@hed-hog/core 0.0.390 → 0.0.394

package/hedhog/frontend/app/users/user-sheet.tsx.ejs

@@ -29,6 +29,7 @@ import {
 } from '@/components/ui/form';
 import { FormActions } from '@/components/ui/form-actions';
 import { Input } from '@/components/ui/input';
+import { NameInput } from '@/components/ui/name-input';
 import {
   formatIntegrationProviderName,
   IntegrationLogo,
@@ -63,6 +64,7 @@ import {
   Key,
   Mail,
   Monitor,
+  MonitorSmartphone,
   ScrollText,
   RefreshCcw,
   Save,
@@ -77,7 +79,9 @@ import { useEffect, useMemo, useRef, useState } from 'react';
 import { useForm, useWatch } from 'react-hook-form';
 import { toast } from 'sonner';
 import { z } from 'zod';
+import { useCoreAccess } from '../_lib/hooks/use-core-access';
 import { ActiveSessions } from './active-session';
+import { UserDevices } from './user-devices';
 import { UserIdentifiersSection } from './identifiers';
 import { PermissionsSection } from './permissions';
 import {
@@ -318,7 +322,7 @@ function UserCreateSheet({
                 <FormItem>
                   <FormLabel>{t('formNameLabel')}</FormLabel>
                   <FormControl>
-                    <Input {...field} />
+                    <NameInput {...field} />
                   </FormControl>
                   <FormMessage />
                 </FormItem>
@@ -421,6 +425,11 @@ function UserEditSheet({
     user: currentUser,
   } = useApp();
   const minPasswordLength = Number(getSettingValue('password-min-length')) || 6;
+  // A aba de permissões concede/revoga papéis de outra conta. Só aparece para
+  // quem tem `admin` ou `admin-user-permission` — os mesmos papéis que o
+  // RoleGuard exige em POST/DELETE /user/:userId/role/:roleId. Enquanto a
+  // consulta a /auth/roles não responde, a aba fica escondida.
+  const { canManageUserPermissions } = useCoreAccess();
   // Resetar a própria senha por aqui força `requires_reset` na conta logada
   // sem passar pelo fluxo de troca (que exige a senha atual). Como o admin
   // não sabe essa senha nova gerada, ele fica preso na tela de troca forçada
@@ -774,10 +783,12 @@ function UserEditSheet({
                 <Fingerprint className="h-4 w-4" />
                 <span>{t('tabIdentifiers')}</span>
               </TabsTrigger>
-              <TabsTrigger value="permissions">
-                <ShieldCheck className="h-4 w-4" />
-                <span>{t('tabPermissions')}</span>
-              </TabsTrigger>
+              {canManageUserPermissions && (
+                <TabsTrigger value="permissions">
+                  <ShieldCheck className="h-4 w-4" />
+                  <span>{t('tabPermissions')}</span>
+                </TabsTrigger>
+              )}
               <TabsTrigger value="mfa">
                 <Shield className="h-4 w-4" />
                 <span>{t('tabMfa')}</span>
@@ -786,6 +797,10 @@ function UserEditSheet({
                 <Monitor className="h-4 w-4" />
                 <span>{t('tabSessions')}</span>
               </TabsTrigger>
+              <TabsTrigger value="devices">
+                <MonitorSmartphone className="h-4 w-4" />
+                <span>{t('tabDevices')}</span>
+              </TabsTrigger>
               <TabsTrigger value="emails">
                 <Mail className="h-4 w-4" />
                 <span>{t('tabEmails')}</span>
@@ -1084,7 +1099,7 @@ function UserEditSheet({
                     <FormItem>
                       <FormLabel>{t('editNameLabel')}</FormLabel>
                       <FormControl>
-                        <Input
+                        <NameInput
                           placeholder={t('editNamePlaceholder')}
                           {...field}
                         />
@@ -1408,26 +1423,28 @@ function UserEditSheet({
           </TabsContent>
 
           {/* Permissions Tab */}
-          <TabsContent value="permissions" className="space-y-4 mt-4 p-4 pt-0">
-            <div className="space-y-3">
-              <div className="flex items-center justify-between">
-                <div>
-                  <h4 className="text-sm font-semibold flex items-center gap-2">
-                    <ShieldCheck className="h-4 w-4" />
-                    {t('permissionsTitle')}
-                  </h4>
-                  <p className="text-xs text-muted-foreground mt-1">
-                    {t('permissionsDescription')}
-                  </p>
+          {canManageUserPermissions && (
+            <TabsContent value="permissions" className="space-y-4 mt-4 p-4 pt-0">
+              <div className="space-y-3">
+                <div className="flex items-center justify-between">
+                  <div>
+                    <h4 className="text-sm font-semibold flex items-center gap-2">
+                      <ShieldCheck className="h-4 w-4" />
+                      {t('permissionsTitle')}
+                    </h4>
+                    <p className="text-xs text-muted-foreground mt-1">
+                      {t('permissionsDescription')}
+                    </p>
+                  </div>
                 </div>
+                <PermissionsSection
+                  userId={editingUser.id!}
+                  userName={editingUser.name ?? undefined}
+                  onRoleChange={handleRefreshUser}
+                />
               </div>
-              <PermissionsSection
-                userId={editingUser.id!}
-                userName={editingUser.name ?? undefined}
-                onRoleChange={handleRefreshUser}
-              />
-            </div>
-          </TabsContent>
+            </TabsContent>
+          )}
 
           {/* MFA Tab */}
           <TabsContent value="mfa" className="space-y-4 mt-4 p-4 pt-0">
@@ -1476,6 +1493,11 @@ function UserEditSheet({
             />
           </TabsContent>
 
+          {/* Devices Tab */}
+          <TabsContent value="devices" className="space-y-4 mt-4 p-4 pt-0">
+            <UserDevices editingUser={editingUser} />
+          </TabsContent>
+
           {/* Emails Tab */}
           <TabsContent value="emails" className="space-y-4 mt-4 p-4 pt-0">
             <UserMails editingUser={editingUser} />

package/hedhog/frontend/messages/en.json

@@ -75,6 +75,7 @@
     "tab2fa": "2FA",
     "tabAccounts": "Accounts",
     "tabSessions": "Sessions",
+    "tabDevices": "Devices",
     "tabMcpTokens": "MCP Tokens",
     "tabTokens": "Tokens",
     "breadcrumbLabel": "Account",
@@ -255,6 +256,7 @@
     "tabIdentifiers": "Identifiers",
     "tabMfa": "MFA",
     "tabSessions": "Sessions",
+    "tabDevices": "Devices",
     "tabEmails": "Emails",
     "tabLogs": "Logs",
     "cardLastLoginDescription": "Last Login",
@@ -384,7 +386,8 @@
     "passwordResetPending": "Reset pending",
     "passwordResetNone": "Up to date",
     "neverLoggedIn": "Never signed in",
-    "filterOptionPasswordReset": "Password reset pending"
+    "filterOptionPasswordReset": "Password reset pending",
+    "activityByActor": "by {name}"
   },
   "RolePage": {
     "title": "Roles Management",
@@ -584,12 +587,14 @@
     "variablesHelp": "Use '{{variable}}' in the email body",
     "bodyLabel": "HTML Body",
     "localeLabel": "Language",
+    "sectionIdentification": "Identification",
     "preview": "Preview",
     "availableVariables": "Available variables:",
     "testValuePlaceholder": "Test value",
     "downloadYAML": "Download YAML",
     "generateMigration": "Generate Migration",
     "sendTestEmail": "Send test email",
+    "moreActions": "More actions",
     "cancel": "Cancel",
     "saveChanges": "Save Changes",
     "createTemplate": "Create Template",
@@ -719,7 +724,11 @@
     "logout": "Logged out",
     "resetPassword": "Reset the password",
     "revokeAllSessions": "Revoked all sessions",
-    "revokeSession": "Revoked a session"
+    "revokeSession": "Revoked a session",
+    "impersonationStarted": "Access simulated by an operator",
+    "impersonationEnded": "Access simulation ended",
+    "impersonationPerformed": "Simulated another user’s access",
+    "impersonationPerformedEnded": "Ended the access simulation"
   },
   "LoginPage": {
     "title": "Authentication",
@@ -781,6 +790,16 @@
     "submitButton": "Reset Password",
     "submitButtonLoading": "Resetting..."
   },
+  "ConfirmEmailPage": {
+    "title": "Email confirmation",
+    "checking": "One moment while we validate the link...",
+    "invalidTitle": "Invalid link",
+    "invalidDescription": "This confirmation link is invalid or has expired. Your account is still active — just sign in normally.",
+    "successTitle": "Email confirmed",
+    "successDescription": "All set! Your email address has been confirmed.",
+    "alreadyConfirmedDescription": "Your email was already confirmed. There is nothing else to do.",
+    "goToLogin": "Go to sign in"
+  },
   "NavUser": {
     "account": "Account",
     "notifications": "Notifications",
@@ -1027,7 +1046,8 @@
     "revokeSuccess": "Session revoked successfully!",
     "revokeFailure": "Failed to revoke session",
     "revokeAllSuccess": "Sessions revoked successfully!",
-    "revokeAllFailure": "Failed to revoke sessions"
+    "revokeAllFailure": "Failed to revoke sessions",
+    "simulatedBy": "Simulated by {name}"
   },
   "UserMails": {
     "title": "Sent emails",
@@ -1069,7 +1089,10 @@
     "role_removed": "Role removed",
     "avatar_changed": "Avatar changed",
     "emptyTitle": "No changes recorded",
-    "emptyDescription": "Administrative changes made to this user will appear here."
+    "emptyDescription": "Administrative changes made to this user will appear here.",
+    "impersonation_requested": "Access simulation requested",
+    "impersonation_started": "Access simulation started",
+    "impersonation_ended": "Access simulation ended"
   },
   "UserActiveSessions": {
     "title": "Active Sessions",
@@ -1086,7 +1109,9 @@
     "revokeSuccess": "Session successfully revoked!",
     "revokeFailure": "Failed to revoke session",
     "revokeAllSuccess": "Sessions successfully revoked!",
-    "revokeAllFailure": "Failed to revoke sessions"
+    "revokeAllFailure": "Failed to revoke sessions",
+    "simulatedSession": "Simulated access",
+    "simulatedBy": "Simulated by {name}"
   },
   "UserIdentifiers": {
     "title": "User Identifiers",
@@ -1287,6 +1312,7 @@
     "to": "To",
     "cc": "CC",
     "bcc": "BCC",
+    "providerMessageId": "Provider message ID",
     "body": "Body",
     "createdAt": "Created At",
     "updatedAt": "Updated At",
@@ -1306,6 +1332,20 @@
     "statusRead": "Read",
     "statusError": "Error",
     "statusUnavailable": "No status",
+    "filterByDelivery": "Delivery",
+    "deliveryAll": "Any delivery outcome",
+    "deliveryPending": "No answer yet",
+    "deliveryPendingHint": "The provider accepted the message and has not reported the outcome yet.",
+    "deliveryDelivered": "Delivered",
+    "deliveryBounced": "Bounced",
+    "deliveryComplained": "Marked as spam",
+    "deliveryRejected": "Rejected",
+    "undeliveredCurrentPage": "Not delivered (page)",
+    "undeliveredHint": "Accepted by the provider and returned afterwards",
+    "providerEvents": "Provider delivery events",
+    "noProviderEvents": "The provider has not reported anything about this message yet.",
+    "allRecipients": "All recipients",
+    "reportingMta": "Reported by",
     "statusReceivedShort": "Received: {count}",
     "statusReadShort": "Read: {count}",
     "statusErrorShort": "Errors: {count}",
@@ -1357,7 +1397,7 @@
     "fileUploaded": "File uploaded successfully.",
     "fileUploadFailed": "Failed to upload file.",
     "fileIdNotReturned": "File ID not returned.",
-    "temporaryOpenUrlNotReturned": "Temporary open URL not returned.",
+    "apiBaseUrlNotConfigured": "API base URL is not configured.",
     "uploadedFileAlt": "Uploaded file",
     "fileUrlPlaceholder": "File URL",
     "durationUnitSeconds": "Seconds",
@@ -1381,44 +1421,21 @@
     "oauthProfileEmptyState": "No OAuth profiles found.",
     "selectPaymentProfile": "Select a payment profile",
     "paymentProfileEmptyState": "No payment profiles found.",
-    "mailProfile": {
-      "nameLabel": "Name *",
-      "namePlaceholder": "My Mail Profile",
-      "fromEmailLabel": "From Email *",
-      "fromEmailPlaceholder": "no-reply@example.com",
-      "fromNameLabel": "Sender name",
-      "fromNamePlaceholder": "Sales Team",
-      "providerLabel": "Provider *",
-      "providers": {
-        "ses": "Amazon SES"
-      },
-      "smtpHostLabel": "SMTP Host *",
-      "smtpHostPlaceholder": "smtp.example.com",
-      "smtpPortLabel": "SMTP Port *",
-      "smtpPortPlaceholder": "587",
-      "smtpUsernameLabel": "SMTP Username *",
-      "smtpUsernamePlaceholder": "user@example.com",
-      "smtpPasswordLabel": "SMTP Password *",
-      "replyToEmailLabel": "Reply-to email",
-      "replyToEmailPlaceholder": "support@company.com",
-      "clientIdLabel": "Client ID *",
-      "clientSecretLabel": "Client Secret *",
-      "refreshTokenLabel": "Refresh Token *",
-      "accessKeyIdLabel": "Access Key ID *",
-      "secretAccessKeyLabel": "Secret Access Key *",
-      "regionLabel": "Region *",
-      "regionPlaceholder": "us-east-1"
-    },
-    "whatsappProfile": {
-      "nameLabel": "Name *",
-      "namePlaceholder": "My WhatsApp Profile",
-      "providerLabel": "Provider *",
-      "hostLabel": "API Host *",
-      "hostPlaceholder": "https://api.example.com",
-      "instanceNameLabel": "Instance Name *",
-      "instanceNamePlaceholder": "MyInstance",
-      "tokenLabel": "Token *",
-      "tokenPlaceholder": "Authentication token"
+    "whatsappProfileEmptyState": "No WhatsApp profiles found.",
+    "selectIntegrationProfile": "Select an integration profile",
+    "integrationProfileEmptyState": "No integration profiles found.",
+    "editProfileAria": "Edit {profile}",
+    "createProfileAria": "Create {profile}",
+    "profileTypeNames": {
+      "ai": "AI profile",
+      "email": "email profile",
+      "whatsapp": "WhatsApp profile",
+      "storage": "storage profile",
+      "oauth": "OAuth profile",
+      "payment": "payment profile",
+      "infrastructure": "infrastructure profile",
+      "kubernetes": "Kubernetes profile",
+      "generic": "integration profile"
     },
     "selectInfraProfile": "Select infrastructure profile",
     "infraProfileEmptyState": "No infrastructure profiles found. Create a DigitalOcean or Kubernetes profile first.",
@@ -1811,7 +1828,13 @@
     "decreaseZoom": "Decrease zoom",
     "resetZoom": "Reset zoom",
     "increaseZoom": "Increase zoom",
-    "saveAndClose": "Save and Close"
+    "saveAndClose": "Save and Close",
+    "aiEdit": "Edit with AI",
+    "aiEditPromptLabel": "What do you want to change?",
+    "aiEditPromptPlaceholder": "e.g., make the tone more formal and add a bullet list of next steps",
+    "aiEditSubmit": "Generate",
+    "aiEditSuccess": "Content updated by AI",
+    "aiEditError": "Could not update the content with AI"
   },
   "DashboardManagement": {
     "title": "Dashboard Management",
@@ -2403,7 +2426,14 @@
     "detailsDescription": "Full details of this access log entry",
     "os": "Operating System",
     "location": "Location",
-    "rawUserAgent": "User Agent"
+    "rawUserAgent": "User Agent",
+    "simulated": "Simulated",
+    "simulatedBy": "Simulated by {name}",
+    "simulatedAccess": "Simulated access",
+    "filterBySimulated": "Simulation",
+    "simulatedAll": "All accesses",
+    "simulatedOnly": "Simulated only",
+    "simulatedExclude": "Exclude simulated"
   },
   "IntegrationProfilePage": {
     "breadcrumbHome": "Home",
@@ -2509,6 +2539,7 @@
     "fieldFromName": "From Name",
     "fieldReplyTo": "Reply-To Email",
     "fieldReplyToName": "Reply-To Name",
+    "fieldSnsTopicArn": "SNS Topic ARN (delivery tracking)",
     "fieldClientId": "Client ID",
     "fieldClientSecret": "Client Secret",
     "fieldRefreshToken": "Refresh Token",
@@ -2516,6 +2547,7 @@
     "fieldSecretAccessKey": "Secret Access Key",
     "fieldRegion": "Region",
     "fieldDomain": "Domain",
+    "fieldImapSecure": "Direct TLS (port 993)",
     "fieldToken": "Token",
     "fieldInstanceName": "Instance Name",
     "fieldPhoneNumberId": "Phone Number ID",
@@ -2529,6 +2561,13 @@
     "fieldEnvironmentTest": "Test",
     "fieldEnvironmentProduction": "Production",
     "copiedToClipboard": "Copied to clipboard",
+    "sesWebhookSectionTitle": "Delivery tracking (SNS)",
+    "sesWebhookDescription": "Without this subscription the Hub only knows the provider accepted the message, not whether it was delivered.",
+    "sesWebhookEndpointLabel": "Endpoint URL",
+    "sesWebhookStep1": "Create an SNS topic in the same region as this SES profile.",
+    "sesWebhookStep2": "Add an HTTPS subscription to the topic using the URL above. It is confirmed automatically.",
+    "sesWebhookStep3": "In SES, open the sending identity and point Bounce, Complaint and Delivery notifications to that topic.",
+    "sesWebhookStep4": "Paste the topic ARN in the field above so events from other topics are rejected.",
     "whatsappWebhookSectionTitle": "Meta Webhook",
     "whatsappWebhookDescription": "Register this webhook in your Meta app to receive WhatsApp messages.",
     "whatsappWebhookCallbackUrlLabel": "Callback URL",
@@ -2674,7 +2713,9 @@
     "fieldTimeoutMs": "Timeout (ms)",
     "fieldMaxRetries": "Max retries",
     "fileStored": "A file is stored and encrypted. Click to replace it.",
-    "fileSelected": "New file selected. It will be encrypted on save."
+    "fileSelected": "New file selected. It will be encrypted on save.",
+    "fieldRtdnServiceAccount": "Notifications Service Account (RTDN)",
+    "fieldRtdnAudience": "Notifications Audience (RTDN)"
   },
   "SystemPagesPage": {
     "title": "Pages",
@@ -3008,7 +3049,18 @@
     "previewTitle": "HTML preview",
     "noContent": "No content to preview",
     "complexHtmlWarningTitle": "Complex HTML detected",
-    "complexHtmlWarningDesc": "This content has style, head or script tags that the visual editor removes. Use the HTML tab to edit it."
+    "complexHtmlWarningDesc": "This content has style, head or script tags that the visual editor removes. Use the HTML tab to edit it.",
+    "aiEditTitle": "Adjust HTML with AI",
+    "aiInstructionPlaceholder": "Describe the adjustment the AI should make to this HTML.",
+    "aiApplyButton": "Adjust with AI",
+    "aiApplying": "Adjusting...",
+    "aiEditAppliedDefault": "HTML adjusted by AI. Review before saving.",
+    "aiEditErrorDefault": "Could not adjust the HTML with AI.",
+    "enterFullscreen": "Fullscreen",
+    "exitFullscreen": "Exit fullscreen",
+    "enterSplitView": "View panels side by side",
+    "exitSplitView": "View as tabs",
+    "splitViewLabel": "Preview, HTML and AI side by side"
   },
   "MailLayoutPage": {
     "breadcrumbHome": "Home",
@@ -3032,5 +3084,51 @@
     "saveSuccess": "Base layout saved",
     "saveError": "Failed to save the base layout",
     "missingContentTokenError": "The wrapper must contain the {{{content}}} token, otherwise every email would be sent empty."
+  },
+  "KnownDevices": {
+    "title": "Known Devices",
+    "description": "Devices your account already recognizes. A sign-in from a device outside this list triggers an email alert.",
+    "adminDescription": "Devices this user's account already recognizes.",
+    "device": "Device",
+    "browser": "Browser",
+    "lastIp": "Last IP",
+    "lastSeen": "Last seen",
+    "firstSeen": "First seen",
+    "action": "Action",
+    "unknown": "Unknown",
+    "forget": "Forget",
+    "noDevices": "No recognized devices yet",
+    "forgetTitle": "Forget device",
+    "forgetDescription": "The next sign-in from this device will be treated as unrecognized and will trigger an email alert. Sessions already open on it stay valid — revoke the sessions to end those.",
+    "cancel": "Cancel",
+    "forgetSuccess": "Device forgotten",
+    "forgetFailure": "Could not forget the device",
+    "simulatedNotRecorded": "Simulated accesses are not recorded as devices — see the sessions tab."
+  },
+  "AccessSimulation": {
+    "action": "Simulate access",
+    "dialogTitle": "Simulate access",
+    "dialogDescription": "Open a short, audited session seeing the system as {name}. Everything you do is recorded under their name and yours.",
+    "targetApp": "Target application",
+    "targetAppPlaceholder": "Choose where to open the session",
+    "noAppsConfigured": "No application has a URL configured in the app-urls setting.",
+    "reason": "Reason (optional)",
+    "reasonPlaceholder": "Ticket, request or context for this simulation",
+    "auditWarning": "The simulation is recorded in the sessions, access log and activity timeline of both users. It lasts 30 minutes and cannot be renewed.",
+    "confirm": "Start simulation",
+    "cancel": "Cancel",
+    "opening": "Opening…",
+    "startFailure": "Could not start the access simulation.",
+    "bannerViewingAs": "SIMULATED ACCESS — you are seeing the system as",
+    "bannerOperator": "Operator",
+    "bannerExpiresIn": "expires in",
+    "bannerStop": "End simulation",
+    "bannerStopping": "Ending…",
+    "redeemLoading": "Starting access simulation…",
+    "redeemInvalidTitle": "Simulation link is no longer valid",
+    "redeemInvalidDescription": "This link works only once and expires after a minute. Ask the operator to start a new simulation.",
+    "redeemMissingCode": "No simulation code found in the link.",
+    "noAdminAccessTitle": "This user has no access to the admin panel",
+    "noAdminAccessDescription": "{name} has no administrative role, so there is nothing to show here. Simulate them in the application they actually use."
   }
 }