@things-factory/auth-base 10.1.31 → 10.1.33

package/tests/role-inheritance-db.test.ts

@@ -0,0 +1,286 @@
+/**
+ * A role name that exists in this domain **and** in the one it inherits from.
+ *
+ * ── How the two rows come about ─────────────────────────────────────────────
+ * Roles are visible one level up: every read is scoped to `[domain.id, domain.parentId]`. The
+ * four duplicate checks in `role-mutation.ts` ask only about this domain, so a domain with a
+ * parent can be given a role whose name is already visible through it. Measured 2026-09-20:
+ * `createRole` accepts it, and both rows then come back from every list.
+ *
+ * ── What was settled, and when ──────────────────────────────────────────────
+ * ADR-0062 decision 3 (2026-09-20): the platform forbids it, and the operator may say otherwise.
+ * The name stays the same when they do — that is the point, because moving a domain off an
+ * inherited structure means standing up the same names here first (decision 2).
+ *
+ * Resolving the name was already deterministic before that, and had to be either way. `In([own, parent])`
+ * with no `ORDER BY` answered whichever the driver handed back first — the same call could
+ * answer the parent's role on one installation and this domain's on another, and a role is what
+ * a privilege check reads. So these cases pin **determinism and direction**, not the semantics.
+ *
+ * ⚠ sqlite (`tests/db.ts`). This harness cannot reproduce another driver's ordering, which is
+ * the point: the fix is to stop depending on ordering at all, and that is visible here as the
+ * parent's row never being the answer while this domain has one.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { RoleQuery } = loadCompiled('service/role/role-query')
+const { RoleMutation } = loadCompiled('service/role/role-mutation')
+const { User, UserStatus } = loadCompiled('service/user/user')
+
+const query = new RoleQuery()
+const mutation = new RoleMutation()
+
+let parent: any
+let child: any
+let orphan: any
+let actor: any
+
+function context(d: any) {
+  return {
+    state: { domain: d, user: actor, tx: undefined },
+    throw: (code: number, message: string) => {
+      const error: any = new Error(message)
+      error.status = code
+      throw error
+    }
+  } as any
+}
+
+/** `context.state.domain` carries `parentId`; the repository does not fill it in for us. */
+async function withParentId(domain: any, parentId: string | null) {
+  return { ...(await getRepository(Domain).findOneBy({ id: domain.id })), parentId }
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const p = await getRepository(Domain).save({ name: 'system', subdomain: 'system' })
+  const c = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme', parent: p })
+  const o = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta' })
+
+  parent = await withParentId(p, null)
+  child = await withParentId(c, p.id)
+  orphan = await withParentId(o, null)
+
+  actor = await getRepository(User).save({
+    username: 'operator@acme.z',
+    email: 'operator@acme.z',
+    name: 'operator',
+    status: UserStatus.ACTIVATED,
+    domains: [c]
+  })
+})
+
+/** 거절의 이름을 본다 — 영어 문장이 아니라 `code` 가 계약이다(ADR-0054). */
+async function refusalCodeOf(promise: Promise<unknown>): Promise<string> {
+  try {
+    await promise
+  } catch (error: any) {
+    return error?.code || error?.extensions?.refusal?.code || `not a refusal: ${error?.message}`
+  }
+
+  return 'nothing was thrown'
+}
+
+/** 거절이 싣고 온 값. 화면이 물음을 만드는 재료다. */
+async function refusalParamsOf(promise: Promise<unknown>): Promise<Record<string, any>> {
+  try {
+    await promise
+  } catch (error: any) {
+    return error?.params || error?.extensions?.refusal?.params || {}
+  }
+
+  return {}
+}
+
+async function roleIn(domain: any, name: string, description: string) {
+  return await getRepository(Role).save({ name, description, domain: { id: domain.id } })
+}
+
+describe('one role, no ambiguity', () => {
+  it('answers this domain own role', async () => {
+    await roleIn(child, 'approver', 'ours')
+
+    expect(await query.role('approver', context(child))).toMatchObject({ description: 'ours' })
+  })
+
+  it('answers a role that only the parent has', async () => {
+    /* Inheritance still works — this is the case the whole one-level scope exists for. */
+    await roleIn(parent, 'auditor', 'theirs')
+
+    expect(await query.role('auditor', context(child))).toMatchObject({ description: 'theirs' })
+  })
+
+  it('answers nothing for a name neither has', async () => {
+    expect(await query.role('nobody', context(child))).toBeNull()
+  })
+
+  it('does not reach a parent that is not ours', async () => {
+    /* A root domain inherits from nobody, and another tenant is not a parent. */
+    await roleIn(parent, 'auditor', 'theirs')
+
+    expect(await query.role('auditor', context(orphan))).toBeNull()
+  })
+})
+
+describe('the same name in both', () => {
+  it('is refused unless the operator says this domain stands its own', async () => {
+    /*
+     * ⚠ ADR-0062 decision 3, settled 2026-09-20. Until then the duplicate checks looked at this
+     * domain only and nothing refused a name already visible through the parent, so the two rows
+     * appeared silently.
+     *
+     * The refusal names the domain the other one stands in, because that is what the operator
+     * needs to decide — they may not have known the parent had it.
+     */
+    await roleIn(parent, 'approver', 'theirs')
+
+    expect(await refusalCodeOf(mutation.createRole({ name: 'approver' } as any, context(child)))).toEqual(
+      'role-name-stands-inherited'
+    )
+  })
+
+  it('names the domain the other one stands in', async () => {
+    /*
+     * ⚠ What makes the refusal answerable. The operator's next move is to decide whether this
+     * domain stands its own of that name, and they cannot decide without knowing where the other
+     * one is — they may not have known the parent had it. A refusal that only said "duplicated"
+     * would leave them guessing.
+     *
+     * The value rides in `params`, not in the sentence: the sentence is built in the reader's
+     * language and the screen puts its own question together from these (ADR-0054).
+     */
+    await roleIn(parent, 'approver', 'theirs')
+
+    expect(await refusalParamsOf(mutation.createRole({ name: 'approver' } as any, context(child)))).toMatchObject({
+      name: 'approver',
+      domain: 'system'
+    })
+  })
+
+  it('stands when the operator does say so, under the same name', async () => {
+    /*
+     * ⚠ The escape is not "call it something else". Standing up the same names here is the first
+     * step of moving a domain off an inherited structure (decision 2) — the child's role replaces
+     * what it inherits, and cutting the parent last leaves one name again. Requiring a different
+     * name would close that route.
+     */
+    await roleIn(parent, 'approver', 'theirs')
+
+    const created = await mutation.createRole(
+      { name: 'approver', description: 'ours', separately: true } as any,
+      context(child)
+    )
+
+    expect(created).toMatchObject({ name: 'approver', description: 'ours' })
+  })
+
+  it('refuses when the name stands in both, whatever the operator says', async () => {
+    /*
+     * ⚠ The state the migration of decision 2 passes through for its whole length: this domain's
+     * own role is standing beside the inherited one until the parent is cut, last. Trying to
+     * stand a second one during that window must be refused as `here` — there is already one
+     * here — and the operator's "stand it separately" must not reach it.
+     *
+     * It depends on the lookup asking this domain first. A single read over both domains with no
+     * ORDER BY can answer with the parent's row, and then the refusal is the inherited one,
+     * which `separately` is allowed to pass. That was the same defect this file already pins for
+     * `role(name)`, reintroduced in the checking path.
+     *
+     * ⚠ This case could not see that version of it. sqlite answered the combined query with this
+     * domain's row, so the outcome was right by accident — measured 2026-09-20 by putting the old
+     * shape back: 448 tests, none red. `role-name-lookup-sentinel.test.ts` reads the query before
+     * it is sent, which is where that shape is reachable from here. What this case does catch,
+     * now that the order is in our code rather than the driver's, is the order being wrong.
+     */
+    await roleIn(parent, 'approver', 'theirs')
+    await roleIn(child, 'approver', 'ours')
+
+    expect(
+      await refusalCodeOf(mutation.createRole({ name: 'approver', separately: true } as any, context(child)))
+    ).toEqual('role-name-taken-here')
+  })
+
+  it('refuses the same way whichever row was written first', async () => {
+    await roleIn(child, 'approver', 'ours')
+    await roleIn(parent, 'approver', 'theirs')
+
+    expect(
+      await refusalCodeOf(mutation.createRole({ name: 'approver', separately: true } as any, context(child)))
+    ).toEqual('role-name-taken-here')
+  })
+
+  it('refuses a name this domain already has, whatever the operator says', async () => {
+    /*
+     * ⚠ Not something to opt into. Two rows in one domain under one name would be
+     * indistinguishable in every respect — nothing for a screen to show, nothing to choose
+     * between.
+     */
+    await roleIn(child, 'approver', 'ours')
+
+    expect(
+      await refusalCodeOf(mutation.createRole({ name: 'approver', separately: true } as any, context(child)))
+    ).toEqual('role-name-taken-here')
+  })
+
+  it('leaves a name that stands only in some third domain alone', async () => {
+    /* Another tenant's naming does not reach us. */
+    await roleIn(orphan, 'approver', 'theirs')
+
+    const created = await mutation.createRole({ name: 'approver', description: 'ours' } as any, context(child))
+
+    expect(created).toMatchObject({ description: 'ours' })
+  })
+
+  it('answers this domain own, never the parent', async () => {
+    /*
+     * ⚠ The case the fix is for. Before it, both rows matched one `In([own, parent])` with no
+     * ORDER BY, so the answer was whichever row the driver handed back first.
+     */
+    await roleIn(parent, 'approver', 'theirs')
+    await roleIn(child, 'approver', 'ours')
+
+    expect(await query.role('approver', context(child))).toMatchObject({ description: 'ours' })
+  })
+
+  it('answers the same way whichever row was written first', async () => {
+    /* ⚠ Insertion order is the thing that must stop mattering. */
+    await roleIn(child, 'approver', 'ours')
+    await roleIn(parent, 'approver', 'theirs')
+
+    expect(await query.role('approver', context(child))).toMatchObject({ description: 'ours' })
+  })
+
+  it('leaves the parent domain reading its own', async () => {
+    /* Shadowing runs one way. The parent is not affected by what a child called something. */
+    await roleIn(parent, 'approver', 'theirs')
+    await roleIn(child, 'approver', 'ours')
+
+    expect(await query.role('approver', context(parent))).toMatchObject({ description: 'theirs' })
+  })
+
+  it('still shows both to a screen that lists them', async () => {
+    /*
+     * ⚠ Deliberate, and the reason the screen has to say where each came from. Resolving a name
+     * is not the same act as offering a list to choose from: hiding the parent's row here would
+     * silently drop a role somebody may still be assigned.
+     */
+    await roleIn(parent, 'approver', 'theirs')
+    await roleIn(child, 'approver', 'ours')
+
+    const offered = await query.userRoles(actor.id, context(child))
+
+    expect(offered.filter(role => role.name === 'approver')).toHaveLength(2)
+  })
+})

package/tests/role-mutation-db.test.ts

@@ -86,6 +86,20 @@ async function makeRole(name: string, domain: any, privileges: any[] = [], users
   return await getRepository(Role).save({ name, domain, privileges, users })
 }
 
+/**
+ * 거절의 이름을 본다. 영어 문장이 아니라 `code` 가 계약이다(ADR-0054) — 문장은 요청의 언어가
+ * 알려진 자리에서 만들어지므로, 문장을 시험에 박으면 번역이 붙는 날 같이 깨진다.
+ */
+async function refusalCodeOf(promise: Promise<unknown>): Promise<string> {
+  try {
+    await promise
+  } catch (error: any) {
+    return error?.code || error?.extensions?.refusal?.code || `not a refusal: ${error?.message}`
+  }
+
+  return 'nothing was thrown'
+}
+
 describe('고치기', () => {
   it('권한을 갈아 끼운다', async () => {
     const role = await makeRole('viewer', child, [boardQuery])
@@ -123,8 +137,8 @@ describe('고치기', () => {
     await makeRole('viewer', child)
     const role = await makeRole('editor', child)
 
-    await expect(mutation.updateRole(role.id, { name: 'viewer' } as any, context(child))).rejects.toThrow(
-      'role name is duplicated'
+    expect(await refusalCodeOf(mutation.updateRole(role.id, { name: 'viewer' } as any, context(child)))).toEqual(
+      'role-name-taken-here'
     )
   })
 })
@@ -235,9 +249,9 @@ describe('격자에서 여럿 저장', () => {
   it('같은 이름으로 만들려 하면 거절한다', async () => {
     await makeRole('operator', child)
 
-    await expect(
-      mutation.updateMultipleRole([{ cuFlag: '+', name: 'operator' }] as any, context(child))
-    ).rejects.toThrow('role name is duplicated')
+    expect(
+      await refusalCodeOf(mutation.updateMultipleRole([{ cuFlag: '+', name: 'operator' }] as any, context(child)))
+    ).toEqual('role-name-taken-here')
   })
 })
 
@@ -256,8 +270,8 @@ describe('만들기', () => {
   it('같은 도메인에 같은 이름은 안 만든다', async () => {
     await makeRole('operator', child)
 
-    await expect(mutation.createRole({ name: 'operator' } as any, context(child))).rejects.toThrow(
-      'role name is duplicated'
+    expect(await refusalCodeOf(mutation.createRole({ name: 'operator' } as any, context(child)))).toEqual(
+      'role-name-taken-here'
     )
   })
 })

package/tests/role-name-lookup-sentinel.test.ts

@@ -0,0 +1,79 @@
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { standingRoleQuery } = loadCompiled('utils/refuse-role-name')
+
+/**
+ * The read behind the inherited-name check asks **one domain at a time**.
+ *
+ * ── Why this reads what we send ─────────────────────────────────────────────
+ * The check has to ask this domain first and the parent only if it has nothing. One read over
+ * both with `In([own, parent])` has no `ORDER BY`, so when the name stands in both, the answer
+ * is whichever row the driver hands back — and if that is the parent's, the refusal is the
+ * inherited one, which the operator's "stand it separately" is allowed to pass. A second row of
+ * the name then stands in a domain that already has it: the state the whole rule exists to
+ * prevent, reached through the rule.
+ *
+ * ⚠ **This harness cannot fail on that.** sqlite returned this domain's row for the combined
+ * query, so the outcome was right by accident and every case in
+ * `role-inheritance-db.test.ts` stayed green with the defect in place — measured 2026-09-20 by
+ * putting the old shape back: 448 tests, none red.
+ *
+ * So this reads the query **before it is sent**, the way `domain-inheritance-sentinel.test.ts`
+ * does for the same reason. What we build is the same on every driver, and that is the only
+ * place this class of defect is reachable from here.
+ */
+
+const OWN = '00000000-0000-4000-8000-000000000002'
+const PARENT = '00000000-0000-4000-8000-000000000001'
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+function sent(domainId: string): { sql: string; parameters: any[] } {
+  const [sql, parameters] = standingRoleQuery(getRepository(Role), 'approver', domainId).getQueryAndParameters()
+
+  return { sql, parameters }
+}
+
+describe('the query the check sends', () => {
+  it('binds the one domain it was asked about', () => {
+    expect(sent(OWN).parameters).toContain(OWN)
+  })
+
+  it('never binds a second domain', () => {
+    /*
+     * ⚠ The assertion that holds the fix. `In([own, parent])` would put both ids in here, and
+     * from that moment which one answers is the driver's choice.
+     */
+    const { parameters } = sent(OWN)
+
+    expect(parameters.filter(parameter => parameter === PARENT)).toHaveLength(0)
+    expect(parameters.filter(parameter => typeof parameter === 'string' && parameter.startsWith('0000'))).toEqual([OWN])
+  })
+
+  it('compares the domain with one value, not a set', () => {
+    /* `IN (...)` in the text is the shape of asking about more than one domain at once. */
+    expect(sent(OWN).sql).not.toMatch(/ROLE_DOMAIN.*\bIN\b/i)
+  })
+
+  it('asks by name as well, bound rather than written in', () => {
+    /* A name is a value: written into the text it would be an injection and a cache miss. */
+    const { sql, parameters } = sent(OWN)
+
+    expect(parameters).toContain('approver')
+    expect(sql).not.toContain('approver')
+  })
+
+  it('is the same query for the parent, with the parent id', () => {
+    /* The fallback is the same read, not a second shape that could drift from this one. */
+    expect(sent(PARENT).parameters).toContain(PARENT)
+    expect(sent(PARENT).parameters.filter(parameter => parameter === OWN)).toHaveLength(0)
+  })
+})

package/tests/role-name-standing.test.ts

@@ -0,0 +1,83 @@
+import { nameStands, refusesName } from '../server/utils/role-name-standing'
+
+/**
+ * Whether a role may take a name that is already standing (ADR-0062 decision 3).
+ *
+ * The two directions cost different things. Letting an inherited name through silently leaves
+ * two rows answering to one name, which is what put an approval line in front of a role nobody
+ * looks at. Refusing too widely closes the migration path of decision 2 — stand the role up
+ * here, move the people to the role **of the same name**, cut the parent last — and then a
+ * domain cannot get off its inherited structure at all.
+ *
+ * So most of these are about the inherited case and about what the operator is allowed to say.
+ */
+
+const ROOT = { id: 'domain-root' }
+const CHILD = { id: 'domain-child', parentId: 'domain-root' }
+
+describe('where the name stands', () => {
+  it('nowhere, when nothing was found', () => {
+    expect(nameStands(null, CHILD)).toEqual('nowhere')
+    expect(nameStands(undefined, CHILD)).toEqual('nowhere')
+    expect(nameStands({}, CHILD)).toEqual('nowhere')
+  })
+
+  it('here, when this domain has it', () => {
+    expect(nameStands({ domainId: 'domain-child' }, CHILD)).toEqual('here')
+  })
+
+  it('inherited, when the parent has it', () => {
+    expect(nameStands({ domainId: 'domain-root' }, CHILD)).toEqual('inherited')
+  })
+
+  it('nowhere, when the row belongs to some third domain', () => {
+    /*
+     * ⚠ Another tenant's role is not this domain's business, and reading it as a collision would
+     * let one tenant's naming block another's.
+     */
+    expect(nameStands({ domainId: 'domain-other' }, CHILD)).toEqual('nowhere')
+  })
+
+  it('never says inherited for a domain with no parent', () => {
+    /* A root domain inherits from nobody, so `here` is the only collision it can have. */
+    expect(nameStands({ domainId: 'domain-root' }, ROOT)).toEqual('here')
+    expect(nameStands({ domainId: 'domain-child' }, ROOT)).toEqual('nowhere')
+  })
+
+  it('does not match an absent parent against an absent domain', () => {
+    /* ⚠ Two missing values are equal to each other, which would make every row inherited. */
+    expect(nameStands({ domainId: null }, { id: 'domain-child', parentId: null })).toEqual('nowhere')
+    expect(nameStands({ domainId: undefined }, CHILD)).toEqual('nowhere')
+  })
+})
+
+describe('whether it refuses', () => {
+  it('always, for a name this domain already has', () => {
+    /*
+     * ⚠ Not something to opt into. Two rows in one domain with one name would be
+     * indistinguishable in every respect — there is nothing for a screen to show and nothing for
+     * a person to choose between.
+     */
+    expect(refusesName('here')).toBe(true)
+    expect(refusesName('here', true)).toBe(true)
+  })
+
+  it('for an inherited name, unless the operator said this domain stands its own', () => {
+    expect(refusesName('inherited')).toBe(true)
+    expect(refusesName('inherited', false)).toBe(true)
+    expect(refusesName('inherited', true)).toBe(false)
+  })
+
+  it('not at all when the name is free', () => {
+    expect(refusesName('nowhere')).toBe(false)
+    expect(refusesName('nowhere', true)).toBe(false)
+  })
+
+  it('treats a missing answer as not said', () => {
+    /*
+     * ⚠ The default has to be refuse. Standing a second role of an inherited name is the
+     * deliberate act; a caller that says nothing has not made it.
+     */
+    expect(refusesName('inherited', undefined)).toBe(true)
+  })
+})

package/tests/token-issuance.test.ts

@@ -113,9 +113,13 @@ describe('어플라이언스 토큰 (Appliance.generateAccessToken)', () => {
 describe('애플리케이션 토큰 (Application)', () => {
   const SCOPES = ['reader', 'approver']
 
+  /* 서명이 받는 것은 이름을 가진 객체다. 맨 문자열을 받던 시절에는 같은 자리에 appSecret 을
+     넣어도 아무 표시가 없었다 — `Application.sign` 의 주석. */
+  const CLIENT = { appKey: 'APPKEY' }
+
   it('access token 은 30일, refresh token 은 1년이다', () => {
-    const access = decode(Application.generateAccessToken(DOMAIN, { id: 'appuser-1' }, 'APPKEY', SCOPES))
-    const refresh = decode(Application.generateRefreshToken(DOMAIN, { id: 'appuser-1' }, 'APPKEY', SCOPES))
+    const access = decode(Application.generateAccessToken(DOMAIN, { id: 'appuser-1' }, CLIENT, SCOPES))
+    const refresh = decode(Application.generateRefreshToken(DOMAIN, { id: 'appuser-1' }, CLIENT, SCOPES))
 
     expect(lifetime(access.payload)).toBe(30 * DAY)
     expect(lifetime(refresh.payload)).toBe(YEAR)
@@ -127,7 +131,7 @@ describe('애플리케이션 토큰 (Application)', () => {
     /* `oauth2-server.ts:131` 이 `roles: scopes` 로 저장하고 `:240` 이 `name: In(scopes)` 로
        역할을 찾는다. 즉 scope 어휘가 따로 없고 역할 이름이 곧 scope 다 — 역할 이름을 바꾸면
        이미 발급된 토큰의 scope 가 조용히 뜻을 잃는다. */
-    const { payload } = decode(Application.generateAccessToken(DOMAIN, { id: 'appuser-1' }, 'APPKEY', SCOPES))
+    const { payload } = decode(Application.generateAccessToken(DOMAIN, { id: 'appuser-1' }, CLIENT, SCOPES))
 
     expect(payload).toMatchObject({
       userType: 'application',

package/translations/en.json

@@ -11,6 +11,8 @@
   "error.password should be supported": "initial password or default password should be supported",
   "error.password should match the rule": "password should match following rule. ${rule}",
   "error.password used in the past": "password used in the past",
+  "error.role-name-stands-inherited": "a role called {name} is already visible here, defined in {domain}. stand this domain's own of that name only if that is what you mean to do.",
+  "error.role-name-taken-here": "this domain already has a role called {name}.",
   "error.subdomain not found": "domain not found",
   "error.token or password is invalid": "token or password is invalid",
   "error.unavailable-domain": "unavailable domain",

package/translations/ja.json

@@ -11,6 +11,8 @@
   "error.password should be supported": "初期パスワードまたはデフォルトパスワードがサポートされるべきです",
   "error.password should match the rule": "パスワードは次の規則を守らなければなりません. {rule}",
   "error.password used in the past": "過去に使用されたパスワードです.",
+  "error.role-name-stands-inherited": "{name} ロールは {domain} に定義されており、ここからも見えています。このドメインに同じ名前で別に立てるつもりの場合のみ作成します。",
+  "error.role-name-taken-here": "このドメインには既に {name} ロールがあります。",
   "error.subdomain not found": "サブドメインが見つかりません.",
   "error.token or password is invalid": "トークンまたはパスワードが無効です.",
   "error.unavailable-domain": "使用できないドメインです.",

package/translations/ko.json

@@ -11,6 +11,8 @@
   "error.password should be supported": "초기 비밀번호나 디폴트 비밀번호가 제공되어야 합니다.",
   "error.password should match the rule": "비밀번호는 다음 규칙을 지켜야 합니다. {rule}",
   "error.password used in the past": "과거에 사용된 비밀번호입니다.",
+  "error.role-name-stands-inherited": "{name} 역할이 {domain} 에 정의되어 여기에서도 보입니다. 이 도메인에 같은 이름으로 따로 세우려는 것이 맞을 때만 세웁니다.",
+  "error.role-name-taken-here": "이 도메인에 이미 {name} 역할이 있습니다.",
   "error.subdomain not found": "서브도메인을 찾을 수 없습니다.",
   "error.token or password is invalid": "토큰 또는 비밀번호가 유효하지 않습니다.",
   "error.unavailable-domain": "사용할 수 없는 도메인입니다.",

package/translations/ms.json

@@ -11,6 +11,8 @@
   "error.password should be supported": "kata laluan awal atau kata laluan lalai harus disokong",
   "error.password should match the rule": "Kata laluan harus mematuhi peraturan berikut. ${rule}",
   "error.password used in the past": "Kata laluan telah digunakan dalam masa lampau",
+  "error.role-name-stands-inherited": "peranan bernama {name} ditakrifkan dalam {domain} dan kelihatan di sini juga. Bina milik domain ini dengan nama yang sama hanya jika itu memang yang dimaksudkan.",
+  "error.role-name-taken-here": "domain ini sudah mempunyai peranan bernama {name}.",
   "error.subdomain not found": "Domain tidak ditemui",
   "error.token or password is invalid": "Token atau kata laluan tidak sah",
   "error.unavailable-domain": "Domain tidak tersedia",

package/translations/zh.json

@@ -11,6 +11,8 @@
   "error.password should be supported": "应支持初始密码或默认密码",
   "error.password should match the rule": "密码应符合以下规则。${rule}",
   "error.password used in the past": "使用过的密码！",
+  "error.role-name-stands-inherited": "名为 {name} 的角色定义在 {domain}，在此处也可见。只有确实要在该域中另行建立同名角色时才创建。",
+  "error.role-name-taken-here": "该域中已有名为 {name} 的角色。",
   "error.subdomain not found": "用户域查询失败！",
   "error.token or password is invalid": "令牌或密码无效！",
   "error.unavailable-domain": "不可用的域名",