@hed-hog/core 0.0.399 → 0.0.400

package/hedhog/data/setting_group.yaml

@@ -165,8 +165,8 @@
           en: Batch Limit
           pt: Limite de Lote
         description:
-          en: Maximum number of records to delete per cleanup task execution. Smaller values prevent long table locks but increase cleanup duration
-          pt: Número máximo de registros a deletar por execução de tarefa de limpeza. Valores menores evitam locks prolongados mas aumentam a duração da limpeza
+          en: Maximum number of records to delete per batch. Cleanup repeats batches until the backlog is drained, so smaller values prevent long table locks but increase cleanup duration
+          pt: Número máximo de registros a deletar por lote. A limpeza repete os lotes até drenar o acúmulo, então valores menores evitam locks prolongados mas aumentam a duração da limpeza
         value: 20000
         user_override: false
         subgroup_id:
@@ -273,6 +273,10 @@
       - slug: mail-integration-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: email
+          excludeProviders:
+            - imap
         name:
           en: Mail Profile
           pt: Perfil de Email
@@ -323,6 +327,8 @@
       - slug: ai-openai-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: ai
         name:
           en: OpenAI Profile
           pt: Perfil OpenAI
@@ -337,6 +343,8 @@
       - slug: ai-gemini-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: ai
         name:
           en: Gemini Profile
           pt: Perfil Gemini
@@ -351,6 +359,8 @@
       - slug: ai-deepseek-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: ai
         name:
           en: DeepSeek Profile
           pt: Perfil DeepSeek
@@ -362,6 +372,20 @@
         subgroup_id:
           where:
             slug: ai-configuration
+      - slug: mcp-connector-denied-tools
+        type: array
+        component: input-tags
+        name:
+          en: Tools denied to connectors
+          pt: Ferramentas negadas ao conector
+        description:
+          en: Tools an external OAuth client (such as Claude) can never call, even when the person's role allows it. One per tag, by tool name.
+          pt: Ferramentas que um cliente OAuth externo (como o Claude) nunca pode chamar, mesmo que o papel da pessoa permita. Uma por tag, pelo nome da tool.
+        value: '["core.roles.create", "core.roles.delete", "core.roles.menus.update", "core.roles.routes.update", "core.roles.screens.update", "core.roles.update", "core.roles.users.update", "core.routes.create", "core.routes.delete", "core.routes.roles.update", "core.routes.screens.update", "core.routes.update", "core.screens.create", "core.screens.delete", "core.screens.roles.update", "core.screens.routes.update", "core.screens.update", "core.sessions.revoke", "core.sessions.revoke-all", "core.sessions.revoke-all-other", "core.settings.delete", "core.settings.set", "core.settings.set-many", "core.settings.update-from-slug", "core.users.assign-role", "core.users.create", "core.users.delete", "core.users.remove-role", "core.users.reset-password", "core.users.update", "core.users.verify-identifier"]'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: ai-configuration
       - slug: mcp-enabled
         type: boolean
         component: switch
@@ -379,6 +403,8 @@
       - slug: mcp-ai-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: ai
         name:
           en: AI Profile
           pt: Perfil de IA
@@ -407,6 +433,8 @@
       - slug: richtext-ai-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: ai
         name:
           en: AI Profile
           pt: Perfil de IA
@@ -890,6 +918,9 @@
       - slug: oauth-google-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: oauth
+          providerSlug: google-oauth
         name:
           en: Google OAuth Profile
           pt: Perfil OAuth Google
@@ -940,6 +971,9 @@
       - slug: oauth-facebook-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: oauth
+          providerSlug: facebook-oauth
         name:
           en: Facebook OAuth Profile
           pt: Perfil OAuth Facebook
@@ -994,6 +1028,9 @@
       - slug: oauth-github-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: oauth
+          providerSlug: github-oauth
         name:
           en: GitHub OAuth Profile
           pt: Perfil OAuth GitHub
@@ -1042,6 +1079,9 @@
       - slug: oauth-microsoft-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: oauth
+          providerSlug: microsoft-oauth
         name:
           en: Microsoft OAuth Profile
           pt: Perfil OAuth Microsoft
@@ -1096,6 +1136,9 @@
       - slug: oauth-microsoft-entra-id-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: oauth
+          providerSlug: microsoft-entra-id-oauth
         name:
           en: Microsoft Entra ID OAuth Profile
           pt: Perfil OAuth Microsoft Entra ID
@@ -1164,6 +1207,12 @@
               order: 13
             - value: OnlineMeetingRecording.Read.All
               order: 14
+            # Necessario para IMPORTAR o anexo do chat da reuniao: o download usa
+            # o token delegado da conta que le o chat, e sem escopo de arquivo o
+            # /shares/{id}/driveItem/content responde 403 — o material vira link
+            # para o arquivo original em vez do arquivo em si.
+            - value: Files.Read.All
+              order: 15
         subgroup_id:
           where:
             slug: microsoft-entra-id
@@ -1295,9 +1344,40 @@
         subgroup_id:
           where:
             slug: microsoft-entra-id
+      - slug: microsoft-meeting-chat-capture-enabled
+        type: boolean
+        component: switch
+        name:
+          en: Capture meeting chat
+          pt: Capturar o chat da reunião
+        description:
+          en: 'After a managed meeting ends, read its Teams chat so the source module can turn what the host shared into materials. Off by default: it reads what people wrote and needs a delegated account with Chat.Read.'
+          pt: 'Quando uma reunião gerenciada termina, ler o chat dela no Teams para o módulo de origem transformar o que o instrutor compartilhou em materiais. Desligado por padrão: lê o que as pessoas escreveram e exige conta delegada com Chat.Read.'
+        value: 'false'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-meeting-chat-delegated-upn
+        type: string
+        component: input-text
+        name:
+          en: Account that reads the chat
+          pt: Conta que lê o chat
+        description:
+          en: UPN of the account whose delegated token reads meeting chats. Empty uses the meeting service account, which organizes every meeting and is therefore in every meeting chat. It must be connected under My account, with Chat.Read granted.
+          pt: UPN da conta cujo token delegado lê os chats das reuniões. Vazio usa a conta de serviço das reuniões, que organiza todas e por isso participa de todos os chats. Ela precisa estar conectada em Minha conta, com Chat.Read concedido.
+        value: ''
+        user_override: false
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
       - slug: oauth-apple-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: oauth
+          providerSlug: apple-oauth
         name:
           en: Apple OAuth Profile
           pt: Perfil OAuth Apple
@@ -1346,6 +1426,9 @@
       - slug: oauth-linkedin-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: oauth
+          providerSlug: linkedin-oauth
         name:
           en: LinkedIn OAuth Profile
           pt: Perfil OAuth LinkedIn
@@ -2070,6 +2153,8 @@
       - slug: file-storage-profile-id
         type: string
         component: entity-picker
+        entity_filter:
+          typeSlug: storage
         name:
           en: Storage Profile
           pt: Perfil de Armazenamento
@@ -2088,7 +2173,7 @@
         description:
           en: MIME types accepted for file uploads (e.g., images, documents, videos)
           pt: Tipos MIME aceitos para upload de arquivos (por exemplo, imagens, documentos, vídeos)
-        value: '["application/pdf","image/jpeg","image/png","image/gif"]'
+        value: '["application/pdf","image/jpeg","image/png","image/gif","text/html"]'
         component: checkbox
         relations:
           setting_list:
@@ -2134,6 +2219,8 @@
               order: 16
             - value: audio/flac
               order: 17
+            - value: text/html
+              order: 18
         subgroup_id:
           where:
             slug: storage-general
@@ -2149,6 +2236,53 @@
         subgroup_id:
           where:
             slug: storage-general
+      # Validade da URL assinada de upload (PUT /file/upload/:token). Curta de
+      # proposito: o token e a unica credencial do endpoint publico, e o cliente
+      # sobe o arquivo logo depois de pedir a URL.
+      - slug: storage-upload-url-ttl
+        type: number
+        name:
+          en: Upload URL Lifetime (seconds)
+          pt: Validade da URL de Upload (segundos)
+        description:
+          en: How long a signed upload URL stays valid. The token is single use and scoped to one upload ticket.
+          pt: Por quanto tempo uma URL assinada de upload continua valida. O token e de uso unico e vale para um unico ticket de upload.
+        value: 900
+        component: input-number
+        subgroup_id:
+          where:
+            slug: storage-general
+      # Tamanho de cada parte no upload em partes pelo MCP. O teto real e o limite
+      # de saida do modelo: base64 infla ~33%, entao 64 KiB viram ~87 mil
+      # caracteres por chamada.
+      - slug: mcp-upload-chunk-bytes
+        type: number
+        name:
+          en: MCP Upload Chunk Size (bytes)
+          pt: Tamanho da Parte no Upload MCP (bytes)
+        description:
+          en: Chunk size for core.files.upload.append. Larger chunks mean fewer calls but risk overflowing the model output limit once base64-encoded.
+          pt: Tamanho de cada parte em core.files.upload.append. Partes maiores significam menos chamadas, mas arriscam estourar o limite de saida do modelo depois de codificadas em base64.
+        value: 65536
+        component: input-number
+        subgroup_id:
+          where:
+            slug: storage-general
+      # Allowlist opcional para a modalidade fileUrl. Vazia = qualquer host
+      # publico (enderecos privados sao recusados de qualquer forma).
+      - slug: mcp-file-url-allowed-hosts
+        type: string
+        name:
+          en: Allowed Hosts for File URLs
+          pt: Hosts Permitidos para URL de Arquivo
+        description:
+          en: Comma-separated hostnames the server may download from when a tool receives fileUrl. Leave empty to allow any public host. Private, loopback, link-local and metadata addresses are always rejected.
+          pt: Nomes de host separados por virgula dos quais o servidor pode baixar quando uma tool recebe fileUrl. Deixe vazio para permitir qualquer host publico. Enderecos privados, loopback, link-local e de metadados sao sempre recusados.
+        value: ''
+        component: input-text
+        subgroup_id:
+          where:
+            slug: storage-general
       - slug: image-compression-enabled
         type: boolean
         component: switch

package/hedhog/frontend/app/access-log/page.tsx.ejs

@@ -31,7 +31,8 @@ import {
   TableRow,
 } from '@/components/ui/table';
 import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group';
-import { useDebounce } from '@/hooks/use-debounce';
+import { DateRangePicker } from '@/components/ui/date-range-picker';
+import { useListUrlState } from '@/hooks/use-list-url-state';
 import { usePersistedPageSize } from '@/hooks/use-persisted-page-size';
 import { formatDateTime } from '@/lib/format-date';
 import { getPhotoUrl } from '@/lib/get-photo-url';
@@ -124,15 +125,33 @@ export default function AccessLogPage() {
   const [selectedUserId, setSelectedUserId] = useState<number | null>(null);
   const [isUserSheetOpen, setIsUserSheetOpen] = useState(false);
 
-  const [searchTerm, setSearchTerm] = useState('');
-  const [filterUserId, setFilterUserId] = useState<number | null>(null);
-  const [typeFilter, setTypeFilter] = useState<TypeFilter>('all');
-  const [simulatedFilter, setSimulatedFilter] = useState<SimulatedFilter>('all');
-  const [createdAtFrom, setCreatedAtFrom] = useState('');
-  const [createdAtTo, setCreatedAtTo] = useState('');
+  // Busca, filtros e página vivem na URL: voltar do detalhe de um log
+  // recupera a mesma consulta, e o link pode ser passado adiante.
+  const urlState = useListUrlState({
+    filters: {
+      userId: { param: 'userId', defaultValue: '' },
+      type: { param: 'type', defaultValue: 'all' },
+      simulated: { param: 'simulated', defaultValue: 'all' },
+      createdAtFrom: { param: 'createdAtFrom', defaultValue: '' },
+      createdAtTo: { param: 'createdAtTo', defaultValue: '' },
+    },
+  });
+  const {
+    search: searchTerm,
+    setSearch: setSearchTerm,
+    debouncedSearch,
+    page,
+    setPage,
+  } = urlState;
+  const filterUserId = urlState.filters.userId
+    ? Number(urlState.filters.userId)
+    : null;
+  const typeFilter = urlState.filters.type as TypeFilter;
+  const simulatedFilter = urlState.filters.simulated as SimulatedFilter;
+  const createdAtFrom = urlState.filters.createdAtFrom;
+  const createdAtTo = urlState.filters.createdAtTo;
   const [viewMode, setViewMode] = useState<ViewMode>('table');
   const [isLive, setIsLive] = useState(true);
-  const [page, setPage] = useState(1);
   const { data: generalSettings } = useQuery<{
     data: Array<{ slug: string; value: string }>;
   }>({
@@ -169,8 +188,6 @@ export default function AccessLogPage() {
     allowedValues: pageSizeOptions,
   });
 
-  const debouncedSearch = useDebounce(searchTerm);
-
   const {
     data: logsResult,
     isLoading,
@@ -218,12 +235,11 @@ export default function AccessLogPage() {
 
   const clearFilters = () => {
     setSearchTerm('');
-    setFilterUserId(null);
-    setTypeFilter('all');
-    setSimulatedFilter('all');
-    setCreatedAtFrom('');
-    setCreatedAtTo('');
-    setPage(1);
+    urlState.setFilter('userId', '');
+    urlState.setFilter('type', 'all');
+    urlState.setFilter('simulated', 'all');
+    urlState.setFilter('createdAtFrom', '');
+    urlState.setFilter('createdAtTo', '');
   };
 
   const searchControls = useMemo<SearchBarControl[]>(
@@ -232,10 +248,7 @@ export default function AccessLogPage() {
         id: 'type',
         type: 'select',
         value: typeFilter,
-        onChange: (value) => {
-          setTypeFilter(value as TypeFilter);
-          setPage(1);
-        },
+        onChange: (value) => urlState.setFilter('type', value),
         placeholder: t('filterByType'),
         options: [
           { value: 'all', label: t('typeAll') },
@@ -247,10 +260,7 @@ export default function AccessLogPage() {
         id: 'simulated',
         type: 'select',
         value: simulatedFilter,
-        onChange: (value) => {
-          setSimulatedFilter(value as SimulatedFilter);
-          setPage(1);
-        },
+        onChange: (value) => urlState.setFilter('simulated', value),
         placeholder: t('filterBySimulated'),
         options: [
           { value: 'all', label: t('simulatedAll') },
@@ -258,28 +268,9 @@ export default function AccessLogPage() {
           { value: 'exclude', label: t('simulatedExclude') },
         ],
       },
-      {
-        id: 'created-at-from',
-        type: 'date',
-        value: createdAtFrom,
-        onChange: (value) => {
-          setCreatedAtFrom(value);
-          setPage(1);
-        },
-        max: createdAtTo || undefined,
-      },
-      {
-        id: 'created-at-to',
-        type: 'date',
-        value: createdAtTo,
-        onChange: (value) => {
-          setCreatedAtTo(value);
-          setPage(1);
-        },
-        min: createdAtFrom || undefined,
-      },
     ],
-    [createdAtFrom, createdAtTo, typeFilter, simulatedFilter, t]
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [typeFilter, simulatedFilter, t]
   );
 
   const kpiCards = useMemo<KpiCardItem[]>(() => {
@@ -441,10 +432,7 @@ export default function AccessLogPage() {
         <div className="flex-1">
           <SearchBar
             searchQuery={searchTerm}
-            onSearchChange={(v) => {
-              setSearchTerm(v);
-              setPage(1);
-            }}
+            onSearchChange={setSearchTerm}
             onSearch={() => setPage(1)}
             placeholder={t('searchPlaceholder')}
             controls={searchControls}
@@ -452,6 +440,15 @@ export default function AccessLogPage() {
         </div>
 
         <div className="flex flex-col gap-2 sm:flex-row sm:flex-wrap xl:justify-end">
+          <DateRangePicker
+            fromDate={createdAtFrom}
+            toDate={createdAtTo}
+            onFromDateChange={(value) =>
+              urlState.setFilter('createdAtFrom', value)
+            }
+            onToDateChange={(value) => urlState.setFilter('createdAtTo', value)}
+          />
+
           <EntityPicker<UserPickerOption>
             placeholder={t('userPickerPlaceholder')}
             emptySelectionLabel={t('userPickerPlaceholder')}
@@ -459,10 +456,7 @@ export default function AccessLogPage() {
             clearable
             allowEmptySelection
             value={filterUserId !== null ? String(filterUserId) : ''}
-            onChange={(val) => {
-              setFilterUserId(val ? Number(val) : null);
-              setPage(1);
-            }}
+            onChange={(val) => urlState.setFilter('userId', val ? String(val) : '')}
             getOptionValue={(o) => o.id}
             getOptionLabel={(o) => o.name}
             loadOptions={async ({ page, pageSize, search }) => {

package/hedhog/frontend/app/account/components/active-sessions.tsx.ejs

@@ -33,7 +33,7 @@ import { formatDate, formatDateTime } from '@/lib/format-date';
 import { parseBrowser, parseDeviceType, parseOS } from '@/lib/session';
 import { UserSession } from '@hed-hog/api-types';
 import { useApp, useQuery } from '@hed-hog/next-app-provider';
-import { Calendar, Clock, LogOut, MapPin, VenetianMask } from 'lucide-react';
+import { Calendar, Clock, LogOut, MapPin, Plug, VenetianMask } from 'lucide-react';
 import { useTranslations } from 'next-intl';
 import { useMemo, useState } from 'react';
 import { toast } from 'sonner';
@@ -288,12 +288,33 @@ function SessionRow({
       <TableCell>
         <div className="flex items-center gap-3">
           <div>
-            <p className="font-medium capitalize">
-              {parseDeviceType(session.user_agent)}
-            </p>
-            <p className="text-xs text-muted-foreground">
-              {parseOS(session.user_agent)}
-            </p>
+            {/* Sessão de app conectado (OAuth) não tem dispositivo para mostrar:
+                ela nasce na nuvem do fornecedor, com um user agent que o parser
+                não reconhece e geolocalizada no país dele. Repetir isso aqui faz
+                a linha parecer invasão de conta — o nome do app é a informação
+                que o usuário precisa para reconhecer o que autorizou. */}
+            {session.oauth_client ? (
+              <p className="font-medium">{session.oauth_client.name}</p>
+            ) : (
+              <>
+                <p className="font-medium capitalize">
+                  {parseDeviceType(session.user_agent)}
+                </p>
+                <p className="text-xs text-muted-foreground">
+                  {parseOS(session.user_agent)}
+                </p>
+              </>
+            )}
+
+            {session.oauth_client && (
+              <Badge
+                variant="outline"
+                className="mt-1 border-sky-500/30 bg-sky-500/10 text-xs text-sky-700"
+              >
+                <Plug className="mr-1 size-3" />
+                {t('connectedApp')}
+              </Badge>
+            )}
             {/* Esta é a tela de segurança do próprio usuário: é aqui que ele
                 precisa enxergar que alguém entrou na conta dele por simulação
                 de acesso, e quem foi. */}
@@ -314,7 +335,11 @@ function SessionRow({
         </div>
       </TableCell>
       <TableCell>
-        <div>{parseBrowser(session.user_agent)}</div>
+        <div>
+          {session.oauth_client
+            ? t('viaConnector')
+            : parseBrowser(session.user_agent)}
+        </div>
 
         {session.revoked_at === null && (
           <Badge variant="default" className="mt-1 text-xs">

package/hedhog/frontend/app/account/components/mcp-tokens.tsx.ejs

@@ -165,7 +165,9 @@ export function McpTokens() {
         <CardHeader className="flex flex-row items-start justify-between">
           <div>
             <CardTitle>{t('title')}</CardTitle>
-            <CardDescription className="mt-1">{t('description')}</CardDescription>
+            <CardDescription className="mt-1">
+              {t('description')}
+            </CardDescription>
           </div>
           <Button size="sm" onClick={() => setIsCreateDialogOpen(true)}>
             <Plus className="size-4 mr-2" />
@@ -174,10 +176,22 @@ export function McpTokens() {
         </CardHeader>
         <CardContent className="space-y-4">
           <div className="flex items-center gap-2 rounded-md border bg-muted/40 px-3 py-2">
-            <span className="text-sm text-muted-foreground shrink-0">{t('mcpUrlLabel')}:</span>
+            <span className="text-sm text-muted-foreground shrink-0">
+              {t('mcpUrlLabel')}:
+            </span>
             <code className="flex-1 text-sm break-all">{mcpUrl}</code>
-            <Button variant="ghost" size="icon" className="size-7 shrink-0" onClick={handleCopyUrl}>
-              {isCopiedUrl ? <Check className="size-3.5 text-green-500" /> : <Copy className="size-3.5" />}
+            <Button
+              variant="ghost"
+              size="icon"
+              className="size-7 shrink-0"
+              onClick={handleCopyUrl}
+              tooltip={t('copyUrl')}
+            >
+              {isCopiedUrl ? (
+                <Check className="size-3.5 text-green-500" />
+              ) : (
+                <Copy className="size-3.5" />
+              )}
             </Button>
           </div>
 
@@ -207,7 +221,9 @@ export function McpTokens() {
                       </code>
                     </TableCell>
                     <TableCell className="text-muted-foreground text-sm">
-                      {key.last_used_at ? formatDateTime(key.last_used_at, getSettingValue) : t('never')}
+                      {key.last_used_at
+                        ? formatDateTime(key.last_used_at, getSettingValue)
+                        : t('never')}
                     </TableCell>
                     <TableCell className="text-muted-foreground text-sm">
                       {formatDateTime(key.created_at, getSettingValue)}
@@ -218,6 +234,7 @@ export function McpTokens() {
                         size="icon"
                         className="size-8 text-destructive hover:text-destructive"
                         onClick={() => setKeyToRevoke(key.id)}
+                        tooltip={t('revoke')}
                       >
                         <Trash2 className="size-4" />
                       </Button>
@@ -243,11 +260,16 @@ export function McpTokens() {
       </Card>
 
       {/* Revoke confirmation */}
-      <AlertDialog open={keyToRevoke !== null} onOpenChange={(open) => !open && setKeyToRevoke(null)}>
+      <AlertDialog
+        open={keyToRevoke !== null}
+        onOpenChange={(open) => !open && setKeyToRevoke(null)}
+      >
         <AlertDialogContent>
           <AlertDialogHeader>
             <AlertDialogTitle>{t('revokeTokenTitle')}</AlertDialogTitle>
-            <AlertDialogDescription>{t('revokeTokenDescription')}</AlertDialogDescription>
+            <AlertDialogDescription>
+              {t('revokeTokenDescription')}
+            </AlertDialogDescription>
           </AlertDialogHeader>
           <AlertDialogFooter>
             <AlertDialogCancel>{t('cancel')}</AlertDialogCancel>
@@ -262,13 +284,18 @@ export function McpTokens() {
       </AlertDialog>
 
       {/* Create token dialog */}
-      <Dialog open={isCreateDialogOpen} onOpenChange={(open) => !open && handleCloseCreateDialog()}>
+      <Dialog
+        open={isCreateDialogOpen}
+        onOpenChange={(open) => !open && handleCloseCreateDialog()}
+      >
         <DialogContent className="sm:max-w-md">
           {createdToken === null ? (
             <>
               <DialogHeader>
                 <DialogTitle>{t('createTokenTitle')}</DialogTitle>
-                <DialogDescription>{t('createTokenDescription')}</DialogDescription>
+                <DialogDescription>
+                  {t('createTokenDescription')}
+                </DialogDescription>
               </DialogHeader>
               <div className="space-y-2 py-2">
                 <Label htmlFor="token-name">{t('tokenNameLabel')}</Label>
@@ -281,7 +308,9 @@ export function McpTokens() {
                 />
               </div>
               <DialogFooter>
-                <Button variant="outline" onClick={handleCloseCreateDialog}>{t('cancel')}</Button>
+                <Button variant="outline" onClick={handleCloseCreateDialog}>
+                  {t('cancel')}
+                </Button>
                 <Button onClick={handleCreate} disabled={!newKeyName.trim()}>
                   {t('createToken')}
                 </Button>
@@ -302,14 +331,26 @@ export function McpTokens() {
                     <code className="flex-1 rounded border bg-muted px-3 py-2 text-xs break-all">
                       {createdToken}
                     </code>
-                    <Button variant="outline" size="icon" onClick={handleCopyToken} className="shrink-0">
-                      {isCopied ? <Check className="size-4 text-green-500" /> : <Copy className="size-4" />}
+                    <Button
+                      variant="outline"
+                      size="icon"
+                      onClick={handleCopyToken}
+                      className="shrink-0"
+                      tooltip={t('copyToken')}
+                    >
+                      {isCopied ? (
+                        <Check className="size-4 text-green-500" />
+                      ) : (
+                        <Copy className="size-4" />
+                      )}
                     </Button>
                   </div>
                 </div>
               </div>
               <DialogFooter>
-                <Button onClick={handleCloseCreateDialog}>{t('closeDialog')}</Button>
+                <Button onClick={handleCloseCreateDialog}>
+                  {t('closeDialog')}
+                </Button>
               </DialogFooter>
             </>
           )}

package/hedhog/frontend/app/account/components/mfa-method-card.tsx.ejs

@@ -75,6 +75,7 @@ export function MfaMethodCard({
             setEditName(method.name);
             setIsEditOpen(true);
           }}
+          tooltip={t('editMfaName')}
         >
           <Edit2 className="w-4 h-4" />
         </Button>
@@ -106,7 +107,12 @@ export function MfaMethodCard({
             </form>
           </DialogContent>
         </Dialog>
-        <Button variant="ghost" size="icon" onClick={() => onRemove(method)}>
+        <Button
+          variant="ghost"
+          size="icon"
+          onClick={() => onRemove(method)}
+          tooltip={t('removeMfa')}
+        >
           <Trash2 className="size-4 text-destructive" />
         </Button>
       </div>

package/hedhog/frontend/app/account/components/recovery-codes-dialog.tsx.ejs

@@ -122,6 +122,7 @@ export function RecoveryCodesDialog({
                     variant="ghost"
                     size="icon"
                     onClick={() => handleCopyCode(code)}
+                    tooltip={t('copyCode')}
                   >
                     <Copy className="w-4 h-4" />
                   </Button>