@things-factory/auth-ui 10.1.106 → 10.1.107

package/dist-client/utils/access-request.d.ts

@@ -0,0 +1,49 @@
+export type PrivilegeRequestDetail = {
+    category: string;
+    privilege: string;
+    operationName?: string;
+};
+/**
+ * What a refusal offers to ask for - only a refusal a role would open. Address, license, ownership and
+ * unknown refusals offer nothing: giving a role would not open them.
+ */
+export declare function requestableFrom(extensions: any, operationName?: string): PrivilegeRequestDetail | null;
+type Translate = (key: string, options?: Record<string, unknown>) => string;
+/**
+ * What a privilege lets one do, in the reader's words - the sentence the role screen shows
+ * (`privilege.allows.<category>.<privilege>`), or the name itself when none is written. Never made up.
+ */
+export declare function privilegeWords(t: Translate, category: string, privilege: string): string;
+export type ReviewIssue = {
+    code: string;
+    blocking: boolean;
+    field?: string;
+    params?: Record<string, unknown>;
+};
+/** One review finding as a sentence - `access-request.issue.<code>`, the code itself when the key is missing. */
+export declare function issueWords(t: Translate, issue: ReviewIssue): string;
+export declare const blocks: (issues: ReviewIssue[]) => boolean;
+/** Which buttons a decision popup offers, from the review the server gave. */
+export declare function decisionButtons(grantIssues: ReviewIssue[] | null, denyIssues: ReviewIssue[] | null): {
+    grant: boolean;
+    deny: boolean;
+};
+/** The candidate a popup selects first - the smallest; ties by name, as the server sorts them. */
+export declare function firstCandidate<T extends {
+    name: string;
+    privilegeCount: number;
+}>(candidates: T[]): T | undefined;
+/** How long a denial is shown back before asking again - the server holds the same words against it (auth-base ACCESS_REQUEST_DENIAL_DAYS). */
+export declare const DENIAL_SHOWN_DAYS = 7;
+/** The latest denial of this privilege among the person's own requests, within DENIAL_SHOWN_DAYS. */
+export declare function recentDenial<T extends {
+    state: string;
+    category: string;
+    privilege: string;
+    decidedAt?: string | null;
+}>(mine: T[], category: string, privilege: string, now?: number): T | undefined;
+/** Send is offered only with a reason - and, after a denial, with words other than the denied ones. */
+export declare function maySend(reason: string, denied?: {
+    reason?: string | null;
+}): boolean;
+export {};

package/dist-client/utils/access-request.js

@@ -0,0 +1,67 @@
+/*
+ * The access request on the screen - pure, so the rules are tested without a browser (ADR-0103).
+ *
+ * A refusal's toast gets its button from this package through @operato/layout's registerNotifyAction
+ * (bootstrap.ts) - the toast and @operato/graphql do not know what a refusal means (ADR-0103 decision 5).
+ */
+/**
+ * What a refusal offers to ask for - only a refusal a role would open. Address, license, ownership and
+ * unknown refusals offer nothing: giving a role would not open them.
+ */
+export function requestableFrom(extensions, operationName) {
+    if (!extensions || extensions.code !== 'FORBIDDEN' || extensions.because !== 'role')
+        return null;
+    /*
+     * Only a change the person made (questions Q9 · 4). A page fires several reads as it opens; offering a request on
+     * each would put the button in front of someone who did not choose to do anything yet.
+     */
+    if (extensions.operation !== 'mutation')
+        return null;
+    const requires = extensions.requires;
+    if (!requires || typeof requires !== 'object' || !requires.category || !requires.privilege)
+        return null;
+    return { category: requires.category, privilege: requires.privilege, ...(operationName ? { operationName } : {}) };
+}
+/**
+ * What a privilege lets one do, in the reader's words - the sentence the role screen shows
+ * (`privilege.allows.<category>.<privilege>`), or the name itself when none is written. Never made up.
+ */
+export function privilegeWords(t, category, privilege) {
+    return t(`privilege.allows.${category}.${privilege}`, { defaultValue: '' }) || `${category}:${privilege}`;
+}
+/** One review finding as a sentence - `access-request.issue.<code>`, the code itself when the key is missing. */
+export function issueWords(t, issue) {
+    const params = { ...(issue.params || {}) };
+    if (typeof params.state === 'string')
+        params.state = t(`access-request.state.${String(params.state).toLowerCase()}`, { defaultValue: String(params.state) });
+    return t(`access-request.issue.${issue.code}`, { ...params, defaultValue: issue.code });
+}
+export const blocks = (issues) => issues.some(issue => issue.blocking);
+/** Which buttons a decision popup offers, from the review the server gave. */
+export function decisionButtons(grantIssues, denyIssues) {
+    return {
+        grant: !!grantIssues && !blocks(grantIssues),
+        deny: !!denyIssues && !blocks(denyIssues)
+    };
+}
+/** The candidate a popup selects first - the smallest; ties by name, as the server sorts them. */
+export function firstCandidate(candidates) {
+    return [...(candidates || [])].sort((a, b) => a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0];
+}
+/** How long a denial is shown back before asking again - the server holds the same words against it (auth-base ACCESS_REQUEST_DENIAL_DAYS). */
+export const DENIAL_SHOWN_DAYS = 7;
+/** The latest denial of this privilege among the person's own requests, within DENIAL_SHOWN_DAYS. */
+export function recentDenial(mine, category, privilege, now = Date.now()) {
+    return (mine || [])
+        .filter(r => r.state === 'DENIED' && r.category === category && r.privilege === privilege && r.decidedAt)
+        .filter(r => now - new Date(r.decidedAt).getTime() <= DENIAL_SHOWN_DAYS * 24 * 60 * 60 * 1000)
+        .sort((a, b) => new Date(b.decidedAt).getTime() - new Date(a.decidedAt).getTime())[0];
+}
+/** Send is offered only with a reason - and, after a denial, with words other than the denied ones. */
+export function maySend(reason, denied) {
+    const said = (reason || '').trim();
+    if (!said)
+        return false;
+    return !(denied && (denied.reason || '').trim() === said);
+}
+//# sourceMappingURL=access-request.js.map

package/dist-client/utils/access-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request.js","sourceRoot":"","sources":["../../client/utils/access-request.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAe,EAAE,aAAsB;IACrE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAChG;;;OAGG;IACH,IAAI,UAAU,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAA;IACpC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IACvG,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AACpH,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAY,EAAE,QAAgB,EAAE,SAAiB;IAC9E,OAAO,CAAC,CAAC,oBAAoB,QAAQ,IAAI,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;AAC3G,CAAC;AAID,iHAAiH;AACjH,MAAM,UAAU,UAAU,CAAC,CAAY,EAAE,KAAkB;IACzD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAA;IAC1C,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC5J,OAAO,CAAC,CAAC,wBAAwB,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;AAErF,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,WAAiC,EAAE,UAAgC;IACjG,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC5C,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,cAAc,CAAqD,UAAe;IAChG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACvH,CAAC;AAED,+IAA+I;AAC/I,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAElC,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAC1B,IAAS,EACT,QAAgB,EAChB,SAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;SACxG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAmB,CAAC,CAAC,OAAO,EAAE,IAAI,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACvG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAmB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7G,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,MAAmC;IACzE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAA;AAC3D,CAAC","sourcesContent":["/*\n * The access request on the screen - pure, so the rules are tested without a browser (ADR-0103).\n *\n * A refusal's toast gets its button from this package through @operato/layout's registerNotifyAction\n * (bootstrap.ts) - the toast and @operato/graphql do not know what a refusal means (ADR-0103 decision 5).\n */\n\nexport type PrivilegeRequestDetail = { category: string; privilege: string; operationName?: string }\n\n/**\n * What a refusal offers to ask for - only a refusal a role would open. Address, license, ownership and\n * unknown refusals offer nothing: giving a role would not open them.\n */\nexport function requestableFrom(extensions: any, operationName?: string): PrivilegeRequestDetail | null {\n  if (!extensions || extensions.code !== 'FORBIDDEN' || extensions.because !== 'role') return null\n  /*\n   * Only a change the person made (questions Q9 · 4). A page fires several reads as it opens; offering a request on\n   * each would put the button in front of someone who did not choose to do anything yet.\n   */\n  if (extensions.operation !== 'mutation') return null\n  const requires = extensions.requires\n  if (!requires || typeof requires !== 'object' || !requires.category || !requires.privilege) return null\n  return { category: requires.category, privilege: requires.privilege, ...(operationName ? { operationName } : {}) }\n}\n\ntype Translate = (key: string, options?: Record<string, unknown>) => string\n\n/**\n * What a privilege lets one do, in the reader's words - the sentence the role screen shows\n * (`privilege.allows.<category>.<privilege>`), or the name itself when none is written. Never made up.\n */\nexport function privilegeWords(t: Translate, category: string, privilege: string): string {\n  return t(`privilege.allows.${category}.${privilege}`, { defaultValue: '' }) || `${category}:${privilege}`\n}\n\nexport type ReviewIssue = { code: string; blocking: boolean; field?: string; params?: Record<string, unknown> }\n\n/** One review finding as a sentence - `access-request.issue.<code>`, the code itself when the key is missing. */\nexport function issueWords(t: Translate, issue: ReviewIssue): string {\n  const params = { ...(issue.params || {}) }\n  if (typeof params.state === 'string') params.state = t(`access-request.state.${String(params.state).toLowerCase()}`, { defaultValue: String(params.state) })\n  return t(`access-request.issue.${issue.code}`, { ...params, defaultValue: issue.code })\n}\n\nexport const blocks = (issues: ReviewIssue[]) => issues.some(issue => issue.blocking)\n\n/** Which buttons a decision popup offers, from the review the server gave. */\nexport function decisionButtons(grantIssues: ReviewIssue[] | null, denyIssues: ReviewIssue[] | null) {\n  return {\n    grant: !!grantIssues && !blocks(grantIssues),\n    deny: !!denyIssues && !blocks(denyIssues)\n  }\n}\n\n/** The candidate a popup selects first - the smallest; ties by name, as the server sorts them. */\nexport function firstCandidate<T extends { name: string; privilegeCount: number }>(candidates: T[]): T | undefined {\n  return [...(candidates || [])].sort((a, b) => a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0]\n}\n\n/** How long a denial is shown back before asking again - the server holds the same words against it (auth-base ACCESS_REQUEST_DENIAL_DAYS). */\nexport const DENIAL_SHOWN_DAYS = 7\n\n/** The latest denial of this privilege among the person's own requests, within DENIAL_SHOWN_DAYS. */\nexport function recentDenial<T extends { state: string; category: string; privilege: string; decidedAt?: string | null }>(\n  mine: T[],\n  category: string,\n  privilege: string,\n  now = Date.now()\n): T | undefined {\n  return (mine || [])\n    .filter(r => r.state === 'DENIED' && r.category === category && r.privilege === privilege && r.decidedAt)\n    .filter(r => now - new Date(r.decidedAt as string).getTime() <= DENIAL_SHOWN_DAYS * 24 * 60 * 60 * 1000)\n    .sort((a, b) => new Date(b.decidedAt as string).getTime() - new Date(a.decidedAt as string).getTime())[0]\n}\n\n/** Send is offered only with a reason - and, after a denial, with words other than the denied ones. */\nexport function maySend(reason: string, denied?: { reason?: string | null }): boolean {\n  const said = (reason || '').trim()\n  if (!said) return false\n  return !(denied && (denied.reason || '').trim() === said)\n}\n"]}

package/dist-client/utils/access-request.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/access-request.test.js

@@ -0,0 +1,70 @@
+import { blocks, decisionButtons, firstCandidate, issueWords, maySend, privilegeWords, recentDenial, requestableFrom } from './access-request';
+/**
+ * The access request on the screen (ADR-0103). The refusal says why; only a missing role offers a request.
+ */
+const ROLE = { code: 'FORBIDDEN', requires: { category: 'warehouse', privilege: 'mutation' }, because: 'role', operation: 'mutation' };
+describe('what a refusal offers to ask for', () => {
+    it('★ a refusal a role would open - the privilege it named', () => {
+        expect(requestableFrom(ROLE, 'updateInboundPlan')).toEqual({ category: 'warehouse', privilege: 'mutation', operationName: 'updateInboundPlan' });
+    });
+    it('★ address, license, ownership and unknown offer nothing - a role would not open them', () => {
+        for (const because of ['address', 'license', 'ownership', 'unknown']) {
+            expect(requestableFrom({ ...ROLE, because })).toBeNull();
+        }
+    });
+    it('★ a read the page fired offers nothing - only a change the person made (Q9)', () => {
+        expect(requestableFrom({ ...ROLE, operation: 'query' })).toBeNull();
+        expect(requestableFrom({ ...ROLE, operation: 'subscription' })).toBeNull();
+        expect(requestableFrom({ ...ROLE, operation: undefined })).toBeNull();
+    });
+    it('a refusal from before the cause was carried offers nothing - it is not guessed', () => {
+        expect(requestableFrom({ code: 'FORBIDDEN', requires: ROLE.requires })).toBeNull();
+    });
+    it('ownership-only and other errors offer nothing', () => {
+        expect(requestableFrom({ ...ROLE, requires: 'ownership' })).toBeNull();
+        expect(requestableFrom({ code: 'BAD_USER_INPUT' })).toBeNull();
+        expect(requestableFrom(undefined)).toBeNull();
+    });
+});
+describe('words', () => {
+    const t = (key, options = {}) => (key === 'privilege.allows.warehouse.mutation' ? '창고 기록을 바꿀 수 있습니다.' : options.defaultValue);
+    it('★ the sentence the role screen writes, or the name - never a key', () => {
+        expect(privilegeWords(t, 'warehouse', 'mutation')).toBe('창고 기록을 바꿀 수 있습니다.');
+        expect(privilegeWords(t, 'board', 'query')).toBe('board:query');
+    });
+    it('an issue without a sentence shows its code, not the key', () => {
+        expect(issueWords(t, { code: 'own-request', blocking: true })).toBe('own-request');
+    });
+});
+describe('the decision buttons', () => {
+    it('★ a blocking finding takes the button away; a warning does not', () => {
+        expect(decisionButtons([{ code: 'role-grants-more', blocking: false }], [{ code: 'deny-needs-reason', blocking: true }])).toEqual({ grant: true, deny: false });
+        expect(decisionButtons([{ code: 'role-does-not-grant', blocking: true }], [])).toEqual({ grant: false, deny: true });
+        expect(decisionButtons(null, [])).toEqual({ grant: false, deny: true });
+        expect(blocks([])).toBe(false);
+    });
+    it('the smallest role first, ties by name', () => {
+        expect(firstCandidate([{ name: 'b', privilegeCount: 1 }, { name: 'a', privilegeCount: 1 }, { name: 'c', privilegeCount: 0 }])?.name).toBe('c');
+    });
+});
+describe('asking is not a reflex (Q9)', () => {
+    const NOW = new Date('2026-10-02T09:00:00Z').getTime();
+    const mine = [
+        { state: 'DENIED', category: 'warehouse', privilege: 'mutation', decidedAt: '2026-09-30T09:00:00Z', reason: 'inbound', decisionReason: 'IT only' },
+        { state: 'DENIED', category: 'warehouse', privilege: 'mutation', decidedAt: '2026-09-01T09:00:00Z', reason: 'old', decisionReason: 'old' },
+        { state: 'DENIED', category: 'board', privilege: 'mutation', decidedAt: '2026-10-01T09:00:00Z', reason: 'x', decisionReason: 'y' }
+    ];
+    it('★ the latest denial of the same privilege within seven days is shown back', () => {
+        expect(recentDenial(mine, 'warehouse', 'mutation', NOW)?.decisionReason).toBe('IT only');
+        expect(recentDenial(mine, 'warehouse', 'query', NOW)).toBeUndefined();
+        expect(recentDenial(mine.slice(1, 2), 'warehouse', 'mutation', NOW)).toBeUndefined();
+    });
+    it('★ send needs a reason, and after a denial other words than the denied ones', () => {
+        expect(maySend('')).toBe(false);
+        expect(maySend('   ')).toBe(false);
+        expect(maySend('inbound')).toBe(true);
+        expect(maySend('inbound', { reason: 'inbound' })).toBe(false);
+        expect(maySend('moved to inbound', { reason: 'inbound' })).toBe(true);
+    });
+});
+//# sourceMappingURL=access-request.test.js.map

package/dist-client/utils/access-request.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request.test.js","sourceRoot":"","sources":["../../client/utils/access-request.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAE9I;;GAEG;AAEH,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AAEtI,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAClJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,KAAK,MAAM,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QACnE,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC1E,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QACtE,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC9D,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;IACrB,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,UAAe,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1I,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5E,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/J,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACpH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAA;IACtD,MAAM,IAAI,GAAG;QACX,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;QAClJ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;QAC1I,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE;KACnI,CAAA;IAED,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACxF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QACrE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7D,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { blocks, decisionButtons, firstCandidate, issueWords, maySend, privilegeWords, recentDenial, requestableFrom } from './access-request'\n\n/**\n * The access request on the screen (ADR-0103). The refusal says why; only a missing role offers a request.\n */\n\nconst ROLE = { code: 'FORBIDDEN', requires: { category: 'warehouse', privilege: 'mutation' }, because: 'role', operation: 'mutation' }\n\ndescribe('what a refusal offers to ask for', () => {\n  it('★ a refusal a role would open - the privilege it named', () => {\n    expect(requestableFrom(ROLE, 'updateInboundPlan')).toEqual({ category: 'warehouse', privilege: 'mutation', operationName: 'updateInboundPlan' })\n  })\n\n  it('★ address, license, ownership and unknown offer nothing - a role would not open them', () => {\n    for (const because of ['address', 'license', 'ownership', 'unknown']) {\n      expect(requestableFrom({ ...ROLE, because })).toBeNull()\n    }\n  })\n\n  it('★ a read the page fired offers nothing - only a change the person made (Q9)', () => {\n    expect(requestableFrom({ ...ROLE, operation: 'query' })).toBeNull()\n    expect(requestableFrom({ ...ROLE, operation: 'subscription' })).toBeNull()\n    expect(requestableFrom({ ...ROLE, operation: undefined })).toBeNull()\n  })\n\n  it('a refusal from before the cause was carried offers nothing - it is not guessed', () => {\n    expect(requestableFrom({ code: 'FORBIDDEN', requires: ROLE.requires })).toBeNull()\n  })\n\n  it('ownership-only and other errors offer nothing', () => {\n    expect(requestableFrom({ ...ROLE, requires: 'ownership' })).toBeNull()\n    expect(requestableFrom({ code: 'BAD_USER_INPUT' })).toBeNull()\n    expect(requestableFrom(undefined)).toBeNull()\n  })\n})\n\ndescribe('words', () => {\n  const t = (key: string, options: any = {}) => (key === 'privilege.allows.warehouse.mutation' ? '창고 기록을 바꿀 수 있습니다.' : options.defaultValue)\n\n  it('★ the sentence the role screen writes, or the name - never a key', () => {\n    expect(privilegeWords(t, 'warehouse', 'mutation')).toBe('창고 기록을 바꿀 수 있습니다.')\n    expect(privilegeWords(t, 'board', 'query')).toBe('board:query')\n  })\n\n  it('an issue without a sentence shows its code, not the key', () => {\n    expect(issueWords(t, { code: 'own-request', blocking: true })).toBe('own-request')\n  })\n})\n\ndescribe('the decision buttons', () => {\n  it('★ a blocking finding takes the button away; a warning does not', () => {\n    expect(decisionButtons([{ code: 'role-grants-more', blocking: false }], [{ code: 'deny-needs-reason', blocking: true }])).toEqual({ grant: true, deny: false })\n    expect(decisionButtons([{ code: 'role-does-not-grant', blocking: true }], [])).toEqual({ grant: false, deny: true })\n    expect(decisionButtons(null, [])).toEqual({ grant: false, deny: true })\n    expect(blocks([])).toBe(false)\n  })\n\n  it('the smallest role first, ties by name', () => {\n    expect(firstCandidate([{ name: 'b', privilegeCount: 1 }, { name: 'a', privilegeCount: 1 }, { name: 'c', privilegeCount: 0 }])?.name).toBe('c')\n  })\n})\n\ndescribe('asking is not a reflex (Q9)', () => {\n  const NOW = new Date('2026-10-02T09:00:00Z').getTime()\n  const mine = [\n    { state: 'DENIED', category: 'warehouse', privilege: 'mutation', decidedAt: '2026-09-30T09:00:00Z', reason: 'inbound', decisionReason: 'IT only' },\n    { state: 'DENIED', category: 'warehouse', privilege: 'mutation', decidedAt: '2026-09-01T09:00:00Z', reason: 'old', decisionReason: 'old' },\n    { state: 'DENIED', category: 'board', privilege: 'mutation', decidedAt: '2026-10-01T09:00:00Z', reason: 'x', decisionReason: 'y' }\n  ]\n\n  it('★ the latest denial of the same privilege within seven days is shown back', () => {\n    expect(recentDenial(mine, 'warehouse', 'mutation', NOW)?.decisionReason).toBe('IT only')\n    expect(recentDenial(mine, 'warehouse', 'query', NOW)).toBeUndefined()\n    expect(recentDenial(mine.slice(1, 2), 'warehouse', 'mutation', NOW)).toBeUndefined()\n  })\n\n  it('★ send needs a reason, and after a denial other words than the denied ones', () => {\n    expect(maySend('')).toBe(false)\n    expect(maySend('   ')).toBe(false)\n    expect(maySend('inbound')).toBe(true)\n    expect(maySend('inbound', { reason: 'inbound' })).toBe(false)\n    expect(maySend('moved to inbound', { reason: 'inbound' })).toBe(true)\n  })\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-ui",
-  "version": "10.1.106",
+  "version": "10.1.107",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -31,7 +31,7 @@
     "@operato/attribute": "^10.0.0",
     "@operato/data-grist": "^10.19.0",
     "@operato/i18n": "^10.0.0",
-    "@operato/layout": "^10.26.0",
+    "@operato/layout": "^10.29.5",
     "@operato/list-state": "^10.15.0",
     "@operato/lottie-player": "^10.0.0",
     "@operato/moment-timezone-es": "^10.0.0",
@@ -39,11 +39,11 @@
     "@operato/popup": "^10.15.0",
     "@operato/shell": "^10.29.2",
     "@operato/styles": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.106",
-    "@things-factory/component-ui": "^10.1.106",
+    "@things-factory/auth-base": "^10.1.107",
+    "@things-factory/component-ui": "^10.1.107",
     "@things-factory/more-base": "^10.1.106",
     "base64url": "^3.0.1",
     "clipboard": "^2.0.6"
   },
-  "gitHead": "8d78c14708420773ec32d18b8dd44c300771c44d"
+  "gitHead": "65a3d5889e687d8122a65f029b926b1a4769d1c0"
 }

package/things-factory.config.js

@@ -18,7 +18,9 @@ export default {
     { tagname: 'env-var-list-page', page: 'env-vars' },
     { tagname: 'attribute-set-management', page: 'attributes' },
     { tagname: 'auth-provider-management', page: 'auth-providers' },
-    { tagname: 'domain-link-management', page: 'domain-links' }
+    { tagname: 'domain-link-management', page: 'domain-links' },
+    { tagname: 'access-requests-page', page: 'access-requests' },
+    { tagname: 'my-access-requests-page', page: 'my-access-requests' }
   ],
   bootstrap
 }

package/translations/en.json

@@ -349,5 +349,65 @@
   "title.secure-ip-list": "secured IP list",
   "title.sign in": "sign in",
   "title.sign up": "sign up",
-  "title.unlock account": "unlock account"
+  "title.unlock account": "unlock account",
+  "access-request.title.access requests": "access requests",
+  "access-request.title.my access requests": "my access requests",
+  "access-request.title.decide": "decide the access request",
+  "access-request.title.request access": "request access",
+  "access-request.text.refused at": "refused at: {operation}",
+  "access-request.text.already waiting": "a request is already waiting (last asked {at}). sending adds to it.",
+  "access-request.text.sent": "sent to the people who decide access.",
+  "access-request.text.added to waiting": "added to the request already waiting.",
+  "access-request.text.who asks": "{name} asks for",
+  "access-request.text.grant with role": "grant by putting them into a role",
+  "access-request.text.no role grants it": "no role in this domain grants it. add it to a role on the role screen first.",
+  "access-request.text.privilege count": "{count} privileges",
+  "access-request.field.reason": "why it is needed",
+  "access-request.field.deny reason": "reason to deny",
+  "access-request.field.requester": "requester",
+  "access-request.field.needed": "needed",
+  "access-request.field.count": "times",
+  "access-request.field.decided by": "decided by",
+  "access-request.field.granted role": "role given",
+  "access-request.field.decision reason": "reason",
+  "access-request.field.decided at": "decided at",
+  "access-request.button.send": "send",
+  "access-request.button.grant": "grant",
+  "access-request.button.deny": "deny",
+  "access-request.button.decide": "decide",
+  "access-request.button.withdraw": "withdraw the request",
+  "access-request.state.pending": "waiting",
+  "access-request.state.granted": "granted",
+  "access-request.state.denied": "denied",
+  "access-request.state.withdrawn": "withdrawn",
+  "access-request.state.expired": "expired",
+  "access-request.issue.access-request-not-found": "the request is not found in this domain.",
+  "access-request.issue.request-not-pending": "this request is already {state}.",
+  "access-request.issue.own-request": "you cannot decide your own request.",
+  "access-request.issue.requester-unavailable": "the requester is locked, inactive or no longer in this domain.",
+  "access-request.issue.deny-needs-reason": "write why it is denied.",
+  "access-request.issue.already-holds": "the requester already has it - through another role.",
+  "access-request.issue.role-required": "choose a role.",
+  "access-request.issue.role-not-assignable": "this domain cannot assign that role.",
+  "access-request.issue.role-does-not-grant": "{role} does not hold {privilege}.",
+  "access-request.issue.role-grants-more": "{role} also gives {count} more: {privileges}",
+  "access-request.issue.role-grants-admin": "{role} lets them give roles to others.",
+  "access-request.issue.smaller-role-exists": "a smaller role grants it too: {role} ({count} privileges)",
+  "access-request.issue.decider-lacks-it": "you are giving what you do not have yourself: {privileges}",
+  "access-request.issue.denied-before": "denied before by {by} ({at}): {reason}",
+  "access-request.title.decision draft": "access decision draft",
+  "access-request.title.request draft": "access request draft",
+  "access-request.field.request": "request",
+  "access-request.field.decision": "decision",
+  "access-request.field.category": "category",
+  "access-request.field.privilege": "privilege",
+  "access-request.decision.grant": "grant",
+  "access-request.decision.deny": "deny",
+  "access-request.issue.not-by-role": "a role would not open this here ({because}).",
+  "access-request.dock.mode": "access requests",
+  "access-request.dock.placeholder": "e.g. sort out today's access requests",
+  "access-request.text.recorded and told": "the request is recorded and {count} people who decide access are told.",
+  "access-request.text.nobody to tell": "nobody in this domain decides access requests, so it cannot be sent. ask your administrator directly.",
+  "access-request.text.denied lately": "denied on {at}: {reason}. to ask again, write what has changed.",
+  "access-request.button.request": "request access…"
 }

package/translations/ja.json

@@ -349,5 +349,65 @@
   "text.x on": "{x}件オン",
   "text.x people hold this role": "このロールを持つ人 {x}名",
   "title.add domain owner": "$t(term.domain)のオーナーを追加",
-  "title.role privileges": "ロールの権限"
+  "title.role privileges": "ロールの権限",
+  "access-request.title.access requests": "権限リクエスト",
+  "access-request.title.my access requests": "自分の権限リクエスト",
+  "access-request.title.decide": "権限リクエストの決定",
+  "access-request.title.request access": "権限をリクエスト",
+  "access-request.text.refused at": "止まった操作: {operation}",
+  "access-request.text.already waiting": "すでに送ったリクエストがあります(最終 {at})。送るとそのリクエストに追加されます。",
+  "access-request.text.sent": "権限を決める人に送りました。",
+  "access-request.text.added to waiting": "送信済みのリクエストに追加しました。",
+  "access-request.text.who asks": "{name} さんのリクエスト",
+  "access-request.text.grant with role": "ロールに追加して付与",
+  "access-request.text.no role grants it": "この権限を与えるロールがありません。先にロール画面でロールに追加してください。",
+  "access-request.text.privilege count": "権限 {count} 件",
+  "access-request.field.reason": "必要な理由",
+  "access-request.field.deny reason": "拒否の理由",
+  "access-request.field.requester": "リクエスト者",
+  "access-request.field.needed": "必要なもの",
+  "access-request.field.count": "回数",
+  "access-request.field.decided by": "決定者",
+  "access-request.field.granted role": "付与したロール",
+  "access-request.field.decision reason": "理由",
+  "access-request.field.decided at": "決定日時",
+  "access-request.button.send": "送信",
+  "access-request.button.grant": "付与",
+  "access-request.button.deny": "拒否",
+  "access-request.button.decide": "決定",
+  "access-request.button.withdraw": "リクエストを取り下げる",
+  "access-request.state.pending": "保留中",
+  "access-request.state.granted": "付与済み",
+  "access-request.state.denied": "拒否",
+  "access-request.state.withdrawn": "取り下げ",
+  "access-request.state.expired": "期限切れ",
+  "access-request.issue.access-request-not-found": "この$t(term.domain)にリクエストがありません。",
+  "access-request.issue.request-not-pending": "このリクエストはすでに{state}です。",
+  "access-request.issue.own-request": "自分のリクエストは決定できません。",
+  "access-request.issue.requester-unavailable": "リクエスト者がロック中、無効、またはこの$t(term.domain)にいません。",
+  "access-request.issue.deny-needs-reason": "拒否の理由を書いてください。",
+  "access-request.issue.already-holds": "リクエスト者はすでに別のロールでその権限を持っています。",
+  "access-request.issue.role-required": "ロールを選んでください。",
+  "access-request.issue.role-not-assignable": "この$t(term.domain)では付与できないロールです。",
+  "access-request.issue.role-does-not-grant": "{role} には {privilege} 権限がありません。",
+  "access-request.issue.role-grants-more": "{role} は要求以外に {count} 件を与えます: {privileges}",
+  "access-request.issue.role-grants-admin": "{role} を持つと他の人にロールを与えられるようになります。",
+  "access-request.issue.smaller-role-exists": "より小さいロールもこの権限を与えます: {role}(権限 {count} 件)",
+  "access-request.issue.decider-lacks-it": "自分にない権限を与えることになります: {privileges}",
+  "access-request.issue.denied-before": "以前に拒否されています — {by}、{at}: {reason}",
+  "access-request.title.decision draft": "権限リクエストの決定案",
+  "access-request.title.request draft": "権限リクエスト案",
+  "access-request.field.request": "リクエスト",
+  "access-request.field.decision": "決定",
+  "access-request.field.category": "カテゴリー",
+  "access-request.field.privilege": "権限",
+  "access-request.decision.grant": "付与",
+  "access-request.decision.deny": "拒否",
+  "access-request.issue.not-by-role": "ここではロールで開けない権限です({because})。",
+  "access-request.dock.mode": "権限リクエスト",
+  "access-request.dock.placeholder": "例: 今日届いた権限リクエストを整理して",
+  "access-request.text.recorded and told": "このリクエストは記録され、権限を決める管理者 {count} 名に通知されます。",
+  "access-request.text.nobody to tell": "この$t(term.domain)には権限を決める管理者がいないため送信できません。管理者に直接問い合わせてください。",
+  "access-request.text.denied lately": "{at} に拒否されました: {reason}。再度リクエストするには、何が変わったかを書いてください。",
+  "access-request.button.request": "権限をリクエスト…"
 }

package/translations/ko.json

@@ -349,5 +349,65 @@
   "title.secure-ip-list": "보안 IP 리스트",
   "title.sign in": "로그인",
   "title.sign up": "사용자 등록",
-  "title.unlock account": "계정 잠금 해제"
+  "title.unlock account": "계정 잠금 해제",
+  "access-request.title.access requests": "권한 요청",
+  "access-request.title.my access requests": "내 권한 요청",
+  "access-request.title.decide": "권한 요청 결정",
+  "access-request.title.request access": "권한 요청",
+  "access-request.text.refused at": "막힌 일: {operation}",
+  "access-request.text.already waiting": "이미 보낸 요청이 있습니다(마지막 {at}). 보내면 그 요청에 더해집니다.",
+  "access-request.text.sent": "권한을 정하는 사람에게 보냈습니다.",
+  "access-request.text.added to waiting": "이미 보낸 요청에 더했습니다.",
+  "access-request.text.who asks": "{name} 님의 요청",
+  "access-request.text.grant with role": "역할에 더해서 부여",
+  "access-request.text.no role grants it": "이 권한을 주는 역할이 없습니다. 역할 화면에서 먼저 역할에 더하세요.",
+  "access-request.text.privilege count": "권한 {count}개",
+  "access-request.field.reason": "필요한 까닭",
+  "access-request.field.deny reason": "거부 까닭",
+  "access-request.field.requester": "요청자",
+  "access-request.field.needed": "필요한 것",
+  "access-request.field.count": "횟수",
+  "access-request.field.decided by": "정한 사람",
+  "access-request.field.granted role": "준 역할",
+  "access-request.field.decision reason": "까닭",
+  "access-request.field.decided at": "정한 시각",
+  "access-request.button.send": "보내기",
+  "access-request.button.grant": "부여",
+  "access-request.button.deny": "거부",
+  "access-request.button.decide": "결정",
+  "access-request.button.withdraw": "요청 거두기",
+  "access-request.state.pending": "기다림",
+  "access-request.state.granted": "부여됨",
+  "access-request.state.denied": "거부됨",
+  "access-request.state.withdrawn": "거둠",
+  "access-request.state.expired": "만료됨",
+  "access-request.issue.access-request-not-found": "이 $t(term.domain)에서 요청을 찾을 수 없습니다.",
+  "access-request.issue.request-not-pending": "이 요청은 이미 {state} 상태입니다.",
+  "access-request.issue.own-request": "자기 요청은 정할 수 없습니다.",
+  "access-request.issue.requester-unavailable": "요청자가 잠겼거나, 비활성이거나, 이 $t(term.domain)에서 빠졌습니다.",
+  "access-request.issue.deny-needs-reason": "거부 까닭을 적으세요.",
+  "access-request.issue.already-holds": "요청자가 이미 그 권한을 가지고 있습니다(다른 역할로).",
+  "access-request.issue.role-required": "역할을 고르세요.",
+  "access-request.issue.role-not-assignable": "이 $t(term.domain)에서 줄 수 없는 역할입니다.",
+  "access-request.issue.role-does-not-grant": "{role} 역할에는 {privilege} 권한이 없습니다.",
+  "access-request.issue.role-grants-more": "{role} 역할은 요청한 것 말고도 {count}개를 더 줍니다: {privileges}",
+  "access-request.issue.role-grants-admin": "{role} 역할을 받으면 남에게 권한을 줄 수 있게 됩니다.",
+  "access-request.issue.smaller-role-exists": "더 작은 역할도 이 권한을 줍니다: {role}(권한 {count}개)",
+  "access-request.issue.decider-lacks-it": "내게 없는 권한을 주게 됩니다: {privileges}",
+  "access-request.issue.denied-before": "전에 거부된 요청입니다 — {by}, {at}: {reason}",
+  "access-request.title.decision draft": "권한 요청 결정안",
+  "access-request.title.request draft": "권한 요청안",
+  "access-request.field.request": "요청",
+  "access-request.field.decision": "결정",
+  "access-request.field.category": "범주",
+  "access-request.field.privilege": "권한",
+  "access-request.decision.grant": "부여",
+  "access-request.decision.deny": "거부",
+  "access-request.issue.not-by-role": "여기서는 역할로 열리지 않는 권한입니다({because}).",
+  "access-request.dock.mode": "권한 요청",
+  "access-request.dock.placeholder": "예: 오늘 들어온 권한 요청 정리해 줘",
+  "access-request.text.recorded and told": "이 요청은 기록되고, 권한을 정하는 관리자 {count}명에게 알림이 갑니다.",
+  "access-request.text.nobody to tell": "이 $t(term.domain)에는 권한을 정할 관리자가 없어 보낼 수 없습니다. 관리자에게 직접 문의하세요.",
+  "access-request.text.denied lately": "{at}에 거부되었습니다: {reason}. 다시 요청하려면 무엇이 달라졌는지 적어 주세요.",
+  "access-request.button.request": "권한 요청…"
 }

package/translations/ms.json

@@ -349,5 +349,65 @@
   "text.x on": "{x} dihidupkan",
   "text.x people hold this role": "dipegang oleh {x}",
   "title.add domain owner": "tambah pemilik $t(term.domain)",
-  "title.role privileges": "keistimewaan peranan"
+  "title.role privileges": "keistimewaan peranan",
+  "access-request.title.access requests": "permintaan akses",
+  "access-request.title.my access requests": "permintaan akses saya",
+  "access-request.title.decide": "putuskan permintaan akses",
+  "access-request.title.request access": "mohon akses",
+  "access-request.text.refused at": "ditolak pada: {operation}",
+  "access-request.text.already waiting": "permintaan sudah menunggu (terakhir {at}). menghantar akan menambah kepadanya.",
+  "access-request.text.sent": "dihantar kepada mereka yang memutuskan akses.",
+  "access-request.text.added to waiting": "ditambah kepada permintaan yang menunggu.",
+  "access-request.text.who asks": "{name} memohon",
+  "access-request.text.grant with role": "berikan dengan memasukkan ke dalam peranan",
+  "access-request.text.no role grants it": "tiada peranan yang memberikannya. tambahkannya pada peranan di skrin peranan dahulu.",
+  "access-request.text.privilege count": "{count} kebenaran",
+  "access-request.field.reason": "sebab ia diperlukan",
+  "access-request.field.deny reason": "sebab menolak",
+  "access-request.field.requester": "peminta",
+  "access-request.field.needed": "yang diperlukan",
+  "access-request.field.count": "kali",
+  "access-request.field.decided by": "diputuskan oleh",
+  "access-request.field.granted role": "peranan diberikan",
+  "access-request.field.decision reason": "sebab",
+  "access-request.field.decided at": "diputuskan pada",
+  "access-request.button.send": "hantar",
+  "access-request.button.grant": "berikan",
+  "access-request.button.deny": "tolak",
+  "access-request.button.decide": "putuskan",
+  "access-request.button.withdraw": "tarik balik permintaan",
+  "access-request.state.pending": "menunggu",
+  "access-request.state.granted": "diberikan",
+  "access-request.state.denied": "ditolak",
+  "access-request.state.withdrawn": "ditarik balik",
+  "access-request.state.expired": "tamat tempoh",
+  "access-request.issue.access-request-not-found": "permintaan tidak ditemui dalam $t(term.domain) ini.",
+  "access-request.issue.request-not-pending": "permintaan ini sudah {state}.",
+  "access-request.issue.own-request": "anda tidak boleh memutuskan permintaan sendiri.",
+  "access-request.issue.requester-unavailable": "peminta dikunci, tidak aktif atau tiada lagi dalam $t(term.domain) ini.",
+  "access-request.issue.deny-needs-reason": "tulis sebab penolakan.",
+  "access-request.issue.already-holds": "peminta sudah memilikinya melalui peranan lain.",
+  "access-request.issue.role-required": "pilih peranan.",
+  "access-request.issue.role-not-assignable": "$t(term.domain) ini tidak boleh memberikan peranan itu.",
+  "access-request.issue.role-does-not-grant": "{role} tidak memegang {privilege}.",
+  "access-request.issue.role-grants-more": "{role} juga memberikan {count} lagi: {privileges}",
+  "access-request.issue.role-grants-admin": "{role} membolehkan mereka memberikan peranan kepada orang lain.",
+  "access-request.issue.smaller-role-exists": "peranan lebih kecil juga memberikannya: {role} ({count} kebenaran)",
+  "access-request.issue.decider-lacks-it": "anda memberikan apa yang anda sendiri tiada: {privileges}",
+  "access-request.issue.denied-before": "pernah ditolak oleh {by} ({at}): {reason}",
+  "access-request.title.decision draft": "draf keputusan akses",
+  "access-request.title.request draft": "draf permintaan akses",
+  "access-request.field.request": "permintaan",
+  "access-request.field.decision": "keputusan",
+  "access-request.field.category": "kategori",
+  "access-request.field.privilege": "kebenaran",
+  "access-request.decision.grant": "berikan",
+  "access-request.decision.deny": "tolak",
+  "access-request.issue.not-by-role": "peranan tidak akan membukanya di sini ({because}).",
+  "access-request.dock.mode": "permintaan akses",
+  "access-request.dock.placeholder": "cth: susun permintaan akses hari ini",
+  "access-request.text.recorded and told": "permintaan ini direkodkan dan {count} orang yang memutuskan akses akan dimaklumkan.",
+  "access-request.text.nobody to tell": "tiada sesiapa dalam $t(term.domain) ini yang memutuskan akses, jadi ia tidak boleh dihantar. hubungi pentadbir anda terus.",
+  "access-request.text.denied lately": "ditolak pada {at}: {reason}. untuk memohon semula, tulis apa yang telah berubah.",
+  "access-request.button.request": "mohon akses…"
 }

package/translations/zh.json

@@ -349,5 +349,65 @@
   "text.x on": "{x} 个开启",
   "text.x people hold this role": "拥有此角色的人:{x}",
   "title.add domain owner": "添加$t(term.domain)所有者",
-  "title.role privileges": "角色权限"
+  "title.role privileges": "角色权限",
+  "access-request.title.access requests": "权限请求",
+  "access-request.title.my access requests": "我的权限请求",
+  "access-request.title.decide": "处理权限请求",
+  "access-request.title.request access": "请求权限",
+  "access-request.text.refused at": "被拒绝的操作: {operation}",
+  "access-request.text.already waiting": "已有待处理的请求(最后 {at})。再次发送会合并到该请求。",
+  "access-request.text.sent": "已发送给负责权限的人。",
+  "access-request.text.added to waiting": "已合并到待处理的请求。",
+  "access-request.text.who asks": "{name} 的请求",
+  "access-request.text.grant with role": "加入角色以授予",
+  "access-request.text.no role grants it": "没有角色包含此权限。请先在角色页面将其加入角色。",
+  "access-request.text.privilege count": "{count} 项权限",
+  "access-request.field.reason": "需要的理由",
+  "access-request.field.deny reason": "拒绝理由",
+  "access-request.field.requester": "请求者",
+  "access-request.field.needed": "所需权限",
+  "access-request.field.count": "次数",
+  "access-request.field.decided by": "处理人",
+  "access-request.field.granted role": "授予的角色",
+  "access-request.field.decision reason": "理由",
+  "access-request.field.decided at": "处理时间",
+  "access-request.button.send": "发送",
+  "access-request.button.grant": "授予",
+  "access-request.button.deny": "拒绝",
+  "access-request.button.decide": "处理",
+  "access-request.button.withdraw": "撤回请求",
+  "access-request.state.pending": "待处理",
+  "access-request.state.granted": "已授予",
+  "access-request.state.denied": "已拒绝",
+  "access-request.state.withdrawn": "已撤回",
+  "access-request.state.expired": "已过期",
+  "access-request.issue.access-request-not-found": "在此$t(term.domain)中找不到该请求。",
+  "access-request.issue.request-not-pending": "该请求已{state}。",
+  "access-request.issue.own-request": "不能处理自己的请求。",
+  "access-request.issue.requester-unavailable": "请求者已被锁定、未激活或不在此$t(term.domain)中。",
+  "access-request.issue.deny-needs-reason": "请填写拒绝理由。",
+  "access-request.issue.already-holds": "请求者已通过其他角色拥有该权限。",
+  "access-request.issue.role-required": "请选择角色。",
+  "access-request.issue.role-not-assignable": "此$t(term.domain)不能分配该角色。",
+  "access-request.issue.role-does-not-grant": "{role} 不包含 {privilege} 权限。",
+  "access-request.issue.role-grants-more": "{role} 还会授予另外 {count} 项: {privileges}",
+  "access-request.issue.role-grants-admin": "获得 {role} 后可以给他人授予角色。",
+  "access-request.issue.smaller-role-exists": "更小的角色也包含此权限: {role}({count} 项权限)",
+  "access-request.issue.decider-lacks-it": "您将授予自己没有的权限: {privileges}",
+  "access-request.issue.denied-before": "之前被拒绝过 — {by}，{at}: {reason}",
+  "access-request.title.decision draft": "权限请求处理草案",
+  "access-request.title.request draft": "权限请求草案",
+  "access-request.field.request": "请求",
+  "access-request.field.decision": "处理",
+  "access-request.field.category": "类别",
+  "access-request.field.privilege": "权限",
+  "access-request.decision.grant": "授予",
+  "access-request.decision.deny": "拒绝",
+  "access-request.issue.not-by-role": "此权限在此无法通过角色开放({because})。",
+  "access-request.dock.mode": "权限请求",
+  "access-request.dock.placeholder": "例如: 整理今天的权限请求",
+  "access-request.text.recorded and told": "此请求会被记录，并通知 {count} 位负责权限的管理员。",
+  "access-request.text.nobody to tell": "此$t(term.domain)没有负责权限的管理员，无法发送。请直接联系管理员。",
+  "access-request.text.denied lately": "已于 {at} 被拒绝: {reason}。如需再次请求，请写明有何变化。",
+  "access-request.button.request": "请求权限…"
 }