masks-server 0.9.0 → 0.10.0

data/app/models/masks/server/refresh_token.rb

@@ -5,6 +5,14 @@ module Masks
         30.days
       end
 
+      def self.absolute_lifetime
+        90.days
+      end
+
+      def exhausted?(limit)
+        root.created_at + limit <= Time.current
+      end
+
       def self.mint!(**attributes)
         super.tap { |token| token.actor&.active! }
       end

data/app/models/masks/server/released_nickname.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    class ReleasedNickname < ApplicationRecord
+      include TenantScoped
+
+      HOLD = 30.days
+
+      belongs_to :actor, optional: true
+
+      scope :holding, ->(nickname) { where(nickname: nickname.to_s.downcase).where("released_at > ?", HOLD.ago) }
+      scope :lapsed, -> { where(released_at: ...HOLD.ago) }
+
+      class << self
+        def release!(nickname, actor:)
+          return if nickname.blank?
+
+          find_or_initialize_by(nickname: nickname.downcase).update!(actor: actor, released_at: Time.current)
+        end
+
+        def held_from?(nickname, actor)
+          holding(nickname).where.not(actor_id: actor.id).or(holding(nickname).where(actor_id: nil)).exists?
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/scim/filter.rb

@@ -1,8 +1,14 @@
+require "strscan"
+
 module Masks
   module Server
     module Scim
       class Filter
-        COMPARISON = /\A\s*([A-Za-z][\w.:\[\]" -]*?)\s+(eq|ne|co|sw|ew|pr|gt|ge|lt|le)(?:\s+("(?:[^"\\]|\\.)*"|true|false|null|[\d.]+))?\s*\z/i
+        LONGEST = 512
+        TOKEN = /"(?:[^"\\]|\\.)*"|(?:[^\s"\[]|\[[^\]]*\])+/
+        PATH = /\A[A-Za-z][\w.:\[\]" ]*\z/
+        VALUE = /\A(?:"(?:[^"\\]|\\.)*"|true|false|null|[\d.]+)\z/
+        OPERATORS = %w[eq ne co sw ew pr gt ge lt le].freeze
         ATTRIBUTES = {
           "id" => "actors.uuid",
           "username" => :user_name,
@@ -30,7 +36,9 @@ module Masks
         end
 
         def apply(relation)
-          clauses = @expression.split(/\s+and\s+/i)
+          raise Error.new(:bad_request, "a filter is at most #{LONGEST} characters", scim_type: "invalidFilter") if @expression.length > LONGEST
+
+          clauses = clauses_of(tokens)
 
           raise Error.new(:bad_request, "at most four comparisons joined by and are understood", scim_type: "invalidFilter") if clauses.size > 4
 
@@ -39,12 +47,44 @@ module Masks
 
         private
 
+          def tokens
+            scanner = StringScanner.new(@expression)
+            held = []
+
+            until scanner.eos?
+              next if scanner.skip(/\s+/)
+
+              token = scanner.scan(TOKEN)
+
+              raise unreadable(@expression) if token.nil?
+
+              held << token
+            end
+
+            held
+          end
+
+          def clauses_of(tokens)
+            clauses = [ [] ]
+
+            tokens.each do |token|
+              token.casecmp?("and") ? clauses << [] : clauses.last << token
+            end
+
+            clauses
+          end
+
+          def unreadable(clause)
+            Error.new(:bad_request, "#{clause.strip} is not a filter this server reads", scim_type: "invalidFilter")
+          end
+
           def compare(relation, clause)
-            match = COMPARISON.match(clause)
+            path, operator, raw = clause
 
-            raise Error.new(:bad_request, "#{clause.strip} is not a filter this server reads", scim_type: "invalidFilter") if match.nil?
+            raise unreadable(clause.join(" ")) unless clause.size.between?(2, 3)
+            raise unreadable(clause.join(" ")) unless PATH.match?(path) && OPERATORS.include?(operator.downcase)
+            raise unreadable(clause.join(" ")) unless raw.nil? || VALUE.match?(raw)
 
-            path, operator, raw = match.captures
             key = normalized(path)
             column = @columns[key]
             operator = operator.downcase

data/app/models/masks/server/scim/user.rb

@@ -118,6 +118,7 @@ module Masks
             raise Error.new(:bad_request, "userName is required", scim_type: "invalidValue") if value.blank?
 
             held = value.to_s.strip
+            actor.trusted_rename = true
 
             if held.match?(URI::MailTo::EMAIL_REGEXP)
               actor.email = held

data/app/models/masks/server/session.rb

@@ -72,11 +72,10 @@ module Masks
       end
 
       def first_factored!(held, at: nil)
-        changes = {}
-        changes[:authenticated_at] = at if at.present? && (authenticated_at.nil? || at > authenticated_at)
-        changes.merge!(first_factor: held["factor"], provider_id: held["provider_id"]) if held["factor"].present? && held != first_factored_by
+        self.authenticated_at = at if at && at > authenticated_at
+        assign_attributes(first_factor: held["factor"], provider_id: held["provider_id"]) if held["factor"].present?
 
-        update!(changes) if changes.any?
+        save! if changed?
       end
 
       def bound?

data/app/views/masks/server/account/_info.html.erb

@@ -46,7 +46,11 @@
       </summary>
 
       <div class="entry-body">
-        <p class="aside"><%= account_text("notifications.lede") %></p>
+        <p class="aside"><%= account_text("notifications.lede") %> <%= account_text("notifications.kept") %></p>
+
+        <% unless fresh %>
+          <p class="aside"><%= account_text("notifications.again") %></p>
+        <% end %>
 
         <% unless Masks::Server::Notifications.mailable?(actor) %>
           <p class="aside aside-bad"><%= account_text("notifications.silent") %></p>
@@ -63,8 +67,12 @@
                 <% actions.each do |action| %>
                   <label class="switch">
                     <span><%= t("events.actions.#{action}") %></span>
-                    <%= check_box_tag "notifications[]", action, actor.notified?(action),
-                          id: "notify-#{action.tr('.', '-')}" %>
+                    <% if Masks::Server::Notifications.always?(action) %>
+                      <span class="switch-kept"><%= account_text("notifications.always") %></span>
+                    <% else %>
+                      <%= check_box_tag "notifications[]", action, actor.notified?(action),
+                            id: "notify-#{action.tr('.', '-')}" %>
+                    <% end %>
                   </label>
                 <% end %>
               </div>
@@ -72,7 +80,7 @@
           <% end %>
 
           <div class="action-row">
-            <button type="submit" class="action action-sm"><%= account_text("notifications.submit") %></button>
+            <button type="submit" class="action action-sm"><%= account_text(fresh ? "notifications.submit" : "notifications.submit_again") %></button>
           </div>
         <% end %>
       </div>

data/app/views/masks/server/account/index.html.erb

@@ -31,7 +31,7 @@
 
   <%= render "masks/server/account/apps", apps: @apps, connections: @connections, linkable: @linkable %>
 
-  <%= render "masks/server/account/info", actor: @actor, directed: @directed %>
+  <%= render "masks/server/account/info", actor: @actor, directed: @directed, fresh: @fresh %>
 
   <%= render "masks/server/account/activity", events: @events %>
 

data/app/views/masks/server/authorize/error.html.erb

@@ -4,9 +4,9 @@
 <div id="authorize-error" class="flow" data-error="<%= @error_code %>">
   <span class="state state-bad"><%= t(".stopped") %></span>
 
-  <h1 class="prompt-title"><%= t(".heading") %></h1>
+  <h1 class="prompt-title"><%= @refused ? t(".refused") : t(".heading") %></h1>
 
   <p class="said"><%= @error_code %> — <%= @error_description %></p>
 
-  <p class="prompt-lede"><%= t(".contact") %></p>
+  <p class="prompt-lede"><%= @refused ? t(".nothing_shared") : t(".contact") %></p>
 </div>

data/config/locales/de/account.yml

@@ -251,6 +251,10 @@ de:
         lede: "Alles hier ist aktiv, bis Sie es deaktivieren. Diese Nachrichten kommen, sobald etwas passiert, und auf keine kann geantwortet werden."
         silent: "Es wird nichts gesendet, weil diese Nachrichten nur an eine bestätigte E-Mail-Adresse gehen."
         submit: "Speichern"
+        kept: "Ein geändertes oder zurückgesetztes Passwort und eine riskante Anmeldung werden immer gemeldet."
+        always: "Immer"
+        again: "Ihre letzte Anmeldung ist eine Weile her, daher werden Sie zuerst gebeten, sich erneut anzumelden."
+        submit_again: "Erneut anmelden"
 
       export:
         heading: "Ihr Konto herunterladen"

data/config/locales/de/actors.yml

@@ -6,3 +6,5 @@ de:
           attributes:
             base:
               unnamed: "Ein Konto braucht einen Spitznamen oder eine E-Mail-Adresse."
+            nickname:
+              held: "wurde vor Kurzem freigegeben und kann noch nicht übernommen werden"

data/config/locales/de/authorize.yml

@@ -5,3 +5,5 @@ de:
       stopped: "Angehalten"
       heading: "Die App hat etwas angefordert, das dieser Server nicht tut."
       contact: "Es wurde nichts geteilt. Die App muss das beheben."
+      refused: "Diese Anmeldung wurde abgelehnt."
+      nothing_shared: "Mit der App wurde nichts geteilt. Sie können diese Seite schließen."

data/config/locales/de/events.yml

@@ -6,6 +6,8 @@ de:
         ended: "Abgemeldet"
         revoked: "Sitzung widerrufen"
         expired: "Sitzung abgelaufen"
+      notifications:
+        changed: "Benachrichtigungen geändert"
       logout:
         undelivered: "Abmeldung nicht an eine App zugestellt"
       login:

data/config/locales/de/flashes.yml

@@ -129,6 +129,7 @@ de:
     directed: "Das Verzeichnis Ihrer Organisation verwaltet Ihren Namen."
     invalid: "%{errors}"
     updated: "Ihre Angaben wurden gespeichert."
+    again: "Melden Sie sich erneut an, um Ihren Spitznamen zu ändern. Ihre letzte Anmeldung ist eine Weile her."
 
   verifications:
     too_many_requests: "Zu viele Anfragen. Warten Sie einige Minuten."

data/config/locales/de/logins.yml

@@ -238,6 +238,7 @@ de:
       too-many-attempts: "Zu viele Versuche. Warten Sie einige Minuten."
       too-many-attempts-for-account: "Zu viele Versuche für dieses Konto."
       too-many-codes: "An diese Adresse wurden zu viele Codes gesendet. Warten Sie einige Minuten."
+      too-many-texts: "An diese Nummer wurden zu viele Codes gesendet. Warten Sie einige Minuten."
       prove-email-first: "Geben Sie zuerst den an diese Adresse gesendeten Code ein."
       no-account-for-email: "Kein Konto hier verwendet diese Adresse."
       invalid-setup-token: "Dieses Einrichtungstoken ist falsch."

data/config/locales/de/manage/client.yml

@@ -115,6 +115,8 @@ de:
         sector_placeholder: "nötig, wenn seine Redirect-URIs mehrere Hosts umfassen"
         unattended: "Meldet sich als er selbst an (client_credentials)"
         rotate: "Secret rotieren"
+        secret_expires: "Das Secret läuft am %{day} ab."
+        secret_expired: "Das Secret ist am %{day} abgelaufen. Rotieren Sie es, sonst kann sich nichts mehr damit anmelden."
         archive: "Archivieren"
       saml:
         title: "SAML"
@@ -146,6 +148,7 @@ de:
         consent: "Akteure um Zustimmung bitten"
         access: "Access-Tokens gelten (Minuten, leer für eine Stunde)"
         refresh: "Refresh-Tokens gelten ungenutzt (Tage, leer für 30)"
+        refresh_absolute: "Refresh-Tokens enden nach der Anmeldung (Tage, leer für 90)"
         consent_lifetime: "Zustimmung gilt (Tage, leer bis zum Widerruf)"
         logout: "Back-Channel-Logout-URI"
         logout_session: "Sein Logout-Token benennt die Sitzung (sid)"

data/config/locales/de/manage/ldap.yml

@@ -17,6 +17,7 @@ de:
         address: "Adresse"
         port: "Port %{port}"
         ldaps: "Port %{port}, LDAPS"
+        local_only: "Ohne Zertifikat antwortet das Verzeichnis nur auf dem eigenen Rechner dieses Servers, damit kein Passwort unverschlüsselt über das Netz geht. Setzen Sie MASKS_LDAP_CERT und MASKS_LDAP_KEY, um LDAPS auf jeder Adresse anzubieten, oder MASKS_LDAP_PLAINTEXT=true in einem privaten Netz, dem Sie vertrauen."
         label: "Bezeichnung"
         issue: "Zugang ausstellen"
         shown_once: "Dieses Geheimnis wird nur einmal angezeigt. Kopieren Sie es jetzt."

data/config/locales/de/notifications.yml

@@ -5,6 +5,7 @@ de:
 
   notifications:
     saved: "Gespeichert."
+    again: "Melden Sie sich erneut an, um zu ändern, welche E-Mails Sie erhalten. Ihre letzte Anmeldung ist eine Weile her."
 
     groups:
       password: "Passwort"

data/config/locales/en/account.yml

@@ -251,6 +251,10 @@ en:
         lede: "Everything here is on until you turn it off. These arrive as they happen, and none of them can be replied to."
         silent: "Nothing is being sent, because these only go to a confirmed email address."
         submit: "Save"
+        kept: "A changed or reset password and a risky sign-in are always announced."
+        always: "Always"
+        again: "You signed in a while ago, so you will be asked to sign in again first."
+        submit_again: "Sign in again"
 
       export:
         heading: "Download your account"

data/config/locales/en/actors.yml

@@ -6,3 +6,5 @@ en:
           attributes:
             base:
               unnamed: "An account needs a nickname or an email address."
+            nickname:
+              held: "was given up recently and cannot be taken yet"

data/config/locales/en/authorize.yml

@@ -5,3 +5,5 @@ en:
       stopped: "Stopped"
       heading: "The app asked for something this server will not do."
       contact: "Nothing was shared. The app has to fix this."
+      refused: "This sign-in was refused."
+      nothing_shared: "Nothing was shared with the app. You can close this page."

data/config/locales/en/events.yml

@@ -6,6 +6,8 @@ en:
         ended: "Signed out"
         revoked: "Session revoked"
         expired: "Session timed out"
+      notifications:
+        changed: "Notifications changed"
       logout:
         undelivered: "Sign-out not delivered to an app"
       login:

data/config/locales/en/flashes.yml

@@ -129,6 +129,7 @@ en:
     directed: "Your organization's directory manages your name."
     invalid: "%{errors}"
     updated: "Your details have been saved."
+    again: "Sign in again to change your nickname. It has been a while since you did."
 
   verifications:
     too_many_requests: "Too many requests. Wait a few minutes."

data/config/locales/en/logins.yml

@@ -238,6 +238,7 @@ en:
       too-many-attempts: "Too many attempts. Wait a few minutes."
       too-many-attempts-for-account: "Too many attempts for that account."
       too-many-codes: "Too many codes have gone to that address. Wait a few minutes."
+      too-many-texts: "Too many codes have gone to that number. Wait a few minutes."
       prove-email-first: "Enter the code sent to that address first."
       no-account-for-email: "No account here uses that address."
       invalid-setup-token: "That setup token is wrong."

data/config/locales/en/manage/client.yml

@@ -115,6 +115,8 @@ en:
         sector_placeholder: "needed when its redirect URIs span several hosts"
         unattended: "Signs in as itself (client_credentials)"
         rotate: "Rotate secret"
+        secret_expires: "The secret expires on %{day}."
+        secret_expired: "The secret expired on %{day}. Rotate it, or nothing can sign in with it."
         archive: "Archive"
       saml:
         title: "SAML"
@@ -146,6 +148,7 @@ en:
         consent: "Ask actors to consent"
         access: "Access tokens last (minutes, blank for an hour)"
         refresh: "Refresh tokens last unused (days, blank for 30)"
+        refresh_absolute: "Refresh tokens stop after a sign-in (days, blank for 90)"
         consent_lifetime: "Consent lasts (days, blank until revoked)"
         logout: "Back-channel logout URI"
         logout_session: "Its logout token names the session (sid)"

data/config/locales/en/manage/ldap.yml

@@ -17,6 +17,7 @@ en:
         address: "Address"
         port: "Port %{port}"
         ldaps: "Port %{port}, LDAPS"
+        local_only: "Without a certificate, the directory answers only on this server's own machine, so no password crosses the network in the clear. Set MASKS_LDAP_CERT and MASKS_LDAP_KEY to serve LDAPS on every address, or MASKS_LDAP_PLAINTEXT=true on a private network you trust."
         label: "Label"
         issue: "Issue a credential"
         shown_once: "This secret is shown once. Copy it now."

data/config/locales/en/notifications.yml

@@ -5,6 +5,7 @@ en:
 
   notifications:
     saved: "Saved."
+    again: "Sign in again to change which emails you get. It has been a while since you did."
 
     groups:
       password: "Password"

data/config/locales/es/account.yml

@@ -251,6 +251,10 @@ es:
         lede: "Todo lo de aquí está activado hasta que lo desactives. Llegan en el momento en que ocurre y no se puede responder a ninguno."
         silent: "No se envía nada, porque solo van a una dirección de correo confirmada."
         submit: "Guardar"
+        kept: "Una contraseña cambiada o restablecida y un inicio de sesión de riesgo se avisan siempre."
+        always: "Siempre"
+        again: "Hace tiempo que iniciaste sesión, así que primero se te pedirá que vuelvas a iniciarla."
+        submit_again: "Volver a iniciar sesión"
 
       export:
         heading: "Descargar tu cuenta"

data/config/locales/es/actors.yml

@@ -6,3 +6,5 @@ es:
           attributes:
             base:
               unnamed: "Una cuenta necesita un apodo o una dirección de correo."
+            nickname:
+              held: "se liberó hace poco y todavía no se puede usar"

data/config/locales/es/authorize.yml

@@ -5,3 +5,5 @@ es:
       stopped: "Detenida"
       heading: "La aplicación pidió algo que este servidor no hará."
       contact: "No se compartió nada. La aplicación tiene que corregirlo."
+      refused: "Este inicio de sesión fue rechazado."
+      nothing_shared: "No se compartió nada con la aplicación. Puede cerrar esta página."

data/config/locales/es/events.yml

@@ -6,6 +6,8 @@ es:
         ended: "Cerró sesión"
         revoked: "Sesión revocada"
         expired: "Sesión caducada"
+      notifications:
+        changed: "Notificaciones cambiadas"
       logout:
         undelivered: "Cierre de sesión no entregado a una aplicación"
       login:

data/config/locales/es/flashes.yml

@@ -129,6 +129,7 @@ es:
     directed: "El directorio de tu organización gestiona tu nombre."
     invalid: "%{errors}"
     updated: "Se guardaron tus datos."
+    again: "Vuelve a iniciar sesión para cambiar tu apodo. Hace tiempo que no lo haces."
 
   verifications:
     too_many_requests: "Demasiadas solicitudes. Espera unos minutos."

data/config/locales/es/logins.yml

@@ -238,6 +238,7 @@ es:
       too-many-attempts: "Demasiados intentos. Espera unos minutos."
       too-many-attempts-for-account: "Demasiados intentos para esa cuenta."
       too-many-codes: "Se enviaron demasiados códigos a esa dirección. Espera unos minutos."
+      too-many-texts: "Se enviaron demasiados códigos a ese número. Espera unos minutos."
       prove-email-first: "Primero escribe el código enviado a esa dirección."
       no-account-for-email: "Ninguna cuenta de aquí usa esa dirección."
       invalid-setup-token: "Ese token de configuración no es correcto."

data/config/locales/es/manage/client.yml

@@ -115,6 +115,8 @@ es:
         sector_placeholder: "necesario cuando sus URI de redirección abarcan varios hosts"
         unattended: "Inicia sesión por sí mismo (client_credentials)"
         rotate: "Rotar secreto"
+        secret_expires: "El secreto caduca el %{day}."
+        secret_expired: "El secreto caducó el %{day}. Rótalo, o nada podrá iniciar sesión con él."
         archive: "Archivar"
       saml:
         title: "SAML"
@@ -146,6 +148,7 @@ es:
         consent: "Pedir el consentimiento de los actores"
         access: "Los tokens de acceso duran (minutos, vacío para una hora)"
         refresh: "Los tokens de actualización duran sin usarse (días, vacío para 30)"
+        refresh_absolute: "Los tokens de actualización terminan tras el inicio de sesión (días, vacío para 90)"
         consent_lifetime: "El consentimiento dura (días, vacío hasta que se revoque)"
         logout: "URI de cierre de sesión por back-channel"
         logout_session: "Su token de cierre de sesión nombra la sesión (sid)"

data/config/locales/es/manage/ldap.yml

@@ -17,6 +17,7 @@ es:
         address: "Dirección"
         port: "Puerto %{port}"
         ldaps: "Puerto %{port}, LDAPS"
+        local_only: "Sin certificado, el directorio responde solo en la propia máquina de este servidor, para que ninguna contraseña cruce la red sin cifrar. Defina MASKS_LDAP_CERT y MASKS_LDAP_KEY para servir LDAPS en todas las direcciones, o MASKS_LDAP_PLAINTEXT=true en una red privada de confianza."
         label: "Etiqueta"
         issue: "Emitir una credencial"
         shown_once: "Este secreto se muestra una sola vez. Cópialo ahora."

data/config/locales/es/notifications.yml

@@ -5,6 +5,7 @@ es:
 
   notifications:
     saved: "Guardado."
+    again: "Vuelve a iniciar sesión para cambiar qué correos recibes. Hace tiempo que no lo haces."
 
     groups:
       password: "Contraseña"

data/config/locales/fr/account.yml

@@ -251,6 +251,10 @@ fr:
         lede: "Tout ce qui figure ici est activé jusqu’à ce que vous le désactiviez. Ces e-mails arrivent au fil des événements, et il n’est pas possible d’y répondre."
         silent: "Rien n’est envoyé, car ces e-mails ne partent que vers une adresse e-mail confirmée."
         submit: "Enregistrer"
+        kept: "Un mot de passe modifié ou réinitialisé et une connexion à risque sont toujours signalés."
+        always: "Toujours"
+        again: "Votre dernière connexion remonte à un moment, vous devrez donc d’abord vous reconnecter."
+        submit_again: "Se reconnecter"
 
       export:
         heading: "Télécharger votre compte"

data/config/locales/fr/actors.yml

@@ -6,3 +6,5 @@ fr:
           attributes:
             base:
               unnamed: "Un compte doit avoir un pseudo ou une adresse e-mail."
+            nickname:
+              held: "a été libéré récemment et ne peut pas encore être repris"

data/config/locales/fr/authorize.yml

@@ -5,3 +5,5 @@ fr:
       stopped: "Interrompu"
       heading: "L’application a demandé quelque chose que ce serveur refuse de faire."
       contact: "Rien n’a été partagé. C’est à l’application de corriger le problème."
+      refused: "Cette connexion a été refusée."
+      nothing_shared: "Rien n’a été partagé avec l’application. Vous pouvez fermer cette page."

data/config/locales/fr/events.yml

@@ -6,6 +6,8 @@ fr:
         ended: "Déconnexion"
         revoked: "Session révoquée"
         expired: "Session expirée"
+      notifications:
+        changed: "Notifications modifiées"
       logout:
         undelivered: "Déconnexion non transmise à une application"
       login:

data/config/locales/fr/flashes.yml

@@ -129,6 +129,7 @@ fr:
     directed: "L’annuaire de votre organisation gère votre nom."
     invalid: "%{errors}"
     updated: "Vos informations ont été enregistrées."
+    again: "Reconnectez-vous pour changer votre pseudo. Votre dernière connexion remonte à un moment."
 
   verifications:
     too_many_requests: "Trop de demandes. Attendez quelques minutes."

data/config/locales/fr/logins.yml

@@ -238,6 +238,7 @@ fr:
       too-many-attempts: "Trop de tentatives. Patientez quelques minutes."
       too-many-attempts-for-account: "Trop de tentatives pour ce compte."
       too-many-codes: "Trop de codes ont été envoyés à cette adresse. Patientez quelques minutes."
+      too-many-texts: "Trop de codes ont été envoyés à ce numéro. Patientez quelques minutes."
       prove-email-first: "Saisissez d’abord le code envoyé à cette adresse."
       no-account-for-email: "Aucun compte ici n’utilise cette adresse."
       invalid-setup-token: "Ce jeton de configuration est incorrect."

data/config/locales/fr/manage/client.yml

@@ -115,6 +115,8 @@ fr:
         sector_placeholder: "nécessaire quand ses URI de redirection couvrent plusieurs hôtes"
         unattended: "Se connecte en son propre nom (client_credentials)"
         rotate: "Renouveler le secret"
+        secret_expires: "Le secret expire le %{day}."
+        secret_expired: "Le secret a expiré le %{day}. Renouvelez-le, sinon rien ne peut se connecter avec."
         archive: "Archiver"
       saml:
         title: "SAML"
@@ -146,6 +148,7 @@ fr:
         consent: "Demander le consentement des acteurs"
         access: "Durée des jetons d’accès (minutes, vide pour une heure)"
         refresh: "Durée des jetons d’actualisation sans utilisation (jours, vide pour 30)"
+        refresh_absolute: "Fin des jetons d’actualisation après la connexion (jours, vide pour 90)"
         consent_lifetime: "Durée du consentement (jours, vide jusqu’à révocation)"
         logout: "URI de déconnexion back-channel"
         logout_session: "Son jeton de déconnexion indique la session (sid)"

data/config/locales/fr/manage/ldap.yml

@@ -17,6 +17,7 @@ fr:
         address: "Adresse"
         port: "Port %{port}"
         ldaps: "Port %{port}, LDAPS"
+        local_only: "Sans certificat, l’annuaire ne répond que sur la machine de ce serveur, pour qu’aucun mot de passe ne traverse le réseau en clair. Définissez MASKS_LDAP_CERT et MASKS_LDAP_KEY pour servir LDAPS sur toutes les adresses, ou MASKS_LDAP_PLAINTEXT=true sur un réseau privé de confiance."
         label: "Libellé"
         issue: "Émettre un identifiant"
         shown_once: "Ce secret n'est affiché qu'une fois. Copiez-le maintenant."

data/config/locales/fr/notifications.yml

@@ -5,6 +5,7 @@ fr:
 
   notifications:
     saved: "Enregistré."
+    again: "Reconnectez-vous pour changer les e-mails que vous recevez. Votre dernière connexion remonte à un moment."
 
     groups:
       password: "Mot de passe"

data/config/routes.rb

@@ -18,6 +18,7 @@ Masks::Server::Engine.routes.draw do
   post "/ssf/events", to: "received_signals#create", as: :received_signals
 
   match "/authorize", to: "authorize#show", via: %i[get post], as: :authorize
+  get "/authorize/refused", to: "authorize#refused", as: :authorize_refused
   post "/par", to: "pushed_authorizations#create", as: :pushed_authorization
   post "/device_authorization", to: "device_authorizations#create", as: :device_authorization
 

data/db/migrate/20261018100000_create_released_nicknames.rb

@@ -0,0 +1,22 @@
+class CreateReleasedNicknames < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :released_nicknames do |t|
+      t.references :tenant, null: false, foreign_key: { on_delete: :cascade }, index: false
+      t.references :actor, foreign_key: { on_delete: :nullify }, index: false
+      t.string :nickname, null: false
+      t.datetime :released_at, null: false
+    end
+
+    add_index :released_nicknames, %i[tenant_id nickname], unique: true
+    add_index :released_nicknames, :released_at
+
+    enable_row_level_security(:released_nicknames)
+  end
+
+  def down
+    disable_row_level_security(:released_nicknames)
+    drop_table :released_nicknames
+  end
+end

data/db/migrate/20261018110000_add_refresh_token_absolute_lifetime_to_clients.rb

@@ -0,0 +1,5 @@
+class AddRefreshTokenAbsoluteLifetimeToClients < ActiveRecord::Migration[8.1]
+  def change
+    add_column :clients, :refresh_token_absolute_lifetime, :integer
+  end
+end