masks-server 0.7.0

data/config/locales/en/manage/actors.yml

@@ -0,0 +1,78 @@
+en:
+  manage:
+    actors:
+      invite_many: "Invite many"
+      invites:
+        title: "Invite many people"
+        lede: "Paste addresses separated by lines, spaces, or commas. Each new address gets an invitation."
+        addresses: "Email addresses"
+        groups: "Put them in"
+        send: "Send invitations"
+        done:
+          one: "%{count} invited"
+          other: "%{count} invited"
+        outcomes:
+          invited: "invited"
+          exists: "already has an account"
+          invalid: "is not an address masks can invite"
+      title: "Actors"
+      lenses:
+        everyone: "Everyone"
+        invited: "Invited"
+        waiting: "Awaiting approval"
+        help: "Asking for help"
+        managers: "Managers"
+        suspended: "Suspended"
+      columns:
+        actor: "Actor"
+        scopes: "Scopes"
+        second_factor: "Second factor"
+        signed_in_on: "Signed in on"
+        last_seen: "Last seen"
+      sessions:
+        one: "%{count} session"
+        other: "%{count} sessions"
+      devices:
+        one: "%{count} device"
+        other: "%{count} devices"
+      who: "Who to show"
+      search: "Search actors"
+      search_placeholder: "nickname, email or name"
+      add: "Add actor"
+      form:
+        nickname: "Nickname"
+        email: "Email"
+        password: "Password"
+        password_placeholder: "blank sends a one-time link"
+        minimum: "At least %{count} characters, and you will know it."
+        scopes: "Scopes"
+        adding: "Adding..."
+        create: "Create the account"
+        invite: "Send the invitation"
+        cancel: "Cancel"
+      created:
+        account: "Account created"
+        invitation: "Invitation sent"
+        can_sign_in: "%{identifier} can sign in now."
+        confirm_link: "This link confirms their address:"
+        emailed: "Emailed — accepting it proves the address."
+        pass_along: "Pass this link along yourself. It works once."
+      empty:
+        search: "No actor matches \"%{search}\"."
+        waiting: "Nobody is awaiting approval."
+        help: "Nobody has asked for help signing in."
+        invited: "Nobody is waiting on an invitation."
+        managers: "Nobody else holds masks:manage."
+        suspended: "Nobody is suspended."
+        everyone: "Nobody can sign in yet. Add the first actor."
+      no_email: "no email"
+      unconfirmed: "unconfirmed"
+      invited: "invited"
+      last_seen: "Last seen %{when}"
+      never: "never"
+      authenticator: "authenticator"
+      blocked: "blocked"
+      backup_codes:
+        one: "%{count} backup code"
+        other: "%{count} backup codes"
+      password: "password"

data/config/locales/en/manage/api.yml

@@ -0,0 +1,5 @@
+en:
+  manage:
+    api:
+      unregistered: "this browser has no client registered"
+      refused: "refused"

data/config/locales/en/manage/app.yml

@@ -0,0 +1,24 @@
+en:
+  manage:
+    app:
+      waiting:
+        one: "%{count} person is waiting on you"
+        other: "%{count} people are waiting on you"
+      missing: "There is no page at this address."
+      account: "Account"
+      starting: "Starting"
+      stopped: "Stopped"
+      failed: "Could not sign in to manage %{tenant}"
+      retry: "Try again"
+      settings: "Settings"
+      sections: "Sections"
+      nav:
+        overview: "Overview"
+        actors: "Actors"
+        organizations: "Organizations"
+        clients: "Clients"
+      limited:
+        read: "You can read everything here and change nothing."
+        support: "You can help people with their accounts. Settings, keys, and other managers need an owner."
+        security: "You can change keys, apps, providers, and policies. People's accounts need support or an owner."
+        both: "You can change settings and help people. Other managers and tenant settings need an owner."

data/config/locales/en/manage/client.yml

@@ -0,0 +1,187 @@
+en:
+  manage:
+    client:
+      parts:
+        label: "Client"
+        general: "General"
+        access: "Access"
+        endpoints: "Endpoints"
+        usage: "Usage"
+      missing: "There is no client with that id."
+      back: "Clients"
+      name_ids:
+        persistent: "A persistent identifier"
+        email: "Their email"
+      facts:
+        origin: "How it got here"
+        self_registered: "self-registered"
+        approved: "approved"
+        approved_by: "Approved by"
+        registered: "Registered"
+        grants: "Grants"
+        response_types: "Response types"
+      subjects:
+        public: "The same identifier every client sees (public)"
+        pairwise: "An identifier only it knows (pairwise)"
+      grants:
+        refresh_token: "Keeps actors signed in (refresh tokens)"
+        device_code: "Signs in on devices without a browser (device code)"
+        token_exchange: "Swaps one token for another (token exchange)"
+      links:
+        logo_uri:
+          label: "Logo URL"
+          saved: "The logo is being fetched. It shows here in a moment."
+        client_uri:
+          label: "Home page"
+          saved: "Home page saved."
+        tos_uri:
+          label: "Terms of service"
+          saved: "Terms saved."
+        policy_uri:
+          label: "Privacy policy"
+          saved: "Privacy policy saved."
+      methods:
+        client_secret_basic: "Secret, in a Basic header"
+        client_secret_post: "Secret, in the form"
+        private_key_jwt: "An assertion signed with its own key"
+      notices:
+        saved: "Saved."
+        cleared: "Cleared."
+        renamed: "Renamed."
+        restored: "Restored."
+        archived: "Archived."
+        rotated: "A new secret was issued."
+        groups: "Who may sign in is updated."
+        unattended_on: "It can ask for a token of its own now, with client_credentials."
+        unattended_off: "It can no longer ask for a token of its own."
+        subject: "Saved. Everybody has a new identifier at this client."
+        keys_signing: "Its keys are saved, and it signs its own assertions now."
+        keys: "Keys saved."
+        declared: "Declared types saved."
+        attributes: "Attributes saved."
+        attributes_default: "It is sent the usual attributes."
+        signs_assertions: "It signs its own assertions now. Its secret no longer works."
+        uses_secret: "It uses a secret now. Rotate one to hand it."
+        grants: "Grants updated."
+        entity_id: "Entity ID saved."
+        certificate_saved: "Certificate saved."
+        certificate_removed: "Certificate removed."
+        signed_refused: "Unsigned requests are refused."
+        signed_read: "Unsigned requests are read."
+        idp_initiated_on: "Actors can be signed into it from masks, without it asking."
+        idp_initiated_off: "It is signed into only when it asks."
+        policy: "Policy updated."
+        par_on: "PAR required. Plain /authorize links are refused."
+        par_off: "PAR optional."
+        dpop_on: "Its access tokens are bound to its key. A token without a proof is refused."
+        dpop_off: "Bearer tokens."
+        consent_on: "Consent required. Each actor approves what this client asks for."
+        consent_off: "Consent skipped. Nobody is asked before this client is granted access."
+        access_minutes: "Access tokens last %{minutes} minutes."
+        access_default: "Access tokens last an hour."
+        refresh_days: "Refresh tokens last %{days} days unused."
+        refresh_default: "Refresh tokens last 30 days unused."
+        consent_days: "Each consent lasts %{days} days, then the person is asked again."
+        consent_default: "Consent lasts until revoked."
+        jar_on: "Signed requests required. An unsigned /authorize or pushed request is refused."
+        jar_off: "Signed requests optional."
+        scopes: "Scopes updated."
+        redirects: "Redirect URIs saved."
+        post_logout: "Post-logout URIs saved."
+        resources: "Resources saved."
+        types: "Types saved."
+      errors:
+        jwks: "That key set is not JSON."
+        declared: "Those declarations are not JSON."
+        attributes: "Write one attribute = claim on each line."
+      confirm:
+        subject: "Everybody gets a different identifier at this client. It will not recognise anybody it already knows. Change it?"
+        restore: "Restore this client? It can sign actors in again immediately."
+        rotate: "Issue a new secret? The one in use stops working immediately."
+        archive: "Archive this client? Nothing will be able to sign in with it."
+      archived_on: "Archived on %{day}. It can no longer sign anybody in."
+      restore: "Restore it"
+      secret_once: "This secret is shown once. Copy it now."
+      save: "Save"
+      registration:
+        title: "Registration"
+        name: "Name"
+        saml: "A SAML application. It is signed into with an assertion, not a token."
+        public: "A public client. It authenticates with nothing, and proves itself with PKCE."
+        authenticates: "Authenticates with"
+        needs_keys: "Give it keys under Keys, and it switches to signing its own assertions."
+        knows_as: "Knows actors as"
+        sector: "Sector identifier URI"
+        sector_placeholder: "needed when its redirect URIs span several hosts"
+        unattended: "Signs in as itself (client_credentials)"
+        rotate: "Rotate secret"
+        archive: "Archive"
+      saml:
+        title: "SAML"
+        entity_id: "Entity ID"
+        metadata: "masks metadata"
+        initiate: "Start from masks"
+        names_by: "Names actors by"
+        certificate: "Its signing certificate"
+        attributes: "Attributes it is sent, one attribute = claim a line"
+        attributes_hint: "Left empty, it is sent the ones shown. An email is sent only once confirmed."
+        requests_signed: "Refuse requests it did not sign"
+        idp_initiated: "Let actors start from masks"
+        slo_url: "Single logout URL"
+        slo_url_hint: "When an actor who signed in to it signs out of masks, masks posts a signed LogoutRequest here. The app's own LogoutRequests are answered here too, and must be signed with its certificate."
+      shown:
+        title: "Shown to actors"
+        unapproved: "Nobody sees its logo until it is approved: a client that registered itself could borrow anybody's."
+        approved: "Its logo, and these links, are shown when actors are asked to let it in."
+      sign_in:
+        title: "Sign-in"
+        policy: "Policy"
+        default: "Default (%{name})"
+        built_in: "built-in"
+        archived: "%{name} is archived, so %{fallback} applies instead."
+        differs: "Where it differs from %{name}"
+        same: "The same as %{name} in every way."
+        par: "Require pushed requests (PAR)"
+        dpop: "Bind its access tokens to a key (DPoP)"
+        consent: "Ask actors to consent"
+        access: "Access tokens last (minutes, blank for an hour)"
+        refresh: "Refresh tokens last unused (days, blank for 30)"
+        consent_lifetime: "Consent lasts (days, blank until revoked)"
+        logout: "Back-channel logout URI"
+        logout_session: "Its logout token names the session (sid)"
+      keys:
+        title: "Keys"
+        hint: "What masks checks its signed assertions (private_key_jwt) and signed requests (JAR) against. A URL or the key set itself, not both."
+        jwks_uri: "Key set URL (jwks_uri)"
+        jwks: "Or the key set (JWKS)"
+        jar: "Require signed request objects (JAR)"
+      groups:
+        title: "Who may sign in"
+        lede: "Everyone, or only people in the groups ticked here. An organization role written as key:role counts as a group."
+        none: "No groups yet."
+        add: "Add one"
+        limit: "to limit who may sign in."
+        roles: "Organization roles"
+        only: "Only %{groups} may sign in."
+        everyone: "Everyone may sign in."
+      scopes:
+        title: "Scopes"
+        always: "Always granted"
+        on_request: "On request"
+      uris:
+        title: "URIs"
+        acs: "Assertion consumer services"
+        redirect: "Redirect"
+        post_logout: "Post-logout redirect"
+        resources: "Resources"
+      details:
+        title: "Authorization details"
+        hint: "Rich authorization requests (RFC 9396). A client asks for the types it lists here, and an approved client declares the types it accepts as a resource, each with a label shown at consent and a schema."
+        types: "Types it may ask for"
+        accepts: "Types it accepts"
+      consents: "Consents"
+      tokens: "Tokens"
+      activity:
+        title: "Activity"
+        all: "All activity"
+        empty: "Nothing yet."

data/config/locales/en/manage/clients.yml

@@ -0,0 +1,62 @@
+en:
+  manage:
+    clients:
+      title: "Clients"
+      archived: "Archived"
+      search: "Search clients"
+      search_placeholder: "name or client_id"
+      add: "Add client"
+      name: "Name"
+      name_placeholder: "Nightly indexer"
+      kind: "What kind of client"
+      kinds:
+        service: "Signs in as itself"
+        app: "Signs actors in"
+        saml: "SAML app"
+        preset: "A known app"
+      app: "App"
+      choose: "Choose one"
+      address: "Its address"
+      slug: "Name it uses for masks"
+      hints:
+        preset: "masks fills in its redirect URIs and scopes, and shows what to enter in the app. Name is optional here."
+        service: "It asks the token endpoint for its own token with client_credentials. No actor is behind it, so it never holds openid, profile, email or masks:manage."
+        saml: "It sends actors here with a SAML AuthnRequest, and masks posts a signed assertion back. Paste its metadata to fill the rest in."
+        app: "It sends actors to sign in and is handed a token on their behalf."
+      metadata: "Its metadata"
+      read: "Read it"
+      entity_id: "Entity ID"
+      acs: "Assertion consumer services"
+      certificate: "Signing certificate, if it signs its requests"
+      requests_signed: "Refuse requests it did not sign"
+      slo_url: "Single logout URL, if it has one"
+      redirect_uris: "Redirect URIs"
+      resources: "Resources"
+      scopes: "Scopes"
+      adding: "Adding..."
+      submit: "Add the client"
+      cancel: "Cancel"
+      created:
+        title: "%{name} is ready"
+        client_id: "Its client_id is below."
+        client_id_and_secret: "Its client_id is below, with a secret shown this once. Copy it now."
+        settings: "Enter these in %{name}. The secret appears in them too, and is not shown again."
+        guide: "Its guide"
+        open: "Open it"
+      columns:
+        name: "Name"
+        resources: "Resources"
+        source: "Source"
+        namespaces: "Namespaces"
+        scopes: "Scopes"
+        approved_by: "Approved by"
+        registered: "Registered"
+      self_registered: "self-registered"
+      approved: "approved"
+      always: "always"
+      on_request: "on request"
+      empty:
+        matches: "No client matches “%{query}”."
+        archived_matches: "No archived client matches “%{query}”."
+        archived: "Nothing has been archived."
+        none: "No clients registered yet."

data/config/locales/en/manage/connections.yml

@@ -0,0 +1,18 @@
+en:
+  manage:
+    connections:
+      stop_confirm: "Stop %{client} using this %{provider} account? It has to ask again."
+      stopped: "%{client} can no longer use it."
+      disconnect_confirm: "Disconnect %{held}? It stops signing anybody in until it is linked again, and every application using it stops."
+      disconnected: "Disconnected."
+      empty: "Nothing connected."
+      badges:
+        signs_in: "signs in"
+        unconfirmed: "unconfirmed"
+        delegable: "tokens held"
+      disconnect: "Disconnect"
+      connected: "Connected %{when}"
+      signed_in: "Signed in %{when}"
+      can_use: "can use it"
+      can_use_last: "can use it · last used %{when}"
+      stop: "Stop"

data/config/locales/en/manage/consents.yml

@@ -0,0 +1,10 @@
+en:
+  manage:
+    consents:
+      revoke_confirm: "Cut %{held} off? Every refresh token it holds is revoked, and it has to ask again the next time somebody signs in."
+      revoked: "Access revoked. It will have to ask again."
+      empty: "None."
+      revoke: "Revoke access"
+      last_asked: "Last asked %{when}"
+      asks_again: "Asks again %{when}"
+      until: "until %{when}"

data/config/locales/en/manage/device.yml

@@ -0,0 +1,30 @@
+en:
+  manage:
+    device:
+      missing: "There is no device with that id."
+      back: "Devices"
+      blocked_lede: "Blocked on %{day}. Nobody can sign in on it."
+      seen_lede: "Last seen %{when}."
+      blocked: "%{label} is blocked."
+      block_question: "Block %{label}? It is refused before any password is checked."
+      unblocked: "%{label} is unblocked."
+      signed_out: "Signed %{label} out everywhere."
+      sign_out_question: "Sign every account out of %{label}?"
+      facts:
+        kind: "Kind"
+        ip_address: "IP address"
+        user_agent: "User agent"
+        first_seen: "First seen"
+        last_seen: "Last seen"
+      what: "What it is"
+      sign_out_everywhere: "Sign out everywhere"
+      unblock: "Unblock"
+      block: "Block"
+      who: "Who signs in on it"
+      nobody: "Nobody has signed in on it."
+      live_sessions: "Live sessions"
+      no_sessions: "Nobody is signed in on it right now."
+      signed_in: "Signed in %{when}"
+      expires: "Expires %{when}"
+      activity: "Activity"
+      no_activity: "Nothing yet."

data/config/locales/en/manage/devices.yml

@@ -0,0 +1,59 @@
+en:
+  manage:
+    devices:
+      title: "Devices"
+      lenses:
+        allowed: "Allowed"
+        blocked: "Blocked"
+        unattached: "Never signed in"
+      columns:
+        device: "Device"
+        who: "Who signs in on it"
+        ip_address: "IP address"
+        last_seen: "Last seen"
+      count:
+        one: "%{count} device"
+        other: "%{count} devices"
+      blocked_count:
+        one: "Blocked %{count} device."
+        other: "Blocked %{count} devices."
+      unblocked_count:
+        one: "Unblocked %{count} device."
+        other: "Unblocked %{count} devices."
+      spared: "%{done} The device you are using was left alone."
+      refused: "%{done} \"%{agent}\" is refused from now on."
+      block_chosen_question:
+        one: "Block %{count} device? Each is signed out and refused before any password is checked."
+        other: "Block %{count} devices? Each is signed out and refused before any password is checked."
+      unblock_chosen_question:
+        one: "Unblock %{count} device?"
+        other: "Unblock %{count} devices?"
+      block_matching_question: "Block every device whose user agent contains \"%{agent}\", including any not listed here?"
+      block_matching_refuse: "%{question} New devices sending it are refused too."
+      empty:
+        blocked: "Nothing is blocked."
+        unattached: "Every device here has signed somebody in."
+        allowed: "No device has reached this server yet."
+      filter_label: "Filter by user agent"
+      which: "Which devices"
+      showing: "Showing devices whose user agent contains"
+      showing_blocked: "Showing blocked devices whose user agent contains"
+      clear: "Clear"
+      refuse_agent: "Also refuse this user agent from now on"
+      block_matching: "Block every matching device"
+      chosen: "%{count} chosen"
+      choose_all:
+        one: "Choose all %{count} device shown"
+        other: "Choose all %{count} devices shown"
+      block_count:
+        one: "Block %{count} device"
+        other: "Block %{count} devices"
+      unblock_count:
+        one: "Unblock %{count} device"
+        other: "Unblock %{count} devices"
+      newest: "Only the newest %{count} are shown."
+      choose: "Choose %{label}"
+      blocked: "blocked"
+      unrecognised: "unrecognised"
+      signed_in: "signed in"
+      nobody_yet: "nobody yet"

data/config/locales/en/manage/directory.yml

@@ -0,0 +1,5 @@
+en:
+  manage:
+    directory:
+      title: "Directory"
+      lede: "Other systems that keep this tenant's people: an identity provider that provisions them over SCIM, and older apps that read them over LDAP."

data/config/locales/en/manage/domains.yml

@@ -0,0 +1,28 @@
+en:
+  manage:
+    domains:
+      title: "Domains"
+      help: "Claim a domain by publishing a TXT record. masks checks it every hour. Once it is proven, people who type an address there can go straight to a provider without a password, and sign-in can be served from a host inside it, such as login.example.com, once that host's DNS points here and it has a certificate. Each address is its own issuer, and a passkey works only on the address it was made on."
+      claimed: "Publish the TXT record below, then check %{domain}."
+      proven: "%{domain} is proven."
+      unanswered: "No matching TXT record at %{name} yet. DNS can take a while to spread."
+      routed_away: "People at %{domain} go to their provider now."
+      routed_here: "People at %{domain} sign in here now."
+      served: "Sign-in is served from %{host} too."
+      unserved: "Sign-in is no longer served from a custom domain."
+      stop_confirm: "Stop serving %{host}? Apps that use it as their issuer stop working."
+      release_confirm: "Release %{domain}? People with an address there sign in the usual way again."
+      released: "%{domain} is released."
+      here: "Sign in here"
+      to: "Send to %{name}"
+      missing: "Stopped answering %{since}"
+      unproven: "Not proven"
+      send: "Where people at %{domain} sign in"
+      check: "Check"
+      release: "Release %{domain}"
+      record: "Publish this TXT record:"
+      new: "Domain to claim"
+      add: "Claim"
+      serve: "Serve sign-in at"
+      save: "Serve"
+      stop: "Stop"

data/config/locales/en/manage/emails.yml

@@ -0,0 +1,30 @@
+en:
+  manage:
+    emails:
+      list: "Emails"
+      app: "The app being signed in to"
+      no_app: "No app"
+      not_approved: "%{name} (not approved)"
+      headed: "Headed by %{heading}, from %{from} to %{to}"
+      no_sender: "no sender configured"
+      part: "Which part"
+      html: "HTML"
+      text: "Text"
+      signature: "The signature"
+      groups:
+        sign_in:
+          title: "While signing in"
+          help: "Sent during a sign-in. When an app sent the person there, an approved app heads the email with its logo and name. A sign-in straight to the account page has no app, and the tenant heads it."
+          about: "About emails sent while signing in"
+        manage:
+          title: "From a manager"
+          help: "Sent when a manager acts in /manage. The tenant heads these."
+          about: "About emails sent from a manager"
+        account:
+          title: "From the account page"
+          help: "Sent when a person changes their own account. The tenant heads these."
+          about: "About emails sent from the account page"
+        system:
+          title: "On its own"
+          help: "Sent by masks without anyone acting, such as security notices and idle warnings. The tenant heads these."
+          about: "About emails sent on its own"

data/config/locales/en/manage/event_labels.yml

@@ -0,0 +1,5 @@
+en:
+  manage:
+    event_labels:
+      "yes": "yes"
+      "no": "no"

data/config/locales/en/manage/events.yml

@@ -0,0 +1,8 @@
+en:
+  manage:
+    events:
+      empty: "Nothing yet."
+      by: "by"
+      more:
+        one: "Show %{count} more"
+        other: "Show %{count} more"

data/config/locales/en/manage/groups.yml

@@ -0,0 +1,15 @@
+en:
+  manage:
+    groups:
+      title: "Groups"
+      lede: "Named sets of people, such as admins or family. Apps that ask for the groups scope see each group a person is in, and an app can be limited to some groups. A group's key is what apps see, and it cannot change later. People join a group from their own page."
+      added: "%{name} is ready. Add people from their own pages."
+      delete_confirm: "Delete %{name}? Apps limited to it turn its people away."
+      deleted: "%{name} is deleted."
+      people:
+        one: "%{count} person"
+        other: "%{count} people"
+      delete: "Delete %{name}"
+      new: "New group name"
+      add: "Add"
+      key: "Apps see it as %{key}."

data/config/locales/en/manage/ldap.yml

@@ -0,0 +1,35 @@
+en:
+  manage:
+    ldap:
+      title: "LDAP"
+      lede: "Older apps such as NAS boxes, media servers, and hypervisors check passwords and read groups over LDAP. masks serves this tenant's people and groups to them read-only."
+      revoke_confirm: "Revoke %{label}? Apps binding with it are refused from now on."
+      revoked: "%{label} is revoked."
+      serve:
+        title: "Directory"
+        help: "While this is off, no app can bind to or search this tenant's directory."
+        "on": "Serve this tenant over LDAP"
+        updated: "The directory is updated."
+      connect:
+        title: "Connect an app"
+        help: "Give the app this base DN, a bind DN, and its secret. The app searches ou=people and ou=groups, then binds as a person to check their password."
+        base_dn: "Base DN"
+        address: "Address"
+        port: "Port %{port}"
+        ldaps: "Port %{port}, LDAPS"
+        label: "Label"
+        issue: "Issue a credential"
+        shown_once: "This secret is shown once. Copy it now."
+        bind_dn: "Bind DN"
+        secret: "Secret"
+      credentials:
+        title: "Credentials"
+        none: "None issued."
+        never: "never"
+        used: "last bound %{used}"
+        revoke: "Revoke"
+      binds:
+        title: "Password binds"
+        help: "LDAP cannot ask for a second factor. An account that has one, or whose sign-in policy requires one, is refused unless a password alone is allowed here."
+        password_only: "Allow a password alone over LDAP"
+        updated: "Password binds are updated."

data/config/locales/en/manage/mail_template.yml

@@ -0,0 +1,18 @@
+en:
+  manage:
+    mail_template:
+      reset: "%{title} uses masks' default again."
+      saved: "%{title} saved."
+      signature: "Signature"
+      template: "Template"
+      customized: " (customized)"
+      subject: "Subject"
+      subject_placeholder: "The subject masks writes"
+      closing: "Closing lines on every email"
+      opening: "Opening text"
+      closing_placeholder: "None"
+      opening_placeholder: "The opening masks writes"
+      hint: "Plain text. A blank line starts a new paragraph. Fills in %{names}."
+      hint_more: "masks still adds the button or code, how long it lasts, and the safety lines."
+      save: "Save"
+      use_default: "Use masks' default"

data/config/locales/en/manage/messages.yml

@@ -0,0 +1,11 @@
+en:
+  manage:
+    messages:
+      title: "Messages"
+      parts: "Messages"
+      sending:
+        title: "Sending"
+        lede: "The services that deliver this tenant's email and SMS. Each kind sends through its primary service."
+      templates:
+        title: "Templates"
+        lede: "What each email masks sends says, previewed as people receive it."