masks-server 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0815510a0ee659d9ba2cf35bb8840d7a3a7b7abb7306e0e0cf3f64fd7890d7dd'
-  data.tar.gz: 188b4436824c6f113da49a7880ad15d6f4d0c915f5c5df9b94ba7affcb51fca8
+  metadata.gz: 36e33f34e755bbbb4470a5c55b920624f2042678b87c810ce614e86f9638a4df
+  data.tar.gz: 2bf178807ba578015922b44145ad0eb28454698adb877ac51b5059be57a35ca3
 SHA512:
-  metadata.gz: faeda2a8132f3e2e92ce8a1f41d235cae52f0640ad33ed3220d526619c5ecd113fece66af5923cb8e610564399ba3db0f22bdd16e9e0306d0155ba63f9e13f91
-  data.tar.gz: bef27fdefa6bc7d1f88a386ac23261cad8b487137ea8130c0bfa41467f7bbec11b59058386ceb0fabe0f97cca1a914a1a3a9aaef6c74a48478b266e3a9c62858
+  metadata.gz: 3d32dd6592c56c0132971c1f322ca90b2a31df6832c0b9fe33d5c41c7d5d7aab443b4c6b2fec0a9d3ac0635b22b6d86bbda1c451bd791fd3794e4776c1edd1c8
+  data.tar.gz: 59f5658c277590947cf74f3b8e57fe2d9d7b01f1a160bdc3bdbc3593f4aba9b9395b08255b866e54029f48aff6d9b7b1384daf9ab1b21b95f7468678a800fbcb

data/app/controllers/concerns/masks/server/client_authentication.rb

@@ -44,7 +44,7 @@ module Masks
         end
 
         def assertion_audiences
-          [ issuer.url, "#{issuer.url}/token", "#{issuer.url}#{request.path}" ].uniq
+          [ issuer.url, "#{issuer.url}/token", "#{issuer.url}#{request.path_info}" ].uniq
         end
 
         def presented_credentials

data/app/controllers/concerns/masks/server/resource_token.rb

@@ -19,7 +19,7 @@ module Masks
           answer = handler.call(request.env)
 
           return render_rack(answer) unless answer.first == 200
-          return refuse_token("a bearer token is required") if token.nil?
+          return ask_for_token if token.nil?
 
           yield token
         end
@@ -50,8 +50,11 @@ module Masks
 
         def decode(bearer)
           claims_in_token(bearer.access_token)
+        rescue JWT::ExpiredSignature
+          bearer.invalid_token!("that token has expired")
         rescue JWT::DecodeError => e
-          bearer.invalid_token!(e.message)
+          ::Rails.logger.info("masks: an access token was refused: #{e.message}")
+          bearer.invalid_token!("that token is not one this server signed")
         end
 
         def claims_in_token(secret)
@@ -96,7 +99,7 @@ module Masks
         end
 
         def proof_for(secret = nil)
-          Proof.read!(request, url: "#{issuer.url}#{request.path}", access_token: secret)
+          Proof.read!(request, url: "#{issuer.url}#{request.path_info}", access_token: secret)
         end
 
         def held_token(secret)
@@ -118,6 +121,12 @@ module Masks
           nil
         end
 
+        def ask_for_token
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}")
+
+          head :unauthorized
+        end
+
         def refuse_token(description)
           render_rack(
             Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(

data/app/controllers/masks/server/application_controller.rb

@@ -143,7 +143,7 @@ module Masks
           Current.device = device
         end
 
-        def sign_in(actor, amr: [], policy: nil, first_factor: {})
+        def sign_in(actor, amr: [], policy: nil, first_factor: {}, authenticated_at: nil)
           carried = session.to_hash.slice(REQUESTS, HANDSHAKES, "login", RETURN_TO)
           reset_session
           carried.each { |key, value| session[key] = value }
@@ -157,7 +157,8 @@ module Masks
             ip_address: request.remote_ip,
             amr: amr,
             policy: policy,
-            first_factor: first_factor
+            first_factor: first_factor,
+            authenticated_at: authenticated_at
           )
 
           cookies.encrypted[:masks_session] = {
@@ -301,17 +302,18 @@ module Masks
         end
 
         def settle!(login)
-          hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+          hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
+                            authenticated_at: login.factored_at(:first_factor))
           forget_login
         end
 
-        def hold(actor, amr: [], policy: nil, first_factor: {})
+        def hold(actor, amr: [], policy: nil, first_factor: {}, authenticated_at: nil)
           return if actor.nil?
-          return current_session.first_factored!(first_factor) if current_session&.actor_id == actor.id
+          return current_session.first_factored!(first_factor, at: authenticated_at) if current_session&.actor_id == actor.id
 
           sign_out if current_session
 
-          sign_in(actor, amr: amr, policy: policy, first_factor: first_factor)
+          sign_in(actor, amr: amr, policy: policy, first_factor: first_factor, authenticated_at: authenticated_at)
         end
 
         def policy_denied(denial)

data/app/controllers/masks/server/authorize_controller.rb

@@ -63,7 +63,7 @@ module Masks
             req.bad_request!(:invalid_client, unknown_client(req.client_id)) if client.nil?
             req.invalid_request!("redirect_uri is required") if req.redirect_uri.blank?
 
-            req.verify_redirect_uri!(client.redirect_uris)
+            req.verify_redirect_uri!(client.redirect_uri?(req.redirect_uri) ? [ req.redirect_uri.to_s ] : client.redirect_uris)
             req.verified_redirect_uri = with_issuer(req.verified_redirect_uri)
             res.redirect_uri = req.verified_redirect_uri
 

data/app/controllers/masks/server/logins_controller.rb

@@ -151,7 +151,8 @@ module Masks
           return unless login.actor
 
           if login.touched?(:first_factor)
-            sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+            sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
+                                 authenticated_at: login.factored_at(:first_factor))
           elsif login.signed_in? && login.touched?(:second_factor)
             current_session.update!(amr: Array(current_session.amr) | login.amr)
           end

data/app/controllers/masks/server/registrations_controller.rb

@@ -133,6 +133,12 @@ module Masks
           }, status: :bad_request
         end
 
+        def ask_for_token
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}")
+
+          head :unauthorized
+        end
+
         def issued(client)
           client.metadata.merge(
             "client_secret" => client.secret,
@@ -155,7 +161,9 @@ module Masks
         end
 
         def unauthorized(description)
-          response.headers["WWW-Authenticate"] = %(Bearer error="invalid_token")
+          return ask_for_token if bearer.blank?
+
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}", error="invalid_token")
 
           render json: {
             "error" => "invalid_token",

data/app/controllers/masks/server/scim/metadata_controller.rb

@@ -7,7 +7,7 @@ module Masks
         def service_provider_config
           scim({
             "schemas" => [ Scim::SERVICE_PROVIDER_CONFIG ],
-            "documentationUri" => "#{::Rails.configuration.masks.docs_url}/concepts/provisioning/",
+            "documentationUri" => "#{::Rails.configuration.masks.docs_url}/guides/sso-saml/#provisioning",
             "patch" => { "supported" => true },
             "bulk" => { "supported" => false, "maxOperations" => 0, "maxPayloadSize" => 0 },
             "filter" => { "supported" => true, "maxResults" => Scim::MAX_RESULTS },

data/app/controllers/masks/server/tokens_controller.rb

@@ -42,7 +42,7 @@ module Masks
           return @proof if defined?(@proof)
 
           @proof = if Proof.presented?(request)
-            Proof.read!(request, url: "#{issuer.url}#{request.path}")
+            Proof.read!(request, url: "#{issuer.url}#{request.path_info}")
           end
         end
 

data/app/graphql/masks/server/manage/mutations/add_app.rb

@@ -7,7 +7,7 @@ module Masks
 
           argument :preset, ID
           argument :base_url, String, description: "Where the app is served, such as https://grafana.example.com."
-          argument :name, String, required: false, description: "What people see. The preset's name when left out."
+          argument :name, String, required: false, description: "What people see."
           argument :slug, String, required: false,
                    description: "The name some apps put in their redirect URI, such as Gitea's authentication source."
 

data/app/helpers/masks/server/account_helper.rb

@@ -15,7 +15,7 @@ module Masks
         close: '<path d="M6.5 6.5l7 7M13.5 6.5l-7 7"/>',
         check: '<path d="m5.5 10.5 3 3 6-7"/>',
         organization: '<rect x="3.5" y="7" width="13" height="9.5" rx="1.5"/><path d="M7.5 7V4.5h5V7"/><path d="M3.5 11h13"/>',
-        person: '<circle cx="10" cy="7" r="3.25"/><path d="M4 16.5c.8-3 3.2-4.5 6-4.5s5.2 1.5 6 4.5"/>',
+        actor: '<circle cx="10" cy="7" r="3.25"/><path d="M4 16.5c.8-3 3.2-4.5 6-4.5s5.2 1.5 6 4.5"/>',
         authenticator: '<rect x="3" y="5.5" width="14" height="9" rx="2"/><path d="M6.5 10h.01M10 10h.01M13.5 10h.01"/>',
         backup_codes: '<path d="M5.5 3.5h9v13h-9z"/><path d="M8 7h4M8 10h4M8 13h4"/>',
         manage: '<path d="M10 2.5 3.5 5v5c0 3.4 2.7 6.2 6.5 7.5 3.8-1.3 6.5-4.1 6.5-7.5V5L10 2.5Z"/>'

data/app/models/masks/server/actor.rb

@@ -190,14 +190,14 @@ module Masks
         holds?(Scopes::MANAGE)
       end
 
-      def person_json
+      def card_json
         style = Avatars.held?(self) ? Avatars::PHOTO : Avatars::FALLBACK
 
         {
           "name" => display_name,
           "details" => display_details,
-          "note" => (I18n.t("application.person.unconfirmed") if email_unconfirmed?),
-          "role" => (I18n.t("application.person.manager") if manages?),
+          "note" => (I18n.t("application.actor.unconfirmed") if email_unconfirmed?),
+          "role" => (I18n.t("application.actor.manager") if manages?),
           "avatar" => Avatars.url(self, style, subject: uuid, size: 128)
         }
       end

data/app/models/masks/server/client.rb

@@ -123,7 +123,7 @@ module Masks
           {
             name: handshake.name,
             redirect_uris: handshake.redirect_uris,
-            post_logout_redirect_uris: [ handshake.return_to ].compact,
+            post_logout_redirect_uris: [ handshake.post_logout_redirect_uri ].compact,
             resources: [ handshake.resource ],
             allowed_scopes: Scopes.join(handshake.scopes),
             grant_types: handshake.grant_types,
@@ -131,6 +131,7 @@ module Masks
             token_endpoint_auth_method: handshake.auth_method,
             backchannel_logout_uri: handshake.backchannel_logout_uri,
             client_uri: handshake.origin,
+            handshake_return_to: handshake.return_to,
             dynamic: false
           }
         end
@@ -169,8 +170,7 @@ module Masks
             name: held[:name] || name,
             grant_types: grant_types,
             response_types: held[:response_types].presence || response_types_for(grant_types),
-            allowed_scopes: Scopes.join(bounded(metadata.to_h.stringify_keys["scope"].presence ||
-                                                Current.tenant&.dynamic_client_ceiling || DEFAULT_SCOPES)),
+            allowed_scopes: Scopes.join(declared_scopes(metadata)),
             dynamic: true
           )
         end
@@ -206,6 +206,12 @@ module Masks
           ).issue_credentials!
         end
 
+        def declared_scopes(metadata)
+          declared = metadata.to_h.stringify_keys["scope"]
+
+          Scopes.list(declared).empty? ? [] : bounded(declared)
+        end
+
         def bounded(requested)
           reserved = Scopes.reserved(requested) + Scopes.list(requested).select { |s| Scopes.prefix?(s) }
 
@@ -380,7 +386,7 @@ module Masks
       end
 
       def redirect_uri?(candidate)
-        redirect_uris.include?(candidate.to_s)
+        redirect_uris.include?(candidate.to_s) || redirect_uris.any? { |registered| same_loopback?(registered, candidate.to_s) }
       end
 
       def grants?(grant_type)
@@ -424,7 +430,11 @@ module Masks
       end
 
       def scope_list
-        Scopes.union(required_scopes, allowed_scopes)
+        Scopes.union(required_scopes, offered_scopes)
+      end
+
+      def follows_registration?
+        dynamic? && Scopes.list(allowed_scopes).empty?
       end
 
       def access_lifetime
@@ -442,7 +452,19 @@ module Masks
       def permitted_scopes(requested)
         return scope_list if Scopes.list(requested).empty?
 
-        Scopes.union(required_scopes, Scopes.granted(requested, allowed_scopes))
+        return Scopes.union(required_scopes, unreserved(requested)) if open_to_anything?
+
+        Scopes.union(required_scopes, Scopes.granted(requested, offered_scopes))
+      end
+
+      def refused_scopes(requested)
+        Scopes.list(requested) - permitted_scopes(requested)
+      end
+
+      def offered_scopes
+        return Scopes.list(allowed_scopes) unless follows_registration?
+
+        Current.tenant&.dynamic_client_ceiling || DEFAULT_SCOPES
       end
 
       def metadata
@@ -544,6 +566,24 @@ module Masks
           self.class.loopback?(uri)
         end
 
+        def open_to_anything?
+          follows_registration? && Current.tenant&.dynamic_registration == Tenant::REGISTRATION_ANYTHING
+        end
+
+        def unreserved(requested)
+          Scopes.list(requested).reject { |scope| Scopes.prefix?(scope) || Scopes.reserved(scope).any? }
+        end
+
+        def same_loopback?(registered, candidate)
+          held = URI.parse(registered)
+          asked = URI.parse(candidate)
+
+          [ held, asked ].all? { |uri| uri.instance_of?(URI::HTTP) && LOOPBACK.include?(uri.hostname) && uri.userinfo.nil? && uri.fragment.nil? } &&
+            held.hostname == asked.hostname && held.path == asked.path && held.query == asked.query
+        rescue URI::InvalidURIError
+          false
+        end
+
         def grant_types_are_known
           unknown = grant_types - GRANT_TYPES
           errors.add(:grant_types, "not supported: #{unknown.join(', ')}") if unknown.any?

data/app/models/masks/server/handshake.rb

@@ -4,7 +4,7 @@ module Masks
       GRANT_TYPES = %w[authorization_code refresh_token].freeze
 
       attr_reader :name, :redirect_uris, :resource, :scopes, :return_to, :state, :auth_method,
-                  :backchannel_logout_uri
+                  :backchannel_logout_uri, :post_logout_redirect_uri
 
       class << self
         def from_request(request)
@@ -19,7 +19,8 @@ module Masks
             return_to: params["return_to"],
             state: params["state"],
             auth_method: params["token_endpoint_auth_method"],
-            backchannel_logout_uri: params["backchannel_logout_uri"]
+            backchannel_logout_uri: params["backchannel_logout_uri"],
+            post_logout_redirect_uri: params["post_logout_redirect_uri"]
           )
         end
 
@@ -36,7 +37,8 @@ module Masks
             return_to: row.redirect_uri,
             state: held["state"],
             auth_method: held["auth_method"],
-            backchannel_logout_uri: held["backchannel_logout_uri"]
+            backchannel_logout_uri: held["backchannel_logout_uri"],
+            post_logout_redirect_uri: held["post_logout_redirect_uri"]
           )
         end
       end
@@ -54,7 +56,8 @@ module Masks
           "state" => state,
           "redirect_uris" => redirect_uris.sort,
           "auth_method" => auth_method,
-          "backchannel_logout_uri" => backchannel_logout_uri
+          "backchannel_logout_uri" => backchannel_logout_uri,
+          "post_logout_redirect_uri" => post_logout_redirect_uri
         }.compact
       end
 
@@ -73,12 +76,14 @@ module Masks
 
         pairs << [ "state", state ] if state
         pairs << [ "backchannel_logout_uri", backchannel_logout_uri ] if backchannel_logout_uri
+        pairs << [ "post_logout_redirect_uri", post_logout_redirect_uri ] if post_logout_redirect_uri
         redirect_uris.each { |uri| pairs << [ "redirect_uris", uri ] }
         pairs
       end
 
       def initialize(name: nil, redirect_uris: nil, resource: nil, scopes: nil,
-                     return_to: nil, state: nil, auth_method: nil, backchannel_logout_uri: nil)
+                     return_to: nil, state: nil, auth_method: nil, backchannel_logout_uri: nil,
+                     post_logout_redirect_uri: nil)
         @name = name.to_s.strip.presence || "An application"
         @redirect_uris = Array(redirect_uris).map(&:to_s).reject(&:empty?).uniq
         @resource = resource.to_s
@@ -87,6 +92,7 @@ module Masks
         @state = state.presence
         @auth_method = auth_method.to_s.presence || Client::DEFAULT_AUTH_METHOD
         @backchannel_logout_uri = backchannel_logout_uri.to_s.strip.presence
+        @post_logout_redirect_uri = post_logout_redirect_uri.to_s.strip.presence
       end
 
       def origin
@@ -134,7 +140,7 @@ module Masks
             return "token_endpoint_auth_method must be one of #{Client::AUTH_METHODS.join(', ')}"
           end
 
-          elsewhere = ([ return_to ] + redirect_uris + Array(backchannel_logout_uri))
+          elsewhere = ([ return_to ] + redirect_uris + Array(backchannel_logout_uri) + Array(post_logout_redirect_uri))
             .reject { |uri| origin_of(uri) == origin }
           return "everything must share the origin #{origin}: #{elsewhere.join(', ')}" if elsewhere.any?
 

data/app/models/masks/server/login.rb

@@ -416,8 +416,7 @@ module Masks
             "rid" => rid,
             "docs" => ::Rails.configuration.masks.docs_url,
             "actor" => actor && { "nickname" => actor.nickname, "name" => actor.name,
-                                  "identifier" => actor.identifier },
-            "person" => person_json,
+                                  "identifier" => actor.identifier, "card" => card_json },
             "client" => client_json,
             "tenant" => tenant && {
               "name" => tenant.name, "logo" => tenant.logo_url
@@ -429,10 +428,8 @@ module Masks
           answering.reduce(base) { |json, state| state.enabled? ? json.merge(state.as_json) : json }
         end
 
-        def person_json
-          return nil if actor.nil? || authenticated_at.nil?
-
-          actor.person_json
+        def card_json
+          actor.card_json if authenticated_at
         end
 
         def forget_vanished_actor!

data/app/models/masks/server/pending_handshake.rb

@@ -19,7 +19,8 @@ module Masks
             "redirect_uris" => handshake.redirect_uris,
             "state" => handshake.state,
             "auth_method" => handshake.auth_method,
-            "backchannel_logout_uri" => handshake.backchannel_logout_uri
+            "backchannel_logout_uri" => handshake.backchannel_logout_uri,
+            "post_logout_redirect_uri" => handshake.post_logout_redirect_uri
           }.compact
         )
       end

data/app/models/masks/server/session.rb

@@ -23,7 +23,7 @@ module Masks
 
       class << self
         def start!(actor:, device: nil, user_agent: nil, ip_address: nil, amr: [], origin: nil, policy: nil,
-                   first_factor: {})
+                   first_factor: {}, authenticated_at: nil)
           secret = SecureRandom.urlsafe_base64(48)
           lifetime = policy&.session_lifetime&.seconds || LIFETIME
           now = Time.current
@@ -36,7 +36,7 @@ module Masks
             user_agent: user_agent,
             ip_address: ip_address,
             origin: origin.presence || Current.origin,
-            authenticated_at: now,
+            authenticated_at: authenticated_at || now,
             last_seen_at: now,
             amr: Array(amr),
             first_factor: first_factor["factor"],
@@ -71,10 +71,12 @@ module Masks
         { "factor" => first_factor, "provider_id" => provider_id }.compact
       end
 
-      def first_factored!(held)
-        return if held["factor"].blank? || held == first_factored_by
+      def first_factored!(held, at: nil)
+        changes = {}
+        changes[:authenticated_at] = at if at.present? && (authenticated_at.nil? || at > authenticated_at)
+        changes.merge!(first_factor: held["factor"], provider_id: held["provider_id"]) if held["factor"].present? && held != first_factored_by
 
-        update!(first_factor: held["factor"], provider_id: held["provider_id"])
+        update!(changes) if changes.any?
       end
 
       def bound?

data/app/policies/masks/server/exchange_policy.rb

@@ -85,7 +85,7 @@ module Masks
         end
 
         def scopes_stay_within_the_client
-          beyond = Scopes.refused(client.scope_list, requested_scopes)
+          beyond = client.refused_scopes(requested_scopes)
 
           deny!("invalid_scope", "this client may not hold #{beyond.join(', ')}") if beyond.any?
         end

data/app/policies/masks/server/grant_checks.rb

@@ -8,7 +8,7 @@ module Masks
         end
 
         def scopes_are_permitted
-          refused = Scopes.refused(client.scope_list, requested_scopes)
+          refused = client.refused_scopes(requested_scopes)
 
           if refused.any?
             deny!("invalid_scope",

data/app/views/masks/server/account/_info.html.erb

@@ -4,7 +4,7 @@
   <div class="entries">
     <details class="entry" id="profile">
       <summary>
-        <span class="entry-icon"><%= account_icon(:person) %></span>
+        <span class="entry-icon"><%= account_icon(:actor) %></span>
         <span class="entry-label"><%= account_text("profile.heading") %></span>
         <span class="entry-state"><%= actor.name.presence || actor.nickname %></span>
         <span class="entry-mark" aria-hidden="true"></span>

data/app/views/masks/server/account/_organizations.html.erb

@@ -72,7 +72,7 @@
 
           <% if own.owner? %>
             <p class="item-meta">
-              <%= account_text("organizations.people", count: joined) %>
+              <%= account_text("organizations.member_count", count: joined) %>
               · <%= account_text("organizations.owners", count: owners) %>
               <% if waiting.positive? %>
                 · <%= account_text("organizations.waiting_count", count: waiting) %>
@@ -81,8 +81,8 @@
 
             <div class="items">
               <% members.each do |member| %>
-                <% person = member.actor %>
-                <% yourself = person.id == own.actor_id %>
+                <% actor = member.actor %>
+                <% yourself = actor.id == own.actor_id %>
                 <% label = Masks::Server::Members.label(member) || account_text("organizations.invited_by_manager") %>
                 <div class="item item-member">
                   <span class="item-name">
@@ -111,7 +111,7 @@
                                       class: "control control-sm", id: "role-#{organization.key}-#{member.id}",
                                       disabled: yourself && alone,
                                       data: { autosubmit: true },
-                                      aria: { label: account_text("organizations.role_of", person: label) } %>
+                                      aria: { label: account_text("organizations.role_of", name: label) } %>
                       <button type="submit" class="action action-quiet action-sm" data-autosubmitted <%= "disabled" if yourself && alone %>>
                         <%= account_text("organizations.set_role") %>
                       </button>

data/app/views/masks/server/application/_actor.html.erb

@@ -0,0 +1,27 @@
+<% sign_out = local_assigns.fetch(:sign_out, false) %>
+<% details = actor.display_details %>
+
+<div class="actor">
+  <%= avatar_tag actor, size: 44, class: "actor-avatar" %>
+
+  <div class="actor-who">
+    <span class="actor-name"><%= actor.display_name %></span>
+
+    <% if details.any? || actor.email_unconfirmed? %>
+      <span class="actor-sub">
+        <%= details.join(" · ") %>
+        <% if actor.email_unconfirmed? %>
+          <span class="actor-note"><%= local_assigns[:unconfirmed] || t("application.actor.unconfirmed") %></span>
+        <% end %>
+      </span>
+    <% end %>
+
+    <% if actor.manages? %>
+      <span class="actor-role"><%= t("application.actor.manager") %></span>
+    <% end %>
+  </div>
+
+  <% if sign_out %>
+    <%= button_to t("application.actor.sign_out"), logout_path, class: "textlink", form_class: "signout" %>
+  <% end %>
+</div>

data/app/views/masks/server/handshakes/refused.html.erb

@@ -6,7 +6,7 @@
 <h1 class="prompt-title"><%= t(".title") %></h1>
 
 <% if current_actor %>
-  <%= render "masks/server/application/person", actor: current_actor, sign_out: true %>
+  <%= render "masks/server/application/actor", actor: current_actor, sign_out: true %>
 <% end %>
 
 <p class="said"><%= @description %></p>

data/app/views/masks/server/handshakes/show.html.erb

@@ -43,7 +43,7 @@
 
 <div class="handshake-as">
   <span class="handshake-caption"><%= t(".signed_in_as") %></span>
-  <%= render "masks/server/application/person", actor: current_actor, sign_out: true, unconfirmed: t(".unconfirmed") %>
+  <%= render "masks/server/application/actor", actor: current_actor, sign_out: true, unconfirmed: t(".unconfirmed") %>
 </div>
 
 <div class="slab handshake-plain">

data/app/views/masks/server/logins/_choose_organization.html.erb

@@ -4,7 +4,7 @@
            title: client ? t(".title_to", client: client) : t(".title"),
            lede: t(".lede") %>
 
-<%= render "masks/server/application/person", actor: login.actor, sign_out: true if login.actor %>
+<%= render "masks/server/application/actor", actor: login.actor, sign_out: true if login.actor %>
 
 <div class="providers">
   <% (login.as_json["organizations"] || []).each do |organization| %>

data/app/views/masks/server/logins/_consent.html.erb

@@ -14,7 +14,7 @@
 
 <%= render "masks/server/logins/head", title: t(".title", client: login.client&.name) %>
 
-<%= render "masks/server/application/person", actor: login.actor, sign_out: true if login.actor %>
+<%= render "masks/server/application/actor", actor: login.actor, sign_out: true if login.actor %>
 
 <div class="slab">
   <div class="ledger-row">

data/app/views/masks/server/sessions/confirm.html.erb

@@ -12,7 +12,7 @@
     </p>
   </div>
 
-  <%= render "masks/server/application/person", actor: current_actor %>
+  <%= render "masks/server/application/actor", actor: current_actor %>
 
   <p class="aside"><%= t(".scope") %></p>
 

data/config/locales/de/account.yml

@@ -155,7 +155,7 @@ de:
         lede_owner: "Als Eigentümer entscheiden Sie, wer dazugehört und welche Rolle jede Person hat. Apps, die Ihre Organisation anfordern, sehen die Rolle."
         lede_member: "Apps, die Ihre Organisation anfordern, sehen, dass Sie dazugehören, und Ihre Rolle."
         members: "Mitglieder"
-        people:
+        member_count:
           one: "1 Mitglied"
           other: "%{count} Mitglieder"
         owners:
@@ -182,7 +182,7 @@ de:
         decline: "Ablehnen"
         confirm_decline: "Die Einladung zu %{organization} ablehnen? Ein Eigentümer muss Sie erneut einladen."
         set_role: "Rolle festlegen"
-        role_of: "Rolle von %{person}"
+        role_of: "Rolle von %{name}"
         remove: "Entfernen"
         withdraw: "Zurückziehen"
         resend: "Erneut senden"

data/config/locales/de/application.yml

@@ -1,6 +1,6 @@
 de:
   application:
-    person:
+    actor:
       manager: "Verwalter"
       unconfirmed: "unbestätigt"
       sign_out: "Abmelden"