masks-server 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 544dc01d0600507eb713667f0d8cf57275b4b7d957b603e3085f9e197e7e63c6
-  data.tar.gz: 70f664c959b40e98e9a273582a45c0dba352e5186430a72c26e3a8dd87db978b
+  metadata.gz: 608910b5ec386933423f04a3596c4b5d454b38e956449ca66d762d2cd79e3e82
+  data.tar.gz: f70b574939800fdcb3407025402e39663e15f8a9c71e2dff473685147e7cf693
 SHA512:
-  metadata.gz: a5c6177ca713658c3003f33cea0b8902c6810266271f4d4e6d0215d8a291b6da13a47add90dca3b65df3f9614f6161dd5627853c3e9038ddafffcc0963ce27d4
-  data.tar.gz: 872c0d7ce2bd4090f885fdbce3eb82d8459ff73840ac89d3bd9cd2088ae334dc1efb2c34fe7bc17a2f413492d07c15c74a69f73b771f98847a4a69ae10416228
+  metadata.gz: a061d6d81ac514d825d3963c466e99272d224e0250e964e8a057a8e794a7cd1f26955cd8e1cb5753eb418f8c91e5dd2d9b31b98c8bba4eb97d11d7112ce0a40b
+  data.tar.gz: c537d6afb5fc139d5e83fd92143f0eb28588f9ec1992e607209f89c5c9f59dfff3502dc0f1196a39c2a19fcec67910458494324a70e739ced310ea73f69168cb

data/app/controllers/masks/server/discovery_controller.rb

@@ -1,6 +1,9 @@
 module Masks
   module Server
     class DiscoveryController < ApplicationController
+      OPENID_ISSUER = "http://openid.net/specs/connect/1.0/issuer".freeze
+      LONGEST_RESOURCE = 512
+
       def openid
         render json: issuer.discovery
       end
@@ -13,6 +16,39 @@ module Masks
       def resource
         render json: issuer.protected_resource
       end
+
+      def webfinger
+        resource = params[:resource].to_s
+        host = resource_host(resource)
+
+        return head(:bad_request) if host.nil?
+        return head(:not_found) unless host.casecmp?(URI.parse(issuer.url).host)
+
+        asked = Array(params[:rel]).map(&:to_s)
+        links = [ { "rel" => OPENID_ISSUER, "href" => issuer.url } ]
+        links = links.select { |link| asked.include?(link["rel"]) } if asked.any?
+
+        response.headers["Access-Control-Allow-Origin"] = "*"
+        render json: { "subject" => resource, "links" => links }, content_type: "application/jrd+json"
+      end
+
+      private
+
+        def resource_host(resource)
+          return nil if resource.blank? || resource.length > LONGEST_RESOURCE
+
+          if resource.start_with?("acct:")
+            account, separator, host = resource.delete_prefix("acct:").rpartition("@")
+
+            return nil if separator.empty? || account.blank? || host.blank? || host.match?(%r{[/\\\s?#]})
+
+            host.sub(/:\d+\z/, "")
+          elsif resource.match?(%r{\Ahttps?://})
+            URI.parse(resource).host
+          end
+        rescue URI::InvalidURIError
+          nil
+        end
     end
   end
 end

data/app/controllers/masks/server/enrollments_controller.rb

@@ -12,6 +12,15 @@ module Masks
                    }, status: :too_many_requests
                  }
 
+      rate_limit to: 60, within: 1.hour, only: :create, name: "app",
+                 by: -> { [ current_tenant.id, claimed_client_id ].join(":") },
+                 with: -> {
+                   render json: {
+                     "error" => "too_many_requests",
+                     "error_description" => "too many enrollment tokens asked for by this app"
+                   }, status: :too_many_requests
+                 }
+
       before_action :no_store!
 
       def create
@@ -55,6 +64,14 @@ module Masks
           client
         end
 
+        def claimed_client_id
+          basic = ActionController::HttpAuthentication::Basic
+
+          named, = basic.user_name_and_password(request) if basic.has_basic_credentials?(request)
+
+          (named.presence || params[:client_id]).to_s
+        end
+
         def not_enrolled
           render json: {
             "error" => "invalid_request",

data/app/controllers/masks/server/organization_members_controller.rb

@@ -99,7 +99,9 @@ module Masks
         end
 
         def member!
-          @organization.memberships.includes(:actor).find_by(id: params[:id].to_s) ||
+          membership_id = params[:id].to_s[/\A\d+\z/]
+
+          (membership_id && @organization.memberships.includes(:actor).find_by(id: membership_id)) ||
             raise(Members::Refused, t("organization_members.not_a_member"))
         end
 

data/app/graphql/masks/server/manage/mutations/unenroll_client.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class UnenrollClient < BaseMutation
+          requires :security
+
+          argument :client_id, ID
+
+          field :client, Types::ClientType, null: false
+
+          def resolve(client_id:)
+            machine = client!(client_id)
+
+            refuse!("that client is not a machine an app enrolled, so archive it instead") unless machine.enrolled?
+
+            revoked = machine.unenroll!
+
+            audit!(Masks::Server::Event::CLIENT_UNENROLLED, client: machine, name: machine.name,
+                                                             enrolled_by: machine.enrolled_by.client_id, revoked: revoked)
+
+            { client: machine }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -63,6 +63,8 @@ module Masks
                 description: "The app that enrolled this client as one of its machines. Archiving that app archives this client."
           field :enrolled, [ ClientType ], null: false,
                 description: "The machines this app enrolled that are not archived."
+          field :last_seen_at, GraphQL::Types::ISO8601DateTime,
+                description: "When this client last got a token. Null if it never has."
           field :archived_at, GraphQL::Types::ISO8601DateTime
           field :secret_expires_at, GraphQL::Types::ISO8601DateTime
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
@@ -85,6 +87,10 @@ module Masks
             object.enrolled.active.order(:name)
           end
 
+          def last_seen_at
+            Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id).maximum(:created_at)
+          end
+
           def tokens(limit: nil)
             Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/mutation_type.rb

@@ -41,6 +41,7 @@ module Masks
           field :update_client, mutation: Mutations::UpdateClient
           field :rotate_client_secret, mutation: Mutations::RotateClientSecret
           field :archive_client, mutation: Mutations::ArchiveClient
+          field :unenroll_client, mutation: Mutations::UnenrollClient
           field :restore_client, mutation: Mutations::RestoreClient
           field :release_namespace, mutation: Mutations::ReleaseNamespace
           field :discover_provider, mutation: Mutations::DiscoverProvider

data/app/jobs/masks/server/application_job.rb

@@ -2,6 +2,34 @@ module Masks
   module Server
     class ApplicationJob < ActiveJob::Base
       include Tenancy::Job
+
+      class Incomplete < StandardError; end
+
+      private
+
+        def each_tenant(scope = Tenant.active)
+          failed = scope.find_each.filter_map do |tenant|
+            Tenant.switch(tenant) { yield tenant }
+            nil
+          rescue StandardError => e
+            report_tenant_failure(tenant, e)
+            tenant.subdomain
+          end
+
+          JobFailures.record(self.class.name, failed)
+
+          raise Incomplete, "#{self.class.name.demodulize} failed for #{failed.join(', ')}" if failed.any?
+        end
+
+        def report_tenant_failure(tenant, error)
+          ::Rails.error.report(error, context: { tenant: tenant.subdomain, job: self.class.name })
+
+          Tenant.switch(tenant) do
+            Event.record!(Event::JOB_FAILED, by: nil, job: self.class.name.demodulize, error: error.class.name, message: error.message.to_s[0, 200])
+          end
+        rescue StandardError => e
+          ::Rails.logger.warn("#{self.class.name} could not record its failure in #{tenant.subdomain}: #{e.message}")
+        end
     end
   end
 end

data/app/jobs/masks/server/check_domain_claims_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.find_each do |tenant|
-          Tenant.switch(tenant) { check }
-        end
+        each_tenant { check }
       end
 
       private

data/app/jobs/masks/server/cleanup_job.rb

@@ -37,13 +37,11 @@ module Masks
         end
 
         def sweep_tokens(cutoff)
-          loop do
-            roots = Token.group("COALESCE(root_id, id)")
-              .having("MAX(LEAST(consumed_at, expires_at)) < ?", cutoff)
-              .limit(BATCH).pluck(Arel.sql("COALESCE(root_id, id)"))
-            break if roots.empty?
+          Token.where(root_id: nil).ended_before(cutoff).in_batches(of: BATCH) do |roots|
+            ids = roots.pluck(:id)
+            kept = Token.where(root_id: ids).where("LEAST(consumed_at, expires_at) >= ?", cutoff).distinct.pluck(:root_id)
 
-            Token.families(roots).delete_all
+            Token.families(ids - kept).delete_all
           end
 
           Token.where.not(kind: RefreshToken.sti_name).ended_before(cutoff)

data/app/jobs/masks/server/idle_accounts_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.idling.find_each do |tenant|
-          Tenant.switch(tenant) { IdleAccounts.sweep(tenant) }
-        end
+        each_tenant(Tenant.active.idling) { |tenant| IdleAccounts.sweep(tenant) }
       end
     end
   end

data/app/jobs/masks/server/prune_queue_job.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    class PruneQueueJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      BATCH = 500
+
+      def perform
+        return unless defined?(::SolidQueue::Job)
+
+        settings = ::Rails.configuration.masks
+
+        ::SolidQueue::Job.clear_finished_in_batches(batch_size: BATCH, finished_before: settings.finished_job_retention.ago)
+        ::SolidQueue::FailedExecution.where(created_at: ...settings.failed_job_retention.ago).discard_all_in_batches(batch_size: BATCH)
+      end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_saml_metadata_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.find_each do |tenant|
-          Tenant.switch(tenant) { refresh }
-        end
+        each_tenant { refresh }
       end
 
       private

data/app/jobs/masks/server/rotate_signing_keys_job.rb

@@ -7,9 +7,7 @@ module Masks
       PUBLISHED_FOR = 1.day
 
       def perform
-        Tenant.active.where.not(key_rotation_days: nil).find_each do |tenant|
-          Tenant.switch(tenant) { advance(tenant) }
-        end
+        each_tenant(Tenant.active.where.not(key_rotation_days: nil)) { |tenant| advance(tenant) }
       end
 
       private

data/app/jobs/masks/server/text_job.rb

@@ -3,7 +3,11 @@ module Masks
     class TextJob < ApplicationJob
       queue_as :mailers
 
-      retry_on Sender::Failed, wait: :polynomially_longer, attempts: 3
+      ATTEMPTS = 3
+
+      retry_on Sender::Failed, wait: :polynomially_longer, attempts: ATTEMPTS do |job, error|
+        job.gave_up!(error)
+      end
 
       def perform(to, body)
         sender = Current.tenant&.sms_sender
@@ -12,6 +16,13 @@ module Masks
 
         sender.deliver(to: to, body: body)
       end
+
+      def gave_up!(error)
+        Tenant.switch(held_tenant) do
+          Event.record!(Event::TEXT_UNDELIVERED, actor: nil, by: nil, device: nil, ip_address: nil, user_agent: nil,
+                                                 said: error.message)
+        end
+      end
     end
   end
 end

data/app/models/masks/server/app_preset.rb

@@ -182,6 +182,108 @@ module Masks
             [ "OAUTH_PROVIDER_NAME", "{tenant}" ], [ "ENABLE_OAUTH_SIGNUP", "true" ],
             [ "ENABLE_OAUTH_ROLE_MANAGEMENT", "true" ], [ "OAUTH_ROLES_CLAIM", "groups" ], [ "OAUTH_ADMIN_ROLES", "admins" ]
           ]
+        },
+        {
+          key: "tailscale", name: "Tailscale",
+          redirects: [ "https://login.tailscale.com/a/oauth_response" ],
+          scopes: %w[openid profile email],
+          guide: "https://tailscale.com/kb/1240/sso-custom-oidc",
+          settings: [
+            [ "WebFinger domain", "{masks_host}" ], [ "Issuer URL", "{issuer}" ],
+            [ "Client ID", "{client_id}" ], [ "Client secret", "{client_secret}" ]
+          ]
+        },
+        {
+          key: "headscale", name: "Headscale",
+          redirects: [ "{base}/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://headscale.net/stable/ref/oidc/",
+          settings: [
+            [ "oidc.issuer", "{issuer}" ], [ "oidc.client_id", "{client_id}" ], [ "oidc.client_secret", "{client_secret}" ],
+            [ "oidc.scope", "[openid, profile, email, groups]" ], [ "oidc.allowed_groups", "[admins]" ]
+          ]
+        },
+        {
+          key: "home-assistant", name: "Home Assistant (OIDC integration)",
+          redirects: [ "{base}/auth/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://github.com/christiaangoossens/hass-oidc-auth",
+          settings: [
+            [ "auth_oidc.discovery_url", "{discovery}" ], [ "auth_oidc.client_id", "{client_id}" ],
+            [ "auth_oidc.client_secret", "{client_secret}" ], [ "auth_oidc.display_name", "{tenant}" ],
+            [ "auth_oidc.roles.admin", "admins" ]
+          ]
+        },
+        {
+          key: "synapse", name: "Matrix (Synapse)", asks: { "name" => "masks" },
+          redirects: [ "{base}/_synapse/client/oidc/callback" ],
+          scopes: %w[openid profile email],
+          guide: "https://element-hq.github.io/synapse/latest/openid.html",
+          settings: [
+            [ "oidc_providers", "- idp_id: {name}\n  idp_name: {tenant}\n  issuer: {issuer}\n  client_id: {client_id}\n" \
+                                "  client_secret: {client_secret}\n  scopes: [openid, profile, email]\n" \
+                                "  user_mapping_provider:\n    config:\n      localpart_template: \"{{ user.preferred_username }}\"\n" \
+                                "      display_name_template: \"{{ user.name }}\"\n      email_template: \"{{ user.email }}\"" ]
+          ]
+        },
+        {
+          key: "bookstack", name: "BookStack",
+          redirects: [ "{base}/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://www.bookstackapp.com/docs/admin/oidc-auth/",
+          settings: [
+            [ "AUTH_METHOD", "oidc" ], [ "OIDC_NAME", "{tenant}" ], [ "OIDC_ISSUER", "{issuer}" ], [ "OIDC_ISSUER_DISCOVER", "true" ],
+            [ "OIDC_CLIENT_ID", "{client_id}" ], [ "OIDC_CLIENT_SECRET", "{client_secret}" ],
+            [ "OIDC_DISPLAY_NAME_CLAIMS", "name" ], [ "OIDC_ADDITIONAL_SCOPES", "groups" ],
+            [ "OIDC_USER_TO_GROUPS", "true" ], [ "OIDC_GROUPS_CLAIM", "groups" ], [ "OIDC_REMOVE_FROM_GROUPS", "true" ]
+          ]
+        },
+        {
+          key: "wikijs", name: "Wiki.js", asks: { "name" => "masks" },
+          redirects: [ "{base}/login/{name}/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://docs.requarks.io/auth/oidc",
+          settings: [
+            [ "Client ID", "{client_id}" ], [ "Client Secret", "{client_secret}" ],
+            [ "Authorization Endpoint URL", "{authorize}" ], [ "Token Endpoint URL", "{token}" ],
+            [ "User Info Endpoint URL", "{userinfo}" ], [ "Issuer", "{issuer}" ], [ "Logout URL", "{logout}" ],
+            [ "Email Claim", "email" ], [ "Display Name Claim", "name" ], [ "Groups Claim", "groups" ],
+            [ "Callback URL", "{base}/login/{name}/callback" ]
+          ]
+        },
+        {
+          key: "minio", name: "MinIO",
+          redirects: [ "{base}/oauth_callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html",
+          settings: [
+            [ "MINIO_IDENTITY_OPENID_CONFIG_URL", "{discovery}" ], [ "MINIO_IDENTITY_OPENID_CLIENT_ID", "{client_id}" ],
+            [ "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "{client_secret}" ], [ "MINIO_IDENTITY_OPENID_SCOPES", "openid,profile,email,groups" ],
+            [ "MINIO_IDENTITY_OPENID_CLAIM_NAME", "groups" ], [ "MINIO_IDENTITY_OPENID_REDIRECT_URI", "{base}/oauth_callback" ],
+            [ "MINIO_IDENTITY_OPENID_DISPLAY_NAME", "{tenant}" ]
+          ]
+        },
+        {
+          key: "argocd", name: "Argo CD",
+          redirects: [ "{base}/auth/callback", "{base}/api/dex/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#existing-oidc-provider",
+          settings: [
+            [ "argocd-cm oidc.config", "name: {tenant}\nissuer: {issuer}\nclientID: {client_id}\nclientSecret: {client_secret}\n" \
+                                       "requestedScopes: [openid, profile, email, groups]" ],
+            [ "argocd-rbac-cm policy.csv", "g, admins, role:admin" ], [ "argocd-rbac-cm scopes", "[groups]" ]
+          ]
+        },
+        {
+          key: "synology", name: "Synology DSM",
+          redirects: [ "{base}", "{base}/" ],
+          scopes: %w[openid profile email],
+          guide: "https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_sso_client",
+          settings: [
+            [ "Profile", "OIDC" ], [ "Name", "{tenant}" ], [ "Well Known URL", "{discovery}" ],
+            [ "Client ID", "{client_id}" ], [ "Client secret", "{client_secret}" ],
+            [ "Scope", "openid profile email" ], [ "Username claim", "preferred_username" ], [ "Redirect URI", "{base}" ]
+          ]
         }
       ].map(&:freeze).freeze
 

data/app/models/masks/server/boot_task.rb

@@ -0,0 +1,41 @@
+require "socket"
+require "zlib"
+
+module Masks
+  module Server
+    class BootTask
+      WINDOW = 10.minutes
+
+      Outcome = Struct.new(:name, :host, :value, :done) do
+        def done? = done
+      end
+
+      class << self
+        def once(name, fingerprint: nil)
+          key = "masks:boot:#{name}:#{Digest::SHA256.hexdigest(fingerprint.to_s)[0, 16]}"
+          host = Socket.gethostname
+          outcome = nil
+
+          ActiveRecord::Base.transaction do
+            ActiveRecord::Base.connection.execute("SELECT pg_advisory_xact_lock(#{lock_id(name)})")
+            done_by = ::Rails.cache.read(key)
+
+            if done_by
+              outcome = Outcome.new(name, done_by, nil, false)
+            else
+              value = yield
+              ::Rails.cache.write(key, host, expires_in: WINDOW)
+              outcome = Outcome.new(name, host, value, true)
+            end
+          end
+
+          outcome
+        end
+
+        def lock_id(name)
+          Zlib.crc32("masks:boot:#{name}")
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/enrollment_token.rb

@@ -2,7 +2,7 @@ module Masks
   module Server
     class EnrollmentToken < Token
       SHORTEST = 1.minute
-      LONGEST = 1.hour
+      LONGEST = 1.day
 
       class << self
         def lifetime

data/app/models/masks/server/event.rb

@@ -146,6 +146,7 @@ module Masks
       SIGNAL_STREAM_UPDATED = "signal_stream.updated".freeze
       SIGNAL_STREAM_DELETED = "signal_stream.deleted".freeze
       SIGNAL_UNDELIVERED = "signal.undelivered".freeze
+      TEXT_UNDELIVERED = "text.undelivered".freeze
       SIGNAL_RECEIVED = "signal.received".freeze
 
       ORGANIZATION_CREATED = "organization.created".freeze
@@ -167,10 +168,13 @@ module Masks
       CUSTOM_DOMAIN_SERVED = "custom_domain.served".freeze
       CUSTOM_DOMAIN_STOPPED = "custom_domain.stopped".freeze
 
+      JOB_FAILED = "job.failed".freeze
+
       GRAVE = [
         LOGIN_REFUSED, LOGIN_THROTTLED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
         DEVICE_BLOCKED, ACTOR_DELETED, AUTHENTICATOR_DISABLED, CONNECTION_REFUSED, DELEGATION_REFUSED,
-        EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT, ORGANIZATION_OWNERLESS
+        EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, TEXT_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT,
+        ORGANIZATION_OWNERLESS, JOB_FAILED
       ].freeze
 
       ACTIONS = constants(false).filter_map do |name|

data/app/models/masks/server/job_failures.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module JobFailures
+      KEEP = 2.days
+      PREFIX = "masks:jobs:failed_tenants:".freeze
+
+      module_function
+
+      def record(job, subdomains)
+        ::Rails.cache.write("#{PREFIX}#{job}", subdomains.sort, expires_in: KEEP)
+      end
+
+      def last(job)
+        ::Rails.cache.read("#{PREFIX}#{job}") || []
+      end
+
+      def named(jobs)
+        jobs.map do |job|
+          tenants = last(job)
+          tenants.empty? ? job : "#{job} (#{tenants.join(', ')})"
+        end
+      end
+    end
+  end
+end

data/config/locales/de/events.yml

@@ -157,6 +157,8 @@ de:
         exported: "Aktivität exportiert"
       mail_template:
         updated: "E-Mail-Vorlage geändert"
+      job:
+        failed: "Hintergrundjob für diesen Mandanten fehlgeschlagen"
       stream:
         created: "Event-Stream hinzugefügt"
         updated: "Event-Stream geändert"
@@ -171,6 +173,8 @@ de:
       signal:
         undelivered: "Shared Signal nicht zugestellt"
         received: "Anbieter hat Abmeldung signalisiert"
+      text:
+        undelivered: "SMS nicht zugestellt"
       organization:
         created: "Organisation hinzugefügt"
         updated: "Organisation geändert"

data/config/locales/de/manage/client.yml

@@ -174,7 +174,7 @@ de:
       uris:
         title: "URIs"
         acs: "Assertion Consumer Services"
-        redirect: "Redirect"
+        redirect: "Weiterleitung"
         post_logout: "Redirect nach dem Logout"
         resources: "Ressourcen"
       details:

data/config/locales/de/manage/machines.yml

@@ -0,0 +1,13 @@
+de:
+  manage:
+    machines:
+      title: "Maschinen"
+      lede: "Clients, die diese App mit einem Registrierungstoken angemeldet hat. Jeder meldet sich mit einem eigenen Schlüssel an."
+      empty: "Diese App hat noch keine Maschine angemeldet."
+      last_seen: "Zuletzt angemeldet %{day}"
+      never: "Nie angemeldet"
+      enrolled: "Angemeldet %{day}"
+      enrolled_by: "Eine Maschine, angemeldet von"
+      revoke: "Widerrufen"
+      revoke_confirm: "%{name} widerrufen? Sie wird archiviert, jedes Token endet, und sie kann sich nicht mehr anmelden."
+      revoked: "%{name} ist widerrufen und kann sich nicht mehr anmelden."

data/config/locales/de/manage/namespaces.yml

@@ -1,7 +1,7 @@
 de:
   manage:
     namespaces:
-      title: "Namespaces"
+      title: "Namensräume"
       release_confirm: "%{name} freigeben? Der nächste Client, der ihn anfordert, erhält ihn, und die Scopes darunter bedeuten nicht mehr, was sie jetzt bedeuten."
       released: "%{name} kann wieder beansprucht werden."
       columns:

data/config/locales/en/events.yml

@@ -157,6 +157,8 @@ en:
         exported: "Activity exported"
       mail_template:
         updated: "Email template changed"
+      job:
+        failed: "Background job failed for this tenant"
       stream:
         created: "Event stream added"
         updated: "Event stream changed"
@@ -171,6 +173,8 @@ en:
       signal:
         undelivered: "Shared signal not delivered"
         received: "Provider signaled sign-out"
+      text:
+        undelivered: "Text message not delivered"
       organization:
         created: "Organization added"
         updated: "Organization changed"

data/config/locales/en/manage/machines.yml

@@ -0,0 +1,13 @@
+en:
+  manage:
+    machines:
+      title: "Machines"
+      lede: "Clients this app enrolled with an enrollment token. Each one signs in with its own key."
+      empty: "This app has not enrolled a machine yet."
+      last_seen: "Last signed in %{day}"
+      never: "Never signed in"
+      enrolled: "Enrolled %{day}"
+      enrolled_by: "A machine enrolled by"
+      revoke: "Revoke"
+      revoke_confirm: "Revoke %{name}? It is archived, every token it holds ends, and it can no longer sign in."
+      revoked: "%{name} is revoked and can no longer sign in."

data/config/locales/es/events.yml

@@ -157,6 +157,8 @@ es:
         exported: "Actividad exportada"
       mail_template:
         updated: "Plantilla de correo cambiada"
+      job:
+        failed: "Tarea en segundo plano fallida para este inquilino"
       stream:
         created: "Flujo de eventos añadido"
         updated: "Flujo de eventos cambiado"
@@ -171,6 +173,8 @@ es:
       signal:
         undelivered: "Señal compartida no entregada"
         received: "El proveedor señaló un cierre de sesión"
+      text:
+        undelivered: "Mensaje de texto no entregado"
       organization:
         created: "Organización añadida"
         updated: "Organización cambiada"

data/config/locales/es/handshakes.yml

@@ -26,7 +26,7 @@ es:
       area_yours: " Tú los recibes todos ahora."
       also: "%{name} también puede"
       details: "Detalles técnicos"
-      scopes: "Scopes"
+      scopes: "Alcances"
       client: "Credenciales"
       credentials:
         public: "Pública. No guarda ningún secreto."

data/config/locales/es/manage/machines.yml

@@ -0,0 +1,13 @@
+es:
+  manage:
+    machines:
+      title: "Máquinas"
+      lede: "Clientes que esta aplicación inscribió con un token de inscripción. Cada uno inicia sesión con su propia clave."
+      empty: "Esta aplicación aún no ha inscrito ninguna máquina."
+      last_seen: "Último inicio de sesión %{day}"
+      never: "Nunca ha iniciado sesión"
+      enrolled: "Inscrita %{day}"
+      enrolled_by: "Una máquina inscrita por"
+      revoke: "Revocar"
+      revoke_confirm: "¿Revocar %{name}? Se archiva, todos sus tokens terminan y ya no puede iniciar sesión."
+      revoked: "%{name} está revocada y ya no puede iniciar sesión."