masks-server 0.7.0 → 0.8.0

data/config/locales/en/manage/organization.yml

@@ -4,7 +4,7 @@ en:
       title: "Organization"
       back: "Organizations"
       archived_lede: "Archived %{when}. Nobody signs in as a member of it."
-      lede: "Apps name it with organization=%{key}, and tokens carry the member's role."
+      lede: "Clients name it with organization=%{key}, and tokens carry the member's role."
       lenses:
         all: "Everyone"
         owners: "Owners"
@@ -38,14 +38,14 @@ en:
         role_added: "%{organization} offers %{role} now."
         role_dropped: "%{organization} no longer offers %{role}."
         saved: "Saved."
-        provider_saved: "Saved. People who sign in through it join this organization."
+        provider_saved: "Saved. Actors who sign in through it join this organization."
         provider_back: "%{provider} serves the whole tenant again."
         archived: "%{organization} is archived."
         restored: "%{organization} is back."
       questions:
         withdraw: "Withdraw the invitation to %{name}?"
         remove: "Remove %{name} from %{organization}? Their tokens for it stop working."
-        hand_back: "Hand %{provider} back to the whole tenant? People who sign in through it stop joining %{organization}."
+        hand_back: "Hand %{provider} back to the whole tenant? Actors who sign in through it stop joining %{organization}."
         archive: "Archive %{organization}? This stops anyone signing in as a member."
         archive_tokens:
           one: "Archive %{organization}? This stops anyone signing in as a member and revokes its %{count} live token."
@@ -65,8 +65,8 @@ en:
         role: "Role"
         invite: "Invite"
         cancel: "Cancel"
-        hint: "They join once they accept, from the address you invite. Someone without an account gets an invitation to make one."
-        person: "Person"
+        hint: "They join once they accept, from the address you invite. Somebody who is not an actor yet gets an invitation to sign up."
+        person: "Actor"
         empty:
           invited: "No invitations are open."
           owners: "Nobody owns this organization. Make a member an owner so someone can manage it."
@@ -81,9 +81,9 @@ en:
         remove: "Remove"
       signing_in:
         title: "Signing in"
-        lede: "A member signs in under this policy, ahead of the app's and the tenant's. It applies from the first step when the app names the organization."
+        lede: "A member signs in under this policy, ahead of the client's and the tenant's. It applies from the first step when the client names the organization."
         policy: "Sign-in policy"
-        inherited: "The app's or the tenant's"
+        inherited: "The client's or the tenant's"
         providers: "Providers"
         no_groups_mapped: "No groups mapped"
         joins_as: "%{mapping}. Anyone else joins as %{role}."
@@ -94,13 +94,13 @@ en:
         groups_claim: "Groups claim"
         unmapped_role: "Role for anyone else"
         role_map: "Groups to roles"
-        role_map_hint: "One group per line. The first group a person holds decides their role, on every sign-in."
+        role_map_hint: "One group per line. The first group an actor holds decides their role, on every sign-in."
         save: "Save"
         cancel: "Cancel"
         domains: "Domains"
         proven: "Proven %{day}"
         waiting: "Waiting for its DNS record"
-        no_domains: "None proven. Until one of its providers proves a domain, owners can invite only the addresses sign-up admits, and a provisioning token cannot set email addresses."
+        no_domains: "None proven. Until one of its providers proves a domain, owners can invite only the addresses signup admits, and a provisioning token cannot set email addresses."
         domains_link: "Domains"
         provisioning: "Provisioning"
         tokens_reach:
@@ -130,3 +130,10 @@ en:
           one: "Archiving stops anyone signing in as a member of %{organization} and revokes its %{count} live token. Members keep their roles, so restoring it puts everything back."
           other: "Archiving stops anyone signing in as a member of %{organization} and revokes its %{count} live tokens. Members keep their roles, so restoring it puts everything back."
         button: "Archive %{organization}"
+      parts:
+        label: "Organization"
+        members: "Members"
+        sign_in: "Sign-in"
+        roles: "Roles"
+        activity: "Activity"
+        general: "General"

data/config/locales/en/manage/organizations.yml

@@ -2,7 +2,7 @@ en:
   manage:
     organizations:
       title: "Organizations"
-      lede: "The customers inside this tenant. An app that asks for the organization scope signs a person in as a member of one, and their token carries the role they hold there."
+      lede: "The customers inside this tenant. A client that asks for the organization scope signs an actor in as a member of one, and their token carries the role they hold there."
       columns:
         organization: "Organization"
         members: "Members"
@@ -17,12 +17,12 @@ en:
       add_lede: "You become its first owner, and can add members once it exists."
       name: "Name"
       key: "Key"
-      key_hint: "An app asks for this organization with"
+      key_hint: "A client asks for this organization with"
       key_word: "key"
       key_hint_end: ". The key cannot change later."
       adding: "Adding..."
       cancel: "Cancel"
-      empty: "No organizations yet. Add one for each customer whose people sign in together."
+      empty: "No organizations yet. Add one for each customer whose members sign in together."
       tenant_policy: "The tenant's policy"
       archived:
         title: "Archived"

data/config/locales/en/manage/policies.yml

@@ -35,7 +35,7 @@ en:
         signup_open: "signup open"
         invitation_only: "invitation only"
         second_factor_required: "second factor required"
-        apps_require_second_factor: "second factor at every app sign-in"
+        apps_require_second_factor: "second factor at every sign-in to a client"
         lifetime: "sessions last %{duration}"
         idle: "idle after %{duration}"
         confirmed_by: "confirmed by %{confirmation}"
@@ -51,7 +51,7 @@ en:
         save: "Save"
         cancel: "Cancel"
         signup:
-          legend: "Sign up"
+          legend: "Signup"
           open: "Open"
           email_domains: "Email domains"
           email_domains_placeholder: "any"
@@ -78,7 +78,7 @@ en:
           phone_verified: "Confirmed phone"
           no_sms: "No SMS service."
         sign_in:
-          legend: "Sign in"
+          legend: "Sign-in"
           characters: "characters minimum"
           refuse_common: "Refuse common passwords"
           password_required: "Require a password at signup"
@@ -86,20 +86,20 @@ en:
         second_factor:
           legend: "Second factor"
           required: "Required for everyone, not just managers"
-          apps: "Asked again at an app sign-in when the session did not use one"
+          apps: "Asked again at a sign-in to a client when the session did not use one"
         risk:
           legend: "Risk"
           step_up: "Ask for a second factor at a score of"
           refuse: "Refuse at"
           refuse_breached: "Refuse passwords found in known breaches"
-          hint: "A sign-in scores up to 100: a new device 30, a new network 25, a risky network 50, repeated failures 20 or 40, an account dormant for six months 10, and a breached password 40. Breach checks send the first five characters of the password's SHA-1 hash, never the password."
+          hint: "A sign-in scores up to 100: a new device 30, a new network 25, a risky network 50, repeated failures 20 or 40, an actor dormant for six months 10, and a breached password 40. Breach checks send the first five characters of the password's SHA-1 hash, never the password."
         sessions:
           legend: "Sessions"
           last: "Last"
           after_sign_in: "after signing in"
           end_after: "End after"
           idle: "idle"
-          hint: "Apps covered by this policy ask again once a session is older or has been idle longer, even one that started under another policy. A shorter session also ends the refresh tokens issued in it."
+          hint: "Clients covered by this policy ask again once a session is older or has been idle longer, even one that started under another policy. A shorter session also ends the refresh tokens issued in it."
       list:
         empty: "None yet. Clients use the built-in default."
         default: "Default"

data/config/locales/en/manage/policy_rules.yml

@@ -34,7 +34,7 @@ en:
           one: "%{count} second"
           other: "%{count} seconds"
       terms:
-        signup: "Sign up"
+        signup: "Signup"
         email_domains: "Email domains"
         hidden: "Hides who has an account"
         nickname: "Nickname"
@@ -47,7 +47,7 @@ en:
         password: "Password"
         second_factors: "Second factors"
         second_factor_required: "Second factor required"
-        apps_require_second_factor: "Second factor at every app sign-in"
+        apps_require_second_factor: "Second factor at every sign-in to a client"
         session_lifetime: "Session lifetime"
         refuse_breached: "Refuses breached passwords"
         password_required: "Password required at signup"

data/config/locales/en/manage/presence.yml

@@ -11,7 +11,7 @@ en:
       last_seen: "Last seen %{when}"
       show_more: "Show %{count} more"
       blocked: "blocked"
-      unrecognised: "unrecognised"
+      unrecognised: "unrecognized"
       sign_out: "Sign out"
       block: "Block"
       unblock: "Unblock"

data/config/locales/en/manage/providers.yml

@@ -29,7 +29,7 @@ en:
       notices:
         discovered: "Endpoints filled in from the discovery document."
         metadata_read: "Read the identity provider's entity, sign-in URL and certificates."
-        registered: "%{name} is registered, and applications can be let use it."
+        registered: "%{name} is registered, and clients can use it."
         added: "%{name} can sign actors in now."
         saved: "%{name} saved."
         archived: "%{name} is archived."
@@ -39,10 +39,12 @@ en:
         archive: "Archive %{name}? Nobody can sign in with it until it is restored."
         register: "Register with %{name} again? Everybody connected to it has to connect again."
       picker:
-        help: "Pick who actors will sign in with. Anything not listed speaks one of the three at the end."
+        help: "Pick who actors will sign in with. Anything not listed speaks one of the protocols under Anything else."
+        back: "Choose another"
+        known: "Known providers"
+        generic: "Anything else"
       form:
         add_title: "Add %{name}"
-        edit_title: "Edit %{name}"
         guide_lead: "Register masks with %{name} first:"
         guide_link: "%{name}'s console"
         give: "Give %{name} these"
@@ -62,13 +64,13 @@ en:
         certificates: "Signing certificates"
         name_id_format: "Name ID format"
         mcp_url: "MCP server URL"
-        mcp_hint: "masks finds the server's own authorization server from its protected resource metadata and registers itself there, so there is no client ID to copy. An MCP server never signs anybody in; it is only something applications can be let use."
+        mcp_hint: "masks finds the server's own authorization server from its protected resource metadata and registers itself there, so there is no client ID to copy. An MCP server never signs anybody in. Clients use it for an actor."
         issuer: "Issuer"
         discover: "Discover"
         authorization_url: "Authorization URL"
         token_url: "Token URL"
         userinfo_url: "Userinfo URL"
-        emails_url: "Verified emails URL"
+        emails_url: "Emails URL"
         jwks_uri: "JWKS URI"
         optional: "optional"
         discovered_if_empty: "discovered if left empty"
@@ -91,66 +93,86 @@ en:
         subject_oidc: "Subject (sub or oid)"
         subject_path: "Subject path"
         attribute_name: "attribute name"
-        applications: "Applications"
-        delegates: "Let applications use somebody's %{name} account"
-        provider: "provider"
-        delegates_hint: "An approved application can ask an actor to let it act as them at %{name} while they are away. masks keeps the tokens, refreshes them, and hands each one only to the application that actor said yes to."
-        delegated_scopes: "What applications may do"
+        delegates: "Let clients use an actor's %{name} account"
+        delegates_hint: "An approved client can ask an actor to let it act as them at %{name} while they are away. masks keeps the tokens, refreshes them, and hands each one only to the client that actor said yes to."
+        delegated_scopes: "What clients may do"
         server_grants: "whatever the server grants"
         delegation_params: "Extra parameters when connecting"
-        delegation_asks: "An application asks for"
-        delegation_reconnect: "Changing what applications may do asks everybody to connect again."
-        signing_in: "Signing in"
-        owns: "%{name} owns the account"
-        this_provider: "This provider"
-        owns_hint: "On, somebody new gets an account here, and their name, photo and address follow %{name} each time they sign in. Off, it is only another way into an account that already exists. Either way it stands in for a password, never for a second factor."
+        delegation_asks: "A client asks for"
+        delegation_reconnect: "Changing what clients may do asks everybody to connect again."
+        owns: "Add the actors it signs in"
+        owns_hint: "On, somebody new becomes an actor here, and their name, photo, and address follow %{name} each time they sign in. Off, it is only another way to sign in as an actor that already exists. Either way it stands in for a password, never for a second factor."
         trusts_email: "Trust the addresses it confirms"
         trusts_email_hint: "Only for a provider that really checks an actor holds the mailbox, as Google, Apple and GitHub do. Off, only addresses in the domains below are taken at its word."
         signals: "Accept its security events"
         signals_lead: "It sends shared signals to"
-        signals_rest: "A session revoked, a credential changed, or an account disabled there signs the account out everywhere here."
+        signals_rest: "A session revoked, a credential changed, or an account disabled there signs the actor out everywhere here."
         saml_domains: "Email domains it answers for"
         domains: "Email domains"
         any_domain: "any domain"
-        signup_scopes: "Scopes a new account holds"
+        signup_scopes: "Scopes a new actor holds"
         saving: "Saving..."
         add: "Add"
         save: "Save"
-      empty: "No provider is set up. Add one and actors can sign in with Google, GitHub, their company's identity provider, or anything that speaks OpenID Connect, OAuth 2.0 or SAML."
-      edit: "Edit"
+      empty: "No provider is set up. Add one and actors can sign in with Google, GitHub, Okta, Entra ID, or anything that speaks OpenID Connect, OAuth 2.0, or SAML."
       register: "Register again"
       archive: "Archive"
-      badges:
-        never_signs_in: "never signs in"
-        owns_accounts: "owns accounts"
-        existing_only: "existing accounts only"
-        trusts_email: "trusts confirmed addresses"
-        signals: "accepts security events"
-        delegates: "applications can use it"
       facts:
-        acs_url: "Assertion consumer service URL"
-        redirect_uri: "Redirect URI"
-        sp_entity_id: "Service provider entity ID"
-        identity_provider: "Identity provider"
-        metadata: "Metadata"
-        metadata_read: "read %{day}"
+        metadata_read: "Metadata read %{day}."
         never: "never"
-        pasted: "pasted, not refreshed"
-        client_id: "Client ID"
-        signing_key: "Signing key"
-        secret: "Secret"
-        held: "held"
-        none_set: "none set"
-        issuer: "Issuer"
-        scopes: "Scopes asked upstream"
-        mcp_server: "MCP server"
-        registered: "Registered"
-        delegation_scope: "Applications ask for"
-        delegations: "Applications using it"
-        delegated_scopes: "What applications may do"
-        connections: "Connected accounts"
+        registered: "Registered with it %{day}."
         signed_in: "%{count} sign in with it"
-      connected: "Who is connected (%{count})"
+        delegations_count:
+          one: "Clients hold %{count} delegation through it."
+          other: "Clients hold %{count} delegations through it."
       archived: "Archived"
       archived_on: "archived %{day}"
       restore: "Restore"
+      lede: "Other places actors sign in with, and MCP servers that clients can use for an actor."
+      back: "Providers"
+      copy: "Copy"
+      missing: "There is no provider with that key."
+      unsaved: "Unsaved changes"
+      discard: "Discard"
+      danger: "Archive"
+      danger_lede: "Nobody can sign in with it until it is restored."
+      danger_lede_mcp: "Registering again makes everybody connected to it connect again. Archiving stops it until it is restored."
+      columns:
+        provider: "Provider"
+        kind: "Kind"
+        connections: "Connected accounts"
+      roles:
+        owns: "adds the actors it signs in"
+        existing: "signs in existing actors only"
+        never: "never signs anybody in"
+      marks:
+        owns: "Adds the actors it signs in"
+        trusts_email: "Trusts the addresses it confirms"
+        signals: "Accepts its security events"
+        delegates: "Clients can use it for an actor"
+        no_secret: "No client secret is set"
+      parts:
+        label: "Provider"
+        setup: "Setup"
+        sign_in: "Sign-in"
+        clients: "Clients"
+        accounts: "Connected accounts (%{count})"
+      sections:
+        give_lede: "Register masks there with these, so it sends actors back here."
+        identity: "Name"
+        identity_lede: "The key is part of its redirect URI, so it cannot change once it is added."
+        endpoints: "Endpoints"
+        endpoints_oidc: "Discover fills these in from the issuer's discovery document."
+        credentials_lede: "What %{name} issued when masks was registered there."
+        mcp: "MCP server"
+        accounts: "Actors"
+        addresses: "Email addresses"
+        signals: "Security events"
+        claims_lede: "Which claim or attribute fills each part of an actor's profile."
+        delegation: "Delegation"
+      callouts:
+        archived: "Archived %{day}. Nobody can sign in with it."
+        no_secret: "No client secret is set"
+        no_secret_detail: "Enter what %{name} issued under Credentials."
+        organization_lead: "It belongs to"
+        organization_rest: "Actors who sign in through it join that organization."

data/config/locales/en/manage/provisioning.yml

@@ -2,7 +2,7 @@ en:
   manage:
     provisioning:
       title: "Provisioning"
-      lede: "An identity provider adds, changes, suspends and removes actors here over SCIM 2.0."
+      lede: "A directory adds, changes, suspends, and removes actors here over SCIM 2.0."
       revoke_confirm: "Revoke %{label}? Whatever provisions with it is refused from now on."
       revoked: "%{label} is revoked."
       lifetimes:
@@ -10,12 +10,12 @@ en:
         quarter: "90 days"
         year: "A year"
       connect:
-        title: "Connect a provider"
-        help: "Give the provider this URL and a token. A provisioned actor is known by their email, which masks takes as confirmed, and signs in through a provider or an invitation. Nobody who holds a masks: scope has their password or email changed this way, and the last manager is never suspended or removed."
+        title: "Connect a directory"
+        help: "Give the directory this URL and a token. A provisioned actor is known by their email, which masks takes as confirmed, and signs in through a provider or an invitation. Nobody who holds a masks: scope has their password or email changed this way, and the last manager is never suspended or removed."
         base_url: "SCIM base URL"
         label: "Label"
         provisions: "Provisions"
-        every_account: "Every account"
+        every_account: "Every actor"
         only_members: "Only members of %{name}"
         lifetime: "How long the token lives"
         issue: "Issue a token"

data/config/locales/en/manage/senders.yml

@@ -11,7 +11,7 @@ en:
       kinds:
         mail:
           title: "Mail"
-          lede: "Invitations, resets, confirmations and codes. The primary one sends everything."
+          lede: "Invitations, resets, confirmations, and codes. The primary one sends everything."
           idle: "Nothing is emailed through a service of this tenant's own. Mail falls back to whatever the server was set up with, if anything."
         sms:
           title: "SMS"
@@ -25,7 +25,7 @@ en:
         name: "Name"
         optional: "%{label} (optional)"
         unchanged: "unchanged"
-        primary: "Primary — send everything of this kind through it"
+        primary: "Primary, so everything of this kind sends through it"
         create: "Add"
         save: "Save"
         cancel: "Cancel"

data/config/locales/en/manage/settings.yml

@@ -16,13 +16,13 @@ en:
           detail: "Invitations, password resets, and sign-in codes go out by email. Until then, a manager passes each invitation link along by hand."
           action: "Add a mail service"
         client:
-          title: "Connect your first app"
-          detail: "Register an app by hand, or let one connect itself through the handshake."
-          action: "Add an app"
+          title: "Register your first client"
+          detail: "Register a client by hand, or let one connect itself through the handshake."
+          action: "Add client"
         invite:
           title: "Invite someone"
-          detail: "Each person gets an invitation to set up their own sign-in."
-          action: "Invite people"
+          detail: "Each actor gets an invitation to set up their own sign-in."
+          action: "Invite actors"
       sign_ins:
         title: "Sign-ins"
         range: "Time range"
@@ -34,15 +34,14 @@ en:
         all: "All organizations"
         organization: "Organization"
         members: "Members"
-        empty: "No organizations yet. Add one for each customer whose people sign in together, and apps that ask for the organization scope learn the role each person holds there."
+        empty: "No organizations yet. Add one for each customer whose members sign in together, and clients that ask for the organization scope learn the role each actor holds there."
       recent:
-        worrying: "Worth a look"
-        lately: "Lately"
         all: "All activity"
         empty: "Nothing yet."
+        title: "Activity"
       tenant:
         title: "Tenant"
-        help: "The name heads every screen and email masks sends. Apps discover this tenant at its issuer, and the manage API answers at its resource."
+        help: "The name heads every screen and email masks sends. Clients discover this tenant at its issuer, and the manage API answers at its resource."
         name: "Name"
         renamed: "Renamed."
         subdomain: "Subdomain"
@@ -55,41 +54,41 @@ en:
         change_logo: "Change logo"
         upload_logo: "Upload a logo"
         remove: "Remove"
-        logo_updated: "Logo updated."
+        logo_updated: "Logo changed."
         logo_removed: "Logo removed."
         accent: "Accent color"
-        color_updated: "Color updated."
+        color_updated: "Color changed."
         color_reset: "Color reset."
         own: "Use masks' own"
       naming:
         title: "Primary identifier"
-        help: "What a person types to sign in. Every policy has to require whichever this names."
+        help: "What an actor types to sign in. Every policy has to require whichever this names."
         nickname: "Nickname"
         email: "Email"
         either: "Either"
-        updated: "Primary identifier updated."
+        updated: "Primary identifier changed."
       policy:
         title: "Default policy"
         help: "The sign-in policy for every client that has none of its own. Built-in offers passwords, passkeys, and providers, with an optional second factor."
         built_in: "Built-in"
-        updated: "Default policy updated."
+        updated: "Default policy changed."
       access:
         title: "Who may sign in"
         help: "Browsers only refuses any sign-in from something that does not present itself as a browser. Refused user agents takes fragments, separated by commas, and refuses every user agent that contains one."
         browsers_only: "Browsers only"
         refused_agents: "Refused user agents"
-        updated: "Sign-in rules updated."
+        updated: "Sign-in rules changed."
         risky_networks: "Risky networks"
         risky_hint: "Address ranges, one per line, that add to a sign-in's risk score. A sign-in policy decides what a score does."
         save_networks: "Save networks"
         networks_saved: "Risky networks saved."
       idle:
         title: "Auto-deletion"
-        help: "An account nobody signs in to or uses through an app is suspended, then deleted, after these periods. Each step is warned by email at least 30 days ahead, and signing in before a suspension keeps the account. With Suspend set, only accounts suspended for being idle are deleted. With Suspend at Never, idle accounts are deleted directly. The last manager and accounts a provider provisions over SCIM are left alone."
+        help: "An actor nobody signs in as or uses through a client is suspended, then deleted, after these periods. Each step is warned by email at least 30 days ahead, and signing in before a suspension keeps the actor. With Suspend set, only actors suspended for being idle are deleted. With Suspend at Never, idle actors are deleted directly. The last manager and actors a directory provisions over SCIM are left alone."
         suspend: "Suspend"
         delete: "Delete"
-        updated: "Auto-deletion updated."
-        delete_confirm: "Delete idle accounts? A deleted account cannot be restored."
+        updated: "Auto-deletion changed."
+        delete_confirm: "Delete idle actors? A deleted actor cannot be restored."
         never: "Never"
         after_90_days: "After 90 days"
         after_180_days: "After 180 days"
@@ -98,7 +97,7 @@ en:
         after_three_years: "After three years"
       retention:
         title: "Activity"
-        help: "How long masks keeps events. Older ones are deleted each night, and a shorter period takes effect at the next sweep. Export a range from Activity before shortening it."
+        help: "How long masks keeps activity. Older events are deleted each night, and a shorter period takes effect at the next sweep. Export a range from Activity before shortening it."
         updated: "Activity is kept for the new period."
         days_30: "30 days"
         days_90: "90 days"
@@ -108,12 +107,12 @@ en:
         seven_years: "Seven years"
       registration:
         title: "Dynamic registration"
-        help: "Whether apps may register themselves over RFC 7591. A self-registered app is never approved, and with the limit on it may ask only for the scopes chosen here."
+        help: "Whether clients may register themselves over RFC 7591. A self-registered client is never approved, and with the limit on it may ask only for the scopes chosen here."
         "off": "Off"
         "on": "On"
         bounded: "On, limited to these scopes"
-        updated: "Dynamic registration updated."
-        ceiling_updated: "Ceiling updated."
+        updated: "Dynamic registration changed."
+        ceiling_updated: "Ceiling changed."
       keys:
         schedule: "Rotation"
         by_hand: "By hand"
@@ -122,7 +121,7 @@ en:
           other: "Every %{count} days"
         scheduled: "Rotation schedule saved. A new key is published a day before it signs."
         title: "Signing keys"
-        help: "Every token is signed with the active key, and apps check it against the keys published at the JWKS endpoint. Stage a key to publish it a day before it signs, or rotate to switch at once. The outgoing key keeps verifying for 24 hours."
+        help: "Every token is signed with the active key, and clients check it against the keys published at the JWKS endpoint. Stage a key to publish it a day before it signs, or rotate to switch at once. The outgoing key keeps verifying for 24 hours."
         stage: "Stage"
         rotate: "Rotate now"
         key: "Key"
@@ -145,3 +144,15 @@ en:
           active: "active"
           retiring: "retiring"
           retired: "retired"
+      needs:
+        waiting:
+          one: "%{count} actor is waiting for approval"
+          other: "%{count} actors are waiting for approval"
+        help:
+          one: "%{count} actor asked for help signing in"
+          other: "%{count} actors asked for help signing in"
+        worrying:
+          one: "%{count} event in the last day is worth a look"
+          other: "%{count} events in the last day are worth a look"
+        latest: "The latest is %{label}, %{when}."
+        review: "Review"

data/config/locales/es/account.yml

@@ -150,7 +150,7 @@ es:
 
       organizations:
         heading: "Organizaciones"
-        invited_by_manager: "Alguien invitado por un administrador"
+        invited_by_manager: "Alguien invitado por un gestor"
         role: "Eres %{role}"
         lede_owner: "Como propietario, decides quién pertenece aquí y qué rol tiene cada persona. Las aplicaciones que piden tu organización ven el rol."
         lede_member: "Las aplicaciones que piden tu organización ven que perteneces a ella y tu rol."

data/config/locales/es/application.yml

@@ -1,6 +1,6 @@
 es:
   application:
     person:
-      manager: "Administrador"
+      manager: "Gestor"
       unconfirmed: "sin confirmar"
       sign_out: "Cerrar sesión"

data/config/locales/es/events.yml

@@ -65,7 +65,7 @@ es:
         refused: "Inicio de sesión de dispositivo rechazado"
       sign_in:
         approved: "Inicio de sesión aprobado desde un dispositivo de confianza"
-        denied: "Inicio de sesión denegado desde un dispositivo de confianza"
+        denied: "Inicio de sesión rechazado desde un dispositivo de confianza"
         risky: "Inicio de sesión inusual"
       device:
         trusted: "Dispositivo de confianza"
@@ -112,6 +112,9 @@ es:
         restored: "Aplicación restaurada"
         secret_rotated: "Secreto de la aplicación rotado"
         logo_refused: "No se pudo usar el logotipo de la aplicación"
+        enrollment_issued: "Inscripción de máquina solicitada"
+        enrolled: "Máquina inscrita"
+        unenrolled: "Máquina dada de baja"
       token:
         revoked: "Token revocado"
       saml:

data/config/locales/es/flashes.yml

@@ -113,7 +113,7 @@ es:
     expired: "Ese inicio de sesión dejó de esperar. Pide un código nuevo en la otra pantalla."
     too_many_attempts: "Demasiados intentos. Espera unos minutos y vuelve a intentarlo."
     approved: "Inicio de sesión aprobado."
-    denied: "Inicio de sesión denegado."
+    denied: "Inicio de sesión rechazado."
 
   passwords:
     too_many_attempts: "Demasiados intentos. Espera unos minutos y vuelve a intentarlo."
@@ -134,18 +134,18 @@ es:
     too_many_requests: "Demasiadas solicitudes. Espera unos minutos."
     no_address: "Esta cuenta no tiene ninguna dirección que confirmar."
     already_confirmed: "Esa dirección ya está confirmada."
-    no_mailer: "Este servidor no puede enviar correo. Pregunta a un administrador."
+    no_mailer: "Este servidor no puede enviar correo. Pregunta a un gestor."
     sent: "Te enviamos un enlace de confirmación a %{email}."
 
   avatars:
-    updated: "Se actualizó tu foto."
+    updated: "Se cambió tu foto."
     removed: "Se eliminó tu foto."
 
   handshakes:
     answered: "esa solicitud de conexión ya se respondió"
     none_in_progress: "no hay ninguna solicitud de conexión en curso"
     not_permitted: "esta cuenta no puede conectar aplicaciones"
-    already_connected: "%{resource} ya está conectado; un administrador tiene que volver a conectarlo"
+    already_connected: "%{resource} ya está conectado; un gestor tiene que volver a conectarlo"
     beyond_account: "%{scopes} es más de lo que tiene esta cuenta"
     too_soon: "No se registró nada. Lee lo que pide y aprueba cuando termine la cuenta atrás."