masks-server 0.7.0

data/config/locales/en/handshakes.yml

@@ -0,0 +1,45 @@
+en:
+  handshakes:
+    show:
+      page_title: "Register a new client"
+      page_title_again: "Replace an existing client"
+      title: "Register a new client?"
+      title_again: "Replace an existing client?"
+      lede_html: "Approving registers <strong>%{name}</strong> for everyone on %{tenant} and allows only your account."
+      lede_again_html: "Approving replaces <strong>%{name}</strong> for everyone on %{tenant} and allows only your account."
+      client: "Credentials"
+      credentials:
+        public: "Public. It holds no secret."
+        secret: "Confidential. It receives a secret."
+        key: "Confidential. It signs with its own key."
+      replaces: "Replaces"
+      replaced: "The %{name} client %{who} approved on %{date}. Its current credentials stop working."
+      you: "you"
+      someone: "somebody"
+      may_ask: "May ask for"
+      manage_warning: "masks:manage lets anyone who signs in through %{name} change every setting on this server."
+      beneath:
+        one: "What that covers today (1)"
+        other: "What that covers today (%{count})"
+      signs_in_at: "Signs in at"
+      claims: "Claims"
+      claimed: "%{namespaces} becomes %{name}'s, and you are granted it now."
+      details: "Additional details"
+      origin: "From"
+      redirect_uris: "Redirect URIs"
+      returns: "Returns to"
+      auth_method: "Authenticates with"
+      backchannel: "Backchannel logout"
+      register: "Register and allow"
+      register_in: "Register and allow in %{seconds}"
+      replace: "Replace and allow"
+      replace_in: "Replace and allow in %{seconds}"
+      cancel: "Cancel"
+
+    refused:
+      page_title: "This connection was refused"
+      stopped: "Stopped"
+      title: "The app described itself in a way this server will not accept."
+      settle: "Nothing was shared. A namespace stays claimed until somebody releases it, so this is yours to settle rather than the app's — archive whatever holds the name, then release it."
+      open_manage: "Manage this server"
+      contact: "Nothing was shared. The app has to fix this."

data/config/locales/en/links.yml

@@ -0,0 +1,16 @@
+en:
+  links:
+    expired:
+      state: "Expired"
+      titles:
+        invitation: "This invitation is no longer valid"
+        reset: "This reset link is no longer valid"
+        confirmation: "This confirmation link is no longer valid"
+      lede: "Nothing changed on the account."
+      sign_in: "Sign in"
+
+    verified:
+      page_title: "Address confirmed"
+      state: "Confirmed"
+      title: "%{email} is confirmed."
+      account: "Your account"

data/config/locales/en/logins.yml

@@ -0,0 +1,272 @@
+en:
+  logins:
+    page:
+      title: "Sign in"
+      title_to: "Sign in to %{tenant}"
+
+    shared:
+      continue: "Continue"
+      code: "Six-digit code"
+      send_again: "Send it again"
+      sent_again: "Sent again"
+      checking: "Checking"
+      nickname: "Nickname"
+      account: "Account"
+      email: "Email"
+      name: "Name"
+      phone: "Phone"
+      password: "Password"
+      not_you: "Not you?"
+      sign_out: "Sign out"
+      use_passkey: "Use a passkey"
+      or: "or"
+      continue_with: "Continue with %{provider}"
+      waiting_for_passkey: "Waiting for your passkey"
+      passkey_hint: "Confirm with your device to keep going."
+      passkey_unoffered: "This server did not offer a passkey challenge."
+      passkey_unusable: "That passkey could not be used on this device."
+      unreachable: "Could not reach the server. Check your connection."
+      try_again: "Try again"
+      working: "Working"
+      halted: "This sign-in cannot continue."
+      halted_lede: "The request expired or was cancelled. Nothing was saved, and no one was signed in."
+      start_over: "Start over"
+
+    signing_up:
+      tabs: "Setting up"
+      tab_identification: "Identification"
+      tab_credentials: "Credentials"
+      tab_configuration: "Configuration"
+      tab_confirmation: "Confirmation"
+      setup_cap: "Welcome!"
+      setup_title: "Set up"
+      signup_title: "Create an account at"
+      token: "Setup token"
+      token_hint: "Printed in the server's logs, where only whoever runs masks can read it."
+      origin: "Set up at"
+      once: "This screen will not appear again."
+      docs: "Read the documentation."
+      confirm: "Confirm password"
+      password_hint: "At least %{minimum} characters."
+      edit: "Edit"
+      submit_first_run: "Create the manager"
+      submit_signup: "Create my account"
+      have_account: "Already have an account?"
+      sign_in_instead: "Sign in instead"
+      needs_script: "Signing up here needs JavaScript, which this browser has turned off. Turn it on, or use another browser."
+      proving: "Checking this browser"
+
+    identify:
+      heading: "Sign in to continue"
+      heading_to: "Sign in to %{client}"
+      identifier: "Nickname or email"
+      signup_hint: "New here? Enter the address you want to use, and an account is made for it."
+
+    first_factor:
+      title: "Enter your password"
+      title_code: "Sign in with a code"
+      forgot: "Forgot it?"
+      email_me: "Email me a code instead"
+      email_only: "Email me a code"
+
+    email_code:
+      title: "Check your email"
+      lede: "If %{identifier} has an account here, a six-digit code is on its way. It works for ten minutes."
+      send_again: "Send another code"
+      sent_again: "Sent"
+
+    second_factor:
+      title: "Enter your code"
+      title_passkey: "Use your second factor"
+      trust: "Trust this device for %{duration}"
+      use_backup_code: "Use a backup code"
+      stuck_insecure: "This account's second factor is a passkey, and the browser only offers passkeys to a page served over HTTPS. Open this page over HTTPS to continue."
+      stuck_unsupported: "This account's second factor is a passkey, and this browser does not support passkeys. Open this page in a browser that does to continue."
+      stuck_no_script: "This account's second factor is a passkey, and a passkey needs JavaScript. Turn JavaScript on to continue."
+      stuck_inbox: "This sign-in began from your inbox, so a code sent there cannot confirm it. Start over and sign in with your password to use an email code."
+      stuck_nothing: "This account has no second factor this sign-in can use. A manager can reset it."
+      recovery_request: "I cannot use any of these"
+      recovery_ask: "Ask a manager for help"
+      recovery_requested: "A manager has been asked to reset your second factors. They may contact you to make sure it is you. Once they have, sign in again to set up a new one."
+      sent_to: "Sent to %{to}."
+      send_email: "Email a code to %{to}"
+      send_sms: "Text a code to %{to}"
+      send_again: "Send it again"
+      use_app: "Use your authenticator app instead"
+      use_trusted_device: "Approve from a device you trust"
+      approval_code: "On a device you trusted before, open your account page and enter this code under Approve a sign-in."
+      approval_waiting: "Waiting for approval"
+      approval_expired: "That code expired."
+      approval_again: "Show a new code"
+      approval_checked: "I approved it"
+
+    enrol:
+      title: "Secure your account"
+      lede: "Add as many second factors as you like. This account needs at least one."
+      lede_optional: "Add as many second factors as you like."
+      otp: "Authenticator app"
+      otp_on: "On"
+      scan_hint: "Scan it, or enter this key by hand:"
+      open: "Open in your authenticator app"
+      turn_on: "Turn it on"
+      passkeys: "Passkeys"
+      passkeys_none: "None yet. One that checks a PIN or fingerprint counts."
+      passkeys_some: "%{count} added"
+      add_passkey: "Add a passkey"
+      add_another_passkey: "Add another"
+      codes_email: "Email codes"
+      codes_email_hint: "A code sent to %{to} confirms each sign-in."
+      codes_sms: "SMS codes"
+      codes_sms_hint: "A code sent to %{to} by SMS confirms each sign-in."
+      send_code: "Send a code to turn it on"
+      sent_to: "Sent to %{to}."
+      backup_codes: "Backup codes"
+      backup_codes_waiting: "Made for you once a factor above is on."
+      backup_codes_hint: "Each one signs in once, when nothing else is to hand. They are not shown again."
+      backup_codes_left: "%{count} left"
+      backup_codes_file: "Backup codes for %{account} at %{origin}"
+      copy: "Copy them"
+      copied: "Copied"
+      download: "Download them"
+      kept: "I have kept my backup codes somewhere safe"
+      done: "Continue"
+      skip: "Skip for now"
+
+    backup_code:
+      title: "Use a backup code"
+      code: "Backup code"
+      hint: "Each one works once."
+      use_authenticator: "Use your authenticator app"
+
+    accept_invitation:
+      title: "Accept your invitation"
+      invited_by: "%{nickname} invited you."
+      hint: "At least %{minimum} characters."
+      working: "Accepting"
+
+    reset_password:
+      title: "Set a new password"
+      password: "New password"
+      hint: "At least %{minimum} characters. Signs you out everywhere else."
+      working: "Setting"
+
+    signup_credentials:
+      working: "Creating"
+      create_passkey: "Create a passkey"
+      passkey_lede: "Your device keeps the passkey and checks it is you the way it already unlocks. There is no password to remember."
+      no_passkeys: "This browser cannot make a passkey. Try another browser or device."
+      way: "Sign in with"
+      way_passkey: "A passkey"
+      way_password: "A password"
+      passkey_later: "It counts as both factors at once. A password can be added later from your account."
+
+    prove_email:
+      title: "Check your email"
+      lede: "A six-digit code is on its way to %{email}. Enter it to carry on."
+      no_mailer: "This server cannot send email yet, so an address cannot be used to sign in. Use your nickname, or ask a manager."
+
+    setup_configure:
+      called: "This server is called"
+      called_hint: "It heads every screen, and every email masks sends."
+      submit: "Finish setting up"
+      working: "Finishing"
+
+    confirm_email:
+      title: "Check your email"
+      lede: "A six-digit code is on its way to %{email}."
+      lede_link: "A link is on its way to %{email}. Open it, and this page carries on by itself."
+      waiting: "Waiting for the link to be opened"
+      no_mailer: "This server cannot send email yet, so the address cannot be confirmed. Ask a manager."
+
+    confirm_phone:
+      title: "Check your phone"
+      lede: "A six-digit code is on its way to %{phone}."
+      change_phone: "Use a different number"
+      no_texts: "This server cannot send SMS yet, so the number cannot be confirmed. Ask a manager."
+
+    add_phone:
+      title: "Add a phone number"
+      lede: "Signing in here needs a phone number on the account."
+      hint: "In international form, starting with + and the country code."
+
+    awaiting_approval:
+      title: "Waiting for a manager"
+      lede: "Your account is made, but a manager has to let you in first. You will get an email when they do."
+      waiting: "Checking every few seconds"
+      check: "Check again"
+
+    choose_organization:
+      title: "Choose an organization"
+      title_to: "Choose an organization for %{client}"
+      lede: "You belong to more than one. You can switch later by signing in again."
+      as: "%{organization}, as %{role}"
+
+    consent:
+      title: "Allow %{client}?"
+      access: "Access"
+      no_access: "Nothing beyond confirming who you are."
+      audience: "On your behalf at"
+      details: "Exactly this"
+      returns_to: "Then back to"
+      site: "About %{client}"
+      terms: "Its terms"
+      privacy: "Its privacy policy"
+      allow: "Allow"
+      deny: "Deny"
+      working: "Allowing"
+
+    settled:
+      heading: "Signed in"
+      heading_to: "Signed in to %{client}"
+      waiting: "Taking you back"
+
+    warnings:
+      invalid-credentials: "That nickname and password do not match."
+      invalid-code: "That code is not valid."
+      invalid-backup-code: "That backup code is not valid."
+      invalid-passkey: "That passkey could not be used."
+      factor-not-offered: "That way of signing in is not offered here."
+      approval-denied: "That sign-in was denied from a trusted device."
+      passkey-expired: "That passkey attempt expired. Try again."
+      passkey-unverified: "That passkey did not ask who you are. Use one that checks a PIN or fingerprint."
+      passkey-unusable: "That passkey could not be added."
+      passkey-crowded: "This account already has as many passkeys as this server keeps."
+      second-factor-required: "Turn on at least one second factor to continue."
+      backup-codes-unkept: "Keep your backup codes before you continue."
+      missing-identifier: "Enter your nickname or email."
+      missing-first-factor: "That step expired. Start over."
+      too-many-attempts: "Too many attempts. Wait a few minutes."
+      too-many-attempts-for-account: "Too many attempts for that account."
+      too-many-codes: "Too many codes have gone to that address. Wait a few minutes."
+      prove-email-first: "Enter the code sent to that address first."
+      no-account-for-email: "No account here uses that address."
+      invalid-setup-token: "That setup token is wrong."
+      missing-nickname: "Choose a nickname."
+      short-password: "That password is too short."
+      mismatched-password: "Those passwords do not match."
+      invalid-configuration: "That configuration cannot be saved."
+      invalid-account: "That nickname cannot be used here."
+      missing-email: "Enter an email address."
+      missing-phone: "Enter a phone number."
+      invalid-phone: "Enter the phone number in international form, like +15551234567."
+      common-password: "That password is one of the most common. Choose another."
+      breached-password: "That password has appeared in a data breach. Choose another."
+      risky-sign-in: "This sign-in looks unusual, so it cannot continue from here. Try from a device you have used before, or ask a manager."
+      confirmation-expired: "That code expired. Send another."
+      signup-domain-refused: "Accounts here cannot be made with that address."
+      work-unsolved: "This browser did not finish the check that keeps out automated signups. Try again."
+      invitation-expired: "That invitation is no longer valid. Ask for another."
+      reset-expired: "That reset link is no longer valid. Ask for another."
+      no-mailer: "This server cannot send email. Ask a manager."
+      sso-failed: "That sign-in did not complete. Try again."
+      sso-expired: "That sign-in took too long. Try again."
+      sso-unavailable: "That way of signing in is not available."
+      sso-no-account: "No account here matches that sign-in. Ask for an invitation."
+      sso-unverified: "That provider did not confirm the address belongs to you."
+      sso-domain-refused: "That address is not allowed to sign in here."
+      sso-unauthoritative: "That provider does not answer for that address here."
+
+    notices:
+      reset-sent: "If that account exists, a reset link is on its way."
+      organization-sign-in: "That organization asks you to sign in another way."
+      sso-claiming: "An account here already holds that address. Sign in to it once and the two are linked."

data/config/locales/en/mailers.yml

@@ -0,0 +1,135 @@
+en:
+  actor_mailer:
+    shared:
+      fallback: "Or paste this into your browser:"
+      sent_by: "Sent by %{tenant}'s sign-in service."
+      sent_by_html: "This message was sent by %{tenant}’s sign-in service."
+
+    invitation:
+      subject: "You have been invited to %{tenant}"
+      invited_by: "%{nickname} invited you to %{tenant}."
+      invited: "You have been invited to %{tenant}."
+      organization_after: "Once you have a password, %{organization} is waiting on your account page to be accepted."
+      nickname_html: "Your nickname is %{nickname}. Open the link to choose a password."
+      nickname: "Your nickname is %{nickname}. Open the link to choose a password."
+      action: "Choose a password"
+      expiry: "Works once, expires in %{duration}. Nothing happens until somebody opens it."
+
+    organization_invitation:
+      subject: "Join %{organization}"
+      invited_by: "%{nickname} invited you to join %{organization} as %{role}."
+      invited: "You have been invited to join %{organization} as %{role}."
+      grants: "Nothing changes until you accept. Once you do, apps that ask which organization you are signing in for can sign you in as %{role} of %{organization}."
+      action: "Accept or decline"
+      unexpected: "If you do not know %{organization}, decline it. An invitation you never accept grants nothing."
+
+    password_reset:
+      subject: "Reset your %{tenant} password"
+      opened_by: "%{nickname} started a password reset for your %{tenant} account."
+      opened: "Somebody asked to reset the password for your %{tenant} account."
+      action: "Reset your password"
+      expiry: "Works once, expires in %{duration}. Setting a new password signs you out everywhere else. If this was not you, ignore it — nothing has changed."
+
+    notification:
+      subject: "%{said} — %{tenant}"
+      action: "Review your account"
+      by: "%{nickname} did this, not you."
+      seen: "Recorded %{at}."
+      wrong: "If this was not you, change your password and sign out everywhere."
+      manage: "Choose which of these arrive"
+
+      said:
+        password:
+          changed: "The password on your %{tenant} account was changed."
+          reset_completed: "Your %{tenant} password was reset through a link sent to this address. Every other session was signed out."
+        passkey:
+          added: "A passkey was added to your %{tenant} account. It can now sign in without a password."
+          removed: "A passkey was removed from your %{tenant} account."
+        backup_codes:
+          generated: "A fresh set of backup codes was generated for your %{tenant} account. The codes printed before this no longer work."
+        backup_code:
+          spent: "A backup code was used to sign in to your %{tenant} account. %{remaining} are left."
+        email:
+          changed: "The email address on your %{tenant} account was changed to another address. Password resets and notices about the account no longer come here."
+        phone:
+          changed: "The phone number on your %{tenant} account was changed. SMS codes go to the new number."
+          removed: "The phone number was removed from your %{tenant} account."
+        recovery:
+          requested: "Someone who knows how to sign in to your %{tenant} account asked a manager to reset its second factors. If it was not you, change your password now."
+        second_factors:
+          reset: "A manager reset the second factors on your %{tenant} account. The next sign-in asks you to set up a new one, and every session was signed out."
+        authenticator:
+          enabled: "An authenticator app was added to your %{tenant} account. Signing in now asks for its code."
+          disabled: "The authenticator app on your %{tenant} account was removed. It is no longer asked for at sign-in."
+        email_codes:
+          enabled: "Signing in to your %{tenant} account can now be confirmed with a code sent to this address."
+          disabled: "Signing in to your %{tenant} account can no longer be confirmed with a code sent to this address."
+        text_codes:
+          enabled: "Signing in to your %{tenant} account can now be confirmed with a code sent to your phone."
+          disabled: "Signing in to your %{tenant} account can no longer be confirmed with a code sent to your phone."
+        session:
+          started: "Somebody signed in to your %{tenant} account on a device that had not been seen before."
+          revoked: "A session on your %{tenant} account was ended for you."
+        sign_in:
+          risky: "A sign-in to your %{tenant} account looked unusual, so it was asked for more or refused. If it was not you, change your password."
+        device:
+          blocked: "A device was blocked from your %{tenant} account. It cannot sign in until somebody unblocks it."
+        consent:
+          granted: "%{client} was allowed into your %{tenant} account and can now read what you agreed to share."
+        connection:
+          linked: "%{provider} was connected to your %{tenant} account and can now be used to sign in."
+          unlinked: "%{provider} was disconnected from your %{tenant} account."
+        device_code:
+          approved: "%{client} was signed in to your %{tenant} account from a device that showed you a code."
+        actor:
+          scopes_changed: "What your %{tenant} account is allowed to do was changed."
+        account:
+          exported: "Everything your %{tenant} account holds was downloaded as a file."
+        membership:
+          role_changed: "Your role in %{organization} changed from %{was} to %{role}. Apps you are signed in to for %{organization} will pick it up the next time they check."
+          removed: "You were removed from %{organization}. Apps signed in for %{organization} were signed out."
+          suspended: "%{organization} was archived. Apps signed in for it were signed out, and it is no longer offered when you sign in."
+
+      wrong_for:
+        membership:
+          role_changed: "If this looks wrong, ask an owner of %{organization}."
+          removed: "If this looks wrong, ask an owner of %{organization} to add you again."
+          suspended: "If this looks wrong, ask a manager to restore %{organization}."
+
+    confirmation_code:
+      subject: "%{code} is your %{tenant} confirmation code"
+      lede: "Enter this code where you are signing in to %{tenant}."
+      expiry: "It works once and expires in %{duration}. If this was not you, ignore it."
+
+    approval_requested:
+      subject: "%{nickname} is waiting to be let in to %{tenant}"
+      lede: "%{nickname} created an account at %{tenant}. It cannot sign in until a manager approves it."
+      action: "Review the account"
+
+    recovery_requested:
+      subject: "%{nickname} asked for help signing in to %{tenant}"
+      lede: "%{nickname} signed in to %{tenant} with their first factor and cannot finish with a second one. Make sure it is really them, by a call or in person, before you reset their second factors."
+      action: "Review the account"
+
+    idle:
+      subject:
+        active: "Sign in to keep your %{tenant} account"
+        suspended: "Your suspended %{tenant} account will be deleted"
+      lede:
+        suspend: "Nobody has signed in to your %{tenant} account for a while. Unless you sign in by %{due}, it will be suspended, and only a manager can restore it."
+        delete: "Nobody has signed in to your %{tenant} account for a while. Unless you sign in by %{due}, it will be deleted, along with everything it holds."
+        delete_suspended: "Your %{tenant} account was suspended because nobody used it. It will be deleted on %{due}, along with everything it holds, unless a manager restores it first."
+      keep: "Signing in once keeps it."
+      action: "Sign in"
+
+    approved:
+      subject: "Your %{tenant} account is ready"
+      lede: "A manager approved your account at %{tenant}. You can sign in now."
+      action: "Sign in"
+
+    email_verification:
+      subject: "Confirm your email address for %{tenant}"
+      confirm_html: "Confirm this address for %{nickname} at %{tenant}."
+      confirm: "Confirm this address for %{nickname} at %{tenant}."
+      action: "Confirm this address"
+      expiry: "Works once, expires in %{duration}. If this was not you, ignore it — nothing else changes."

data/config/locales/en/manage/activity.yml

@@ -0,0 +1,31 @@
+en:
+  manage:
+    activity:
+      parts:
+        log: "Log"
+        streams: "Streams"
+      title: "Activity"
+      nouns:
+        actor: "actor"
+        client: "client"
+      downloading:
+        one: "Downloading %{count} event."
+        other: "Downloading %{count} events."
+      involves: "Only what involves the %{noun}"
+      involves_end: "."
+      gone:
+        actor: "Only what involves one actor, which no longer exists."
+        client: "Only what involves one client, which no longer exists."
+      everything: "Show everything"
+      show: "Show"
+      all: "everything"
+      grave: "Only what is worth a look"
+      export:
+        title: "Export"
+        lede: "Every event in a range as newline-delimited JSON, in the shape event streams send. It follows the filter above."
+        from: "From"
+        through: "Through"
+        download: "Download"
+      empty:
+        grave: "Nothing worth a look."
+        plain: "Nothing yet."

data/config/locales/en/manage/actor.yml

@@ -0,0 +1,125 @@
+en:
+  manage:
+    actor:
+      fields:
+        nickname: "Nickname"
+        name: "Name"
+        email: "Email"
+        given_name: "Given name"
+        family_name: "Family name"
+        middle_name: "Middle name"
+        profile_url: "Profile URL"
+        picture_url: "Picture URL"
+        website_url: "Website"
+        gender: "Gender"
+        birthdate: "Birthdate"
+        zoneinfo: "Time zone"
+        locale: "Locale"
+      left_group: "Out of %{group}."
+      joined_group: "In %{group}."
+      profile_saved: "Profile saved."
+      scopes_updated: "Scopes updated."
+      codes_generated: "Backup codes generated. They are shown once and never again."
+      emailed: "Emailed. The link is not shown here, so that using it proves the address."
+      no_mailer: "No mailer is configured, so pass this link along yourself. It works once."
+      reset_question: "Start a password reset? Every session and refresh token ends when the link is used."
+      resend_question: "Send a fresh invitation? The previous one stops working."
+      confirm_question: "Send a confirmation link for this address? Any earlier one stops working."
+      remove_passkey_question: "Remove the passkey “%{label}”?"
+      passkey_removed: "Passkey removed."
+      photo_updated: "Photo updated."
+      remove_photo_question: "Remove this actor's photo?"
+      photo_removed: "Photo removed."
+      disable_question: "Remove this actor's authenticator app and every backup code?"
+      authenticator_removed: "Authenticator removed."
+      factors:
+        email:
+          name: "Email codes"
+          lower: "email codes"
+        sms:
+          name: "SMS codes"
+          lower: "SMS codes"
+      turn_off_question: "Turn off %{name} for this actor?"
+      turned_off: "%{name} turned off."
+      suspend_question: "Suspend %{identifier}? They are signed out everywhere, every token they hold stops working, and they cannot sign in until they are restored."
+      suspended: "Suspended."
+      restored: "Restored. They can sign in again."
+      delete_question: "Delete %{identifier}? Their sessions, tokens, passkeys, consents and avatar go with them. There is no undo, and nothing is kept."
+      missing: "There is no such actor."
+      back: "Actors"
+      signed_in_lede: "Signed in %{when}."
+      invited_lede: "Invited, and has not accepted yet."
+      never: "never"
+      link_once: "This link works once."
+      write_down: "Write these down. They are not recoverable."
+      profile: "Profile"
+      more_fields: "More fields"
+      save_profile: "Save profile"
+      signed_in: "Signed in"
+      signed_in_yourself: "Signing out everywhere signs you out here too."
+      consents: "Consents"
+      connections: "Connected accounts"
+      tokens: "Tokens"
+      photo: "Photo"
+      styles:
+        photo: "photo"
+        identicon: "identicon"
+        initials: "initials"
+      upload_photo: "Upload photo"
+      remove_photo: "Remove photo"
+      uploading: "Uploading..."
+      scopes: "Scopes"
+      access: "Access"
+      suspended_on: "Suspended %{day}. They cannot sign in."
+      restore: "Restore"
+      provisioned_as: "Provisioned as"
+      provider_may_change: "The identity provider may change or suspend this actor too."
+      directory_provisioned: "%{organization}'s directory provisioned them as"
+      directory_may_change: "and may change them too."
+      reset_password: "Reset password"
+      invited_on: "Invited %{day}, not accepted."
+      invited: "Invited, not accepted."
+      resend: "Resend invitation"
+      unconfirmed: "%{email} is unconfirmed."
+      send_confirmation: "Send a confirmation link"
+      passkeys: "Passkeys"
+      no_passkeys: "None enrolled."
+      verifying: "verifying"
+      remove: "Remove"
+      compromise: "Compromise reported for this model: %{compromise}."
+      no_aaguid: "no aaguid"
+      last_used: "Last used %{when}"
+      approval:
+        title: "Awaiting approval"
+        lede: "They cannot sign in until a manager approves them."
+        approved: "Approved. They can sign in now, and they have been told."
+        approve: "Approve"
+      recovery:
+        title: "Asking for help"
+        lede: "They got past their first factor %{when} and cannot finish with a second one. Make sure it is really them, by a call or in person, before you reset."
+        explain: "Resetting removes their authenticator app, backup codes, passkeys, and sign-in codes, and signs them out everywhere. Their next sign-in asks them to set up a new second factor."
+        question: "Reset every second factor %{identifier} has?"
+        done: "Second factors reset. They have been told, and can set up a new one at their next sign-in."
+        reset: "Reset second factors"
+        dismissed: "Dismissed."
+        dismiss: "Dismiss"
+      groups: "Groups"
+      no_groups: "No groups yet."
+      add_group: "Add one"
+      group_labels: "Apps that ask for groups see %{labels}."
+      second_factor: "Second factor"
+      authenticator_enabled:
+        one: "Authenticator enabled. %{count} backup code remaining."
+        other: "Authenticator enabled. %{count} backup codes remaining."
+      generate: "Generate backup codes"
+      remove_authenticator: "Remove authenticator app"
+      password_only: "Password only — nothing enrolled."
+      factor_on: "%{name} on."
+      turn_off: "Turn off %{name}"
+      activity: "Activity"
+      all_activity: "All activity"
+      no_activity: "Nothing yet."
+      danger: "Suspend or delete"
+      yourself: "This is you — another manager has to do it."
+      suspend: "Suspend %{identifier}"
+      delete: "Delete %{identifier}"