@flowdular/sdk 0.2.4 → 0.3.1

package/modules/auth/src/services/totp.ts

@@ -1,10 +1,5 @@
-import {
-	createCipheriv,
-	createDecipheriv,
-	createHmac,
-	randomBytes,
-	timingSafeEqual,
-} from 'node:crypto';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createKeyring, parsePreviousKeys } from '@flowdular/sdk/kernel';
 import { AuthServiceError } from './auth-service-error.ts';
 
 const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
@@ -67,69 +62,100 @@ export function verifyTotp(
 	return false;
 }
 
+/** The envelope columns of one enrolled factor. */
+export interface SealedMfaSecret {
+	readonly keyId: string;
+	readonly ciphertext: string;
+}
+
+export interface MfaSecretVault {
+	/** Key id every new envelope is written with; stored rows may carry older ones. */
+	readonly keyId: string;
+	seal(secret: string): SealedMfaSecret;
+	/** `keyId` is absent on a row written before the key id column existed. */
+	open(ciphertext: string, keyId?: string | null): string;
+}
+
+function notConfigured(): AuthServiceError {
+	return new AuthServiceError(
+		'MFA_NOT_CONFIGURED',
+		'Multi-factor authentication is not configured for this deployment.',
+		503,
+	);
+}
+
+function configurationInvalid(cause?: unknown): AuthServiceError {
+	return new AuthServiceError(
+		'MFA_CONFIGURATION_INVALID',
+		'The MFA configuration is invalid.',
+		500,
+		cause === undefined ? undefined : { cause },
+	);
+}
+
 function encryptionKey(value: string | undefined): Buffer {
-	if (!value) {
-		throw new AuthServiceError(
-			'MFA_NOT_CONFIGURED',
-			'Multi-factor authentication is not configured for this deployment.',
-			503,
-		);
-	}
+	if (!value) throw notConfigured();
 	const key = Buffer.from(
 		value,
 		/^[0-9a-f]{64}$/i.test(value) ? 'hex' : 'base64url',
 	);
-	if (key.byteLength !== 32) {
-		throw new AuthServiceError(
-			'MFA_NOT_CONFIGURED',
-			'Multi-factor authentication is not configured for this deployment.',
-			503,
-		);
-	}
+	if (key.byteLength !== 32) throw notConfigured();
 	return key;
 }
 
-export function encryptMfaSecret(
-	secret: string,
-	keyValue: string | undefined,
-): string {
-	const iv = randomBytes(12);
-	const cipher = createCipheriv('aes-256-gcm', encryptionKey(keyValue), iv);
-	const ciphertext = Buffer.concat([
-		cipher.update(secret, 'utf8'),
-		cipher.final(),
-	]);
-	return `${iv.toString('base64url')}.${ciphertext.toString('base64url')}.${cipher.getAuthTag().toString('base64url')}`;
+/**
+ * The key set that protects enrolled TOTP secrets at rest: one current key that
+ * seals every new envelope, and the keys kept only to open the rows a rotation
+ * has not re-sealed yet. The stored envelope stays `iv.ciphertext.tag` in
+ * base64url exactly as rows written before the key id existed; only the id of
+ * the key moved, into its own column, so a row that carries none is opened by
+ * trying the ring in order.
+ */
+export function createMfaSecretVault(
+	current: string | undefined,
+	previous: readonly string[] = [],
+): MfaSecretVault {
+	const keyring = createKeyring({
+		current: encryptionKey(current),
+		previous: previous.map((entry) => encryptionKey(entry)),
+	});
+	return {
+		keyId: keyring.keyId,
+		seal(secret) {
+			const sealed = keyring.seal(secret);
+			return {
+				keyId: sealed.keyId,
+				ciphertext: `${sealed.iv.toString('base64url')}.${sealed.ciphertext.toString('base64url')}.${sealed.tag.toString('base64url')}`,
+			};
+		},
+		open(ciphertext, keyId) {
+			const [ivValue, ciphertextValue, tagValue] = ciphertext.split('.');
+			if (!ivValue || !ciphertextValue || !tagValue) {
+				throw configurationInvalid();
+			}
+			try {
+				return keyring
+					.open({
+						keyId: keyId ?? undefined,
+						iv: Buffer.from(ivValue, 'base64url'),
+						tag: Buffer.from(tagValue, 'base64url'),
+						ciphertext: Buffer.from(ciphertextValue, 'base64url'),
+					})
+					.toString('utf8');
+			} catch (error) {
+				/* The kernel code reaches a caller on the cause: a key that is simply
+				   absent from the ring and a corrupt row are the same refusal here. */
+				throw configurationInvalid(error);
+			}
+		},
+	};
 }
 
-export function decryptMfaSecret(
-	value: string,
-	keyValue: string | undefined,
-): string {
-	const [ivValue, ciphertextValue, tagValue] = value.split('.');
-	if (!ivValue || !ciphertextValue || !tagValue)
-		throw new AuthServiceError(
-			'MFA_CONFIGURATION_INVALID',
-			'The MFA configuration is invalid.',
-			500,
-		);
-	try {
-		const decipher = createDecipheriv(
-			'aes-256-gcm',
-			encryptionKey(keyValue),
-			Buffer.from(ivValue, 'base64url'),
-		);
-		decipher.setAuthTag(Buffer.from(tagValue, 'base64url'));
-		return Buffer.concat([
-			decipher.update(Buffer.from(ciphertextValue, 'base64url')),
-			decipher.final(),
-		]).toString('utf8');
-	} catch (error) {
-		if (error instanceof AuthServiceError) throw error;
-		throw new AuthServiceError(
-			'MFA_CONFIGURATION_INVALID',
-			'The MFA configuration is invalid.',
-			500,
-		);
-	}
+export function mfaSecretVaultFromEnvironment(
+	environment: NodeJS.ProcessEnv = process.env,
+): MfaSecretVault {
+	return createMfaSecretVault(
+		environment.FD_AUTH_MFA_KEY,
+		parsePreviousKeys(environment.FD_AUTH_MFA_KEY_PREVIOUS, (entry) => entry),
+	);
 }

package/modules/auth/src/services/validation.ts

@@ -1,5 +1,6 @@
 import type {
 	CreateTenantMemberInput,
+	CreateTenantMemberWithoutPasswordInput,
 	SignInInput,
 	SignUpInput,
 } from '../domain/types.ts';
@@ -51,15 +52,163 @@ export function validateEmailAddress(value: string): string {
 	return email;
 }
 
+/* The credentials that lead every published breach corpus: the hundred short
+   ones first, then the long entries that clear an ordinary minimum length and
+   would otherwise never reach this lookup. A fixed set, so the check is one
+   lookup and the list can never grow into a download at request time. Entries
+   are lowercase; the candidate is folded before the lookup. */
+export const COMMON_PASSWORDS: ReadonlySet<string> = new Set([
+	'123456',
+	'password',
+	'123456789',
+	'12345678',
+	'12345',
+	'qwerty',
+	'1234567',
+	'111111',
+	'123123',
+	'abc123',
+	'1234567890',
+	'1234',
+	'iloveyou',
+	'000000',
+	'dragon',
+	'monkey',
+	'letmein',
+	'sunshine',
+	'princess',
+	'football',
+	'123321',
+	'654321',
+	'666666',
+	'7777777',
+	'121212',
+	'qwertyuiop',
+	'1q2w3e4r',
+	'555555',
+	'888888',
+	'admin',
+	'welcome',
+	'login',
+	'master',
+	'passw0rd',
+	'superman',
+	'batman',
+	'michael',
+	'jennifer',
+	'jordan',
+	'hunter',
+	'ranger',
+	'harley',
+	'shadow',
+	'baseball',
+	'soccer',
+	'trustno1',
+	'whatever',
+	'charlie',
+	'daniel',
+	'jessica',
+	'ashley',
+	'thomas',
+	'robert',
+	'andrew',
+	'matthew',
+	'joshua',
+	'hannah',
+	'nicole',
+	'amanda',
+	'samantha',
+	'buster',
+	'tigger',
+	'purple',
+	'orange',
+	'silver',
+	'chelsea',
+	'cheese',
+	'banana',
+	'zaq1zaq1',
+	'qazwsx',
+	'zxcvbnm',
+	'asdfgh',
+	'asdfghjkl',
+	'qwe123',
+	'123qwe',
+	'1qaz2wsx',
+	'password1',
+	'password123',
+	'pass123',
+	'admin123',
+	'root',
+	'guest',
+	'test',
+	'changeme',
+	'secret',
+	'freedom',
+	'killer',
+	'summer',
+	'maggie',
+	'pepper',
+	'ginger',
+	'cookie',
+	'flower',
+	'hello',
+	'starwars',
+	'computer',
+	'internet',
+	'access',
+	'mustang',
+	'corvette',
+	// Twelve characters and longer, sorted, so the list stays deduplicated.
+	'1234567890123',
+	'1qaz2wsx3edc',
+	'administrator',
+	'asdfghjkl123',
+	'changeme1234',
+	'iloveyou1234',
+	'letmein12345',
+	'password1234',
+	'passwordpassword',
+	'qazwsxedcrfv',
+	'qwerty123456',
+	'qwertyuiop12',
+	'welcome12345',
+	'zaq12wsxcde3',
+]);
+
+/* Below this an address fragment is too short to carry any of the address into
+   the password, and the rule would reject unrelated passwords. */
+const MIN_EMAIL_FRAGMENT_LENGTH = 3;
+
+export function emailLocalPart(email: string): string {
+	return normalizeEmail(email).split('@')[0] ?? '';
+}
+
 export function assertPasswordPolicy(
 	password: string,
 	minLength = DEFAULT_PASSWORD_MIN_LENGTH,
+	email?: string,
 ): void {
-	validatePassword(password, minLength);
+	validatePassword(password, minLength, email);
 }
 
-function validatePassword(password: string, minLength: number): void {
-	const bytes = Buffer.byteLength(password, 'utf8');
+function validatePassword(
+	password: string,
+	minLength: number,
+	email?: string,
+): void {
+	if (Buffer.byteLength(password, 'utf8') > 1024) {
+		throw new AuthServiceError('INVALID_INPUT', 'Password is too long.', 400);
+	}
+	/* Ahead of the length rule: a breached credential is refused on its own
+	   code whether or not it also clears the configured minimum. */
+	const folded = password.trim().normalize('NFKC').toLowerCase();
+	if (COMMON_PASSWORDS.has(folded)) {
+		throw new AuthServiceError(
+			'PASSWORD_TOO_COMMON',
+			'Choose a password that does not appear on the list of most common passwords.',
+			400,
+		);
+	}
 	if (password.length < minLength) {
 		throw new AuthServiceError(
 			'INVALID_INPUT',
@@ -67,8 +216,16 @@ function validatePassword(password: string, minLength: number): void {
 			400,
 		);
 	}
-	if (bytes > 1024) {
-		throw new AuthServiceError('INVALID_INPUT', 'Password is too long.', 400);
+	const localPart = email === undefined ? '' : emailLocalPart(email);
+	if (
+		localPart.length >= MIN_EMAIL_FRAGMENT_LENGTH &&
+		folded.includes(localPart)
+	) {
+		throw new AuthServiceError(
+			'PASSWORD_CONTAINS_EMAIL',
+			'Password must not contain the local part of the email address.',
+			400,
+		);
 	}
 }
 
@@ -101,7 +258,16 @@ export function validateSignIn(input: SignInInput): SignInInput {
 	validateEmail(email);
 	if (!input.password)
 		throw new AuthServiceError('INVALID_INPUT', 'Password is required.', 400);
-	return { email, password: input.password };
+	if (input.workspace === undefined) return { email, password: input.password };
+	const workspace = input.workspace.trim();
+	if (workspace.length === 0 || workspace.length > 128) {
+		throw new AuthServiceError(
+			'INVALID_INPUT',
+			'Workspace reference is invalid.',
+			400,
+		);
+	}
+	return { email, password: input.password, workspace };
 }
 
 export function validateSignUp(
@@ -112,7 +278,7 @@ export function validateSignUp(
 	const displayName = validateDisplayName(input.displayName);
 	const organizationSlug = validateWorkspaceSlug(input.organizationSlug);
 	validateEmail(email);
-	validatePassword(input.password, passwordMinLength);
+	validatePassword(input.password, passwordMinLength, email);
 	const organizationName = validateWorkspaceName(input.organizationName);
 	return {
 		email,
@@ -149,6 +315,27 @@ export function validateCreateTenantMember(
 	};
 }
 
+/**
+ * The same rules without the password one, for a member created with an
+ * unusable credential. Nothing about the password policy applies: there is no
+ * password to measure.
+ */
+export function validateCreateTenantMemberWithoutPassword(
+	input: CreateTenantMemberWithoutPasswordInput,
+): CreateTenantMemberWithoutPasswordInput {
+	const email = normalizeEmail(input.email);
+	validateEmail(email);
+	if (!input.tenantId || input.tenantId.length > 128) {
+		throw new AuthServiceError('INVALID_INPUT', 'Tenant is invalid.', 400);
+	}
+	return {
+		tenantId: input.tenantId,
+		email,
+		displayName: validateDisplayName(input.displayName),
+		role: validateRoleKey(input.role),
+	};
+}
+
 export function validateRoleKey(value: string): string {
 	const key = value.trim();
 	if (!ROLE_KEY_PATTERN.test(key)) {

package/modules/auth/src/settings.ts

@@ -109,6 +109,18 @@ export function createAuthModuleSettings(
 				max: 200,
 				pattern: PROVIDER_LIST_PATTERN,
 			},
+			requireMfa: {
+				type: 'boolean',
+				defaultValue: false,
+				visibility: 'private',
+				client: false,
+				scope: 'tenant',
+				labelKey: 'auth.moduleSettings.requireMfa.label',
+				label: 'Require multi-factor authentication',
+				descriptionKey: 'auth.moduleSettings.requireMfa.description',
+				description:
+					'Members of this workspace must enrol an authenticator before any workspace API or page answers them. API tokens are exempt, and the deployment needs an MFA encryption key.',
+			},
 			defaultLocale: {
 				type: 'string',
 				defaultValue: locales[0]!,
@@ -138,6 +150,12 @@ export interface AuthSettings {
 	readonly passwordMinLength: number;
 }
 
+/** The auth.core settings a single workspace decides for itself. */
+export interface AuthTenantSettings {
+	/** Members without a confirmed second factor are held at enrolment. */
+	readonly requireMfa: boolean;
+}
+
 export function parseProviderList(value: string): readonly string[] {
 	return [
 		...new Set(

package/modules/auth/translations/en.json

@@ -10,6 +10,7 @@
 	"common.never": "Never",
 	"common.none": "None",
 	"common.refresh": "Refresh",
+	"common.retry": "Try again",
 	"common.save": "Save",
 	"common.saved": "Saved",
 	"navigation.tokens": "API tokens",
@@ -243,6 +244,7 @@
 	"security.mfa.verify": "Verify and sign in",
 	"security.mfa.useRecovery": "Use a recovery code",
 	"security.mfa.useCode": "Use an authenticator code",
+	"security.mfa.requiredNotice": "This workspace requires multi-factor authentication. Enrol an authenticator app to regain access to the rest of the workspace.",
 	"security.mfa.errorLoad": "Could not load account security.",
 	"security.mfa.errorEnroll": "MFA setup could not be started.",
 	"security.mfa.errorConfirm": "The authenticator code could not be confirmed.",
@@ -258,6 +260,87 @@
 	"moduleSettings.passwordMinLength.description": "Applies to sign-up, member creation, and password changes.",
 	"moduleSettings.signInProviders.label": "Sign-in providers",
 	"moduleSettings.signInProviders.description": "Comma-separated external provider ids shown on the sign-in screen.",
+	"moduleSettings.requireMfa.label": "Require multi-factor authentication",
+	"moduleSettings.requireMfa.description": "Members of this workspace must enrol an authenticator before any workspace API or page answers them. API tokens are exempt, and the deployment needs an MFA encryption key.",
 	"moduleSettings.defaultLocale.label": "Default locale",
-	"moduleSettings.defaultLocale.description": "Language offered to new members of this workspace."
+	"moduleSettings.defaultLocale.description": "Language offered to new members of this workspace.",
+	"navigation.providers": "Identity providers",
+	"navigation.providersDescription": "Single sign-on for this workspace",
+	"providers.title": "Identity providers",
+	"providers.description": "Offer single sign-on on this workspace sign-in screen and decide who may join through it.",
+	"providers.new": "New provider",
+	"providers.open": "Open",
+	"providers.enable": "Enable",
+	"providers.disable": "Disable",
+	"providers.delete": "Delete provider",
+	"providers.loading": "Loading identity providers…",
+	"providers.note": "A client secret is stored sealed and never shown again; only its fingerprint is.",
+	"providers.denied": "Your current session cannot read the identity providers of this workspace.",
+	"providers.readOnly": "This provider cannot be changed from here.",
+	"providers.table.title": "Providers",
+	"providers.table.count": "{total} configured",
+	"providers.table.caption": "Identity providers offered on this sign-in screen",
+	"providers.search.placeholder": "Search providers or issuers",
+	"providers.search.label": "Search identity providers",
+	"providers.empty.title": "No workspace provider yet",
+	"providers.empty.hint": "Add one to let this workspace sign in through your own identity provider.",
+	"providers.empty.filteredTitle": "No matching providers",
+	"providers.empty.filteredHint": "Change the search phrase to see other providers.",
+	"providers.column.provider": "Provider",
+	"providers.column.issuer": "Issuer",
+	"providers.column.status": "Status",
+	"providers.column.fingerprint": "Secret",
+	"providers.status.active": "offered",
+	"providers.status.disabled": "disabled",
+	"providers.scope.platform": "platform provider",
+	"providers.scope.tenant": "workspace provider",
+	"providers.scope.platformHint": "This provider comes from the deployment configuration and is offered to every workspace.",
+	"providers.jit.on": "provisioning on",
+	"providers.jit.off": "provisioning off",
+	"providers.jit.detail": "New members from {domains} join as {role}.",
+	"providers.drawer.newTitle": "New identity provider",
+	"providers.drawer.newSubtitle": "The issuer is verified through its discovery document before it is saved.",
+	"providers.drawer.subtitle": "Workspace provider",
+	"providers.secret.rotate": "New client secret",
+	"providers.secret.rotateHelp": "Paste the secret the provider issued. It is sealed immediately and never shown again.",
+	"providers.secret.rotateAction": "Rotate secret",
+	"providers.secret.rotated": "The client secret was replaced.",
+	"providers.form.key": "Key",
+	"providers.form.keyHelp": "Lower-case letters, digits and hyphens; it appears in the sign-in link.",
+	"providers.form.label": "Name",
+	"providers.form.issuer": "Issuer",
+	"providers.form.issuerHelp": "The HTTPS issuer whose discovery document names it back.",
+	"providers.form.clientId": "Client id",
+	"providers.form.clientSecret": "Client secret",
+	"providers.form.clientSecretOnce": "Entered once. It is sealed at rest and never returned.",
+	"providers.form.clientSecretKeep": "Leave empty to keep the current secret.",
+	"providers.form.scopes": "Scopes",
+	"providers.form.scopesHelp": "Comma separated. openid and email are always requested.",
+	"providers.form.jit": "Create members on first sign-in",
+	"providers.form.jitHelp": "Off by default: without it, a person needs a membership before signing in.",
+	"providers.form.allowedDomains": "Allowed e-mail domains",
+	"providers.form.allowedDomainsHelp": "Comma separated. A verified address outside them is refused.",
+	"providers.form.jitRole": "Role for new members",
+	"providers.form.jitRoleHelp": "A role key of this workspace; member by default.",
+	"providers.form.secretNote": "The client secret is never displayed after saving.",
+	"providers.form.create": "Create provider",
+	"providers.error.request": "The request could not be completed.",
+	"providers.error.load": "The identity providers could not be loaded.",
+	"providers.error.save": "The provider could not be saved.",
+	"providers.error.rotate": "The client secret could not be replaced.",
+	"providers.error.status": "The provider status could not be changed.",
+	"providers.error.delete": "The provider could not be deleted.",
+	"signin.workspace.label": "Workspace id",
+	"signin.workspace.help": "Enter it to see the sign-in options of that workspace.",
+	"signin.workspace.entering": "Signing in to {workspace}.",
+	"mail.password-reset.subject": "Reset your password",
+	"mail.password-reset.intro": "A password reset was requested for this address. Open the link below to choose a new password.",
+	"mail.password-reset.action": "Reset your password",
+	"mail.tenant-invitation.subject": "You have been invited to a workspace",
+	"mail.tenant-invitation.intro": "You have been invited to a workspace. Open the link below to accept the invitation and set up your account.",
+	"mail.tenant-invitation.action": "Accept the invitation",
+	"mail.email-confirmation.subject": "Confirm your email address",
+	"mail.email-confirmation.intro": "Confirm this address to finish setting up your account. Open the link below to complete the confirmation.",
+	"mail.email-confirmation.action": "Confirm your address",
+	"mail.closing": "The link expires and can be used only once. If you did not expect this message, you can ignore it."
 }

package/modules/auth/translations/pl.json

@@ -10,6 +10,7 @@
 	"common.never": "Nigdy",
 	"common.none": "Brak",
 	"common.refresh": "Odśwież",
+	"common.retry": "Spróbuj ponownie",
 	"common.save": "Zapisz",
 	"common.saved": "Zapisano",
 	"navigation.tokens": "Tokeny API",
@@ -243,6 +244,7 @@
 	"security.mfa.verify": "Zweryfikuj i zaloguj",
 	"security.mfa.useRecovery": "Użyj kodu odzyskiwania",
 	"security.mfa.useCode": "Użyj kodu z aplikacji",
+	"security.mfa.requiredNotice": "Ta przestrzeń robocza wymaga uwierzytelniania wieloskładnikowego. Zarejestruj aplikację uwierzytelniającą, aby odzyskać dostęp do pozostałych części przestrzeni roboczej.",
 	"security.mfa.errorLoad": "Nie udało się wczytać ustawień bezpieczeństwa konta.",
 	"security.mfa.errorEnroll": "Nie udało się rozpocząć konfiguracji MFA.",
 	"security.mfa.errorConfirm": "Nie udało się potwierdzić kodu z aplikacji.",
@@ -258,6 +260,87 @@
 	"moduleSettings.passwordMinLength.description": "Obowiązuje przy rejestracji, tworzeniu członków i zmianie hasła.",
 	"moduleSettings.signInProviders.label": "Dostawcy logowania",
 	"moduleSettings.signInProviders.description": "Identyfikatory zewnętrznych dostawców wyświetlanych na ekranie logowania, rozdzielone przecinkami.",
+	"moduleSettings.requireMfa.label": "Wymagaj uwierzytelniania wieloskładnikowego",
+	"moduleSettings.requireMfa.description": "Członkowie tej przestrzeni roboczej muszą zarejestrować aplikację uwierzytelniającą, zanim odpowie im jakiekolwiek API lub strona przestrzeni roboczej. Tokeny API są zwolnione, a wdrożenie potrzebuje klucza szyfrującego MFA.",
 	"moduleSettings.defaultLocale.label": "Domyślny język",
-	"moduleSettings.defaultLocale.description": "Język proponowany nowym członkom tej przestrzeni roboczej."
+	"moduleSettings.defaultLocale.description": "Język proponowany nowym członkom tej przestrzeni roboczej.",
+	"navigation.providers": "Dostawcy tożsamości",
+	"navigation.providersDescription": "Logowanie jednokrotne tego obszaru",
+	"providers.title": "Dostawcy tożsamości",
+	"providers.description": "Udostępnij logowanie jednokrotne na ekranie logowania tego obszaru i zdecyduj, kto może przez nie dołączyć.",
+	"providers.new": "Nowy dostawca",
+	"providers.open": "Otwórz",
+	"providers.enable": "Włącz",
+	"providers.disable": "Wyłącz",
+	"providers.delete": "Usuń dostawcę",
+	"providers.loading": "Wczytywanie dostawców tożsamości…",
+	"providers.note": "Sekret klienta jest przechowywany zaszyfrowany i nigdy nie jest pokazywany ponownie; widoczny jest tylko jego odcisk.",
+	"providers.denied": "Bieżąca sesja nie może odczytać dostawców tożsamości tego obszaru.",
+	"providers.readOnly": "Tego dostawcy nie można zmienić w tym miejscu.",
+	"providers.table.title": "Dostawcy",
+	"providers.table.count": "Skonfigurowani: {total}",
+	"providers.table.caption": "Dostawcy tożsamości dostępni na tym ekranie logowania",
+	"providers.search.placeholder": "Szukaj dostawców lub wystawców",
+	"providers.search.label": "Szukaj dostawców tożsamości",
+	"providers.empty.title": "Brak dostawcy obszaru",
+	"providers.empty.hint": "Dodaj dostawcę, aby ten obszar logował się przez Twojego dostawcę tożsamości.",
+	"providers.empty.filteredTitle": "Brak pasujących dostawców",
+	"providers.empty.filteredHint": "Zmień frazę wyszukiwania, aby zobaczyć innych.",
+	"providers.column.provider": "Dostawca",
+	"providers.column.issuer": "Wystawca",
+	"providers.column.status": "Status",
+	"providers.column.fingerprint": "Sekret",
+	"providers.status.active": "dostępny",
+	"providers.status.disabled": "wyłączony",
+	"providers.scope.platform": "dostawca platformy",
+	"providers.scope.tenant": "dostawca obszaru",
+	"providers.scope.platformHint": "Ten dostawca pochodzi z konfiguracji wdrożenia i jest dostępny w każdym obszarze.",
+	"providers.jit.on": "zakładanie kont włączone",
+	"providers.jit.off": "zakładanie kont wyłączone",
+	"providers.jit.detail": "Nowe osoby z domen {domains} dołączają jako {role}.",
+	"providers.drawer.newTitle": "Nowy dostawca tożsamości",
+	"providers.drawer.newSubtitle": "Wystawca jest weryfikowany przez dokument discovery przed zapisaniem.",
+	"providers.drawer.subtitle": "Dostawca obszaru",
+	"providers.secret.rotate": "Nowy sekret klienta",
+	"providers.secret.rotateHelp": "Wklej sekret wydany przez dostawcę. Zostanie od razu zaszyfrowany i nigdy nie będzie pokazany ponownie.",
+	"providers.secret.rotateAction": "Wymień sekret",
+	"providers.secret.rotated": "Sekret klienta został wymieniony.",
+	"providers.form.key": "Klucz",
+	"providers.form.keyHelp": "Małe litery, cyfry i myślniki; pojawia się w adresie logowania.",
+	"providers.form.label": "Nazwa",
+	"providers.form.issuer": "Wystawca",
+	"providers.form.issuerHelp": "Adres HTTPS wystawcy, którego dokument discovery wskazuje na niego samego.",
+	"providers.form.clientId": "Identyfikator klienta",
+	"providers.form.clientSecret": "Sekret klienta",
+	"providers.form.clientSecretOnce": "Podawany raz. Jest szyfrowany i nigdy nie jest zwracany.",
+	"providers.form.clientSecretKeep": "Zostaw puste, aby zachować bieżący sekret.",
+	"providers.form.scopes": "Zakresy",
+	"providers.form.scopesHelp": "Rozdzielone przecinkami. openid i email są zawsze wymagane.",
+	"providers.form.jit": "Zakładaj konta przy pierwszym logowaniu",
+	"providers.form.jitHelp": "Domyślnie wyłączone: bez tego osoba musi mieć wcześniej przypisany dostęp.",
+	"providers.form.allowedDomains": "Dozwolone domeny e-mail",
+	"providers.form.allowedDomainsHelp": "Rozdzielone przecinkami. Zweryfikowany adres spoza nich zostanie odrzucony.",
+	"providers.form.jitRole": "Rola nowych osób",
+	"providers.form.jitRoleHelp": "Klucz roli tego obszaru; domyślnie member.",
+	"providers.form.secretNote": "Sekret klienta nie jest pokazywany po zapisaniu.",
+	"providers.form.create": "Utwórz dostawcę",
+	"providers.error.request": "Nie udało się wykonać żądania.",
+	"providers.error.load": "Nie udało się wczytać dostawców tożsamości.",
+	"providers.error.save": "Nie udało się zapisać dostawcy.",
+	"providers.error.rotate": "Nie udało się wymienić sekretu klienta.",
+	"providers.error.status": "Nie udało się zmienić statusu dostawcy.",
+	"providers.error.delete": "Nie udało się usunąć dostawcy.",
+	"signin.workspace.label": "Identyfikator obszaru",
+	"signin.workspace.help": "Podaj go, aby zobaczyć opcje logowania tego obszaru.",
+	"signin.workspace.entering": "Logowanie do {workspace}.",
+	"mail.password-reset.subject": "Zresetuj swoje hasło",
+	"mail.password-reset.intro": "Dla tego adresu poproszono o zresetowanie hasła. Otwórz poniższy link, aby wybrać nowe hasło.",
+	"mail.password-reset.action": "Zresetuj hasło",
+	"mail.tenant-invitation.subject": "Zaproszenie do obszaru roboczego",
+	"mail.tenant-invitation.intro": "Otrzymałeś zaproszenie do obszaru roboczego. Otwórz poniższy link, aby przyjąć zaproszenie i skonfigurować konto.",
+	"mail.tenant-invitation.action": "Przyjmij zaproszenie",
+	"mail.email-confirmation.subject": "Potwierdź swój adres e-mail",
+	"mail.email-confirmation.intro": "Potwierdź ten adres, aby dokończyć zakładanie konta. Otwórz poniższy link, aby zakończyć potwierdzanie.",
+	"mail.email-confirmation.action": "Potwierdź adres",
+	"mail.closing": "Link wygasa i można go użyć tylko raz. Jeśli nie spodziewałeś się tej wiadomości, możesz ją zignorować."
 }

package/modules/automations/migrations/0005_secret_rotation_inventory.down.sql

@@ -0,0 +1 @@
+REVOKE SELECT (secret_key_id) ON automations_triggers FROM coreloom_background;

package/modules/automations/migrations/0005_secret_rotation_inventory.up.sql

@@ -0,0 +1,6 @@
+-- The rotation command has to find the triggers still sealed with a retired key
+-- before it knows whose they are. The cross-tenant lookup already reads the two
+-- routing columns; this adds the key id and nothing else. The nonce, the tag and
+-- the ciphertext stay unreadable on this connection, and every row it re-seals
+-- is read again under the tenant that row named.
+GRANT SELECT (secret_key_id) ON automations_triggers TO coreloom_background;

package/modules/automations/migrations/0006_automations_list_sort_indexes.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS automations_triggers_tenant_updated_idx;
+DROP INDEX IF EXISTS automations_triggers_tenant_label_key_idx;
+DROP INDEX IF EXISTS automations_schedules_tenant_updated_idx;
+DROP INDEX IF EXISTS automations_schedules_tenant_label_key_idx;