@open-mercato/core 0.6.8-develop.7068.1.c55b52e1a1 → 0.6.8-develop.7072.1.19c2a8bbe0

package/src/modules/auth/components/AclEditor.tsx

@@ -4,14 +4,10 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import Link from 'next/link'
 import { hasFeature, matchFeature } from '@open-mercato/shared/security/features'
-import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'
 import type { FeatureDescriptor } from '@open-mercato/shared/security/aclDependencies'
 import { AclDependencyDiagnosticsPanel } from './AclDependencyDiagnosticsPanel'
 
-function toTitleCase(value: string): string {
-  return value.replace(/[-_.]/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase())
-}
-
 function normalizeFeatureArray(input: unknown): string[] {
   if (!Array.isArray(input)) return []
   const dedup = new Set<string>()
@@ -30,12 +26,16 @@ function isTenantRestrictedFeature(feature: string): boolean {
   return false
 }
 
-function formatWildcardLabel(moduleId: string, wildcard: string): string {
+function formatWildcardLabel(t: TranslateFn, moduleId: string, wildcard: string): string {
   if (!wildcard.endsWith('.*')) return wildcard
   const prefix = `${moduleId}.`
   const suffix = wildcard.startsWith(prefix) ? wildcard.slice(prefix.length, -2) : wildcard.slice(0, -2)
-  if (!suffix) return 'All features'
-  return `All ${suffix.split('.').map(toTitleCase).join(' / ')}`
+  if (!suffix) return t('auth.acl.wildcards.allFeatures', 'All features')
+  const group = suffix
+    .split('.')
+    .map((segment) => segment.replace(/[-_]/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase()))
+    .join(' / ')
+  return t('auth.acl.wildcards.allGroup', 'All permissions in {group}', { group })
 }
 
 type Feature = { id: string; title: string; module: string; dependsOn?: string[] }
@@ -257,19 +257,28 @@ export function AclEditor({
   const grouped = React.useMemo(() => {
     const moduleMap = new Map<string, string>()
     for (const m of modules) {
-      moduleMap.set(m.id, m.title)
+      moduleMap.set(m.id, t(`auth.acl.modules.${m.id}`, m.title))
     }
     const map = new Map<string, { moduleId: string; moduleTitle: string; features: Feature[] }>()
     for (const f of features) {
       const moduleId = f.module
       const moduleTitle = moduleMap.get(moduleId) || moduleId
+      const localizedFeature = {
+        ...f,
+        title: t(`auth.acl.features.${f.id}`, f.title),
+      }
       if (!map.has(moduleId)) {
         map.set(moduleId, { moduleId, moduleTitle, features: [] })
       }
-      map.get(moduleId)!.features.push(f)
+      map.get(moduleId)!.features.push(localizedFeature)
     }
     return Array.from(map.values()).sort((a, b) => a.moduleTitle.localeCompare(b.moduleTitle))
-  }, [features, modules])
+  }, [features, modules, t])
+
+  const localizedFeatures = React.useMemo(
+    () => grouped.flatMap((group) => group.features),
+    [grouped],
+  )
 
   const hasGlobalWildcard = granted.includes('*')
   const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0
@@ -305,22 +314,28 @@ export function AclEditor({
 
   const isFeatureChecked = (featureId: string) => hasFeature(granted, featureId)
 
-  if (loading) return <div className="text-sm text-muted-foreground">Loading ACL…</div>
+  if (loading) {
+    return (
+      <div className="text-sm text-muted-foreground">
+        {t('auth.acl.loading', 'Loading access control…')}
+      </div>
+    )
+  }
 
   const showRoleBanner = kind === 'user' && !hasCustomAcl && !overrideEnabled
 
   return (
     <div className="space-y-4">
       {showRoleBanner && (
-        <div className="rounded-lg border border-blue-200 bg-blue-50 p-4">
-          <div className="text-sm font-medium text-blue-900 mb-2">
-            Permissions inherited from roles
+        <div className="rounded-lg border border-status-info-border bg-status-info-bg p-4">
+          <div className="text-sm font-medium text-status-info-text mb-2">
+            {t('auth.acl.inherited.title', 'Permissions inherited from roles')}
           </div>
-          <div className="text-sm text-blue-700 mb-3">
-            This user currently inherits permissions from their assigned roles.
+          <div className="text-sm text-status-info-text mb-3">
+            {t('auth.acl.inherited.description', 'This user currently inherits permissions from their assigned roles.')}
             {roleDetails.length > 0 && (
               <span>
-                {' '}Assigned roles:{' '}
+                {' '}{t('auth.acl.inherited.assignedRoles', 'Assigned roles:')}{' '}
                 {roleDetails.map((role, idx) => {
                   const roleId = typeof role?.id === 'string' && role.id.length > 0 ? role.id : `role-${idx}`
                   const roleName = typeof role?.name === 'string' && role.name.length > 0 ? role.name : roleId
@@ -329,7 +344,7 @@ export function AclEditor({
                       {idx > 0 && ', '}
                       <Link 
                         href={`/backend/roles/${roleId}/edit`}
-                        className="font-semibold text-blue-900 underline hover:text-blue-950 transition-colors"
+                        className="font-semibold text-status-info-text underline"
                       >
                         {roleName}
                       </Link>
@@ -347,8 +362,8 @@ export function AclEditor({
               checked={overrideEnabled} 
               onChange={(e) => setOverrideEnabled(e.target.checked)} 
             />
-            <label htmlFor="overrideAcl" className="text-sm text-blue-900 font-medium">
-              Override permissions for this user only
+            <label htmlFor="overrideAcl" className="text-sm text-status-info-text font-medium">
+              {t('auth.acl.inherited.override', 'Override permissions for this user only')}
             </label>
           </div>
         </div>
@@ -364,31 +379,39 @@ export function AclEditor({
               disabled={!actorIsSuperAdmin}
               onChange={(e) => setIsSuperAdmin(!!e.target.checked)}
             />
-            <label htmlFor="isSuperAdmin" className="text-sm">Super Admin (all features)</label>
+            <label htmlFor="isSuperAdmin" className="text-sm">
+              {t('auth.acl.superAdmin.label', 'Super Admin (all features)')}
+            </label>
           </div>
           {!actorIsSuperAdmin && (
-            <p className="text-xs text-muted-foreground">Only super administrators can change this option.</p>
+            <p className="text-xs text-muted-foreground">
+              {t('auth.acl.superAdmin.hint', 'Only super administrators can change this option.')}
+            </p>
           )}
       {!isSuperAdmin && (
         <>
           {hasGlobalWildcard && (
-            <div className="rounded border border-blue-200 bg-blue-50 p-3">
-              <div className="text-sm font-medium text-blue-900">Global wildcard (*) enabled</div>
-              <div className="text-xs text-blue-700 mt-1">This grants access to all features in the system.</div>
+            <div className="rounded border border-status-info-border bg-status-info-bg p-3">
+              <div className="text-sm font-medium text-status-info-text">
+                {t('auth.acl.globalWildcard.title', 'Global wildcard (*) enabled')}
+              </div>
+              <div className="text-xs text-status-info-text mt-1">
+                {t('auth.acl.globalWildcard.description', 'This grants access to all features in the system.')}
+              </div>
               <Button
                 variant="outline"
                 size="sm"
                 className="mt-2"
                 onClick={() => updateGranted((prev) => prev.filter((x) => x !== '*'))}
               >
-                Remove global wildcard
+                {t('auth.acl.globalWildcard.remove', 'Remove global wildcard')}
               </Button>
             </div>
           )}
           {!hasGlobalWildcard && (
             <AclDependencyDiagnosticsPanel
               granted={granted}
-              catalog={features as readonly FeatureDescriptor[]}
+              catalog={localizedFeatures as readonly FeatureDescriptor[]}
               onGrantedChange={updateGranted}
               hideUnknownReferences={process.env.NODE_ENV === 'production'}
             />
@@ -433,8 +456,13 @@ export function AclEditor({
                         onChange={(e) => toggleModuleWildcard(group.moduleId, e.target.checked)} 
                       />
                       <label htmlFor={`module-${group.moduleId}`} className="text-sm text-muted-foreground">
-                        All {moduleWildcard && !hasGlobalWildcard ? <span className="font-medium text-blue-600">({group.moduleId}.*)</span> : ''}
-                        {moduleRestricted ? <span className="ml-2 text-xs font-medium text-muted-foreground">(manage via super admin)</span> : null}
+                        {t('auth.acl.allModuleFeatures', 'All')}{' '}
+                        {moduleWildcard && !hasGlobalWildcard ? <span className="font-medium text-status-info-text">({group.moduleId}.*)</span> : ''}
+                        {moduleRestricted ? (
+                          <span className="ml-2 text-xs font-medium text-muted-foreground">
+                            {t('auth.acl.manageViaSuperAdmin', '(manage via super admin)')}
+                          </span>
+                        ) : null}
                       </label>
                     </div>
                   </div>
@@ -459,7 +487,7 @@ export function AclEditor({
                                 htmlFor={`wildcard-${wildcard}`}
                                 className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}
                               >
-                                {formatWildcardLabel(group.moduleId, wildcard)}{' '}
+                                {formatWildcardLabel(t, group.moduleId, wildcard)}{' '}
                                 <span className="text-muted-foreground text-xs font-mono">({wildcard})</span>
                                 {wildcardRestricted ? (
                                   <span className="ml-2 text-xs font-medium text-muted-foreground">
@@ -535,7 +563,9 @@ export function AclEditor({
               <div className="text-sm font-medium mb-2">
                 {t('auth.acl.organizationsScope', 'Organizations scope')}
               </div>
-              <div className="text-xs text-muted-foreground mb-2">Empty = all organizations. Select one or more to restrict.</div>
+              <div className="text-xs text-muted-foreground mb-2">
+                {t('auth.acl.organizationsScopeHint', 'Empty means all organizations. Select one or more to restrict access.')}
+              </div>
               <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
                 {orgOptions.map((o) => {
                   const checked = organizations == null ? false : (organizations || []).includes(o.id)
@@ -557,7 +587,7 @@ export function AclEditor({
                 <Button variant="outline" onClick={() => setOrganizations(null)}>{t('auth.acl.allowAllOrganizations', 'Allow all organizations')}</Button>
               </div>
               {showOrganizationWarning && (
-                <div className="mt-3 rounded border border-amber-200 bg-amber-50 px-3 py-2 text-sm text-amber-900">
+                <div className="mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text">
                   {t('auth.acl.organizationWarning', 'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.')}
                 </div>
               )}

package/src/modules/auth/i18n/de.json

@@ -3,6 +3,7 @@
   "auth.accessDenied.home": "Zur Startseite",
   "auth.accessDenied.message": "Du hast keine Berechtigung, diese Seite anzuzeigen. Bitte wende dich an deinen Administrator.",
   "auth.accessDenied.title": "Zugriff verweigert",
+  "auth.acl.allModuleFeatures": "All",
   "auth.acl.allowAllOrganizations": "Alle Organisationen zulassen",
   "auth.acl.deps.missing.add": "\"{dep}\" hinzufügen",
   "auth.acl.deps.missing.item": "\"{feature}\" benötigt:",
@@ -12,9 +13,388 @@
   "auth.acl.deps.orphaned.restore": "\"{dependency}\" wiederherstellen",
   "auth.acl.deps.orphaned.title": "Entfernung einer Berechtigung, die andere gewährte Berechtigungen benötigen:",
   "auth.acl.deps.unknown.title": "Einige deklarierte Abhängigkeiten passen zu keiner bekannten Berechtigung:",
+  "auth.acl.features.ai_assistant.conversations.manage": "Manage AI Assistant Conversations",
+  "auth.acl.features.ai_assistant.conversations.share": "Share AI Assistant Conversations",
+  "auth.acl.features.ai_assistant.mcp.serve": "Start MCP Server",
+  "auth.acl.features.ai_assistant.mcp_servers.manage": "Manage MCP Server Configurations",
+  "auth.acl.features.ai_assistant.mcp_servers.view": "View MCP Server Configurations",
+  "auth.acl.features.ai_assistant.settings.manage": "Manage AI Assistant Settings",
+  "auth.acl.features.ai_assistant.tools.list": "List MCP Tools",
+  "auth.acl.features.ai_assistant.view": "View AI Assistant Settings",
+  "auth.acl.features.analytics.view": "View analytics widgets",
+  "auth.acl.features.api_keys.create": "Create API keys",
+  "auth.acl.features.api_keys.delete": "Delete API keys",
+  "auth.acl.features.api_keys.view": "View API keys",
+  "auth.acl.features.attachments.manage": "Manage attachments",
+  "auth.acl.features.attachments.view": "View attachments",
+  "auth.acl.features.audit_logs.redo_self": "Redo own actions",
+  "auth.acl.features.audit_logs.redo_tenant": "Redo tenant actions",
+  "auth.acl.features.audit_logs.undo_self": "Undo own actions",
+  "auth.acl.features.audit_logs.undo_tenant": "Undo tenant actions",
+  "auth.acl.features.audit_logs.view_self": "View own audit logs",
+  "auth.acl.features.audit_logs.view_tenant": "View tenant audit logs",
+  "auth.acl.features.auth.acl.manage": "Manage ACLs",
+  "auth.acl.features.auth.roles.list": "List roles",
+  "auth.acl.features.auth.roles.manage": "Manage roles",
+  "auth.acl.features.auth.sidebar.manage": "Manage sidebar presets",
+  "auth.acl.features.auth.users.create": "Create users",
+  "auth.acl.features.auth.users.delete": "Delete users",
+  "auth.acl.features.auth.users.edit": "Edit users",
+  "auth.acl.features.auth.users.list": "List users",
+  "auth.acl.features.business_rules.execute": "Execute business rules manually",
+  "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
+  "auth.acl.features.business_rules.manage_sets": "Manage rule sets",
+  "auth.acl.features.business_rules.view": "View business rules",
+  "auth.acl.features.business_rules.view_logs": "View rule execution logs",
+  "auth.acl.features.catalog.categories.manage": "Manage catalog categories",
+  "auth.acl.features.catalog.categories.view": "View catalog categories",
+  "auth.acl.features.catalog.pricing.manage": "Manage catalog pricing",
+  "auth.acl.features.catalog.products.manage": "Manage catalog products",
+  "auth.acl.features.catalog.products.view": "View catalog products",
+  "auth.acl.features.catalog.settings.manage": "Manage catalog settings",
+  "auth.acl.features.catalog.variants.manage": "Manage catalog variants",
+  "auth.acl.features.channel_apns.configure": "Configure APNs credentials",
+  "auth.acl.features.channel_apns.view": "View APNs channel configuration",
+  "auth.acl.features.channel_expo.configure": "Configure Expo push credentials",
+  "auth.acl.features.channel_expo.view": "View Expo push channel configuration",
+  "auth.acl.features.channel_fcm.configure": "Configure FCM credentials",
+  "auth.acl.features.channel_fcm.view": "View FCM channel configuration",
+  "auth.acl.features.channel_gmail.configure": "Configure Gmail OAuth defaults",
+  "auth.acl.features.channel_gmail.view": "View Gmail channel configuration",
+  "auth.acl.features.channel_imap.configure": "Configure IMAP channel defaults",
+  "auth.acl.features.channel_imap.view": "View IMAP channel configuration",
+  "auth.acl.features.checkout.create": "Create checkout links and templates",
+  "auth.acl.features.checkout.delete": "Delete checkout links and templates",
+  "auth.acl.features.checkout.edit": "Edit checkout links and templates",
+  "auth.acl.features.checkout.export": "Export checkout transactions",
+  "auth.acl.features.checkout.view": "View checkout links and transactions",
+  "auth.acl.features.checkout.viewPii": "View checkout customer PII",
+  "auth.acl.features.communication_channels.admin": "Administer all communication channels (tenant-wide)",
+  "auth.acl.features.communication_channels.assign": "Assign channel conversations",
+  "auth.acl.features.communication_channels.channel.import_history": "Import channel history",
+  "auth.acl.features.communication_channels.channel.push.manage": "Manage push delivery",
+  "auth.acl.features.communication_channels.connect_tenant_channel": "Connect tenant-wide communication channel",
+  "auth.acl.features.communication_channels.connect_user_channel": "Connect own communication channel",
+  "auth.acl.features.communication_channels.manage": "Manage communication channels",
+  "auth.acl.features.communication_channels.react": "React to channel messages",
+  "auth.acl.features.communication_channels.view": "View communication channels",
+  "auth.acl.features.configs.cache.manage": "Manage cache",
+  "auth.acl.features.configs.cache.view": "View cache overview",
+  "auth.acl.features.configs.manage": "Manage configuration",
+  "auth.acl.features.configs.system_status.view": "View system status",
+  "auth.acl.features.currencies.fetch.manage": "Manage currency fetch configuration",
+  "auth.acl.features.currencies.fetch.view": "View currency fetch configuration",
+  "auth.acl.features.currencies.manage": "Manage currencies",
+  "auth.acl.features.currencies.rates.manage": "Manage exchange rates",
+  "auth.acl.features.currencies.rates.view": "View exchange rates",
+  "auth.acl.features.currencies.view": "View currencies",
+  "auth.acl.features.customer_accounts.domain.manage": "Manage custom portal domains",
+  "auth.acl.features.customer_accounts.invite": "Invite customer users",
+  "auth.acl.features.customer_accounts.manage": "Manage customer accounts",
+  "auth.acl.features.customer_accounts.roles.manage": "Manage customer roles",
+  "auth.acl.features.customer_accounts.view": "View customer accounts",
+  "auth.acl.features.customers.activities.manage": "Manage activities",
+  "auth.acl.features.customers.activities.view": "View activities",
+  "auth.acl.features.customers.companies.manage": "Manage companies",
+  "auth.acl.features.customers.companies.view": "View companies",
+  "auth.acl.features.customers.deals.manage": "Manage deals",
+  "auth.acl.features.customers.deals.view": "View deals",
+  "auth.acl.features.customers.email.compose": "Compose / send emails from CRM",
+  "auth.acl.features.customers.email.view_private": "View other users' private emails (reserved — inert in v1)",
+  "auth.acl.features.customers.interactions.manage": "Manage interactions",
+  "auth.acl.features.customers.interactions.view": "View interactions",
+  "auth.acl.features.customers.people.manage": "Manage people",
+  "auth.acl.features.customers.people.view": "View people",
+  "auth.acl.features.customers.pipelines.manage": "Manage pipelines",
+  "auth.acl.features.customers.pipelines.view": "View pipelines",
+  "auth.acl.features.customers.roles.manage": "Manage entity roles",
+  "auth.acl.features.customers.roles.view": "View entity roles",
+  "auth.acl.features.customers.settings.manage": "Manage customer settings",
+  "auth.acl.features.customers.widgets.new-customers": "Use customer new customers widget",
+  "auth.acl.features.customers.widgets.new-deals": "Use customer new deals widget",
+  "auth.acl.features.customers.widgets.next-interactions": "Use customer next interactions widget",
+  "auth.acl.features.customers.widgets.todos": "Use customer todos widget",
+  "auth.acl.features.dashboards.admin.assign-widgets": "Manage dashboard widget availability",
+  "auth.acl.features.dashboards.configure": "Customize dashboard layout",
+  "auth.acl.features.dashboards.view": "View dashboard",
+  "auth.acl.features.data_sync.configure": "Configure sync mappings and schedules",
+  "auth.acl.features.data_sync.run": "Run sync operations",
+  "auth.acl.features.data_sync.view": "View sync runs",
+  "auth.acl.features.design_system.view": "View the design system gallery",
+  "auth.acl.features.devices.admin": "Manage devices across users",
+  "auth.acl.features.devices.manage": "Manage own devices",
+  "auth.acl.features.devices.view": "View own devices",
+  "auth.acl.features.dictionaries.manage": "Manage shared dictionaries",
+  "auth.acl.features.dictionaries.view": "View shared dictionaries",
+  "auth.acl.features.directory.organizations.manage": "Manage organizations",
+  "auth.acl.features.directory.organizations.view": "View organizations",
+  "auth.acl.features.directory.tenants.manage": "Manage tenants",
+  "auth.acl.features.directory.tenants.view": "View tenants",
+  "auth.acl.features.documents.create": "Create documents",
+  "auth.acl.features.documents.delete": "Delete documents",
+  "auth.acl.features.documents.edit": "Edit documents",
+  "auth.acl.features.documents.manage": "Manage all documents",
+  "auth.acl.features.documents.share": "Share documents",
+  "auth.acl.features.documents.templates.manage": "Manage document templates",
+  "auth.acl.features.documents.view": "View documents",
+  "auth.acl.features.entities.definitions.manage": "Manage custom field definitions",
+  "auth.acl.features.entities.definitions.view": "View custom field definitions",
+  "auth.acl.features.entities.records.manage": "Manage records",
+  "auth.acl.features.entities.records.view": "View records",
+  "auth.acl.features.eudr.mappings.manage": "Manage EUDR mappings",
+  "auth.acl.features.eudr.mappings.view": "View EUDR mappings",
+  "auth.acl.features.eudr.plots.manage": "Manage EUDR plots",
+  "auth.acl.features.eudr.plots.view": "View EUDR plots",
+  "auth.acl.features.eudr.risk.manage": "Manage EUDR risk assessments",
+  "auth.acl.features.eudr.risk.view": "View EUDR risk assessments",
+  "auth.acl.features.eudr.statements.manage": "Manage EUDR statements",
+  "auth.acl.features.eudr.statements.view": "View EUDR statements",
+  "auth.acl.features.eudr.submissions.manage": "Manage EUDR submissions",
+  "auth.acl.features.eudr.submissions.view": "View EUDR submissions",
+  "auth.acl.features.example.backend": "Access example backend",
+  "auth.acl.features.example.manage": "Manage example (override probe)",
+  "auth.acl.features.example.todos.manage": "Manage todos",
+  "auth.acl.features.example.todos.view": "View todos",
+  "auth.acl.features.example.view": "View example enrichments",
+  "auth.acl.features.example.widgets.injection": "Use injection widgets",
+  "auth.acl.features.example.widgets.notes": "Use dashboard notes widget",
+  "auth.acl.features.example.widgets.todo": "Use dashboard todo widget",
+  "auth.acl.features.example.widgets.welcome": "Use dashboard welcome widget",
+  "auth.acl.features.example_customers_sync.manage": "Manage Example customer sync",
+  "auth.acl.features.example_customers_sync.view": "View Example customer sync diagnostics",
+  "auth.acl.features.feature_toggles.global.manage": "Manage system-wide global feature toggles",
+  "auth.acl.features.feature_toggles.manage": "Manage per-tenant feature toggle overrides",
+  "auth.acl.features.feature_toggles.view": "View feature toggles",
+  "auth.acl.features.gateway_stripe.configure": "Configure Stripe gateway settings",
+  "auth.acl.features.gateway_stripe.view": "View Stripe gateway configuration",
+  "auth.acl.features.inbox_ops.log.view": "View processing log",
+  "auth.acl.features.inbox_ops.proposals.manage": "Manage proposals",
+  "auth.acl.features.inbox_ops.proposals.view": "View proposals",
+  "auth.acl.features.inbox_ops.replies.send": "Send draft replies",
+  "auth.acl.features.inbox_ops.settings.manage": "Manage inbox settings",
+  "auth.acl.features.integrations.credentials.manage": "Manage integration credentials",
+  "auth.acl.features.integrations.manage": "Manage integration configurations",
+  "auth.acl.features.integrations.view": "View integrations and external ID mappings",
+  "auth.acl.features.messages.actions": "Execute message actions",
+  "auth.acl.features.messages.attach": "Attach records to messages",
+  "auth.acl.features.messages.attach_files": "Attach files to messages",
+  "auth.acl.features.messages.compose": "Compose messages",
+  "auth.acl.features.messages.email": "Send messages via email",
+  "auth.acl.features.messages.manage": "Manage all messages",
+  "auth.acl.features.messages.view": "View messages",
+  "auth.acl.features.notifications.create": "Create notifications for others",
+  "auth.acl.features.notifications.manage": "Manage all notifications",
+  "auth.acl.features.notifications.manage_preferences": "Manage own notification preferences",
+  "auth.acl.features.notifications.manage_user_preferences": "Manage other users' notification preferences",
+  "auth.acl.features.notifications.view": "View own notifications",
+  "auth.acl.features.onboarding.access": "Access onboarding flow",
+  "auth.acl.features.onboarding.submit": "Submit onboarding request",
+  "auth.acl.features.onboarding.verify": "Verify onboarding request",
+  "auth.acl.features.payment_gateways.capture": "Capture authorized payments",
+  "auth.acl.features.payment_gateways.manage": "Create and manage payment sessions",
+  "auth.acl.features.payment_gateways.refund": "Refund captured payments",
+  "auth.acl.features.payment_gateways.view": "View payment gateway transactions",
+  "auth.acl.features.perspectives.role_defaults": "Manage role default perspectives",
+  "auth.acl.features.perspectives.use": "Use table perspectives",
+  "auth.acl.features.planner.manage_availability": "Manage availability",
+  "auth.acl.features.planner.view": "View schedules",
+  "auth.acl.features.progress.cancel": "Cancel progress jobs",
+  "auth.acl.features.progress.create": "Create progress jobs",
+  "auth.acl.features.progress.manage": "Manage all progress jobs",
+  "auth.acl.features.progress.update": "Update progress jobs",
+  "auth.acl.features.progress.view": "View progress jobs",
+  "auth.acl.features.push_notifications.send_custom": "Send custom push notifications",
+  "auth.acl.features.push_notifications.view_deliveries": "View push delivery log",
+  "auth.acl.features.query_index.purge": "Purge index",
+  "auth.acl.features.query_index.reindex": "Trigger reindex",
+  "auth.acl.features.query_index.status.view": "View index status",
+  "auth.acl.features.record_locks.force_release": "Force release locks owned by other users",
+  "auth.acl.features.record_locks.manage": "Manage record locking settings",
+  "auth.acl.features.record_locks.override_incoming": "Override incoming conflict changes",
+  "auth.acl.features.record_locks.view": "View and use record locking",
+  "auth.acl.features.resources.manage_resources": "Manage resources",
+  "auth.acl.features.resources.view": "View resources",
+  "auth.acl.features.sales.channels.manage": "Manage sales channels",
+  "auth.acl.features.sales.channels.view": "View sales channels",
+  "auth.acl.features.sales.credit_memos.manage": "Manage credit memos",
+  "auth.acl.features.sales.documents.number.edit": "Edit sales document numbers",
+  "auth.acl.features.sales.invoices.manage": "Manage sales invoices",
+  "auth.acl.features.sales.orders.approve": "Approve sales orders",
+  "auth.acl.features.sales.orders.manage": "Manage sales orders",
+  "auth.acl.features.sales.orders.view": "View sales orders",
+  "auth.acl.features.sales.payments.manage": "Manage order payments",
+  "auth.acl.features.sales.quotes.manage": "Manage sales quotes",
+  "auth.acl.features.sales.quotes.view": "View sales quotes",
+  "auth.acl.features.sales.returns.create": "Create order returns",
+  "auth.acl.features.sales.returns.manage": "Edit and delete order returns",
+  "auth.acl.features.sales.returns.view": "View order returns",
+  "auth.acl.features.sales.settings.manage": "Manage sales configuration",
+  "auth.acl.features.sales.settings.view": "View sales configuration",
+  "auth.acl.features.sales.shipments.manage": "Manage order shipments",
+  "auth.acl.features.sales.widgets.new-orders": "View new orders widget",
+  "auth.acl.features.sales.widgets.new-quotes": "View new quotes widget",
+  "auth.acl.features.scheduler.jobs.manage": "Manage schedules",
+  "auth.acl.features.scheduler.jobs.trigger": "Trigger schedules",
+  "auth.acl.features.scheduler.jobs.view": "View schedules",
+  "auth.acl.features.search.embeddings.manage": "Manage embedding settings",
+  "auth.acl.features.search.embeddings.view": "View embedding settings",
+  "auth.acl.features.search.global": "Use global search (Cmd+K)",
+  "auth.acl.features.search.manage": "Manage search settings",
+  "auth.acl.features.search.reindex": "Reindex search data",
+  "auth.acl.features.search.view": "View search settings",
+  "auth.acl.features.security.admin.manage": "Manage security policies",
+  "auth.acl.features.security.mfa.manage": "Manage MFA settings",
+  "auth.acl.features.security.profile.manage": "Manage security profile",
+  "auth.acl.features.security.profile.password": "Change own password",
+  "auth.acl.features.security.profile.view": "View security profile",
+  "auth.acl.features.security.sudo.manage": "Manage sudo protection",
+  "auth.acl.features.security.sudo.view": "View sudo protection",
+  "auth.acl.features.shipping_carriers.manage": "Manage shipping carrier operations",
+  "auth.acl.features.shipping_carriers.view": "View shipping carrier shipments",
+  "auth.acl.features.sso.config.manage": "Manage SSO configuration",
+  "auth.acl.features.sso.config.view": "View SSO configuration",
+  "auth.acl.features.sso.scim.manage": "Manage SCIM provisioning tokens",
+  "auth.acl.features.staff.leave_requests.manage": "Manage leave requests",
+  "auth.acl.features.staff.leave_requests.send": "Send leave requests",
+  "auth.acl.features.staff.manage_team": "Manage employees",
+  "auth.acl.features.staff.my_availability.manage": "Manage my availability",
+  "auth.acl.features.staff.my_availability.unavailability": "Manage my unavailability",
+  "auth.acl.features.staff.my_availability.view": "View my availability",
+  "auth.acl.features.staff.my_leave_requests.send": "Send my leave requests",
+  "auth.acl.features.staff.my_leave_requests.view": "View my leave requests",
+  "auth.acl.features.staff.timesheets.approve": "Approve reportee time",
+  "auth.acl.features.staff.timesheets.lock": "Lock time periods",
+  "auth.acl.features.staff.timesheets.manage_all": "Manage all employees entries",
+  "auth.acl.features.staff.timesheets.manage_own": "Create/edit/delete own entries",
+  "auth.acl.features.staff.timesheets.projects.manage": "Manage time projects",
+  "auth.acl.features.staff.timesheets.projects.view": "View time projects",
+  "auth.acl.features.staff.timesheets.view": "View own time entries",
+  "auth.acl.features.staff.view": "View employees",
+  "auth.acl.features.storage_providers.manage": "Manage storage providers",
+  "auth.acl.features.sync_excel.run": "Upload CSV files and prepare imports",
+  "auth.acl.features.sync_excel.view": "View sync_excel uploads and previews",
+  "auth.acl.features.translations.manage": "Manage entity translations",
+  "auth.acl.features.translations.manage_locales": "Configure supported locales",
+  "auth.acl.features.translations.view": "View translations",
+  "auth.acl.features.warranty_claims.claim.create": "Create warranty claims",
+  "auth.acl.features.warranty_claims.claim.delete": "Delete warranty claims",
+  "auth.acl.features.warranty_claims.claim.manage": "Manage warranty claims",
+  "auth.acl.features.warranty_claims.claim.view": "View warranty claims",
+  "auth.acl.features.warranty_claims.external.submit": "Submit external warranty claims",
+  "auth.acl.features.warranty_claims.external.view": "View external warranty claims",
+  "auth.acl.features.warranty_claims.receiving.manage": "Manage warranty receiving and grading",
+  "auth.acl.features.warranty_claims.registration.manage": "Manage warranty registrations",
+  "auth.acl.features.warranty_claims.registration.view": "View warranty registrations",
+  "auth.acl.features.warranty_claims.settings.manage": "Manage warranty claim settings",
+  "auth.acl.features.warranty_claims.troubleshooting.manage": "Manage warranty troubleshooting guides",
+  "auth.acl.features.warranty_claims.vendor_policy.manage": "Manage warranty vendor policies",
+  "auth.acl.features.webhooks.manage": "Manage webhooks",
+  "auth.acl.features.webhooks.secrets": "View and rotate webhook secrets",
+  "auth.acl.features.webhooks.test": "Test webhooks",
+  "auth.acl.features.webhooks.view": "View webhooks",
+  "auth.acl.features.wms.adjust_inventory": "Adjust and move inventory",
+  "auth.acl.features.wms.cycle_count": "Run cycle counts",
+  "auth.acl.features.wms.import": "Import inventory from CSV",
+  "auth.acl.features.wms.manage_inventory": "Manage inventory profiles and stock state",
+  "auth.acl.features.wms.manage_locations": "Manage warehouse locations",
+  "auth.acl.features.wms.manage_reservations": "Manage inventory reservations",
+  "auth.acl.features.wms.manage_warehouses": "Manage warehouses",
+  "auth.acl.features.wms.manage_zones": "Manage warehouse zones",
+  "auth.acl.features.wms.receive_inventory": "Receive inbound inventory",
+  "auth.acl.features.wms.view": "View WMS data",
+  "auth.acl.features.workflows.definitions.create": "Create workflow definitions",
+  "auth.acl.features.workflows.definitions.delete": "Delete workflow definitions",
+  "auth.acl.features.workflows.definitions.edit": "Edit workflow definitions",
+  "auth.acl.features.workflows.definitions.view": "View workflow definitions",
+  "auth.acl.features.workflows.events.view": "View workflow events",
+  "auth.acl.features.workflows.instances.cancel": "Cancel workflow instances",
+  "auth.acl.features.workflows.instances.create": "Start workflow instances",
+  "auth.acl.features.workflows.instances.retry": "Retry workflow instances",
+  "auth.acl.features.workflows.instances.signal": "Signal workflow instances",
+  "auth.acl.features.workflows.instances.view": "View workflow instances",
+  "auth.acl.features.workflows.manage": "Manage workflows",
+  "auth.acl.features.workflows.signals.send": "Send workflow signals",
+  "auth.acl.features.workflows.tasks.claim": "Claim workflow tasks",
+  "auth.acl.features.workflows.tasks.complete": "Complete workflow tasks",
+  "auth.acl.features.workflows.tasks.view": "View user tasks",
+  "auth.acl.features.workflows.view": "View workflows",
+  "auth.acl.features.workflows.view_logs": "View workflow logs",
+  "auth.acl.features.workflows.view_tasks": "View workflow tasks",
+  "auth.acl.globalWildcard.description": "This grants access to all features in the system.",
+  "auth.acl.globalWildcard.remove": "Remove global wildcard",
+  "auth.acl.globalWildcard.title": "Global wildcard (*) enabled",
+  "auth.acl.inherited.assignedRoles": "Assigned roles:",
+  "auth.acl.inherited.description": "This user currently inherits permissions from their assigned roles.",
+  "auth.acl.inherited.override": "Override permissions for this user only",
+  "auth.acl.inherited.title": "Permissions inherited from roles",
+  "auth.acl.loading": "Loading access control…",
+  "auth.acl.manageViaSuperAdmin": "(manage via super admin)",
+  "auth.acl.modules.ai_assistant": "AI Assistant",
+  "auth.acl.modules.api_keys": "API Keys",
+  "auth.acl.modules.attachments": "Attachments",
+  "auth.acl.modules.audit_logs": "Audit & Action Logs",
+  "auth.acl.modules.auth": "Authentication & Accounts",
+  "auth.acl.modules.business_rules": "Business Rules",
+  "auth.acl.modules.catalog": "Product Catalog",
+  "auth.acl.modules.channel_apns": "Apple Push Notification Channel",
+  "auth.acl.modules.channel_expo": "Expo Push Channel",
+  "auth.acl.modules.channel_fcm": "Firebase Cloud Messaging Channel",
+  "auth.acl.modules.channel_gmail": "Gmail Email Channel",
+  "auth.acl.modules.channel_imap": "IMAP + SMTP Email Channel",
+  "auth.acl.modules.checkout": "Checkout",
+  "auth.acl.modules.communication_channels": "Communication Channels",
+  "auth.acl.modules.configs": "Configuration",
+  "auth.acl.modules.currencies": "Currencies",
+  "auth.acl.modules.customer_accounts": "Customer Identity & Portal Authentication",
+  "auth.acl.modules.customers": "Customer Relationship Management",
+  "auth.acl.modules.dashboards": "Admin Dashboards",
+  "auth.acl.modules.data_sync": "Data Sync",
+  "auth.acl.modules.design_system": "Design system gallery",
+  "auth.acl.modules.devices": "Devices",
+  "auth.acl.modules.dictionaries": "Shared Dictionaries",
+  "auth.acl.modules.directory": "Directory (Tenants & Organizations)",
+  "auth.acl.modules.documents": "Documents",
+  "auth.acl.modules.entities": "Custom Entities & Fields",
+  "auth.acl.modules.eudr": "EUDR Compliance",
+  "auth.acl.modules.example": "Example Module",
+  "auth.acl.modules.example_customers_sync": "Example Customers Sync",
+  "auth.acl.modules.feature_toggles": "Feature Toggles",
+  "auth.acl.modules.gateway_stripe": "Stripe Payment Gateway",
+  "auth.acl.modules.inbox_ops": "InboxOps — Email-to-ERP Agent",
+  "auth.acl.modules.integrations": "Integrations",
+  "auth.acl.modules.messages": "Messages",
+  "auth.acl.modules.notifications": "Notifications",
+  "auth.acl.modules.onboarding": "Onboarding",
+  "auth.acl.modules.payment_gateways": "Payment Gateways",
+  "auth.acl.modules.perspectives": "Table perspectives",
+  "auth.acl.modules.planner": "Worktime / Availabilities",
+  "auth.acl.modules.progress": "Progress",
+  "auth.acl.modules.push_notifications": "Push Notifications",
+  "auth.acl.modules.query_index": "Query Indexes",
+  "auth.acl.modules.record_locks": "Record Locking",
+  "auth.acl.modules.resources": "Resource planning",
+  "auth.acl.modules.sales": "Sales Management",
+  "auth.acl.modules.scheduler": "Scheduler",
+  "auth.acl.modules.search": "Search",
+  "auth.acl.modules.security": "Security",
+  "auth.acl.modules.shipping_carriers": "Shipping Carriers",
+  "auth.acl.modules.sso": "sso",
+  "auth.acl.modules.staff": "Employees",
+  "auth.acl.modules.storage_s3": "S3-Compatible Storage",
+  "auth.acl.modules.sync_excel": "Excel / CSV Import",
+  "auth.acl.modules.translations": "Entity Translations",
+  "auth.acl.modules.warranty_claims": "Warranty & RMA",
+  "auth.acl.modules.webhooks": "Webhooks",
+  "auth.acl.modules.wms": "Warehouse Management System",
+  "auth.acl.modules.workflows": "Workflow Engine",
   "auth.acl.organizationWarning": "Organisationseinschränkungen werden nur gespeichert, wenn mindestens eine Berechtigungsüberschreibung ausgewählt ist. Füge eine Berechtigung hinzu oder aktiviere einen Modul-Wildcard vor dem Speichern.",
   "auth.acl.organizationsScope": "Organisationsbereich",
+  "auth.acl.organizationsScopeHint": "Empty means all organizations. Select one or more to restrict access.",
   "auth.acl.restricted": "Eingeschränkt",
+  "auth.acl.superAdmin.hint": "Only super administrators can change this option.",
+  "auth.acl.superAdmin.label": "Super Admin (all features)",
+  "auth.acl.wildcards.allFeatures": "All features",
+  "auth.acl.wildcards.allGroup": "All permissions in {group}",
   "auth.actions.contactSupport": "Support kontaktieren",
   "auth.actions.viewPermissions": "Berechtigungen anzeigen",
   "auth.actions.viewSessions": "Sitzungen anzeigen",