@things-factory/auth-base 10.1.188 → 10.1.198

package/tests/list-inheritance-db.test.ts

@@ -24,8 +24,6 @@ const { InvitationStatus } = loadCompiled('utils/invitation-state')
 const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
 const { Partner } = loadCompiled('service/partner/partner')
 const { PartnerQuery } = loadCompiled('service/partner/partner-query')
-const { LoginHistory } = loadCompiled('service/login-history/login-history')
-const { LoginHistoryQuery } = loadCompiled('service/login-history/login-history-query')
 
 let parent: any
 let child: any
@@ -119,11 +117,6 @@ const LISTS: [string, () => Promise<any>, (params: any, context: any) => Promise
     'partners',
     () => getRepository(Partner).save({ domain: parent, partnerDomain, requestedAt: new Date() }),
     (params, context) => new PartnerQuery().partners(params, context)
-  ],
-  [
-    'login histories',
-    () => LoginHistory.stamp(parent, parentUser, '10.0.0.1'),
-    (params, context) => new LoginHistoryQuery().loginHistories(params, context)
   ]
 ]
 

package/tests/mail-request-answers-db.test.ts

@@ -0,0 +1,139 @@
+const mockSentMail: any[] = []
+let mockMailFails = false
+
+jest.mock('@things-factory/email-base', () => ({
+  sendEmail: async (mail: any) => {
+    if (mockMailFails) throw new Error('smtp down')
+    mockSentMail.push(mail)
+  }
+}))
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { authPublicProcessRouter } = loadCompiled('router/auth-public-process-router')
+
+/**
+ * What the two "mail me" posts answer - forgot-password and resend-verification-email.
+ *
+ * Both set nothing when there was no account to mail, or when the mail did not go, so koa answered
+ * a bare 404 and the page showed "Not Found" - the same words for "no such address" and "the mail
+ * server is down". Now they give one answer whether or not the address has an account (another
+ * would tell anyone which addresses are registered), and fail only when a mail was due and did not
+ * go.
+ *
+ * The handler is taken from the router's own table, so the path is the one the page posts to.
+ */
+
+function handler(path: string) {
+  const layer = authPublicProcessRouter.stack.find((layer: any) => layer.path === path && layer.methods.includes('POST'))
+
+  return layer.stack[layer.stack.length - 1]
+}
+
+async function post(path: string, body: any) {
+  const context: any = {
+    t: (key: string) => key,
+    lng: 'en-US',
+    headers: {},
+    header: {},
+    request: { protocol: 'https', host: 'acme.example.com', body }
+  }
+
+  await handler(path)(context, async () => {})
+
+  return { status: context.status, body: context.body }
+}
+
+let domain: any
+
+async function person(email: string, status: string) {
+  const salt = User.generateSalt()
+
+  return await getRepository(User).save({
+    username: email.split('@')[0],
+    email,
+    name: 'Kim',
+    salt,
+    password: User.encode('Passw0rd!', salt),
+    status,
+    domains: [domain]
+  })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'plant-a', subdomain: 'plant-a' })
+  mockSentMail.length = 0
+  mockMailFails = false
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+describe('forgot-password', () => {
+  const PATH = '/auth/forgot-password'
+
+  it('mails a registered address', async () => {
+    await person('kim@example.com', 'activated')
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 200, body: 'text.password reset email sent' })
+    expect(mockSentMail.map(mail => mail.receiver)).toEqual(['kim@example.com'])
+  })
+
+  it('answers an unknown address the same way, and mails nobody', async () => {
+    await person('kim@example.com', 'activated')
+
+    expect(await post(PATH, { email: 'nobody@example.com' })).toEqual({ status: 200, body: 'text.password reset email sent' })
+    expect(mockSentMail).toEqual([])
+  })
+
+  it('says so when the mail does not go', async () => {
+    await person('kim@example.com', 'activated')
+    mockMailFails = true
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 503, body: 'error.mail could not be sent' })
+  })
+})
+
+describe('resend-verification-email', () => {
+  const PATH = '/auth/resend-verification-email'
+
+  it('mails an account waiting for confirmation', async () => {
+    await person('kim@example.com', 'inactive')
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 200, body: 'text.verification email sent' })
+    expect(mockSentMail.map(mail => mail.receiver)).toEqual(['kim@example.com'])
+  })
+
+  it.each([
+    ['an unknown address', 'nobody@example.com'],
+    ['an account already confirmed', 'lee@example.com']
+  ])('answers %s the same way, and mails nobody', async (_, email) => {
+    await person('lee@example.com', 'activated')
+
+    expect(await post(PATH, { email })).toEqual({ status: 200, body: 'text.verification email sent' })
+    expect(mockSentMail).toEqual([])
+  })
+
+  it('mails nobody for a post without an address', async () => {
+    /* ⚠ TypeORM drops an undefined condition - this matched the first account and mailed it. */
+    await person('kim@example.com', 'inactive')
+
+    expect(await post(PATH, {})).toEqual({ status: 200, body: 'text.verification email sent' })
+    expect(mockSentMail).toEqual([])
+  })
+
+  it('says so when the mail does not go', async () => {
+    await person('kim@example.com', 'inactive')
+    mockMailFails = true
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 503, body: 'error.mail could not be sent' })
+  })
+})

package/tests/open-doors.test.ts

@@ -80,7 +80,7 @@ describe('the doors that were closed', () => {
    *                                  signs in, so adding one is not an edit to a settings row
    *   domainUserRoleRegister         makes a domain, its roles and its users. `domainRegister`
    *                                  beside it makes only a domain and is super-user only
-   *   loginHistories                 everybody's sign-ins
+   *   loginHistories                 everybody's sign-ins - now the audit's, behind `audit:query` (ADR-0141)
    *   invitation / invitations       and neither of them scopes by tenant at all
    *   sendInvitation / cancelInvitation / inviteUser
    */
@@ -96,7 +96,7 @@ describe('the doors that were closed', () => {
       'cancelInvitation',
       'inviteUser'
     ],
-    Query: ['loginHistories', 'invitation', 'invitations']
+    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth', 'invitation', 'invitations']
   }
 
   it.each(Object.entries(CLOSED).flatMap(([t, fields]) => fields.map(f => [t, f])))('%s.%s', (typeName, field) => {

package/tests/refusal-cause.test.ts

@@ -64,7 +64,7 @@ describe('a refusal says which of the four it was', () => {
   it('★ an owner without the role, from an unsafe address: address - from a safe one they pass', async () => {
     given({ owner: true })
     expect(await judgePermission(OWNED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'address' })
-    expect(await judgePermission(OWNED, USER, DOMAIN, false)).toEqual({ permitted: true })
+    expect(await judgePermission(OWNED, USER, DOMAIN, false)).toEqual({ permitted: true, by: 'domain-owner' })
   })
 
   it('an unsafe address whose ownership cannot be asked still refuses as role - it refused before', async () => {

package/tests/role-task.test.ts

@@ -0,0 +1,168 @@
+/**
+ * Role tasks — the registry, what it refuses, and how a role is laid against tasks (ADR-0139 decision 11).
+ *
+ * The comparison is pure: a role's held privileges, the registered tasks, the declared privileges. The role screen
+ * draws exactly this, so what "all", "some", "none" and "broken" mean is pinned here.
+ */
+
+import { loadCompiled } from './compiled'
+
+const { registerRoleTask, roleTasks, roleTaskById, mergeGrants, taskCoverageOf, undeclaredTaskGrants } = loadCompiled('service/role-template/role-task')
+const { registerRoleTemplate, templateGrantsOf, templateDefinitionErrors, unknownTemplateGrants } = loadCompiled('service/role-template/role-template')
+
+const DECLARED = {
+  'board query': ['board', 'query'],
+  'board mutation': ['board', 'mutation'],
+  'order query': ['order', 'query'],
+  'worklist query': ['worklist', 'query'],
+  'worklist mutation': ['worklist', 'mutation']
+}
+
+beforeEach(() => {
+  ;(process as any)['ROLE_TASKS'] = {}
+  ;(process as any)['ROLE_TEMPLATES'] = {}
+  ;(process as any).PRIVILEGES = { ...DECLARED }
+})
+
+const held = (...pairs: string[]) => new Set(pairs.map(pair => pair.replace(':', ' ')))
+
+describe('declaring a task', () => {
+  it('can be found again by id', () => {
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+
+    expect(roleTaskById('board.reading')).toEqual({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+    expect(roleTasks()).toHaveLength(1)
+  })
+
+  it.each([['reading'], [''], ['.reading']])('refuses the id "%s" - the declaring module comes first', id => {
+    expect(() => registerRoleTask({ id, grants: [{ category: 'board', axes: ['query'] }] })).toThrow(/<module>.<work>/)
+  })
+
+  it('refuses a task that holds no privileges', () => {
+    expect(() => registerRoleTask({ id: 'board.nothing', grants: [] })).toThrow(/holds no privileges/)
+  })
+
+  it('refuses a grant with no axes - axes are listed one by one', () => {
+    expect(() => registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: [] }] })).toThrow(/one by one/)
+  })
+
+  it('refuses the same task declared twice - one piece of work is one task', () => {
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+
+    expect(() => registerRoleTask({ id: 'board.reading', grants: [{ category: 'order', axes: ['query'] }] })).toThrow(/declared twice/)
+  })
+
+  it('holds a privilege written twice once', () => {
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
+
+    expect(roleTaskById('board.reading').grants).toEqual([{ category: 'board', axes: ['query'] }])
+  })
+
+  it('★ lets two tasks share a privilege - that is not a duplicate', () => {
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
+
+    expect(roleTasks()).toHaveLength(2)
+  })
+
+  it('keeps a change-only grant as written - nothing adds query to it', () => {
+    registerRoleTask({ id: 'worklist.putting-up', grants: [{ category: 'worklist', axes: ['mutation'] }] })
+
+    expect(roleTaskById('worklist.putting-up').grants).toEqual([{ category: 'worklist', axes: ['mutation'] }])
+  })
+})
+
+describe('a template built from tasks', () => {
+  beforeEach(() => {
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
+  })
+
+  it('★ holds the union of its tasks and its own grants, each privilege once', () => {
+    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'order.reading'], grants: [{ category: 'board', axes: ['mutation', 'query'] }] })
+
+    expect(templateGrantsOf({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'order.reading'], grants: [{ category: 'board', axes: ['mutation', 'query'] }] })).toEqual([
+      { category: 'board', axes: ['query', 'mutation'] },
+      { category: 'order', axes: ['query'] }
+    ])
+  })
+
+  it('may be written with tasks and no grants', () => {
+    expect(() => registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading'] })).not.toThrow()
+  })
+
+  it('still refuses a template with neither - leaving both out is forgetting', () => {
+    expect(() => registerRoleTemplate({ id: 'plant.reader', name: 'READER' } as any)).toThrow(/has no grants/)
+  })
+
+  it('★ names an unregistered task as a definition error', () => {
+    expect(templateDefinitionErrors({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.writting'] })).toEqual(['task "board.writting" is not registered'])
+  })
+
+  it('★ names a task privilege this installation does not declare as a definition error', () => {
+    registerRoleTask({ id: 'board.exporting', grants: [{ category: 'board-export', axes: ['query'] }] })
+
+    expect(undeclaredTaskGrants(roleTaskById('board.exporting'))).toEqual(['board-export:query'])
+    expect(templateDefinitionErrors({ id: 'plant.reader', name: 'READER', tasks: ['board.exporting'] })).toEqual([
+      'task "board.exporting" names board-export:query, which this installation does not declare'
+    ])
+  })
+
+  it("keeps a template's own undeclared grants as before - skipped, not a definition error", () => {
+    const template = { id: 'plant.reader', name: 'READER', grants: [{ category: 'kpi', axes: ['query'] }] }
+
+    expect(templateDefinitionErrors(template)).toEqual([])
+    expect(unknownTemplateGrants(template)).toEqual(['kpi:query'])
+  })
+})
+
+describe('a role laid against the tasks', () => {
+  beforeEach(() => {
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTask({ id: 'board.keeping', grants: [{ category: 'board', axes: ['query', 'mutation'] }] })
+    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
+  })
+
+  const statuses = (coverage: any) => Object.fromEntries(coverage.tasks.map((task: any) => [task.taskId, task.status]))
+
+  it('★ says all, some and none by what the role holds of each task', () => {
+    const coverage = taskCoverageOf(held('board:query'))
+
+    expect(statuses(coverage)).toEqual({ 'board.reading': 'all', 'board.keeping': 'some', 'order.reading': 'some' })
+    expect(coverage.tasks.find((task: any) => task.taskId === 'board.keeping').missing).toEqual([{ category: 'board', axes: ['mutation'] }])
+  })
+
+  it('★ a shared privilege alone makes every task that names it "some" - reported, not supplied', () => {
+    const coverage = taskCoverageOf(held('board:query'))
+
+    expect(coverage.tasks.find((task: any) => task.taskId === 'order.reading')).toMatchObject({
+      status: 'some',
+      held: [{ category: 'board', axes: ['query'] }],
+      missing: [{ category: 'order', axes: ['query'] }]
+    })
+  })
+
+  it('says none for a role that holds nothing of a task', () => {
+    expect(statuses(taskCoverageOf(held('worklist:query')))).toEqual({ 'board.reading': 'none', 'board.keeping': 'none', 'order.reading': 'none' })
+  })
+
+  it('★ keeps what no task names apart - and leaves out what nothing declares any more', () => {
+    const coverage = taskCoverageOf(held('board:query', 'worklist:query', 'worklist:mutation', 'retired:query'))
+
+    expect(coverage.unclassified).toEqual([{ category: 'worklist', axes: ['mutation', 'query'] }])
+  })
+
+  it('★ says broken for a task naming an undeclared privilege, whatever the role holds', () => {
+    registerRoleTask({ id: 'board.exporting', grants: [{ category: 'board', axes: ['query'] }, { category: 'board-export', axes: ['query'] }] })
+
+    const task = taskCoverageOf(held('board:query')).tasks.find((one: any) => one.taskId === 'board.exporting')
+    expect(task).toMatchObject({ status: 'broken', module: 'board', undeclared: [{ category: 'board-export', axes: ['query'] }] })
+  })
+
+  it('merges grants by category in the order first written', () => {
+    expect(mergeGrants([[{ category: 'b', axes: ['x'] }], [{ category: 'a', axes: ['y'] }, { category: 'b', axes: ['z', 'x'] }]])).toEqual([
+      { category: 'b', axes: ['x', 'z'] },
+      { category: 'a', axes: ['y'] }
+    ])
+  })
+})

package/tests/role-template-gap-db.test.ts

@@ -16,9 +16,11 @@ const { User } = loadCompiled('service/user/user')
 const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
 const { RoleTemplateGapResolver } = loadCompiled('service/role-template/role-template-gap-resolver')
 const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
+const { registerRoleTask } = loadCompiled('service/role-template/role-task')
 
 const mutation = new RoleTemplateMutation()
-const gapOf = (role: any) => new RoleTemplateGapResolver().templateGap(role)
+const gapOf = (role: any, templateId?: string) => new RoleTemplateGapResolver().templateGap(role, templateId)
+const coverageOf = (role: any) => new RoleTemplateGapResolver().taskCoverage(role)
 
 let domain: any
 let actor: any
@@ -71,7 +73,9 @@ describe('the gap between a role and its template', () => {
       templateId: 'plant.qi',
       templateName: 'QUALITY-INSPECTOR',
       missing: [],
-      missingCount: 0
+      missingCount: 0,
+      extra: [],
+      extraCount: 0
     })
   })
 
@@ -120,6 +124,77 @@ describe('the gap between a role and its template', () => {
     ]
     await getRepository(Role).save(stored)
 
+    const gap = await gapOf(role)
+    expect(gap.missingCount).toBe(0)
+    /* Shown as wider than the template - not a fault, and nothing takes it away. */
+    expect(gap.extra).toEqual([{ category: 'board', axes: ['mutation'] }])
+    expect(gap.extraCount).toBe(1)
+  })
+
+  it('★ lays a role against a template the administrator picks, whatever the role is called', async () => {
+    declareTemplate(['query', 'mutation'])
+    const role = await getRepository(Role).save({ domain, name: '품질검사', privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' })] })
+
+    expect(await gapOf(role)).toBeNull()
+    expect(await gapOf(role, 'plant.qi')).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+  })
+
+  it('refuses a template id that does not exist rather than answering null', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    await expect(gapOf(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+  })
+})
+
+describe('a template built from tasks (ADR-0139 decision 11)', () => {
+  beforeEach(async () => {
+    ;(process as any)['ROLE_TASKS'] = {}
+    ;(process as any)['ROLE_TEMPLATES'] = {}
+    await getRepository(Privilege).save({ name: 'query', category: 'order' })
+    ;(process as any).PRIVILEGES['order query'] = ['order', 'query']
+    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
+  })
+
+  it('★ holds every privilege of every task once, plus its own grants', async () => {
+    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'order.reading'], grants: [{ category: 'board', axes: ['mutation'] }] })
+    const role = await mutation.createRoleFromTemplate('plant.reader', undefined, context())
+
+    const held = (await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })).privileges.map((p: any) => `${p.category}:${p.name}`).sort()
+    expect(held).toEqual(['board:mutation', 'board:query', 'order:query'])
     expect((await gapOf(role)).missingCount).toBe(0)
   })
+
+  it('★ is refused whole when a task is not registered - no role is made, no privilege added', async () => {
+    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.writting'] })
+
+    await expect(mutation.createRoleFromTemplate('plant.reader', undefined, context())).rejects.toThrow(/task "board.writting" is not registered/)
+    expect(await getRepository(Role).findOneBy({ name: 'READER' })).toBeNull()
+  })
+
+  it('★ is refused whole when a task names a privilege this installation does not declare', async () => {
+    registerRoleTask({ id: 'board.exporting', grants: [{ category: 'board-export', axes: ['query'] }] })
+    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.exporting'] })
+    const standing = await getRepository(Role).save({ domain, name: 'READER', privileges: [] })
+
+    await expect(mutation.createRoleFromTemplate('plant.reader', undefined, context())).rejects.toThrow(/board-export:query/)
+    expect((await getRepository(Role).findOne({ where: { id: standing.id }, relations: ['privileges'] })).privileges).toEqual([])
+  })
+
+  it('★ the role screen sees a role by task: all, some, none, and what no task names', async () => {
+    const role = await getRepository(Role).save({
+      domain,
+      name: '판독',
+      privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' }), await getRepository(Privilege).findOneBy({ category: 'board', name: 'mutation' })]
+    })
+
+    const coverage = await coverageOf(role)
+    expect(coverage.tasks.map((task: any) => [task.taskId, task.status])).toEqual([
+      ['board.reading', 'all'],
+      ['order.reading', 'some']
+    ])
+    expect(coverage.tasks[1].missing).toEqual([{ category: 'order', axes: ['query'] }])
+    expect(coverage.unclassified).toEqual([{ category: 'board', axes: ['mutation'] }])
+  })
 })

package/translations/en.json

@@ -7,6 +7,7 @@
   "error.email already exists": "email already used by another user",
   "error.failed to find x": "failed to find {x}",
   "error.invalid username": "invalid username: {username}",
+  "error.mail could not be sent": "the email could not be sent. try again in a moment.",
   "error.ownership required": "unauthorized! domain or system ownership required",
   "error.password should be supported": "initial password or default password should be supported",
   "error.password should match the rule": "password should match following rule. ${rule}",
@@ -211,7 +212,7 @@
   "text.invalid verification token": "invalid verification token",
   "text.invitation email sent": "invitation email sent",
   "text.password changed successfully": "password changed successfully",
-  "text.password reset email sent": "password reset email sent",
+  "text.password reset email sent": "if an account uses this address, a password reset email is on its way.",
   "text.password reset succeed": "password reset succeed",
   "text.pattern_atleast_1_digit": "at least 1 digit character",
   "text.pattern_atleast_1_lowercase": "at least 1 lowercase character",
@@ -226,7 +227,7 @@
   "text.user credential registered successfully": "device registration has been successfully completed. You can now use biometric authentication.",
   "text.user inactivated successfully": "user inactivated successfully",
   "text.user registered successfully": "user registered successfully. find your email to activate account",
-  "text.verification email sent": "verification email sent",
+  "text.verification email sent": "if an account at this address is waiting for confirmation, a verification email is on its way.",
   "privilege.description": "{name} {category}",
   "error.access-request-names-nothing": "an access request names a category and a privilege.",
   "error.access-request-unknown-privilege": "there is no privilege {privilege}.",
@@ -250,5 +251,17 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "write why you need it.",
   "error.access-request-same-reason-as-denied": "this was denied lately for the same reason ({reason}). write what has changed.",
-  "error.role-belongs-to-parent": "{roles}: a role of the parent domain. only someone who decides roles there can give or take it."
+  "error.role-belongs-to-parent": "{roles}: a role of the parent domain. only someone who decides roles there can give or take it.",
+  "task.auth-base.users-and-roles.name": "Keeping accounts and roles",
+  "task.auth-base.users-and-roles.description": "Reads and changes users, roles and who holds them, invitations, access requests, applications, devices and sign-in providers. Whoever holds this can give any role, to themselves as well.",
+  "task.auth-base.privilege-reading.name": "Reading the privilege list",
+  "task.auth-base.privilege-reading.description": "Reads the privileges roles are made of.",
+  "task.auth-base.security.name": "Keeping security settings",
+  "task.auth-base.security.description": "Reads and changes the domain's protected addresses and sign-in rules.",
+  "task.auth-base.env-vars.name": "Keeping environment variables",
+  "task.auth-base.env-vars.description": "Reads and changes the domain's environment variables.",
+  "privilege.category.audit": "audit log",
+  "privilege.allows.audit.query": "see everyone’s sign-ins, privilege use and refusals, and role changes",
+  "task.auth-base.audit-reading.name": "Reading the audit log",
+  "task.auth-base.audit-reading.description": "Reads everyone's sign-ins, privilege use and refusals, and role changes in the domain."
 }

package/translations/es.json

@@ -7,6 +7,7 @@
   "error.email already exists": "el correo electrónico ya lo usa otro usuario",
   "error.failed to find x": "no se encontró {x}",
   "error.invalid username": "nombre de usuario no válido: {username}",
+  "error.mail could not be sent": "no se pudo enviar el correo. vuelva a intentarlo en un momento.",
   "error.ownership required": "¡no autorizado! se requiere la propiedad del dominio o del sistema",
   "error.password should be supported": "se debe proporcionar una contraseña inicial o una contraseña predeterminada",
   "error.password should match the rule": "la contraseña debe cumplir la siguiente regla. ${rule}",
@@ -211,7 +212,7 @@
   "text.invalid verification token": "token de verificación no válido",
   "text.invitation email sent": "correo de invitación enviado",
   "text.password changed successfully": "contraseña cambiada correctamente",
-  "text.password reset email sent": "correo de restablecimiento de contraseña enviado",
+  "text.password reset email sent": "si hay una cuenta con esta dirección, le enviamos un correo de restablecimiento de contraseña.",
   "text.password reset succeed": "contraseña restablecida correctamente",
   "text.pattern_atleast_1_digit": "al menos 1 dígito",
   "text.pattern_atleast_1_lowercase": "al menos 1 letra minúscula",
@@ -226,7 +227,7 @@
   "text.user credential registered successfully": "el registro del dispositivo se ha completado correctamente. Ya puede usar la autenticación biométrica.",
   "text.user inactivated successfully": "usuario desactivado correctamente",
   "text.user registered successfully": "usuario registrado correctamente. busque el correo electrónico para activar la cuenta",
-  "text.verification email sent": "correo de verificación enviado",
+  "text.verification email sent": "si una cuenta con esta dirección espera confirmación, le enviamos un correo de verificación.",
   "privilege.description": "{name} de {category}",
   "error.access-request-names-nothing": "una solicitud de acceso indica una categoría y un privilegio.",
   "error.access-request-unknown-privilege": "no existe el privilegio {privilege}.",
@@ -250,5 +251,17 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "indique por qué lo necesita.",
   "error.access-request-same-reason-as-denied": "se rechazó hace poco por el mismo motivo ({reason}). indique qué ha cambiado.",
-  "error.role-belongs-to-parent": "{roles}: un rol del dominio principal. solo quien decide los roles allí puede concederlo o quitarlo."
+  "error.role-belongs-to-parent": "{roles}: un rol del dominio principal. solo quien decide los roles allí puede concederlo o quitarlo.",
+  "task.auth-base.users-and-roles.name": "Mantener cuentas y roles",
+  "task.auth-base.users-and-roles.description": "Lee y modifica usuarios, roles y quién los tiene, invitaciones, solicitudes de acceso, aplicaciones, dispositivos y proveedores de acceso. Quien lo tiene puede dar cualquier rol, también a sí mismo.",
+  "task.auth-base.privilege-reading.name": "Leer la lista de privilegios",
+  "task.auth-base.privilege-reading.description": "Lee los privilegios de los que se componen los roles.",
+  "task.auth-base.security.name": "Mantener la seguridad",
+  "task.auth-base.security.description": "Lee y modifica las direcciones protegidas y las reglas de acceso del dominio.",
+  "task.auth-base.env-vars.name": "Mantener variables de entorno",
+  "task.auth-base.env-vars.description": "Lee y modifica las variables de entorno del dominio.",
+  "privilege.category.audit": "registro de auditoría",
+  "privilege.allows.audit.query": "ver los inicios de sesión, el uso y rechazo de privilegios y los cambios de rol de todos",
+  "task.auth-base.audit-reading.name": "Consultar el registro de auditoría",
+  "task.auth-base.audit-reading.description": "Lee los inicios de sesión, el uso y rechazo de privilegios y los cambios de rol de todos en el dominio."
 }

package/translations/ja.json

@@ -7,6 +7,7 @@
   "error.email already exists": "メールはすでに他のユーザーによって使用されています.",
   "error.failed to find x": "{x}が見つかりません.",
   "error.invalid username": "無効なユーザー名: {username}",
+  "error.mail could not be sent": "メールを送れませんでした. しばらくしてからもう一度お試しください.",
   "error.ownership required": "権限がありません。$t(term.domain)またはシステムの所有者権限が必要です。",
   "error.password should be supported": "初期パスワードまたはデフォルトパスワードがサポートされるべきです",
   "error.password should match the rule": "パスワードは次の規則を守らなければなりません. {rule}",
@@ -51,7 +52,7 @@
   "text.invalid verification token": "確認トークンが無効です.",
   "text.invitation email sent": "招待メールを送りました.",
   "text.password changed successfully": "パスワードが正常に変更されました.",
-  "text.password reset email sent": "パスワード リセットメールを送りました.",
+  "text.password reset email sent": "登録済みのアドレスであれば、パスワード リセットメールを送りました.",
   "text.password reset succeed": "パスワードが正常にリセットされました.",
   "text.pattern_atleast_1_digit": "少なくとも1つの数字",
   "text.pattern_atleast_1_lowercase": "少なくとも１つの小文字",
@@ -66,7 +67,7 @@
   "text.user credential registered successfully": "デバイスの登録が正常に完了しました。今後は生体認証を使用できます。",
   "text.user inactivated successfully": "ユーザーが正常に非アクティブ化されました.",
   "text.user registered successfully": "ユーザーが正常に登録されました. 確認メールでアカウントを有効にしてください.",
-  "text.verification email sent": "確認メールを送りました.",
+  "text.verification email sent": "確認待ちのアカウントのアドレスであれば、確認メールを送りました.",
   "privilege.allows.accounting.mutation": "伝票を起票・修正・締めできます。",
   "privilege.allows.accounting.query": "伝票と勘定残高を閲覧できます。",
   "privilege.allows.activity-instance.mutation": "業務を開始・引き継ぎ・完了・中断できます。",
@@ -250,5 +251,17 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "必要な理由を書いてください。",
   "error.access-request-same-reason-as-denied": "同じ理由で最近拒否されました({reason})。何が変わったかを書いてください。",
-  "error.role-belongs-to-parent": "{roles}: 上位$t(term.domain)のロールです。その$t(term.domain)で権限を決める人だけが付与・解除できます。"
+  "error.role-belongs-to-parent": "{roles}: 上位$t(term.domain)のロールです。その$t(term.domain)で権限を決める人だけが付与・解除できます。",
+  "task.auth-base.users-and-roles.name": "アカウント・ロールの管理",
+  "task.auth-base.users-and-roles.description": "ユーザー・ロールとその付与・招待・アクセス申請・アプリ・機器・ログイン提供者を読み、変更する。自分にもどのロールでも付与できる。",
+  "task.auth-base.privilege-reading.name": "権限一覧の閲覧",
+  "task.auth-base.privilege-reading.description": "ロールを構成する権限の一覧を読む。",
+  "task.auth-base.security.name": "セキュリティ設定",
+  "task.auth-base.security.description": "ドメインの保護アドレスとログイン規則を読み、変更する。",
+  "task.auth-base.env-vars.name": "環境変数",
+  "task.auth-base.env-vars.description": "ドメインの環境変数を読み、変更する。",
+  "privilege.category.audit": "監査ログ",
+  "privilege.allows.audit.query": "全ユーザーのログイン、権限の使用と拒否、ロール変更の記録を見ることができます。",
+  "task.auth-base.audit-reading.name": "監査ログの閲覧",
+  "task.auth-base.audit-reading.description": "全ユーザーのログイン、権限の使用と拒否、ロール変更の記録を読む。"
 }

package/translations/ko.json

@@ -7,6 +7,7 @@
   "error.email already exists": "이메일이 이미 사용되고 있습니다.",
   "error.failed to find x": "{x}을(를) 찾을 수 없습니다.",
   "error.invalid username": "유효하지 않은 사용자 이름: {username}",
+  "error.mail could not be sent": "메일을 보내지 못했습니다. 잠시 후 다시 시도하십시오.",
   "error.ownership required": "권한이 없습니다. $t(term.domain) 또는 시스템 소유자 권한이 필요합니다.",
   "error.password should be supported": "초기 비밀번호나 디폴트 비밀번호가 제공되어야 합니다.",
   "error.password should match the rule": "비밀번호는 다음 규칙을 지켜야 합니다. {rule}",
@@ -211,7 +212,7 @@
   "text.invalid verification token": "확인 토큰이 유효하지 않습니다.",
   "text.invitation email sent": "초대 이메일을 보냈습니다.",
   "text.password changed successfully": "비밀번호가 성공적으로 변경되었습니다.",
-  "text.password reset email sent": "비밀번호 재설정 이메일을 보냈습니다.",
+  "text.password reset email sent": "가입된 주소라면 비밀번호 재설정 메일을 보냈습니다.",
   "text.password reset succeed": "비밀번호 성공적으로 재설정되었습니다.",
   "text.pattern_atleast_1_digit": "최소 1개 숫자",
   "text.pattern_atleast_1_lowercase": "최소 1개 소문자",
@@ -226,7 +227,7 @@
   "text.user credential registered successfully": "기기 등록이 성공적으로 완료되었습니다. 이제 바이오메트릭 인증을 사용할 수 있습니다.",
   "text.user inactivated successfully": "사용자가 성공적으로 비활성화되었습니다.",
   "text.user registered successfully": "사용자가 성공적으로 등록되었습니다. 확인 이메일을 통해서 계정을 활성화하시기 바랍니다.",
-  "text.verification email sent": "확인 이메일을 보냈습니다.",
+  "text.verification email sent": "확인을 기다리는 계정의 주소라면 확인 메일을 보냈습니다.",
   "privilege.description": "{category} {name}",
   "error.access-request-names-nothing": "권한 요청에는 범주와 권한이 있어야 합니다.",
   "error.access-request-unknown-privilege": "{privilege} 권한이 없습니다.",
@@ -250,5 +251,17 @@
   "access-request.notify.denied.body": "{privilege}: {reason}",
   "error.access-request-needs-reason": "필요한 사유를 입력해 주세요.",
   "error.access-request-same-reason-as-denied": "동일한 사유로 최근에 거부된 요청입니다({reason}). 다시 요청하려면 변경된 사항을 입력해 주세요.",
-  "error.role-belongs-to-parent": "{roles}: 상위 $t(term.domain)의 역할입니다. 그 $t(term.domain)에서 권한을 정하는 사람만 주거나 뺄 수 있습니다."
+  "error.role-belongs-to-parent": "{roles}: 상위 $t(term.domain)의 역할입니다. 그 $t(term.domain)에서 권한을 정하는 사람만 주거나 뺄 수 있습니다.",
+  "task.auth-base.users-and-roles.name": "계정·역할 관리",
+  "task.auth-base.users-and-roles.description": "사용자·역할과 역할 부여·초대·접근 요청·앱·기기·로그인 제공자를 읽고 바꾼다. 자기에게도 어떤 역할이든 줄 수 있다.",
+  "task.auth-base.privilege-reading.name": "권한 목록 열람",
+  "task.auth-base.privilege-reading.description": "역할을 이루는 권한 목록을 읽는다.",
+  "task.auth-base.security.name": "보안 설정",
+  "task.auth-base.security.description": "도메인의 보호 주소와 로그인 규칙을 읽고 바꾼다.",
+  "task.auth-base.env-vars.name": "환경 변수",
+  "task.auth-base.env-vars.description": "도메인의 환경 변수를 읽고 바꾼다.",
+  "privilege.category.audit": "감사 기록",
+  "privilege.allows.audit.query": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 볼 수 있습니다.",
+  "task.auth-base.audit-reading.name": "감사 기록 열람",
+  "task.auth-base.audit-reading.description": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 읽는다."
 }