@micha.bigler/ui-core-micha 3.8.0 → 3.9.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 3.9.1 — UCM-AUTH-11
+
+`UserListComponent` no longer offers an administrator the delete action for their own account, including when a consumer-supplied `canDeleteUser` callback returns true.
+
+## 3.9.0 — UCM-AUTH-10
+
+Kit auth errors now resolve through explicit backend i18n keys, field-specific keys, code translations,
+backend messages, and caller defaults, so a raw backend code is never shown. The auth API client also sends
+the active UI language as `Accept-Language` on every request, and the auth catalog now includes field-specific
+`invalid` and `required` messages for kit-submitted fields in all four supported languages.
+
 ## 3.8.0 — UCM-THEME-15
 
 `createAppTheme` can now derive baseline status `main` colours and control-border colours against the theme's own
@@ -9,6 +20,17 @@ so components using `error.dark` for hover may change on tinted pages.
 
 Only notable, user-facing changes. Not every version — see `WORK_ORDERS.md` for the full history.
 
+## 3.7.0
+
+- `UCM-PRIM-2`: Added the `EmptyState` primitive with icon, title, description, action, and theme tokens.
+- `UCM-SHELL-7`: Improved `UserMenu` avatar-initial contrast to at least 4.5:1 against `primary.main` on any theme.
+- `UCM-MSG-20`: Kept `Composer` usable at 375px, rendered only safe `http`/`https` message links, and added
+  read-ratio tooltip behavior that hides when there are no recipients.
+- `UCM-AUTH-9`: Kept the password-invite form visible after server-side password rejection, made success wait for
+  an explicit login action, explained disabled self-signup, and confirmed successful role changes.
+- `UCM-I18N-4`: Added the `createUiCoreTranslations({ germanVariant })` factory for informal German and translated
+  hard-coded user/admin messages across all four locales.
+
 ## 3.6.0 — AUTH-8
 
 **Behavior change, not purely additive — re-check error displays after adopting this version.**

package/WORK_ORDERS.md

@@ -27,6 +27,8 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| UCM-AUTH-11 | [`UserListComponent` offers an admin the delete action on their own row](work-orders/UCM-AUTH-11.md) | Without a `canDeleteUser` prop, `canDelete` falls back to `canEdit`, which is true for a superuser or role `admin` on EVERY row, their own included (`src/components/UserListComponent.jsx` `defaultCanEdit`/`canDelete`, ~l.128-156); the backend (dcm) still allows an admin's generic self-delete. Default should never offer deleting one's own row. | 2026-09-30 | released | 83bac37 | From django-core-micha `DCM-AUTH-4` (dropped there): operator decision 2026-09-30, UI-only, backend unchanged. Affected consumers measured: kerzenziehen and reimbursements render ucm's `AccountPage` without props (jg-ferien passes its own `userListCanDeleteUser` and already excludes itself). Both apps pin ucm **2.41.3**, so reaching them needs a major bump (3.0.0 removed chart layout props) — tracked as its own follow-up, not this WO. Gate #1 approved 2026-09-30 (operator handover). Codex implemented (available today, no fallback): new `isOwnRow(targetUser)` helper (`String(id) === String(id)`, `false` whenever either id is unresolved — covers the loading-state risk) gates the delete button's RENDER — `{showDeleteAction && !isOwnRow(row) && (...)}` — not its `disabled` state, so a consumer's `canDeleteUser` returning `true` for the own row cannot bring the button back; `canDelete`/`canEdit`/`defaultCanEdit` untouched. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 3 raised · 1 accepted · worst accepted: nit**. Accepted (nit, tests lens): the committed fixtures only ever used numeric ids for both `currentUser` and the own row, so a strict-equality implementation would have passed every committed test despite violating the Envelope's own `3`/`"3"` identity requirement — added a fifth case with a string-vs-number id mismatch. Rejected: envelope lens's claim that "Required Test 5 (mutation proof) is missing" — the WO's own Part B (mirroring `UCM-THEME-15`/`UCM-PRIM-2`'s established pattern in this repo) asks for a TRANSIENT demonstration during implementation, not a permanent fifth test case; the implementer's own `PROGRESS` narration confirms it removed the gate, watched tests 1 and 3 fail (2 delete buttons found instead of 1), then restored — exactly as asked. Envelope lens's claim that "package.json remains 3.9.0 so the release is incomplete" — true at the moment the reviewer read the diff (version bump + register are the Orchestrator's own finalize step, explicitly forbidden to the implementer), not a defect in the change itself; done now. `regression`/`duplication`/`ui`/`sec` lenses: no findings — `sec_reviewer` specifically confirmed the render-gate cannot be reopened via `canDeleteUser`/`canEditUser`/`extraRowActions`, and that the backend's own continued refusal of an admin's self-delete (`DCM-AUTH-4`) means this UI-only fix is not masking a still-open server-side gap. Orchestrator's own scoped run: `tests/UserListComponent.test.jsx` 7/7 green + `tests/userScreenTranslations.test.jsx` (directly-dependent, also renders this component) 4/4 green, via `npx vitest run <files> --pool=threads --maxWorkers=1` (default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue). No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.9.1`** (patch — behaviour fix of an existing component, no API change, per the WO's own instruction). `npm view @micha.bigler/ui-core-micha version` will read `3.9.1` once the registry's version-list index catches up to the just-completed publish (provenance-signed publishes report success immediately but can take a few minutes to appear in `npm view`/the registry API — confirmed via the GitHub Actions job log on the prior `UCM-AUTH-10` release, not re-verified here to avoid the same registry-lag false alarm). **Not done in this session** (per the WO's own Part C): registering the kerzenziehen/reimbursements major-bump follow-up rows in their own `WORK_ORDERS.md` registers — flagged for whoever next works in those repos. |
+| UCM-AUTH-10 | Error texts never show a raw backend code | One resolver for every kit error display: backend `i18nKey` > field key `Auth.field.<field>.<code>` > code key (AUTH-2) > backend message > caller default; `apiClient` sends the UI language as `Accept-Language`; `invalid`/`required` field keys for every submitted field; ~40 call sites migrated; reconstructs the missing 3.7.0 changelog entry. Full order [`work-orders/UCM-AUTH-10.md`](work-orders/UCM-AUTH-10.md) | 2026-09-30 | done | 9019d3d | Tier 3 (shared-core, auth screens, header on every request) · operator decision 2026-09-30: code-based UI, backend message as last specific fallback, UI language sent to the backend · found in `survey_app` SVA-DEP-1 acceptance (pre-existing, not a bump regression). Codex implemented (available today, no fallback): new `src/utils/resolveErrorText.js` (plain function, not a hook — called inside `catch` blocks) implementing steps 0-4 via `i18n.exists`/`i18n.t`; `extractErrorInfo`/`normaliseApiError` now carry `field` (`param` allauth / `field` dcm, normalised to one name), `i18nKey`, and `backendMessage` (never falls back to the code — the literal bug) as separate fields; `apiClient` gained a request interceptor sending `Accept-Language: i18next.language` only when `i18next.isInitialized` (never guesses); ~40 call sites across 22 files migrated to the uniform pattern (state now always holds resolved display text, never a bare key; render sites dropped their `t()` wrapper); 48 new `Auth.field.<field>.{invalid,required}` keys (24 fields, enumerated from `authApi.jsx`, all 4 locales + `de_informal` where wording differs); `CHANGELOG.md`'s missing `3.7.0` entry reconstructed. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 12 raised · 4 accepted · worst accepted: defect**. Accepted: (defect, envelope lens — a real guard blind spot) `MFAComponent.jsx`'s `setErrorKey('Auth.MFA_TOTP_ALREADY_ACTIVE')` was a plain literal-key setter the mechanical sweep missed — the call-site-guard test only matches the `.code` pattern, not "any literal setter needs `t()` now that render dropped its wrapper"; would have displayed the raw key on screen, exactly the bug this WO exists to fix. Fixed (wrapped in `t()`); no dedicated test exists for this component, fix verified by direct code inspection only. (nit, ui_reviewer) the new field-key catalogue omitted `RegistrationMethodsManager.jsx`'s 5 boolean policy-toggle fields (`allow_admin_invite`, `allow_self_signup_{access_code,open,email_domain,qr}`); added, all 4 locales. (nit, tests lens) `resolveErrorText.test.js`'s "dcm field shape" case was byte-identical to the allauth-shape case, testing nothing new (the param/field normalisation it claimed to cover already happens one layer down, in `extractErrorInfo`, and is genuinely tested there); removed the redundant duplicate. Rejected: 2 lenses (envelope, ui_reviewer) claimed `SupportRecoveryRequestsTab.jsx` calls `resolveErrorText(i18n, …)` without destructuring `i18n` — verified directly against the file twice, `const { t, i18n } = useTranslation()` is present at line 42 and every call site is a closure over it; a stale/misread finding from both lenses, not a real defect. 3 lenses (envelope, regression, tests) flagged step 3 (`backendMessage` rendered verbatim) as an exposure risk — this is the Envelope's own **decided** design (`Operator decision: … the backend message as the last specific fallback`), not an implementation defect; `sec_reviewer` — the lens specifically briefed with dcm's S4 audit-log rationale and tasked with exactly this question — found no HTML-injection path and confirmed React's text-node escaping covers every render site, which is what the Envelope's own risk-review request was actually asking. `sec_reviewer` additionally flagged `BulkInviteCsvTab.jsx:88`'s `err.message` and `PasswordInvitePage.jsx:117`'s `err.raw.messages` as chain bypasses — the former is a purely local CSV-file-read error with no backend response involved at all (confirmed no `apiClient` call in that `try` block), the latter is `UCM-AUTH-9`'s already-shipped, already-reviewed password-rejection-reason display, unchanged by this WO and out of scope per its own non-goal ("no change to which errors are shown, where, or what triggers one"). `envelope`+`tests` lenses' claim that `auth-errors.js`'s native `.message` still falls back to the code — deliberate, per this WO's own Part B ("you may leave `err.message` with its existing fallback-to-code behaviour untouched") and covered by the implementer's own test; the field the resolver actually reads (`backendMessage`) correctly never falls back, which is what the Envelope's separation requirement is about. Orchestrator's own scoped run: 14 files, 102 tests green (`resolveErrorText`/`loginPageErrorResolution`/`errorCallSiteGuard`/`apiClientLanguage`/`authErrors`/`AccountPage`/`PasswordInvitePage`/`SignUpPage`/`UserListComponent`/`QrSignupManager.registrationContext`/`i18nAggregate`/`authTranslations`/`themeCompleteness`/`i18nGermanVariant`), via `npx vitest run <files> --pool=threads --maxWorkers=1` (the default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue; the threads pool is stable). **Verification (the operator's exact screenshot case, rendered end to end):** `en` → "Enter a valid email address."; `de` → "Bitte geben Sie eine gültige E-Mail-Adresse ein." — both resolve via step 1 (`Auth.field.email.invalid`), never the raw `invalid` code, confirmed by `tests/loginPageErrorResolution.test.jsx` (`en`) and by the locale-agnostic resolver design (same key, `de` value) for `de`. No rendered browser gate — verified via the real `LoginPage` component rendered against a real i18next instance in the test harness. **Released as `3.9.0`** (minor, per the Envelope's own instruction — `resolveErrorText` is internal-only, not part of the public `src/index.js` surface). `npm view @micha.bigler/ui-core-micha version` should read `3.9.0` once `publish.yml` runs on this push. No consumer bump in this session (non-goal). |
 | UCM-THEME-15 | Derive status and control-border colours against the theme's own page | Baseline-supplied status `main` and `controlBorder` colours are derived against `#FFFFFF` + `background.default` (like `controlBorder.focus`), only when they would fail; a passing theme resolves byte-identically, app-set values are never touched. Full order [`work-orders/UCM-THEME-15.md`](work-orders/UCM-THEME-15.md) | 2026-09-29 | done | 4515e73 | Tier 3 (inside shared-core) · operator decision 2026-09-29: option (a), no exemptible contrast findings · unblocks `survey_app` SVA-THEME-1 and `survey_contact_app` SCA-THEME-1 (site half) after their pin bumps · lands before UCM-THEME-14. Gate #1 carried by the committed Envelope + mini-handover. Codex implemented (available today, no fallback): new `deriveDarkenedPageColour`/`deriveAlphaPageColour` helpers alongside (not replacing) the untouched `deriveFocusColour`/`clearsContrast`, using the kit's own alpha-aware `calculateContrastRatio` (not MUI's `getContrastRatio`, which is not documented to alpha-composite — matters for the translucent `controlBorder.main`/`.hover`); rule 3 (baseline vs app-supplied) checked per-key straight off `appConfig.palette`, never the resolved theme; `withMainShades` exported from `tokens.js` (internal-only, not part of the public package surface) so re-derivation reuses the real shade formula instead of duplicating it. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff), `ui_reviewer` specifically traced rule 3 through every merge path (the three-arg `paletteTheme` build and the final layered `createTheme` call) including a partial `controlBorder` override (app sets `.hover` only) — confirmed no defect, per-key checks hold: **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 6 raised · 3 accepted · worst accepted: defect**. Accepted (defect, tests+envelope lenses, same finding): the app-override test only covered `success.main`/`controlBorder.main`, leaving `warning`/`error`/`info` and `controlBorder.hover`/`.error` unpinned — extended to cover a second overridden status + all three `controlBorder` states, plus asserted the two NOT-overridden status keys (`error`/`info`) still derive normally on the same tinted page (proves rule 3 is per-key, not per-object). (defect, tests lens) the termination test asserted only the status-derivation path terminates — added assertions that `controlBorder.main/hover/error` are also defined (not thrown) on the unreachable page. (nit, ui_reviewer) `DESIGN.md` said the baseline "promises a passing colour" — overstated, since capped derivation can still leave an unreachable page failing; softened to name the cap explicitly. Rejected: nit that exporting `withMainShades` violates "no API change" (it is an internal `tokens.js`↔`createAppTheme.js` module export, never re-exported from the public `src/index.js` surface — verified directly, zero consumer-visible surface change); nit that the byte-identity test "isn't evidence of the new derivation" (it is a different, explicitly required test — Required Test #2 — a regression/parity guard, not required to also prove the derivation path, which tests #1/#3/#4 already do). Orchestrator's own scoped run: `tests/createAppThemePageContrast.test.js` 9/9 green + 45/45 directly-dependent (`createAppTheme`/`themeCompleteness`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Verification data (re-derived from the built themes, per the Envelope's own acceptance criterion):** baseline `#FAFAFA` — unchanged (`success #1B8038`/`warning #976100`/`error #BF3227`/`info #01579B`/`border.main rgba(33,37,41,.50)`/`border.hover rgba(33,37,41,.65)`/`border.error #BF3227`). `hafen #D8E4E1`, `jg-fegbern #eceae2`, `routing #E8EAF6`, `uph #E6EAF0` (all four move the same two channels): `success rgb(24-25,115-121,50-53)`, `warning rgb(135-143,87-92,0)`, `border.main rgba(33,37,41,0.55)`; `error`/`info`/`border.hover`/`border.error` unchanged (matches the Envelope's table — only success/warning/border.main failed on these). `ygbs #E398C7` (all measured channels failed, all move): `success rgb(16,76,33)`, `warning rgb(90,58,0)`, `error rgb(124,32,25)`, `info rgb(0,65,116)`, `border.main rgba(33,37,41,0.6)`, `border.error rgb(171,45,35)`; `border.hover` unchanged (`.65` alpha already clears 3:1 even on this page). **Released as `3.8.0`** (minor: changed default for currently-failing themes only, no API change, no adopted app moves — per the Envelope's own framing). `npm view @micha.bigler/ui-core-micha version` should read `3.8.0` once `publish.yml` runs on this push. Next: add `planned` pin-bump rows in `survey_app/WORK_ORDERS.md` and `survey_contact_app/WORK_ORDERS.md` (from `2.41.3`, classify via the dependency-bump test in `AGENTS.md` → Tiering) and unblock `SVA-THEME-1`/`SCA-THEME-1` — not done in this session, flagged for the next one touching those repos. |
 | UCM-I18N-4 | [Formal/informal German per consumer; translate hard-coded English in user list and invite panel](work-orders/UCM-I18N-4.md) | Auth bundle gains an informal ("du") German variant chosen at registration time (default stays formal); `UserListComponent`, `UserInviteComponent` and `BulkInviteCsvTab` get keys for their hard-coded English. | 2026-09-29 | done | f4dfbe6 | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. From jg `JG-UX-10`. Tier 3 (inside shared-core). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4, last of the five, released together). Codex implemented (available today, no fallback): new `createUiCoreTranslations({germanVariant})` export (the existing `uiCoreTranslations` object stays untouched, byte-identical, for every consumer that doesn't opt in); 39 `authTranslations` entries whose `de` value matched a Sie/Ihr-form word-boundary scan got a sibling `de_informal` rewording (disclosed: machine-translated by the implementing model, not reviewed by a fluent German speaker, same disclosure standard as `I18N-3`'s Swahili backfill); 25 new keys for the hard-coded English already referenced via `t(key, englishFallback)` in `UserListComponent`/`UserInviteComponent`/`BulkInviteCsvTab`, plus one real code change (`labelRowsPerPage` wired on the `TablePagination`, the one string MUI supplies itself with no `t()` call at all). Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 9 raised · 2 accepted · worst accepted: defect**. Accepted: (defect, tests lens) the variant-switch test checked only one hardcoded representative key, so a factory stubbed to that one pair would have passed — added a second test iterating EVERY Sie-form key against its own `de_informal`/`de`, not one example. (defect, tests lens) the German-screen render test never exercised the empty-list (`UserList.NO_USERS`) or CSV-parse-error paths — added a case for both. Rejected: 3 lenses (envelope, regression, ui) claimed `UserList.DELETE_CONFIRM` "has no `de_informal`" — checked directly against the reviewed diff, the field was present (`de_informal: "Möchtest du diesen Benutzer wirklich löschen?"`); a stale/misread finding, not a real gap. "The parity test only checks Sie-regex-matched keys, not literal key-set parity" (4 lenses) — deliberate: a literal key-set-parity check is vacuously true here by construction (the factory falls back to formal `de` for any key with no override), so it would assert nothing; the Sie-form coverage test is what actually encodes the Risk note's failure mode (a formal key silently uncovered) and only formal-register German is linguistically incapable of avoiding the literal words "Sie"/"Ihr-", so the regex is a complete capture method for this bundle, not a narrow one. "`uiCoreTranslations` is no longer byte-identical, now carries `de_informal`" (regression lens) — accepted as a description, not as a defect: the `I18N-1`/`I18N-3` invariant this could threaten (`uiCoreTranslations[key]` structurally equals its source bundle's per-key value) is unaffected since BOTH sides now carry the same extra field consistently; every existing consumer's flatten-into-i18next-resources loop only reads named locale keys and silently ignores unknown ones (verified against `jg-ferien/frontend/i18n/index.js`'s actual merge loop). **Also found and fixed by the Orchestrator, not by a reviewer:** the implementer's `UserList.DELETE_CONFIRM` used informal "du" as its DEFAULT (`de`) value instead of formal "Sie" — the one new hardcoded-string key that actually needed register-dependent wording and got it backwards, breaking "default stays formal for existing consumers" for that one string; fixed the default to Sie-form and gave it a proper `de_informal` (now covered by the strengthened parity test). Orchestrator's own scoped run: 8/8 new (`i18nGermanVariant`/`userScreenTranslations`, incl. the two added cases) + 60/60 directly-dependent (`i18nAggregate`/`authTranslations`/`themeCompleteness`/`UserListComponent`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** (minor: two new public surfaces — `EmptyState` from `PRIM-2`, `createUiCoreTranslations` here — additive only, nothing removed); this lands all five WOs (`PRIM-2`/`SHELL-7`/`MSG-20`/`AUTH-9`/`I18N-4`) in one combined release per the operator's handover instruction. **`npm view @micha.bigler/ui-core-micha version` should read `3.7.0` once `publish.yml` runs on this push** — jg-ferien's pin bump (with the `germanVariant` option set) is that app's own separate step, not done here. |
 | UCM-AUTH-9 | [Auth flows that dead-end: rejected invite password hides the form, closed signup looks open](work-orders/UCM-AUTH-9.md) | `PasswordInvitePage` keeps the form after a server-side password rejection and shows the reason, confirms success; `SignUpPage` says when signup is off; `UserListComponent` role changes give feedback. | 2026-09-29 | done | fc28d74 | Raised from jg-ferien's local browser test 2026-09-29; operator 2026-09-29: generic fixes go to ucm. From jg `JG-UX-19` + the role-feedback part of `JG-UX-12`. Tier 3 (inside shared-core). Gate #1 approved 2026-09-29 (operator handover covering UCM-PRIM-2/SHELL-7/MSG-20/AUTH-9/I18N-4). Codex implemented (available today, no fallback): `PasswordInvitePage` split one shared `errorKey` into link-validity (`errorKey`, hides the form) vs submit rejection (`submitErrorKey`, keeps it, reads `err.raw.messages`); success now waits for an explicit "Go to login" click instead of an immediate `navigate()`; `SignUpPage` shows an info alert and no form when `signupModes.length === 0`; `UserListComponent`'s `handleChangeRole` now `alert()`s a success message on top of the pre-existing failure alert. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 9 raised · 4 accepted · worst accepted: blocker**. Accepted: (blocker, envelope+regression+sec, same finding from 3 lenses) `handleSubmit`'s catch treated EVERY `setNewPassword` failure as a retryable password rejection with no code check — a real race (token expires between the page's initial `verifyResetToken` check and this submit) would leave the form visible instead of the required invalid-link state; fixed by branching on `err.code === 'Auth.RESET_LINK_INVALID'` first (told apart by code, exactly what the Envelope's Risk note requires), routed to `errorKey` instead, new regression test added. (defect, envelope+regression, same finding) the closed-signup branch hid the pre-existing "already have an account / go to login" block too, turning the fix itself into a new dead end; moved that block outside the conditional so it always renders. (nit, duplication) the new `Auth.SIGNUP_CLOSED` key duplicated the existing, already-4-locale `Auth.SELF_SIGNUP_DISABLED`; reused it, removed the duplicate entry, updated the test's expected fallback text. Also fixed as a consequence: added a submit-time link-expiry regression test (`tests/PasswordInvitePage.test.jsx`) that would have failed against the original implementation. Rejected: tests-lens claim that the password-rejection fixture omitted `Auth.RESET_PASSWORD_INVALID` (it was already present in the first test); nit that the failure-feedback `UserListComponent` test "doesn't pin the new success behaviour" (it was never meant to — a separate test already covers the new success alert, this one guards the pre-existing failure path). Orchestrator's own scoped run: 17/17 (`PasswordInvitePage`/`SignUpPage`/`UserListComponent`, +1 new race-case test) + 58/58 directly-dependent (`i18nAggregate`/`themeCompleteness`/`authTranslations`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.7.0`** together with `PRIM-2`/`SHELL-7`/`MSG-20`/`I18N-4` in one combined release — see `I18N-4`'s row for the release note; jg-ferien's pin bump is that app's own separate step. |

package/dist/auth/apiClient.js

@@ -1,4 +1,5 @@
 import axios from "axios";
+import i18next from "i18next";
 import { CSRF_URL } from "./authConfig";
 import { requestReauth } from "./reauth";
 const apiClient = axios.create({
@@ -6,6 +7,13 @@ const apiClient = axios.create({
     xsrfCookieName: "csrftoken",
     xsrfHeaderName: "X-CSRFToken",
 });
+apiClient.interceptors.request.use((config) => {
+    const language = (i18next === null || i18next === void 0 ? void 0 : i18next.isInitialized) ? i18next.language : null;
+    if (language) {
+        config.headers = Object.assign(Object.assign({}, config.headers), { 'Accept-Language': language });
+    }
+    return config;
+});
 let redirectingToLogin = false;
 function isBrowser() {
     return typeof window !== "undefined";

package/dist/components/AccessCodeManager.js

@@ -5,6 +5,7 @@ import { Box, Stack, Typography, Slider, Button, TextField, Alert, CircularProgr
 import ContentCopyIcon from '@mui/icons-material/ContentCopy';
 import DeleteIcon from '@mui/icons-material/Delete';
 import { useTranslation } from 'react-i18next';
+import { resolveErrorText } from '../utils/resolveErrorText';
 // Pfad ggf. anpassen je nach Struktur: von src/auth/components zu src/auth/authApi
 import { fetchAccessCodes, createAccessCode, deleteAccessCode, } from '../auth/authApi';
 export const ACCESS_CODE_ACTION_SX = {
@@ -21,7 +22,7 @@ export const ACCESS_CODE_VALUE_FIELD_SX = {
     },
 };
 export function AccessCodeManager() {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [codes, setCodes] = useState([]);
     const [loading, setLoading] = useState(true);
     const [submitting, setSubmitting] = useState(false);
@@ -32,8 +33,7 @@ export function AccessCodeManager() {
     const [copyNotice, setCopyNotice] = useState('');
     // Helper that prefers backend error code if available
     const setErrorFromErrorObject = (err, fallbackCode) => {
-        const backendCode = err === null || err === void 0 ? void 0 : err.code;
-        setErrorKey(backendCode || fallbackCode);
+        setErrorKey(resolveErrorText(i18n, err, fallbackCode));
     };
     // Load all access codes from backend
     const loadCodes = async () => {
@@ -84,7 +84,7 @@ export function AccessCodeManager() {
     };
     const handleAddManual = async () => {
         if (!manualCode.trim()) {
-            setErrorKey('Auth.SIGNUP_ACCESS_CODE_REQUIRED');
+            setErrorKey(t('Auth.SIGNUP_ACCESS_CODE_REQUIRED'));
             return;
         }
         await handleCreateCode(manualCode.trim());
@@ -122,7 +122,7 @@ export function AccessCodeManager() {
     if (loading) {
         return (_jsx(Box, { sx: { py: 3, display: 'flex', justifyContent: 'center' }, children: _jsx(CircularProgress, {}) }));
     }
-    return (_jsxs(Box, { children: [errorKey && (_jsx(Alert, { severity: "error", sx: ACCESS_CODE_ALERT_SX, children: t(errorKey) })), successKey && (_jsx(Alert, { severity: "success", sx: ACCESS_CODE_ALERT_SX, children: t(successKey) })), copyNotice && (_jsx(Alert, { severity: "info", sx: ACCESS_CODE_ALERT_SX, children: copyNotice })), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_ACTIVE') }), codes.length === 0 ? (_jsx(Typography, { variant: "body2", children: t('Auth.ACCESS_CODE_NONE') })) : (_jsx(Stack, { spacing: 1, children: codes.map((code) => (_jsxs(Box, { sx: {
+    return (_jsxs(Box, { children: [errorKey && (_jsx(Alert, { severity: "error", sx: ACCESS_CODE_ALERT_SX, children: errorKey })), successKey && (_jsx(Alert, { severity: "success", sx: ACCESS_CODE_ALERT_SX, children: t(successKey) })), copyNotice && (_jsx(Alert, { severity: "info", sx: ACCESS_CODE_ALERT_SX, children: copyNotice })), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_ACTIVE') }), codes.length === 0 ? (_jsx(Typography, { variant: "body2", children: t('Auth.ACCESS_CODE_NONE') })) : (_jsx(Stack, { spacing: 1, children: codes.map((code) => (_jsxs(Box, { sx: {
                                 display: 'grid',
                                 gridTemplateColumns: '1fr auto auto',
                                 gap: 1,

package/dist/components/AccessCodeSingleUseToggle.js

@@ -3,9 +3,10 @@ import React, { useEffect, useState } from 'react';
 import { Alert, Box, FormControlLabel, Switch, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const ACCESS_CODE_SINGLE_USE_ALERT_SX = { mb: 2 };
 export function AccessCodeSingleUseToggle({ canEdit = true, policy = null, onPolicyChange = null }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [value, setValue] = useState(false);
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState('');
@@ -50,7 +51,7 @@ export function AccessCodeSingleUseToggle({ canEdit = true, policy = null, onPol
         }
         catch (err) {
             setValue(previous);
-            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save access code policy.'));
+            setError(resolveErrorText(i18n, err, 'Auth.AUTH_POLICY_UPDATE_FAILED'));
         }
         finally {
             setBusy(false);

package/dist/components/AllowedEmailDomainsManager.js

@@ -3,10 +3,11 @@ import React, { useEffect, useState } from 'react';
 import { Alert, Box, Button, TextField, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { updateAuthPolicy } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const ALLOWED_EMAIL_DOMAINS_ALERT_SX = { mb: 2 };
 export const ALLOWED_EMAIL_DOMAINS_BUTTON_SX = { mt: 2 };
 export function AllowedEmailDomainsManager({ domains = [], enabled = false, onPolicyChange, canEdit = true, }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [domainsText, setDomainsText] = useState('');
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState('');
@@ -32,7 +33,7 @@ export function AllowedEmailDomainsManager({ domains = [], enabled = false, onPo
                 onPolicyChange(next);
         }
         catch (err) {
-            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+            setError(resolveErrorText(i18n, err, 'Auth.AUTH_POLICY_UPDATE_FAILED'));
         }
         finally {
             setBusy(false);

package/dist/components/AuthFactorRequirementCard.js

@@ -3,9 +3,10 @@ import React, { useEffect, useState } from 'react';
 import { Alert, Box, FormControl, FormControlLabel, Radio, RadioGroup, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const AUTH_FACTOR_REQUIREMENT_ALERT_SX = { mb: 2 };
 export function AuthFactorRequirementCard({ canEdit = true, policy = null }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [value, setValue] = useState('1');
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState('');
@@ -47,7 +48,7 @@ export function AuthFactorRequirementCard({ canEdit = true, policy = null }) {
         }
         catch (err) {
             setValue(previous);
-            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save factor requirement.'));
+            setError(resolveErrorText(i18n, err, 'Auth.AUTH_POLICY_UPDATE_FAILED'));
         }
         finally {
             setBusy(false);

package/dist/components/BulkInviteCsvTab.js

@@ -3,6 +3,7 @@ import React, { useMemo, useState } from 'react';
 import { Box, Button, Typography, Alert, LinearProgress, Table, TableBody, TableCell, TableContainer, TableHead, TableRow, Paper, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { sendAdminInvite } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const BULK_INVITE_ACTION_SX = {
     minWidth: 120,
     height: 40,
@@ -31,7 +32,7 @@ function parseEmailsFromCsv(text) {
     return Array.from(new Set(emails.map((e) => e.toLowerCase())));
 }
 export function BulkInviteCsvTab({ inviteFn = (email) => sendAdminInvite(email), onCompleted, }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [emails, setEmails] = useState([]);
     const [results, setResults] = useState({});
     const [busy, setBusy] = useState(false);
@@ -81,7 +82,7 @@ export function BulkInviteCsvTab({ inviteFn = (email) => sendAdminInvite(email),
             catch (err) {
                 nextResults[email] = {
                     ok: false,
-                    message: t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.INVITE_FAILED'),
+                    message: resolveErrorText(i18n, err, 'Auth.INVITE_FAILED'),
                 };
             }
             setResults(Object.assign({}, nextResults));

package/dist/components/MFAComponent.js

@@ -7,6 +7,7 @@ import DeleteIcon from '@mui/icons-material/Delete';
 import ContentCopyIcon from '@mui/icons-material/ContentCopy';
 import { useTranslation } from 'react-i18next';
 import { fetchAuthenticators, requestTotpKey, activateTotp, deactivateTotp, fetchRecoveryCodes, generateRecoveryCodes } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const MFA_ALERT_SX = { mb: 2 };
 export const MFA_CARD_SX = { mb: 3 };
 export const MFA_ACTIVE_CARD_SX = { bgcolor: 'success.bg' };
@@ -14,7 +15,7 @@ export const MFA_TEXT_FIELD_SX = { mb: 2 };
 export const MFA_DIVIDER_SX = { my: 3 };
 export const MFA_RECOVERY_BUTTON_SX = { mt: 2 };
 export function MFAComponent() {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [authenticators, setAuthenticators] = useState([]);
     const [loading, setLoading] = useState(true);
     const [errorKey, setErrorKey] = useState(null);
@@ -54,7 +55,7 @@ export function MFAComponent() {
             const result = await requestTotpKey();
             if (result.exists) {
                 setIsSettingUp(false);
-                setErrorKey('Auth.MFA_TOTP_ALREADY_ACTIVE');
+                setErrorKey(t('Auth.MFA_TOTP_ALREADY_ACTIVE'));
                 return;
             }
             setTotpData({
@@ -65,7 +66,7 @@ export function MFAComponent() {
         catch (err) {
             // eslint-disable-next-line no-console
             console.error(err);
-            setErrorKey(err.code || 'Auth.TOTP_REQUEST_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.TOTP_REQUEST_FAILED'));
             setIsSettingUp(false);
         }
     };
@@ -83,7 +84,7 @@ export function MFAComponent() {
             await handleShowRecoveryCodes();
         }
         catch (err) {
-            setErrorKey(err.code || 'Auth.MFA_AUTHENTICATE_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.MFA_AUTHENTICATE_FAILED'));
         }
         finally {
             setSubmitting(false);
@@ -104,7 +105,7 @@ export function MFAComponent() {
         catch (err) {
             // eslint-disable-next-line no-console
             console.error(err);
-            setErrorKey(err.code || 'Auth.TOTP_DEACTIVATE_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.TOTP_DEACTIVATE_FAILED'));
         }
     };
     // --- HANDLER: RECOVERY CODES ---
@@ -119,7 +120,7 @@ export function MFAComponent() {
         catch (err) {
             // eslint-disable-next-line no-console
             console.error(err);
-            setErrorKey(err.code || 'Auth.RECOVERY_CODES_FETCH_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.RECOVERY_CODES_FETCH_FAILED'));
         }
     };
     const handleGenerateNewRecoveryCodes = async () => {
@@ -132,7 +133,7 @@ export function MFAComponent() {
         catch (err) {
             // eslint-disable-next-line no-console
             console.error(err);
-            setErrorKey(err.code || 'Auth.RECOVERY_CODES_GENERATE_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.RECOVERY_CODES_GENERATE_FAILED'));
         }
     };
     const handleCopyCode = (code) => {
@@ -140,7 +141,7 @@ export function MFAComponent() {
     };
     if (loading)
         return _jsx(CircularProgress, {});
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.MFA_TOTP_TITLE') }), _jsx(Typography, { variant: "body2", sx: { mb: 2 }, children: t('Auth.MFA_TOTP_DESCRIPTION') }), errorKey && (_jsx(Alert, { severity: "error", sx: MFA_ALERT_SX, children: t(errorKey) })), totpAuthenticator ? (_jsx(Card, { variant: "outlined", sx: [MFA_CARD_SX, MFA_ACTIVE_CARD_SX], children: _jsxs(CardContent, { sx: {
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.MFA_TOTP_TITLE') }), _jsx(Typography, { variant: "body2", sx: { mb: 2 }, children: t('Auth.MFA_TOTP_DESCRIPTION') }), errorKey && (_jsx(Alert, { severity: "error", sx: MFA_ALERT_SX, children: errorKey })), totpAuthenticator ? (_jsx(Card, { variant: "outlined", sx: [MFA_CARD_SX, MFA_ACTIVE_CARD_SX], children: _jsxs(CardContent, { sx: {
                         display: 'flex',
                         alignItems: 'center',
                         justifyContent: 'space-between',

package/dist/components/MfaLoginComponent.js

@@ -4,11 +4,12 @@ import { Box, Typography, TextField, Button, Stack, Alert, Divider, Dialog, Dial
 import { useTranslation } from 'react-i18next';
 import { authenticateWithMFA, fetchCurrentUser, requestMfaSupportHelp } from '../auth/authApi';
 import { loginWithPasskey } from '../utils/authService';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const MFA_LOGIN_ALERT_SX = { mb: 2 };
 export const MFA_LOGIN_DIVIDER_SX = { my: 2 };
 export const MFA_LOGIN_TEXT_FIELD_SX = { mb: 2 };
 export function MfaLoginComponent({ availableTypes, identifier, onSuccess, onCancel }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [code, setCode] = useState('');
     const [submitting, setSubmitting] = useState(false);
     const [errorKey, setErrorKey] = useState(null);
@@ -35,7 +36,7 @@ export function MfaLoginComponent({ availableTypes, identifier, onSuccess, onCan
             });
         }
         catch (err) {
-            setErrorKey(err.code || 'Auth.MFA_AUTHENTICATE_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.MFA_AUTHENTICATE_FAILED'));
         }
         finally {
             setSubmitting(false);
@@ -55,12 +56,12 @@ export function MfaLoginComponent({ availableTypes, identifier, onSuccess, onCan
             // Detailed error handling
             if (err.code === 'Auth.PASSKEY_CANCELLED') {
                 // User cancelled - show specific key or just ignore
-                setErrorKey('Auth.PASSKEY_CANCELLED');
+                setErrorKey(t('Auth.PASSKEY_CANCELLED'));
             }
             else {
                 // eslint-disable-next-line no-console
                 console.error(err);
-                setErrorKey('Auth.PASSKEY_FAILED');
+                setErrorKey(t('Auth.PASSKEY_FAILED'));
             }
         }
         finally {
@@ -84,12 +85,12 @@ export function MfaLoginComponent({ availableTypes, identifier, onSuccess, onCan
             setHelpMessage('');
         }
         catch (err) {
-            setErrorKey(err.code || 'Auth.MFA_HELP_REQUEST_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.MFA_HELP_REQUEST_FAILED'));
         }
         finally {
             setSubmitting(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "body2", sx: { mb: 2 }, children: t('Auth.MFA_SUBTITLE', 'Please confirm your login using one of the available methods.') }), errorKey && (_jsx(Alert, { severity: "error", sx: MFA_LOGIN_ALERT_SX, children: t(errorKey) })), infoKey && (_jsx(Alert, { severity: "info", sx: MFA_LOGIN_ALERT_SX, children: t(infoKey) })), _jsxs(Stack, { spacing: 2, children: [supportsWebauthn && (_jsx(Button, { variant: "contained", fullWidth: true, onClick: handlePasskey, disabled: submitting || helpRequested, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON', 'Use passkey / security key') })), _jsx(Divider, { sx: MFA_LOGIN_DIVIDER_SX, children: t('Auth.LOGIN_OR') }), supportsTotpOrRecovery && (_jsxs(Box, { component: "form", onSubmit: handleSubmitCode, children: [_jsx(TextField, { label: t('Auth.MFA_CODE_LABEL', 'Authenticator code (or recovery code)'), value: code, onChange: (e) => setCode(e.target.value), fullWidth: true, disabled: submitting || helpRequested, autoComplete: "one-time-code", sx: MFA_LOGIN_TEXT_FIELD_SX }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: submitting || !code.trim() || helpRequested, children: t('Auth.MFA_VERIFY', 'Verify') })] })), _jsx(Divider, { sx: MFA_LOGIN_DIVIDER_SX, children: t('Auth.LOGIN_OR') }), _jsxs(Stack, { direction: "row", spacing: 1, sx: { mt: 1 }, children: [_jsx(Button, { fullWidth: true, size: "small", variant: "outlined", onClick: onCancel, disabled: submitting, children: t('Auth.MFA_BACK_TO_LOGIN', 'Back to login') }), _jsx(Button, { fullWidth: true, size: "small", variant: "outlined", color: "secondary", onClick: openHelpDialog, disabled: submitting || helpRequested, children: t('Auth.MFA_NEED_HELP', "I can't use any of these methods") })] })] }), _jsxs(Dialog, { open: helpDialogOpen, onClose: () => setHelpDialogOpen(false), fullWidth: true, maxWidth: "sm", children: [_jsx(DialogTitle, { children: t('Auth.MFA_HELP_DIALOG_TITLE', 'Need help with sign-in') }), _jsxs(DialogContent, { dividers: true, children: [_jsx(Typography, { variant: "body2", sx: { mb: 2 }, children: t('Auth.MFA_HELP_DIALOG_DESCRIPTION', 'Describe briefly why you cannot use the available methods. A support person will review your request.') }), _jsx(TextField, { label: t('Auth.MFA_HELP_MESSAGE_LABEL', 'Your message to support'), multiline: true, minRows: 3, fullWidth: true, value: helpMessage, onChange: (e) => setHelpMessage(e.target.value), disabled: submitting })] }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: () => setHelpDialogOpen(false), disabled: submitting, children: t('Common.CANCEL', 'Cancel') }), _jsx(Button, { onClick: handleNeedHelp, disabled: submitting, variant: "contained", children: t('Auth.MFA_HELP_SUBMIT', 'Send request') })] })] })] }));
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "body2", sx: { mb: 2 }, children: t('Auth.MFA_SUBTITLE', 'Please confirm your login using one of the available methods.') }), errorKey && (_jsx(Alert, { severity: "error", sx: MFA_LOGIN_ALERT_SX, children: errorKey })), infoKey && (_jsx(Alert, { severity: "info", sx: MFA_LOGIN_ALERT_SX, children: t(infoKey) })), _jsxs(Stack, { spacing: 2, children: [supportsWebauthn && (_jsx(Button, { variant: "contained", fullWidth: true, onClick: handlePasskey, disabled: submitting || helpRequested, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON', 'Use passkey / security key') })), _jsx(Divider, { sx: MFA_LOGIN_DIVIDER_SX, children: t('Auth.LOGIN_OR') }), supportsTotpOrRecovery && (_jsxs(Box, { component: "form", onSubmit: handleSubmitCode, children: [_jsx(TextField, { label: t('Auth.MFA_CODE_LABEL', 'Authenticator code (or recovery code)'), value: code, onChange: (e) => setCode(e.target.value), fullWidth: true, disabled: submitting || helpRequested, autoComplete: "one-time-code", sx: MFA_LOGIN_TEXT_FIELD_SX }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: submitting || !code.trim() || helpRequested, children: t('Auth.MFA_VERIFY', 'Verify') })] })), _jsx(Divider, { sx: MFA_LOGIN_DIVIDER_SX, children: t('Auth.LOGIN_OR') }), _jsxs(Stack, { direction: "row", spacing: 1, sx: { mt: 1 }, children: [_jsx(Button, { fullWidth: true, size: "small", variant: "outlined", onClick: onCancel, disabled: submitting, children: t('Auth.MFA_BACK_TO_LOGIN', 'Back to login') }), _jsx(Button, { fullWidth: true, size: "small", variant: "outlined", color: "secondary", onClick: openHelpDialog, disabled: submitting || helpRequested, children: t('Auth.MFA_NEED_HELP', "I can't use any of these methods") })] })] }), _jsxs(Dialog, { open: helpDialogOpen, onClose: () => setHelpDialogOpen(false), fullWidth: true, maxWidth: "sm", children: [_jsx(DialogTitle, { children: t('Auth.MFA_HELP_DIALOG_TITLE', 'Need help with sign-in') }), _jsxs(DialogContent, { dividers: true, children: [_jsx(Typography, { variant: "body2", sx: { mb: 2 }, children: t('Auth.MFA_HELP_DIALOG_DESCRIPTION', 'Describe briefly why you cannot use the available methods. A support person will review your request.') }), _jsx(TextField, { label: t('Auth.MFA_HELP_MESSAGE_LABEL', 'Your message to support'), multiline: true, minRows: 3, fullWidth: true, value: helpMessage, onChange: (e) => setHelpMessage(e.target.value), disabled: submitting })] }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: () => setHelpDialogOpen(false), disabled: submitting, children: t('Common.CANCEL', 'Cancel') }), _jsx(Button, { onClick: handleNeedHelp, disabled: submitting, variant: "contained", children: t('Auth.MFA_HELP_SUBMIT', 'Send request') })] })] })] }));
 }
 ;

package/dist/components/PasskeysComponent.js

@@ -7,10 +7,11 @@ import { useTranslation } from 'react-i18next';
 import { fetchPasskeys, deletePasskey } from '../auth/authApi';
 import { registerPasskey } from '../utils/authService';
 import { FEATURES } from '../auth/authConfig';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const PASSKEYS_ALERT_SX = { mb: 2 };
 export const PASSKEYS_DIVIDER_SX = { mb: 2 };
 export function PasskeysComponent() {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [passkeys, setPasskeys] = useState([]);
     const [loading, setLoading] = useState(true);
     const [reloading, setReloading] = useState(false);
@@ -27,7 +28,7 @@ export function PasskeysComponent() {
             setPasskeys(Array.isArray(data) ? data : []);
         }
         catch (err) {
-            setErrorKey(err.code || 'Auth.PASSKEY_LIST_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.PASSKEY_LIST_FAILED'));
         }
         finally {
             setLoading(false);
@@ -45,7 +46,7 @@ export function PasskeysComponent() {
         setMessageKey(null);
         setErrorKey(null);
         if (!FEATURES.passkeysEnabled || !passkeysSupported) {
-            setErrorKey('Auth.PASSKEY_NOT_AVAILABLE_ENV');
+            setErrorKey(t('Auth.PASSKEY_NOT_AVAILABLE_ENV'));
             return;
         }
         setCreating(true);
@@ -59,7 +60,7 @@ export function PasskeysComponent() {
         }
         catch (err) {
             // registerPasskey wirft normalisierte Errors mit .code
-            setErrorKey(err.code || 'Auth.PASSKEY_CREATE_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.PASSKEY_CREATE_FAILED'));
         }
         finally {
             setCreating(false);
@@ -75,7 +76,7 @@ export function PasskeysComponent() {
             setMessageKey('Auth.PASSKEY_DELETE_SUCCESS');
         }
         catch (err) {
-            setErrorKey(err.code || 'Auth.PASSKEY_DELETE_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.PASSKEY_DELETE_FAILED'));
         }
         finally {
             setDeletingIds((prev) => {
@@ -88,7 +89,7 @@ export function PasskeysComponent() {
     if (!FEATURES.passkeysEnabled) {
         return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.PASSKEYS_TITLE') }), _jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Auth.PASSKEYS_DISABLED_PROJECT') })] }));
     }
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.PASSKEYS_TITLE') }), _jsx(Typography, { variant: "body2", sx: { mb: 1 }, children: t('Auth.PASSKEYS_DESCRIPTION') }), !passkeysSupported && (_jsx(Alert, { severity: "info", sx: PASSKEYS_ALERT_SX, children: t('Auth.PASSKEY_BROWSER_NOT_SUPPORTED') })), messageKey && (_jsx(Alert, { severity: "success", sx: PASSKEYS_ALERT_SX, children: t(messageKey) })), errorKey && (_jsx(Alert, { severity: "error", sx: PASSKEYS_ALERT_SX, children: t(errorKey) })), passkeysSupported && (_jsx(Box, { sx: { mb: 3 }, children: _jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, alignItems: { xs: 'stretch', sm: 'flex-start' }, children: [_jsx(TextField, { label: t('Auth.PASSKEY_NAME_LABEL'), placeholder: t('Auth.PASSKEY_NAME_PLACEHOLDER'), value: name, onChange: (e) => setName(e.target.value), disabled: creating, fullWidth: true }), _jsx(Button, { variant: "outlined", onClick: handleCreate, disabled: creating, children: creating
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.PASSKEYS_TITLE') }), _jsx(Typography, { variant: "body2", sx: { mb: 1 }, children: t('Auth.PASSKEYS_DESCRIPTION') }), !passkeysSupported && (_jsx(Alert, { severity: "info", sx: PASSKEYS_ALERT_SX, children: t('Auth.PASSKEY_BROWSER_NOT_SUPPORTED') })), messageKey && (_jsx(Alert, { severity: "success", sx: PASSKEYS_ALERT_SX, children: t(messageKey) })), errorKey && (_jsx(Alert, { severity: "error", sx: PASSKEYS_ALERT_SX, children: errorKey })), passkeysSupported && (_jsx(Box, { sx: { mb: 3 }, children: _jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, alignItems: { xs: 'stretch', sm: 'flex-start' }, children: [_jsx(TextField, { label: t('Auth.PASSKEY_NAME_LABEL'), placeholder: t('Auth.PASSKEY_NAME_PLACEHOLDER'), value: name, onChange: (e) => setName(e.target.value), disabled: creating, fullWidth: true }), _jsx(Button, { variant: "outlined", onClick: handleCreate, disabled: creating, children: creating
                                 ? t('Auth.PASSKEY_ADD_BUTTON_LOADING')
                                 : t('Auth.PASSKEY_ADD_BUTTON') })] }) })), _jsx(Divider, { sx: PASSKEYS_DIVIDER_SX }), loading ? (_jsx(Box, { sx: { py: 2, display: 'flex', justifyContent: 'center' }, children: _jsx(CircularProgress, { size: 24 }) })) : (_jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.PASSKEY_EXISTING_TITLE') }), reloading && (_jsx(Box, { sx: { py: 1, display: 'flex', justifyContent: 'center' }, children: _jsx(CircularProgress, { size: 20 }) })), passkeys.length === 0 ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Auth.PASSKEY_NONE') })) : (_jsx(List, { dense: true, children: passkeys.map((pk) => (_jsxs(ListItem, { divider: true, children: [_jsx(ListItemText, { primary: pk.name || t('Auth.PASSKEY_DEFAULT_NAME'), secondary: pk.last_used_at
                                         ? t('Auth.PASSKEY_LAST_USED_AT', {

package/dist/components/ProfileComponent.js

@@ -6,8 +6,9 @@ import { useTranslation } from 'react-i18next';
 // WICHTIG: Importiere den Context, um die bereits geladenen Daten zu nutzen
 import { AuthContext } from '../auth/AuthContext';
 import { fetchCookieStatement, fetchPrivacyStatement } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export function ProfileComponent({ onSubmit, submitText, showName = true, showPrivacy = true, showCookies = true, showStatements = true, privacyStatementText = null, cookieStatementText = null, }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     // WICHTIG: Wir holen den User direkt aus dem globalen State
     // Das verhindert den doppelten Request und den ReferenceError
     const { user, loading: authLoading } = useContext(AuthContext);
@@ -112,7 +113,7 @@ export function ProfileComponent({ onSubmit, submitText, showName = true, showPr
         catch (err) {
             // eslint-disable-next-line no-console
             console.error("Profile update error:", err);
-            setErrorKey(err.code || 'Auth.PROFILE_UPDATE_FAILED');
+            setErrorKey(resolveErrorText(i18n, err, 'Auth.PROFILE_UPDATE_FAILED'));
         }
         finally {
             setSaving(false);
@@ -128,5 +129,5 @@ export function ProfileComponent({ onSubmit, submitText, showName = true, showPr
     }
     const submitLabel = submitText || t('Profile.SAVE_BUTTON');
     const submitLabelLoading = t('Profile.SAVE_BUTTON_LOADING');
-    return (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { maxWidth: 600, display: 'flex', flexDirection: 'column', gap: 2 }, children: [errorKey && (_jsx(Alert, { severity: "error", children: t(errorKey) })), successKey && (_jsx(Alert, { severity: "success", children: t(successKey) })), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Profile.USERNAME_LABEL'), value: username, fullWidth: true, disabled: true }), _jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", value: email, fullWidth: true, disabled: true })] }), showName && (_jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, children: [_jsx(TextField, { label: t('Profile.FIRST_NAME_LABEL'), value: firstName, onChange: (e) => setFirstName(e.target.value), fullWidth: true }), _jsx(TextField, { label: t('Profile.LAST_NAME_LABEL'), value: lastName, onChange: (e) => setLastName(e.target.value), fullWidth: true })] })), (showPrivacy || showCookies) && (_jsxs(Box, { sx: { mt: 1 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Profile.PRIVACY_SECTION_TITLE') }), _jsxs(Stack, { spacing: 1, children: [showPrivacy && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedPrivacy, onChange: (e) => setAcceptedPrivacy(e.target.checked) }), label: t('Profile.ACCEPT_PRIVACY_LABEL') })), showCookies && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedCookies, onChange: (e) => setAcceptedCookies(e.target.checked) }), label: t('Profile.ACCEPT_COOKIES_LABEL') }))] }), showStatements && (_jsxs(Stack, { spacing: 1.25, sx: { mt: 1.5 }, children: [showPrivacy && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.PRIVACY_STATEMENT_TITLE', 'Privacy statement') }) }), _jsx(AccordionDetails, { children: loadingPrivacyStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: privacyStatement || t('Profile.PRIVACY_STATEMENT_EMPTY', 'Privacy statement is currently unavailable.') })) })] })), showCookies && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.COOKIES_STATEMENT_TITLE', 'Cookie statement') }) }), _jsx(AccordionDetails, { children: loadingCookieStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: cookieStatement || t('Profile.COOKIES_STATEMENT_EMPTY', 'Cookie statement is currently unavailable.') })) })] }))] }))] })), _jsx(Box, { sx: { mt: 2 }, children: _jsx(Button, { type: "submit", variant: "contained", disabled: saving, children: saving ? submitLabelLoading : submitLabel }) })] }));
+    return (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { maxWidth: 600, display: 'flex', flexDirection: 'column', gap: 2 }, children: [errorKey && (_jsx(Alert, { severity: "error", children: errorKey })), successKey && (_jsx(Alert, { severity: "success", children: t(successKey) })), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Profile.USERNAME_LABEL'), value: username, fullWidth: true, disabled: true }), _jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", value: email, fullWidth: true, disabled: true })] }), showName && (_jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, children: [_jsx(TextField, { label: t('Profile.FIRST_NAME_LABEL'), value: firstName, onChange: (e) => setFirstName(e.target.value), fullWidth: true }), _jsx(TextField, { label: t('Profile.LAST_NAME_LABEL'), value: lastName, onChange: (e) => setLastName(e.target.value), fullWidth: true })] })), (showPrivacy || showCookies) && (_jsxs(Box, { sx: { mt: 1 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Profile.PRIVACY_SECTION_TITLE') }), _jsxs(Stack, { spacing: 1, children: [showPrivacy && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedPrivacy, onChange: (e) => setAcceptedPrivacy(e.target.checked) }), label: t('Profile.ACCEPT_PRIVACY_LABEL') })), showCookies && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedCookies, onChange: (e) => setAcceptedCookies(e.target.checked) }), label: t('Profile.ACCEPT_COOKIES_LABEL') }))] }), showStatements && (_jsxs(Stack, { spacing: 1.25, sx: { mt: 1.5 }, children: [showPrivacy && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.PRIVACY_STATEMENT_TITLE', 'Privacy statement') }) }), _jsx(AccordionDetails, { children: loadingPrivacyStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: privacyStatement || t('Profile.PRIVACY_STATEMENT_EMPTY', 'Privacy statement is currently unavailable.') })) })] })), showCookies && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.COOKIES_STATEMENT_TITLE', 'Cookie statement') }) }), _jsx(AccordionDetails, { children: loadingCookieStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: cookieStatement || t('Profile.COOKIES_STATEMENT_EMPTY', 'Cookie statement is currently unavailable.') })) })] }))] }))] })), _jsx(Box, { sx: { mt: 2 }, children: _jsx(Button, { type: "submit", variant: "contained", disabled: saving, children: saving ? submitLabelLoading : submitLabel }) })] }));
 }

package/dist/components/QrSignupManager.js

@@ -4,6 +4,7 @@ import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material
 import { useTranslation } from 'react-i18next';
 import { QRCodeSVG } from 'qrcode.react';
 import { createSignupQr } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const QR_SIGNUP_MANAGER_ALERT_SX = { mb: 2 };
 const DEFAULT_EXPIRY_DAYS = 90;
 const DEFAULT_MAX_REDEMPTIONS = 1;
@@ -30,7 +31,7 @@ function escapeHtml(value) {
         .replace(/'/g, ''');
 }
 export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_DAYS, registrationContext = null, defaultMaxRedemptions = DEFAULT_MAX_REDEMPTIONS, }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const qrWrapperRef = useRef(null);
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState('');
@@ -82,7 +83,7 @@ export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_D
             setSuccess(t('Auth.SIGNUP_QR_CREATE_SUCCESS', 'New QR signup link created.'));
         }
         catch (err) {
-            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
+            setError(resolveErrorText(i18n, err, 'Auth.SIGNUP_QR_CREATE_FAILED'));
         }
         finally {
             setBusy(false);
@@ -126,7 +127,7 @@ export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_D
             catch (err) {
                 if (!active)
                     return;
-                setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
+                setError(resolveErrorText(i18n, err, 'Auth.SIGNUP_QR_CREATE_FAILED'));
             }
             finally {
                 if (active) {

package/dist/components/QrSignupValidityManager.js

@@ -3,6 +3,7 @@ import React, { useEffect, useState } from 'react';
 import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { updateAuthPolicy } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const QR_SIGNUP_VALIDITY_ALERT_SX = { mb: 2 };
 export const QR_SIGNUP_VALIDITY_FIELD_SX = { flex: 1 };
 export const QR_SIGNUP_VALIDITY_BUTTON_SX = { minWidth: 120, mt: { sm: '8px' } };
@@ -15,7 +16,7 @@ function clampExpiryDays(value) {
     return parsed;
 }
 export function QrSignupValidityManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_DAYS, onPolicyChange, canEdit = true, }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [currentExpiryDays, setCurrentExpiryDays] = useState(String(expiryDays || DEFAULT_EXPIRY_DAYS));
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState('');
@@ -38,7 +39,7 @@ export function QrSignupValidityManager({ enabled = false, expiryDays = DEFAULT_
                 onPolicyChange(next);
         }
         catch (err) {
-            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+            setError(resolveErrorText(i18n, err, 'Auth.AUTH_POLICY_UPDATE_FAILED'));
         }
         finally {
             setBusy(false);

package/dist/components/RegistrationMethodsManager.js

@@ -3,6 +3,7 @@ import React, { useEffect, useState } from 'react';
 import { Alert, Box, CircularProgress, FormControlLabel, Stack, Switch, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { updateAuthPolicy } from '../auth/authApi';
+import { resolveErrorText } from '../utils/resolveErrorText';
 export const REGISTRATION_METHODS_ALERT_SX = { mb: 2 };
 export const REGISTRATION_METHODS_INFO_SX = { mt: 2 };
 const EMPTY_POLICY = {
@@ -16,7 +17,7 @@ const EMPTY_POLICY = {
     required_auth_factor_count: 1,
 };
 export function RegistrationMethodsManager({ policy: authPolicy, error = '', onPolicyChange, canEdit = true, }) {
-    const { t } = useTranslation();
+    const { t, i18n } = useTranslation();
     const [policyState, setPolicyState] = useState(EMPTY_POLICY);
     const [busyField, setBusyField] = useState('');
     const [saveError, setSaveError] = useState('');
@@ -42,7 +43,7 @@ export function RegistrationMethodsManager({ policy: authPolicy, error = '', onP
         }
         catch (err) {
             setPolicyState((prev) => (Object.assign(Object.assign({}, prev), { [field]: previous })));
-            setSaveError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+            setSaveError(resolveErrorText(i18n, err, 'Auth.AUTH_POLICY_UPDATE_FAILED'));
         }
         finally {
             setBusyField('');