@materializecms/server 0.7.0 → 0.9.0

package/src/app.js

@@ -8,8 +8,9 @@ import { Readable } from 'node:stream';
 import { getConnInfo } from '@hono/node-server/conninfo';
 import { describeCollection, prepare, SLUG_PATTERN, slugify, titleOf, validate, } from '@materializecms/core';
 import { documentSlots, isLocaleCode, mergeTranslation, nodeSlots, untranslatedIds, withLocales, } from '@materializecms/core/i18n';
+import { currentLang, intlLocaleOf, isLang } from '@materializecms/core/lang';
 import { senderDomain } from '@materializecms/core/mail';
-import { expandComponents, expandGlobals, formDefinition, normalizeTheme, richTextHtml, sameDesign, walk, } from '@materializecms/core/page';
+import { expandComponents, expandGlobals, formDefinition, normalizeTheme, OVERRIDE_KEYS, richTextHtml, sameDesign, walk, } from '@materializecms/core/page';
 import { addMove, feedCollections, normalizePath } from '@materializecms/core/seo';
 import { TRACKING_PATTERNS, trackingBlocks } from '@materializecms/core/tracking';
 import { DEFAULT_UPDATES, isPatch, } from '@materializecms/core/updates';
@@ -31,6 +32,7 @@ import { createBackups, DEFAULT_BACKUPS } from './backups.js';
 import { briefSystem, briefTools, plain } from './brief.js';
 import { createFonts, FONT_FILE, FONT_ID } from './fonts.js';
 import { fingerprintOf, readSubmission, removeFiles, saveFiles, sendWebhook, spamReason, } from './forms.js';
+import { requestLang, useProfileLang, withLang } from './lang.js';
 import { checkSenderDomain, explainMailError, isConfigured, publicMail, sendMail, submissionText, } from './mail.js';
 import { createMcpServer } from './mcp.js';
 import { createMediaFiles, fileBody, MAX_UPLOAD, MediaError, mediaUrl } from './media.js';
@@ -40,6 +42,7 @@ import { hashPassword, verifyPassword } from './password.js';
 import { fetchPublicFile, RemoteError, remoteFetch } from './remote.js';
 import { statusPage } from './status-page.js';
 import { studioSystem, studioTools } from './studio.js';
+import { t } from './t.js';
 import { apiCaller, assistantTools, contentTools, pageTools } from './tools.js';
 import { newSecret, otpauthUri, recoveryCodes, verifyCode } from './totp.js';
 import { readRest, readWxr, WordPressError } from './wordpress.js';
@@ -78,32 +81,80 @@ function embedsOf(value, out = []) {
         const node = value;
         if (node.type === 'embed' && typeof node.id === 'string')
             out.push(`${node.id}:${String(node.html ?? '')}`);
-        // Where a form's messages go: someone who only edits pages must not divert them.
+        // Where a form's messages go, and the email it sends back to whoever writes (to any address a
+        // visitor types): someone who only edits pages must not divert them or write that email.
         const form = node.form;
-        if (form && typeof node.id === 'string' && (form.to || form.webhook))
-            out.push(`form:${node.id}:${form.to ?? ''}:${form.webhook ?? ''}`);
+        if (form && typeof node.id === 'string' && (form.to || form.webhook || form.autoReply))
+            out.push(`form:${node.id}:${form.to ?? ''}:${form.webhook ?? ''}:${JSON.stringify(form.autoReply ?? null)}`);
+        // A component's copy keeps only its own words, links and images; anything else in its overrides
+        // (a type, custom code, a form) would turn an element of the component into something the
+        // checks above never see by its id.
+        const overrides = node.overrides;
+        if (overrides && typeof overrides === 'object' && typeof node.id === 'string')
+            for (const [child, own] of Object.entries(overrides)) {
+                const extra = own && typeof own === 'object'
+                    ? Object.keys(own).filter((k) => !OVERRIDE_KEYS.includes(k))
+                    : [];
+                if (extra.length)
+                    out.push(`override:${node.id}:${child}:${JSON.stringify(Object.fromEntries(extra.map((k) => [k, own[k]])))}`);
+            }
         for (const v of Object.values(node))
             if (v && typeof v === 'object')
                 embedsOf(v, out);
     }
     return out;
 }
+/** What a form shows to visitors: the rest (who receives it, the webhook, the automatic reply) is the site's own. */
+const PUBLIC_FORM_KEYS = ['name', 'success', 'newsletter'];
+/**
+ * A published document as anyone may read it: page elements (and component copies' overrides)
+ * keep only the public part of their forms. The site itself reads the database, not this.
+ */
+function withoutFormSettings(value) {
+    if (Array.isArray(value))
+        return value.map(withoutFormSettings);
+    if (!value || typeof value !== 'object')
+        return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] =
+            k === 'form' && v && typeof v === 'object' && !Array.isArray(v)
+                ? Object.fromEntries(Object.entries(v).filter(([key]) => PUBLIC_FORM_KEYS.includes(key)))
+                : withoutFormSettings(v);
+    }
+    return out;
+}
 class ApiError extends HTTPException {
     constructor(status, code, message, issues) {
         super(status, { res: Response.json({ error: { code, message, issues } }, { status }) });
     }
 }
-const credentials = z.object({ email: z.email(), password: z.string().min(1) });
+/** The language of an email to someone with an account: their profile's, else the current one. */
+/**
+ * The language of an email to someone with an account: their profile's, else Italian, the panel's
+ * default — never the language of whoever made the request (a stranger trying to sign in).
+ */
+const langFor = (locale) => (isLang(locale) ? locale : 'it');
+/** A document's schedules with the reason of the last failure in the reader's language (t.keep). */
+const readSchedule = (schedule) => schedule.failed?.error
+    ? { ...schedule, failed: { ...schedule.failed, error: t.read(schedule.failed.error) } }
+    : schedule;
+/** Longer than any real password: hashing a huge one would only cost the server time. */
+const MAX_PASSWORD = 1000;
+const credentials = z.object({ email: z.email(), password: z.string().min(1).max(MAX_PASSWORD) });
 const setupBody = z.object({
     email: z.email(),
     name: z.string().trim().min(1),
-    password: z.string().min(10),
+    password: z.string().min(10).max(MAX_PASSWORD),
     /** From the link `materialize start` prints, when it set one. */
     token: z.string().optional(),
     site: z
         .object({
         name: z.string().trim().min(1).max(120).optional(),
-        locale: z.string().refine(isLocaleCode, 'Codice lingua non valido').optional(),
+        locale: z
+            .string()
+            .refine(isLocaleCode, { error: () => t('Codice lingua non valido') })
+            .optional(),
     })
         .optional(),
 });
@@ -168,8 +219,17 @@ async function body(c, schema) {
 /** Naive in-memory limiter: enough to slow down password guessing on a single instance. */
 function createLimiter(max, windowMs) {
     const hits = new Map();
+    let swept = Date.now();
     return (key) => {
         const now = Date.now();
+        // Keys come from whoever asks (an address, a form's name): the expired ones go, or the map
+        // would only grow.
+        if (now - swept > windowMs) {
+            swept = now;
+            for (const [k, v] of hits)
+                if (v.until < now)
+                    hits.delete(k);
+        }
         const entry = hits.get(key);
         if (!entry || entry.until < now) {
             hits.set(key, { n: 1, until: now + windowMs });
@@ -179,6 +239,28 @@ function createLimiter(max, windowMs) {
         return entry.n <= max;
     };
 }
+/** Request bodies, at most: anyone may send one, and it is read into memory. */
+const BODY_MAX = 2 * 1024 * 1024;
+/** For the panel and its tokens: a page built on the canvas, with its components, can weigh a few MB. */
+const SIGNED_IN_BODY_MAX = 10 * 1024 * 1024;
+/** A WordPress export file (WXR): only text, but a large blog's can be big. */
+const WXR_MAX = 200 * 1024 * 1024;
+/** Two addresses of the same server (scheme, host and port), or both empty (the provider's own). */
+const sameServer = (a, b) => {
+    if (!a || !b)
+        return !a && !b;
+    try {
+        return new URL(a).origin === new URL(b).origin;
+    }
+    catch {
+        return false;
+    }
+};
+/** This computer: a Host header that can only bring a link back here, never to someone else's server. */
+const isLocalHost = (hostname) => hostname === 'localhost' ||
+    hostname.endsWith('.localhost') ||
+    /^127\.\d+\.\d+\.\d+$/.test(hostname) ||
+    hostname === '[::1]';
 export function createApp(base) {
     // The languages chosen in Impostazioni → Lingue win over the config's; read once, then kept current.
     let languages = null;
@@ -228,6 +310,15 @@ export function createApp(base) {
         ...DEFAULT_OFFSITE,
         ...(await settings.get('offsite')),
     });
+    /**
+     * The language of the people who get the site's notices (a form's messages): the account with
+     * that address, else the first administrator's, else Italian.
+     */
+    const ownerLang = async (address) => {
+        const users = await auth.listUsers();
+        const owner = users.find((u) => u.email.toLowerCase() === address.toLowerCase()) ?? users.find((u) => u.role === 'admin');
+        return langFor(owner?.locale);
+    };
     let offsiteRunning = false;
     /** One run; the outcome is kept, and administrators hear by email the first time it fails. */
     const offsiteRun = async (fresh) => {
@@ -243,10 +334,13 @@ export function createApp(base) {
             status = { at: new Date().toISOString(), ok: false, message: error.message };
             if (before?.ok !== false)
                 for (const admin of (await auth.listUsers()).filter((u) => u.role === 'admin'))
-                    await mailNotice(admin.email, 'Backup fuori dal server non riuscito', [
-                        `La copia dei backup di ${ctx.config().site.name} fuori dal server non è riuscita: ${status.message}`,
-                        'Controlla in Impostazioni → Sicurezza → Backup. Ti scriviamo di nuovo solo quando torna a funzionare e si ferma di nuovo.',
-                    ]);
+                    await withLang(langFor(admin.locale), () => mailNotice(admin.email, t('Backup fuori dal server non riuscito'), [
+                        t('La copia dei backup di {site} fuori dal server non è riuscita: {message}', {
+                            site: ctx.config().site.name,
+                            message: status.message,
+                        }),
+                        t('Controlla in Impostazioni → Sicurezza → Backup. Ti scriviamo di nuovo solo quando torna a funzionare e si ferma di nuovo.'),
+                    ]));
         }
         finally {
             offsiteRunning = false;
@@ -323,6 +417,12 @@ export function createApp(base) {
     const presence = new Map();
     // A form can be sent a few times a minute from one address: enough for people, not for spam.
     const allowForm = createLimiter(5, 60_000);
+    // And from one address across every form: form names are whatever the sender writes.
+    const allowFormIp = createLimiter(10, 60_000);
+    const allowFormIpHour = createLimiter(60, 60 * 60_000);
+    // Forms the site built by hand (no form on a published page): any name goes, so fewer of them.
+    const allowHandForm = createLimiter(3, 60_000);
+    const privateWebhooks = base.privateWebhooks ?? process.env.MATERIALIZE_PRIVATE_WEBHOOKS === '1';
     const files = createMediaFiles(ctx.config().media.dir);
     // Fonts are cached next to the media library (.materialize/fonts by default).
     const fonts = createFonts(join(dirname(resolve(ctx.config().media.dir)), 'fonts'));
@@ -339,11 +439,11 @@ export function createApp(base) {
         if (user.role === 'admin')
             return;
         if (JSON.stringify(embedsOf(before).sort()) !== JSON.stringify(embedsOf(after).sort()))
-            throw new ApiError(403, 'embed_admin_only', 'Solo un amministratore può modificare il codice personalizzato e dove arrivano i messaggi dei moduli');
+            throw new ApiError(403, 'embed_admin_only', t('Solo un amministratore può modificare il codice personalizzato e dove arrivano i messaggi dei moduli'));
     };
     /** Editors who may only change contents (Persone → Redattori): words, links and images, not the layout. */
     const contentOnly = async (user) => user.role !== 'admin' && !!(await settings.get('editorial'))?.editorsContentOnly;
-    const designLocked = () => new ApiError(403, 'content_only', 'Puoi modificare testi, collegamenti e immagini, non il layout della pagina');
+    const designLocked = () => new ApiError(403, 'content_only', t('Puoi modificare testi, collegamenti e immagini, non il layout della pagina'));
     const guardDesign = async (user, before, after) => {
         const pages = (v) => (Array.isArray(v) ? v : []);
         if (!sameDesign(pages(before), pages(after)) && (await contentOnly(user)))
@@ -399,6 +499,19 @@ export function createApp(base) {
             console.error('Materialize: activity not recorded', error);
         }
     };
+    /**
+     * Whether the browser reached the site over HTTPS: directly, through a proxy the config trusts,
+     * or at a site whose address is https (not on this computer, where browsers may refuse a secure
+     * cookie over plain http). The session cookie then never travels in clear.
+     */
+    const secureRequest = (c) => {
+        const url = new URL(c.req.url);
+        if (url.protocol === 'https:')
+            return true;
+        if (ctx.config().server.trustProxy && c.req.header('x-forwarded-proto')?.split(',')[0]?.trim() === 'https')
+            return true;
+        return !isLocalHost(url.hostname) && !!ctx.config().site.url?.startsWith('https:');
+    };
     const startSession = async (c, userId) => {
         const { token, expiresAt } = await auth.createSession(userId, SESSION_TTL, {
             userAgent: c.req.header('user-agent'),
@@ -407,7 +520,7 @@ export function createApp(base) {
         setCookie(c, SESSION_COOKIE, token, {
             httpOnly: true,
             sameSite: 'Lax',
-            secure: new URL(c.req.url).protocol === 'https:',
+            secure: secureRequest(c),
             path: '/',
             expires: expiresAt,
         });
@@ -424,6 +537,7 @@ export function createApp(base) {
                 throw new ApiError(403, 'two_factor_required', 'Set up two-step verification to continue');
             c.set('user', user);
             c.set('viaToken', true);
+            useProfileLang(user.locale);
             return next();
         }
         const token = getCookie(c, SESSION_COOKIE);
@@ -431,6 +545,7 @@ export function createApp(base) {
         if (!user)
             throw new ApiError(401, 'unauthenticated', 'Sign in to continue');
         c.set('user', user);
+        useProfileLang(user.locale);
         // When the site requires two-step verification, someone without it can only set it up.
         if (!user.twoFactor && !c.req.path.startsWith('/api/auth/') && (await twoFactorRequired()))
             throw new ApiError(403, 'two_factor_required', 'Set up two-step verification to continue');
@@ -466,7 +581,7 @@ export function createApp(base) {
             url: def?.url ? def.url(doc.data) : null,
             issues: check && !check.ok ? check.issues : [],
             /** When it goes on or off the site by itself, and the last scheduled action that failed. */
-            schedule: await schedules.forDocument(doc.id),
+            schedule: readSchedule(await schedules.forDocument(doc.id)),
             /** The release it goes out with, if any. */
             release: await releases
                 .forDocument(doc.id)
@@ -503,12 +618,39 @@ export function createApp(base) {
             throw error;
         }
     };
+    // Library files are the og:image of shared pages and the enclosures of the RSS feed: social previews
+    // and feed readers load them from other sites. Registered before secureHeaders, so this runs after it.
+    app.use('/media/*', async (c, next) => {
+        await next();
+        c.res.headers.set('cross-origin-resource-policy', 'cross-origin');
+    });
     app.use('*', secureHeaders());
+    // Every body is limited before anything reads it: the sign-in, setup and form routes are open to
+    // anyone. Uploads and the WordPress export set their own limits (larger, after the sign-in check).
+    const ownLimit = /^\/api\/(media|forms\/[^/]+|import\/wordpress\/analyze)$/;
+    const limitBody = (max) => bodyLimit({
+        maxSize: max,
+        onError: () => {
+            throw new ApiError(413, 'body_too_large', t('La richiesta è troppo grande'));
+        },
+    });
+    const smallBody = limitBody(BODY_MAX);
+    const signedInBody = limitBody(SIGNED_IN_BODY_MAX);
+    const limitRequest = (c, next) => {
+        if (c.req.method === 'POST' && ownLimit.test(c.req.path))
+            return next();
+        // Only the larger size for a request that says who sends it; the sign-in check comes after.
+        return (bearerOf(c) || getCookie(c, SESSION_COOKIE) ? signedInBody : smallBody)(c, next);
+    };
+    app.use('/api/*', limitRequest);
+    app.use('/mcp', limitRequest);
     // Requests with a bearer token carry no cookie, so a forged form cannot ride on them.
     const checkOrigin = csrf();
     app.use('/api/*', (c, next) => 
     // Leaving the newsletter with one click from the email app comes with no Origin: the token is the proof.
     bearerOf(c) || c.req.path.startsWith('/api/newsletter/unsubscribe/') ? next() : checkOrigin(c, next));
+    // Every request in the language of whoever makes it (see lang.ts).
+    app.use('*', requestLang);
     // Answers change with every edit: browsers must not reuse them.
     app.use('/api/*', async (c, next) => {
         await next();
@@ -553,7 +695,7 @@ export function createApp(base) {
             id: 'node',
             label: `Node.js ${process.versions.node}`,
             state: node >= 24 ? 'ok' : 'error',
-            detail: node >= 24 ? 'Versione adatta.' : 'Serve Node 24 o più recente.',
+            detail: node >= 24 ? t('Versione adatta.') : t('Serve Node 24 o più recente.'),
         });
         const mediaDir = resolve(ctx.config().media.dir);
         let writable = true;
@@ -566,41 +708,41 @@ export function createApp(base) {
         }
         checks.push({
             id: 'files',
-            label: 'Cartella dei file',
+            label: t('Cartella dei file'),
             state: writable ? 'ok' : 'error',
             detail: writable
-                ? 'Database e immagini si possono salvare.'
-                : `Il programma non può scrivere in ${mediaDir}: dagli i permessi su quella cartella.`,
+                ? t('Database e immagini si possono salvare.')
+                : t('Il programma non può scrivere in {dir}: dagli i permessi su quella cartella.', { dir: mediaDir }),
         });
         checks.push({
             id: 'site',
-            label: 'Sito',
+            label: t('Sito'),
             state: ctx.preview ? 'ok' : 'warn',
             detail: ctx.preview
-                ? 'Il sito si genera da solo a ogni pubblicazione.'
-                : 'Solo il CMS: in questa cartella non c’è un sito Astro.',
+                ? t('Il sito si genera da solo a ogni pubblicazione.')
+                : t('Solo il CMS: in questa cartella non c’è un sito Astro.'),
         });
         const url = new URL(c.req.url);
         const local = /^(localhost|127\.|\[::1\])/.test(url.hostname);
         const https = url.protocol === 'https:' || c.req.header('x-forwarded-proto') === 'https';
         checks.push({
             id: 'https',
-            label: 'Connessione sicura',
+            label: t('Connessione sicura'),
             state: https || local ? 'ok' : 'warn',
             detail: https
-                ? 'HTTPS attivo.'
+                ? t('HTTPS attivo.')
                 : local
-                    ? 'In locale non serve HTTPS.'
-                    : 'Senza HTTPS la password viaggia in chiaro: attivalo prima di metterlo online (guida in docs/sicurezza.md).',
+                    ? t('In locale non serve HTTPS.')
+                    : t('Senza HTTPS la password viaggia in chiaro: attivalo prima di metterlo online (guida in docs/sicurezza.md).'),
         });
         const updates = await ctx.updates?.status();
         checks.push({
             id: 'updates',
-            label: 'Aggiornamenti',
+            label: t('Aggiornamenti'),
             state: updates && !updates.unavailable ? 'ok' : 'warn',
             detail: updates && !updates.unavailable
-                ? 'Si installano dal pannello, con un clic.'
-                : (updates?.unavailable ?? 'Si installano da terminale.'),
+                ? t('Si installano dal pannello, con un clic.')
+                : (updates?.unavailable ?? t('Si installano da terminale.')),
         });
         return checks;
     };
@@ -630,7 +772,7 @@ export function createApp(base) {
         if ((await auth.countUsers()) > 0)
             throw new ApiError(409, 'already_set_up', 'An administrator already exists');
         if (ctx.setupToken && input.token !== ctx.setupToken)
-            throw new ApiError(403, 'setup_token', 'Per installare serve il link stampato all’avvio del server (materialize start), con il suo codice');
+            throw new ApiError(403, 'setup_token', t('Per installare serve il link stampato all’avvio del server (materialize start), con il suo codice'));
         // The site's language and name, before anything else is written in them.
         if (input.site?.locale && input.site.locale !== ctx.config().locales.default) {
             const value = { default: input.site.locale, available: [input.site.locale] };
@@ -683,19 +825,19 @@ export function createApp(base) {
             const until = await auth.lockedUntil(key);
             if (until) {
                 const minutes = Math.max(1, Math.ceil((until.getTime() - Date.now()) / 60_000));
-                throw new ApiError(429, 'too_many_attempts', `Troppi tentativi: riprova tra ${minutes === 1 ? 'un minuto' : `${minutes} minuti`}`);
+                throw new ApiError(429, 'too_many_attempts', t.n(minutes, 'Troppi tentativi: riprova tra un minuto', 'Troppi tentativi: riprova tra {n} minuti'));
             }
         }
     };
     /** A failed sign-in: counted for the email and the address; the owner hears when their account pauses. */
-    const signInFailed = async (email, ip, hasAccount) => {
+    const signInFailed = async (email, ip, hasAccount, locale) => {
         const byEmail = await auth.recordFailure(`email:${email}`, EMAIL_THRESHOLD);
         await auth.recordFailure(`ip:${ip}`, IP_THRESHOLD);
         if (hasAccount && byEmail.failures === EMAIL_THRESHOLD)
-            await mailNotice(email, 'Tentativi di accesso non riusciti', [
-                `Qualcuno ha provato ${EMAIL_THRESHOLD} volte di fila a entrare nel pannello del sito con il tuo indirizzo, senza la password giusta. Per sicurezza gli accessi con il tuo indirizzo sono in pausa per qualche minuto.`,
-                'Se eri tu, aspetta e riprova. Se non eri tu, la tua password è ancora al sicuro: per più protezione attiva la verifica in due passaggi dal tuo profilo.',
-            ]);
+            await withLang(langFor(locale), () => mailNotice(email, t('Tentativi di accesso non riusciti'), [
+                t('Qualcuno ha provato {n} volte di fila a entrare nel pannello del sito con il tuo indirizzo, senza la password giusta. Per sicurezza gli accessi con il tuo indirizzo sono in pausa per qualche minuto.', { n: EMAIL_THRESHOLD }),
+                t('Se eri tu, aspetta e riprova. Se non eri tu, la tua password è ancora al sicuro: per più protezione attiva la verifica in due passaggi dal tuo profilo.'),
+            ]));
     };
     /** Passwords accepted, codes still due: by ticket, in memory for a few minutes. */
     const challenges = new Map();
@@ -731,7 +873,7 @@ export function createApp(base) {
         // A password is checked even for an unknown email: the answer takes as long either way.
         const ok = await verifyPassword(input.password, found?.passwordHash ?? (await dummyHash));
         if (!found || !ok) {
-            await signInFailed(email, ip, !!found);
+            await signInFailed(email, ip, !!found, found?.locale);
             await record(c, 'login.failed', email, { known: !!found }, found ? { id: found.id, name: found.name } : null);
             throw new ApiError(401, 'invalid_credentials', 'Email or password is not correct');
         }
@@ -754,23 +896,32 @@ export function createApp(base) {
         await auth.recordFailure(`forgot:${email}`, FORGOT_THRESHOLD);
         await auth.recordFailure(`forgot-ip:${ip}`, FORGOT_IP_THRESHOLD);
         const mail = isConfigured(await settings.get('mail'));
-        const found = mail ? await auth.findForLogin(email) : null;
-        if (found) {
-            const { token } = await auth.createInvite({
-                kind: 'reset',
-                email: found.email,
-                name: found.name,
-                role: found.role,
-                userId: found.id,
-                ttlMs: FORGOT_TTL,
-            });
-            await mailLink(c, found.email, 'Nuova password', [
-                `Qualcuno ha chiesto una nuova password per il tuo account su ${ctx.config().site.name}.`,
-                'Se non sei stato tu, ignora questa email: la password resta quella di prima.',
-                'Per sceglierne una nuova, apri questo link entro un’ora:',
-            ], linkPath(token));
-            await record(c, 'password.forgot', found.email, null, { id: found.id, name: found.name });
-        }
+        const origin = strangerOrigin(c);
+        if (mail && !origin)
+            console.warn('Materialize: no password link sent, because the site address (MATERIALIZE_SITE_URL) is not set');
+        // After the answer: how long it takes must not tell whether the email has an account.
+        if (mail && origin)
+            void (async () => {
+                const found = await auth.findForLogin(email);
+                if (!found)
+                    return;
+                const { token } = await auth.createInvite({
+                    kind: 'reset',
+                    email: found.email,
+                    name: found.name,
+                    role: found.role,
+                    userId: found.id,
+                    ttlMs: FORGOT_TTL,
+                });
+                await withLang(langFor(found.locale), () => mailLink(origin, found.email, t('Nuova password'), [
+                    t('Qualcuno ha chiesto una nuova password per il tuo account su {site}.', {
+                        site: ctx.config().site.name,
+                    }),
+                    t('Se non sei stato tu, ignora questa email: la password resta quella di prima.'),
+                    t('Per sceglierne una nuova, apri questo link entro un’ora:'),
+                ], linkPath(token)));
+                await record(c, 'password.forgot', found.email, null, { id: found.id, name: found.name });
+            })().catch((error) => console.error('Materialize: password link not sent', error));
         return c.json({ ok: true, mail });
     });
     /** The second step: a code from the app, or a recovery code. */
@@ -827,7 +978,7 @@ export function createApp(base) {
         const hash = await auth.getPasswordHash(userId);
         if (!hash || !(await verifyPassword(password, hash)))
             throw new ApiError(422, 'wrong_password', 'The password is not correct', [
-                { path, message: 'La password non è corretta' },
+                { path, message: t('La password non è corretta') },
             ]);
     };
     app.get('/api/auth/security', requireUser, requireSession, async (c) => {
@@ -859,7 +1010,7 @@ export function createApp(base) {
         const step = verifyCode(state.pending, input.code);
         if (step === null)
             throw new ApiError(422, 'invalid_code', 'The code is not correct', [
-                { path: 'code', message: 'Il codice non è corretto' },
+                { path: 'code', message: t('Il codice non è corretto') },
             ]);
         const codes = recoveryCodes();
         await auth.enableTwoFactor(user.id, step, codes);
@@ -913,7 +1064,12 @@ export function createApp(base) {
             before: before || undefined,
             limit: 50,
         });
-        return c.json({ items });
+        // Messages copied into the log (a release or a schedule that failed) are kept texts.
+        return c.json({
+            items: items.map((i) => typeof i.detail?.message === 'string'
+                ? { ...i, detail: { ...i.detail, message: t.read(i.detail.message) } }
+                : i),
+        });
     });
     /**
      * What an administrator should look at, in order: who signs in without a second step, whether
@@ -921,6 +1077,7 @@ export function createApp(base) {
      */
     app.get('/api/security/overview', requireUser, requireAdmin, async (c) => {
         const checks = [];
+        const hoursAgo = (ms) => new Intl.RelativeTimeFormat(intlLocaleOf(currentLang()), { numeric: 'auto' }).format(-Math.round(ms / 3_600_000), 'hour');
         const people = await auth.listUsers();
         const required = await twoFactorRequired();
         const admins = people.filter((p) => p.role === 'admin');
@@ -930,36 +1087,34 @@ export function createApp(base) {
             ? {
                 id: 'admins-2fa',
                 status: 'bad',
-                title: adminsWithout.length === 1
-                    ? 'Un amministratore entra con la sola password'
-                    : `${adminsWithout.length} amministratori entrano con la sola password`,
-                detail: `${adminsWithout.map((p) => p.name).join(', ')}: chi ruba quella password controlla tutto il sito. Attivate la verifica in due passaggi dal profilo → Sicurezza.`,
+                title: t.n(adminsWithout.length, 'Un amministratore entra con la sola password', '{n} amministratori entrano con la sola password'),
+                detail: t('{names}: chi ruba quella password controlla tutto il sito. Attiva la verifica in due passaggi dal profilo → Sicurezza.', { names: adminsWithout.map((p) => p.name).join(', ') }),
                 action: adminsWithout.some((p) => p.id === c.get('user').id) ? 'profile' : 'people',
             }
             : {
                 id: 'admins-2fa',
                 status: 'ok',
-                title: 'Gli amministratori usano la verifica in due passaggi',
-                detail: 'Per entrare servono password e codice dal telefono.',
+                title: t('Gli amministratori usano la verifica in due passaggi'),
+                detail: t('Per entrare servono password e codice dal telefono.'),
             });
         checks.push(required
             ? {
                 id: 'everyone-2fa',
                 status: 'ok',
-                title: 'Verifica in due passaggi richiesta a tutti',
+                title: t('Verifica in due passaggi richiesta a tutti'),
                 detail: without.length
-                    ? `${without.length === 1 ? 'Una persona la attiverà' : `${without.length} persone la attiveranno`} al prossimo accesso.`
-                    : 'Tutti l’hanno attivata.',
+                    ? t.n(without.length, 'Una persona la attiverà al prossimo accesso.', '{n} persone la attiveranno al prossimo accesso.')
+                    : t('Tutti l’hanno attivata.'),
             }
             : {
                 id: 'everyone-2fa',
                 status: without.length ? 'warn' : 'ok',
                 title: without.length
-                    ? `${without.length === 1 ? 'Una persona entra' : `${without.length} persone entrano`} con la sola password`
-                    : 'Tutti usano la verifica in due passaggi',
+                    ? t.n(without.length, 'Una persona entra con la sola password', '{n} persone entrano con la sola password')
+                    : t('Tutti usano la verifica in due passaggi'),
                 detail: without.length
-                    ? 'Potete richiederla a tutti da Persone: chi non l’ha la attiverà al prossimo accesso.'
-                    : 'Potete anche richiederla a tutti da Persone, per chi entrerà in futuro.',
+                    ? t('Puoi richiederla a tutti da Persone: chi non l’ha la attiverà al prossimo accesso.')
+                    : t('Puoi anche richiederla a tutti da Persone, per chi entrerà in futuro.'),
                 action: without.length ? 'people' : undefined,
             });
         const mail = isConfigured(await settings.get('mail'));
@@ -967,14 +1122,14 @@ export function createApp(base) {
             ? {
                 id: 'mail',
                 status: 'ok',
-                title: 'Gli avvisi arrivano per email',
-                detail: 'Tentativi di accesso falliti, cambi di indirizzo e di verifica vengono segnalati a chi riguardano.',
+                title: t('Gli avvisi arrivano per email'),
+                detail: t('Tentativi di accesso falliti, cambi di indirizzo e di verifica vengono segnalati a chi riguardano.'),
             }
             : {
                 id: 'mail',
                 status: 'warn',
-                title: 'L’invio delle email non è configurato',
-                detail: 'Nessuno viene avvisato di tentativi di accesso falliti o di un indirizzo cambiato, e i link per una nuova password vanno mandati a mano.',
+                title: t('L’invio delle email non è configurato'),
+                detail: t('Nessuno viene avvisato di tentativi di accesso falliti o di un indirizzo cambiato, e i link per una nuova password vanno mandati a mano.'),
                 action: 'mail',
             });
         const url = new URL(c.req.url);
@@ -986,92 +1141,108 @@ export function createApp(base) {
             ? {
                 id: 'https',
                 status: 'info',
-                title: 'Pannello aperto in locale',
-                detail: 'Online, il sito va servito in HTTPS: password e sessioni viaggiano cifrate.',
+                title: t('Pannello aperto in locale'),
+                detail: t('Online, il sito va servito in HTTPS: password e sessioni viaggiano cifrate.'),
             }
             : secure
                 ? {
                     id: 'https',
                     status: 'ok',
-                    title: 'Connessione cifrata (HTTPS)',
-                    detail: 'Password e sessioni viaggiano cifrate.',
+                    title: t('Connessione cifrata (HTTPS)'),
+                    detail: t('Password e sessioni viaggiano cifrate.'),
                 }
                 : {
                     id: 'https',
                     status: 'bad',
-                    title: 'Il pannello non usa HTTPS',
-                    detail: 'Password e sessioni viaggiano in chiaro: attiva HTTPS sull’hosting (Let’s Encrypt è gratuito) o metti il sito dietro Cloudflare.',
+                    title: t('Il pannello non usa HTTPS'),
+                    detail: t('Password e sessioni viaggiano in chiaro: attiva HTTPS sull’hosting (Let’s Encrypt è gratuito) o metti il sito dietro Cloudflare.'),
                 });
+        // Without it, links in emails asked for from the sign-in page cannot be trusted, so none is sent.
+        if (!siteOrigin() && !local)
+            checks.push({
+                id: 'site-url',
+                status: 'warn',
+                title: t('L’indirizzo del sito non è impostato'),
+                detail: t('Senza, “Password dimenticata?” non manda il link: la richiesta può dichiarare un indirizzo falso. Imposta {env} nell’ambiente del server, o site.url in materialize.config.ts.', { env: 'MATERIALIZE_SITE_URL' }),
+            });
         const forwarded = !!c.req.header('x-forwarded-for');
         const trust = ctx.config().server.trustProxy;
         if (forwarded && !trust)
             checks.push({
                 id: 'proxy',
                 status: 'warn',
-                title: 'Il sito è dietro un proxy, ma non lo sa',
-                detail: 'Tutte le richieste sembrano arrivare dallo stesso indirizzo, quindi i limiti agli accessi per indirizzo non funzionano. Imposta server: { trustProxy: true } in materialize.config.ts.',
+                title: t('Il sito è dietro un proxy, ma non lo sa'),
+                detail: t('Tutte le richieste sembrano arrivare dallo stesso indirizzo, quindi i limiti agli accessi per indirizzo non funzionano. Imposta server: {code} in materialize.config.ts.', { code: '{ trustProxy: true }' }),
             });
         else if (trust && !forwarded && !local)
             checks.push({
                 id: 'proxy',
                 status: 'warn',
-                title: 'trustProxy è acceso, ma non arriva nessun proxy',
-                detail: 'Senza un proxy davanti, chiunque può dichiarare un indirizzo falso e aggirare i limiti agli accessi. Se il sito non è dietro un proxy, spegnilo in materialize.config.ts.',
+                title: t('trustProxy è acceso, ma non arriva nessun proxy'),
+                detail: t('Senza un proxy davanti, chiunque può dichiarare un indirizzo falso e aggirare i limiti agli accessi. Se il sito non è dietro un proxy, spegnilo in materialize.config.ts.'),
             });
         const day = new Date(Date.now() - 24 * 60 * 60_000);
         const failed = (await activityLog.countSince('login.failed', day)) + (await activityLog.countSince('login.code_failed', day));
         const locked = await activityLog.lockedKeys();
         checks.push({
             id: 'failed',
-            status: failed >= 20 || locked.length ? 'warn' : 'ok',
+            // Some failures are people mistyping; many, or a paused account, are someone trying.
+            status: failed >= 20 || locked.length ? 'warn' : failed ? 'info' : 'ok',
             title: failed
-                ? `${failed === 1 ? 'Un accesso fallito' : `${failed} accessi falliti`} nelle ultime 24 ore`
-                : 'Nessun accesso fallito nelle ultime 24 ore',
+                ? t.n(failed, 'Un accesso fallito nelle ultime 24 ore', '{n} accessi falliti nelle ultime 24 ore')
+                : t('Nessun accesso fallito nelle ultime 24 ore'),
             detail: locked.length
-                ? `In pausa adesso: ${locked
-                    .map((k) => k
-                    .replace(/^email:/, '')
-                    .replace(/^ip:/, 'indirizzo ')
-                    .replace(/^2fa:.*/, 'un codice di verifica'))
-                    .join(', ')}. Le pause finiscono da sole.`
-                : 'Dopo 5 errori un’email va in pausa, dopo 20 un indirizzo: la pausa raddoppia a ogni nuovo errore.',
+                ? t('In pausa adesso: {list}. Le pause finiscono da sole.', {
+                    list: locked
+                        .map((k) => k.startsWith('ip:')
+                        ? t('indirizzo {ip}', { ip: k.slice(3) })
+                        : k.startsWith('2fa:')
+                            ? t('un codice di verifica')
+                            : k.replace(/^email:/, ''))
+                        .join(', '),
+                })
+                : t('Dopo 5 errori un’email va in pausa, dopo 20 un indirizzo: la pausa raddoppia a ogni nuovo errore.'),
         });
         if (!backups.available())
             checks.push({
                 id: 'backups',
                 status: 'info',
-                title: 'Database ospitato da un fornitore',
-                detail: 'I backup del database li fa il fornitore (Turso, libSQL): controlla che siano attivi nel suo pannello.',
+                title: t('Database ospitato da un fornitore'),
+                detail: t('I backup del database li fa il fornitore (Turso, libSQL): controlla che siano attivi nel suo pannello.'),
             });
         else {
             const b = await backupSettings();
             const last = (await backups.list())[0];
             const age = last ? Date.now() - last.createdAt.getTime() : Number.POSITIVE_INFINITY;
+            const days = Math.round(age / 86_400_000);
             checks.push(!b.enabled
                 ? {
                     id: 'backups',
                     status: 'warn',
-                    title: 'Backup automatici spenti',
+                    title: t('Backup automatici spenti'),
                     detail: last
-                        ? `L’ultima copia è di ${Math.round(age / 86_400_000)} giorni fa. Riaccendili qui sotto.`
-                        : 'Non c’è nessuna copia del database. Riaccendili qui sotto.',
+                        ? t.n(days, 'L’ultima copia è di un giorno fa. Riaccendili qui sotto.', 'L’ultima copia è di {n} giorni fa. Riaccendili qui sotto.')
+                        : t('Non c’è nessuna copia del database. Riaccendili qui sotto.'),
                     action: 'backups',
                 }
                 : age > 2 * 86_400_000
                     ? {
                         id: 'backups',
                         status: last ? 'warn' : 'info',
-                        title: last ? 'L’ultimo backup è vecchio' : 'Il primo backup arriva a breve',
+                        title: last ? t('L’ultimo backup è vecchio') : t('Il primo backup arriva a breve'),
                         detail: last
-                            ? 'Il server fa una copia al giorno mentre è acceso: se resta spento a lungo, scaricane una a mano.'
-                            : 'Il server fa una copia del database poco dopo l’avvio, poi una al giorno.',
+                            ? t('Il server fa una copia al giorno mentre è acceso: se resta spento a lungo, scaricane una a mano.')
+                            : t('Il server fa una copia del database poco dopo l’avvio, poi una al giorno.'),
                         action: 'backups',
                     }
                     : {
                         id: 'backups',
                         status: 'ok',
-                        title: 'Backup del database ogni giorno',
-                        detail: `Ultima copia ${new Intl.RelativeTimeFormat('it', { numeric: 'auto' }).format(-Math.round(age / 3_600_000), 'hour')}, immagini comprese; ne restano ${b.keep}.`,
+                        title: t('Backup del database ogni giorno'),
+                        detail: t('Ultima copia {when}, immagini comprese; ne restano {keep}.', {
+                            when: hoursAgo(age),
+                            keep: b.keep,
+                        }),
                     });
         }
         {
@@ -1081,25 +1252,28 @@ export function createApp(base) {
                 ? {
                     id: 'offsite',
                     status: 'warn',
-                    title: 'I backup restano sul server',
-                    detail: 'Se il server si rompe, si perdono anche le copie. Attiva la copia fuori dal server (S3 o WebDAV), oppure scarica ogni tanto l’archivio completo.',
+                    title: t('I backup restano sul server'),
+                    detail: t('Se il server si rompe, si perdono anche le copie. Attiva la copia fuori dal server (S3 o WebDAV), oppure scarica ogni tanto l’archivio completo.'),
                     action: 'backups',
                 }
                 : status && !status.ok
                     ? {
                         id: 'offsite',
                         status: 'bad',
-                        title: 'La copia fuori dal server non riesce',
-                        detail: status.message ?? 'Controlla il collegamento.',
+                        title: t('La copia fuori dal server non riesce'),
+                        detail: status.message ?? t('Controlla il collegamento.'),
                         action: 'backups',
                     }
                     : {
                         id: 'offsite',
                         status: 'ok',
-                        title: 'Copia cifrata fuori dal server',
+                        title: t('Copia cifrata fuori dal server'),
                         detail: status
-                            ? `Ultima copia ${new Intl.RelativeTimeFormat('it', { numeric: 'auto' }).format(-Math.round((Date.now() - new Date(status.at).getTime()) / 3_600_000), 'hour')}, su ${o.kind === 's3' ? 'S3' : 'WebDAV'}.`
-                            : 'La prima copia parte entro un’ora.',
+                            ? t('Ultima copia {when}, su {where}.', {
+                                when: hoursAgo(Date.now() - new Date(status.at).getTime()),
+                                where: o.kind === 's3' ? 'S3' : 'WebDAV',
+                            })
+                            : t('La prima copia parte entro un’ora.'),
                     });
         }
         const tokens = await activityLog.tokens();
@@ -1108,10 +1282,10 @@ export function createApp(base) {
             checks.push({
                 id: 'tokens',
                 status: stale.length ? 'warn' : 'ok',
-                title: `${tokens.length === 1 ? 'Un token di accesso' : `${tokens.length} token di accesso`} per i client AI`,
+                title: t.n(tokens.length, 'Un token di accesso per i client AI', '{n} token di accesso per i client AI'),
                 detail: stale.length
-                    ? `${stale.length === 1 ? 'Uno non è usato' : `${stale.length} non sono usati`} da più di 90 giorni: chi li ha creati può revocarli da Impostazioni → AI e MCP.`
-                    : 'Tutti usati di recente. Ognuno può revocare i propri da Impostazioni → AI e MCP.',
+                    ? t.n(stale.length, 'Uno non è usato da più di 90 giorni: chi li ha creati può revocarli da Impostazioni → AI e MCP.', '{n} non sono usati da più di 90 giorni: chi li ha creati può revocarli da Impostazioni → AI e MCP.')
+                    : t('Tutti usati di recente. Ognuno può revocare i propri da Impostazioni → AI e MCP.'),
             });
         return c.json({ checks });
     });
@@ -1200,21 +1374,30 @@ export function createApp(base) {
         s3: s3Input.optional(),
         webdav: webdavInput.optional(),
     });
-    /** The settings as sent, with the saved secrets where the panel left them empty. */
+    /**
+     * The settings as sent, with the saved secrets where the panel left them empty — only for the
+     * same server: a secret is never sent to an address it was not given for (a stolen session
+     * could otherwise point the saved key to its own server and read it there).
+     */
     const withSecrets = (input, saved) => {
         if (input.kind === 's3' && !input.s3)
             throw new ApiError(400, 'missing_s3', 'S3 settings are missing');
         if (input.kind === 'webdav' && !input.webdav)
             throw new ApiError(400, 'missing_webdav', 'WebDAV settings are missing');
+        const sameS3 = !!input.s3 && sameServer(input.s3.endpoint, saved.s3?.endpoint);
+        const sameDav = !!input.webdav && sameServer(input.webdav.url, saved.webdav?.url);
         return {
             kind: input.kind,
             keep: input.keep,
             key: saved.key,
             s3: input.s3
-                ? { ...input.s3, secretAccessKey: input.s3.secretAccessKey || saved.s3?.secretAccessKey || '' }
+                ? {
+                    ...input.s3,
+                    secretAccessKey: input.s3.secretAccessKey || (sameS3 ? saved.s3?.secretAccessKey : '') || '',
+                }
                 : saved.s3,
             webdav: input.webdav
-                ? { ...input.webdav, password: input.webdav.password || saved.webdav?.password || '' }
+                ? { ...input.webdav, password: input.webdav.password || (sameDav ? saved.webdav?.password : '') || '' }
                 : saved.webdav,
         };
     };
@@ -1295,7 +1478,7 @@ export function createApp(base) {
                 latest: null,
                 notes: [],
                 checkedAt: null,
-                unavailable: 'Questo server non è avviato da materialize start: aggiorna da terminale.',
+                unavailable: t('Questo server non è avviato da materialize start: aggiorna da terminale.'),
                 previous: null,
                 job: { state: 'idle' },
                 last: null,
@@ -1310,7 +1493,7 @@ export function createApp(base) {
     app.post('/api/updates/install', requireUser, requireSession, requireAdmin, async (c) => {
         const input = await body(c, z.object({ version: z.string().regex(/^\d+\.\d+\.\d+$/) }));
         if (!ctx.updates)
-            throw new ApiError(409, 'updates_unavailable', 'Gli aggiornamenti dal pannello non sono disponibili qui');
+            throw new ApiError(409, 'updates_unavailable', t('Gli aggiornamenti dal pannello non sono disponibili qui'));
         try {
             await ctx.updates.install(input.version, backupBeforeUpdate);
         }
@@ -1322,7 +1505,7 @@ export function createApp(base) {
     });
     app.post('/api/updates/rollback', requireUser, requireSession, requireAdmin, async (c) => {
         if (!ctx.updates)
-            throw new ApiError(409, 'updates_unavailable', 'Gli aggiornamenti dal pannello non sono disponibili qui');
+            throw new ApiError(409, 'updates_unavailable', t('Gli aggiornamenti dal pannello non sono disponibili qui'));
         try {
             await ctx.updates.rollback();
         }
@@ -1369,11 +1552,17 @@ export function createApp(base) {
         return c.json({ user: await auth.updateUser(c.get('user').id, input) });
     });
     /** A changed sign-in address: the old one is told, in case it was not its owner who changed it. */
-    const emailChanged = async (before, after, by) => {
-        await mailNotice(before, 'Il tuo indirizzo email è cambiato', [
-            `${by === 'self' ? 'Hai cambiato' : `${by} ha cambiato`} l’indirizzo con cui entri nel pannello del sito: da ${before} a ${after}.`,
-            'Se non te lo aspettavi, rispondi a questa email o avvisa un amministratore del sito.',
-        ]);
+    const emailChanged = async (before, after, by, locale) => {
+        await withLang(langFor(locale), () => mailNotice(before, t('Il tuo indirizzo email è cambiato'), [
+            by === 'self'
+                ? t('Hai cambiato l’indirizzo con cui entri nel pannello del sito: da {before} a {after}.', { before, after })
+                : t('{by} ha cambiato l’indirizzo con cui entri nel pannello del sito: da {before} a {after}.', {
+                    by,
+                    before,
+                    after,
+                }),
+            t('Se non te lo aspettavi, rispondi a questa email o avvisa un amministratore del sito.'),
+        ]));
     };
     // Changing one's own email needs the password: a session left open is not enough.
     app.post('/api/auth/email', requireUser, requireSession, async (c) => {
@@ -1382,13 +1571,13 @@ export function createApp(base) {
         const hash = await auth.getPasswordHash(user.id);
         if (!hash || !(await verifyPassword(input.password, hash))) {
             throw new ApiError(422, 'wrong_password', 'The password is not correct', [
-                { path: 'password', message: 'La password non è corretta' },
+                { path: 'password', message: t('La password non è corretta') },
             ]);
         }
         try {
             const updated = await auth.updateUser(user.id, { email: input.email });
             if (updated && updated.email !== user.email) {
-                await emailChanged(user.email, updated.email, 'self');
+                await emailChanged(user.email, updated.email, 'self', user.locale);
                 await record(c, 'user.email', updated.email, { from: user.email });
             }
             return c.json({ user: updated });
@@ -1400,12 +1589,12 @@ export function createApp(base) {
         }
     });
     app.post('/api/auth/password', requireUser, requireSession, async (c) => {
-        const input = await body(c, z.object({ current: z.string().min(1), next: z.string().min(10) }));
+        const input = await body(c, z.object({ current: z.string().min(1).max(MAX_PASSWORD), next: z.string().min(10).max(MAX_PASSWORD) }));
         const user = c.get('user');
         const hash = await auth.getPasswordHash(user.id);
         if (!hash || !(await verifyPassword(input.current, hash))) {
             throw new ApiError(422, 'wrong_password', 'The current password is not correct', [
-                { path: 'current', message: 'La password attuale non è corretta' },
+                { path: 'current', message: t('La password attuale non è corretta') },
             ]);
         }
         // Other devices are signed out; this one stays in.
@@ -1431,9 +1620,9 @@ export function createApp(base) {
                 ttlMs: INVITE_TTL,
             });
             const link = linkPath(token);
-            const mailed = await mailLink(c, input.email, 'Il tuo invito', [
-                `${c.get('user').name} ti ha invitato a lavorare sul sito con Materialize.`,
-                'Apri questo link per scegliere la tua password ed entrare:',
+            const mailed = await mailLink(publicOrigin(c), input.email, t('Il tuo invito'), [
+                t('{name} ti ha invitato a lavorare sul sito con Materialize.', { name: c.get('user').name }),
+                t('Apri questo link per scegliere la tua password ed entrare:'),
             ], link);
             await record(c, 'user.invited', input.email, { role: input.role });
             return c.json({ invite, link, mailed }, 201);
@@ -1463,7 +1652,7 @@ export function createApp(base) {
         try {
             const updated = await auth.updateUser(target.id, input);
             if (updated && updated.email !== target.email) {
-                await emailChanged(target.email, updated.email, c.get('user').name);
+                await emailChanged(target.email, updated.email, c.get('user').name, target.locale);
                 await record(c, 'user.email', updated.email, { from: target.email });
             }
             if (updated && updated.role !== target.role)
@@ -1491,10 +1680,10 @@ export function createApp(base) {
     app.delete('/api/users/:id/two-factor', requireUser, requireSession, requireAdmin, async (c) => {
         const target = await loadUser(c.req.param('id'));
         await auth.disableTwoFactor(target.id);
-        await mailNotice(target.email, 'Verifica in due passaggi disattivata', [
-            `${c.get('user').name} ha disattivato la verifica in due passaggi del tuo account: per entrare nel pannello ora basta la password.`,
-            'Riattivala dal tuo profilo appena puoi. Se non te lo aspettavi, avvisa un amministratore.',
-        ]);
+        await withLang(langFor(target.locale), () => mailNotice(target.email, t('Verifica in due passaggi disattivata'), [
+            t('{name} ha disattivato la verifica in due passaggi del tuo account: per entrare nel pannello ora basta la password.', { name: c.get('user').name }),
+            t('Riattivala dal tuo profilo appena puoi. Se non te lo aspettavi, avvisa un amministratore.'),
+        ]));
         await record(c, 'twofactor.reset', target.email);
         return c.json({ user: await auth.getUser(target.id) });
     });
@@ -1510,7 +1699,7 @@ export function createApp(base) {
             ttlMs: RESET_TTL,
         });
         const link = linkPath(token);
-        const mailed = await mailLink(c, target.email, 'Nuova password', ['È stata chiesta una nuova password per il tuo account. Il link vale 24 ore:'], link);
+        const mailed = await withLang(langFor(target.locale), () => mailLink(publicOrigin(c), target.email, t('Nuova password'), [t('È stata chiesta una nuova password per il tuo account. Il link vale 24 ore:')], link));
         await record(c, 'user.reset_link', target.email);
         return c.json({ invite, link, mailed }, 201);
     });
@@ -1528,11 +1717,14 @@ export function createApp(base) {
     app.post('/api/invites/:token/accept', async (c) => {
         const token = c.req.param('token');
         const invite = await loadInvite(token);
-        const input = await body(c, z.object({ name: z.string().trim().min(1).max(80).optional(), password: z.string().min(10) }));
+        const input = await body(c, z.object({ name: z.string().trim().min(1).max(80).optional(), password: z.string().min(10).max(MAX_PASSWORD) }));
         const passwordHash = await hashPassword(input.password);
         let user;
         if (invite.kind === 'reset' && invite.userId) {
+            // Signed out everywhere (setPassword) and its tokens revoked: a reset is how an account
+            // someone else got into is won back, and what they made with it must stop working too.
             await auth.setPassword(invite.userId, passwordHash);
+            await auth.revokeAllTokens(invite.userId);
             user = await auth.getUser(invite.userId);
         }
         else {
@@ -1639,7 +1831,9 @@ export function createApp(base) {
             const usage = await globalUsage();
             const inUse = removed.find((id) => usage[id]?.length);
             if (inUse)
-                throw new ApiError(409, 'global_in_use', `La sezione è ancora in ${usage[inUse]?.map((t) => `“${t}”`).join(', ')}: toglila prima dalle pagine`);
+                throw new ApiError(409, 'global_in_use', t('La sezione è ancora in {pages}: toglila prima dalle pagine', {
+                    pages: usage[inUse]?.map((title) => `“${title}”`).join(', '),
+                }));
         }
         const ids = [...new Set([...Object.keys(before), ...Object.keys(input.globals)])].sort();
         await guardDesign(c.get('user'), ids.map((id) => before[id] ?? { id, type: 'frame' }), ids.map((id) => input.globals[id] ?? { id, type: 'frame' }));
@@ -1676,6 +1870,69 @@ export function createApp(base) {
         await comments.remove(comment.id);
         return c.body(null, 204);
     });
+    const turns = new Map();
+    const TURN_TTL = 45_000;
+    const turnOf = (docId) => {
+        const turn = turns.get(docId);
+        if (turn && Date.now() - turn.at > TURN_TTL) {
+            turns.delete(docId);
+            return null;
+        }
+        return turn ?? null;
+    };
+    const turnJson = (turn, user, tab) => ({
+        mine: !!turn && turn.userId === user.id && turn.tab === tab,
+        holder: turn ? { name: turn.name, since: new Date(turn.since).toISOString(), self: turn.userId === user.id } : null,
+    });
+    /** Holds the turn (or asks for it); take: true takes it from whoever has it. */
+    app.post('/api/documents/:id/turn', requireUser, async (c) => {
+        const input = await body(c, z.object({ tab: z.string().min(8).max(64), take: z.boolean().optional() }));
+        const user = c.get('user');
+        const docId = c.req.param('id');
+        const now = Date.now();
+        for (const [k, t] of turns)
+            if (now - t.at > TURN_TTL * 4)
+                turns.delete(k);
+        const turn = turnOf(docId);
+        if (!turn || (turn.userId === user.id && turn.tab === input.tab) || input.take) {
+            if (input.take && turn && turn.tab !== input.tab) {
+                // The one who had it learns who took it, at their next beat.
+                turns.set(`lost:${docId}:${turn.tab}`, { ...turn, takenBy: user.name, at: now });
+                const doc = await content.get(docId);
+                await record(c, 'document.turn_taken', doc?.title ?? '', { id: docId, from: turn.name });
+            }
+            const keep = turn && turn.userId === user.id && turn.tab === input.tab;
+            turns.set(docId, { userId: user.id, name: user.name, tab: input.tab, since: keep ? turn.since : now, at: now });
+            return c.json(turnJson(turnOf(docId), user, input.tab));
+        }
+        const taken = turns.get(`lost:${docId}:${input.tab}`);
+        if (taken)
+            turns.delete(`lost:${docId}:${input.tab}`);
+        return c.json({ ...turnJson(turn, user, input.tab), takenBy: taken?.takenBy ?? null });
+    });
+    /** Leaves the turn: the document closed. */
+    app.delete('/api/documents/:id/turn', requireUser, async (c) => {
+        const docId = c.req.param('id');
+        const turn = turnOf(docId);
+        if (turn && turn.userId === c.get('user').id && turn.tab === c.req.query('tab'))
+            turns.delete(docId);
+        return c.body(null, 204);
+    });
+    /**
+     * Changes to a document from someone who is not on turn are refused: from another person, or
+     * from another tab of the same person. The API and AI tools of the person on turn pass.
+     */
+    const guardTurn = (c, docId) => {
+        const turn = turnOf(docId);
+        if (!turn)
+            return;
+        const user = c.get('user');
+        const tab = c.req.header('x-mz-tab');
+        if (turn.userId !== user.id)
+            throw new ApiError(409, 'not_your_turn', t('{name} sta modificando questo documento: le tue modifiche non sono state salvate', { name: turn.name }));
+        if (tab && tab !== turn.tab)
+            throw new ApiError(409, 'not_your_turn', t('Questo documento è aperto in un’altra scheda: le modifiche di qui non sono state salvate'));
+    };
     app.post('/api/documents/:id/presence', requireUser, async (c) => {
         const input = await body(c, z.object({ selected: z.string().max(200).nullable() }));
         const user = c.get('user');
@@ -1705,26 +1962,37 @@ export function createApp(base) {
             return false;
         }
     };
-    /**
-     * The address links in emails point to: the site's own (MATERIALIZE_SITE_URL, site.url) when it
-     * is known. The request's Host header is used only without it, as in local development: anyone
-     * can send a request with a false Host, and a link to their server would carry the token there.
-     */
-    const publicOrigin = (c) => {
+    /** The site's own address (MATERIALIZE_SITE_URL, site.url), when it is set. */
+    const siteOrigin = () => {
         const site = ctx.config().site.url;
         try {
             if (site)
                 return new URL(site).origin;
         }
         catch { }
-        return new URL(c.req.url).origin;
+        return null;
     };
-    const mailLink = async (c, to, subject, lines, path) => {
+    /**
+     * The address links in emails point to: the site's own (MATERIALIZE_SITE_URL, site.url) when it
+     * is known. The request's Host header is used only without it, as in local development: anyone
+     * can send a request with a false Host, and a link to their server would carry the token there.
+     */
+    const publicOrigin = (c) => siteOrigin() ?? new URL(c.req.url).origin;
+    /**
+     * The address for links in emails asked for by someone not signed in (a forgotten password):
+     * never the Host header, which they choose, except on this computer during development. Null
+     * when the site's address is not set: then no link is sent (Impostazioni → Sicurezza says so).
+     */
+    const strangerOrigin = (c) => {
+        const url = new URL(c.req.url);
+        return siteOrigin() ?? (isLocalHost(url.hostname) ? url.origin : null);
+    };
+    const mailLink = async (origin, to, subject, lines, path) => {
         const mail = await settings.get('mail');
         if (!isConfigured(mail))
             return false;
         try {
-            const url = new URL(path, publicOrigin(c)).toString();
+            const url = new URL(path, origin).toString();
             await sendMail(mail, { to, subject, text: `${lines.join('\n')}\n\n${url}\n` });
             return true;
         }
@@ -1749,7 +2017,9 @@ export function createApp(base) {
             }),
         }));
         const before = await settings.get('mail');
-        const pass = input.mail.pass === null ? '' : input.mail.pass || before?.pass || '';
+        // The saved password goes only to the server it was given for (see withSecrets).
+        const sameHost = !!before && before.host.trim().toLowerCase() === input.mail.host.trim().toLowerCase();
+        const pass = input.mail.pass === null ? '' : input.mail.pass || (sameHost ? before?.pass : '') || '';
         const mail = { ...input.mail, pass };
         await settings.set('mail', mail, c.get('user').id);
         await record(c, 'settings.mail');
@@ -1763,8 +2033,8 @@ export function createApp(base) {
         try {
             await sendMail(mail, {
                 to,
-                subject: 'Prova di invio da Materialize',
-                text: 'Se leggi questo messaggio, l’invio delle email dal sito funziona.',
+                subject: t('Prova di invio da Materialize'),
+                text: t('Se leggi questo messaggio, l’invio delle email dal sito funziona.'),
             });
         }
         catch (error) {
@@ -1805,7 +2075,7 @@ export function createApp(base) {
     const readyAi = async () => {
         const ai = await aiSettings();
         if (!isReady(ai))
-            throw new ApiError(400, 'ai_not_configured', 'L’AI non è configurata: Impostazioni → AI e MCP');
+            throw new ApiError(400, 'ai_not_configured', t('L’AI non è configurata: Impostazioni → AI e MCP'));
         return { ...ai, onUsage: countUsage };
     };
     const aiFailed = (error) => {
@@ -1830,7 +2100,9 @@ export function createApp(base) {
             }),
         }));
         const before = await aiSettings();
-        const apiKey = input.ai.apiKey === null ? '' : input.ai.apiKey?.trim() || before.apiKey;
+        // The saved key goes only to the service it was given for (see withSecrets).
+        const sameService = before.provider === input.ai.provider && sameServer(before.baseUrl, input.ai.baseUrl);
+        const apiKey = input.ai.apiKey === null ? '' : input.ai.apiKey?.trim() || (sameService ? before.apiKey : '');
         const ai = { ...input.ai, apiKey };
         await settings.set('ai', ai, c.get('user').id);
         await record(c, 'settings.ai', ai.provider);
@@ -1869,7 +2141,7 @@ export function createApp(base) {
      */
     app.post('/api/voice/suggest', requireUser, requireAdmin, async (c) => {
         if (!allowAi(c.get('user').id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const ai = await readyAi();
         const config = ctx.config();
         const texts = [];
@@ -1886,7 +2158,7 @@ export function createApp(base) {
             }
         }
         if (size < 300)
-            throw new ApiError(400, 'too_little_text', 'Il sito ha ancora pochi testi pubblicati: scrivi la voce a mano');
+            throw new ApiError(400, 'too_little_text', t('Il sito ha ancora pochi testi pubblicati: scrivi la voce a mano'));
         const reply = await complete(ai, {
             system: 'You describe the voice of a brand from the texts of its website, for a style guide the brand will reuse. Reply with JSON only, no code fences.',
             prompt: `Read these texts of the website "${config.site.name}" and describe how it speaks, writing in the language of the texts.
@@ -1916,7 +2188,7 @@ ${texts.join('\n---\n')}
             address: ['tu', 'voi', 'lei'].includes(raw.address) ? raw.address : null,
         });
         if (!parsed.success)
-            throw new ApiError(422, 'ai_failed', 'L’AI non ha risposto come doveva: riprova');
+            throw new ApiError(422, 'ai_failed', t('L’AI non ha risposto come doveva: riprova'));
         return c.json({ voice: parsed.data, texts: texts.length });
     });
     // ---------- AI review before publishing ----------
@@ -1946,12 +2218,12 @@ ${texts.join('\n---\n')}
         const existing = await loadDocument(c.req.param('id'));
         const input = await body(c, z.object({ data: z.record(z.string(), z.unknown()).optional() }));
         if (!allowAi(c.get('user').id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const ai = await readyAi();
         const def = collection(existing.collection);
         const slots = documentSlots(def.fields, structuredClone(input.data ?? existing.data));
         if (!slots.length)
-            throw new ApiError(400, 'empty_text', 'Non c’è testo da rivedere');
+            throw new ApiError(400, 'empty_text', t('Non c’è testo da rivedere'));
         const titles = await pageTitles();
         const linkTo = (href) => {
             const path = href.split('#')[0] || href;
@@ -1991,7 +2263,7 @@ ${listed.join('\n')}
             raw = JSON.parse(reply.replace(/^\s*```(?:json)?|```\s*$/g, '').trim());
         }
         catch {
-            throw new ApiError(422, 'ai_failed', 'L’AI non ha risposto come doveva: riprova');
+            throw new ApiError(422, 'ai_failed', t('L’AI non ha risposto come doveva: riprova'));
         }
         const issue = z.object({
             slot: z.number().int().min(0),
@@ -2037,7 +2309,7 @@ ${listed.join('\n')}
             ? slots[input.slot]
             : slots.find((s) => s.text.includes(input.find));
         if (!slot)
-            throw new ApiError(409, 'changed', 'Quel testo è cambiato: rifai la revisione');
+            throw new ApiError(409, 'changed', t('Quel testo è cambiato: rifai la revisione'));
         slot.set(slot.text.replace(input.find, input.replace));
         return c.json({ data });
     });
@@ -2067,7 +2339,7 @@ ${listed.join('\n')}
             max: z.number().int().positive().max(100_000).optional(),
         }));
         if (!allowAi(c.get('user').id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const ai = await readyAi();
         // Writing from scratch takes the whole voice; changing a text, only its style.
         const voice = await voiceText(['seo_title', 'seo_description', 'custom'].includes(input.action) ? 'full' : 'style');
@@ -2079,7 +2351,7 @@ ${listed.join('\n')}
             const key = /^\/media\/([^/?#@]+)/.exec(input.src ?? '')?.[1];
             const file = key ? await files.open(decodeURIComponent(key), { width: 1024, format: 'jpg' }) : null;
             if (!file)
-                throw new ApiError(400, 'no_image', 'Scegli prima un’immagine della libreria');
+                throw new ApiError(400, 'no_image', t('Scegli prima un’immagine della libreria'));
             const data = (await readFile(file.path)).toString('base64');
             // The text already there may credit the photographer or the source: that part stays.
             const current = input.text.trim()
@@ -2094,7 +2366,7 @@ ${listed.join('\n')}
             return c.json({ text });
         }
         if (!input.text.trim())
-            throw new ApiError(400, 'empty_text', 'Non c’è testo su cui lavorare');
+            throw new ApiError(400, 'empty_text', t('Non c’è testo su cui lavorare'));
         const task = input.action === 'translate'
             ? `Translate it into ${input.instruction || 'English'}, naturally, as a native writer would.`
             : input.action === 'custom'
@@ -2158,7 +2430,7 @@ ${listed.join('\n')}
         }));
         const user = c.get('user');
         if (!allowAi(user.id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const ai = await readyAi();
         const now = Date.now();
         for (const [k, v] of chats)
@@ -2210,7 +2482,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     if (limited && !sameDesign(before, page.nodes))
                         await send({
                             type: 'error',
-                            message: 'Puoi cambiare solo i contenuti: le modifiche al layout non sono state applicate.',
+                            message: t('Puoi cambiare solo i contenuti: le modifiche al layout non sono state applicate.'),
                         });
                     else
                         await send({ type: 'page', nodes: page.nodes });
@@ -2223,7 +2495,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     console.error(error);
                 // A failed turn leaves the conversation as it was before it.
                 chats.delete(key);
-                await send({ type: 'error', message: error instanceof Error ? error.message : 'Errore' });
+                await send({ type: 'error', message: error instanceof Error ? error.message : t('Errore') });
                 await send({ type: 'done', chatId });
             }
         });
@@ -2235,7 +2507,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.post('/api/ai/site', requireUser, requireSession, requireAdmin, async (c) => {
         const input = await body(c, z
             .object({
-            brief: z.string().trim().min(20, 'Scrivi qualche riga in più sull’attività').max(6000).optional(),
+            brief: z.string().trim().min(20, t('Scrivi qualche riga in più sull’attività')).max(6000).optional(),
             /** A reply in a run already started, with its id. */
             runId: z.string().max(64).optional(),
             message: z.string().trim().min(1).max(4000).optional(),
@@ -2248,10 +2520,10 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 .max(2)
                 .default([]),
         })
-            .refine((v) => (v.runId ? !!v.message : !!v.brief), { message: 'Scrivi il brief' }));
+            .refine((v) => (v.runId ? !!v.message : !!v.brief), { message: t('Scrivi il brief') }));
         const user = c.get('user');
         if (!allowAi(user.id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const ai = await readyAi();
         const now = Date.now();
         for (const [k, v] of briefRuns)
@@ -2261,12 +2533,12 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const key = `${user.id}:${runId}`;
         let run = input.runId ? briefRuns.get(key) : undefined;
         if (input.runId && (!run || run.conv.provider !== ai.provider))
-            throw new ApiError(409, 'run_expired', 'Questa conversazione non c’è più: parti da un nuovo brief');
+            throw new ApiError(409, 'run_expired', t('Questa conversazione non c’è più: parti da un nuovo brief'));
         if (!run) {
             const config = ctx.config();
             const pageCollections = config.collections.filter((d) => !d.singleton && Object.values(d.fields).some((f) => f.kind === 'page'));
             if (!pageCollections.length)
-                throw new ApiError(400, 'no_pages', 'Il sito non ha una raccolta di pagine costruite sulla tela');
+                throw new ApiError(400, 'no_pages', t('Il sito non ha una raccolta di pagine costruite sulla tela'));
             const locale = config.locales.default;
             const existing = [];
             for (const d of config.collections.filter((x) => !x.singleton)) {
@@ -2336,7 +2608,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 // What was made before the failure stays, as drafts: the panel lists it. The run ends.
                 briefRuns.delete(key);
                 await send({ type: 'result', ...result });
-                await send({ type: 'error', message: error instanceof Error ? error.message : 'Errore' });
+                await send({ type: 'error', message: error instanceof Error ? error.message : t('Errore') });
                 await send({ type: 'done' });
             }
         });
@@ -2357,7 +2629,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         }));
         const user = c.get('user');
         if (!allowAi(user.id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const ai = await readyAi();
         const now = Date.now();
         for (const [k, v] of studioRuns)
@@ -2412,7 +2684,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 if (!(error instanceof AiError))
                     console.error(error);
                 studioRuns.delete(key);
-                await send({ type: 'error', message: error instanceof Error ? error.message : 'Errore' });
+                await send({ type: 'error', message: error instanceof Error ? error.message : t('Errore') });
                 await send({ type: 'done' });
             }
         });
@@ -2469,8 +2741,9 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     }), async (c) => {
         const form = c.req.param('form').slice(0, 80);
         const ip = clientIp(c);
-        if (!allowForm(`${ip}:${form}`))
-            throw new ApiError(429, 'too_many_attempts', 'Troppi messaggi: riprova tra un minuto');
+        const tooMany = () => new ApiError(429, 'too_many_attempts', 'Troppi messaggi: riprova tra un minuto');
+        if (!allowFormIp(ip) || !allowFormIpHour(ip) || !allowForm(`${ip}:${form}`))
+            throw tooMany();
         const type = c.req.header('content-type') ?? '';
         const isJson = type.includes('application/json');
         const wantsJson = isJson || (c.req.header('accept') ?? '').includes('application/json');
@@ -2481,6 +2754,8 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         if (typeof raw._gotcha === 'string' && raw._gotcha.length > 0)
             return wantsJson ? c.json({ ok: true }) : c.redirect(`${back}#inviato`, 303);
         const def = (await publishedForms()).get(form) ?? null;
+        if (!def && !allowHandForm(ip))
+            throw tooMany();
         const { data, files, issues } = await readSubmission(raw, def);
         if (issues.length) {
             if (!wantsJson)
@@ -2492,7 +2767,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const elapsed = typeof raw._t === 'string' && /^\d+$/.test(raw._t) ? Number(raw._t) : null;
         const fingerprint = fingerprintOf(form, data);
         const spam = spamReason(data, elapsed) ??
-            ((await submissions.seen(fingerprint, new Date(Date.now() - 86_400_000))) ? 'Messaggio ripetuto' : null);
+            ((await submissions.seen(fingerprint, new Date(Date.now() - 86_400_000))) ? t.keep('Messaggio ripetuto') : null);
         // A signup form: no message, a subscriber waiting to confirm. Spam gets the same answer.
         if (def?.newsletter) {
             if (!spam)
@@ -2501,7 +2776,8 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         }
         const formName = def?.name?.trim() || def?.subject?.trim() || '';
         const saved = await submissions.add({ form, formName, page, data, spam, fingerprint });
-        if (files.length)
+        // Spam keeps its words, for a check, but not its files: they would only fill the disk.
+        if (files.length && !spam)
             await submissions.setFiles(saved.id, await saveFiles(uploadsDir, saved.id, files));
         // Spam stays in the panel, recoverable, but nobody is notified.
         if (!spam) {
@@ -2510,13 +2786,17 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             const sender = Object.entries(data).find(([k, v]) => (def?.fields.find((f) => f.name === k)?.kind === 'email' || /mail/i.test(k)) && /^[^\s@]+@[^\s@]+$/.test(v))?.[1];
             if (isConfigured(mail) && to) {
                 const subject = def?.subject || (typeof raw._subject === 'string' ? raw._subject.slice(0, 120) : '');
-                const attached = files.length
-                    ? `\n\nAllegati (${files.map((f) => f.name).join(', ')}): li trovi in Impostazioni → Messaggi.`
-                    : '';
+                // The visitor's request says nothing about who reads this: it goes in the owner's language.
+                const notice = withLang(await ownerLang(to), () => ({
+                    subject: subject ? t('Nuovo messaggio dal sito: {subject}', { subject }) : t('Nuovo messaggio dal sito'),
+                    text: submissionText(page, data) +
+                        (files.length
+                            ? `\n\n${t('Allegati ({files}): li trovi in Impostazioni → Messaggi.', { files: files.map((f) => f.name).join(', ') })}`
+                            : ''),
+                }));
                 sendMail(mail, {
                     to,
-                    subject: `Nuovo messaggio dal sito${subject ? `: ${subject}` : ''}`,
-                    text: submissionText(page, data) + attached,
+                    ...notice,
                     replyTo: sender,
                 })
                     .then(() => submissions.markMailed(saved.id))
@@ -2540,7 +2820,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     createdAt: saved.createdAt.toISOString(),
                 };
                 void webhookSecret()
-                    .then((secret) => sendWebhook(def.webhook, payload, secret))
+                    .then((secret) => sendWebhook(def.webhook, payload, secret, undefined, privateWebhooks))
                     .then((ok) => submissions.setWebhook(saved.id, ok ? 'ok' : 'failed'))
                     .catch((error) => console.error('Materialize: webhook not sent', error));
             }
@@ -2556,8 +2836,11 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.get('/api/submissions', requireUser, async (c) => {
         const limit = Math.min(Number(c.req.query('limit') ?? 50), 200);
         const offset = Math.max(Number(c.req.query('offset') ?? 0), 0);
+        const list = await submissions.list(limit, offset, filterOf(c));
         return c.json({
-            ...(await submissions.list(limit, offset, filterOf(c))),
+            ...list,
+            // The spam reason is saved as a kept text: read in the language of whoever looks.
+            items: list.items.map((m) => ({ ...m, spam: m.spam && t.read(m.spam) })),
             forms: await submissions.forms(),
         });
     });
@@ -2571,7 +2854,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             return /[",\n;]/.test(safe) ? `"${safe.replace(/"/g, '""')}"` : safe;
         };
         const rows = [
-            ['Data', 'Modulo', 'Pagina', ...fields],
+            [t('Data'), t('Modulo'), t('Pagina'), ...fields],
             ...items.map((m) => [
                 m.createdAt.toISOString(),
                 m.formName || m.form,
@@ -2595,7 +2878,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         if (input.read !== undefined)
             await submissions.markRead(id, input.read);
         if (input.spam !== undefined)
-            await submissions.markSpam(id, input.spam ? 'Segnato a mano' : null);
+            await submissions.markSpam(id, input.spam ? t.keep('Segnato a mano') : null);
         return c.json({ ok: true });
     });
     /** A file sent with a message: always downloaded, never opened in the panel's own page. */
@@ -2603,10 +2886,10 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const message = await submissions.get(c.req.param('id'));
         const file = message?.files[Number(c.req.param('n'))];
         if (!message || !file)
-            throw new ApiError(404, 'not_found', 'File non trovato');
+            throw new ApiError(404, 'not_found', t('File non trovato'));
         const bytes = await readFile(join(uploadsDir, file.path)).catch(() => null);
         if (!bytes)
-            throw new ApiError(404, 'not_found', 'Il file non c’è più');
+            throw new ApiError(404, 'not_found', t('Il file non c’è più'));
         return new Response(bytes, {
             headers: {
                 'content-type': 'application/octet-stream',
@@ -2674,14 +2957,14 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const category = z.enum(['necessary', 'analytics', 'marketing']);
         const input = await body(c, z.object({
             tracking: z.object({
-                ga4: id(TRACKING_PATTERNS.ga4, 'Un ID di Google Analytics 4 inizia con G-'),
-                gtm: id(TRACKING_PATTERNS.gtm, 'Un ID di Tag Manager inizia con GTM-'),
+                ga4: id(TRACKING_PATTERNS.ga4, t('Un ID di Google Analytics 4 inizia con G-')),
+                gtm: id(TRACKING_PATTERNS.gtm, t('Un ID di Tag Manager inizia con GTM-')),
                 gtmCategory: category.optional(),
-                metaPixel: id(TRACKING_PATTERNS.metaPixel, 'L’ID del Pixel è fatto di sole cifre'),
-                plausible: id(TRACKING_PATTERNS.plausible, 'Scrivi il dominio come su Plausible, per esempio example.com'),
-                plausibleSrc: id(/^https:\/\/[^"<>\s]+$/, 'Un indirizzo https://'),
-                matomoUrl: id(/^https:\/\/[^"'<>\s]+$/, 'L’indirizzo di Matomo, con https://'),
-                matomoSiteId: id(TRACKING_PATTERNS.matomoSiteId, 'Il numero del sito su Matomo'),
+                metaPixel: id(TRACKING_PATTERNS.metaPixel, t('L’ID del Pixel è fatto di sole cifre')),
+                plausible: id(TRACKING_PATTERNS.plausible, t('Scrivi il dominio come su Plausible, per esempio example.com')),
+                plausibleSrc: id(/^https:\/\/[^"<>\s]+$/, t('Un indirizzo https://')),
+                matomoUrl: id(/^https:\/\/[^"'<>\s]+$/, t('L’indirizzo di Matomo, con https://')),
+                matomoSiteId: id(TRACKING_PATTERNS.matomoSiteId, t('Il numero del sito su Matomo')),
                 custom: z
                     .array(z.object({
                     id: z.string().min(1).max(40),
@@ -2691,7 +2974,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     code: z
                         .string()
                         .max(20_000)
-                        .refine((v) => !/<\/template/i.test(v), 'Il codice non può contenere </template>'),
+                        .refine((v) => !/<\/template/i.test(v), t('Il codice non può contenere </template>')),
                 }))
                     .max(30)
                     .optional(),
@@ -2699,7 +2982,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     .object({
                     title: z.string().trim().max(120).optional(),
                     text: z.string().trim().max(600).optional(),
-                    policyUrl: id(/^(https?:\/\/|\/)[^"<>\s]*$/, 'Un indirizzo che inizia con / o https://'),
+                    policyUrl: id(/^(https?:\/\/|\/)[^"<>\s]*$/, t('Un indirizzo che inizia con / o https://')),
                     position: z.enum(['bottom', 'corner']).optional(),
                     reopenButton: z.boolean().optional(),
                 })
@@ -2888,6 +3171,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.get('/api/documents/:id', requireUser, async (c) => c.json(await toJson(await loadDocument(c.req.param('id')))));
     app.put('/api/documents/:id', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
+        guardTurn(c, existing.id);
         const input = await body(c, documentBody);
         const def = collection(existing.collection);
         const draft = draftData(def, input.data);
@@ -2960,18 +3244,18 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         }
         const at = new Date(input.at);
         if (at.getTime() <= Date.now() + 30_000)
-            throw new ApiError(400, 'past_time', 'Scegli un momento nel futuro, almeno tra un minuto');
+            throw new ApiError(400, 'past_time', t('Scegli un momento nel futuro, almeno tra un minuto'));
         const current = await schedules.forDocument(existing.id);
         if (input.action === 'publish')
             publishableData(collection(existing.collection), existing.data);
         else {
             if (!existing.publishedAt && !current.publish)
-                throw new ApiError(409, 'not_published', 'La pagina non è sul sito: programma prima la pubblicazione');
+                throw new ApiError(409, 'not_published', t('La pagina non è sul sito: programma prima la pubblicazione'));
             if (current.publish && current.publish.runAt >= at)
-                throw new ApiError(400, 'before_publish', 'La pagina verrebbe tolta prima di essere pubblicata');
+                throw new ApiError(400, 'before_publish', t('La pagina verrebbe tolta prima di essere pubblicata'));
         }
         if (input.action === 'publish' && current.unpublish && current.unpublish.runAt <= at)
-            throw new ApiError(400, 'after_unpublish', 'La pubblicazione verrebbe dopo il momento in cui la pagina va tolta');
+            throw new ApiError(400, 'after_unpublish', t('La pubblicazione verrebbe dopo il momento in cui la pagina va tolta'));
         await schedules.set({ documentId: existing.id, action: input.action, runAt: at, user });
         await record(c, 'document.scheduled', existing.title, {
             collection: existing.collection,
@@ -2985,12 +3269,14 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     const publishProblem = (doc) => {
         const def = ctx.config().collections.find((x) => x.name === doc.collection);
         if (!def)
-            return 'La raccolta non esiste più';
+            return t.keep('La raccolta non esiste più');
         const check = validate(def, prepare(def, doc.data));
         if (check.ok)
             return null;
         const fields = [...new Set(check.issues.map((i) => def.fields[i.path.split('.')[0] ?? '']?.label ?? i.path))];
-        return `Alcuni campi vanno completati${fields.length ? `: ${fields.join(', ')}` : ''}`;
+        return fields.length
+            ? t.keep('Alcuni campi vanno completati: {fields}', { fields: fields.join(', ') })
+            : t.keep('Alcuni campi vanno completati');
     };
     /**
      * Runs the actions whose time has come, as the person who set them. A server that was off at the
@@ -3017,7 +3303,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     .catch((error) => console.error('Materialize: activity not recorded', error));
                 const existing = await content.get(item.documentId);
                 if (!existing) {
-                    await schedules.finish(item.id, 'failed', 'La pagina non esiste più');
+                    await schedules.finish(item.id, 'failed', t.keep('La pagina non esiste più'));
                     continue;
                 }
                 try {
@@ -3037,7 +3323,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     ran++;
                 }
                 catch (error) {
-                    const message = error instanceof Error && error.message ? error.message : 'Errore imprevisto';
+                    const message = error instanceof Error && error.message ? error.message : t.keep('Errore imprevisto');
                     await schedules.finish(item.id, 'failed', message);
                     await note('document.schedule_failed', existing.title, {
                         collection: existing.collection,
@@ -3083,7 +3369,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         for (const item of release.items) {
             const doc = await content.get(item.documentId);
             if (!doc)
-                out.push({ documentId: item.documentId, title: '', message: 'La pagina non esiste più' });
+                out.push({ documentId: item.documentId, title: '', message: t.keep('La pagina non esiste più') });
             else if (item.action === 'publish') {
                 const message = publishProblem(doc);
                 if (message)
@@ -3091,7 +3377,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             }
         }
         if (!release.items.length)
-            out.push({ documentId: '', title: '', message: 'Il rilascio è vuoto' });
+            out.push({ documentId: '', title: '', message: t.keep('Il rilascio è vuoto') });
         return out;
     };
     /**
@@ -3104,7 +3390,9 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             .catch((error) => console.error('Materialize: activity not recorded', error));
         const problems = await releaseProblems(release);
         if (problems.length) {
-            const message = problems.map((p) => (p.title ? `${p.title}: ${p.message}` : p.message)).join('; ');
+            const message = t.keep('{list}', {
+                list: problems.map((p) => p.title ? t.keep('{title}: {message}', { title: p.title, message: p.message }) : p.message),
+            });
             await releases.finish(release.id, 'failed', message);
             await note('release.failed', release.name, { id: release.id, message });
             return false;
@@ -3127,8 +3415,8 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             }
         }
         catch (error) {
-            const why = error instanceof Error && error.message ? error.message : 'Errore imprevisto';
-            const message = `${why}${done.length ? ` (già uscite: ${done.join(', ')})` : ''}`;
+            const why = error instanceof Error && error.message ? error.message : t.keep('Errore imprevisto');
+            const message = done.length ? t.keep('{why} (già uscite: {done})', { why, done: done.join(', ') }) : why;
             await releases.finish(release.id, 'failed', message);
             await note('release.failed', release.name, { id: release.id, message });
             return false;
@@ -3151,21 +3439,21 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 collection: doc.collection,
                 locale: doc.locale,
                 status: doc.status,
-                problem: problems.find((p) => p.documentId === doc.id)?.message ?? null,
+                problem: t.read(problems.find((p) => p.documentId === doc.id)?.message) || null,
             });
         }
-        return { ...release, items, ready: problems.length === 0 };
+        return { ...release, error: release.error && t.read(release.error), items, ready: problems.length === 0 };
     };
     const loadRelease = async (id) => {
         const release = await releases.get(id);
         if (!release)
-            throw new ApiError(404, 'not_found', 'Questo rilascio non esiste');
+            throw new ApiError(404, 'not_found', t('Questo rilascio non esiste'));
         return release;
     };
     const openRelease = async (id) => {
         const release = await loadRelease(id);
         if (release.status === 'published' || release.status === 'cancelled')
-            throw new ApiError(409, 'release_closed', 'Questo rilascio è già uscito o è stato annullato');
+            throw new ApiError(409, 'release_closed', t('Questo rilascio è già uscito o è stato annullato'));
         return release;
     };
     app.get('/api/releases', requireUser, async (c) => {
@@ -3201,7 +3489,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const doc = await loadDocument(c.req.param('documentId'));
         const input = await body(c, z.object({ action: z.enum(['publish', 'unpublish']).default('publish') }));
         if (input.action === 'unpublish' && !doc.publishedAt)
-            throw new ApiError(409, 'not_published', 'La pagina non è sul sito: non c’è niente da togliere');
+            throw new ApiError(409, 'not_published', t('La pagina non è sul sito: non c’è niente da togliere'));
         await releases.put(release.id, doc.id, input.action);
         await record(c, 'release.item_added', doc.title, { id: release.id, release: release.name, action: input.action });
         return c.json(await releaseJson(await loadRelease(release.id)));
@@ -3219,15 +3507,15 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             return c.json({
                 error: {
                     code: 'release_not_ready',
-                    message: 'Alcune pagine non sono pronte: non è uscito niente',
-                    problems,
+                    message: t('Alcune pagine non sono pronte: non è uscito niente'),
+                    problems: problems.map((p) => ({ ...p, message: t.read(p.message) })),
                 },
             }, 422);
         const user = c.get('user');
         const ok = await releaseOut(release, user);
         const after = await loadRelease(release.id);
         if (!ok)
-            throw new ApiError(422, 'release_failed', after.error ?? 'Il rilascio non è uscito');
+            throw new ApiError(422, 'release_failed', after.error ? t.read(after.error) : t('Il rilascio non è uscito'));
         return c.json(await releaseJson(after));
     });
     /** When the release goes out by itself; at null: only by hand. Checked now, and again at that moment. */
@@ -3242,9 +3530,9 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         }
         const at = new Date(input.at);
         if (at.getTime() <= Date.now() + 30_000)
-            throw new ApiError(400, 'past_time', 'Scegli un momento nel futuro, almeno tra un minuto');
+            throw new ApiError(400, 'past_time', t('Scegli un momento nel futuro, almeno tra un minuto'));
         if (!release.items.length)
-            throw new ApiError(400, 'empty_release', 'Aggiungi prima qualcosa al rilascio');
+            throw new ApiError(400, 'empty_release', t('Aggiungi prima qualcosa al rilascio'));
         await releases.schedule(release.id, at, user);
         await record(c, 'release.scheduled', release.name, { id: release.id, at: at.toISOString() });
         return c.json(await releaseJson(await loadRelease(release.id)));
@@ -3413,7 +3701,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.delete('/api/subscribers/:id', requireUser, requireAdmin, async (c) => {
         const found = await newsletter.subscriber(c.req.param('id'));
         if (!found)
-            throw new ApiError(404, 'not_found', 'Questo iscritto non esiste');
+            throw new ApiError(404, 'not_found', t('Questo iscritto non esiste'));
         await newsletter.removeSubscriber(found.id);
         await record(c, 'newsletter.subscriber_removed', found.email);
         return c.body(null, 204);
@@ -3422,7 +3710,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const input = await body(c, z.object({ csv: z.string().max(5_000_000) }));
         const rows = parseSubscribersCsv(input.csv);
         if (!rows.length)
-            throw new ApiError(422, 'no_addresses', 'Nel file non ho trovato indirizzi email');
+            throw new ApiError(422, 'no_addresses', t('Nel file non ho trovato indirizzi email'));
         const result = await newsletter.importMany(rows);
         await record(c, 'newsletter.imported', '', result);
         return c.json({ found: rows.length, ...result });
@@ -3461,16 +3749,20 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         return c.json(input);
     });
     // ----- panel: newsletters -----
-    const newsletterJson = async (n) => ({ ...n, stats: await newsletter.stats(n.id) });
+    const newsletterJson = async (n) => ({
+        ...n,
+        error: n.error && t.read(n.error),
+        stats: await newsletter.stats(n.id),
+    });
     const loadNewsletter = async (id) => {
         const found = await newsletter.get(id);
         if (!found)
-            throw new ApiError(404, 'not_found', 'Questa newsletter non esiste');
+            throw new ApiError(404, 'not_found', t('Questa newsletter non esiste'));
         return found;
     };
     const editable = (n) => {
         if (n.status === 'sending' || n.status === 'sent')
-            throw new ApiError(409, 'newsletter_sent', 'Questa newsletter è già partita: non si può più cambiare');
+            throw new ApiError(409, 'newsletter_sent', t('Questa newsletter è già partita: non si può più cambiare'));
     };
     const newsletterBody = z.object({
         subject: z.string().trim().min(1).max(200),
@@ -3495,7 +3787,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.delete('/api/newsletters/:id', requireUser, async (c) => {
         const found = await loadNewsletter(c.req.param('id'));
         if (found.status === 'sending')
-            throw new ApiError(409, 'newsletter_sending', 'La newsletter sta partendo: aspetta che finisca');
+            throw new ApiError(409, 'newsletter_sending', t('La newsletter sta partendo: aspetta che finisca'));
         await newsletter.remove(found.id);
         await record(c, 'newsletter.deleted', found.subject);
         return c.body(null, 204);
@@ -3538,17 +3830,25 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     const readyMail = async () => {
         const mail = await settings.get('mail');
         if (!isConfigured(mail))
-            throw new ApiError(400, 'mail_not_configured', 'Per inviare la newsletter serve l’email: Impostazioni → Email');
+            throw new ApiError(400, 'mail_not_configured', t('Per inviare la newsletter serve l’email: Impostazioni → Email'));
         return mail;
     };
     /** A try, to the person writing it (or another address): nothing is counted. */
+    // Each try is an email to any address: a few an hour are plenty to check one.
+    const allowNewsletterTest = createLimiter(10, 60 * 60_000);
     app.post('/api/newsletters/:id/test', requireUser, async (c) => {
+        if (!allowNewsletterTest(c.get('user').id))
+            throw new ApiError(429, 'too_many_attempts', t('Troppe prove: riprova tra un’ora'));
         const found = await loadNewsletter(c.req.param('id'));
         const input = await body(c, z.object({ to: z.email().optional() }));
         const mail = await readyMail();
         await newsletterOrigin(c);
         const message = await composeNewsletter(found, null);
-        await sendMail(mail, { to: input.to ?? c.get('user').email, ...message, subject: `[Prova] ${message.subject}` });
+        await sendMail(mail, {
+            to: input.to ?? c.get('user').email,
+            ...message,
+            subject: t('[Prova] {subject}', { subject: message.subject }),
+        });
         return c.json({ ok: true });
     });
     app.post('/api/newsletters/:id/send', requireUser, async (c) => {
@@ -3558,7 +3858,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         await newsletterOrigin(c);
         const { counts } = await newsletter.subscribers({ limit: 1 });
         if (!counts.active)
-            throw new ApiError(400, 'no_subscribers', 'Non ci sono ancora iscritti attivi');
+            throw new ApiError(400, 'no_subscribers', t('Non ci sono ancora iscritti attivi'));
         await newsletter.setStatus(found.id, 'sending', { runAt: new Date(), error: null });
         await record(c, 'newsletter.sent', found.subject, { subscribers: counts.active });
         void runNewsletters();
@@ -3574,7 +3874,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         }
         const at = new Date(input.at);
         if (at.getTime() <= Date.now() + 30_000)
-            throw new ApiError(400, 'past_time', 'Scegli un momento nel futuro, almeno tra un minuto');
+            throw new ApiError(400, 'past_time', t('Scegli un momento nel futuro, almeno tra un minuto'));
         await readyMail();
         await newsletterOrigin(c);
         await newsletter.setStatus(found.id, 'scheduled', { runAt: at, error: null });
@@ -3624,7 +3924,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const input = await body(c, z.object({ count: z.number().int().min(1).max(10).default(3), note: z.string().max(1000).optional() }));
         const user = c.get('user');
         if (!allowAi(user.id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const ai = await readyAi();
         const config = ctx.config();
         const lang = config.locales.default;
@@ -3654,7 +3954,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         items.sort((a, b) => b.date - a.date);
         const latest = items.slice(0, input.count);
         if (!latest.length)
-            throw new ApiError(400, 'no_articles', 'Non ci sono ancora articoli pubblicati da raccontare');
+            throw new ApiError(400, 'no_articles', t('Non ci sono ancora articoli pubblicati da raccontare'));
         const voice = await voiceText();
         const system = `${voice ? `${voice}\n\n` : ''}You write the email newsletter of the website "${config.site.name}", in ${languageName(lang)}. You get its latest articles; write a short newsletter that makes people want to read them: a subject (at most 70 characters), a preheader (one sentence, at most 120 characters), an opening of one or two sentences, then for each article a heading with its title and two or three sentences on why it is worth reading, ending with a link to it. Use only facts from the articles. Reply with JSON only: {"subject": "...", "preheader": "...", "blocks": [{"type": "paragraph"|"heading", "text": "...", "link": {"text": "...", "href": "..."}?}]}.`;
         const prompt = `${input.note ? `<note>${input.note}</note>\n` : ''}${latest.map((a) => `<article title="${a.title.replace(/"/g, "'")}" url="${a.url}">\n${a.text}\n</article>`).join('\n')}`;
@@ -3664,7 +3964,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             parsed = JSON.parse(reply.replace(/^```(?:json)?\s*|\s*```$/g, ''));
         }
         catch {
-            throw new ApiError(422, 'ai_failed', 'La risposta dell’AI non era leggibile: riprova');
+            throw new ApiError(422, 'ai_failed', t('La risposta dell’AI non era leggibile: riprova'));
         }
         const known = new Set(latest.map((a) => a.url));
         const blocks = [];
@@ -3700,7 +4000,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             for (const n of await newsletter.due(now)) {
                 const mail = await settings.get('mail');
                 if (!isConfigured(mail)) {
-                    await newsletter.setStatus(n.id, 'failed', { error: 'L’email non è configurata' });
+                    await newsletter.setStatus(n.id, 'failed', { error: t.keep('L’email non è configurata') });
                     continue;
                 }
                 if (n.status === 'scheduled')
@@ -3713,7 +4013,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                     for (const item of batch) {
                         const who = await newsletter.subscriber(item.subscriberId);
                         if (!who || who.status !== 'active') {
-                            await newsletter.markSend(item.id, 'failed', 'Non più iscritto');
+                            await newsletter.markSend(item.id, 'failed', t.keep('Non più iscritto'));
                             continue;
                         }
                         try {
@@ -3723,7 +4023,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                             sent++;
                         }
                         catch (error) {
-                            await newsletter.markSend(item.id, 'failed', error instanceof Error ? error.message.slice(0, 300) : 'Errore');
+                            await newsletter.markSend(item.id, 'failed', error instanceof Error ? error.message.slice(0, 300) : t.keep('Errore'));
                         }
                         if (pause)
                             await new Promise((r) => setTimeout(r, pause));
@@ -3733,7 +4033,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 const allFailed = stats.total > 0 && stats.sent === 0;
                 await newsletter.setStatus(n.id, allFailed ? 'failed' : 'sent', {
                     sentAt: new Date(),
-                    error: allFailed ? 'Nessun invio riuscito: controlla Impostazioni → Email' : null,
+                    error: allFailed ? t.keep('Nessun invio riuscito: controlla Impostazioni → Email') : null,
                 });
             }
             // Signups never confirmed are dropped after a week.
@@ -3766,9 +4066,9 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const existing = await loadDocument(c.req.param('id'));
         const input = await body(c, z.object({ days: z.number().int().min(1).max(365).nullable() }));
         if (!ctx.preview)
-            throw new ApiError(409, 'no_site', 'Questo sito non ha pagine da mostrare in anteprima');
+            throw new ApiError(409, 'no_site', t('Questo sito non ha pagine da mostrare in anteprima'));
         if (!collection(existing.collection).url)
-            throw new ApiError(400, 'no_page', 'Questo contenuto non ha una pagina sul sito');
+            throw new ApiError(400, 'no_page', t('Questo contenuto non ha una pagina sul sito'));
         const expiresAt = input.days === null ? null : new Date(Date.now() + input.days * 86_400_000);
         const link = await previewLinks.create({ documentId: existing.id, expiresAt, user: c.get('user') });
         await record(c, 'document.preview_shared', existing.title, {
@@ -3781,7 +4081,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.delete('/api/previews/:id', requireUser, async (c) => {
         const link = await previewLinks.get(c.req.param('id'));
         if (!link)
-            throw new ApiError(404, 'not_found', 'Link non trovato');
+            throw new ApiError(404, 'not_found', t('Link non trovato'));
         const doc = await content.get(link.documentId);
         await previewLinks.revoke(link.id);
         await record(c, 'document.preview_revoked', doc?.title ?? '', { id: link.documentId });
@@ -3811,6 +4111,16 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     });
     app.post('/api/documents/:id/revisions/:revision/restore', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
+        guardTurn(c, existing.id);
+        // An old version is a save like any other: it may hold code or a form's address an editor
+        // could not write today (an admin's version, or one from before the rules changed).
+        const revision = await content.revision(existing.id, c.req.param('revision'));
+        if (!revision)
+            throw new ApiError(404, 'not_found', 'This version does not exist');
+        guardEmbeds(c.get('user'), existing.data, revision.data);
+        for (const [name, f] of Object.entries(collection(existing.collection).fields))
+            if (f.kind === 'page')
+                await guardDesign(c.get('user'), existing.data[name], revision.data[name]);
         const doc = await content.restore(existing.id, c.req.param('revision'), c.get('user').id);
         if (!doc)
             throw new ApiError(404, 'not_found', 'This version does not exist');
@@ -3832,11 +4142,14 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     });
     app.put('/api/locales', requireUser, requireSession, requireAdmin, async (c) => {
         const input = await body(c, z.object({
-            default: z.string().refine(isLocaleCode, 'Codice lingua non valido'),
-            available: z.array(z.string().refine(isLocaleCode, 'Codice lingua non valido')).min(1).max(30),
+            default: z.string().refine(isLocaleCode, t('Codice lingua non valido')),
+            available: z
+                .array(z.string().refine(isLocaleCode, t('Codice lingua non valido')))
+                .min(1)
+                .max(30),
         }));
         if (!input.available.includes(input.default))
-            throw new ApiError(400, 'invalid_locales', 'La lingua principale deve essere tra quelle del sito');
+            throw new ApiError(400, 'invalid_locales', t('La lingua principale deve essere tra quelle del sito'));
         const value = { default: input.default, available: [...new Set(input.available)] };
         await settings.set('locales', value, c.get('user').id);
         languages = value;
@@ -3874,11 +4187,11 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const lang = locale(input.locale);
         const group = await content.translations(doc.id);
         if (group.some((t) => t.locale === lang))
-            throw new ApiError(409, 'translation_exists', 'Questa lingua esiste già: aprila dall’elenco delle lingue');
+            throw new ApiError(409, 'translation_exists', t('Questa lingua esiste già: aprila dall’elenco delle lingue'));
         if (def.singleton && (await content.list(def.name, { locale: lang, limit: 1 })).total > 0)
-            throw new ApiError(409, 'singleton_exists', `"${def.label}" esiste già in questa lingua`);
+            throw new ApiError(409, 'singleton_exists', t('"{label}" esiste già in questa lingua', { label: def.label }));
         if (input.translate && !allowAi(c.get('user').id))
-            throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+            throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
         const data = structuredClone(doc.data);
         if (input.translate) {
             // The address is translated too ("chi-siamo" → "about-us"), the home page keeps its own.
@@ -3913,7 +4226,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const input = await body(c, z.object({ translate: z.boolean().default(false) }));
         const doc = await loadDocument(c.req.param('id'));
         if (!doc.sourceId)
-            throw new ApiError(400, 'not_a_translation', 'Questa è la versione originale');
+            throw new ApiError(400, 'not_a_translation', t('Questa è la versione originale'));
         const original = await loadDocument(doc.sourceId);
         const def = collection(doc.collection);
         const data = structuredClone(doc.data);
@@ -3929,7 +4242,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         }
         if (input.translate && fresh.size) {
             if (!allowAi(c.get('user').id))
-                throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
+                throw new ApiError(429, 'too_many_requests', t('Troppe richieste: aspetta un minuto'));
             const ai = await readyAi();
             for (const [name, f] of Object.entries(def.fields)) {
                 if (f.kind !== 'page' || !Array.isArray(data[name]))
@@ -3967,7 +4280,12 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 wpJobs.delete(k);
     };
     /** A WordPress site is read from its address (REST API) or from its export file. */
-    app.post('/api/import/wordpress/analyze', requireUser, requireSession, requireAdmin, async (c) => {
+    app.post('/api/import/wordpress/analyze', requireUser, requireSession, requireAdmin, bodyLimit({
+        maxSize: WXR_MAX,
+        onError: () => {
+            throw new ApiError(413, 'file_too_large', t('Il file è troppo grande'));
+        },
+    }), async (c) => {
         forget();
         const isForm = (c.req.header('content-type') ?? '').includes('multipart/form-data');
         let site;
@@ -4001,7 +4319,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             if (error instanceof WordPressError)
                 throw new ApiError(422, 'wordpress_unreadable', error.message);
             if (error instanceof RemoteError)
-                throw new ApiError(422, 'wordpress_unreadable', `Il sito non risponde: ${error.message}`);
+                throw new ApiError(422, 'wordpress_unreadable', t('Il sito non risponde: {message}', { message: error.message }));
             throw error;
         }
         const token = randomBytes(16).toString('hex');
@@ -4058,12 +4376,12 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     const relayoutPage = async (ai, id, user, credentials) => {
         const doc = await content.get(id);
         if (!doc)
-            return 'la pagina non c’è più';
+            return t('la pagina non c’è più');
         const def = collection(doc.collection);
         const field = Object.entries(def.fields).find(([, f]) => f.kind === 'page')?.[0];
         const before = field && Array.isArray(doc.data[field]) ? doc.data[field] : null;
         if (!field || !before?.length)
-            return 'la pagina è vuota';
+            return t('la pagina è vuota');
         const page = { nodes: before };
         const call = apiCaller(app.fetch, credentials);
         const getSchema = () => call('GET', '/api/schema');
@@ -4155,15 +4473,15 @@ When done, reply with one short sentence.`;
                 }
                 catch (error) {
                     return {
-                        error: error instanceof RemoteError && /too large/.test(error.message)
-                            ? 'troppo grandi (oltre 25 MB)'
-                            : 'non raggiungibili',
+                        error: error instanceof RemoteError && error.reason === 'too_large'
+                            ? t('troppo grandi (oltre 25 MB)')
+                            : t('non raggiungibili'),
                     };
                 }
                 if (res.status !== 200)
-                    return { error: `non trovate sul sito (${res.status})` };
+                    return { error: t('non trovate sul sito ({status})', { status: res.status }) };
                 if (/svg/.test(res.type) || /\.svg$/i.test(res.name))
-                    return { error: 'SVG: la libreria non li accetta, perché possono contenere codice' };
+                    return { error: t('SVG: la libreria non li accetta, perché possono contenere codice') };
                 try {
                     const saved = await files.save(res.name, res.bytes);
                     const asset = await mediaStore.create({ ...saved, filename: res.name.slice(0, 200), alt, createdBy: user.id });
@@ -4177,7 +4495,7 @@ When done, reply with one short sentence.`;
                     return media;
                 }
                 catch {
-                    return { error: 'in un formato che la libreria non legge' };
+                    return { error: t('in un formato che la libreria non legge') };
                 }
             },
             fetchPage: async (url) => {
@@ -4394,7 +4712,7 @@ When done, reply with one short sentence.`;
     // ---------- public delivery API: published content only ----------
     const publicDocument = (doc) => {
         const def = ctx.config().collections.find((x) => x.name === doc.collection);
-        const data = doc.publishedData ?? {};
+        const data = withoutFormSettings(doc.publishedData ?? {});
         return {
             id: doc.id,
             slug: doc.slug,