      def limits(name)
+        budget(name).limits
+      end
+
+      def refused(name, &block)
+        held = budget(name)
+
+        proc { Throttle.hit!(held.name); instance_exec(&block) }
+      end
+
+      def key(name, by, scope: nil, named: nil)
+        held = budget(name)
+
+        [ "rate-limit", scope || "masks/server/#{held.key}", named, by ].compact.join(":")
+      end
+
+      def count!(name, by, scope: nil, named: nil)
+        ::Rails.cache.increment(key(name, by, scope: scope, named: named), 1, expires_in: budget(name).within)
+      end
+
+      def exceeded?(name, by, scope: nil, named: nil, times: 1)
+        ::Rails.cache.read(key(name, by, scope: scope, named: named)).to_i >= budget(name).to * times
+      end
+
+      def crowded?(name, by, scope: nil, named: nil, times: 1)
+        held = budget(name)
+
+        ::Rails.cache.increment(key(name, by, scope: scope, named: named), 1, expires_in: held.within).to_i > held.to * times
+      end
+
+      def hit!(name, actor: nil, client: nil, address: Current.ip_address, **details)
+        held = budget(name)
+
+        ::Rails.logger.info("masks: the #{held.key} limit of #{held.to} in #{held.within.inspect} was reached" \
+                            "#{address.present? ? " from #{address}" : ''}")
+
+        return if Current.tenant.nil?
+        return unless ::Rails.cache.write(key(name, "reached:#{address}"), true, unless_exist: true, expires_in: held.within)
+
+        Event.record!(Event::LIMIT_REACHED, actor: actor, by: nil, client: client, limit: held.key, **details)
+      end
+
+      def reference
+        DEFAULTS.map(&:reference)
+      end
+
+      def reset!
+        @budgets = nil
+        @declared = nil
+      end
+
+      def limit_for(budget)
+        from_env(budget) || declared.fetch(budget.key, nil) || budget.to
+      end
+
+      def from_env(budget)
+        value = ENV[budget.variable]
+
+        return nil if value.blank?
+
+        whole!(value, budget.variable)
+      end
+
+      def declared
+        @declared ||= read_declared(::Rails.configuration.masks.config_path)
+      end
+
+      def read_declared(path)
+        return {} if path.blank?
+
+        document = YAML.safe_load_file(path, aliases: false) || {}
+        limits = document.is_a?(Hash) ? document.fetch("limits", nil) || {} : {}
+
+        raise Invalid, "limits in #{path} must map each limit's name to a whole number" unless limits.is_a?(Hash)
+
+        unknown = limits.keys.map(&:to_s) - NAMES
+        raise Invalid, "#{path} sets limits called #{unknown.join(', ')}, which do not exist. The limits are #{NAMES.join(', ')}." if unknown.any?
+
+        limits.to_h { |name, value| [ name.to_s, whole!(value, "limits.#{name} in #{path}") ] }
+      rescue Errno::ENOENT, Psych::Exception
+        {}
+      end
+
+      def whole!(value, where)
+        count = Integer(value.to_s, 10)
+
+        raise Invalid, "#{where} is #{value.inspect}. A limit is a whole number, 1 or more." if count < 1
+
+        count
+      rescue ArgumentError, TypeError
+        raise Invalid, "#{where} is #{value.inspect}. A limit is a whole number, 1 or more."
+      end
+    end
+  end
+end

data/app/models/masks/server/token.rb

@@ -22,7 +22,8 @@ module Masks
         "pushed" => "PushedRequest",
         "approval" => "SignInApproval",
         "forward_code" => "ForwardCode",
-        "forward_session" => "ForwardSession"
+        "forward_session" => "ForwardSession",
+        "app_password" => "AppPassword"
       }.freeze
 
       self.inheritance_column = "kind"

data/app/views/masks/server/account/_app_passwords.html.erb

@@ -0,0 +1,83 @@
+<section class="group" id="app-passwords">
+  <h2><%= account_text("app_passwords.heading") %></h2>
+
+  <div class="entries">
+    <details class="entry" <%= "open" if app_password %>>
+      <summary>
+        <span class="entry-icon"><%= account_icon(:password) %></span>
+        <span class="entry-label"><%= account_text("app_passwords.entry") %></span>
+        <span class="entry-state">
+          <%= app_passwords.any? ? app_passwords.size : account_text("app_passwords.state.none") %>
+        </span>
+        <span class="entry-mark" aria-hidden="true"></span>
+      </summary>
+
+      <div class="entry-body">
+        <p class="aside"><%= account_text("app_passwords.lede") %></p>
+
+        <% if app_password %>
+          <p class="aside aside-bad" role="alert">
+            <%= account_text("app_passwords.shown_once", name: app_password["name"], app: app_password["app"]) %>
+          </p>
+
+          <ol class="codes">
+            <li><code><%= app_password["secret"] %></code></li>
+          </ol>
+        <% end %>
+
+        <% if app_passwords.any? %>
+          <div class="items">
+            <% app_passwords.each do |held| %>
+              <div class="item">
+                <span class="item-name">
+                  <span><%= held.name %></span>
+                  <span class="tag"><%= held.client.name %></span>
+                </span>
+
+                <span class="item-meta">
+                  <%= account_text("app_passwords.made_ago", age: time_ago_in_words(held.created_at)) %>
+                  ·
+                  <% if held.used_at %>
+                    <%= account_text("app_passwords.used_ago", age: time_ago_in_words(held.used_at)) %>
+                  <% else %>
+                    <%= account_text("app_passwords.never_used") %>
+                  <% end %>
+                </span>
+
+                <%= button_to account_text("app_passwords.revoke"),
+                      account_app_password_path(held.id), method: :delete,
+                      class: "action action-quiet action-sm", form_class: "item-act",
+                      form: { data: { turbo_confirm: account_text("app_passwords.confirm_revoke", name: held.name) } } %>
+              </div>
+            <% end %>
+          </div>
+        <% end %>
+
+        <% if offered.any? %>
+          <%= form_with url: account_app_passwords_path, method: :post, class: "member-add" do |form| %>
+            <label class="field member-add-email">
+              <span class="field-label"><%= account_text("app_passwords.name") %></span>
+              <%= form.text_field :name, required: true, autocomplete: "off", class: "control", id: "app-password-name",
+                                  maxlength: Masks::Server::AppPassword::NAME_LIMIT,
+                                  placeholder: account_text("app_passwords.name_placeholder") %>
+            </label>
+
+            <label class="field member-add-role">
+              <span class="field-label"><%= account_text("app_passwords.app") %></span>
+              <%= form.select :client_id, offered.map { |client| [ client.name, client.client_id ] }, {}, class: "control",
+                              id: "app-password-client" %>
+            </label>
+
+            <button type="submit" class="action action-sm member-add-go">
+              <%= account_text(fresh ? "app_passwords.make" : "app_passwords.make_again") %>
+            </button>
+
+            <span class="field-hint member-add-hint"><%= account_text("app_passwords.hint") %></span>
+          <% end %>
+        <% else %>
+          <p class="aside"><%= account_text("app_passwords.none_offered") %></p>
+        <% end %>
+      </div>
+    </details>
+  </div>
+</section>

data/app/views/masks/server/account/_organizations.html.erb

@@ -135,6 +135,39 @@
               <% end %>
             </div>
 
+            <% asked = account_access_requests(organization) %>
+            <% if asked.any? %>
+              <p class="aside"><strong><%= account_text("access.heading") %></strong> <%= account_text("access.lede", organization: organization.name) %></p>
+
+              <div class="items" id="access-requests-<%= organization.key %>">
+                <% asked.each do |request| %>
+                  <% roles = request.organization_roles.filter_map { |key, role| role if key == organization.key } %>
+                  <div class="item item-member access-request" id="access-request-<%= request.id %>">
+                    <span class="item-name"><%= request.actor.identifier %></span>
+                    <span class="item-meta">
+                      <%= account_text("access.asked", app: request.client.name, age: time_ago_in_words(request.created_at)) %>
+                    </span>
+
+                    <div class="item-act item-acts">
+                      <%= form_with url: account_organization_access_path(organization.key, request.id), method: :post,
+                                    class: "item-acts" do |form| %>
+                        <%= form.select :role, roles, {}, class: "control control-sm",
+                                        id: "access-role-#{organization.key}-#{request.id}",
+                                        aria: { label: account_text("access.role_of", name: request.actor.identifier) } %>
+                        <button type="submit" class="action action-sm"><%= account_text("access.grant") %></button>
+                      <% end %>
+
+                      <%= button_to account_text("access.decline"),
+                            account_organization_access_path(organization.key, request.id), method: :delete,
+                            class: "action action-quiet action-sm",
+                            form: { data: { turbo_confirm: account_text("access.confirm_decline", identifier: request.actor.identifier,
+                                                                                                  app: request.client.name) } } %>
+                    </div>
+                  </div>
+                <% end %>
+              </div>
+            <% end %>
+
             <%= form_with url: account_organization_members_path(organization.key), method: :post, class: "member-add" do |form| %>
               <label class="field member-add-email">
                 <span class="field-label"><%= account_text("organizations.add_email") %></span>

data/app/views/masks/server/account/index.html.erb

@@ -31,6 +31,11 @@
 
   <%= render "masks/server/account/apps", apps: @apps, connections: @connections, linkable: @linkable %>
 
+  <% if @app_passwords.any? || @app_password_clients.any? %>
+    <%= render "masks/server/account/app_passwords", app_passwords: @app_passwords, offered: @app_password_clients,
+                                                     app_password: @app_password, fresh: @fresh %>
+  <% end %>
+
   <%= render "masks/server/account/info", actor: @actor, directed: @directed, fresh: @fresh %>
 
   <%= render "masks/server/account/activity", events: @events %>

data/app/views/masks/server/actor_mailer/access_declined.html.erb

@@ -0,0 +1,5 @@
+<%= render layout: "message" do %>
+<p class="lede"><%= t(".lede", app: @app.name, tenant: @tenant_name) %></p>
+<% end %>
+
+<p class="meta"><%= t(".again") %></p>

data/app/views/masks/server/actor_mailer/access_declined.text.erb

@@ -0,0 +1,5 @@
+<%= render layout: "message" do %>
+<%= t(".lede", app: @app.name, tenant: @tenant_name) %>
+<% end %>
+
+<%= t(".again") %>

data/app/views/masks/server/actor_mailer/access_granted.html.erb

@@ -0,0 +1,7 @@
+<%= render layout: "message" do %>
+<p class="lede"><%= t(".lede", app: @app.name, tenant: @tenant_name) %></p>
+<% end %>
+
+<% if @url %>
+  <%= render "action", url: @url, label: t(".action", app: @app.name) %>
+<% end %>

data/app/views/masks/server/actor_mailer/access_granted.text.erb

@@ -0,0 +1,7 @@
+<%= render layout: "message" do %>
+<%= t(".lede", app: @app.name, tenant: @tenant_name) %>
+<% end %>
+<% if @url %>
+
+<%= @url %>
+<% end %>

data/app/views/masks/server/authorize/error.html.erb

@@ -9,4 +9,29 @@
   <p class="said"><%= @error_code %> — <%= @error_description %></p>
 
   <p class="prompt-lede"><%= @refused ? t(".nothing_shared") : t(".contact") %></p>
+
+  <% if @asking %>
+    <div id="ask-access" class="flow" data-waiting="<%= @waiting.present? %>">
+      <% if flash[:alert].present? %>
+        <p class="note note-bad" role="alert"><%= flash[:alert] %></p>
+      <% elsif flash[:notice].present? %>
+        <p class="note note-plain" role="status"><%= flash[:notice] %></p>
+      <% end %>
+
+      <% if @waiting %>
+        <p class="prompt-lede"><%= t(".waiting", app: @asking.name) %></p>
+      <% else %>
+        <p class="prompt-lede"><%= t(".asking", app: @asking.name) %></p>
+
+        <%= form_with url: authorize_access_request_path, method: :post do |form| %>
+          <%= form.hidden_field :rid, value: params[:rid] %>
+          <button type="submit" class="action"><%= t(".ask") %></button>
+        <% end %>
+      <% end %>
+    </div>
+  <% end %>
+
+  <% if @return_to %>
+    <a class="action action-quiet" id="back-to-app" href="<%= @return_to %>"><%= t(".back", app: @asking&.name || t(".the_app")) %></a>
+  <% end %>
 </div>

data/config/locales/de/access_requests.yml

@@ -0,0 +1,43 @@
+de:
+  authorize:
+    error:
+      asking: "Ihr Konto ist in keiner Gruppe, die %{app} nutzen darf. Sie können um Zugang bitten. Die Betreiber von %{app} entscheiden, und Sie erhalten in jedem Fall eine E-Mail."
+      ask: "Um Zugang bitten"
+      asked: "Ihre Anfrage wurde gesendet. Sie erhalten eine E-Mail, sobald sie entschieden ist."
+      waiting: "Ihre Anfrage, %{app} zu nutzen, wartet. Sie erhalten eine E-Mail, sobald sie entschieden ist."
+      slow_down: "Sie haben vor weniger als einer Stunde um Zugang zu dieser App gebeten. Warten Sie auf die Antwort."
+      back: "Zurück zu %{app}"
+      the_app: "der App"
+
+  account:
+    index:
+      access:
+        heading: "Um Zugang gebeten"
+        lede: "Diese Personen wurden von einer App abgewiesen, die Mitglieder von %{organization} zulässt. Mit Genehmigen werden sie Mitglied mit der Rolle, die Sie wählen."
+        asked: "Hat vor %{age} gebeten, %{app} zu nutzen"
+        role_of: "Rolle für %{name}"
+        grant: "Genehmigen"
+        decline: "Ablehnen"
+        confirm_decline: "Die Anfrage von %{identifier}, %{app} zu nutzen, ablehnen? Die Person erhält eine E-Mail und kann in einer Stunde erneut bitten."
+
+  organization_access:
+    granted: "%{identifier} ist jetzt %{role} von %{organization} und kann %{app} nutzen."
+    declined: "Die Anfrage von %{identifier}, %{app} zu nutzen, ist abgelehnt."
+    unknown: "Diese Anfrage wartet nicht auf %{organization}."
+
+  actor_mailer:
+    access_granted:
+      subject: "Sie können %{app} jetzt nutzen"
+      lede: "Ihre Anfrage, %{app} bei %{tenant} zu nutzen, wurde genehmigt. Melden Sie sich erneut bei %{app} an, und Sie werden eingelassen."
+      action: "%{app} öffnen"
+    access_declined:
+      subject: "Ihre Anfrage, %{app} zu nutzen, wurde abgelehnt"
+      lede: "Jemand, der %{app} bei %{tenant} betreibt, hat Ihre Anfrage um Zugang abgelehnt."
+      again: "Wenn Sie das für einen Fehler halten, fragen Sie die Person direkt. In einer Stunde können Sie erneut bitten."
+
+  events:
+    actions:
+      access:
+        requested: "Um Zugang zu einer App gebeten"
+        granted: "Zugang zu einer App genehmigt"
+        declined: "Zugang zu einer App abgelehnt"

data/config/locales/de/account/app_passwords.yml

@@ -0,0 +1,42 @@
+de:
+  account:
+    index:
+      app_passwords:
+        heading: "App-Passwörter"
+        entry: "App-Passwörter"
+        state:
+          none: "Keine"
+        lede: "Mit einem App-Passwort meldet sich eine einzelne App, etwa ein Medienserver oder ein NAS, ohne Ihren zweiten Faktor als Sie an. Es gilt nur für die App, für die es erstellt wurde."
+        shown_once: "Das ist das App-Passwort für %{name}. Es wird nur einmal angezeigt. Geben Sie es jetzt in %{app} ein."
+        made_ago: "erstellt vor %{age}"
+        used_ago: "zuletzt verwendet vor %{age}"
+        never_used: "nie verwendet"
+        revoke: "Widerrufen"
+        confirm_revoke: "%{name} widerrufen? Die App kann sich damit sofort nicht mehr anmelden."
+        name: "Name"
+        name_placeholder: "Jellyfin auf dem Fernseher"
+        app: "App"
+        make: "App-Passwort erstellen"
+        make_again: "Zum Erstellen erneut anmelden"
+        hint: "Ihr eigenes Passwort und Ihre Passkeys bleiben unverändert. Das Widerrufen eines App-Passworts ändert sonst nichts."
+        none_offered: "Noch keine App akzeptiert App-Passwörter."
+  app_passwords:
+    again: "Melden Sie sich erneut an, um ein App-Passwort zu erstellen. Ihre letzte Anmeldung liegt eine Weile zurück."
+    unknown: "Dieses Konto hat kein solches App-Passwort."
+    revoked: "%{name} ist widerrufen."
+    refused:
+      name: "Geben Sie dem App-Passwort einen Namen mit höchstens 64 Zeichen."
+      app: "Diese App akzeptiert keine App-Passwörter."
+      too_many: "Sie haben bereits %{most} App-Passwörter. Widerrufen Sie zuerst eines."
+  events:
+    actions:
+      app_password:
+        created: "App-Passwort erstellt"
+        used: "Mit einem App-Passwort angemeldet"
+        revoked: "App-Passwort widerrufen"
+  actor_mailer:
+    notification:
+      said:
+        app_password:
+          created: "Für Ihr %{tenant}-Konto wurde ein App-Passwort erstellt. Damit meldet sich eine App ohne Ihren zweiten Faktor an."
+          revoked: "Ein App-Passwort Ihres %{tenant}-Kontos wurde widerrufen."

data/config/locales/de/events.yml

@@ -159,6 +159,11 @@ de:
         updated: "E-Mail-Vorlage geändert"
       job:
         failed: "Hintergrundjob für diesen Mandanten fehlgeschlagen"
+      health:
+        failing: "Zustandsprüfung fehlgeschlagen"
+        recovered: "Zustandsprüfung wieder in Ordnung"
+      release:
+        available: "Neue Version verfügbar"
       stream:
         created: "Event-Stream hinzugefügt"
         updated: "Event-Stream geändert"

data/config/locales/de/flashes.yml

@@ -163,3 +163,4 @@ de:
   forward_auth:
     unknown: "Unter dieser Adresse ist keine App hinter einem Proxy registriert."
     not_admitted: "Ihr Konto darf %{app} nicht verwenden."
+    denied: "Diese Seite von %{app} ist für alle gesperrt."

data/config/locales/de/group_sources.yml

@@ -0,0 +1,5 @@
+de:
+  events:
+    actions:
+      group:
+        refreshed: "Gruppe aus ihrer Quelle gefüllt"