@things-factory/auth-base 10.1.34 → 10.1.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.34",
+  "version": "10.1.38",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -34,9 +34,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.34",
+    "@things-factory/email-base": "^10.1.38",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.34",
+    "@things-factory/shell": "^10.1.38",
     "@things-factory/utils": "^10.1.20",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "5e16fd9f0cbb71c8d395b58a95bd9e99c93975c7"
+  "gitHead": "b947349fe1c27d11038b592ceadaba336f14785b"
 }

package/tests/app-binding-db.test.ts

@@ -160,3 +160,51 @@ describe('the list', () => {
     expect(items).toHaveLength(1)
   })
 })
+
+describe('the free-text term', () => {
+  /*
+   * The screen now sends the term itself (`ListParam.search`) and lets the server say where it
+   * looks. This door builds with the older `buildQuery`, which only understood search *filters* -
+   * so a term that arrived here was dropped, and the whole list came back as if it were the answer.
+   * A person searching for a binding's name read that as "not here".
+   */
+  it('narrows the list to the bindings that match', async () => {
+    await makeUser(ours, 'erp-bridge', 'application')
+    await makeUser(ours, 'label-printer', 'application')
+    await makeUser(ours, 'erp-archive', 'application')
+
+    const { items, total } = await query.appBindings({ search: 'erp' } as any, context(ours))
+
+    expect(items.map((one: any) => one.username).sort()).toEqual(['erp-archive', 'erp-bridge'])
+    expect(total).toBe(2)
+  })
+
+  it('looks in the email too', async () => {
+    await makeUser(ours, 'scanner-1', 'application')
+    await makeUser(ours, 'scanner-2', 'application')
+
+    const { items } = await query.appBindings({ search: 'scanner-2@example' } as any, context(ours))
+
+    expect(items.map((one: any) => one.username)).toEqual(['scanner-2'])
+  })
+
+  it('still answers only for this domain when a term is given', async () => {
+    /* A term must not widen the tenant: the OR of the search sits inside the domain condition. */
+    await makeUser(ours, 'erp-ours', 'application')
+    await makeUser(theirs, 'erp-theirs', 'application')
+
+    const { items } = await query.appBindings({ search: 'erp' } as any, context(ours))
+
+    expect(items.map((one: any) => one.username)).toEqual(['erp-ours'])
+  })
+
+  it('an empty term is no term', async () => {
+    await makeUser(ours, 'app-one', 'application')
+    await makeUser(ours, 'app-two', 'application')
+
+    const { total } = await query.appBindings({ search: '   ' } as any, context(ours))
+
+    expect(total).toBe(2)
+  })
+})
+

package/tests/domain-required.test.ts

@@ -0,0 +1,127 @@
+import { decideDomainRedirect, DOMAIN_REDIRECT_WINDOW_MS, domainRequiredTarget } from '../client/domain-required'
+
+/**
+ * Where a screen that came up before the shell settled on a domain is sent.
+ *
+ * Every query on such a screen answers 403, and "try again" answers 403 again, forever. The shell
+ * sends the reader to check-in - the same place the server already sends an HTML request - and
+ * never from check-in or sign-in themselves, where it would go round in a circle.
+ */
+
+describe('domainRequiredTarget', () => {
+  test('a screen without a domain segment goes to check-in, carrying where it was', () => {
+    const target = new URL(domainRequiredTarget('http://localhost:4000/activity-catalog')!)
+
+    expect(target.pathname).toBe('/auth/checkin')
+    expect(target.searchParams.get('redirect_to')).toBe('http://localhost:4000/activity-catalog')
+  })
+
+  test('a screen on a domain the reader may not enter also goes to check-in - the server names why', () => {
+    const target = new URL(domainRequiredTarget('http://localhost:4000/domain/other/activity-catalog')!)
+
+    expect(target.pathname).toBe('/auth/checkin')
+    expect(target.searchParams.get('redirect_to')).toBe('http://localhost:4000/domain/other/activity-catalog')
+  })
+
+  test('the query string and hash of the screen survive the round trip', () => {
+    const from = 'http://localhost:4000/activity-detail?name=MES%20Disposition%20Approval#line'
+    const target = new URL(domainRequiredTarget(from)!)
+
+    expect(target.searchParams.get('redirect_to')).toBe(from)
+  })
+
+  test('it stays on the same origin', () => {
+    expect(new URL(domainRequiredTarget('https://plant.example.com/x')!).origin).toBe('https://plant.example.com')
+  })
+
+  test('check-in itself is never sent to check-in', () => {
+    expect(domainRequiredTarget('http://localhost:4000/auth/checkin?redirect_to=%2F')).toBeNull()
+  })
+
+  test('sign-in and the other auth screens are left alone', () => {
+    expect(domainRequiredTarget('http://localhost:4000/auth/signin')).toBeNull()
+    expect(domainRequiredTarget('http://localhost:4000/auth')).toBeNull()
+  })
+
+  test('a path that only starts with the letters auth is not an auth screen', () => {
+    expect(domainRequiredTarget('http://localhost:4000/authority-list')).not.toBeNull()
+  })
+
+  test('something that is not an address is not guessed at', () => {
+    expect(domainRequiredTarget('')).toBeNull()
+    expect(domainRequiredTarget('not a url')).toBeNull()
+  })
+
+  /*
+   * A 403 is not only "no domain". The shell also answers 403 to an address on the site's IP block list
+   * (shell/server/middlewares/domain-middleware.ts). That reader has a domain; check-in sends them
+   * straight back and the screen gets 403 again. Without this guard the tab goes round forever.
+   */
+  describe('after one round trip it stops', () => {
+    const now = 1_000_000_000
+    const here = 'http://localhost:4000/domain/miratek/activity-catalog'
+
+    test('sent a moment ago: not sent again, whatever the reason for the 403', () => {
+      expect(domainRequiredTarget(here, now - 2_000, now)).toBeNull()
+    })
+
+    test('it is the time that counts, not the address - the server changed the address on the way back', () => {
+      expect(domainRequiredTarget('http://localhost:4000/activity-catalog', now - 2_000, now)).toBeNull()
+      expect(domainRequiredTarget(here, now - 2_000, now)).toBeNull()
+    })
+
+    test('once the window has passed, a new 403 is a new case and is sent', () => {
+      expect(domainRequiredTarget(here, now - DOMAIN_REDIRECT_WINDOW_MS, now)).not.toBeNull()
+    })
+
+    test('never sent before: sent', () => {
+      expect(domainRequiredTarget(here, null, now)).not.toBeNull()
+      expect(domainRequiredTarget(here, undefined, now)).not.toBeNull()
+    })
+
+    test('a stamp from the future (a clock that moved back) does not block for ever', () => {
+      expect(domainRequiredTarget(here, now + 60_000, now)).not.toBeNull()
+    })
+  })
+
+  /*
+   * The stamp is the only thing that knows "we just came back". A browser that blocks storage would lose it,
+   * and a reader on the IP block list would go round again. So storage that does not work means: do not send.
+   */
+  describe('decideDomainRedirect - the stamp must work or nothing is sent', () => {
+    const now = 1_000_000_000
+    const here = 'http://localhost:4000/activity-catalog'
+    const store = (saved: string | null = null) => {
+      const box = { value: saved, written: [] as string[] }
+      return { box, stamp: { read: () => box.value, write: (v: string) => { box.written.push(v); box.value = v } } }
+    }
+
+    test('first time: sent, and the stamp is written before leaving', () => {
+      const { box, stamp } = store()
+      expect(decideDomainRedirect(here, stamp, now)).not.toBeNull()
+      expect(box.written).toEqual([String(now)])
+    })
+
+    test('just came back: not sent, and the stamp is left as it was', () => {
+      const { box, stamp } = store(String(now - 2_000))
+      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
+      expect(box.written).toEqual([])
+    })
+
+    test('storage that cannot be read: not sent', () => {
+      const stamp = { read: () => { throw new Error('blocked') }, write: () => {} }
+      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
+    })
+
+    test('storage that cannot be written: not sent - a trip we cannot remember could loop', () => {
+      const stamp = { read: () => null, write: () => { throw new Error('quota') } }
+      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
+    })
+
+    test('a stamp that is not a number is treated as none, and the trip goes ahead', () => {
+      const { stamp } = store('garbage')
+      expect(decideDomainRedirect(here, stamp, now)).not.toBeNull()
+    })
+  })
+})
+

package/tests/invitation-route.test.ts

@@ -0,0 +1,97 @@
+import { readFileSync, readdirSync } from 'fs'
+import { join } from 'path'
+
+import { loadCompiled } from './compiled'
+
+const { authPublicProcessRouter } = loadCompiled('router/auth-public-process-router')
+const { ACCEPT_INVITATION_PATH } = loadCompiled('controllers/invitation')
+
+/**
+ * The link in each mail lands on a route that exists.
+ *
+ * ── Why this file exists ────────────────────────────────────────────────────
+ * The invitation mail pointed at `/auth/accept/<token>` — a path with no route anywhere — so the
+ * invitee fell through to the private history fallback and the domain gate turned them away for
+ * not being a member yet. That was found and fixed on 2026-09-20, and the fix made the same
+ * mistake again: the new route was declared as `/accept-invitation` on a router whose prefix is
+ * `/auth`, and the mail and the page both used `/accept-invitation`. It shipped that way.
+ *
+ * Every test of the invitation called the controller directly, so none of them ever went through
+ * a route. This one reads the router's own table — the paths koa-router resolved, prefix included
+ * — and holds each mail's link against it.
+ */
+
+type Layer = { path: string; methods: string[] }
+
+const layers: Layer[] = authPublicProcessRouter.stack.map((layer: any) => ({
+  path: layer.path,
+  methods: layer.methods
+}))
+
+function answers(method: string, path: string): boolean {
+  return layers.some(layer => layer.methods.includes(method) && matches(layer.path, path))
+}
+
+/** A declared path against a concrete one: `:param` matches one segment. */
+function matches(declared: string, actual: string): boolean {
+  const a = declared.split('/')
+  const b = actual.split('/')
+
+  return a.length === b.length && a.every((part, i) => part.startsWith(':') || part === b[i])
+}
+
+describe('the invitation link', () => {
+  it('the page answers where the mail points', () => {
+    /* ⚠ The case that shipped broken. */
+    expect(answers('GET', ACCEPT_INVITATION_PATH)).toBe(true)
+  })
+
+  it('the page posts where the router listens', () => {
+    expect(answers('POST', ACCEPT_INVITATION_PATH)).toBe(true)
+  })
+
+  it('carries the prefix the router adds', () => {
+    /*
+     * Declaring `/accept-invitation` on this router makes it `/auth/accept-invitation`. The spelling
+     * without the prefix is exactly the one that went out, so it is named here as the wrong one.
+     */
+    expect(ACCEPT_INVITATION_PATH.startsWith('/auth/')).toBe(true)
+    expect(answers('GET', '/accept-invitation')).toBe(false)
+  })
+
+  it('is the path the client page uses too', () => {
+    const page = readFileSync(
+      join(__dirname, '..', '..', 'auth-ui', 'client', 'components', 'accept-invitation.ts'),
+      'utf-8'
+    )
+
+    expect(page).toContain(`return '${ACCEPT_INVITATION_PATH}'`)
+  })
+})
+
+describe('the other links sent by mail', () => {
+  /*
+   * Same class, older links. Each controller builds its URL from a literal; every literal has to be
+   * a route this router answers. Read from the source because they are not exported — the point is
+   * that the link and the route are two spellings of one thing and nothing else ties them.
+   */
+  const CONTROLLERS = join(__dirname, '..', 'server', 'controllers')
+
+  const linked = readdirSync(CONTROLLERS)
+    .filter(file => file.endsWith('.ts'))
+    .flatMap(file =>
+      [...readFileSync(join(CONTROLLERS, file), 'utf-8').matchAll(/new URL\(`(\/auth\/[^`?$]*)/g)].map(m => ({
+        file,
+        path: m[1].replace(/\/$/, '/:token')
+      }))
+    )
+
+  it('finds the links it means to check', () => {
+    /* A scan that matches nothing passes whatever the links say. */
+    expect(linked.map(l => l.file).sort()).toEqual(['reset-password.ts', 'unlock-user.ts', 'verification.ts'])
+  })
+
+  it.each(linked.map(l => [l.file, l.path]))('%s → %s', (_file, path) => {
+    expect(answers('GET', path)).toBe(true)
+  })
+})

package/tests/open-doors.test.ts

@@ -30,27 +30,18 @@ import { loadCompiled } from './compiled'
 const { schema: declared } = loadCompiled('service/index')
 const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
 
-/**
- * Open on purpose. Each of these answers about the caller, or about the installation rather
- * than about anybody's data.
+/*
+ * Open on purpose — read from the module's own declaration (`server/service/open-fields.ts`), which is
+ * also what the directive enforces against. It used to be a copy kept here, and two copies of one
+ * list are two lists.
  */
-const OPEN_BY_DECISION: Record<string, Record<string, string>> = {
-  Query: {
-    /* The caller's own. */
-    myLoginHistories: 'the caller\'s own sign-ins',
-    myRoles: 'the caller\'s own roles',
-    hasPrivilege: 'whether the caller has one — a gate here would need the answer to itself',
-    domainsWithPrivilege: 'the domains where the caller has one',
-    checkUserBelongsDomain: 'whether the caller belongs to this domain',
-    checkResettablePasswordToDefault: 'about the caller\'s own password',
-    checkDefaultPassword: 'whether the caller is still on the default password',
-
-    /* Neither tenant data nor about a person. */
-    passwordRule:
-      'the installation\'s password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none',
-    authProviderTypes: 'which provider types this build supports. A catalogue, not a tenant\'s configuration'
-  },
-  Mutation: {}
+const { openFields: declaration } = loadCompiled('service/open-fields')
+
+const OPEN_BY_DECISION: Record<string, Record<string, string>> = { Query: {}, Mutation: {} }
+
+for (const [where, reason] of Object.entries(declaration.byDesign as Record<string, string>)) {
+  const [typeName, field] = where.split('.')
+  OPEN_BY_DECISION[typeName][field] = reason
 }
 
 let schema: GraphQLSchema
@@ -58,7 +49,8 @@ let schema: GraphQLSchema
 beforeAll(async () => {
   schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
 
-  privilegeDirectiveResolver(schema)
+  /* No modules: this file measures what is open, not what would be refused. */
+  privilegeDirectiveResolver(schema, { modules: [] })
 })
 
 function openFields(typeName: 'Query' | 'Mutation'): string[] {

package/tests/open-fields-enforcement.test.ts

@@ -0,0 +1,215 @@
+import { buildSchema } from 'type-graphql'
+import { graphql, GraphQLSchema } from 'graphql'
+import { makeExecutableSchema } from '@graphql-tools/schema'
+
+import { loadCompiled } from './compiled'
+
+const { schema: declared } = loadCompiled('service/index')
+const { privilegeDirectiveResolver, privilegeDirectiveTypeDefs } = loadCompiled('service/privilege/privilege-directive')
+const { coverageOf, judgeUndeclared } = loadCompiled('service/privilege/open-field-rule')
+
+/**
+ * A field that declares no `@privilege` and that its module does not list — what happens to it
+ * (`docs/design/auth-rebuild.md` §8 step 1; question sheet Q1 · Q2 · Q5).
+ *
+ * ── The four answers ────────────────────────────────────────────────────────
+ *   byDesign          open, and the module says why
+ *   notYetDeclared    open, and on the module's list to close
+ *   unlisted          the module opted in and says nothing: boot refuses in development, the field
+ *                     refuses in production
+ *   not opted in      the module declared no lists at all: exactly as before
+ *
+ * The last one is deliberate. The four products serve resolvers of their own from another
+ * repository, and enforcing on them the day this lands would stop all four from booting.
+ *
+ * These build auth-base's real schema from the `resolverClasses` the server boots from, and vary
+ * only the module's declaration — so what is tested is the directive against real fields, not
+ * against a model of them.
+ */
+
+const MODULE = 'auth-base'
+const REAL = declared.openFields
+
+function modules(openFields: any) {
+  return [{ name: MODULE, schema: { resolverClasses: declared.resolverClasses, openFields } }]
+}
+
+/** auth-base's declaration with one reason taken out — the shape of a field somebody forgot to list. */
+function without(where: string) {
+  const byDesign = { ...REAL.byDesign }
+  delete byDesign[where]
+  return { ...REAL, byDesign }
+}
+
+async function built(): Promise<GraphQLSchema> {
+  return await buildSchema({ resolvers: declared.resolverClasses, validate: false })
+}
+
+async function refusalCodeOf(promise: Promise<any>): Promise<string> {
+  const result = await promise
+  return result?.errors?.[0]?.extensions?.refusal?.code || result?.errors?.[0]?.extensions?.code || 'no error'
+}
+
+describe('who is covered', () => {
+  it('attributes each root field to the module whose class declared it', async () => {
+    const coverage = coverageOf(modules(REAL))
+
+    expect(coverage.get('Query.myRoles')).toEqual({ module: MODULE, listed: 'by-design' })
+    expect(coverage.get('Mutation.createRole')).toEqual({ module: MODULE, listed: null })
+  })
+
+  it('covers nothing for a module that declared no lists', () => {
+    /* ⚠ The line that keeps the four products booting. */
+    expect(coverageOf(modules(undefined)).size).toBe(0)
+  })
+
+  it('does not cover a field of a class the module did not name', () => {
+    const coverage = coverageOf([{ name: 'other', schema: { resolverClasses: [], openFields: {} } }])
+
+    expect(judgeUndeclared('Query.myRoles', coverage)).toEqual('not-opted-in')
+  })
+})
+
+describe('the verdicts', () => {
+  const coverage = () =>
+    coverageOf(modules({ byDesign: { 'Query.myRoles': 'mine' }, notYetDeclared: ['Query.passwordRule'] }))
+
+  it('open by design', () => {
+    expect(judgeUndeclared('Query.myRoles', coverage())).toEqual('open-by-design')
+  })
+
+  it('open, not yet declared', () => {
+    expect(judgeUndeclared('Query.passwordRule', coverage())).toEqual('open-not-yet-declared')
+  })
+
+  it('unlisted', () => {
+    expect(judgeUndeclared('Query.hasPrivilege', coverage())).toEqual('unlisted')
+  })
+
+  it('not opted in', () => {
+    expect(judgeUndeclared('Query.somethingElse', coverage())).toEqual('not-opted-in')
+  })
+})
+
+describe('in development — the schema refuses to build', () => {
+  it('builds with the declaration auth-base ships', async () => {
+    /* Every undeclared field of auth-base is in `byDesign`; nothing is unlisted today. */
+    const schema = await built()
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(REAL), mode: 'boot' })).not.toThrow()
+  })
+
+  it('names the field that is unlisted', async () => {
+    /* ⚠ The case the step exists for: a field arrived and nobody said who may call it. */
+    const schema = await built()
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(without('Query.myRoles')), mode: 'boot' })).toThrow(
+      /Query\.myRoles/
+    )
+  })
+
+  it('names every unlisted field at once, not the first', async () => {
+    const schema = await built()
+    const declaration = without('Query.myRoles')
+    delete declaration.byDesign['Query.passwordRule']
+
+    let message = ''
+    try {
+      privilegeDirectiveResolver(schema, { modules: modules(declaration), mode: 'boot' })
+    } catch (e: any) {
+      message = e.message
+    }
+
+    expect(message).toMatch(/2 field\(s\)/)
+    expect(message).toMatch(/Query\.myRoles/)
+    expect(message).toMatch(/Query\.passwordRule/)
+  })
+
+  it('accepts the field once it is listed as not yet declared', async () => {
+    const schema = await built()
+    const declaration = { ...without('Query.myRoles'), notYetDeclared: ['Query.myRoles'] }
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(declaration), mode: 'boot' })).not.toThrow()
+  })
+
+  it('leaves a module that declared no lists exactly as it was', async () => {
+    const schema = await built()
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(undefined), mode: 'boot' })).not.toThrow()
+  })
+})
+
+describe('in production — only that field refuses', () => {
+  it('still builds', async () => {
+    const schema = await built()
+
+    expect(() =>
+      privilegeDirectiveResolver(schema, { modules: modules(without('Query.passwordRule')), mode: 'request' })
+    ).not.toThrow()
+  })
+
+  it('refuses the unlisted field, with a name the screen can read', async () => {
+    /*
+     * ⚠ Never the other way. An unlisted field in production answers nobody — wrong in the worst case
+     * means one field refuses, never one field opens.
+     */
+    const schema = privilegeDirectiveResolver(await built(), {
+      modules: modules(without('Query.passwordRule')),
+      mode: 'request'
+    })
+
+    expect(await refusalCodeOf(graphql({ schema, source: '{ passwordRule { lowerCase } }', contextValue: { state: {} } }))).toEqual(
+      'field-declares-no-privilege'
+    )
+  })
+
+  it('leaves a listed field answering', async () => {
+    const schema = privilegeDirectiveResolver(await built(), {
+      modules: modules(without('Query.myRoles')),
+      mode: 'request'
+    })
+
+    const result = await graphql({ schema, source: '{ passwordRule { lowerCase } }', contextValue: { state: {} } })
+
+    expect(result.errors?.[0]?.extensions?.refusal).toBeUndefined()
+  })
+})
+
+describe('a subscription is stopped where it opens', () => {
+  /*
+   * ⚠ The directive used to wrap `resolve` only. A declared subscription then connected for anyone
+   * and failed on every event — it leaked nothing and refused nothing. Built from SDL because
+   * auth-base has no subscription of its own; the directive sees the same field configuration.
+   */
+  const typeDefs = `
+    type Query { ok: Boolean }
+    type Subscription {
+      guarded: String @privilege(category: "board", privilege: "query")
+    }
+  `
+
+  function schemaWith(subscribe: () => any) {
+    return privilegeDirectiveResolver(
+      makeExecutableSchema({
+        typeDefs: [privilegeDirectiveTypeDefs, typeDefs],
+        resolvers: { Query: { ok: () => true }, Subscription: { guarded: { subscribe, resolve: (v: any) => v } } }
+      }),
+      { modules: [] }
+    )
+  }
+
+  it('refuses at subscribe for somebody without the privilege', async () => {
+    let opened = false
+    const schema = schemaWith(() => {
+      opened = true
+      return (async function* () {})()
+    })
+
+    const field = schema.getSubscriptionType()!.getFields().guarded as any
+
+    await expect(
+      field.subscribe({}, {}, { state: { user: { id: 'u', domains: [] }, domain: { id: 'd' } } }, {} as any)
+    ).rejects.toBeTruthy()
+    expect(opened).toBe(false)
+  })
+})

package/translations/en.json

@@ -35,7 +35,6 @@
   "field.model": "model",
   "field.password": "password",
   "field.privileges": "privileges",
-  "field.roles": "roles",
   "field.token": "token",
   "field.user": "user",
   "field.user_account": "user account",

package/translations/ja.json

@@ -2,20 +2,20 @@
   "error.auth error": "認証エラー。{message}",
   "error.authn verification failed": "ユーザー認証に失敗しました。",
   "error.confirm password not matched": "新しいパスワードと確認パスワードが一致しません.",
-  "error.domain mismatch": "証明書のドメインと現在のドメインが一致しません.",
+  "error.domain mismatch": "証明書の$t(term.domain)と現在の$t(term.domain)が一致しません.",
   "error.domain not allowed": "'{subdomain}' 領域はこのユーザに許可されていません.",
   "error.email already exists": "メールはすでに他のユーザーによって使用されています.",
   "error.failed to find x": "{x}が見つかりません.",
   "error.invalid username": "無効なユーザー名: {username}",
-  "error.ownership required": "権限がありません。ドメインまたはシステムの所有者権限が必要です。",
+  "error.ownership required": "権限がありません。$t(term.domain)またはシステムの所有者権限が必要です。",
   "error.password should be supported": "初期パスワードまたはデフォルトパスワードがサポートされるべきです",
   "error.password should match the rule": "パスワードは次の規則を守らなければなりません. {rule}",
   "error.password used in the past": "過去に使用されたパスワードです.",
-  "error.role-name-stands-inherited": "{name} ロールは {domain} に定義されており、ここからも見えています。このドメインに同じ名前で別に立てるつもりの場合のみ作成します。",
-  "error.role-name-taken-here": "このドメインには既に {name} ロールがあります。",
+  "error.role-name-stands-inherited": "{name} ロールは {domain} に定義されており、ここからも見えています。この$t(term.domain)に同じ名前で別に立てるつもりの場合のみ作成します。",
+  "error.role-name-taken-here": "この$t(term.domain)には既に {name} ロールがあります。",
   "error.subdomain not found": "サブドメインが見つかりません.",
   "error.token or password is invalid": "トークンまたはパスワードが無効です.",
-  "error.unavailable-domain": "使用できないドメインです.",
+  "error.unavailable-domain": "使用できない$t(term.domain)です.",
   "error.user credential not found": "ユーザー資格情報が見つかりません. 生体認証を使用するにはデバイスを登録する必要があります.",
   "error.user credential registration failed": "登録を完了できませんでした。デバイスでキャンセルされたか、サーバーに到達できませんでした。",
   "error.user credential registration not allowed": "このデバイスは登録できませんでした。登録がタイムアウトしたか、すでに登録済みです。",
@@ -35,7 +35,6 @@
   "field.model": "モデル",
   "field.password": "パスワード",
   "field.privileges": "権限",
-  "field.roles": "ルール",
   "field.token": "トークン",
   "field.user": "ユーザー",
   "field.user_account": "ユーザー アカウント",

package/translations/ko.json

@@ -2,20 +2,20 @@
   "error.auth error": "인증 오류. {message}",
   "error.authn verification failed": "사용자 자격 증명을 실패하였습니다.",
   "error.confirm password not matched": "새 비밀번호와 확인 비밀번호가 일치하지 않습니다.",
-  "error.domain mismatch": "인증서의 도메인과 현재 도메인이 일치하지 않습니다.",
+  "error.domain mismatch": "인증서의 $t(term.domain)과 현재 $t(term.domain)이 일치하지 않습니다.",
   "error.domain not allowed": "'{subdomain}' 영역은 이 사용자에게 허가되지 않았습니다.",
   "error.email already exists": "이메일이 이미 사용되고 있습니다.",
   "error.failed to find x": "{x}을(를) 찾을 수 없습니다.",
   "error.invalid username": "유효하지 않은 사용자 이름: {username}",
-  "error.ownership required": "권한이 없습니다. 도메인 또는 시스템 소유자 권한이 필요합니다.",
+  "error.ownership required": "권한이 없습니다. $t(term.domain) 또는 시스템 소유자 권한이 필요합니다.",
   "error.password should be supported": "초기 비밀번호나 디폴트 비밀번호가 제공되어야 합니다.",
   "error.password should match the rule": "비밀번호는 다음 규칙을 지켜야 합니다. {rule}",
   "error.password used in the past": "과거에 사용된 비밀번호입니다.",
-  "error.role-name-stands-inherited": "{name} 역할이 {domain} 에 정의되어 여기에서도 보입니다. 이 도메인에 같은 이름으로 따로 세우려는 것이 맞을 때만 세웁니다.",
-  "error.role-name-taken-here": "이 도메인에 이미 {name} 역할이 있습니다.",
+  "error.role-name-stands-inherited": "{name} 역할이 {domain} 에 정의되어 여기에서도 보입니다. 이 $t(term.domain)에 같은 이름으로 따로 세우려는 것이 맞을 때만 세웁니다.",
+  "error.role-name-taken-here": "이 $t(term.domain)에 이미 {name} 역할이 있습니다.",
   "error.subdomain not found": "서브도메인을 찾을 수 없습니다.",
   "error.token or password is invalid": "토큰 또는 비밀번호가 유효하지 않습니다.",
-  "error.unavailable-domain": "사용할 수 없는 도메인입니다.",
+  "error.unavailable-domain": "사용할 수 없는 $t(term.domain)입니다.",
   "error.user credential not found": "사용자 자격 증명을 찾을 수 없습니다. 바이오메트릭 인증을 사용하기 위해서는 먼저 기기를 등록해야 합니다.",
   "error.user credential registration failed": "등록을 마치지 못했습니다. 기기에서 취소했거나 서버에 닿지 못했습니다.",
   "error.user credential registration not allowed": "이 기기를 등록할 수 없습니다. 등록 시간이 초과되었거나, 이미 등록된 기기입니다.",
@@ -35,7 +35,6 @@
   "field.model": "모델",
   "field.password": "비밀번호",
   "field.privileges": "권한",
-  "field.roles": "규칙",
   "field.token": "토큰",
   "field.user": "사용자",
   "field.user_account": "사용자 계정",
@@ -115,7 +114,7 @@
   "privilege.allows.organization.mutation": "조직 구조를 고칠 수 있습니다.",
   "privilege.allows.organization.query": "조직 구조를 볼 수 있습니다.",
   "privilege.allows.partner.mutation": "협력사를 등록하고 연결을 끊을 수 있습니다.",
-  "privilege.allows.partner.query": "협력사와 그 도메인 연결을 볼 수 있습니다.",
+  "privilege.allows.partner.query": "협력사와 그 $t(term.domain) 연결을 볼 수 있습니다.",
   "privilege.allows.privilege.query": "이 시스템에 선언된 권한 목록을 볼 수 있습니다.",
   "privilege.allows.process-instance.query": "프로세스가 어디까지 돌았는지 볼 수 있습니다.",
   "privilege.allows.process.mutation": "프로세스를 만들고 단계를 고칠 수 있습니다.",