@jeffusion/bungee-core 5.26.0 → 6.0.1

package/dist/plugins/user-auth/manifest.json

@@ -0,0 +1,735 @@
+{
+  "name": "user-auth",
+  "version": "1.0.0",
+  "schemaVersion": 3,
+  "artifactKind": "runtime-plugin",
+  "main": "index.js",
+  "capabilities": [
+    "hooks",
+    "api",
+    "dynamicRuntimeLoad",
+    "controlPlane",
+    "nativeWidgetsStatic"
+  ],
+  "uiExtensionMode": "native-static",
+  "engines": {
+    "bungee": "^6.0.0"
+  },
+  "runtimeScope": "global",
+  "control": {
+    "entry": "control.js",
+    "rpc": []
+  },
+  "management": {
+    "loginComponent": "UserAuthLogin",
+    "setupComponent": "UserAuthSetup"
+  },
+  "builtin": true,
+  "ui": {
+    "components": [
+      {
+        "name": "UserAuthSettings",
+        "entry": "ui/Settings.svelte"
+      },
+      {
+        "name": "UserAuthUsers",
+        "entry": "ui/Users.svelte"
+      },
+      {
+        "name": "UserAuthProfile",
+        "entry": "ui/Profile.svelte"
+      },
+      {
+        "name": "UserAuthLogin",
+        "entry": "ui/Login.svelte"
+      },
+      {
+        "name": "UserAuthSetup",
+        "entry": "ui/Setup.svelte"
+      }
+    ]
+  },
+  "contributes": {
+    "api": [
+      {
+        "path": "/password",
+        "methods": [
+          "POST"
+        ],
+        "handler": "changePassword",
+        "execution": "control",
+        "capability": "self.password"
+      },
+      {
+        "path": "/session-policy",
+        "methods": [
+          "GET",
+          "PUT"
+        ],
+        "handler": "sessionPolicy",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/logout",
+        "methods": [
+          "POST"
+        ],
+        "handler": "logout",
+        "execution": "control",
+        "capability": "self.logout"
+      },
+      {
+        "path": "/self",
+        "methods": [
+          "GET"
+        ],
+        "handler": "self",
+        "execution": "control",
+        "capability": "self.password"
+      },
+      {
+        "path": "/users",
+        "methods": [
+          "GET",
+          "POST"
+        ],
+        "handler": "users",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/users/update",
+        "methods": [
+          "PUT"
+        ],
+        "handler": "updateUser",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/users/password",
+        "methods": [
+          "POST"
+        ],
+        "handler": "resetUserPassword",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/identities",
+        "methods": [
+          "GET",
+          "POST",
+          "DELETE"
+        ],
+        "handler": "identities",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/login-connections",
+        "methods": [
+          "GET",
+          "POST",
+          "PUT",
+          "DELETE"
+        ],
+        "handler": "loginConnections",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/login-connections/discover",
+        "methods": [
+          "POST"
+        ],
+        "handler": "discoverLoginConnection",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/login-settings",
+        "methods": [
+          "GET",
+          "PUT"
+        ],
+        "handler": "loginSettings",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/turnstile",
+        "methods": [
+          "GET",
+          "PUT"
+        ],
+        "handler": "turnstile",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/identities/link/start",
+        "methods": [
+          "POST"
+        ],
+        "handler": "beginIdentityLink",
+        "execution": "control",
+        "capability": "config.write"
+      },
+      {
+        "path": "/identities/link/finish",
+        "methods": [
+          "POST"
+        ],
+        "handler": "finishIdentityLink",
+        "execution": "control",
+        "capability": "config.write"
+      }
+    ],
+    "navigation": [
+      {
+        "label": "users.title",
+        "path": "/users",
+        "component": "UserAuthUsers",
+        "icon": "group",
+        "target": "header"
+      },
+      {
+        "label": "profile.title",
+        "path": "/profile",
+        "component": "UserAuthProfile",
+        "icon": "person",
+        "target": "header"
+      }
+    ],
+    "settings": "/settings",
+    "nativeSettingsComponent": "UserAuthSettings"
+  },
+  "metadata": {
+    "name": "metadata.name",
+    "description": "metadata.description",
+    "icon": "manage_accounts"
+  },
+  "configSchema": [],
+  "translations": {
+    "zh-CN": {
+      "metadata.name": "用户认证",
+      "metadata.description": "本地密码、第三方登录与人机验证",
+      "login.title": "账号登录",
+      "login.username": "账号",
+      "login.password": "密码",
+      "login.busy": "正在登录…",
+      "login.submit": "登录",
+      "login.technicalDetails": "技术详情",
+      "login.correctAddress": "使用正确地址：{origin}",
+      "login.errors.invalid_credentials": "账号或密码不正确。请重新输入。",
+      "login.errors.invalid_input": "账号格式不正确。账号名只允许字母、数字及 _ . @ -，长度为 1–64。",
+      "login.errors.forbidden": "当前登录请求无法完成。请刷新后重试。",
+      "login.errors.unauthorized": "登录会话未建立。请重新登录。",
+      "login.errors.invalid_origin": "当前访问地址与服务配置不匹配。请使用配置的公开地址登录，或请部署管理员调整公开地址。",
+      "login.errors.invalid_csrf": "当前会话或访问地址校验失败。请从配置的公开地址重新登录。",
+      "login.errors.login_limited": "登录尝试过多。请等待 15 分钟后重试。",
+      "login.errors.session_limit": "登录会话已达到上限。请退出不再使用的会话后重试。",
+      "login.errors.management_provider_unavailable": "账号服务暂时不可用。请检查服务状态，恢复后重试。",
+      "login.errors.provider_unavailable": "账号服务暂时不可用。请检查服务状态，恢复后重试。",
+      "login.errors.control_recovering": "账号服务正在恢复。请稍候重试。",
+      "login.errors.session_unavailable": "登录尚未完成。请检查连接后重试，或刷新管理访问状态。",
+      "login.errors.unknown": "登录未完成。请检查连接后重试。",
+      "recovery.summary": "忘记账号或密码？",
+      "recovery.intro": "请在部署服务器上恢复账号。",
+      "recovery.step1": "确认目标实例的配置数据库路径，停止该实例的全部进程并备份数据。",
+      "recovery.step2": "在原部署目录、使用原数据位置和环境变量执行下面的命令。",
+      "recovery.step3": "按提示设置账号和新密码，然后重新启动实例。",
+      "recovery.docker": "停止原容器，使用同一镜像、原数据卷和环境变量启动临时交互容器，在 /usr/app 中执行下方命令。数据库路径须指向原实例，必要时覆盖 entrypoint，并保持终端交互（TTY）。完成后删除临时容器，启动原容器。",
+      "settings.accountTitle": "当前账号",
+      "settings.accountTag": "账号",
+      "settings.passwordTag": "密码",
+      "settings.loading": "正在加载…",
+      "settings.passwordTitle": "修改登录密码",
+      "settings.passwordDescription": "修改密码会退出该账号的所有会话。",
+      "settings.currentPassword": "当前密码",
+      "settings.newPassword": "新密码（5–32 个字符）",
+      "settings.confirmation": "确认新密码",
+      "settings.updating": "正在更新…",
+      "settings.submit": "修改并重新登录",
+      "settings.logout": "退出当前会话",
+      "session.title": "登录会话",
+      "session.tag": "有效期",
+      "session.noIdleTimeout": "不限制",
+      "session.description": "仅对新登录生效。空闲超时设为 0 可关闭，最长有效期不超过 30 天。",
+      "session.idle": "空闲超时",
+      "session.absolute": "登录最长有效期",
+      "session.minutes": "分钟",
+      "session.hours": "小时",
+      "session.days": "天",
+      "session.unit": "时长单位",
+      "session.loading": "正在读取会话设置",
+      "session.save": "保存会话设置",
+      "session.saving": "正在保存…",
+      "session.saved": "已保存，下次登录生效。",
+      "session.invalid": "请输入整数时长，最长 30 天；登录最长有效期至少为 1 分钟。",
+      "session.conflict": "设置已被其他页面修改。请重新读取后再保存。",
+      "session.failed": "会话设置读取或保存失败。",
+      "session.reload": "重新读取",
+      "setup.title": "初始化认证",
+      "setup.description": "初始化码由部署服务器签发，30 分钟内有效。",
+      "setup.code": "一次性初始化码",
+      "setup.password": "密码（5–32 个字符）",
+      "setup.confirmation": "确认密码",
+      "setup.submit": "初始化账号",
+      "setup.busy": "正在初始化…",
+      "setup.failed": "未能确认初始化结果。请检查连接后重试。",
+      "setup.invalid_setup_code": "初始化码无效或已过期，请在部署服务器重新签发。",
+      "setup.password_confirmation": "两次输入的密码不一致。",
+      "setup.invalid_password": "密码须为 5–32 个字符。",
+      "setup.already_initialized": "认证已初始化，请前往登录。",
+      "settings.errors.invalid_password": "密码须为 5–32 个字符。",
+      "settings.errors.password_confirmation": "两次输入的密码不一致。",
+      "settings.errors.password_unchanged": "新密码须与当前密码不同。",
+      "settings.errors.failed": "账号操作失败。",
+      "session.increase": "增加时长",
+      "session.decrease": "减少时长",
+      "login.retryChallenge": "重试验证",
+      "login.challengeFailed": "人机验证不可用，请重试。",
+      "login.errors.turnstile_required": "请完成人机验证。",
+      "login.errors.turnstile_failed": "人机验证未通过，请重新验证。",
+      "login.errors.unknown_identity": "该外部身份尚未绑定用户，请联系管理员。",
+      "login.errors.disabled_user": "该用户已被禁用。",
+      "login.errors.invalid_oidc_flow": "外部登录流程无效或已过期，请重新登录。",
+      "login.errors.oauth_client_rejected": "GitHub 拒绝应用凭据，请检查该连接的 Client ID 和 Client Secret。",
+      "login.errors.oauth_callback_mismatch": "GitHub 回调地址不匹配，请核对应用中登记的回调地址。",
+      "login.errors.oauth_code_rejected": "GitHub 授权码无效或已过期，请重新发起授权。",
+      "login.errors.oauth_email_unverified": "请先在 GitHub 验证主邮箱，再重新发起授权。",
+      "login.errors.oauth_token_failed": "未能验证 GitHub 授权响应，请重新授权或检查连接配置。",
+      "login.errors.oidc_failed": "外部登录失败，请重新登录。",
+      "login.errors.identity_connection_mismatch": "外部身份所属连接不匹配，请联系管理员。",
+      "admin.edit": "编辑",
+      "admin.save": "保存",
+      "admin.saved": "已保存。",
+      "admin.secretRetained": "已配置，留空保留",
+      "users.title": "用户管理",
+      "users.access": "所有已登录用户拥有完整管理能力。",
+      "users.enabled": "启用",
+      "users.disabled": "停用",
+      "users.local": "有本地密码",
+      "users.sso": "仅外部身份",
+      "users.reset": "重设密码",
+      "users.toggle": "启用用户",
+      "users.new": "创建用户",
+      "users.edit": "编辑用户",
+      "users.displayName": "显示名称",
+      "users.password": "用户密码（5–32 个字符）",
+      "users.confirmation": "确认用户密码",
+      "users.optionalPassword": "留空则不设置本地密码。",
+      "users.revokes": "重设密码会退出该用户的所有会话。",
+      "users.identities": "第三方登录绑定",
+      "users.bindingNote": "绑定或解绑会退出该账号的所有会话。",
+      "users.unbind": "解除绑定",
+      "turnstile.title": "Turnstile 人机验证",
+      "turnstile.description": "启用后，本地密码登录需完成人机验证。",
+      "turnstile.enabled": "启用 Turnstile",
+      "turnstile.siteKey": "Site key",
+      "turnstile.secret": "Turnstile secret",
+      "turnstile.hostnames": "允许的 hostname（每行一个）",
+      "turnstile.save": "保存配置",
+      "turnstile.configure": "配置",
+      "turnstile.saveEnable": "保存并启用",
+      "turnstile.saveDisable": "保存并停用",
+      "turnstile.pending": "更改未保存",
+      "turnstile.configuredDisabled": "已配置，未启用",
+      "turnstile.active": "已启用",
+      "turnstile.inactive": "未启用",
+      "admin.errors.version_conflict": "设置已被其他页面修改，已重新读取。请重新编辑后保存。",
+      "admin.errors.invalid_input": "输入格式无效，请检查各字段。",
+      "admin.errors.last_local_user": "不能禁用最后一个启用的本地密码用户。",
+      "admin.errors.username_exists": "用户名已存在。",
+      "admin.errors.identity_exists": "该外部身份已经绑定。",
+      "admin.errors.invalid_password": "密码须为 5–32 个字符。",
+      "admin.errors.password_confirmation": "两次输入的密码不一致。",
+      "admin.errors.turnstile_incomplete": "开启前请完整配置 site key、secret 和允许的 hostname。",
+      "admin.errors.oidc_secret_required": "请配置 Client secret。",
+      "admin.errors.invalid_origin": "公开管理地址不可用，请检查 BUNGEE_PUBLIC_ORIGIN。",
+      "admin.errors.management_origin_required": "请配置固定回调地址 BUNGEE_PUBLIC_ORIGIN 后重启服务。",
+      "admin.errors.oidc_unavailable": "该登录连接不可用，请检查是否已启用并配置凭据。",
+      "settings.title": "登录管理",
+      "profile.title": "用户信息",
+      "profile.noPassword": "尚未设置本地密码，可在用户管理中设置。",
+      "profile.noConnections": "暂无可绑定的登录方式。",
+      "users.empty": "暂无用户。",
+      "users.editDescription": "账号以英文字母或数字开头，可包含 _ . @ -。",
+      "admin.close": "关闭",
+      "admin.cancel": "取消",
+      "connections.title": "第三方登录",
+      "connections.connection": "身份连接",
+      "connections.autoCreate": "自动创建第三方登录用户",
+      "connections.autoCreateWarning": "开启后，所有已启用连接的新用户均可自动创建账号，并获得完整管理权限。",
+      "connections.new": "添加第三方登录",
+      "connections.edit": "编辑第三方登录",
+      "connections.editor": "第三方登录表单",
+      "connections.enabled": "启用连接",
+      "connections.label": "连接显示名称",
+      "connections.issuer": "Issuer URL",
+      "connections.clientId": "Client ID",
+      "connections.secret": "Client secret",
+      "connections.scopes": "Scopes（空格分隔）",
+      "connections.callback": "回调地址",
+      "connections.missingOrigin": "请先配置公开管理地址 BUNGEE_PUBLIC_ORIGIN。",
+      "connections.empty": "尚未添加第三方登录。",
+      "connections.description": "选择提供商并配置应用凭据。",
+      "connections.delete": "删除第三方登录",
+      "connections.deleteWarning": "删除后将清理该连接的外部身份绑定，退出受影响用户的所有会话，并取消未完成的登录。平台用户保留。",
+      "connections.search": "搜索连接",
+      "connections.status": "状态",
+      "connections.all": "全部状态",
+      "connections.actions": "操作",
+      "connections.enable": "启用",
+      "connections.disable": "停用",
+      "connections.remove": "删除",
+      "connections.noMatches": "没有匹配的连接。",
+      "login.methods": "外部身份登录",
+      "connections.provider": "提供商",
+      "connections.providerFixed": "提供商不可修改；如需更换，请删除后重新添加。",
+      "connections.saveNote": "新连接默认停用。保存仅记录配置，不代表登录已验证成功。",
+      "connections.saved": "配置已保存，尚未验证实际登录。",
+      "connections.copy": "复制回调地址",
+      "connections.copied": "已复制",
+      "connections.copyFailed": "复制失败，请手动复制回调地址。",
+      "connections.createApp": "创建应用 ↗",
+      "connections.oidcGuide": "OIDC 配置指南 ↗",
+      "connections.accountType": "账号范围",
+      "connections.mode": "配置方式",
+      "connections.modeIssuer": "Issuer 自动发现",
+      "connections.modeDiscovery": "Discovery URL",
+      "connections.modeManual": "手动配置",
+      "connections.discoveryUrl": "Discovery URL",
+      "connections.authorizationEndpoint": "授权端点",
+      "connections.tokenEndpoint": "令牌端点",
+      "connections.jwksUri": "JWKS URL",
+      "connections.authMethod": "客户端认证方式",
+      "connections.signingAlg": "ID Token 签名算法",
+      "connections.advanced": "高级设置",
+      "connections.discovering": "正在读取提供商配置…",
+      "connections.discoveryFailed": "无法读取提供商配置。请检查地址并重新移出输入框重试。",
+      "connections.invalidUrl": "请输入有效的 HTTPS 地址；本机地址可使用 HTTP。",
+      "providers.google": "Google",
+      "providers.microsoft": "Microsoft",
+      "providers.github": "GitHub",
+      "providers.oidc": "自定义 OIDC",
+      "accounts.tenant": "仅此组织（单租户）",
+      "accounts.organizations": "任何组织（多租户）",
+      "accounts.consumers": "个人 Microsoft 账号",
+      "accounts.common": "组织和个人 Microsoft 账号",
+      "guides.google": "创建 Web 应用客户端，将上方地址添加为授权重定向 URI，并复制 Client ID 和密钥。",
+      "guides.microsoft": "注册 Web 应用，账号范围须与此处一致。添加上方重定向 URI，复制应用 ID 和客户端密码的值。",
+      "guides.github": "创建 OAuth App，将上方地址填入 Authorization callback URL，并生成客户端密钥。",
+      "guides.oidc": "在身份提供商创建机密客户端，登记上方回调地址，并使用授权码流程。",
+      "admin.errors.invalid_provider": "请选择支持的登录提供商。",
+      "login.errors.invalid_provider": "请选择支持的登录提供商。",
+      "admin.errors.invalid_microsoft_configuration": "Microsoft 配置无效，请检查账号范围。",
+      "login.errors.invalid_microsoft_configuration": "Microsoft 配置无效，请检查账号范围。",
+      "admin.errors.invalid_microsoft_tenant": "Tenant ID 必须是有效的租户 GUID。",
+      "login.errors.invalid_microsoft_tenant": "Tenant ID 必须是有效的租户 GUID。",
+      "admin.errors.microsoft_account_scope": "Microsoft 账号不在允许的范围内。",
+      "login.errors.microsoft_account_scope": "Microsoft 账号不在允许的范围内。",
+      "admin.errors.microsoft_signing_key_issuer": "无法验证 Microsoft 身份，请重新登录。",
+      "login.errors.microsoft_signing_key_issuer": "无法验证 Microsoft 身份，请重新登录。",
+      "admin.errors.invalid_oidc_configuration": "OIDC 配置不完整或格式无效。",
+      "login.errors.invalid_oidc_configuration": "OIDC 配置不完整或格式无效。",
+      "admin.errors.invalid_oauth_identity": "无法确认外部身份，请重新登录。",
+      "login.errors.invalid_oauth_identity": "无法确认外部身份，请重新登录。",
+      "admin.errors.oidc_metadata_failed": "无法读取提供商配置，请检查地址。",
+      "login.errors.oidc_metadata_failed": "无法读取提供商配置，请检查地址。",
+      "admin.errors.oidc_metadata_invalid": "提供商返回的配置无效，请检查地址或使用手动配置。",
+      "login.errors.oidc_metadata_invalid": "提供商返回的配置无效，请检查地址或使用手动配置。",
+      "admin.errors.oidc_metadata_limit": "提供商配置超过大小限制。",
+      "login.errors.oidc_metadata_limit": "提供商配置超过大小限制。",
+      "admin.errors.oidc_network_failed": "无法连接身份提供商，请稍后重试。",
+      "login.errors.oidc_network_failed": "无法连接身份提供商，请稍后重试。",
+      "admin.errors.oidc_pkce_unsupported": "身份提供商不支持所需的 S256 PKCE。",
+      "login.errors.oidc_pkce_unsupported": "身份提供商不支持所需的 S256 PKCE。",
+      "admin.errors.oidc_signing_alg_unsupported": "身份提供商不支持所选 ID Token 签名算法。",
+      "login.errors.oidc_signing_alg_unsupported": "身份提供商不支持所选 ID Token 签名算法。",
+      "admin.errors.preset_scopes_fixed": "此提供商的权限范围固定，请重新打开连接。",
+      "login.errors.preset_scopes_fixed": "此提供商的权限范围固定，请重新打开连接。",
+      "admin.errors.verified_identity_required": "请先登录已有账号，在用户信息中验证并绑定此身份。",
+      "login.errors.verified_identity_required": "请先登录已有账号，在用户信息中验证并绑定此身份。",
+      "admin.errors.invalid_oidc_url": "请输入有效的 HTTPS 地址；本机地址可使用 HTTP。",
+      "login.errors.invalid_oidc_url": "请输入有效的 HTTPS 地址；本机地址可使用 HTTP。",
+      "admin.errors.oidc_issuer_mismatch": "提供商返回的 Issuer 与配置不一致。",
+      "login.errors.oidc_issuer_mismatch": "提供商返回的 Issuer 与配置不一致。",
+      "admin.errors.oidc_auth_method_unsupported": "身份提供商不支持所选客户端认证方式。",
+      "login.errors.oidc_auth_method_unsupported": "身份提供商不支持所选客户端认证方式。",
+      "login.errors.oidc_secret_required": "请配置 Client secret。",
+      "profile.bindingDescription": "使用已绑定的第三方账号登录。",
+      "profile.bind": "绑定",
+      "profile.bound": "已绑定",
+      "profile.notBound": "未绑定",
+      "profile.identityId": "身份 ID",
+      "profile.unbindTitle": "解除第三方账号绑定",
+      "profile.unbindWarning": "解除后将无法使用此身份登录，当前账号的所有会话也将退出。",
+      "profile.changePassword": "修改密码",
+      "connections.add": "添加连接",
+      "connections.searchPlaceholder": "搜索连接…"
+    },
+    "en": {
+      "metadata.name": "User Authentication",
+      "metadata.description": "Local passwords, third-party sign-in and human verification",
+      "login.title": "Account sign-in",
+      "login.username": "Username",
+      "login.password": "Password",
+      "login.busy": "Signing in…",
+      "login.submit": "Sign in",
+      "login.technicalDetails": "Technical details",
+      "login.correctAddress": "Use the correct address: {origin}",
+      "login.errors.invalid_credentials": "Incorrect username or password. Enter your credentials again.",
+      "login.errors.invalid_input": "Invalid username. Use 1–64 characters containing letters, numbers, and _ . @ - only.",
+      "login.errors.forbidden": "This sign-in request could not be completed. Refresh and try again.",
+      "login.errors.unauthorized": "A sign-in session was not established. Sign in again.",
+      "login.errors.invalid_origin": "This address does not match the service configuration. Sign in at the configured public address, or ask the deployment administrator to update it.",
+      "login.errors.invalid_csrf": "Session or address verification failed. Sign in again at the configured public address.",
+      "login.errors.login_limited": "Too many sign-in attempts. Wait 15 minutes before trying again.",
+      "login.errors.session_limit": "The sign-in session limit has been reached. Sign out of unused sessions and try again.",
+      "login.errors.management_provider_unavailable": "The account service is temporarily unavailable. Check its status and try again after recovery.",
+      "login.errors.provider_unavailable": "The account service is temporarily unavailable. Check its status and try again after recovery.",
+      "login.errors.control_recovering": "The account service is recovering. Try again shortly.",
+      "login.errors.session_unavailable": "Sign-in has not completed. Check your connection and retry, or refresh management access status.",
+      "login.errors.unknown": "Sign-in did not complete. Check your connection and try again.",
+      "recovery.summary": "Forgot your username or password?",
+      "recovery.intro": "Recover your account on the deployment server.",
+      "recovery.step1": "Confirm the target instance’s configuration database path, stop all its processes, and back up the data.",
+      "recovery.step2": "Run the command below in the original deployment directory, with the original data location and environment variables.",
+      "recovery.step3": "Set the username and new password when prompted, then restart the instance.",
+      "recovery.docker": "Stop the original container. Start a temporary interactive container with the same image, original data volume and environment, then run the command below from /usr/app. Use the original instance’s database path, override the entrypoint if needed, and keep the terminal attached (TTY). Remove the temporary container afterwards and restart the original one.",
+      "settings.accountTitle": "Current account",
+      "settings.accountTag": "Account",
+      "settings.passwordTag": "Password",
+      "settings.loading": "Loading…",
+      "settings.passwordTitle": "Change sign-in password",
+      "settings.passwordDescription": "Changing the password signs this account out of all sessions.",
+      "settings.currentPassword": "Current password",
+      "settings.newPassword": "New password (5–32 characters)",
+      "settings.confirmation": "Confirm new password",
+      "settings.updating": "Updating…",
+      "settings.submit": "Change and sign in again",
+      "settings.logout": "Sign out of current session",
+      "session.title": "Sign-in sessions",
+      "session.tag": "LIFETIME",
+      "session.noIdleTimeout": "Disabled",
+      "session.description": "Applies only to new sign-ins. Set idle timeout to 0 to disable it. Maximum lifetime is 30 days.",
+      "session.idle": "Idle timeout",
+      "session.absolute": "Maximum sign-in lifetime",
+      "session.minutes": "Minutes",
+      "session.hours": "Hours",
+      "session.days": "Days",
+      "session.unit": "Duration unit",
+      "session.loading": "Loading session settings",
+      "session.save": "Save session settings",
+      "session.saving": "Saving…",
+      "session.saved": "Saved. Applies to your next sign-in.",
+      "session.invalid": "Enter a whole-number duration up to 30 days. Maximum lifetime must be at least 1 minute.",
+      "session.conflict": "Another page changed these settings. Reload before saving.",
+      "session.failed": "Could not read or save session settings.",
+      "session.reload": "Reload settings",
+      "setup.title": "Initialize authentication",
+      "setup.description": "The setup code is issued on the deployment server and expires after 30 minutes.",
+      "setup.code": "One-time setup code",
+      "setup.password": "Password (5–32 characters)",
+      "setup.confirmation": "Confirm password",
+      "setup.submit": "Initialize account",
+      "setup.busy": "Initializing…",
+      "setup.failed": "Could not confirm initialization. Check your connection and try again.",
+      "setup.invalid_setup_code": "The code is invalid or expired. Issue another code on the deployment server.",
+      "setup.password_confirmation": "Passwords do not match.",
+      "setup.invalid_password": "Use 5–32 characters.",
+      "setup.already_initialized": "Authentication is already initialized. Sign in.",
+      "settings.errors.invalid_password": "Use 5–32 characters.",
+      "settings.errors.password_confirmation": "Passwords do not match.",
+      "settings.errors.password_unchanged": "Choose a different password.",
+      "settings.errors.failed": "The account request failed.",
+      "session.increase": "Increase duration",
+      "session.decrease": "Decrease duration",
+      "login.retryChallenge": "Retry challenge",
+      "login.challengeFailed": "Challenge unavailable. Please retry.",
+      "login.errors.turnstile_required": "Complete the sign-in challenge.",
+      "login.errors.turnstile_failed": "Challenge verification failed. Try again.",
+      "login.errors.unknown_identity": "This identity is not linked to a user. Contact an administrator.",
+      "login.errors.disabled_user": "This user is disabled.",
+      "login.errors.invalid_oidc_flow": "The external sign-in has expired or is invalid. Start again.",
+      "login.errors.oauth_client_rejected": "GitHub rejected the application credentials. Check the connection’s Client ID and Client Secret.",
+      "login.errors.oauth_callback_mismatch": "The GitHub callback URL does not match. Check the callback registered with the application.",
+      "login.errors.oauth_code_rejected": "The GitHub authorization code is invalid or expired. Start authorization again.",
+      "login.errors.oauth_email_unverified": "Verify your primary email address on GitHub, then start authorization again.",
+      "login.errors.oauth_token_failed": "Could not validate the GitHub authorization response. Authorize again or check the connection configuration.",
+      "login.errors.oidc_failed": "External sign-in failed. Try again.",
+      "login.errors.identity_connection_mismatch": "The identity belongs to a different connection. Contact an administrator.",
+      "admin.edit": "Edit",
+      "admin.save": "Save",
+      "admin.saved": "Saved.",
+      "admin.secretRetained": "Configured; leave blank to retain",
+      "users.title": "Users",
+      "users.access": "Every signed-in user has full management access.",
+      "users.enabled": "Enabled",
+      "users.disabled": "Disabled",
+      "users.local": "Local password set",
+      "users.sso": "External identity only",
+      "users.reset": "Reset password",
+      "users.toggle": "Enable user",
+      "users.new": "Create user",
+      "users.edit": "Edit user",
+      "users.displayName": "Display name",
+      "users.password": "User password (5–32 characters)",
+      "users.confirmation": "Confirm user password",
+      "users.optionalPassword": "Leave blank to create the user without a local password.",
+      "users.revokes": "Resetting the password signs this user out of all sessions.",
+      "users.identities": "Linked sign-in accounts",
+      "users.bindingNote": "Binding or unbinding signs this account out of all sessions.",
+      "users.unbind": "Unlink",
+      "turnstile.title": "Turnstile challenge",
+      "turnstile.description": "When enabled, local password sign-in requires human verification.",
+      "turnstile.enabled": "Enable Turnstile",
+      "turnstile.siteKey": "Site key",
+      "turnstile.secret": "Turnstile secret",
+      "turnstile.hostnames": "Allowed hostnames (one per line)",
+      "turnstile.save": "Save configuration",
+      "turnstile.configure": "Configure",
+      "turnstile.saveEnable": "Save and enable",
+      "turnstile.saveDisable": "Save and disable",
+      "turnstile.pending": "Changes not saved",
+      "turnstile.configuredDisabled": "Configured, disabled",
+      "turnstile.active": "Enabled",
+      "turnstile.inactive": "Disabled",
+      "admin.errors.version_conflict": "Settings changed elsewhere and have been reloaded. Edit again before saving.",
+      "admin.errors.invalid_input": "Invalid input. Check the fields.",
+      "admin.errors.last_local_user": "Cannot disable the last enabled user with a local password.",
+      "admin.errors.username_exists": "Username already exists.",
+      "admin.errors.identity_exists": "This external identity is already bound.",
+      "admin.errors.invalid_password": "Use 5–32 characters.",
+      "admin.errors.password_confirmation": "Passwords do not match.",
+      "admin.errors.turnstile_incomplete": "Configure site key, secret and allowed hostnames before enabling.",
+      "admin.errors.oidc_secret_required": "Configure a client secret.",
+      "admin.errors.invalid_origin": "The public management address is unavailable. Check BUNGEE_PUBLIC_ORIGIN.",
+      "admin.errors.management_origin_required": "Configure the callback origin with BUNGEE_PUBLIC_ORIGIN and restart the service.",
+      "admin.errors.oidc_unavailable": "This sign-in connection is unavailable. Check that it is enabled and has credentials.",
+      "settings.title": "Sign-in management",
+      "profile.title": "User profile",
+      "profile.noPassword": "No local password is set. Set one in user management.",
+      "profile.noConnections": "No sign-in methods are available to link.",
+      "users.empty": "No users.",
+      "users.editDescription": "Start the username with an English letter or digit. It may also contain _ . @ -.",
+      "admin.close": "Close",
+      "admin.cancel": "Cancel",
+      "connections.title": "Third-party sign-in",
+      "connections.connection": "Identity connection",
+      "connections.autoCreate": "Automatically create external users",
+      "connections.autoCreateWarning": "When enabled, new users from every enabled connection can create accounts with full management access.",
+      "connections.new": "Add sign-in connection",
+      "connections.edit": "Edit sign-in connection",
+      "connections.editor": "Sign-in connection form",
+      "connections.enabled": "Enable connection",
+      "connections.label": "Connection label",
+      "connections.issuer": "Issuer URL",
+      "connections.clientId": "Client ID",
+      "connections.secret": "Client secret",
+      "connections.scopes": "Scopes (space separated)",
+      "connections.callback": "Callback URL",
+      "connections.missingOrigin": "Configure the public management address with BUNGEE_PUBLIC_ORIGIN first.",
+      "connections.empty": "No Third-party sign-in configured.",
+      "connections.description": "Choose a provider and configure your application credentials.",
+      "connections.delete": "Delete sign-in connection",
+      "connections.deleteWarning": "Deleting removes this connection’s external identity bindings, signs affected users out of all sessions, and cancels pending sign-ins. Platform users remain.",
+      "connections.search": "Search connections",
+      "connections.status": "Status",
+      "connections.all": "All statuses",
+      "connections.actions": "Actions",
+      "connections.enable": "Enable",
+      "connections.disable": "Disable",
+      "connections.remove": "Delete",
+      "connections.noMatches": "No matching connections.",
+      "login.methods": "External sign-in",
+      "connections.provider": "Provider",
+      "connections.providerFixed": "To change provider, delete this connection and add another.",
+      "connections.saveNote": "New connections are disabled. Saving configuration does not verify sign-in.",
+      "connections.saved": "Configuration saved. Sign-in has not been verified.",
+      "connections.copy": "Copy callback URL",
+      "connections.copied": "Copied",
+      "connections.copyFailed": "Could not copy. Copy the callback URL manually.",
+      "connections.createApp": "Create application ↗",
+      "connections.oidcGuide": "OIDC configuration guide ↗",
+      "connections.accountType": "Supported accounts",
+      "connections.mode": "Configuration method",
+      "connections.modeIssuer": "Discover by issuer",
+      "connections.modeDiscovery": "Discovery URL",
+      "connections.modeManual": "Manual configuration",
+      "connections.discoveryUrl": "Discovery URL",
+      "connections.authorizationEndpoint": "Authorization endpoint",
+      "connections.tokenEndpoint": "Token endpoint",
+      "connections.jwksUri": "JWKS URL",
+      "connections.authMethod": "Client authentication",
+      "connections.signingAlg": "ID Token signing algorithm",
+      "connections.advanced": "Advanced settings",
+      "connections.discovering": "Reading provider configuration…",
+      "connections.discoveryFailed": "Could not read provider configuration. Check the URL and leave the field to retry.",
+      "connections.invalidUrl": "Enter a valid HTTPS URL. HTTP is allowed for loopback hosts.",
+      "providers.google": "Google",
+      "providers.microsoft": "Microsoft",
+      "providers.github": "GitHub",
+      "providers.oidc": "Custom OIDC",
+      "accounts.tenant": "This organization only (single tenant)",
+      "accounts.organizations": "Any organization (multiple tenants)",
+      "accounts.consumers": "Personal Microsoft accounts",
+      "accounts.common": "Organizational and personal Microsoft accounts",
+      "guides.google": "Create a Web application client, add the callback URL as an authorized redirect URI, and copy its client ID and secret.",
+      "guides.microsoft": "Register a Web application with matching supported accounts. Add the redirect URI, then copy the application ID and client secret value.",
+      "guides.github": "Create an OAuth App, enter the callback URL under Authorization callback URL, and generate a client secret.",
+      "guides.oidc": "Create a confidential client at your identity provider, register the callback URL, and enable the authorization code flow.",
+      "admin.errors.invalid_provider": "Choose a supported sign-in provider.",
+      "login.errors.invalid_provider": "Choose a supported sign-in provider.",
+      "admin.errors.invalid_microsoft_configuration": "Check the Microsoft account configuration.",
+      "login.errors.invalid_microsoft_configuration": "Check the Microsoft account configuration.",
+      "admin.errors.invalid_microsoft_tenant": "Enter a valid tenant GUID.",
+      "login.errors.invalid_microsoft_tenant": "Enter a valid tenant GUID.",
+      "admin.errors.microsoft_account_scope": "This Microsoft account is outside the allowed account scope.",
+      "login.errors.microsoft_account_scope": "This Microsoft account is outside the allowed account scope.",
+      "admin.errors.microsoft_signing_key_issuer": "Could not verify the Microsoft identity. Sign in again.",
+      "login.errors.microsoft_signing_key_issuer": "Could not verify the Microsoft identity. Sign in again.",
+      "admin.errors.invalid_oidc_configuration": "The OIDC configuration is incomplete or invalid.",
+      "login.errors.invalid_oidc_configuration": "The OIDC configuration is incomplete or invalid.",
+      "admin.errors.invalid_oauth_identity": "Could not verify the external identity. Sign in again.",
+      "login.errors.invalid_oauth_identity": "Could not verify the external identity. Sign in again.",
+      "admin.errors.oidc_metadata_failed": "Could not read provider configuration. Check the URL.",
+      "login.errors.oidc_metadata_failed": "Could not read provider configuration. Check the URL.",
+      "admin.errors.oidc_metadata_invalid": "Provider metadata is invalid. Check the URL or configure it manually.",
+      "login.errors.oidc_metadata_invalid": "Provider metadata is invalid. Check the URL or configure it manually.",
+      "admin.errors.oidc_metadata_limit": "Provider metadata exceeds the size limit.",
+      "login.errors.oidc_metadata_limit": "Provider metadata exceeds the size limit.",
+      "admin.errors.oidc_network_failed": "Could not reach the identity provider. Try again later.",
+      "login.errors.oidc_network_failed": "Could not reach the identity provider. Try again later.",
+      "admin.errors.oidc_pkce_unsupported": "The identity provider does not support required S256 PKCE.",
+      "login.errors.oidc_pkce_unsupported": "The identity provider does not support required S256 PKCE.",
+      "admin.errors.oidc_signing_alg_unsupported": "The identity provider does not support the selected ID Token signing algorithm.",
+      "login.errors.oidc_signing_alg_unsupported": "The identity provider does not support the selected ID Token signing algorithm.",
+      "admin.errors.preset_scopes_fixed": "This provider uses fixed scopes. Reopen the connection.",
+      "login.errors.preset_scopes_fixed": "This provider uses fixed scopes. Reopen the connection.",
+      "admin.errors.verified_identity_required": "Sign in to an existing account, then verify and link this identity in your profile.",
+      "login.errors.verified_identity_required": "Sign in to an existing account, then verify and link this identity in your profile.",
+      "admin.errors.invalid_oidc_url": "Enter a valid HTTPS URL. HTTP is allowed for loopback hosts.",
+      "login.errors.invalid_oidc_url": "Enter a valid HTTPS URL. HTTP is allowed for loopback hosts.",
+      "admin.errors.oidc_issuer_mismatch": "The provider issuer does not match the configuration.",
+      "login.errors.oidc_issuer_mismatch": "The provider issuer does not match the configuration.",
+      "admin.errors.oidc_auth_method_unsupported": "The identity provider does not support the selected client authentication method.",
+      "login.errors.oidc_auth_method_unsupported": "The identity provider does not support the selected client authentication method.",
+      "login.errors.oidc_secret_required": "Configure a client secret.",
+      "profile.bindingDescription": "Sign in with your linked third-party accounts.",
+      "profile.bind": "Link",
+      "profile.bound": "Linked",
+      "profile.notBound": "Not linked",
+      "profile.identityId": "Identity ID",
+      "profile.unbindTitle": "Unlink sign-in account",
+      "profile.unbindWarning": "This identity can no longer be used to sign in. All sessions for this account will also end.",
+      "profile.changePassword": "Change password",
+      "connections.add": "Add connection",
+      "connections.searchPlaceholder": "Search connections…"
+    }
+  }
+}