@things-factory/auth-base 10.1.37 → 10.1.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.37",
+  "version": "10.1.38",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -34,9 +34,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.37",
+    "@things-factory/email-base": "^10.1.38",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.37",
+    "@things-factory/shell": "^10.1.38",
     "@things-factory/utils": "^10.1.20",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "d8a69e5c8803a4b9d3289df0cf38e161a207db61"
+  "gitHead": "b947349fe1c27d11038b592ceadaba336f14785b"
 }

package/tests/app-binding-db.test.ts

@@ -160,3 +160,51 @@ describe('the list', () => {
     expect(items).toHaveLength(1)
   })
 })
+
+describe('the free-text term', () => {
+  /*
+   * The screen now sends the term itself (`ListParam.search`) and lets the server say where it
+   * looks. This door builds with the older `buildQuery`, which only understood search *filters* -
+   * so a term that arrived here was dropped, and the whole list came back as if it were the answer.
+   * A person searching for a binding's name read that as "not here".
+   */
+  it('narrows the list to the bindings that match', async () => {
+    await makeUser(ours, 'erp-bridge', 'application')
+    await makeUser(ours, 'label-printer', 'application')
+    await makeUser(ours, 'erp-archive', 'application')
+
+    const { items, total } = await query.appBindings({ search: 'erp' } as any, context(ours))
+
+    expect(items.map((one: any) => one.username).sort()).toEqual(['erp-archive', 'erp-bridge'])
+    expect(total).toBe(2)
+  })
+
+  it('looks in the email too', async () => {
+    await makeUser(ours, 'scanner-1', 'application')
+    await makeUser(ours, 'scanner-2', 'application')
+
+    const { items } = await query.appBindings({ search: 'scanner-2@example' } as any, context(ours))
+
+    expect(items.map((one: any) => one.username)).toEqual(['scanner-2'])
+  })
+
+  it('still answers only for this domain when a term is given', async () => {
+    /* A term must not widen the tenant: the OR of the search sits inside the domain condition. */
+    await makeUser(ours, 'erp-ours', 'application')
+    await makeUser(theirs, 'erp-theirs', 'application')
+
+    const { items } = await query.appBindings({ search: 'erp' } as any, context(ours))
+
+    expect(items.map((one: any) => one.username)).toEqual(['erp-ours'])
+  })
+
+  it('an empty term is no term', async () => {
+    await makeUser(ours, 'app-one', 'application')
+    await makeUser(ours, 'app-two', 'application')
+
+    const { total } = await query.appBindings({ search: '   ' } as any, context(ours))
+
+    expect(total).toBe(2)
+  })
+})
+

package/tests/domain-required.test.ts

@@ -0,0 +1,127 @@
+import { decideDomainRedirect, DOMAIN_REDIRECT_WINDOW_MS, domainRequiredTarget } from '../client/domain-required'
+
+/**
+ * Where a screen that came up before the shell settled on a domain is sent.
+ *
+ * Every query on such a screen answers 403, and "try again" answers 403 again, forever. The shell
+ * sends the reader to check-in - the same place the server already sends an HTML request - and
+ * never from check-in or sign-in themselves, where it would go round in a circle.
+ */
+
+describe('domainRequiredTarget', () => {
+  test('a screen without a domain segment goes to check-in, carrying where it was', () => {
+    const target = new URL(domainRequiredTarget('http://localhost:4000/activity-catalog')!)
+
+    expect(target.pathname).toBe('/auth/checkin')
+    expect(target.searchParams.get('redirect_to')).toBe('http://localhost:4000/activity-catalog')
+  })
+
+  test('a screen on a domain the reader may not enter also goes to check-in - the server names why', () => {
+    const target = new URL(domainRequiredTarget('http://localhost:4000/domain/other/activity-catalog')!)
+
+    expect(target.pathname).toBe('/auth/checkin')
+    expect(target.searchParams.get('redirect_to')).toBe('http://localhost:4000/domain/other/activity-catalog')
+  })
+
+  test('the query string and hash of the screen survive the round trip', () => {
+    const from = 'http://localhost:4000/activity-detail?name=MES%20Disposition%20Approval#line'
+    const target = new URL(domainRequiredTarget(from)!)
+
+    expect(target.searchParams.get('redirect_to')).toBe(from)
+  })
+
+  test('it stays on the same origin', () => {
+    expect(new URL(domainRequiredTarget('https://plant.example.com/x')!).origin).toBe('https://plant.example.com')
+  })
+
+  test('check-in itself is never sent to check-in', () => {
+    expect(domainRequiredTarget('http://localhost:4000/auth/checkin?redirect_to=%2F')).toBeNull()
+  })
+
+  test('sign-in and the other auth screens are left alone', () => {
+    expect(domainRequiredTarget('http://localhost:4000/auth/signin')).toBeNull()
+    expect(domainRequiredTarget('http://localhost:4000/auth')).toBeNull()
+  })
+
+  test('a path that only starts with the letters auth is not an auth screen', () => {
+    expect(domainRequiredTarget('http://localhost:4000/authority-list')).not.toBeNull()
+  })
+
+  test('something that is not an address is not guessed at', () => {
+    expect(domainRequiredTarget('')).toBeNull()
+    expect(domainRequiredTarget('not a url')).toBeNull()
+  })
+
+  /*
+   * A 403 is not only "no domain". The shell also answers 403 to an address on the site's IP block list
+   * (shell/server/middlewares/domain-middleware.ts). That reader has a domain; check-in sends them
+   * straight back and the screen gets 403 again. Without this guard the tab goes round forever.
+   */
+  describe('after one round trip it stops', () => {
+    const now = 1_000_000_000
+    const here = 'http://localhost:4000/domain/miratek/activity-catalog'
+
+    test('sent a moment ago: not sent again, whatever the reason for the 403', () => {
+      expect(domainRequiredTarget(here, now - 2_000, now)).toBeNull()
+    })
+
+    test('it is the time that counts, not the address - the server changed the address on the way back', () => {
+      expect(domainRequiredTarget('http://localhost:4000/activity-catalog', now - 2_000, now)).toBeNull()
+      expect(domainRequiredTarget(here, now - 2_000, now)).toBeNull()
+    })
+
+    test('once the window has passed, a new 403 is a new case and is sent', () => {
+      expect(domainRequiredTarget(here, now - DOMAIN_REDIRECT_WINDOW_MS, now)).not.toBeNull()
+    })
+
+    test('never sent before: sent', () => {
+      expect(domainRequiredTarget(here, null, now)).not.toBeNull()
+      expect(domainRequiredTarget(here, undefined, now)).not.toBeNull()
+    })
+
+    test('a stamp from the future (a clock that moved back) does not block for ever', () => {
+      expect(domainRequiredTarget(here, now + 60_000, now)).not.toBeNull()
+    })
+  })
+
+  /*
+   * The stamp is the only thing that knows "we just came back". A browser that blocks storage would lose it,
+   * and a reader on the IP block list would go round again. So storage that does not work means: do not send.
+   */
+  describe('decideDomainRedirect - the stamp must work or nothing is sent', () => {
+    const now = 1_000_000_000
+    const here = 'http://localhost:4000/activity-catalog'
+    const store = (saved: string | null = null) => {
+      const box = { value: saved, written: [] as string[] }
+      return { box, stamp: { read: () => box.value, write: (v: string) => { box.written.push(v); box.value = v } } }
+    }
+
+    test('first time: sent, and the stamp is written before leaving', () => {
+      const { box, stamp } = store()
+      expect(decideDomainRedirect(here, stamp, now)).not.toBeNull()
+      expect(box.written).toEqual([String(now)])
+    })
+
+    test('just came back: not sent, and the stamp is left as it was', () => {
+      const { box, stamp } = store(String(now - 2_000))
+      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
+      expect(box.written).toEqual([])
+    })
+
+    test('storage that cannot be read: not sent', () => {
+      const stamp = { read: () => { throw new Error('blocked') }, write: () => {} }
+      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
+    })
+
+    test('storage that cannot be written: not sent - a trip we cannot remember could loop', () => {
+      const stamp = { read: () => null, write: () => { throw new Error('quota') } }
+      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
+    })
+
+    test('a stamp that is not a number is treated as none, and the trip goes ahead', () => {
+      const { stamp } = store('garbage')
+      expect(decideDomainRedirect(here, stamp, now)).not.toBeNull()
+    })
+  })
+})
+

package/tests/invitation-route.test.ts

@@ -0,0 +1,97 @@
+import { readFileSync, readdirSync } from 'fs'
+import { join } from 'path'
+
+import { loadCompiled } from './compiled'
+
+const { authPublicProcessRouter } = loadCompiled('router/auth-public-process-router')
+const { ACCEPT_INVITATION_PATH } = loadCompiled('controllers/invitation')
+
+/**
+ * The link in each mail lands on a route that exists.
+ *
+ * ── Why this file exists ────────────────────────────────────────────────────
+ * The invitation mail pointed at `/auth/accept/<token>` — a path with no route anywhere — so the
+ * invitee fell through to the private history fallback and the domain gate turned them away for
+ * not being a member yet. That was found and fixed on 2026-09-20, and the fix made the same
+ * mistake again: the new route was declared as `/accept-invitation` on a router whose prefix is
+ * `/auth`, and the mail and the page both used `/accept-invitation`. It shipped that way.
+ *
+ * Every test of the invitation called the controller directly, so none of them ever went through
+ * a route. This one reads the router's own table — the paths koa-router resolved, prefix included
+ * — and holds each mail's link against it.
+ */
+
+type Layer = { path: string; methods: string[] }
+
+const layers: Layer[] = authPublicProcessRouter.stack.map((layer: any) => ({
+  path: layer.path,
+  methods: layer.methods
+}))
+
+function answers(method: string, path: string): boolean {
+  return layers.some(layer => layer.methods.includes(method) && matches(layer.path, path))
+}
+
+/** A declared path against a concrete one: `:param` matches one segment. */
+function matches(declared: string, actual: string): boolean {
+  const a = declared.split('/')
+  const b = actual.split('/')
+
+  return a.length === b.length && a.every((part, i) => part.startsWith(':') || part === b[i])
+}
+
+describe('the invitation link', () => {
+  it('the page answers where the mail points', () => {
+    /* ⚠ The case that shipped broken. */
+    expect(answers('GET', ACCEPT_INVITATION_PATH)).toBe(true)
+  })
+
+  it('the page posts where the router listens', () => {
+    expect(answers('POST', ACCEPT_INVITATION_PATH)).toBe(true)
+  })
+
+  it('carries the prefix the router adds', () => {
+    /*
+     * Declaring `/accept-invitation` on this router makes it `/auth/accept-invitation`. The spelling
+     * without the prefix is exactly the one that went out, so it is named here as the wrong one.
+     */
+    expect(ACCEPT_INVITATION_PATH.startsWith('/auth/')).toBe(true)
+    expect(answers('GET', '/accept-invitation')).toBe(false)
+  })
+
+  it('is the path the client page uses too', () => {
+    const page = readFileSync(
+      join(__dirname, '..', '..', 'auth-ui', 'client', 'components', 'accept-invitation.ts'),
+      'utf-8'
+    )
+
+    expect(page).toContain(`return '${ACCEPT_INVITATION_PATH}'`)
+  })
+})
+
+describe('the other links sent by mail', () => {
+  /*
+   * Same class, older links. Each controller builds its URL from a literal; every literal has to be
+   * a route this router answers. Read from the source because they are not exported — the point is
+   * that the link and the route are two spellings of one thing and nothing else ties them.
+   */
+  const CONTROLLERS = join(__dirname, '..', 'server', 'controllers')
+
+  const linked = readdirSync(CONTROLLERS)
+    .filter(file => file.endsWith('.ts'))
+    .flatMap(file =>
+      [...readFileSync(join(CONTROLLERS, file), 'utf-8').matchAll(/new URL\(`(\/auth\/[^`?$]*)/g)].map(m => ({
+        file,
+        path: m[1].replace(/\/$/, '/:token')
+      }))
+    )
+
+  it('finds the links it means to check', () => {
+    /* A scan that matches nothing passes whatever the links say. */
+    expect(linked.map(l => l.file).sort()).toEqual(['reset-password.ts', 'unlock-user.ts', 'verification.ts'])
+  })
+
+  it.each(linked.map(l => [l.file, l.path]))('%s → %s', (_file, path) => {
+    expect(answers('GET', path)).toBe(true)
+  })
+})

package/tests/open-doors.test.ts

@@ -30,27 +30,18 @@ import { loadCompiled } from './compiled'
 const { schema: declared } = loadCompiled('service/index')
 const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
 
-/**
- * Open on purpose. Each of these answers about the caller, or about the installation rather
- * than about anybody's data.
+/*
+ * Open on purpose — read from the module's own declaration (`server/service/open-fields.ts`), which is
+ * also what the directive enforces against. It used to be a copy kept here, and two copies of one
+ * list are two lists.
  */
-const OPEN_BY_DECISION: Record<string, Record<string, string>> = {
-  Query: {
-    /* The caller's own. */
-    myLoginHistories: 'the caller\'s own sign-ins',
-    myRoles: 'the caller\'s own roles',
-    hasPrivilege: 'whether the caller has one — a gate here would need the answer to itself',
-    domainsWithPrivilege: 'the domains where the caller has one',
-    checkUserBelongsDomain: 'whether the caller belongs to this domain',
-    checkResettablePasswordToDefault: 'about the caller\'s own password',
-    checkDefaultPassword: 'whether the caller is still on the default password',
-
-    /* Neither tenant data nor about a person. */
-    passwordRule:
-      'the installation\'s password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none',
-    authProviderTypes: 'which provider types this build supports. A catalogue, not a tenant\'s configuration'
-  },
-  Mutation: {}
+const { openFields: declaration } = loadCompiled('service/open-fields')
+
+const OPEN_BY_DECISION: Record<string, Record<string, string>> = { Query: {}, Mutation: {} }
+
+for (const [where, reason] of Object.entries(declaration.byDesign as Record<string, string>)) {
+  const [typeName, field] = where.split('.')
+  OPEN_BY_DECISION[typeName][field] = reason
 }
 
 let schema: GraphQLSchema
@@ -58,7 +49,8 @@ let schema: GraphQLSchema
 beforeAll(async () => {
   schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
 
-  privilegeDirectiveResolver(schema)
+  /* No modules: this file measures what is open, not what would be refused. */
+  privilegeDirectiveResolver(schema, { modules: [] })
 })
 
 function openFields(typeName: 'Query' | 'Mutation'): string[] {

package/tests/open-fields-enforcement.test.ts

@@ -0,0 +1,215 @@
+import { buildSchema } from 'type-graphql'
+import { graphql, GraphQLSchema } from 'graphql'
+import { makeExecutableSchema } from '@graphql-tools/schema'
+
+import { loadCompiled } from './compiled'
+
+const { schema: declared } = loadCompiled('service/index')
+const { privilegeDirectiveResolver, privilegeDirectiveTypeDefs } = loadCompiled('service/privilege/privilege-directive')
+const { coverageOf, judgeUndeclared } = loadCompiled('service/privilege/open-field-rule')
+
+/**
+ * A field that declares no `@privilege` and that its module does not list — what happens to it
+ * (`docs/design/auth-rebuild.md` §8 step 1; question sheet Q1 · Q2 · Q5).
+ *
+ * ── The four answers ────────────────────────────────────────────────────────
+ *   byDesign          open, and the module says why
+ *   notYetDeclared    open, and on the module's list to close
+ *   unlisted          the module opted in and says nothing: boot refuses in development, the field
+ *                     refuses in production
+ *   not opted in      the module declared no lists at all: exactly as before
+ *
+ * The last one is deliberate. The four products serve resolvers of their own from another
+ * repository, and enforcing on them the day this lands would stop all four from booting.
+ *
+ * These build auth-base's real schema from the `resolverClasses` the server boots from, and vary
+ * only the module's declaration — so what is tested is the directive against real fields, not
+ * against a model of them.
+ */
+
+const MODULE = 'auth-base'
+const REAL = declared.openFields
+
+function modules(openFields: any) {
+  return [{ name: MODULE, schema: { resolverClasses: declared.resolverClasses, openFields } }]
+}
+
+/** auth-base's declaration with one reason taken out — the shape of a field somebody forgot to list. */
+function without(where: string) {
+  const byDesign = { ...REAL.byDesign }
+  delete byDesign[where]
+  return { ...REAL, byDesign }
+}
+
+async function built(): Promise<GraphQLSchema> {
+  return await buildSchema({ resolvers: declared.resolverClasses, validate: false })
+}
+
+async function refusalCodeOf(promise: Promise<any>): Promise<string> {
+  const result = await promise
+  return result?.errors?.[0]?.extensions?.refusal?.code || result?.errors?.[0]?.extensions?.code || 'no error'
+}
+
+describe('who is covered', () => {
+  it('attributes each root field to the module whose class declared it', async () => {
+    const coverage = coverageOf(modules(REAL))
+
+    expect(coverage.get('Query.myRoles')).toEqual({ module: MODULE, listed: 'by-design' })
+    expect(coverage.get('Mutation.createRole')).toEqual({ module: MODULE, listed: null })
+  })
+
+  it('covers nothing for a module that declared no lists', () => {
+    /* ⚠ The line that keeps the four products booting. */
+    expect(coverageOf(modules(undefined)).size).toBe(0)
+  })
+
+  it('does not cover a field of a class the module did not name', () => {
+    const coverage = coverageOf([{ name: 'other', schema: { resolverClasses: [], openFields: {} } }])
+
+    expect(judgeUndeclared('Query.myRoles', coverage)).toEqual('not-opted-in')
+  })
+})
+
+describe('the verdicts', () => {
+  const coverage = () =>
+    coverageOf(modules({ byDesign: { 'Query.myRoles': 'mine' }, notYetDeclared: ['Query.passwordRule'] }))
+
+  it('open by design', () => {
+    expect(judgeUndeclared('Query.myRoles', coverage())).toEqual('open-by-design')
+  })
+
+  it('open, not yet declared', () => {
+    expect(judgeUndeclared('Query.passwordRule', coverage())).toEqual('open-not-yet-declared')
+  })
+
+  it('unlisted', () => {
+    expect(judgeUndeclared('Query.hasPrivilege', coverage())).toEqual('unlisted')
+  })
+
+  it('not opted in', () => {
+    expect(judgeUndeclared('Query.somethingElse', coverage())).toEqual('not-opted-in')
+  })
+})
+
+describe('in development — the schema refuses to build', () => {
+  it('builds with the declaration auth-base ships', async () => {
+    /* Every undeclared field of auth-base is in `byDesign`; nothing is unlisted today. */
+    const schema = await built()
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(REAL), mode: 'boot' })).not.toThrow()
+  })
+
+  it('names the field that is unlisted', async () => {
+    /* ⚠ The case the step exists for: a field arrived and nobody said who may call it. */
+    const schema = await built()
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(without('Query.myRoles')), mode: 'boot' })).toThrow(
+      /Query\.myRoles/
+    )
+  })
+
+  it('names every unlisted field at once, not the first', async () => {
+    const schema = await built()
+    const declaration = without('Query.myRoles')
+    delete declaration.byDesign['Query.passwordRule']
+
+    let message = ''
+    try {
+      privilegeDirectiveResolver(schema, { modules: modules(declaration), mode: 'boot' })
+    } catch (e: any) {
+      message = e.message
+    }
+
+    expect(message).toMatch(/2 field\(s\)/)
+    expect(message).toMatch(/Query\.myRoles/)
+    expect(message).toMatch(/Query\.passwordRule/)
+  })
+
+  it('accepts the field once it is listed as not yet declared', async () => {
+    const schema = await built()
+    const declaration = { ...without('Query.myRoles'), notYetDeclared: ['Query.myRoles'] }
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(declaration), mode: 'boot' })).not.toThrow()
+  })
+
+  it('leaves a module that declared no lists exactly as it was', async () => {
+    const schema = await built()
+
+    expect(() => privilegeDirectiveResolver(schema, { modules: modules(undefined), mode: 'boot' })).not.toThrow()
+  })
+})
+
+describe('in production — only that field refuses', () => {
+  it('still builds', async () => {
+    const schema = await built()
+
+    expect(() =>
+      privilegeDirectiveResolver(schema, { modules: modules(without('Query.passwordRule')), mode: 'request' })
+    ).not.toThrow()
+  })
+
+  it('refuses the unlisted field, with a name the screen can read', async () => {
+    /*
+     * ⚠ Never the other way. An unlisted field in production answers nobody — wrong in the worst case
+     * means one field refuses, never one field opens.
+     */
+    const schema = privilegeDirectiveResolver(await built(), {
+      modules: modules(without('Query.passwordRule')),
+      mode: 'request'
+    })
+
+    expect(await refusalCodeOf(graphql({ schema, source: '{ passwordRule { lowerCase } }', contextValue: { state: {} } }))).toEqual(
+      'field-declares-no-privilege'
+    )
+  })
+
+  it('leaves a listed field answering', async () => {
+    const schema = privilegeDirectiveResolver(await built(), {
+      modules: modules(without('Query.myRoles')),
+      mode: 'request'
+    })
+
+    const result = await graphql({ schema, source: '{ passwordRule { lowerCase } }', contextValue: { state: {} } })
+
+    expect(result.errors?.[0]?.extensions?.refusal).toBeUndefined()
+  })
+})
+
+describe('a subscription is stopped where it opens', () => {
+  /*
+   * ⚠ The directive used to wrap `resolve` only. A declared subscription then connected for anyone
+   * and failed on every event — it leaked nothing and refused nothing. Built from SDL because
+   * auth-base has no subscription of its own; the directive sees the same field configuration.
+   */
+  const typeDefs = `
+    type Query { ok: Boolean }
+    type Subscription {
+      guarded: String @privilege(category: "board", privilege: "query")
+    }
+  `
+
+  function schemaWith(subscribe: () => any) {
+    return privilegeDirectiveResolver(
+      makeExecutableSchema({
+        typeDefs: [privilegeDirectiveTypeDefs, typeDefs],
+        resolvers: { Query: { ok: () => true }, Subscription: { guarded: { subscribe, resolve: (v: any) => v } } }
+      }),
+      { modules: [] }
+    )
+  }
+
+  it('refuses at subscribe for somebody without the privilege', async () => {
+    let opened = false
+    const schema = schemaWith(() => {
+      opened = true
+      return (async function* () {})()
+    })
+
+    const field = schema.getSubscriptionType()!.getFields().guarded as any
+
+    await expect(
+      field.subscribe({}, {}, { state: { user: { id: 'u', domains: [] }, domain: { id: 'd' } } }, {} as any)
+    ).rejects.toBeTruthy()
+    expect(opened).toBe(false)
+  })
+})

package/translations/en.json

@@ -35,7 +35,6 @@
   "field.model": "model",
   "field.password": "password",
   "field.privileges": "privileges",
-  "field.roles": "roles",
   "field.token": "token",
   "field.user": "user",
   "field.user_account": "user account",

package/translations/ja.json

@@ -35,7 +35,6 @@
   "field.model": "モデル",
   "field.password": "パスワード",
   "field.privileges": "権限",
-  "field.roles": "ルール",
   "field.token": "トークン",
   "field.user": "ユーザー",
   "field.user_account": "ユーザー アカウント",

package/translations/ko.json

@@ -35,7 +35,6 @@
   "field.model": "모델",
   "field.password": "비밀번호",
   "field.privileges": "권한",
-  "field.roles": "규칙",
   "field.token": "토큰",
   "field.user": "사용자",
   "field.user_account": "사용자 계정",

package/translations/ms.json

@@ -35,7 +35,6 @@
   "field.model": "Model",
   "field.password": "Kata laluan",
   "field.privileges": "Keistimewaan",
-  "field.roles": "Peranan",
   "field.token": "Token",
   "field.user": "Pengguna",
   "field.user_account": "Akaun pengguna",

package/translations/zh.json

@@ -36,7 +36,6 @@
   "field.model": "模型",
   "field.password": "密码",
   "field.privileges": "权限",
-  "field.roles": "角色",
   "field.token": "符记",
   "field.user": "用户",
   "field.user_account": "用户账号",