@things-factory/auth-base 10.1.79 → 10.1.107

package/tests/access-request-review.test.ts

@@ -0,0 +1,155 @@
+/**
+ * The access decision review - pure (ADR-0103, docs/design/access-request.md §6-1).
+ *
+ * The list screen, the AI 입력 draft card and the decision door all read this one function, so what it says
+ * is what every one of them says. Each code is held here on its own.
+ */
+
+import {
+  effectiveState,
+  expiryFrom,
+  isBlocked,
+  reviewAccessDecision,
+  smallestRole,
+  type DecisionFacts
+} from '../server/utils/access-request-review.js'
+
+const NOW = new Date('2026-10-02T09:00:00Z')
+const ASKED = { category: 'warehouse', privilege: 'mutation' }
+const SEE = { category: 'warehouse', privilege: 'query' }
+const GRANT_ROLES = { category: 'user', privilege: 'mutation' }
+
+function facts(over: Partial<DecisionFacts> = {}): DecisionFacts {
+  return {
+    request: { state: 'PENDING', requesterId: 'kim', ...ASKED, expiresAt: expiryFrom(NOW) },
+    deciderId: 'park',
+    decision: 'GRANT',
+    reason: null,
+    role: { id: 'r-inbound', name: 'inbound', privileges: [ASKED] },
+    requester: { active: true, inDomain: true },
+    requesterHoldsIt: false,
+    candidates: [{ id: 'r-inbound', name: 'inbound', privilegeCount: 1 }],
+    deciderPrivileges: [ASKED, SEE, GRANT_ROLES],
+    deciderIsOwner: false,
+    deniedBefore: null,
+    now: NOW,
+    ...over
+  }
+}
+
+const codes = (f: DecisionFacts) => reviewAccessDecision(f).map(issue => `${issue.blocking ? '⛔' : '⚠'}${issue.code}`)
+
+describe('a clean grant', () => {
+  it('★ the smallest role that holds exactly what was asked passes with nothing to say', () => {
+    expect(reviewAccessDecision(facts())).toEqual([])
+  })
+})
+
+describe('what keeps a decision from being made', () => {
+  it('★ no such request', () => {
+    expect(codes(facts({ request: null }))).toEqual(['⛔access-request-not-found'])
+  })
+
+  it('★ decided, withdrawn or expired already - another person may have decided a moment ago', () => {
+    for (const state of ['GRANTED', 'DENIED', 'WITHDRAWN', 'EXPIRED'] as const) {
+      expect(codes(facts({ request: { ...facts().request!, state } }))).toContain('⛔request-not-pending')
+    }
+  })
+
+  it('★ a pending request past its time is expired whatever the column says', () => {
+    const late = facts({ request: { ...facts().request!, expiresAt: new Date(NOW.getTime() - 1) } })
+    expect(codes(late)).toContain('⛔request-not-pending')
+  })
+
+  it('★ the decider is the requester', () => {
+    expect(codes(facts({ deciderId: 'kim' }))).toContain('⛔own-request')
+  })
+
+  it('★ the requester is locked, inactive or gone from the domain', () => {
+    expect(codes(facts({ requester: { active: false, inDomain: true } }))).toContain('⛔requester-unavailable')
+    expect(codes(facts({ requester: { active: true, inDomain: false } }))).toContain('⛔requester-unavailable')
+    expect(codes(facts({ requester: null }))).toContain('⛔requester-unavailable')
+  })
+
+  it('★ a denial without a reason', () => {
+    expect(codes(facts({ decision: 'DENY', reason: '  ', role: null }))).toEqual(['⛔deny-needs-reason'])
+    expect(codes(facts({ decision: 'DENY', reason: 'IT only', role: null }))).toEqual([])
+  })
+
+  it('★ the requester holds it already', () => {
+    expect(codes(facts({ requesterHoldsIt: true }))).toContain('⛔already-holds')
+  })
+
+  it('★ no role chosen, or one this domain cannot assign', () => {
+    expect(codes(facts({ role: null }))).toEqual(['⛔role-required'])
+    expect(codes(facts({ role: null, roleNamedButNotAssignable: true }))).toEqual(['⛔role-not-assignable'])
+  })
+
+  it('★ the role does not hold the asked privilege', () => {
+    expect(codes(facts({ role: { id: 'r-viewer', name: 'viewer', privileges: [SEE] } }))).toEqual(['⛔role-does-not-grant'])
+  })
+})
+
+describe('what the person deciding is told', () => {
+  const manager = { id: 'r-manager', name: 'manager', privileges: [ASKED, SEE, GRANT_ROLES] }
+  const candidates = [
+    { id: 'r-inbound', name: 'inbound', privilegeCount: 1 },
+    { id: 'r-manager', name: 'manager', privilegeCount: 3 }
+  ]
+
+  it('★ the role gives more than was asked - named', () => {
+    const issues = reviewAccessDecision(facts({ role: manager, candidates }))
+    expect(issues.find(i => i.code === 'role-grants-more')).toMatchObject({
+      blocking: false,
+      params: { count: 2, privileges: 'warehouse:query, user:mutation' }
+    })
+  })
+
+  it('★ the role hands on the power to give roles', () => {
+    expect(codes(facts({ role: manager, candidates }))).toContain('⚠role-grants-admin')
+  })
+
+  it('asking for the role-giving power itself is not warned as a side effect', () => {
+    const asked = facts({
+      request: { ...facts().request!, ...GRANT_ROLES },
+      role: { id: 'r-admin', name: 'admin', privileges: [GRANT_ROLES] },
+      candidates: [{ id: 'r-admin', name: 'admin', privilegeCount: 1 }]
+    })
+    expect(codes(asked)).not.toContain('⚠role-grants-admin')
+  })
+
+  it('★ a smaller role grants it too - its name', () => {
+    const issues = reviewAccessDecision(facts({ role: manager, candidates }))
+    expect(issues.find(i => i.code === 'smaller-role-exists')).toMatchObject({ params: { role: 'inbound', count: 1 } })
+  })
+
+  it('★ the role gives what the decider does not have - told, not refused (Q6)', () => {
+    const issues = reviewAccessDecision(facts({ role: manager, candidates, deciderPrivileges: [ASKED] }))
+    expect(issues.find(i => i.code === 'decider-lacks-it')).toMatchObject({ blocking: false, params: { privileges: 'warehouse:query, user:mutation' } })
+    expect(isBlocked(issues)).toBe(false)
+  })
+
+  it('an owner is not told they lack anything', () => {
+    expect(codes(facts({ role: manager, candidates, deciderPrivileges: [], deciderIsOwner: true }))).not.toContain('⚠decider-lacks-it')
+  })
+
+  it('★ denied before - by whom, when, why', () => {
+    const issues = reviewAccessDecision(facts({ deniedBefore: { by: 'Lee', at: '2026-09-01T00:00:00Z', reason: 'IT only' } }))
+    expect(issues).toEqual([
+      { code: 'denied-before', blocking: false, field: 'request', params: { by: 'Lee', at: '2026-09-01T00:00:00.000Z', reason: 'IT only' } }
+    ])
+  })
+})
+
+describe('helpers', () => {
+  it('the smallest role, ties by name - the same answer every time', () => {
+    expect(smallestRole([{ name: 'b', privilegeCount: 2 }, { name: 'a', privilegeCount: 2 }, { name: 'c', privilegeCount: 5 }])?.name).toBe('a')
+    expect(smallestRole([])).toBeUndefined()
+  })
+
+  it('a request waits fourteen days', () => {
+    expect(expiryFrom(NOW).toISOString()).toBe('2026-10-16T09:00:00.000Z')
+    expect(effectiveState('PENDING', null, NOW)).toBe('PENDING')
+    expect(effectiveState('GRANTED', new Date(0), NOW)).toBe('GRANTED')
+  })
+})

package/tests/assignable-roles-db.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Putting a person into roles - one function, the domain's scope, ids found again (ADR-0103 decision 2).
+ *
+ * `updateUserRoles` concatenated the client's `selectedRoles` onto the user as sent and removed every held role
+ * whose id was in `availableRoles`. A role of another tenant went in; another tenant's role id in
+ * `availableRoles` took that role away from the person in the other domain. The access request grants through
+ * the same function, so both doors are held here.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { GrantedRole } = loadCompiled('service/granted-role/granted-role')
+const { User } = loadCompiled('service/user/user')
+const { UserMutation } = loadCompiled('service/user/user-mutation')
+const { assignRoles } = loadCompiled('utils/assignable-roles')
+
+let parent: any
+let child: any
+let stranger: any
+
+async function loadDomain(id: string) {
+  return await getRepository(Domain).findOneBy({ id })
+}
+
+async function makeUser(domains: any[], roles: any[]) {
+  const tag = Math.random().toString(36).slice(2, 8)
+  return await getRepository(User).save({
+    username: `u-${tag}`,
+    email: `u-${tag}@example.com`,
+    name: 'Kim',
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains,
+    roles
+  })
+}
+
+async function heldRoleNames(user: any) {
+  const read = await getRepository(User).findOne({ where: { id: user.id }, relations: ['roles'] })
+  return read.roles.map((role: any) => role.name).sort()
+}
+
+function updateUserRoles(user: any, available: any[], selected: any[], domain: any) {
+  return new UserMutation().updateUserRoles(
+    user.username,
+    available.map(role => ({ id: role.id })),
+    selected.map(role => ({ id: role.id })),
+    { state: { domain }, t: (key: string) => key } as any
+  )
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const domainRepository = getRepository(Domain)
+  const savedParent = await domainRepository.save({ name: 'HQ', subdomain: 'hq' })
+  const savedChild = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a', parent: savedParent })
+  const savedStranger = await domainRepository.save({ name: 'Other', subdomain: 'other' })
+
+  parent = await loadDomain(savedParent.id)
+  child = await loadDomain(savedChild.id)
+  stranger = await loadDomain(savedStranger.id)
+})
+
+describe('what a domain can put a person into', () => {
+  it('its own role, its parent role and a role granted to it - all three', async () => {
+    const own = await getRepository(Role).save({ name: 'operator', domain: child })
+    const inherited = await getRepository(Role).save({ name: 'viewer', domain: parent })
+    const granted = await getRepository(Role).save({ name: 'partner', domain: stranger })
+    await getRepository(GrantedRole).save({ role: granted, domain: child })
+    const user = await makeUser([child], [])
+
+    const { added } = await assignRoles(user, { add: [own.id, inherited.id, granted.id] }, child)
+
+    expect(added.map((role: any) => role.name).sort()).toEqual(['operator', 'partner', 'viewer'])
+    expect(await heldRoleNames(user)).toEqual(['operator', 'partner', 'viewer'])
+  })
+
+  it('★ another tenant\'s role is refused by name, and nothing is saved', async () => {
+    const own = await getRepository(Role).save({ name: 'operator', domain: child })
+    const foreign = await getRepository(Role).save({ name: 'auditor', domain: stranger })
+    const user = await makeUser([child], [])
+
+    await expect(assignRoles(user, { add: [own.id, foreign.id] }, child)).rejects.toMatchObject({
+      code: 'role-not-assignable-here',
+      params: { roles: foreign.id }
+    })
+    expect(await heldRoleNames(user)).toEqual([])
+  })
+
+  it('a role already held is not added twice and is not reported as added', async () => {
+    const own = await getRepository(Role).save({ name: 'operator', domain: child })
+    const user = await makeUser([child], [own])
+
+    const { added } = await assignRoles(user, { add: [own.id] }, child)
+
+    expect(added).toEqual([])
+    expect(await heldRoleNames(user)).toEqual(['operator'])
+  })
+})
+
+describe('updateUserRoles goes through the same function', () => {
+  it('★ a foreign role in selectedRoles is refused - it used to be attached as sent', async () => {
+    const foreign = await getRepository(Role).save({ name: 'auditor', domain: stranger })
+    const user = await makeUser([child], [])
+
+    /* The method is called directly, so the Refusal arrives before SpeakRefusals turns it into a sentence. */
+    await expect(updateUserRoles(user, [], [foreign], child)).rejects.toMatchObject({ code: 'role-not-assignable-here' })
+    expect(await heldRoleNames(user)).toEqual([])
+  })
+
+  it('★ a foreign role in availableRoles stays with the person - this domain cannot take it', async () => {
+    const own = await getRepository(Role).save({ name: 'operator', domain: child })
+    const theirs = await getRepository(Role).save({ name: 'auditor', domain: stranger })
+    const user = await makeUser([child, stranger], [own, theirs])
+
+    await updateUserRoles(user, [own, theirs], [], child)
+
+    expect(await heldRoleNames(user)).toEqual(['auditor'])
+  })
+
+  it('within the scope it replaces as before - remove the shown, add the chosen', async () => {
+    const a = await getRepository(Role).save({ name: 'a', domain: child })
+    const b = await getRepository(Role).save({ name: 'b', domain: child })
+    const user = await makeUser([child], [a])
+
+    await updateUserRoles(user, [a, b], [b], child)
+
+    expect(await heldRoleNames(user)).toEqual(['b'])
+  })
+})

package/tests/permission-gate.test.ts

@@ -117,15 +117,13 @@ describe('이름이 없는 선언 — 소유권만으로 판정한다', () => {
     expect(await checkPermission({ owner: true }, USER, DOMAIN)).toBe(true)
   })
 
-  it('소유자가 아니면 닫힌다 — 다만 돌려주는 값이 `false` 가 아니라 `undefined` 다', async () => {
-    /* 선언한 타입은 `Promise<boolean>` 인데 실제로는 `(true && false) || (undefined && …)`
-       = `undefined` 가 나온다. 지금 모든 소비처가 `if (await checkPermission(…))` 로 받으므로
-       거동은 같다 — 그러나 시그니처가 사실과 다르고, `=== false` 로 받는 소비처가 하나
-       생기는 순간 조용히 통과한다. 그래서 값 자체를 고정한다. */
+  it('소유자가 아니면 닫힌다 — 값은 `false` 다', async () => {
+    /* 2026-10-02 까지는 `(true && false) || (undefined && …)` = `undefined` 가 나왔다. 선언한 타입은
+       `Promise<boolean>` 이었고, `=== false` 로 받는 소비처가 생기는 순간 조용히 통과할 자리였다.
+       판정이 이유를 내게 되면서(`judgePermission`, ADR-0103) 값이 타입과 같아졌다. */
     const decision = await checkPermission({ owner: true }, USER, DOMAIN)
 
-    expect(decision).toBeFalsy()
-    expect(decision).toBeUndefined()
+    expect(decision).toBe(false)
   })
 
   it('refuses an object that names nothing', async () => {

package/tests/privilege-directive.test.ts

@@ -291,3 +291,42 @@ describe('a declaration that names nothing', () => {
     expect(buildField('@privilege(superUserGranted: true)')).not.toThrow()
   })
 })
+
+describe('거절이 이유를 싣는다 (ADR-0103 결정 1)', () => {
+  it('★ 역할이 없으면 because: role — 화면이 「권한 요청」을 띄운다', async () => {
+    const result = await run(buildSchema(), 'guardedBoard')
+    expect((result.errors![0].extensions as any).because).toBe('role')
+  })
+
+  it('★ 라이선스가 막으면 역할이 있어도 because: license — 요청할 것이 아니다', async () => {
+    User.hasPrivilege = jest.fn().mockResolvedValue(true)
+    const result = await run(buildSchema(), 'guardedBoard', {
+      prohibitedPrivileges: [{ category: 'board', privilege: 'mutation', by: 'license' }]
+    })
+    expect((result.errors![0].extensions as any).because).toBe('license')
+  })
+
+  it('★ 보호 주소 밖에서 소유자 전용이면 because: address', async () => {
+    withOwnership({ owner: true })
+    const result = await run(buildSchema(), 'ownershipOnly', { unsafeIP: true })
+    expect((result.errors![0].extensions as any).because).toBe('address')
+  })
+})
+
+describe('거절이 무엇이 막혔는지도 싣는다 — 변경인가 조회인가 (질문지 Q9 · 4)', () => {
+  it('★ 조회가 막히면 operation: query', async () => {
+    const result = await run(buildSchema(), 'guardedBoard')
+    expect((result.errors![0].extensions as any).operation).toBe('query')
+  })
+
+  it('★ 변경이 막히면 operation: mutation — 사람이 누른 일이다', async () => {
+    const schema = privilegeDirectiveResolver(
+      makeExecutableSchema({
+        typeDefs: [privilegeDirectiveTypeDefs, 'type Query { ok: String } type Mutation { saveBoard: String @privilege(category: "board", privilege: "mutation") }'],
+        resolvers: { Query: { ok: () => 'ok' }, Mutation: { saveBoard: () => 'saved' } }
+      })
+    )
+    const result = await graphql({ schema, source: 'mutation { saveBoard }', contextValue: { state: { domain: DOMAIN, user: USER } } })
+    expect((result.errors![0].extensions as any)).toMatchObject({ because: 'role', operation: 'mutation' })
+  })
+})

package/tests/privilege-rejection.test.ts

@@ -70,3 +70,35 @@ describe('privilege rejection', () => {
     expect(privilegeRejection({}, undefined, 'mutation').extensions.requires).toBe('ownership')
   })
 })
+
+describe('privilege rejection carries why (ADR-0103 decision 1)', () => {
+  it('★ the cause goes in extensions.because - a screen offers a request only for role', () => {
+    expect(privilegeRejection(undefined, 'twin', 'mutation', 'license').extensions).toEqual({
+      code: 'FORBIDDEN',
+      requires: { category: 'twin', privilege: 'mutation' },
+      because: 'license'
+    })
+  })
+
+  it('a caller that does not say keeps the old meaning - named is role, unnamed is ownership', () => {
+    expect(privilegeRejection(undefined, 'twin', 'mutation').extensions.because).toBe('role')
+    expect(privilegeRejection(undefined).extensions.because).toBe('ownership')
+  })
+
+  it('★ each cause has its own sentence - an address refusal does not say a privilege is missing', () => {
+    const address = privilegeRejection(undefined, 'twin', 'mutation', 'address').message
+    const license = privilegeRejection(undefined, 'twin', 'mutation', 'license').message
+    const role = privilegeRejection(undefined, 'twin', 'mutation', 'role').message
+    expect(new Set([address, license, role]).size).toBe(3)
+    expect(address).toContain('address')
+    expect(license).toContain('licensed')
+  })
+
+  it('every sentence key is in all five languages', () => {
+    const keys = ['error.x not allowed from this address', 'error.x not licensed', 'error.x refused for this request', 'error.ownership not allowed from this address']
+    for (const lng of ['en', 'ko', 'ja', 'zh', 'ms']) {
+      const dict = require(`../translations/${lng}.json`)
+      for (const key of keys) expect([lng, key, typeof dict[key]]).toEqual([lng, key, 'string'])
+    }
+  })
+})

package/tests/refusal-cause.test.ts

@@ -0,0 +1,80 @@
+/**
+ * Why the gate said no (ADR-0103 decision 1).
+ *
+ * The four refusals used to arrive as one sentence. Only one of them is opened by a role, so a screen
+ * that offers "request access" for all four sends the admin a request they cannot answer - the person is
+ * given the role and is refused again. `judgePermission` says which it was; `checkPermission` stays a boolean.
+ */
+
+import { loadCompiled } from './compiled'
+
+const { judgePermission, checkPermission } = loadCompiled('utils/check-permission')
+const { User } = loadCompiled('service/user/user')
+
+const DOMAIN = { id: 'domain-1' } as any
+const USER = { id: 'user-1' } as any
+const NAMED = { category: 'warehouse', privilege: 'mutation' }
+const OWNED = { ...NAMED, owner: true }
+
+function given({ role = false, owner = false } = {}) {
+  User.hasPrivilege = jest.fn().mockResolvedValue(role)
+  ;(process as any).domainOwnerGranted = jest.fn().mockResolvedValue(owner)
+  ;(process as any).superUserGranted = jest.fn().mockResolvedValue(false)
+}
+
+afterEach(() => {
+  delete (process as any).domainOwnerGranted
+  delete (process as any).superUserGranted
+})
+
+describe('a refusal says which of the four it was', () => {
+  it('★ no role holds it: role', async () => {
+    given()
+    expect(await judgePermission(NAMED, USER, DOMAIN)).toEqual({ permitted: false, because: 'role' })
+    expect(await judgePermission(NAMED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'role' })
+  })
+
+  it('★ withheld by the address list: address - even with the role', async () => {
+    given({ role: true })
+    const prohibited = [{ ...NAMED, by: 'address' }]
+    expect(await judgePermission(NAMED, USER, DOMAIN, true, prohibited)).toEqual({ permitted: false, because: 'address' })
+  })
+
+  it('★ withheld by the license: license - even with the role', async () => {
+    given({ role: true })
+    const prohibited = [{ ...NAMED, by: 'license' }]
+    expect(await judgePermission(NAMED, USER, DOMAIN, false, prohibited)).toEqual({ permitted: false, because: 'license' })
+  })
+
+  it('★ a prohibition that does not say who made it: unknown - the cause is not made up', async () => {
+    given({ role: true })
+    expect(await judgePermission(NAMED, USER, DOMAIN, false, [NAMED])).toEqual({ permitted: false, because: 'unknown' })
+  })
+
+  it('★ only owners may: ownership', async () => {
+    given()
+    expect(await judgePermission({ owner: true }, USER, DOMAIN)).toEqual({ permitted: false, because: 'ownership' })
+  })
+
+  it('★ ownership asked from an unsafe address: address', async () => {
+    given({ owner: true })
+    expect(await judgePermission({ owner: true }, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'address' })
+  })
+
+  it('★ an owner without the role, from an unsafe address: address - from a safe one they pass', async () => {
+    given({ owner: true })
+    expect(await judgePermission(OWNED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'address' })
+    expect(await judgePermission(OWNED, USER, DOMAIN, false)).toEqual({ permitted: true })
+  })
+
+  it('an unsafe address whose ownership cannot be asked still refuses as role - it refused before', async () => {
+    User.hasPrivilege = jest.fn().mockResolvedValue(false)
+    expect(await judgePermission(OWNED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'role' })
+  })
+
+  it('checkPermission answers the same, as a boolean', async () => {
+    given({ role: true })
+    expect(await checkPermission(NAMED, USER, DOMAIN)).toBe(true)
+    expect(await checkPermission(NAMED, USER, DOMAIN, false, [{ ...NAMED, by: 'license' }])).toBe(false)
+  })
+})

package/translations/en.json

@@ -27,6 +27,11 @@
   "error.username already exists": "username already used by another user",
   "error.x is not a member of y": "{x} is not a member of {y}",
   "error.x privilege required": "unauthorized! {x} privilege required",
+  "error.role-not-assignable-here": "this domain cannot assign the role(s) {roles}.",
+  "error.x not allowed from this address": "unauthorized! {x} is not allowed from this address",
+  "error.x not licensed": "unauthorized! {x} is not licensed on this installation",
+  "error.x refused for this request": "unauthorized! {x} is refused for this request",
+  "error.ownership not allowed from this address": "unauthorized! ownership does not count from this address",
   "field.appliance_id": "appliance id",
   "field.brand": "brand",
   "field.password": "password",
@@ -222,5 +227,27 @@
   "text.user inactivated successfully": "user inactivated successfully",
   "text.user registered successfully": "user registered successfully. find your email to activate account",
   "text.verification email sent": "verification email sent",
-  "privilege.description": "{name} {category}"
+  "privilege.description": "{name} {category}",
+  "error.access-request-names-nothing": "an access request names a category and a privilege.",
+  "error.access-request-unknown-privilege": "there is no privilege {privilege}.",
+  "error.access-request-already-holds": "you already have {privilege}.",
+  "error.access-request-not-by-role": "a role would not open {privilege} here, so it cannot be requested.",
+  "error.access-request-not-withdrawable": "there is no pending request of yours to withdraw.",
+  "error.access-decision-access-request-not-found": "the access request is not found in this domain.",
+  "error.access-decision-request-not-pending": "the request has already been decided, withdrawn or has expired.",
+  "error.access-decision-own-request": "you cannot decide your own request.",
+  "error.access-decision-requester-unavailable": "the requester is locked, inactive or no longer in this domain.",
+  "error.access-decision-deny-needs-reason": "a denial needs a reason.",
+  "error.access-decision-already-holds": "the requester already has this privilege.",
+  "error.access-decision-role-required": "choose the role to grant.",
+  "error.access-decision-role-not-assignable": "this domain cannot assign that role.",
+  "error.access-decision-role-does-not-grant": "that role does not hold the requested privilege.",
+  "access-request.notify.asked.title": "access request",
+  "access-request.notify.asked.body": "{name} asks for {privilege}.",
+  "access-request.notify.granted.title": "access granted",
+  "access-request.notify.granted.body": "you now have {privilege} (role: {role}).",
+  "access-request.notify.denied.title": "access request denied",
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "write why you need it.",
+  "error.access-request-same-reason-as-denied": "this was denied lately for the same reason ({reason}). write what has changed."
 }

package/translations/ja.json

@@ -27,6 +27,11 @@
   "error.username already exists": "ユーザー名はすでに他のユーザーによって使用されています.",
   "error.x is not a member of y": "{x}は{y}のメンバーではありません.",
   "error.x privilege required": "権限がありません。{x} 権限が必要です。",
+  "error.role-not-assignable-here": "この$t(term.domain)では付与できないロールです: {roles}",
+  "error.x not allowed from this address": "権限がありません。このアドレスからは {x} 権限を使えません。",
+  "error.x not licensed": "権限がありません。このインストールのライセンスには {x} 権限がありません。",
+  "error.x refused for this request": "権限がありません。このリクエストでは {x} 権限が許可されていません。",
+  "error.ownership not allowed from this address": "権限がありません。このアドレスからは所有者権限が適用されません。",
   "field.appliance_id": "器具ID",
   "field.brand": "ブランド",
   "field.password": "パスワード",
@@ -222,5 +227,27 @@
   "privilege.category.user": "ユーザー",
   "privilege.category.webhook": "Webhook",
   "privilege.category.work-shift": "勤務交代",
-  "privilege.category.worker": "作業者"
+  "privilege.category.worker": "作業者",
+  "error.access-request-names-nothing": "権限リクエストにはカテゴリーと権限が必要です。",
+  "error.access-request-unknown-privilege": "{privilege} という権限はありません。",
+  "error.access-request-already-holds": "すでに {privilege} 権限があります。",
+  "error.access-request-not-by-role": "{privilege} はここではロールで開けないため、リクエストできません。",
+  "error.access-request-not-withdrawable": "取り下げられる保留中のリクエストがありません。",
+  "error.access-decision-access-request-not-found": "この$t(term.domain)にその権限リクエストはありません。",
+  "error.access-decision-request-not-pending": "すでに決定済み、取り下げ済み、または期限切れのリクエストです。",
+  "error.access-decision-own-request": "自分のリクエストは決定できません。",
+  "error.access-decision-requester-unavailable": "リクエスト者がロック中、無効、またはこの$t(term.domain)に所属していません。",
+  "error.access-decision-deny-needs-reason": "拒否には理由が必要です。",
+  "error.access-decision-already-holds": "リクエスト者はすでにその権限を持っています。",
+  "error.access-decision-role-required": "付与するロールを選んでください。",
+  "error.access-decision-role-not-assignable": "この$t(term.domain)では付与できないロールです。",
+  "error.access-decision-role-does-not-grant": "そのロールにはリクエストされた権限がありません。",
+  "access-request.notify.asked.title": "権限リクエスト",
+  "access-request.notify.asked.body": "{name} さんが {privilege} 権限をリクエストしました。",
+  "access-request.notify.granted.title": "権限が付与されました",
+  "access-request.notify.granted.body": "{privilege} 権限が付与されました(ロール: {role})。",
+  "access-request.notify.denied.title": "権限リクエストが拒否されました",
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "必要な理由を書いてください。",
+  "error.access-request-same-reason-as-denied": "同じ理由で最近拒否されました({reason})。何が変わったかを書いてください。"
 }

package/translations/ko.json

@@ -27,6 +27,11 @@
   "error.username already exists": "사용자 아이디가 이미 사용되고 있습니다.",
   "error.x is not a member of y": "{x}은(는) {y}의 멤버가 아닙니다.",
   "error.x privilege required": "권한이 없습니다. {x} 권한이 필요합니다.",
+  "error.role-not-assignable-here": "이 $t(term.domain)에서 줄 수 없는 역할입니다: {roles}",
+  "error.x not allowed from this address": "권한이 없습니다. 이 주소에서는 {x} 권한을 쓸 수 없습니다.",
+  "error.x not licensed": "권한이 없습니다. 이 설치의 라이선스에는 {x} 권한이 없습니다.",
+  "error.x refused for this request": "권한이 없습니다. 이 요청에는 {x} 권한이 허용되지 않습니다.",
+  "error.ownership not allowed from this address": "권한이 없습니다. 이 주소에서는 소유자 권한이 적용되지 않습니다.",
   "field.appliance_id": "기구 아이디",
   "field.brand": "브랜드",
   "field.password": "비밀번호",
@@ -222,5 +227,27 @@
   "text.user inactivated successfully": "사용자가 성공적으로 비활성화되었습니다.",
   "text.user registered successfully": "사용자가 성공적으로 등록되었습니다. 확인 이메일을 통해서 계정을 활성화하시기 바랍니다.",
   "text.verification email sent": "확인 이메일을 보냈습니다.",
-  "privilege.description": "{category} {name}"
+  "privilege.description": "{category} {name}",
+  "error.access-request-names-nothing": "권한 요청에는 범주와 권한이 있어야 합니다.",
+  "error.access-request-unknown-privilege": "{privilege} 권한이 없습니다.",
+  "error.access-request-already-holds": "이미 {privilege} 권한이 있습니다.",
+  "error.access-request-not-by-role": "{privilege} 권한은 여기서 역할로 열리지 않아 요청할 수 없습니다.",
+  "error.access-request-not-withdrawable": "거둘 수 있는 내 대기 중 요청이 없습니다.",
+  "error.access-decision-access-request-not-found": "이 $t(term.domain)에서 그 권한 요청을 찾을 수 없습니다.",
+  "error.access-decision-request-not-pending": "이미 정해졌거나, 거두었거나, 만료된 요청입니다.",
+  "error.access-decision-own-request": "자기 요청은 정할 수 없습니다.",
+  "error.access-decision-requester-unavailable": "요청자가 잠겼거나, 비활성이거나, 이 $t(term.domain)에서 빠졌습니다.",
+  "error.access-decision-deny-needs-reason": "거부에는 까닭이 있어야 합니다.",
+  "error.access-decision-already-holds": "요청자가 이미 그 권한을 가지고 있습니다.",
+  "error.access-decision-role-required": "부여할 역할을 고르세요.",
+  "error.access-decision-role-not-assignable": "이 $t(term.domain)에서 줄 수 없는 역할입니다.",
+  "error.access-decision-role-does-not-grant": "그 역할에는 요청한 권한이 없습니다.",
+  "access-request.notify.asked.title": "권한 요청",
+  "access-request.notify.asked.body": "{name} 님이 {privilege} 권한을 요청했습니다.",
+  "access-request.notify.granted.title": "권한을 받았습니다",
+  "access-request.notify.granted.body": "{privilege} 권한을 받았습니다(역할: {role}).",
+  "access-request.notify.denied.title": "권한 요청이 거부되었습니다",
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "필요한 까닭을 적어 주세요.",
+  "error.access-request-same-reason-as-denied": "같은 까닭으로 최근에 거부되었습니다({reason}). 무엇이 달라졌는지 적어 주세요."
 }

package/translations/ms.json

@@ -27,6 +27,11 @@
   "error.username already exists": "Nama pengguna telah digunakan oleh pengguna lain",
   "error.x is not a member of y": "{x} bukan ahli {y}",
   "error.x privilege required": "tidak dibenarkan! kebenaran {x} diperlukan",
+  "error.role-not-assignable-here": "$t(term.domain) ini tidak boleh memberikan peranan: {roles}",
+  "error.x not allowed from this address": "tidak dibenarkan! kebenaran {x} tidak dibenarkan dari alamat ini",
+  "error.x not licensed": "tidak dibenarkan! kebenaran {x} tiada dalam lesen pemasangan ini",
+  "error.x refused for this request": "tidak dibenarkan! kebenaran {x} ditolak untuk permintaan ini",
+  "error.ownership not allowed from this address": "tidak dibenarkan! kebenaran pemilik tidak terpakai dari alamat ini",
   "field.appliance_id": "Perkakas",
   "field.brand": "Jenama",
   "field.password": "Kata laluan",
@@ -222,5 +227,27 @@
   "privilege.category.user": "pengguna",
   "privilege.category.webhook": "Webhook",
   "privilege.category.work-shift": "syif kerja",
-  "privilege.category.worker": "pekerja"
+  "privilege.category.worker": "pekerja",
+  "error.access-request-names-nothing": "permintaan akses perlu menamakan kategori dan kebenaran.",
+  "error.access-request-unknown-privilege": "tiada kebenaran {privilege}.",
+  "error.access-request-already-holds": "anda sudah mempunyai {privilege}.",
+  "error.access-request-not-by-role": "{privilege} tidak dibuka oleh peranan di sini, jadi ia tidak boleh dipohon.",
+  "error.access-request-not-withdrawable": "tiada permintaan anda yang menunggu untuk ditarik balik.",
+  "error.access-decision-access-request-not-found": "permintaan akses tidak ditemui dalam $t(term.domain) ini.",
+  "error.access-decision-request-not-pending": "permintaan ini sudah diputuskan, ditarik balik atau tamat tempoh.",
+  "error.access-decision-own-request": "anda tidak boleh memutuskan permintaan anda sendiri.",
+  "error.access-decision-requester-unavailable": "peminta dikunci, tidak aktif atau tiada lagi dalam $t(term.domain) ini.",
+  "error.access-decision-deny-needs-reason": "penolakan memerlukan sebab.",
+  "error.access-decision-already-holds": "peminta sudah mempunyai kebenaran ini.",
+  "error.access-decision-role-required": "pilih peranan untuk diberikan.",
+  "error.access-decision-role-not-assignable": "$t(term.domain) ini tidak boleh memberikan peranan itu.",
+  "error.access-decision-role-does-not-grant": "peranan itu tidak memegang kebenaran yang dipohon.",
+  "access-request.notify.asked.title": "permintaan akses",
+  "access-request.notify.asked.body": "{name} memohon {privilege}.",
+  "access-request.notify.granted.title": "akses diberikan",
+  "access-request.notify.granted.body": "anda kini mempunyai {privilege} (peranan: {role}).",
+  "access-request.notify.denied.title": "permintaan akses ditolak",
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "tulis sebab anda memerlukannya.",
+  "error.access-request-same-reason-as-denied": "ini ditolak baru-baru ini atas sebab yang sama ({reason}). tulis apa yang telah berubah."
 }