runlight 0.1.7 → 0.2.0

data/assets/tracker.js

@@ -1 +1 @@
-(function(){var n=window,a=document,u=navigator,p=a.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),k=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=o("before-send"),A=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},G=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return A(e.trim())}),H=!1,O=n.runlight&&n.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[k]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&/[?&]runlight_ticket=/.test(location.search)){var M=a.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,a.head.appendChild(M),n.runlight=function(){};return}var N=!1;try{var z=/[?&]runlight=(ignore|track)\b/.exec(location.search);z&&(z[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||n.doNotTrack==="1")){n.runlight=function(){};return}var E=function(e,t){if(!H){var r={k:e,u:b};k&&(r.s=k);for(var i in t)r[i]=t[i];if($!==null)try{if(r=n[$](r),!r||r.constructor!==Object)return}catch(y){return}var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||n.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},J=function(){var e=new Uint8Array(6);return(n.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.from(e,function(t){return(t+256).toString(36).slice(-2)}).join("")},B=o("404")!==null,b="",v="",f=0,d=0,w=0,P=function(){return a.visibilityState==="visible"&&a.hasFocus()},F=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&P()&&(d=Date.now())},S=function(){F(),v&&f>=1e3&&(E("engagement",{i:v,e:f,d:w}),f=0)},D=function(){var e=a.documentElement,t=Math.max(e.scrollHeight,a.body?a.body.scrollHeight:0),r=(n.scrollY||e.scrollTop)+n.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>w&&(w=i)},Y=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:Y();if(t!==b){var r=b||a.referrer;S(),b=t;var i=new URL(t).pathname;H=G.some(function(s){return s.test(i)}),v=J(),f=0,w=0,D(),c(),E("pageview",{i:v,r,t:a.title,w:screen.width,h:screen.height,l:u.language}),B&&l("404",{path:location.pathname}),B=!1}},l=function(e,t){typeof e!="string"||!e||E("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},V=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(V("pushState"),V("replaceState"),n.addEventListener("popstate",h),U&&n.addEventListener("hashchange",h)),a.addEventListener("visibilitychange",function(){a.visibilityState==="hidden"?S():c()}),n.addEventListener("pagehide",S),n.addEventListener("blur",F),n.addEventListener("focus",c),n.addEventListener("scroll",function(){D(),c()},{passive:!0}),a.addEventListener("pointerdown",c,!0),a.addEventListener("keydown",c,!0);var q=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;a.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],y=s[1];(s[0]==="s"?t.closest(y):r&&A(y).test(y.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(K){}var g=t.closest("[data-runlight]");if(g){for(var C={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(C[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),C)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&q.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),n.runlight=l,l.pageview=h,I||h();for(var L=0;L<O.length;L++)l.apply(null,O[L])}})();
+(function(){var a=window,n=document,u=navigator,p=n.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),k=o("site"),U=o("hash")!==null,I=o("manual")!==null,T=o("before-send"),$=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},J=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return $(e.trim())}),A=!1,H=a.runlight&&a.runlight.q||[],m="__RUNLIGHT_RULES__",O=typeof m=="object"&&(m[k]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[],M=/[?&]runlight=pick\b/.test(location.search)&&/[?&]runlight_ticket=/.test(location.search);if(M){var N=n.createElement("script");N.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,n.head.appendChild(N)}var z=!1;try{var B=/[?&]runlight=(ignore|track)\b/.exec(location.search);B&&(B[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),z=localStorage.getItem("runlight_ignore")==="1"}catch(e){}var P=M||u.webdriver||z||o("dnt")!==null&&(u.doNotTrack==="1"||a.doNotTrack==="1"),E=function(e,t){if(!(A||P)){var r={k:e,u:b};k&&(r.s=k);for(var i in t)r[i]=t[i];if(T!==null)try{if(r=a[T](r),!r||r.constructor!==Object)return}catch(y){return}var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||a.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},Y=function(){var e=new Uint8Array(6);return(a.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.from(e,function(t){return(t+256).toString(36).slice(-2)}).join("")},F=o("404")!==null,b="",v="",f=0,d=0,w=0,q=function(){return n.visibilityState==="visible"&&n.hasFocus()},D=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&q()&&(d=Date.now())},S=function(){D(),v&&f>=1e3&&(E("engagement",{i:v,e:f,d:w}),f=0)},V=function(){var e=n.documentElement,t=Math.max(e.scrollHeight,n.body?n.body.scrollHeight:0),r=(a.scrollY||e.scrollTop)+a.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>w&&(w=i)},K=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:K();if(t!==b){var r=b||n.referrer;S(),b=t;var i=new URL(t).pathname;A=J.some(function(s){return s.test(i)}),v=Y(),f=0,w=0,V(),c(),E("pageview",{i:v,r,t:n.title,w:screen.width,h:screen.height,l:u.language}),F&&l("404",{path:location.pathname}),F=!1}},l=function(e,t){typeof e!="string"||!e||E("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},C=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return setTimeout(h),r}};I||(C("pushState"),C("replaceState"),a.addEventListener("popstate",h),U&&a.addEventListener("hashchange",h)),n.addEventListener("visibilitychange",function(){n.visibilityState==="hidden"?S():c()}),a.addEventListener("pagehide",S),a.addEventListener("blur",D),a.addEventListener("focus",c),a.addEventListener("scroll",function(){V(),c()},{passive:!0}),n.addEventListener("pointerdown",c,!0),n.addEventListener("keydown",c,!0);var Q=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;n.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<O.length;i++)try{var s=O[i],y=s[1];(s[0]==="s"?t.closest(y):r&&$(y).test(y.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(W){}var g=t.closest("[data-runlight]");if(g){for(var G={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(G[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),G)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&Q.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),a.runlight=l,l.pageview=h,I||h();for(var L=0;L<H.length;L++)l.apply(null,H[L])}})();

data/lib/runlight/accounts/accounts.rb

@@ -151,21 +151,9 @@ module Runlight
         ticket("pending", user, now + (5 * 60_000))
       end
 
-      # A ticket that looks and acts like pending_for's, except that no code ever
-      # passes with it. A wrong password gets one once an account with
-      # two-factor has had too many, so the answer never tells a right password.
-      def decoy_for(user, now)
-        ticket("decoy", user, now + (5 * 60_000))
-      end
-
-      # The account a code-step ticket names, and whether a right code may sign in with it:
-      # {"user" => user, "real" => bool}, or nil.
+      # The account a code-step ticket names, or nil.
       def from_pending(value, now)
-        user = from_ticket("pending", value, now)
-        return { "user" => user, "real" => true } unless user.nil?
-
-        decoy = from_ticket("decoy", value, now)
-        decoy.nil? ? nil : { "user" => decoy, "real" => false }
+        from_ticket("pending", value, now)
       end
 
       # A ticket for a sign-in link sent by email, for fifteen minutes. A new password withdraws it.
@@ -249,6 +237,20 @@ module Runlight
         nil
       end
 
+      # Removes the accounts and invitations kept to a site that was deleted. A site made later is often given the
+      # same id, from its domain, and they must not find their way into it.
+      def forget_site(site)
+        init
+        turn do
+          list.select { |u| u["site"] == site }.each do |user|
+            @store.db.run("DELETE FROM rl_users WHERE id = ?", [user["id"]])
+            @store.set_setting("login-link-used:#{user["id"]}", nil)
+          end
+          @store.db.run("DELETE FROM rl_invites WHERE site = ?", [site])
+        end
+        nil
+      end
+
       # Removes an account. The owner cannot be removed.
       def remove(id)
         # The tables first: making them takes the same lock as a turn.
@@ -367,7 +369,13 @@ module Runlight
           self.class.slot { Crypto.check_password(password, hash) }
           return nil
         end
-        self.class.slot { Crypto.check_password(password, user["hash"]) } ? user : nil
+        return nil unless self.class.slot { Crypto.check_password(password, user["hash"]) }
+        return user unless Crypto.weaker_than_now?(user["hash"])
+
+        # A hash from before the cost rose is made again now that the password is here, unless it changed meanwhile.
+        hash = self.class.slot { Crypto.hash_password(password) }
+        @store.db.run("UPDATE rl_users SET hash = ? WHERE id = ? AND hash = ?", [hash, user["id"], user["hash"]])
+        by_id(user["id"]) || user
       end
 
       # A cookie value naming the user and when it expires, signed with the

data/lib/runlight/accounts/crypto.rb

@@ -12,10 +12,12 @@ module Runlight
     # TOTP, the otpauth address, recovery codes, and the signature on session cookies) are here too, as
     # functions of their inputs alone, so the accounts class can call them.
     module Crypto
-      SCRYPT_N = 16_384
-      SCRYPT_R = 8
-      SCRYPT_P = 1
-      private_constant :SCRYPT_N, :SCRYPT_R, :SCRYPT_P
+      # What a new hash costs: one of OWASP's scrypt settings, 32 MiB a check. Each hash records its own cost,
+      # so this can rise again.
+      SCRYPT = { n: 32_768, r: 8, p: 3 }.freeze
+      # What a hash written as scrypt$salt$key costs: the setting before hashes recorded theirs.
+      SCRYPT_BEFORE = { n: 16_384, r: 8, p: 1 }.freeze
+      private_constant :SCRYPT, :SCRYPT_BEFORE
 
       # As many PBKDF2 rounds as Cloudflare Workers allow, the strictest runtime Runlight runs on.
       PBKDF2_ROUNDS = 100_000
@@ -71,10 +73,10 @@ module Runlight
         same_bytes(a, b)
       end
 
-      # A password hash, in the scrypt form the standalone server has always written.
+      # A password hash, scrypt$N$r$p$salt$key: it records its cost, which can rise later.
       def hash_password(password)
         salt = random_bytes(16)
-        "scrypt$#{base64url(salt)}$#{base64url(scrypt(password, salt, 32))}"
+        "scrypt$#{SCRYPT[:n]}$#{SCRYPT[:r]}$#{SCRYPT[:p]}$#{base64url(salt)}$#{base64url(scrypt(password, salt, 32, SCRYPT))}"
       end
 
       # Whether a password matches a hash, scrypt or PBKDF2. A stored key under MIN_KEY_BYTES is refused,
@@ -88,12 +90,15 @@ module Runlight
         rescue ArgumentError
           nil
         end
-        if parts[0] == "scrypt" && parts.length == 3
-          expected = decode.call(parts[2])
-          salt = decode.call(parts[1])
+        if parts[0] == "scrypt" && [3, 6].include?(parts.length)
+          cost = scrypt_cost(parts)
+          return false if cost.nil?
+
+          expected = decode.call(parts[-1])
+          salt = decode.call(parts[-2])
           return false if expected.nil? || salt.nil? || expected.bytesize < MIN_KEY_BYTES
 
-          return same_bytes(scrypt(password, salt, expected.bytesize), expected)
+          return same_bytes(scrypt(password, salt, expected.bytesize, cost), expected)
         end
         if parts[0] == "pbkdf2" && parts.length == 4
           rounds = Js.number(parts[1])
@@ -108,8 +113,31 @@ module Runlight
         false
       end
 
-      def scrypt(password, salt, length)
-        length.zero? ? "".b : Scrypt.derive(password, salt, SCRYPT_N, SCRYPT_R, SCRYPT_P, length)
+      # Whether a stored hash costs less than a new one would, so the password it matched is hashed again: an
+      # scrypt hash with a lower cost, or a PBKDF2 one.
+      def weaker_than_now?(stored)
+        parts = stored.split("$", -1)
+        return true if parts[0] == "pbkdf2"
+        return false if parts[0] != "scrypt"
+
+        cost = scrypt_cost(parts)
+        !cost.nil? && cost[:n] * cost[:r] * cost[:p] < SCRYPT[:n] * SCRYPT[:r] * SCRYPT[:p]
+      end
+
+      # A scrypt hash's cost: recorded in it (scrypt$N$r$p$salt$key), or the old setting (scrypt$salt$key).
+      # Nil for one out of bounds, so a stored hash cannot ask for a huge amount of memory or time.
+      def scrypt_cost(parts)
+        return SCRYPT_BEFORE if parts.length == 3
+
+        n, r, p = parts[1, 3].map { |part| Js.number(part) }
+        whole = ->(v, max) { v.is_a?(Integer) && v >= 1 && v <= max }
+        return nil unless whole.call(n, 1 << 20) && n >= 2 && (n & (n - 1)).zero? && whole.call(r, 32) && whole.call(p, 16)
+
+        { n: n, r: r, p: p }
+      end
+
+      def scrypt(password, salt, length, cost)
+        length.zero? ? "".b : Scrypt.derive(password, salt, cost[:n], cost[:r], cost[:p], length)
       end
 
       def pbkdf2(password, salt, rounds, length)
@@ -251,7 +279,7 @@ module Runlight
         base64url(hmac("SHA-256", secret, "#{body}.#{hash}"))
       end
 
-      private_class_method :scrypt, :pbkdf2, :same_bytes, :seal_key, :decode_utf8
+      private_class_method :scrypt, :scrypt_cost, :pbkdf2, :same_bytes, :seal_key, :decode_utf8
     end
   end
 end

data/lib/runlight/accounts/pages.rb

@@ -54,7 +54,7 @@ module Runlight
       CSS
 
       # Applies the saved theme before the page paints, then runs the switch and Cmd+Shift+D (Ctrl+Shift+D).
-      AUTH_JS = <<~'JS'.chomp
+      AUTH_JS_SOURCE = <<~'JS'.chomp
         (() => {
           const COMMON = ["password", "passw0rd", "123456", "qwerty", "azerty", "letmein", "welcome", "admin", "runlight", "iloveyou", "abc123", "monkey", "dragon", "football", "baseball", "sunshine", "princess", "shadow", "master"];
           function strength(password, avoid = []) {
@@ -157,11 +157,11 @@ module Runlight
         })();
       JS
 
-      THEME_BUTTON = '<button type="button" class="theme" aria-label="Switch theme"><svg data-choice="light" viewBox="0 0 16 16" aria-hidden="true">' \
-                     '<circle cx="8" cy="8" r="3"/><path d="M8 1.5v1.5M8 13v1.5M1.5 8H3M13 8h1.5M3.4 3.4l1 1M11.6 11.6l1 1M3.4 12.6l1-1M11.6 4.4l1-1"/></svg>' \
-                     '<svg data-choice="dark" viewBox="0 0 16 16" aria-hidden="true"><path d="M13.5 9.5A5.5 5.5 0 0 1 6.5 2.5a5.5 5.5 0 1 0 7 7z"/></svg>' \
-                     '<svg data-choice="system" viewBox="0 0 16 16" aria-hidden="true"><rect x="2" y="3" width="12" height="8.5" rx="1.5"/><path d="M5.5 14h5M8 11.5V14"/></svg></button>'
-      private_constant :THEME_BUTTON
+      THEME_ICONS = '<svg data-choice="light" viewBox="0 0 16 16" aria-hidden="true">' \
+                    '<circle cx="8" cy="8" r="3"/><path d="M8 1.5v1.5M8 13v1.5M1.5 8H3M13 8h1.5M3.4 3.4l1 1M11.6 11.6l1 1M3.4 12.6l1-1M11.6 4.4l1-1"/></svg>' \
+                    '<svg data-choice="dark" viewBox="0 0 16 16" aria-hidden="true"><path d="M13.5 9.5A5.5 5.5 0 0 1 6.5 2.5a5.5 5.5 0 1 0 7 7z"/></svg>' \
+                    '<svg data-choice="system" viewBox="0 0 16 16" aria-hidden="true"><rect x="2" y="3" width="12" height="8.5" rx="1.5"/><path d="M5.5 14h5M8 11.5V14"/></svg>'
+      private_constant :THEME_ICONS, :AUTH_JS_SOURCE
 
       ESCAPES = { "&" => "&amp;", "<" => "&lt;", ">" => "&gt;", '"' => "&quot;", "'" => "&#39;" }.freeze
       private_constant :ESCAPES
@@ -177,11 +177,31 @@ module Runlight
         Version.build["icon"].to_s
       end
 
-      def page(base, title, body)
+      # The script, with its words in a language the dashboard speaks. English is served as auth.js, the others as
+      # auth.js?lang=fr and so on.
+      def auth_js(lang = "en")
+        translator = Messages.translator(lang)
+        t = translator["t"]
+        q = ->(key) { Json.encode(t.call(key)) }
+        theme = translator["lang"] == "en" ? '"Theme: " + c' : "c === \"dark\" ? #{q.call("auth.themeDark")} : #{q.call("auth.themeLight")}"
+        strength = (0..4).map { |n| q.call("account.strength#{n}") }.join(", ")
+        AUTH_JS_SOURCE
+          .sub('button.title = c === "system" ? "Theme: device setting" : "Theme: " + c;',
+               "button.title = c === \"system\" ? #{q.call("auth.themeSystem")} : #{theme};")
+          .sub('eye.setAttribute("aria-label", shown ? "Hide password" : "Show password");',
+               "eye.setAttribute(\"aria-label\", shown ? #{q.call("auth.hidePassword")} : #{q.call("auth.showPassword")});")
+          .sub('eye.title = shown ? "Hide password" : "Show password";',
+               "eye.title = shown ? #{q.call("auth.hidePassword")} : #{q.call("auth.showPassword")};")
+          .sub('["Too short", "Weak", "Fair", "Good", "Strong"][score]', "[#{strength}][score]")
+      end
+
+      def page(base, lang, title, body)
         b = esc(base)
+        translator = Messages.translator(lang)
+        code = translator["lang"]
         <<~HTML
           <!doctype html>
-          <html lang="en">
+          <html lang="#{code}">
           <head>
           <meta charset="utf-8">
           <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -189,14 +209,14 @@ module Runlight
           <title>#{esc(title)} | Runlight</title>
           <link rel="icon" href="#{icon}">
           <link rel="stylesheet" href="#{b}/auth.css">
-          <script src="#{b}/auth.js"></script>
+          <script src="#{b}/auth.js#{code == "en" ? "" : "?lang=#{code}"}"></script>
           </head>
           <body>
           <main>
           <p class="brand">#{MARK}Runlight</p>
           #{body}
           </main>
-          #{THEME_BUTTON}
+          <button type="button" class="theme" aria-label="#{esc(translator["t"].call("auth.switchTheme"))}">#{THEME_ICONS}</button>
           </body>
           </html>
         HTML
@@ -207,115 +227,134 @@ module Runlight
       end
 
       # opts: "error", "email", "next" (all optional), and "forgot".
-      def login_page(base, opts)
+      def login_page(base, opts, lang = "en")
         b = esc(base)
-        page(base, "Sign in", <<~HTML.chomp)
-          <h1>Sign in</h1>
-          <p>Sign in to see your sites.</p>
+        translator = Messages.translator(lang)
+        t = translator["t"]
+        h = translator["html"]
+        link = "<a href=\"#{esc(opts["forgot"])}\" target=\"_blank\" rel=\"noopener\">#{h.call("auth.forgotLink")}</a>"
+        page(base, lang, t.call("auth.signIn"), <<~HTML.chomp)
+          <h1>#{h.call("auth.signIn")}</h1>
+          <p>#{h.call("auth.signInIntro")}</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/login">
           <input type="hidden" name="next" value="#{esc(opts["next"] || "#{base}/")}">
-          <label>Email<input type="email" name="email" autocomplete="username" required autofocus value="#{esc(opts["email"] || "")}"></label>
-          <label>Password<input type="password" name="password" autocomplete="current-password" required></label>
-          <button type="submit">Sign in</button>
+          <label>#{h.call("auth.email")}<input type="email" name="email" autocomplete="username" required autofocus value="#{esc(opts["email"] || "")}"></label>
+          <label>#{h.call("auth.password")}<input type="password" name="password" autocomplete="current-password" required></label>
+          <button type="submit">#{h.call("auth.signIn")}</button>
           </form>
-          <p class="hint">If you have forgotten your password, <a href="#{esc(opts["forgot"])}" target="_blank" rel="noopener">the docs say how to set a new one</a>.</p>
+          <p class="hint">#{h.call("auth.forgot", { "link" => link })}</p>
         HTML
       end
 
       # The second step of signing in, for an account with two-factor on. opts: "pending", "next", and "error".
-      def code_page(base, opts)
+      def code_page(base, opts, lang = "en")
         b = esc(base)
-        page(base, "Enter your code", <<~HTML.chomp)
-          <h1>Enter your code</h1>
-          <p>Open your authenticator app and enter the six-digit code for Runlight.</p>
+        translator = Messages.translator(lang)
+        h = translator["html"]
+        page(base, lang, translator["t"].call("auth.codeTitle"), <<~HTML.chomp)
+          <h1>#{h.call("auth.codeTitle")}</h1>
+          <p>#{h.call("auth.codeIntro")}</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/login/code">
           <input type="hidden" name="pending" value="#{esc(opts["pending"])}">
           <input type="hidden" name="next" value="#{esc(opts["next"])}">
-          <label>Code<input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" maxlength="12" required autofocus></label>
-          <button type="submit">Sign in</button>
+          <label>#{h.call("auth.code")}<input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" maxlength="12" required autofocus></label>
+          <button type="submit">#{h.call("auth.signIn")}</button>
           </form>
-          <p class="hint">Lost your phone? Enter one of your recovery codes instead. Each works once.</p>
+          <p class="hint">#{h.call("auth.codeHint")}</p>
         HTML
       end
 
       # What someone invited with a role can do, after "as".
-      def role_text(role, site = nil)
-        return role == "viewer" ? "a viewer, who can read the stats for #{site} only" : "a member, who can change the settings of #{site} only" unless site.nil?
-        return "a viewer, who can read every site's stats" if role == "viewer"
-        return "a member, who can change the settings of every site" if role == "member"
+      def role_text(role, site = nil, lang = "en")
+        t = Messages.translator(lang)["t"]
+        return t.call(role == "viewer" ? "auth.roleViewerSite" : "auth.roleMemberSite", { "site" => site }) unless site.nil?
+        return t.call("auth.roleViewer") if role == "viewer"
+        return t.call("auth.roleMember") if role == "member"
 
-        "an admin, who can change everything and manage people"
+        t.call("auth.roleAdmin")
       end
 
       # Where an invited person chooses a password and joins. opts: "code", "email", "role", "host", and "error".
-      def invite_page(base, opts)
+      def invite_page(base, opts, lang = "en")
         b = esc(base)
-        page(base, "Join Runlight", <<~HTML.chomp)
-          <h1>Join Runlight</h1>
-          <p>You were invited to #{esc(opts["host"])} as #{esc(role_text(opts["role"], opts["site"]))}. Choose a password to finish.</p>
+        translator = Messages.translator(lang)
+        h = translator["html"]
+        page(base, lang, translator["t"].call("auth.joinTitle"), <<~HTML.chomp)
+          <h1>#{h.call("auth.joinTitle")}</h1>
+          <p>#{h.call("auth.joinIntro", { "host" => esc(opts["host"]), "role" => esc(role_text(opts["role"], opts["site"], lang)) })}</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/invite">
           <input type="hidden" name="code" value="#{esc(opts["code"])}">
-          <label>Email<input type="email" value="#{esc(opts["email"])}" disabled></label>
-          <label>Password<input type="password" name="password" autocomplete="new-password" minlength="10" required autofocus></label>
-          <label>Password again<input type="password" name="again" autocomplete="new-password" minlength="10" required></label>
-          <button type="submit">Join</button>
+          <label>#{h.call("auth.email")}<input type="email" value="#{esc(opts["email"])}" disabled></label>
+          <label>#{h.call("auth.password")}<input type="password" name="password" autocomplete="new-password" minlength="10" required autofocus></label>
+          <label>#{h.call("auth.passwordAgain")}<input type="password" name="again" autocomplete="new-password" minlength="10" required></label>
+          <button type="submit">#{h.call("auth.join")}</button>
           </form>
-          <p class="hint">Use at least ten characters.</p>
+          <p class="hint">#{h.call("auth.passwordHint")}</p>
         HTML
       end
 
-      def invite_gone_page(base)
-        page(base, "This invite no longer works", <<~HTML.chomp)
-          <h1>This invite no longer works</h1>
-          <p>It has expired or was already used. Ask whoever invited you to send a new one.</p>
+      def invite_gone_page(base, lang = "en")
+        translator = Messages.translator(lang)
+        h = translator["html"]
+        page(base, lang, translator["t"].call("auth.inviteGoneTitle"), <<~HTML.chomp)
+          <h1>#{h.call("auth.inviteGoneTitle")}</h1>
+          <p>#{h.call("auth.inviteGone")}</p>
         HTML
       end
 
       # opts: "code", and optionally "error", "email", and "askCode".
-      def setup_page(base, opts)
+      def setup_page(base, opts, lang = "en")
         b = esc(base)
+        translator = Messages.translator(lang)
+        h = translator["html"]
         code = esc(opts["code"])
         field = if Js.truthy?(opts["askCode"])
-                  "<label>Your RUNLIGHT_TOKEN<input type=\"password\" name=\"code\" autocomplete=\"off\" required value=\"#{code}\"></label>"
+                  "<label>#{h.call("auth.setupToken")}<input type=\"password\" name=\"code\" autocomplete=\"off\" required value=\"#{code}\"></label>"
                 else
                   "<input type=\"hidden\" name=\"code\" value=\"#{code}\">"
                 end
-        page(base, "Create your account", <<~HTML.chomp)
-          <h1>Create your account</h1>
-          <p>This account owns the dashboard. You can invite more people later in Settings, Team Members.</p>
+        page(base, lang, translator["t"].call("auth.setupTitle"), <<~HTML.chomp)
+          <h1>#{h.call("auth.setupTitle")}</h1>
+          <p>#{h.call("auth.setupIntro")}</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/setup">
           #{field}
-          <label>Email<input type="email" name="email" autocomplete="username" required autofocus value="#{esc(opts["email"] || "")}"></label>
-          <label>Password<input type="password" name="password" autocomplete="new-password" minlength="10" required></label>
-          <label>Password again<input type="password" name="again" autocomplete="new-password" minlength="10" required></label>
-          <button type="submit">Create account</button>
+          <label>#{h.call("auth.email")}<input type="email" name="email" autocomplete="username" required autofocus value="#{esc(opts["email"] || "")}"></label>
+          <label>#{h.call("auth.password")}<input type="password" name="password" autocomplete="new-password" minlength="10" required></label>
+          <label>#{h.call("auth.passwordAgain")}<input type="password" name="again" autocomplete="new-password" minlength="10" required></label>
+          <button type="submit">#{h.call("auth.createAccount")}</button>
           </form>
-          <p class="hint">Use at least ten characters.</p>
+          <p class="hint">#{h.call("auth.passwordHint")}</p>
         HTML
       end
 
-      # For a server with no account yet, which prints a setup link with a one-time code in its log.
-      def setup_locked_page(base, where = nil)
-        where ||= "printed in the server's log when it started"
-        page(base, "Finish setting up", <<~HTML.chomp)
-          <h1>Finish setting up</h1>
-          <p>Runlight has no account yet. Open the setup link #{where}, which carries a one-time code, to create the first account.</p>
+      # For a server with no account yet, which prints a setup link with a one-time code in its log. `file` says the
+      # standalone server keeps it in setup.txt in its data folder instead.
+      def setup_locked_page(base, file = false, lang = "en")
+        translator = Messages.translator(lang)
+        h = translator["html"]
+        text = file ? h.call("auth.setupLockedFile", { "command" => "<code>runlight setup</code>" }) : h.call("auth.setupLocked")
+        page(base, lang, translator["t"].call("auth.finishTitle"), <<~HTML.chomp)
+          <h1>#{h.call("auth.finishTitle")}</h1>
+          <p>#{text}</p>
         HTML
       end
 
       # For an app with accounts on but nothing to prove the first account with.
-      def setup_needs_token_page(base)
-        page(base, "Finish setting up", <<~HTML.chomp)
-          <h1>Finish setting up</h1>
-          <p>Runlight has no account yet. Set RUNLIGHT_TOKEN, or pass token to routes(), and open this page again. Creating the first account asks for it, so only whoever runs the app can.</p>
+      def setup_needs_token_page(base, lang = "en")
+        translator = Messages.translator(lang)
+        h = translator["html"]
+        page(base, lang, translator["t"].call("auth.finishTitle"), <<~HTML.chomp)
+          <h1>#{h.call("auth.finishTitle")}</h1>
+          <p>#{h.call("auth.setupNeedsToken")}</p>
         HTML
       end
 
       private_class_method :esc, :icon, :page, :error
+      AUTH_JS = auth_js("en")
     end
   end
 end