@flowdular/sdk 0.1.0

package/modules/sandbox/src/services/sandbox-service.ts

@@ -0,0 +1,533 @@
+import { randomUUID } from 'node:crypto';
+import {
+	SANDBOX_GRANT_CAPABILITIES,
+	SANDBOX_PERMISSIONS,
+} from '../acl/permissions.ts';
+import {
+	SANDBOX_SESSION_STATES,
+	type SandboxAccessCandidate,
+	type SandboxAccessGrant,
+	type SandboxAuditChainVerification,
+	type SandboxAuditEvent,
+	type SandboxAuditPage,
+	type SandboxAuthority,
+	type SandboxGrantCapability,
+	type SandboxRuntimeMode,
+	type SandboxSessionRecord,
+	type SandboxSessionState,
+} from '../domain/types.ts';
+import type { SandboxDirectory } from './directory.ts';
+import type { SandboxRepository } from './repository.ts';
+import { SandboxServiceError } from './sandbox-service-error.ts';
+
+const MAX_GRANT_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
+const MAX_NOTE_LENGTH = 280;
+const SESSION_LIST_LIMIT = 200;
+const DEFAULT_AUDIT_PAGE = 50;
+const MAX_AUDIT_PAGE = 200;
+
+/* `occurredAt:sequence` of the last row of the previous page. Both halves are
+   non-negative integers; anything else is a client error, never a silent
+   first-page fallback. */
+function auditCursor(
+	raw: string | null,
+): { readonly occurredAt: number; readonly sequence: number } | null {
+	if (raw === null || raw === '') return null;
+	const match = /^(\d+):(\d+)$/.exec(raw);
+	const occurredAt = match ? Number(match[1]) : NaN;
+	const sequence = match ? Number(match[2]) : NaN;
+	if (!Number.isSafeInteger(occurredAt) || !Number.isSafeInteger(sequence)) {
+		throw new SandboxServiceError(
+			'INVALID_CURSOR',
+			'cursor is malformed.',
+			400,
+		);
+	}
+	return { occurredAt, sequence };
+}
+
+export interface GrantSandboxAccessInput {
+	readonly tenantId: string;
+	readonly actorId: string;
+	readonly accountId: string;
+	readonly capabilities?: readonly string[] | undefined;
+	readonly expiresAt?: number | null | undefined;
+	readonly note?: string | null | undefined;
+}
+
+export interface RegisterSandboxSessionInput {
+	readonly tenantId: string;
+	readonly accountId: string;
+	readonly sessionId: string;
+	readonly moduleId: string;
+	readonly title: string;
+	readonly blueprint: string;
+	readonly driver: string;
+	readonly mode: SandboxRuntimeMode;
+}
+
+export interface SandboxServiceOptions {
+	readonly now?: () => number;
+}
+
+function identifier(value: string, field: string): string {
+	const normalized = value.trim();
+	if (normalized.length < 1 || normalized.length > 128) {
+		throw new SandboxServiceError(
+			'INVALID_INPUT',
+			`${field} must contain between 1 and 128 characters.`,
+			400,
+		);
+	}
+	return normalized;
+}
+
+function moduleIdentifier(value: string): string {
+	const normalized = value.trim();
+	if (!/^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$/.test(normalized)) {
+		throw new SandboxServiceError(
+			'INVALID_MODULE_ID',
+			'Module id must use lowercase dot-separated segments.',
+			400,
+		);
+	}
+	return normalized;
+}
+
+function boundedText(
+	value: string,
+	field: string,
+	minimum: number,
+	maximum: number,
+): string {
+	const normalized = value.trim();
+	if (normalized.length < minimum || normalized.length > maximum) {
+		throw new SandboxServiceError(
+			'INVALID_INPUT',
+			`${field} must contain between ${minimum} and ${maximum} characters.`,
+			400,
+		);
+	}
+	return normalized;
+}
+
+function sessionState(value: string): SandboxSessionState {
+	if (!(SANDBOX_SESSION_STATES as readonly string[]).includes(value)) {
+		throw new SandboxServiceError(
+			'INVALID_SESSION_STATE',
+			`${value} is not a sandbox session state.`,
+			400,
+		);
+	}
+	return value as SandboxSessionState;
+}
+
+function isGrantCapability(value: string): value is SandboxGrantCapability {
+	return (SANDBOX_GRANT_CAPABILITIES as readonly string[]).includes(value);
+}
+
+function sandboxCapabilitiesOf(
+	scopes: readonly string[],
+): readonly SandboxGrantCapability[] {
+	const held = new Set(scopes);
+	return SANDBOX_GRANT_CAPABILITIES.filter((capability) =>
+		held.has(capability),
+	) as readonly SandboxGrantCapability[];
+}
+
+export class SandboxService {
+	readonly #now: () => number;
+
+	constructor(
+		private readonly repository: SandboxRepository,
+		private readonly directory: SandboxDirectory,
+		options: SandboxServiceOptions = {},
+	) {
+		this.#now = options.now ?? Date.now;
+	}
+
+	async listCandidates(
+		tenantId: string,
+	): Promise<readonly SandboxAccessCandidate[]> {
+		const tenant = identifier(tenantId, 'tenantId');
+		const members = await this.directory.listMembers(tenant);
+		return await Promise.all(
+			members.map(async (member) => ({
+				accountId: member.accountId,
+				email: member.email,
+				displayName: member.displayName,
+				role: member.role,
+				status: member.status,
+				availableCapabilities: sandboxCapabilitiesOf(
+					await this.directory.listScopes(member.accountId, tenant),
+				),
+			})),
+		);
+	}
+
+	async listGrants(tenantId: string): Promise<readonly SandboxAccessGrant[]> {
+		return await this.repository.listGrants(identifier(tenantId, 'tenantId'));
+	}
+
+	async grant(input: GrantSandboxAccessInput): Promise<SandboxAccessGrant> {
+		const tenantId = identifier(input.tenantId, 'tenantId');
+		const actorId = identifier(input.actorId, 'actorId');
+		const accountId = identifier(input.accountId, 'accountId');
+		const member = (await this.directory.listMembers(tenantId)).find(
+			(candidate) => candidate.accountId === accountId,
+		);
+		if (!member) {
+			throw new SandboxServiceError(
+				'ACCOUNT_NOT_FOUND',
+				'The account is not a member of this tenant.',
+				404,
+			);
+		}
+		if (member.status !== 'active') {
+			throw new SandboxServiceError(
+				'ACCOUNT_DISABLED',
+				'A disabled account cannot receive sandbox access.',
+				409,
+			);
+		}
+		const available = new Set(
+			sandboxCapabilitiesOf(
+				await this.directory.listScopes(accountId, tenantId),
+			),
+		);
+		const requested = input.capabilities ?? [...available];
+		for (const capability of requested) {
+			if (!isGrantCapability(capability)) {
+				throw new SandboxServiceError(
+					'UNKNOWN_CAPABILITY',
+					`Capability ${capability} is not a sandbox grant capability.`,
+					400,
+				);
+			}
+		}
+		const capabilities = SANDBOX_GRANT_CAPABILITIES.filter(
+			(capability) =>
+				available.has(capability) &&
+				(requested as readonly string[]).includes(capability),
+		) as readonly SandboxGrantCapability[];
+		if (!capabilities.includes(SANDBOX_PERMISSIONS.use)) {
+			throw new SandboxServiceError(
+				'ACCESS_CAPABILITY_REQUIRED',
+				'A sandbox grant must include sandbox.access.use, and the account must hold that scope.',
+				409,
+			);
+		}
+		const grantedAt = this.#now();
+		const expiresAt = this.#expiry(input.expiresAt ?? null, grantedAt);
+		const note =
+			input.note === undefined || input.note === null || input.note === ''
+				? null
+				: boundedText(input.note, 'note', 1, MAX_NOTE_LENGTH);
+		const existing = await this.repository.findGrant(tenantId, accountId);
+		const saved = await this.repository.saveGrant({
+			id: existing?.id ?? randomUUID(),
+			tenantId,
+			accountId,
+			email: member.email,
+			displayName: member.displayName,
+			capabilities,
+			note,
+			grantedBy: actorId,
+			grantedAt,
+			expiresAt,
+			revokedAt: null,
+			revokedBy: null,
+		});
+		await this.repository.appendAuditEvent({
+			tenantId,
+			actorId,
+			action: 'sandbox.access.granted',
+			subjectType: 'grant',
+			subjectId: saved.id,
+			metadata: {
+				accountId,
+				capabilities: capabilities.join(' '),
+				expiresAt: expiresAt ?? 0,
+				renewed: existing !== null,
+			},
+			occurredAt: grantedAt,
+		});
+		return saved;
+	}
+
+	async revoke(
+		tenantId: string,
+		accountId: string,
+		actorId: string,
+	): Promise<SandboxAccessGrant> {
+		const tenant = identifier(tenantId, 'tenantId');
+		const account = identifier(accountId, 'accountId');
+		const actor = identifier(actorId, 'actorId');
+		const existing = await this.repository.findGrant(tenant, account);
+		if (!existing) {
+			throw new SandboxServiceError(
+				'GRANT_NOT_FOUND',
+				'No sandbox grant exists for this account.',
+				404,
+			);
+		}
+		if (existing.revokedAt !== null) return existing;
+		const revokedAt = this.#now();
+		const revoked = (await this.repository.revokeGrant(
+			tenant,
+			account,
+			revokedAt,
+			actor,
+		))!;
+		await this.repository.appendAuditEvent({
+			tenantId: tenant,
+			actorId: actor,
+			action: 'sandbox.access.revoked',
+			subjectType: 'grant',
+			subjectId: revoked.id,
+			metadata: { accountId: account },
+			occurredAt: revokedAt,
+		});
+		return revoked;
+	}
+
+	/* Live platform scopes always win. A grant can narrow authority and can
+	   never widen it beyond the scopes the membership holds right now. */
+	async authorize(
+		tenantId: string,
+		accountId: string,
+		scopes: readonly string[],
+	): Promise<SandboxAuthority> {
+		const tenant = identifier(tenantId, 'tenantId');
+		const account = identifier(accountId, 'accountId');
+		const grant = await this.repository.findGrant(tenant, account);
+		if (!grant) return { granted: false, reason: 'grant-missing' };
+		if (grant.revokedAt !== null) {
+			return { granted: false, reason: 'grant-revoked' };
+		}
+		if (grant.expiresAt !== null && grant.expiresAt <= this.#now()) {
+			return { granted: false, reason: 'grant-expired' };
+		}
+		const held = new Set(scopes);
+		const capabilities = grant.capabilities.filter((capability) =>
+			held.has(capability),
+		);
+		if (!capabilities.includes(SANDBOX_PERMISSIONS.use)) {
+			return { granted: false, reason: 'scope-missing' };
+		}
+		return {
+			granted: true,
+			grantId: grant.id,
+			tenantId: tenant,
+			accountId: account,
+			capabilities,
+			expiresAt: grant.expiresAt,
+		};
+	}
+
+	async registerSession(
+		input: RegisterSandboxSessionInput,
+	): Promise<SandboxSessionRecord> {
+		const tenantId = identifier(input.tenantId, 'tenantId');
+		const accountId = identifier(input.accountId, 'accountId');
+		const id = identifier(input.sessionId, 'sessionId');
+		const now = this.#now();
+		const existing = await this.repository.findSession(tenantId, id);
+		const session = await this.repository.saveSession({
+			id,
+			tenantId,
+			accountId,
+			moduleId: moduleIdentifier(input.moduleId),
+			title: boundedText(input.title, 'title', 2, 120),
+			blueprint: boundedText(input.blueprint, 'blueprint', 2, 120),
+			driver: boundedText(input.driver, 'driver', 2, 64),
+			mode: input.mode,
+			state: existing?.state ?? 'draft',
+			createdAt: existing?.createdAt ?? now,
+			updatedAt: now,
+			ejectedAt: existing?.ejectedAt ?? null,
+			archivedAt: existing?.archivedAt ?? null,
+		});
+		await this.repository.appendAuditEvent({
+			tenantId,
+			actorId: accountId,
+			action: existing ? 'sandbox.session.updated' : 'sandbox.session.opened',
+			subjectType: 'session',
+			subjectId: session.id,
+			metadata: {
+				moduleId: session.moduleId,
+				driver: session.driver,
+				mode: session.mode,
+			},
+			occurredAt: now,
+		});
+		return session;
+	}
+
+	/* Archiving and deleting are transitions like any other, so the sandbox
+	   reports them through the same call; the audit action names them. A
+	   transition out of archived is a restore. */
+	async updateSessionState(
+		tenantId: string,
+		sessionId: string,
+		requested: SandboxSessionState,
+		actorId: string,
+	): Promise<SandboxSessionRecord> {
+		const tenant = identifier(tenantId, 'tenantId');
+		const id = identifier(sessionId, 'sessionId');
+		const actor = identifier(actorId, 'actorId');
+		const state = sessionState(requested);
+		const existing = await this.repository.findSession(tenant, id);
+		if (!existing) {
+			throw new SandboxServiceError(
+				'SESSION_NOT_FOUND',
+				'The sandbox session does not exist in this tenant.',
+				404,
+			);
+		}
+		if (existing.state === 'deleted') {
+			throw new SandboxServiceError(
+				'SESSION_DELETED',
+				'A deleted sandbox session cannot change state.',
+				409,
+			);
+		}
+		const now = this.#now();
+		const session = await this.repository.saveSession({
+			...existing,
+			state,
+			updatedAt: now,
+			ejectedAt:
+				state === 'accepted' ? (existing.ejectedAt ?? now) : existing.ejectedAt,
+			archivedAt: state === 'archived' ? (existing.archivedAt ?? now) : null,
+		});
+		await this.repository.appendAuditEvent({
+			tenantId: tenant,
+			actorId: actor,
+			action:
+				state === 'archived'
+					? 'sandbox.session.archived'
+					: state === 'deleted'
+						? 'sandbox.session.deleted'
+						: existing.state === 'archived'
+							? 'sandbox.session.restored'
+							: 'sandbox.session.state',
+			subjectType: 'session',
+			subjectId: session.id,
+			metadata: { from: existing.state, to: state },
+			occurredAt: now,
+		});
+		return session;
+	}
+
+	async archiveSession(
+		tenantId: string,
+		sessionId: string,
+		actorId: string,
+	): Promise<SandboxSessionRecord> {
+		return this.updateSessionState(tenantId, sessionId, 'archived', actorId);
+	}
+
+	async deleteSession(
+		tenantId: string,
+		sessionId: string,
+		actorId: string,
+	): Promise<SandboxSessionRecord> {
+		return this.updateSessionState(tenantId, sessionId, 'deleted', actorId);
+	}
+
+	async listSessions(
+		tenantId: string,
+		limit = SESSION_LIST_LIMIT,
+	): Promise<readonly SandboxSessionRecord[]> {
+		return await this.repository.listSessions(
+			identifier(tenantId, 'tenantId'),
+			Math.min(Math.max(limit, 1), SESSION_LIST_LIMIT),
+		);
+	}
+
+	async findSession(
+		tenantId: string,
+		sessionId: string,
+	): Promise<SandboxSessionRecord | null> {
+		return await this.repository.findSession(
+			identifier(tenantId, 'tenantId'),
+			identifier(sessionId, 'sessionId'),
+		);
+	}
+
+	async recordEject(
+		tenantId: string,
+		sessionId: string,
+		actorId: string,
+		metadata: Readonly<Record<string, string | number | boolean>>,
+	): Promise<SandboxAuditEvent> {
+		return await this.repository.appendAuditEvent({
+			tenantId: identifier(tenantId, 'tenantId'),
+			actorId: identifier(actorId, 'actorId'),
+			action: 'sandbox.module.ejected',
+			subjectType: 'module',
+			subjectId: identifier(sessionId, 'sessionId'),
+			metadata,
+			occurredAt: this.#now(),
+		});
+	}
+
+	async listAuditEvents(
+		tenantId: string,
+		limit = 100,
+	): Promise<readonly SandboxAuditEvent[]> {
+		return await this.repository.listAuditEvents(
+			identifier(tenantId, 'tenantId'),
+			Math.min(Math.max(limit, 1), 500),
+		);
+	}
+
+	async pageAuditEvents(
+		tenantId: string,
+		cursor: string | null,
+		limit = DEFAULT_AUDIT_PAGE,
+	): Promise<SandboxAuditPage> {
+		const size = Number.isSafeInteger(limit)
+			? Math.min(Math.max(1, Math.trunc(limit)), MAX_AUDIT_PAGE)
+			: DEFAULT_AUDIT_PAGE;
+		return await this.repository.pageAuditEvents(
+			identifier(tenantId, 'tenantId'),
+			auditCursor(cursor),
+			size,
+		);
+	}
+
+	async verifyAuditChain(tenantId: string): Promise<boolean> {
+		return await this.repository.verifyAuditChain(
+			identifier(tenantId, 'tenantId'),
+		);
+	}
+
+	async verifyAudit(tenantId: string): Promise<SandboxAuditChainVerification> {
+		return await this.repository.verifyAuditChainDetailed(
+			identifier(tenantId, 'tenantId'),
+		);
+	}
+
+	#expiry(value: number | null, now: number): number | null {
+		if (value === null) return null;
+		if (!Number.isSafeInteger(value) || value <= now) {
+			throw new SandboxServiceError(
+				'INVALID_EXPIRY',
+				'Grant expiry must be a future timestamp in milliseconds.',
+				400,
+			);
+		}
+		if (value - now > MAX_GRANT_LIFETIME_MS) {
+			throw new SandboxServiceError(
+				'EXPIRY_TOO_DISTANT',
+				'A sandbox grant cannot last longer than one year.',
+				400,
+			);
+		}
+		return value;
+	}
+}
+
+export { SandboxServiceError } from './sandbox-service-error.ts';

package/modules/sandbox/translations/en.json

@@ -0,0 +1,77 @@
+{
+	"module.name": "Sandbox Access",
+	"navigation.sandbox": "Sandbox",
+	"navigation.description": "Access and module sessions",
+	"access.title": "Sandbox",
+	"access.description": "Grant isolated module development access and follow the sessions it produces.",
+	"access.grant": "Grant access",
+	"access.revoke": "Revoke",
+	"access.empty": "No account has sandbox access in this workspace yet.",
+	"sessions.title": "Sessions",
+	"sessions.empty": "No sandbox session has been opened for this workspace.",
+	"page.eyebrow": "Development",
+	"action.refresh": "Refresh",
+	"action.open": "Open sandbox",
+	"action.cancel": "Cancel",
+	"action.saving": "Saving…",
+	"kpi.activeAccess": "Active access",
+	"kpi.activeAccessNote": "Accounts that can sign in to the sandbox right now.",
+	"kpi.sessionsNote": "Module sessions registered by the sandbox application.",
+	"kpi.address": "Sandbox address",
+	"kpi.configured": "Configured",
+	"kpi.unset": "Unset",
+	"kpi.startHint": "Start it with npx @flowdular/sandbox.",
+	"value.na": "n/a",
+	"access.listTitle": "Access",
+	"access.count": "{active} active · {total} granted",
+	"access.note": "A grant lets an account sign in to the sandbox with the listed capabilities. Workspace data stays behind the same permissions.",
+	"access.caption": "Sandbox access grants",
+	"access.emptyTitle": "No sandbox access granted",
+	"access.account": "Account",
+	"access.capabilities": "Capabilities",
+	"access.status": "Status",
+	"access.actions": "Actions",
+	"access.noExpiry": "No expiry",
+	"access.until": "Until {date}",
+	"sessions.caption": "Sandbox sessions",
+	"sessions.count": "{count} records, latest first",
+	"sessions.emptyTitle": "No sandbox sessions",
+	"sessions.session": "Session",
+	"sessions.state": "State",
+	"sessions.updated": "Updated",
+	"drawer.title": "Grant sandbox access",
+	"drawer.subtitle": "Owner-only, auditable, revocable",
+	"form.member": "Workspace member",
+	"form.memberHelp": "Only members that already hold sandbox scopes can be granted access.",
+	"form.selectMember": "Select a member",
+	"form.capabilities": "Capabilities",
+	"form.noCapabilities": "This member holds no sandbox scope. Change the membership role or grant the scope first.",
+	"form.requiredCapability": "sandbox.access.use is always required.",
+	"form.expiry": "Expires in days",
+	"form.expiryHelp": "Leave empty for no expiry.",
+	"form.note": "Note",
+	"form.footer": "Access is auditable and can be revoked at any time.",
+	"grantState.active": "Active",
+	"grantState.expired": "Expired",
+	"grantState.revoked": "Revoked",
+	"sessionState.draft": "Draft",
+	"sessionState.classified": "Classified",
+	"sessionState.planned": "Planned",
+	"sessionState.editing": "Editing",
+	"sessionState.validating": "Validating",
+	"sessionState.previewing": "Previewing",
+	"sessionState.awaiting-approval": "Awaiting approval",
+	"sessionState.accepted": "Accepted",
+	"sessionState.failed": "Failed",
+	"sessionState.blocked": "Blocked",
+	"sessionState.archived": "Archived",
+	"sessionState.deleted": "Deleted",
+	"capability.sandbox.access.use": "Use sandbox",
+	"capability.sandbox.sessions.read": "Read sessions",
+	"capability.sandbox.preview.data": "Use preview data",
+	"capability.sandbox.modules.eject": "Deliver modules",
+	"error.load": "Could not load sandbox access.",
+	"error.grant": "Could not grant sandbox access.",
+	"error.revoke": "Could not revoke sandbox access.",
+	"error.request": "The sandbox operation failed."
+}

package/modules/sandbox/translations/pl.json

@@ -0,0 +1,77 @@
+{
+	"module.name": "Dostęp do sandboxa",
+	"navigation.sandbox": "Sandbox",
+	"navigation.description": "Dostęp i sesje modułów",
+	"access.title": "Sandbox",
+	"access.description": "Przydziel dostęp do izolowanego budowania modułów i śledź powstające sesje.",
+	"access.grant": "Przydziel dostęp",
+	"access.revoke": "Odbierz",
+	"access.empty": "Żadne konto nie ma jeszcze dostępu do sandboxa w tej przestrzeni.",
+	"sessions.title": "Sesje",
+	"sessions.empty": "Nie otwarto jeszcze żadnej sesji sandboxa dla tej przestrzeni.",
+	"page.eyebrow": "Rozwój",
+	"action.refresh": "Odśwież",
+	"action.open": "Otwórz sandbox",
+	"action.cancel": "Anuluj",
+	"action.saving": "Zapisywanie…",
+	"kpi.activeAccess": "Aktywny dostęp",
+	"kpi.activeAccessNote": "Konta, które mogą teraz zalogować się do sandboxa.",
+	"kpi.sessionsNote": "Sesje modułów zarejestrowane przez aplikację sandboxa.",
+	"kpi.address": "Adres sandboxa",
+	"kpi.configured": "Skonfigurowany",
+	"kpi.unset": "Nie ustawiono",
+	"kpi.startHint": "Uruchom poleceniem npx @flowdular/sandbox.",
+	"value.na": "nie dotyczy",
+	"access.listTitle": "Dostęp",
+	"access.count": "Aktywne: {active} · przydzielone: {total}",
+	"access.note": "Przydział pozwala kontu zalogować się do sandboxa z podanymi możliwościami. Dane przestrzeni roboczej pozostają chronione tymi samymi uprawnieniami.",
+	"access.caption": "Przydziały dostępu do sandboxa",
+	"access.emptyTitle": "Brak przydzielonego dostępu",
+	"access.account": "Konto",
+	"access.capabilities": "Możliwości",
+	"access.status": "Status",
+	"access.actions": "Akcje",
+	"access.noExpiry": "Bez terminu ważności",
+	"access.until": "Do {date}",
+	"sessions.caption": "Sesje sandboxa",
+	"sessions.count": "Liczba rekordów: {count}, najnowsze pierwsze",
+	"sessions.emptyTitle": "Brak sesji sandboxa",
+	"sessions.session": "Sesja",
+	"sessions.state": "Stan",
+	"sessions.updated": "Aktualizacja",
+	"drawer.title": "Przydziel dostęp do sandboxa",
+	"drawer.subtitle": "Tylko dla właściciela, audytowalny i odwoływalny",
+	"form.member": "Członek przestrzeni roboczej",
+	"form.memberHelp": "Dostęp można przydzielić tylko członkom, którzy mają już zakresy sandboxa.",
+	"form.selectMember": "Wybierz członka",
+	"form.capabilities": "Możliwości",
+	"form.noCapabilities": "Ten członek nie ma żadnego zakresu sandboxa. Najpierw zmień jego rolę lub przydziel odpowiedni zakres.",
+	"form.requiredCapability": "sandbox.access.use jest zawsze wymagane.",
+	"form.expiry": "Wygasa za liczbę dni",
+	"form.expiryHelp": "Pozostaw puste, aby dostęp nie wygasał.",
+	"form.note": "Notatka",
+	"form.footer": "Dostęp podlega audytowi i można go odebrać w dowolnym momencie.",
+	"grantState.active": "Aktywny",
+	"grantState.expired": "Wygasł",
+	"grantState.revoked": "Odebrany",
+	"sessionState.draft": "Wersja robocza",
+	"sessionState.classified": "Sklasyfikowana",
+	"sessionState.planned": "Zaplanowana",
+	"sessionState.editing": "Edycja",
+	"sessionState.validating": "Walidacja",
+	"sessionState.previewing": "Podgląd",
+	"sessionState.awaiting-approval": "Oczekuje na zatwierdzenie",
+	"sessionState.accepted": "Zaakceptowana",
+	"sessionState.failed": "Nieudana",
+	"sessionState.blocked": "Zablokowana",
+	"sessionState.archived": "Zarchiwizowana",
+	"sessionState.deleted": "Usunięta",
+	"capability.sandbox.access.use": "Korzystanie z sandboxa",
+	"capability.sandbox.sessions.read": "Odczyt sesji",
+	"capability.sandbox.preview.data": "Dane podglądu",
+	"capability.sandbox.modules.eject": "Dostarczanie modułów",
+	"error.load": "Nie udało się wczytać dostępu do sandboxa.",
+	"error.grant": "Nie udało się przydzielić dostępu do sandboxa.",
+	"error.revoke": "Nie udało się odebrać dostępu do sandboxa.",
+	"error.request": "Operacja sandboxa nie powiodła się."
+}