@owlmeans/client-auth 0.1.18-rc.8 → 0.1.18

package/src/login/env.ts

@@ -1,86 +1,74 @@
 import { LOGIN_SURROGATE_MARKER, LOGIN_SURROGATE_NAME } from './consts.js'
 import type { LoginEnv } from './types.js'
+import type { LoginEnvHelper } from './env/types.js'
 
-/**
- * Whether this document is embedded in a frame.
- *
- * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
- * differs and a `top` that cannot be reached both mean "framed".
- */
-export const isEmbedded = (): boolean => {
-  try {
-    return window.self !== window.top
-  } catch {
-    return true
+export const createLoginEnvHelper = (): LoginEnvHelper => {
+  const isEmbedded = (): boolean => {
+    try {
+      return window.self !== window.top
+    } catch {
+      return true
+    }
   }
-}
 
-/**
- * Record that this window is the surrogate login window, while that is still knowable.
- *
- * Must run on the surrogate's **first** load, before the flow navigates to the provider:
- * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
- * context goes cross-origin — so by the time the provider redirects back, the name is gone and
- * this window would look like an ordinary tab.
- *
- * Idempotent, and a no-op in every window that is not the surrogate.
- */
-export const markSurrogate = (): void => {
-  if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
-    return
-  }
-  try {
-    window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1')
-  } catch {
-    // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
-    // covers the case where nothing cross-origin happened in between.
+  const markSurrogate = (): void => {
+    if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
+      return
+    }
+    try {
+      window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1')
+    } catch {
+      // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
+      // covers the case where nothing cross-origin happened in between.
+    }
   }
-}
 
-/** Whether this document is the surrogate login window. */
-export const isSurrogate = (): boolean => {
-  if (typeof window === 'undefined') {
-    return false
+  const isSurrogate = (): boolean => {
+    if (typeof window === 'undefined') {
+      return false
+    }
+    if (window.name === LOGIN_SURROGATE_NAME) {
+      return true
+    }
+    try {
+      return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1'
+    } catch {
+      return false
+    }
   }
-  if (window.name === LOGIN_SURROGATE_NAME) {
-    return true
-  }
-  try {
-    return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1'
-  } catch {
-    return false
-  }
-}
 
-/** Forget the surrogate marker — called once its token has been handed back. */
-export const clearSurrogate = (): void => {
-  if (typeof window === 'undefined') {
-    return
+  const clearSurrogate = (): void => {
+    if (typeof window === 'undefined') {
+      return
+    }
+    try {
+      window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER)
+    } catch { /* nothing to clean up if storage was never available */ }
   }
-  try {
-    window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER)
-  } catch { /* nothing to clean up if storage was never available */ }
-}
 
-/**
- * Default login environment.
- *
- * The single source of environment truth for cascade selection — a plugin's `match` reads this
- * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
- * own descriptor.
- */
-export const defaultLoginEnv = (): LoginEnv => {
-  const hasWindow = typeof window !== 'undefined'
-  if (!hasWindow) {
-    return { hasWindow, embedded: false, surrogate: false, hasOpener: false }
-  }
+  const defaultLoginEnv = (): LoginEnv => {
+    const hasWindow = typeof window !== 'undefined'
+    if (!hasWindow) {
+      return { hasWindow, embedded: false, surrogate: false, hasOpener: false }
+    }
 
-  return {
-    hasWindow,
-    embedded: isEmbedded(),
-    surrogate: isSurrogate(),
-    // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
-    // is why it is observed rather than assumed from "we were opened by someone".
-    hasOpener: window.opener != null,
+    return {
+      hasWindow,
+      embedded: isEmbedded(),
+      surrogate: isSurrogate(),
+      // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
+      // is why it is observed rather than assumed from "we were opened by someone".
+      hasOpener: window.opener != null,
+    }
   }
+
+  return { isEmbedded, markSurrogate, isSurrogate, clearSurrogate, defaultLoginEnv }
 }
+
+export const loginEnvHelper = createLoginEnvHelper()
+
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.markSurrogate()` */
+export const markSurrogate = (): void => loginEnvHelper.markSurrogate()
+
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.clearSurrogate()` */
+export const clearSurrogate = (): void => loginEnvHelper.clearSurrogate()

package/src/login/flow.ts

@@ -0,0 +1,44 @@
+import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow'
+import type { FlowModel } from '@owlmeans/flow'
+import { DEFAULT_ENTITY } from '../consts.js'
+
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export const enterOidcAuthorization = (model: FlowModel): FlowModel => {
+  const state = model.state()
+  if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Dispatch) {
+    return model
+  }
+
+  const target = model.step().service
+  if (state.service == null || state.service === '') {
+    model.target(target)
+  }
+
+  // The entity travels to this app's own backend, which resolves its default provider by `def`
+  // alone. It still has to BE there: the init endpoint rejects a body without one.
+  if (state.entityId == null) {
+    model.entity(DEFAULT_ENTITY)
+  }
+
+  if (target === FLOW_PLACEHOLDER) {
+    model.transit(OidcAuthStep.Ephemeral, true)
+  }
+
+  return model
+}

package/src/login/hook.ts

@@ -1,13 +1,14 @@
-import { useCallback } from 'react'
-import type { MouseEvent } from 'react'
+import { useCallback, type MouseEvent } from 'react'
 import { useContext, useNavigate } from '@owlmeans/client'
 import type { ClientContext } from '@owlmeans/client-context'
 import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 import { DISPATCHER } from '@owlmeans/auth'
-import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js'
-import type { AuthService } from '@owlmeans/auth-common'
-import type { LoginService } from './types.js'
-import { LOGIN_SERVICE } from './consts.js'
+import type { LoginContext, LoginService } from './types.js'
+import type { LandOptions } from './land/types.js'
+import { LoginIntent, LOGIN_SERVICE } from './consts.js'
+import { loginLandingOf } from './land.js'
+import { surrogatePath } from './surrogate.js'
+import { loginStartOf } from './start.js'
 
 /**
  * Wiring for a "Log in" control: where it points, and what it does when clicked.
@@ -17,6 +18,12 @@ import { LOGIN_SERVICE } from './consts.js'
  * an app embedded in a frame runs the flow one window up, because the provider refuses to be
  * framed and its cookies are third-party there.
  *
+ * `target` is the screen to land on once signed in — sign-in FIRST, then the screen, in an ordinary
+ * tab and in a framed application alike, with any pending post-sign-in step (a consent screen) run
+ * on the way. The control still leads to the dispatcher; the target is parked for the landing
+ * (`LoginRequest.target`), and somebody already signed in goes straight to it (`loginStartOf(ctx).startLogin`).
+ * Without a target the landing is the ordinary one.
+ *
  * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
  * opened after the user gesture has finished being handled is eaten by the popup blocker.
  *
@@ -29,17 +36,12 @@ export const useLogin = (target?: string): readonly [string, (event?: MouseEvent
   const context = useContext() as unknown as ClientContext
   const nav = useNavigate()
   const dispatcher = context.entrypoint<ClientEntrypoint>(DISPATCHER)
-  const path = dispatcher.getPath()
+  const path = dispatcher.path()
 
   const onLogin = useCallback((event?: MouseEvent) => {
     event?.preventDefault()
-    const login = context.service<LoginService>(LOGIN_SERVICE)
-    void login.begin({
-      url: path,
-      target,
-      // Only a component may call `useNavigate`, so the in-app continuation is handed to the
-      // plugin rather than reinvented by it.
-      navigate: () => { nav.go(target ?? DISPATCHER) },
+    void loginStartOf(context as unknown as LoginContext).startLogin({
+      url: path, target, go: alias => nav.go(alias),
     })
   }, [context, path, target])
 
@@ -49,15 +51,49 @@ export const useLogin = (target?: string): readonly [string, (event?: MouseEvent
 /**
  * Wiring for a "Log out" control.
  *
- * `update(undefined)` — not `null`. The declared clearing value is `undefined`, and on the web the
- * auth service reacts to it by navigating to the dispatcher, so this is the whole logout.
+ * One control, one handler, no decision — the mirror of {@link useLogin}. Where the session has to
+ * be ended (here, or one window up in a surrogate whose storage partition this document cannot
+ * reach) is the login plugin's call.
+ *
+ * NOT async, and nothing is awaited before delegating: logging out of a framed application opens a
+ * window, and a window opened after the gesture has finished being handled is eaten by the popup
+ * blocker. The surrogate entrypoint is resolved INSIDE the hook for the same reason `useLogin`
+ * resolves the dispatcher there.
+ *
+ * The return shape stays a bare handler rather than `useLogin`'s tuple: a logout control has no
+ * address to point at, and every generated application carries a copy of a component that writes
+ * `const onLogOut = useLogout()`. `(event?: MouseEvent) => void` is assignable to `() => void`, so
+ * `onClick={onLogOut}` keeps compiling everywhere.
  */
-export const useLogout = (): (() => void) => {
+export const useLogout = (target?: string): ((event?: MouseEvent) => void) => {
   const context = useContext() as unknown as ClientContext
+  const nav = useNavigate()
+  const path = surrogatePath(context as unknown as LoginContext, { intent: LoginIntent.Logout })
+
+  return useCallback((event?: MouseEvent) => {
+    event?.preventDefault()
+    const login = context.service<LoginService>(LOGIN_SERVICE)
+    void login.logout({
+      // An application whose entrypoint list predates the surrogate route logs out in place.
+      url: path ?? '',
+      ...(target != null ? { navigate: () => { nav.go(target) } } : {}),
+    })
+  }, [context, path, target])
+}
+
+/**
+ * For a component that runs its own post-login step (the marketing-consent screen, for one) to
+ * call once it is satisfied — moves the flow on to the next step, or the ordinary landing.
+ *
+ * Not async at the call site by accident of its own — it is a callback a component holds and
+ * fires later, so nothing here needs the synchronous-gesture discipline `useLogin`/`useLogout` do.
+ */
+export const useContinueLogin = (): ((opts?: LandOptions) => Promise<void>) => {
+  const context = useContext() as unknown as ClientContext
+  const nav = useNavigate()
 
-  return useCallback(() => {
-    void context.service<AuthService>(AUTH_ALIAS).update(undefined)
-      .then(() => { window.location.reload() })
-      .catch(console.error)
-  }, [context])
+  return useCallback(async (opts?: LandOptions) => {
+    const landing = await loginLandingOf(context as unknown as LoginContext).continueLogin(opts)
+    await nav.go(landing.alias, { params: landing.params, query: landing.query })
+  }, [context, nav])
 }

package/src/login/i18n/be.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Уваход",
+    "subtitle": "Абярыце спосаб уваходу.",
+    "busy": "Адкрываем акно ўваходу…",
+    "empty": "Для гэтай праграмы не наладжаны ніводзін спосаб уваходу.",
+    "method": {
+      "google": "Працягнуць з Google",
+      "oidc": "Працягнуць з {{provider}}",
+      "oidc-default": "Увайсці / Зарэгістравацца",
+      "oidc-client": "Працягнуць з {{provider}}",
+      "basic-ed25519": "Увайсці з ключом",
+      "pk-supervisor": "Сакрэтны ключ (аператар)",
+      "wallet-consumer": "Гаманец OwlMeans ID",
+      "one-time-token": "Увайсці па кодзе з ліста",
+      "fallback": "Працягнуць з {{method}}"
+    },
+    "terms": {
+      "accept": "Я прачытаў(-ла) і прымаю {{documents}}.",
+      "terms": "Умовы карыстання",
+      "privacy": "Палітыку прыватнасці",
+      "cookies": "Палітыку файлаў cookie",
+      "billing": "Умовы аплаты",
+      "product": "Умовы прадукту {{product}}",
+      "notice": "Як мы апрацоўваем вашы асабістыя дадзеныя: {{notices}}.",
+      "revised": "Апошняе абнаўленне: {{date}}",
+      "required": "Каб працягнуць, пацвердзіце {{documents}}."
+    },
+    "consent": {
+      "required": "Уваход захоўвае сеансавы файл cookie. Прыміце неабходныя файлы cookie, каб працягнуць."
+    },
+    "credit": {
+      "powered": "Працуе на OwlMeans"
+    },
+    "error": {
+      "failed": "Уваход не завершаны. Паспрабуйце яшчэ раз.",
+      "blocked": "Акно ўваходу заблакавана. Націсніце значок заблакаванага ўсплывальнага акна ў адрасным радку браўзера, каб адкрыць яго."
+    },
+    "orphaned": "Уваход выкананы. Можаце закрыць гэтае акно і вярнуцца ў праграму."
+  }
+}

package/src/login/i18n/de.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Anmelden",
+    "subtitle": "Wählen Sie, wie Sie fortfahren möchten.",
+    "busy": "Anmeldung wird geöffnet…",
+    "empty": "Für diese Anwendung ist keine Anmeldemethode konfiguriert.",
+    "method": {
+      "google": "Mit Google fortfahren",
+      "oidc": "Mit {{provider}} fortfahren",
+      "oidc-default": "Anmelden / Registrieren",
+      "oidc-client": "Mit {{provider}} fortfahren",
+      "basic-ed25519": "Mit einem Schlüssel anmelden",
+      "pk-supervisor": "Geheimer Schlüssel (Betreiber)",
+      "wallet-consumer": "OwlMeans-ID-Wallet",
+      "one-time-token": "Mit einem E-Mail-Code anmelden",
+      "fallback": "Mit {{method}} fortfahren"
+    },
+    "terms": {
+      "accept": "Ich habe {{documents}} gelesen und stimme ihnen zu.",
+      "terms": "Allgemeinen Geschäftsbedingungen",
+      "privacy": "Datenschutzerklärung",
+      "cookies": "Cookie-Richtlinie",
+      "billing": "Abrechnungsbedingungen",
+      "product": "{{product}}-Produktbedingungen",
+      "notice": "Wie wir Ihre personenbezogenen Daten verarbeiten: {{notices}}.",
+      "revised": "Zuletzt aktualisiert: {{date}}",
+      "required": "Bitte bestätigen Sie {{documents}}, um fortzufahren."
+    },
+    "consent": {
+      "required": "Bei der Anmeldung wird ein Sitzungs-Cookie gespeichert. Akzeptieren Sie die notwendigen Cookies, um fortzufahren."
+    },
+    "credit": {
+      "powered": "Betrieben mit OwlMeans"
+    },
+    "error": {
+      "failed": "Die Anmeldung wurde nicht abgeschlossen. Bitte versuchen Sie es erneut.",
+      "blocked": "Das Anmeldefenster wurde blockiert. Klicken Sie auf das Symbol für blockierte Pop-ups in der Adressleiste Ihres Browsers, um es zu öffnen."
+    },
+    "orphaned": "Angemeldet. Sie können dieses Fenster schließen und in der Anwendung fortfahren."
+  }
+}

package/src/login/i18n/en.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Sign in",
+    "subtitle": "Choose how you would like to continue.",
+    "busy": "Opening sign-in…",
+    "empty": "No sign-in method is configured for this application.",
+    "method": {
+      "google": "Continue with Google",
+      "oidc": "Continue with {{provider}}",
+      "oidc-default": "Sign in / Sign up",
+      "oidc-client": "Continue with {{provider}}",
+      "basic-ed25519": "Sign in with a key",
+      "pk-supervisor": "Secret key (operator)",
+      "wallet-consumer": "OwlMeans ID wallet",
+      "one-time-token": "Sign in with an email code",
+      "fallback": "Continue with {{method}}"
+    },
+    "terms": {
+      "accept": "I have read and agree to the {{documents}}.",
+      "terms": "Terms & Conditions",
+      "privacy": "Privacy Policy",
+      "cookies": "Cookie Policy",
+      "billing": "Billing Terms",
+      "product": "{{product}} Product Terms",
+      "notice": "How we handle your personal data: {{notices}}.",
+      "revised": "Last updated: {{date}}",
+      "required": "Please confirm the {{documents}} to continue."
+    },
+    "consent": {
+      "required": "Signing in stores a session cookie. Accept essential cookies to continue."
+    },
+    "credit": {
+      "powered": "Powered by OwlMeans"
+    },
+    "error": {
+      "failed": "Sign-in did not complete. Please try again.",
+      "blocked": "The sign-in window was blocked. Click the blocked pop-up icon in your browser's address bar to open it."
+    },
+    "orphaned": "Signed in. You can close this window and continue in the application."
+  }
+}

package/src/login/i18n/es.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Iniciar sesión",
+    "subtitle": "Elige cómo quieres continuar.",
+    "busy": "Abriendo el inicio de sesión…",
+    "empty": "No hay ningún método de inicio de sesión configurado para esta aplicación.",
+    "method": {
+      "google": "Continuar con Google",
+      "oidc": "Continuar con {{provider}}",
+      "oidc-default": "Iniciar sesión / Registrarse",
+      "oidc-client": "Continuar con {{provider}}",
+      "basic-ed25519": "Iniciar sesión con una clave",
+      "pk-supervisor": "Clave secreta (operador)",
+      "wallet-consumer": "Cartera OwlMeans ID",
+      "one-time-token": "Iniciar sesión con un código por correo",
+      "fallback": "Continuar con {{method}}"
+    },
+    "terms": {
+      "accept": "He leído y acepto {{documents}}.",
+      "terms": "Términos y Condiciones",
+      "privacy": "Política de Privacidad",
+      "cookies": "Política de Cookies",
+      "billing": "Condiciones de Facturación",
+      "product": "Condiciones del Producto {{product}}",
+      "notice": "Cómo tratamos tus datos personales: {{notices}}.",
+      "revised": "Última actualización: {{date}}",
+      "required": "Confirma {{documents}} para continuar."
+    },
+    "consent": {
+      "required": "Iniciar sesión guarda una cookie de sesión. Acepta las cookies esenciales para continuar."
+    },
+    "credit": {
+      "powered": "Con tecnología de OwlMeans"
+    },
+    "error": {
+      "failed": "El inicio de sesión no se completó. Inténtalo de nuevo.",
+      "blocked": "Se bloqueó la ventana de inicio de sesión. Haz clic en el icono de ventana emergente bloqueada en la barra de direcciones del navegador para abrirla."
+    },
+    "orphaned": "Sesión iniciada. Puedes cerrar esta ventana y continuar en la aplicación."
+  }
+}

package/src/login/i18n/fr.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Connexion",
+    "subtitle": "Choisissez comment continuer.",
+    "busy": "Ouverture de la connexion…",
+    "empty": "Aucune méthode de connexion n’est configurée pour cette application.",
+    "method": {
+      "google": "Continuer avec Google",
+      "oidc": "Continuer avec {{provider}}",
+      "oidc-default": "Connexion / Inscription",
+      "oidc-client": "Continuer avec {{provider}}",
+      "basic-ed25519": "Se connecter avec une clé",
+      "pk-supervisor": "Clé secrète (opérateur)",
+      "wallet-consumer": "Portefeuille d’identité OwlMeans",
+      "one-time-token": "Se connecter avec un code e-mail",
+      "fallback": "Continuer avec {{method}}"
+    },
+    "terms": {
+      "accept": "J’ai lu et j’accepte {{documents}}.",
+      "terms": "conditions générales",
+      "privacy": "politique de confidentialité",
+      "cookies": "Politique relative aux cookies",
+      "billing": "Conditions de facturation",
+      "product": "Conditions du produit {{product}}",
+      "notice": "Comment nous traitons vos données personnelles : {{notices}}.",
+      "revised": "Dernière mise à jour : {{date}}",
+      "required": "Confirmez {{documents}} pour continuer."
+    },
+    "consent": {
+      "required": "La connexion enregistre un cookie de session. Acceptez les cookies essentiels pour continuer."
+    },
+    "credit": {
+      "powered": "Propulsé par OwlMeans"
+    },
+    "error": {
+      "failed": "La connexion n’a pas abouti. Réessayez.",
+      "blocked": "La fenêtre de connexion a été bloquée. Cliquez sur l’icône de fenêtre contextuelle bloquée dans la barre d’adresse pour l’ouvrir."
+    },
+    "orphaned": "Vous êtes connecté. Vous pouvez fermer cette fenêtre et continuer dans l’application."
+  }
+}

package/src/login/i18n/pl.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Zaloguj się",
+    "subtitle": "Wybierz sposób, w jaki chcesz kontynuować.",
+    "busy": "Otwieranie logowania…",
+    "empty": "Dla tej aplikacji nie skonfigurowano żadnej metody logowania.",
+    "method": {
+      "google": "Kontynuuj z Google",
+      "oidc": "Kontynuuj z {{provider}}",
+      "oidc-default": "Zaloguj się / Zarejestruj się",
+      "oidc-client": "Kontynuuj z {{provider}}",
+      "basic-ed25519": "Zaloguj się kluczem",
+      "pk-supervisor": "Klucz tajny (operator)",
+      "wallet-consumer": "Portfel OwlMeans ID",
+      "one-time-token": "Zaloguj się kodem e-mail",
+      "fallback": "Kontynuuj z {{method}}"
+    },
+    "terms": {
+      "accept": "Przeczytałem(-am) i akceptuję {{documents}}.",
+      "terms": "Regulamin",
+      "privacy": "Politykę prywatności",
+      "cookies": "Politykę plików cookie",
+      "billing": "Warunki rozliczeń",
+      "product": "Warunki produktu {{product}}",
+      "notice": "Jak przetwarzamy Twoje dane osobowe: {{notices}}.",
+      "revised": "Ostatnia aktualizacja: {{date}}",
+      "required": "Aby kontynuować, potwierdź {{documents}}."
+    },
+    "consent": {
+      "required": "Logowanie zapisuje plik cookie sesji. Zaakceptuj niezbędne pliki cookie, aby kontynuować."
+    },
+    "credit": {
+      "powered": "Napędzane przez OwlMeans"
+    },
+    "error": {
+      "failed": "Logowanie nie zostało ukończone. Spróbuj ponownie.",
+      "blocked": "Okno logowania zostało zablokowane. Kliknij ikonę zablokowanego okienka w pasku adresu przeglądarki, aby je otworzyć."
+    },
+    "orphaned": "Zalogowano. Możesz zamknąć to okno i kontynuować w aplikacji."
+  }
+}

package/src/login/i18n/ru.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Вход",
+    "subtitle": "Выберите способ входа.",
+    "busy": "Открываем окно входа…",
+    "empty": "Для этого приложения не настроен ни один способ входа.",
+    "method": {
+      "google": "Продолжить с Google",
+      "oidc": "Продолжить с {{provider}}",
+      "oidc-default": "Войти / Зарегистрироваться",
+      "oidc-client": "Продолжить с {{provider}}",
+      "basic-ed25519": "Войти с ключом",
+      "pk-supervisor": "Секретный ключ (оператор)",
+      "wallet-consumer": "Кошелёк OwlMeans ID",
+      "one-time-token": "Войти по коду из письма",
+      "fallback": "Продолжить с {{method}}"
+    },
+    "terms": {
+      "accept": "Я прочитал(а) и принимаю {{documents}}.",
+      "terms": "Условия использования",
+      "privacy": "Политику конфиденциальности",
+      "cookies": "Политику файлов cookie",
+      "billing": "Условия оплаты",
+      "product": "Условия использования продукта {{product}}",
+      "notice": "Как мы обрабатываем ваши персональные данные: {{notices}}.",
+      "revised": "Последнее обновление: {{date}}",
+      "required": "Чтобы продолжить, подтвердите {{documents}}."
+    },
+    "consent": {
+      "required": "Вход сохраняет сессионный файл cookie. Примите необходимые файлы cookie, чтобы продолжить."
+    },
+    "credit": {
+      "powered": "Работает на OwlMeans"
+    },
+    "error": {
+      "failed": "Вход не завершён. Попробуйте ещё раз.",
+      "blocked": "Окно входа заблокировано. Нажмите на значок заблокированного всплывающего окна в адресной строке браузера, чтобы открыть его."
+    },
+    "orphaned": "Вход выполнен. Можете закрыть это окно и вернуться в приложение."
+  }
+}

package/src/login/i18n/uk.json

@@ -0,0 +1,41 @@
+{
+  "login": {
+    "title": "Вхід",
+    "subtitle": "Оберіть спосіб входу.",
+    "busy": "Відкриваємо вікно входу…",
+    "empty": "Для цього застосунку не налаштовано жодного способу входу.",
+    "method": {
+      "google": "Продовжити з Google",
+      "oidc": "Продовжити з {{provider}}",
+      "oidc-default": "Увійти / Зареєструватися",
+      "oidc-client": "Продовжити з {{provider}}",
+      "basic-ed25519": "Увійти з ключем",
+      "pk-supervisor": "Секретний ключ (оператор)",
+      "wallet-consumer": "Гаманець OwlMeans ID",
+      "one-time-token": "Увійти за кодом з листа",
+      "fallback": "Продовжити з {{method}}"
+    },
+    "terms": {
+      "accept": "Я прочитав(-ла) і приймаю {{documents}}.",
+      "terms": "Умови користування",
+      "privacy": "Політику конфіденційності",
+      "cookies": "Політику файлів cookie",
+      "billing": "Умови оплати",
+      "product": "Умови продукту {{product}}",
+      "notice": "Як ми обробляємо ваші персональні дані: {{notices}}.",
+      "revised": "Востаннє оновлено: {{date}}",
+      "required": "Щоб продовжити, підтвердьте {{documents}}."
+    },
+    "consent": {
+      "required": "Вхід зберігає сеансовий файл cookie. Прийміть необхідні файли cookie, щоб продовжити."
+    },
+    "credit": {
+      "powered": "Працює на OwlMeans"
+    },
+    "error": {
+      "failed": "Вхід не завершено. Спробуйте ще раз.",
+      "blocked": "Вікно входу заблоковано. Натисніть значок заблокованого спливаючого вікна в адресному рядку браузера, щоб відкрити його."
+    },
+    "orphaned": "Вхід виконано. Можете закрити це вікно й повернутися до застосунку."
+  }
+}