@flowdular/sdk 0.2.3 → 0.3.0

package/modules/users/src/services/member-import.ts

@@ -0,0 +1,249 @@
+import type { AuthPrincipal, TenantMember } from '@flowdular/sdk/modules/auth';
+import type { AuthRuntime } from '@flowdular/sdk/modules/auth/server';
+import {
+	AuthServiceError,
+	TENANT_MEMBER_LOOKUP_LIMIT,
+} from '@flowdular/sdk/modules/auth/server';
+import type {
+	ImportPort,
+	ImportRow,
+	ImportValidateInput,
+	ImportValidation,
+	ImportWriteInput,
+	ImportWriteOutcome,
+} from '@flowdular/sdk/modules/import';
+import { USER_PERMISSIONS } from '../acl/permissions.ts';
+import { UsersService } from './users-service.ts';
+
+/** The port key; import.core composes the target id `users.core.members`. */
+export const MEMBER_IMPORT_PORT_KEY = 'members';
+
+/** A row that names no role joins on the least privileged built-in role. */
+export const MEMBER_IMPORT_DEFAULT_ROLE = 'member';
+
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+/* The address rule auth.core applies, so the natural key this port looks up is
+   the same string auth.core stored. */
+function address(value: string | undefined): string {
+	return (value ?? '').trim().normalize('NFKC').toLowerCase();
+}
+
+function text(value: string | undefined): string | undefined {
+	const trimmed = value?.trim();
+	return trimmed === undefined || trimmed === '' ? undefined : trimmed;
+}
+
+function refusal(row: number, field: string, reason: string): ImportValidation {
+	return { row, verdict: 'invalid', field, reason };
+}
+
+/**
+ * Refusals only, as the port contract asks: a row this says nothing about is
+ * taken as valid. Whether a member already exists is not one of them, because
+ * the job's mode decides what an existing member means, and that is read at
+ * write time.
+ */
+async function validateRows(
+	auth: AuthRuntime,
+	{ tenantId, rows }: ImportValidateInput,
+): Promise<readonly ImportValidation[]> {
+	const roles = new Set(
+		(await (await auth.service()).listRoles(tenantId)).map((role) => role.key),
+	);
+	const refusals: ImportValidation[] = [];
+	const seen = new Set<string>();
+	for (const entry of rows) {
+		const email = address(entry.values.email);
+		if (email.length > 254 || !EMAIL.test(email)) {
+			refusals.push(refusal(entry.row, 'email', 'EMAIL_INVALID'));
+			continue;
+		}
+		const displayName = text(entry.values.displayName);
+		if (
+			displayName === undefined ||
+			displayName.length < 2 ||
+			displayName.length > 80
+		) {
+			refusals.push(refusal(entry.row, 'displayName', 'DISPLAY_NAME_INVALID'));
+			continue;
+		}
+		const role = text(entry.values.role);
+		if (role !== undefined && !roles.has(role)) {
+			refusals.push(refusal(entry.row, 'role', 'ROLE_UNKNOWN'));
+			continue;
+		}
+		/* The first row carrying an address is the one that writes it, so a
+		   repeat further down the file would write over this import's own row.
+		   A repeat in a later batch meets the natural key at write instead. */
+		if (seen.has(email)) {
+			refusals.push(refusal(entry.row, 'email', 'EMAIL_DUPLICATE'));
+			continue;
+		}
+		seen.add(email);
+	}
+	return refusals;
+}
+
+/* No credential at all: auth.core stores its unusable marker, so nothing has to
+   be drawn, kept, or thrown away here. The member reaches the workspace through
+   the public reset flow or an administrative temporary password. */
+async function createMember(
+	users: UsersService,
+	principal: AuthPrincipal,
+	entry: ImportRow,
+	email: string,
+): Promise<ImportWriteOutcome> {
+	const created = await users.createWithoutPassword(principal, {
+		email,
+		displayName: text(entry.values.displayName) ?? '',
+		role: text(entry.values.role) ?? MEMBER_IMPORT_DEFAULT_ROLE,
+	});
+	return { row: entry.row, outcome: 'created', recordRef: created.accountId };
+}
+
+async function applyExisting(
+	users: UsersService,
+	principal: AuthPrincipal,
+	entry: ImportRow,
+	member: TenantMember,
+	mode: ImportWriteInput['mode'],
+): Promise<ImportWriteOutcome> {
+	if (mode === 'create-only') {
+		return { row: entry.row, outcome: 'failed', reason: 'ALREADY_EXISTS' };
+	}
+	if (mode === 'skip-existing') {
+		return { row: entry.row, outcome: 'skipped', recordRef: member.accountId };
+	}
+	/* There is no transaction across the two writes, so the display name goes
+	   first: it is the bounded one, refused only for its own shape, while the
+	   role meets the owner cap, the acting principal and the assignable set. A
+	   value the member already holds is not written at all, so a repeat leaves
+	   no audit event for a change that did not happen. */
+	const displayName = text(entry.values.displayName);
+	let renamed = false;
+	if (displayName !== undefined && displayName !== member.displayName) {
+		await users.rename(principal, member.accountId, displayName);
+		renamed = true;
+	}
+	const role = text(entry.values.role);
+	if (role !== undefined && role !== member.role) {
+		try {
+			await users.assignRole(principal, member.accountId, role);
+		} catch (error) {
+			/* The rename already landed. Failing the whole row here would report a
+			   change that did happen as one that did not, so the row is updated and
+			   names what the role write met. */
+			if (!renamed) throw error;
+			return {
+				row: entry.row,
+				outcome: 'updated',
+				recordRef: member.accountId,
+				reason: `ROLE_UNCHANGED:${
+					error instanceof AuthServiceError ? error.code : 'WRITE_FAILED'
+				}`,
+			};
+		}
+	}
+	return { row: entry.row, outcome: 'updated', recordRef: member.accountId };
+}
+
+/**
+ * The batch's natural keys, resolved by the addresses the batch names rather
+ * than by listing the workspace: the cost is the rows the file asks about, not
+ * the workspace's member count. auth.core bounds one lookup, and an import
+ * batch is a setting a deployment raises, so the addresses are split into
+ * chunks of that bound.
+ */
+async function existingMembers(
+	auth: AuthRuntime,
+	tenantId: string,
+	addresses: readonly string[],
+): Promise<Map<string, TenantMember>> {
+	const service = await auth.service();
+	const found = new Map<string, TenantMember>();
+	const wanted = [...new Set(addresses)];
+	for (
+		let start = 0;
+		start < wanted.length;
+		start += TENANT_MEMBER_LOOKUP_LIMIT
+	) {
+		for (const member of await service.findTenantMembersByEmail(
+			tenantId,
+			wanted.slice(start, start + TENANT_MEMBER_LOOKUP_LIMIT),
+		)) {
+			found.set(address(member.email), member);
+		}
+	}
+	return found;
+}
+
+/**
+ * One outcome per row. The read names the job's workspace while every write
+ * pins the tenant to the principal, so a disagreement between the two fails the
+ * row in auth.core instead of reaching another workspace.
+ */
+async function writeRows(
+	auth: AuthRuntime,
+	users: UsersService,
+	{ tenantId, principal, rows, mode }: ImportWriteInput,
+): Promise<readonly ImportWriteOutcome[]> {
+	const existing = await existingMembers(
+		auth,
+		tenantId,
+		rows.map((entry) => address(entry.values.email)).filter(Boolean),
+	);
+	const outcomes: ImportWriteOutcome[] = [];
+	for (const entry of rows) {
+		const email = address(entry.values.email);
+		const member = existing.get(email);
+		try {
+			outcomes.push(
+				member === undefined
+					? await createMember(users, principal, entry, email)
+					: await applyExisting(users, principal, entry, member, mode),
+			);
+		} catch (error) {
+			/* One row never fails the batch, and only the stable code is reported:
+			   an auth.core message can name the member it refused. */
+			outcomes.push({
+				row: entry.row,
+				outcome: 'failed',
+				reason: error instanceof AuthServiceError ? error.code : 'WRITE_FAILED',
+			});
+		}
+	}
+	return outcomes;
+}
+
+/**
+ * The workspace's members as an import target. Every read and write goes
+ * through the auth administration port with the principal that started the job
+ * as the actor, so the owner cap, the last-owner rule and the audit trail hold
+ * for an imported row exactly as they do for the Users screen.
+ */
+export function createMemberImportPort(auth: AuthRuntime): ImportPort {
+	const users = new UsersService(auth);
+	return {
+		key: MEMBER_IMPORT_PORT_KEY,
+		label: 'Members',
+		permission: USER_PERMISSIONS.manage,
+		fields: [
+			{ id: 'email', label: 'Email', required: true, type: 'email' },
+			{
+				id: 'displayName',
+				label: 'Display name',
+				required: true,
+				type: 'string',
+			},
+			{ id: 'role', label: 'Role', required: false, type: 'string' },
+		],
+		naturalKey: ['email'],
+		/* The address rule auth.core stores under, so two rows naming one member
+		   in different case are one natural key for the whole file, not only
+		   inside the batch the port happens to see them in. */
+		naturalKeyOf: (values) => address(values.email),
+		validate: (input) => validateRows(auth, input),
+		write: (input) => writeRows(auth, users, input),
+	};
+}

package/modules/users/src/services/member-search.ts

@@ -0,0 +1,145 @@
+import type { TenantMember } from '@flowdular/sdk/modules/auth';
+import type { AuthRuntime } from '@flowdular/sdk/modules/auth/server';
+import type {
+	SearchHit,
+	SearchProvider,
+	SearchProviderPage,
+	SearchProviderQuery,
+} from '@flowdular/sdk/modules/search';
+import { USER_PERMISSIONS } from '../acl/permissions.ts';
+
+export const MEMBER_SEARCH_PROVIDER_KEY = 'users.members';
+
+/**
+ * Members one query may read. auth.core applies both the predicate and this
+ * limit in SQL, so the read is the matching rows rather than the workspace.
+ * Ranking and the multi-term rule still run here, over that bounded set.
+ */
+export const MEMBER_SEARCH_SCAN_LIMIT = 500;
+
+/**
+ * Terms of one query the provider may push down. auth.core matches a prefix,
+ * so a term that opens no name and no address answers nothing and the next one
+ * has to be asked for; the cap keeps a long query to a bounded number of reads
+ * of at most `MEMBER_SEARCH_SCAN_LIMIT` rows each, at the price of not finding
+ * a member only the fourth term or later opens.
+ */
+export const MEMBER_SEARCH_PUSHDOWN_LIMIT = 3;
+
+/** The view a hit opens, as the users client contribution registers it. */
+const MEMBER_VIEW_ID = 'users';
+
+function aborted(signal: AbortSignal | undefined): boolean {
+	return signal?.aborted === true;
+}
+
+/**
+ * The terms the query names, in the order they were typed. A query of only
+ * whitespace names none and reads nothing.
+ */
+function searchTerms(query: string): readonly string[] {
+	return query.split(' ').filter((term) => term.length > 0);
+}
+
+/**
+ * How well one member answers the query. Only compared against other members,
+ * so the scale is this provider's own: an exact address beats a name that
+ * starts with the term, which beats a term found anywhere.
+ */
+export function memberScore(member: TenantMember, term: string): number {
+	const name = member.displayName.toLowerCase();
+	const email = member.email.toLowerCase();
+	if (email === term) return 1;
+	if (name === term) return 0.9;
+	if (name.startsWith(term)) return 0.8;
+	if (email.startsWith(term)) return 0.7;
+	if (name.includes(term)) return 0.5;
+	if (email.includes(term)) return 0.4;
+	return 0;
+}
+
+/** Every term has to land somewhere, so "ada lovelace" does not match "ada". */
+export function matchMembers(
+	members: readonly TenantMember[],
+	query: string,
+): readonly { readonly member: TenantMember; readonly score: number }[] {
+	const terms = query.toLowerCase().split(' ').filter(Boolean);
+	if (terms.length === 0) return [];
+	const matched: { member: TenantMember; score: number }[] = [];
+	for (const member of members) {
+		let best = 0;
+		let all = true;
+		for (const term of terms) {
+			const score = memberScore(member, term);
+			if (score === 0) {
+				all = false;
+				break;
+			}
+			if (score > best) best = score;
+		}
+		if (all) matched.push({ member, score: best });
+	}
+	matched.sort(
+		(left, right) =>
+			right.score - left.score ||
+			left.member.displayName.localeCompare(right.member.displayName) ||
+			left.member.accountId.localeCompare(right.member.accountId),
+	);
+	return matched;
+}
+
+function toHit(member: TenantMember, score: number): SearchHit {
+	return {
+		ref: member.accountId,
+		title: member.displayName,
+		snippet: member.email,
+		viewId: MEMBER_VIEW_ID,
+		route: '/users?member=' + encodeURIComponent(member.accountId),
+		score,
+	};
+}
+
+/**
+ * The workspace's members as a search provider. Every read goes through the
+ * auth administration port with the tenant of the principal search.core
+ * resolved, so this module still opens no table of another one.
+ */
+export function createMemberSearchProvider(auth: AuthRuntime): SearchProvider {
+	return {
+		key: MEMBER_SEARCH_PROVIDER_KEY,
+		label: 'Members',
+		permission: USER_PERMISSIONS.read,
+		async search(input: SearchProviderQuery): Promise<SearchProviderPage> {
+			if (aborted(input.signal)) return { hits: [], nextCursor: null };
+			const terms = searchTerms(input.query);
+			if (terms.length === 0) return { hits: [], nextCursor: null };
+			const service = await auth.service();
+			const pushdowns = Math.min(terms.length, MEMBER_SEARCH_PUSHDOWN_LIMIT);
+			/* The port matches a prefix, so the term typed first is not
+			   necessarily the one that opens the member: "lovelace ada" has to
+			   fall through to "ada" to reach Ada Lovelace. Each term is pushed
+			   in turn until one answers rows, and `matchMembers` still requires
+			   every term over what came back. */
+			let members: readonly TenantMember[] = [];
+			for (let index = 0; index < pushdowns; index += 1) {
+				members = await service.searchTenantMembers(input.tenantId, {
+					query: terms[index]!,
+					limit: MEMBER_SEARCH_SCAN_LIMIT,
+				});
+				if (members.length > 0) break;
+				if (aborted(input.signal)) return { hits: [], nextCursor: null };
+			}
+			if (aborted(input.signal)) return { hits: [], nextCursor: null };
+			const matched = matchMembers(members, input.query);
+			const offset = Number(input.cursor ?? '0');
+			const start =
+				Number.isSafeInteger(offset) && offset >= 0 ? offset : matched.length;
+			const page = matched.slice(start, start + input.limit);
+			const next = start + page.length;
+			return {
+				hits: page.map((entry) => toHit(entry.member, entry.score)),
+				nextCursor: next < matched.length ? String(next) : null,
+			};
+		},
+	};
+}

package/modules/users/src/services/users-service.ts

@@ -2,10 +2,15 @@ import type {
 	AuthActor,
 	AuthPrincipal,
 	CreateTenantMemberInput,
+	CreateTenantMemberWithoutPasswordInput,
 	TenantMember,
+	TenantMemberKeyset,
+	TenantMemberSort,
+	TenantMemberSortedPage,
 	TenantRole,
 } from '@flowdular/sdk/modules/auth';
 import type { AuthRuntime } from '@flowdular/sdk/modules/auth/server';
+import { AuthServiceError } from '@flowdular/sdk/modules/auth/server';
 
 export interface CreateUserInput {
 	readonly email: string;
@@ -14,8 +19,30 @@ export interface CreateUserInput {
 	readonly role: string;
 }
 
-export interface UserDirectory {
-	readonly users: readonly TenantMember[];
+export type MemberStatusFilter = 'active' | 'disabled' | null;
+
+export interface MemberListInput {
+	readonly sort: TenantMemberSort;
+	readonly direction: 'asc' | 'desc';
+	readonly limit: number;
+	/** A prefix of the display name or the address; empty narrows nothing. */
+	readonly query: string;
+	readonly status: MemberStatusFilter;
+	readonly after: TenantMemberKeyset | null;
+}
+
+/** Ids one bulk member action may name. */
+export const MEMBER_BULK_LIMIT = 100;
+
+export interface MemberBulkOutcome {
+	readonly accountId: string;
+	readonly outcome: 'updated' | 'not-found' | 'refused';
+	/** The stable auth.core code behind a refusal. */
+	readonly reason?: string;
+}
+
+/** What the Members screen needs beside the page it shows. */
+export interface UsersContext {
 	readonly roles: readonly Pick<
 		TenantRole,
 		'id' | 'key' | 'name' | 'builtin'
@@ -25,6 +52,8 @@ export interface UserDirectory {
 	readonly actor: { readonly accountId: string; readonly role: string };
 	/** Shared auth.core setting, read through the declared dependency. */
 	readonly passwordMinLength: number;
+	/** Every membership of the workspace, counted in the database. */
+	readonly memberCount: number;
 }
 
 function actor(principal: AuthPrincipal): AuthActor {
@@ -47,16 +76,35 @@ export class UsersService {
 		this.#auth = auth;
 	}
 
-	async list(principal: AuthPrincipal): Promise<UserDirectory> {
+	/* One page, sorted, narrowed and cut by auth.core; the screen shows it as
+	   it arrives. */
+	async list(
+		principal: AuthPrincipal,
+		input: MemberListInput,
+	): Promise<TenantMemberSortedPage> {
+		return (await this.#auth.service()).listTenantMembersSorted(
+			principal.tenantId,
+			{
+				sort: input.sort,
+				direction: input.direction,
+				limit: input.limit,
+				query: input.query,
+				membershipStatus: input.status,
+				after: input.after,
+			},
+		);
+	}
+
+	async context(principal: AuthPrincipal): Promise<UsersContext> {
 		const service = await this.#auth.service();
 		return {
-			users: await service.listTenantMembers(principal.tenantId),
 			roles: (await service.listRoles(principal.tenantId)).map(
 				({ id, key, name, builtin }) => ({ id, key, name, builtin }),
 			),
 			grantableScopes: await service.listGrantableScopes(principal.tenantId),
 			actor: { accountId: principal.accountId, role: principal.role },
 			passwordMinLength: this.#auth.settings.passwordMinLength,
+			memberCount: await service.countTenantMembers(principal.tenantId),
 		};
 	}
 
@@ -74,6 +122,22 @@ export class UsersService {
 		);
 	}
 
+	/* A member who holds no password: auth.core stores its unusable credential
+	   marker, so no secret is drawn here and none has to be delivered. */
+	async createWithoutPassword(
+		principal: AuthPrincipal,
+		input: Omit<CreateUserInput, 'password'>,
+	): Promise<TenantMember> {
+		const record: CreateTenantMemberWithoutPasswordInput = {
+			...input,
+			tenantId: principal.tenantId,
+		};
+		return (await this.#auth.service()).createTenantMemberWithoutPassword(
+			record,
+			actor(principal),
+		);
+	}
+
 	async rename(
 		principal: AuthPrincipal,
 		accountId: string,
@@ -110,6 +174,55 @@ export class UsersService {
 		);
 	}
 
+	/* Workspace access for several members at once: the membership path the
+	   drawer's switch uses, once per id, so every row keeps its own audit event
+	   and its own refusal (the acting principal, the last owner, an owner
+	   touched by a non-owner) and a missing or foreign id costs nobody else. */
+	setMembershipStatusMany(
+		principal: AuthPrincipal,
+		accountIds: readonly string[],
+		status: 'active' | 'disabled',
+	): Promise<readonly MemberBulkOutcome[]> {
+		return this.#each(accountIds, async (accountId) => {
+			await (
+				await this.#auth.service()
+			).setMembershipStatus(actor(principal), accountId, status);
+		});
+	}
+
+	assignRoleMany(
+		principal: AuthPrincipal,
+		accountIds: readonly string[],
+		roleKey: string,
+	): Promise<readonly MemberBulkOutcome[]> {
+		return this.#each(accountIds, async (accountId) => {
+			await (
+				await this.#auth.service()
+			).assignMemberRole(actor(principal), accountId, roleKey);
+		});
+	}
+
+	async #each(
+		accountIds: readonly string[],
+		write: (accountId: string) => Promise<void>,
+	): Promise<readonly MemberBulkOutcome[]> {
+		const outcomes: MemberBulkOutcome[] = [];
+		for (const accountId of accountIds) {
+			try {
+				await write(accountId);
+				outcomes.push({ accountId, outcome: 'updated' });
+			} catch (error) {
+				if (!(error instanceof AuthServiceError)) throw error;
+				outcomes.push(
+					error.code === 'ACCOUNT_NOT_FOUND'
+						? { accountId, outcome: 'not-found' }
+						: { accountId, outcome: 'refused', reason: error.code },
+				);
+			}
+		}
+		return outcomes;
+	}
+
 	async remove(principal: AuthPrincipal, accountId: string): Promise<void> {
 		await (
 			await this.#auth.service()

package/modules/users/translations/en.json

@@ -19,6 +19,10 @@
 	"invite.sending": "Sending…",
 	"invite.sent": "Invitation sent to {email}.",
 	"invite.error": "The invitation could not be sent.",
+	"export.action": "Export CSV",
+	"export.started": "The member export started. It appears on the Exports screen as soon as the file is ready.",
+	"export.link": "Open Exports",
+	"export.error": "The export could not be started.",
 	"action.manage": "Manage",
 	"action.cancel": "Cancel",
 	"action.close": "Close",
@@ -31,10 +35,11 @@
 	"denied.members": "Reading the user directory needs the users.members.read scope.",
 	"table.title": "Members",
 	"table.caption": "Workspace users",
-	"table.count": "{owners} owners · {accounts} accounts",
+	"table.count": "{accounts} accounts",
 	"table.user": "User",
+	"table.email": "Email",
 	"table.role": "Role",
-	"table.status": "Status",
+	"table.status": "Workspace access",
 	"table.scopes": "Scopes",
 	"table.actions": "User actions",
 	"table.loading": "Loading workspace accounts…",
@@ -42,11 +47,36 @@
 	"table.emptyHint": "Create the first account for this workspace.",
 	"table.emptyFilteredTitle": "No matching accounts",
 	"table.emptyFilteredHint": "No account in this workspace matches the current filter.",
+	"selection.label": "Select all members on screen",
+	"selection.rowLabel": "Select {name}",
+	"selection.clear": "Clear selection",
+	"selection.summary": "{count} selected",
+	"action.deactivateSelected": "Deactivate selected",
+	"action.assignRoleSelected": "Assign role",
+	"action.bulkRefused": "Select at least one member other than yourself.",
+	"deactivateMany.title": "Deactivate the selected members?",
+	"deactivateMany.description": "{count} members lose access to this workspace; their sessions and API tokens here are revoked. Their other workspaces are untouched.",
+	"roleMany.title": "Assign a role to the selected members",
+	"roleMany.description": "The role replaces the scopes of {count} members.",
+	"notice.deactivatedMany": "Deactivated {updated}, missing {missing}, refused {refused}.",
+	"notice.roleAssignedMany": "Role assigned to {updated}, missing {missing}, refused {refused}.",
+	"error.deactivateMany": "Could not deactivate the selected members.",
+	"error.roleMany": "Could not assign the role to the selected members.",
+	"common.messages": "Messages",
 	"table.note": "Roles decide what an account may reach. Owners administer the workspace; every other role carries exactly the scopes it lists.",
-	"search.placeholder": "Filter by name or email",
+	"search.placeholder": "Starts with name or email",
 	"search.label": "Filter members",
+	"filter.label": "Filters",
+	"filter.status": "Workspace access",
+	"filter.allStatuses": "All",
+	"pagination.label": "Member pages",
+	"pagination.previous": "Previous",
+	"pagination.next": "Next",
+	"pagination.size": "Members per page",
+	"pagination.summary": "Page {page} · from member {from}",
 	"status.active": "Active",
 	"status.disabled": "Disabled",
+	"status.blocked": "Operator block",
 	"status.passwordResetPending": "Password reset pending",
 	"drawer.newTitle": "New account",
 	"drawer.newSubtitle": "Direct workspace access",
@@ -68,28 +98,47 @@
 	"member.saveName": "Save name",
 	"member.roleDescription": "A role sets the scopes below; custom roles live on the Roles screen.",
 	"member.assignRole": "Assign role",
+	"member.access": "Access to this workspace",
+	"member.accessDescription": "Turns this membership on or off. It never touches the person's other workspaces or their account.",
+	"membership.active": "Active in this workspace",
+	"membership.disabled": "Disabled in this workspace",
+	"membership.reasonActive": "The member signs in to this workspace normally. Other workspaces are unaffected either way.",
+	"membership.reasonDisabled": "Sign-in to this workspace is refused and its sessions and API tokens are revoked. Other workspaces keep working.",
+	"membership.disable": "Disable access",
+	"membership.confirmTitle": "Disable access for {name}?",
+	"membership.confirmDescription": "Sessions and API tokens for this workspace are revoked at once and sign-in here is refused. Other workspaces stay untouched. Turning access back on restores sign-in, not the revoked tokens.",
+	"membership.error": "Workspace access could not be changed.",
+	"membership.errorSelf": "You cannot change your own access to this workspace. Ask another owner.",
+	"membership.errorLastOwner": "This is the last active owner of the workspace. Give another member the owner role first.",
+	"membership.errorOwnerRequired": "Only an owner can change another owner's access to this workspace.",
+	"membership.errorNotFound": "This member is no longer in the workspace. Refresh the list.",
 	"member.account": "Account",
-	"member.accountDescription": "Disabling ends every session at once and blocks sign-in.",
-	"member.disable": "Disable account",
-	"member.enable": "Enable account",
+	"member.accountDescription": "The global account state an operator owns. Signing out ends every session of this account, in every workspace.",
+	"member.accountReadOnly": "Blocking or unblocking an account is a deployment operator action and cannot be done here. Use the workspace access switch above to end access to this workspace.",
 	"member.signOutEverywhere": "Sign out everywhere",
 	"member.temporaryPassword": "Temporary password",
 	"member.temporaryPasswordHelp": "At least {min} characters. The member picks a new one at the next sign-in.",
 	"member.resetPassword": "Reset password",
+	"member.mfa": "Multi-factor authentication",
+	"member.mfaDescription": "Clear the enrolled authenticator when a member loses the device. The member enrols again from account security.",
+	"member.resetMfa": "Reset MFA",
 	"member.removeTitle": "Remove from workspace",
 	"member.removeDescription": "Ends the membership with its sessions and tokens; the account stays if it belongs to another workspace.",
 	"member.remove": "Remove member",
 	"notice.nameSaved": "Display name saved.",
 	"notice.roleAssigned": "Role assigned.",
 	"notice.scopesSaved": "Scopes saved.",
-	"notice.accountDisabled": "Account disabled.",
-	"notice.accountEnabled": "Account enabled.",
+	"notice.membershipDisabled": "Access to this workspace disabled.",
+	"notice.membershipEnabled": "Access to this workspace enabled.",
 	"notice.passwordSet": "Temporary password set. The member must change it at sign-in.",
+	"notice.mfaReset": "Multi-factor authentication cleared. The member must enrol again.",
 	"notice.sessionsCount": "Sessions ended: {count}.",
 	"notice.sessionsEnded": "Sessions ended.",
 	"remove.title": "Remove this member?",
 	"remove.fallbackName": "The member",
 	"remove.description": "{name} loses access to this workspace immediately. Sessions and API tokens for this membership are revoked.",
+	"mfaReset.title": "Reset multi-factor authentication?",
+	"mfaReset.description": "{name} loses the enrolled authenticator and every recovery code, and must enrol again before the next sign-in that asks for a second factor.",
 	"roles.title": "Roles",
 	"roles.description": "Built-in and custom roles with the exact scopes they grant.",
 	"roles.new": "New role",