@things-factory/auth-ui 10.1.192 → 10.1.198

package/dist-client/utils/audit-words.d.ts

@@ -0,0 +1,30 @@
+/**
+ * How the audit screen says what an audit row holds (ADR-0141 §6). The rows hold codes; the screen
+ * shows words. Pure, so the words are tested without a screen.
+ */
+type Translate = (key: string, options?: Record<string, unknown>) => string;
+export interface AuditActionRow {
+    kind: string;
+    door?: string | null;
+    decision?: string | null;
+    outcome?: string | null;
+    code?: string | null;
+    count?: number | null;
+    objectId?: string | null;
+    detail?: Record<string, unknown> | null;
+}
+/** The door in words: the category's name and the declared axis - `payroll:query` → 「급여 query」. */
+export declare function doorWords(t: Translate, door?: string | null): string;
+/** One action in words, with how many times when more than once. */
+export declare function actionWords(t: Translate, action: AuditActionRow): string;
+/**
+ * A request's actions in one line - refusals and errors first, then events, then the doors passed.
+ * A door passed and its result say the same thing twice, so only an error result is shown.
+ */
+export declare function recordWords(t: Translate, actions: AuditActionRow[]): string;
+/** The last `days` days up to `now`. */
+export declare function lastDays(days: number, now?: Date): {
+    from: Date;
+    to: Date;
+};
+export {};

package/dist-client/utils/audit-words.js

@@ -0,0 +1,57 @@
+/**
+ * How the audit screen says what an audit row holds (ADR-0141 §6). The rows hold codes; the screen
+ * shows words. Pure, so the words are tested without a screen.
+ */
+/** The door in words: the category's name and the declared axis - `payroll:query` → 「급여 query」. */
+export function doorWords(t, door) {
+    if (!door)
+        return '';
+    if (!door.includes(':')) {
+        return door
+            .split('+')
+            .map(part => t(`audit.door.${part}`, { defaultValue: part }))
+            .join(' · ');
+    }
+    const [category, privilege] = door.split(':');
+    return `${t(`privilege.category.${category}`, { defaultValue: category })} ${privilege}`;
+}
+function statusWords(t, status) {
+    return t(`label.${status}-user`, { defaultValue: String(status ?? '') });
+}
+/** One action in words, with how many times when more than once. */
+export function actionWords(t, action) {
+    const times = (action.count ?? 1) > 1 ? ` ×${action.count}` : '';
+    if (action.kind === 'door.check') {
+        const refused = action.decision === 'denied' ? ` ${t('audit.outcome.denied')}` : '';
+        return `${doorWords(t, action.door)}${refused}${times}`;
+    }
+    if (action.kind === 'door.result') {
+        return action.outcome === 'error' ? `${doorWords(t, action.door)} ${t('audit.outcome.error')}${times}` : '';
+    }
+    const kind = t(`audit.kind.${action.kind}`, { defaultValue: action.kind });
+    const failed = action.outcome === 'error' ? ` ${t('audit.outcome.failed')}` : '';
+    const change = action.kind === 'user.status' && action.detail
+        ? ` ${statusWords(t, action.detail.from)} → ${statusWords(t, action.detail.to)}`
+        : '';
+    return `${kind}${change}${failed}${times}`;
+}
+/**
+ * A request's actions in one line - refusals and errors first, then events, then the doors passed.
+ * A door passed and its result say the same thing twice, so only an error result is shown.
+ */
+export function recordWords(t, actions) {
+    const weight = (action) => action.decision === 'denied' || action.outcome === 'error' ? 0 : action.kind.startsWith('door.') ? 2 : 1;
+    return [...actions]
+        .sort((a, b) => weight(a) - weight(b))
+        .map(action => actionWords(t, action))
+        .filter(Boolean)
+        .join(', ');
+}
+/** The last `days` days up to `now`. */
+export function lastDays(days, now = new Date()) {
+    const from = new Date(now);
+    from.setHours(0, 0, 0, 0);
+    from.setDate(from.getDate() - (days - 1));
+    return { from, to: now };
+}
+//# sourceMappingURL=audit-words.js.map

package/dist-client/utils/audit-words.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-words.js","sourceRoot":"","sources":["../../client/utils/audit-words.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,CAAY,EAAE,IAAoB;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI;aACR,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5D,IAAI,CAAC,KAAK,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7C,OAAO,GAAG,CAAC,CAAC,sBAAsB,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,IAAI,SAAS,EAAE,CAAA;AAC1F,CAAC;AAED,SAAS,WAAW,CAAC,CAAY,EAAE,MAAe;IAChD,OAAO,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,MAAsB;IAC9D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAEhE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM;QAC5C,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAChF,CAAC,CAAC,EAAE,CAAA;IACR,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,EAAE,CAAA;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,OAAyB;IACjE,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAE,EAAE,CACxC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1G,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;SACrC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;SACrC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;AAC1B,CAAC","sourcesContent":["/**\n * How the audit screen says what an audit row holds (ADR-0141 §6). The rows hold codes; the screen\n * shows words. Pure, so the words are tested without a screen.\n */\n\ntype Translate = (key: string, options?: Record<string, unknown>) => string\n\nexport interface AuditActionRow {\n  kind: string\n  door?: string | null\n  decision?: string | null\n  outcome?: string | null\n  code?: string | null\n  count?: number | null\n  objectId?: string | null\n  detail?: Record<string, unknown> | null\n}\n\n/** The door in words: the category's name and the declared axis - `payroll:query` → 「급여 query」. */\nexport function doorWords(t: Translate, door?: string | null): string {\n  if (!door) return ''\n  if (!door.includes(':')) {\n    return door\n      .split('+')\n      .map(part => t(`audit.door.${part}`, { defaultValue: part }))\n      .join(' · ')\n  }\n  const [category, privilege] = door.split(':')\n  return `${t(`privilege.category.${category}`, { defaultValue: category })} ${privilege}`\n}\n\nfunction statusWords(t: Translate, status: unknown) {\n  return t(`label.${status}-user`, { defaultValue: String(status ?? '') })\n}\n\n/** One action in words, with how many times when more than once. */\nexport function actionWords(t: Translate, action: AuditActionRow): string {\n  const times = (action.count ?? 1) > 1 ? ` ×${action.count}` : ''\n\n  if (action.kind === 'door.check') {\n    const refused = action.decision === 'denied' ? ` ${t('audit.outcome.denied')}` : ''\n    return `${doorWords(t, action.door)}${refused}${times}`\n  }\n  if (action.kind === 'door.result') {\n    return action.outcome === 'error' ? `${doorWords(t, action.door)} ${t('audit.outcome.error')}${times}` : ''\n  }\n\n  const kind = t(`audit.kind.${action.kind}`, { defaultValue: action.kind })\n  const failed = action.outcome === 'error' ? ` ${t('audit.outcome.failed')}` : ''\n  const change =\n    action.kind === 'user.status' && action.detail\n      ? ` ${statusWords(t, action.detail.from)} → ${statusWords(t, action.detail.to)}`\n      : ''\n  return `${kind}${change}${failed}${times}`\n}\n\n/**\n * A request's actions in one line - refusals and errors first, then events, then the doors passed.\n * A door passed and its result say the same thing twice, so only an error result is shown.\n */\nexport function recordWords(t: Translate, actions: AuditActionRow[]): string {\n  const weight = (action: AuditActionRow) =>\n    action.decision === 'denied' || action.outcome === 'error' ? 0 : action.kind.startsWith('door.') ? 2 : 1\n  return [...actions]\n    .sort((a, b) => weight(a) - weight(b))\n    .map(action => actionWords(t, action))\n    .filter(Boolean)\n    .join(', ')\n}\n\n/** The last `days` days up to `now`. */\nexport function lastDays(days: number, now = new Date()): { from: Date; to: Date } {\n  const from = new Date(now)\n  from.setHours(0, 0, 0, 0)\n  from.setDate(from.getDate() - (days - 1))\n  return { from, to: now }\n}\n"]}

package/dist-client/utils/audit-words.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/audit-words.test.js

@@ -0,0 +1,47 @@
+import { actionWords, doorWords, lastDays, recordWords } from './audit-words';
+const WORDS = {
+    'privilege.category.payroll': '급여',
+    'audit.door.super': '시스템 소유자',
+    'audit.outcome.denied': '거절',
+    'audit.outcome.error': '오류',
+    'audit.outcome.failed': '실패',
+    'audit.kind.auth.signin': '로그인',
+    'audit.kind.role.grant': '역할 부여',
+    'audit.kind.user.status': '계정 상태',
+    'label.activated-user': '정상',
+    'label.locked-user': '잠김'
+};
+const t = (key, options) => WORDS[key] ?? options?.defaultValue ?? key;
+describe('the audit screen says what a row holds', () => {
+    it('a door is its category in words and the declared axis', () => {
+        expect(doorWords(t, 'payroll:query')).toBe('급여 query');
+        expect(doorWords(t, 'super')).toBe('시스템 소유자');
+        expect(doorWords(t, 'unknown-category:query')).toBe('unknown-category query');
+    });
+    it('a refusal says so, with how many times', () => {
+        expect(actionWords(t, { kind: 'door.check', door: 'payroll:query', decision: 'denied', count: 3 })).toBe('급여 query 거절 ×3');
+    });
+    it('a result is shown only when it failed - passing already said it ran', () => {
+        expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'ok' })).toBe('');
+        expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'error' })).toBe('급여 query 오류');
+    });
+    it('an event in words, a status change with both states', () => {
+        expect(actionWords(t, { kind: 'auth.signin', outcome: 'error', code: 'user not found' })).toBe('로그인 실패');
+        expect(actionWords(t, { kind: 'user.status', detail: { from: 'activated', to: 'locked' } })).toBe('계정 상태 정상 → 잠김');
+    });
+    it('a request reads refusals first, then events, then doors passed', () => {
+        expect(recordWords(t, [
+            { kind: 'door.check', door: 'payroll:query', decision: 'granted' },
+            { kind: 'door.result', door: 'payroll:query', outcome: 'ok' },
+            { kind: 'role.grant' },
+            { kind: 'door.check', door: 'payroll:mutation', decision: 'denied' }
+        ])).toBe('급여 mutation 거절, 역할 부여, 급여 query');
+    });
+    it('the last seven days start at midnight six days back', () => {
+        const now = new Date(2026, 9, 19, 15, 30);
+        const { from, to } = lastDays(7, now);
+        expect(from).toEqual(new Date(2026, 9, 13, 0, 0));
+        expect(to).toBe(now);
+    });
+});
+//# sourceMappingURL=audit-words.test.js.map

package/dist-client/utils/audit-words.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-words.test.js","sourceRoot":"","sources":["../../client/utils/audit-words.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE7E,MAAM,KAAK,GAA2B;IACpC,4BAA4B,EAAE,IAAI;IAClC,kBAAkB,EAAE,SAAS;IAC7B,sBAAsB,EAAE,IAAI;IAC5B,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,IAAI;IAC5B,wBAAwB,EAAE,KAAK;IAC/B,uBAAuB,EAAE,OAAO;IAChC,wBAAwB,EAAE,OAAO;IACjC,sBAAsB,EAAE,IAAI;IAC5B,mBAAmB,EAAE,IAAI;CAC1B,CAAA;AACD,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,OAAa,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,YAAY,IAAI,GAAG,CAAA;AAEpF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5H,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxG,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CACJ,WAAW,CAAC,CAAC,EAAE;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE;YAClE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7D,EAAE,IAAI,EAAE,YAAY,EAAE;YACtB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACrE,CAAC,CACH,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACzC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACjD,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { actionWords, doorWords, lastDays, recordWords } from './audit-words'\n\nconst WORDS: Record<string, string> = {\n  'privilege.category.payroll': '급여',\n  'audit.door.super': '시스템 소유자',\n  'audit.outcome.denied': '거절',\n  'audit.outcome.error': '오류',\n  'audit.outcome.failed': '실패',\n  'audit.kind.auth.signin': '로그인',\n  'audit.kind.role.grant': '역할 부여',\n  'audit.kind.user.status': '계정 상태',\n  'label.activated-user': '정상',\n  'label.locked-user': '잠김'\n}\nconst t = (key: string, options?: any) => WORDS[key] ?? options?.defaultValue ?? key\n\ndescribe('the audit screen says what a row holds', () => {\n  it('a door is its category in words and the declared axis', () => {\n    expect(doorWords(t, 'payroll:query')).toBe('급여 query')\n    expect(doorWords(t, 'super')).toBe('시스템 소유자')\n    expect(doorWords(t, 'unknown-category:query')).toBe('unknown-category query')\n  })\n\n  it('a refusal says so, with how many times', () => {\n    expect(actionWords(t, { kind: 'door.check', door: 'payroll:query', decision: 'denied', count: 3 })).toBe('급여 query 거절 ×3')\n  })\n\n  it('a result is shown only when it failed - passing already said it ran', () => {\n    expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'ok' })).toBe('')\n    expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'error' })).toBe('급여 query 오류')\n  })\n\n  it('an event in words, a status change with both states', () => {\n    expect(actionWords(t, { kind: 'auth.signin', outcome: 'error', code: 'user not found' })).toBe('로그인 실패')\n    expect(actionWords(t, { kind: 'user.status', detail: { from: 'activated', to: 'locked' } })).toBe('계정 상태 정상 → 잠김')\n  })\n\n  it('a request reads refusals first, then events, then doors passed', () => {\n    expect(\n      recordWords(t, [\n        { kind: 'door.check', door: 'payroll:query', decision: 'granted' },\n        { kind: 'door.result', door: 'payroll:query', outcome: 'ok' },\n        { kind: 'role.grant' },\n        { kind: 'door.check', door: 'payroll:mutation', decision: 'denied' }\n      ])\n    ).toBe('급여 mutation 거절, 역할 부여, 급여 query')\n  })\n\n  it('the last seven days start at midnight six days back', () => {\n    const now = new Date(2026, 9, 19, 15, 30)\n    const { from, to } = lastDays(7, now)\n    expect(from).toEqual(new Date(2026, 9, 13, 0, 0))\n    expect(to).toBe(now)\n  })\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-ui",
-  "version": "10.1.192",
+  "version": "10.1.198",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -39,11 +39,11 @@
     "@operato/popup": "^10.29.39",
     "@operato/shell": "^10.29.39",
     "@operato/styles": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.192",
-    "@things-factory/component-ui": "^10.1.192",
+    "@things-factory/auth-base": "^10.1.198",
+    "@things-factory/component-ui": "^10.1.198",
     "@things-factory/more-base": "^10.1.188",
     "base64url": "^3.0.1",
     "clipboard": "^2.0.6"
   },
-  "gitHead": "c44fe3ae4646dc4ffad7947785322acdb84c7374"
+  "gitHead": "68f884a78ca3a779c2b057ba5b8f6e03f477d701"
 }

package/things-factory.config.js

@@ -11,6 +11,7 @@ export default {
     { tagname: 'role-list-page', page: 'roles' },
     { tagname: 'role-privilege-page', page: 'role-privileges' },
     { tagname: 'user-list-page', page: 'users' },
+    { tagname: 'audit-page', page: 'audit' },
     { tagname: 'invitations-page', page: 'invitations' },
     { tagname: 'partner-management', page: 'partners' },
     { tagname: 'domain-management', page: 'domains' },

package/translations/en.json

@@ -420,5 +420,72 @@
   "access-request.dock.example today": "sort out today's access requests",
   "access-request.dock.example smallest": "grant each with the smallest role that gives it",
   "access-request.dock.example one person": "show what one person asked for and what each role would give",
-  "access-request.text.and more": "{list} and {count} more"
+  "access-request.text.and more": "{list} and {count} more",
+  "label.privileges view": "Privileges",
+  "label.tasks view": "Tasks",
+  "label.template view": "Against a template",
+  "text.counted from the saved privileges": "Counted from the saved privileges.",
+  "text.this role holds no task": "This role holds no privilege of any task.",
+  "label.tasks this role does not hold": "Tasks this role holds nothing of",
+  "button.unfold": "Show",
+  "button.fold": "Hide",
+  "label.privileges no task names": "Privileges no task names",
+  "text.task names an undeclared privilege": "Definition error",
+  "text.task held whole": "All",
+  "text.task held in part": "{held} of {total}",
+  "text.not held x": "Not held: {x}",
+  "text.no template to compare with": "There is no template to compare with, or reading them is not among your privileges.",
+  "text.pick a template to compare with": "Pick a template",
+  "text.template cannot be applied because": "This template cannot be applied: {list}.",
+  "text.template cannot be applied": "Cannot be applied",
+  "label.missing against the template": "Missing against the template",
+  "text.nothing missing against the template": "Nothing is missing.",
+  "label.wider than the template": "Wider than the template",
+  "audit.title": "Audit log",
+  "audit.view.people": "By person",
+  "audit.view.doors": "By privilege",
+  "audit.view.records": "Records",
+  "audit.period.days": "{count} days",
+  "audit.period.from": "From",
+  "audit.period.to": "To",
+  "audit.outcome.all": "All",
+  "audit.outcome.denied": "Refused",
+  "audit.outcome.error": "Error",
+  "audit.outcome.failed": "Failed",
+  "audit.button.all-people": "All people",
+  "audit.button.all-privileges": "All privileges",
+  "audit.health.failures": "{count} not recorded (since {since})",
+  "audit.health.unknown": "Unrecorded count unavailable",
+  "audit.field.last-checkin": "Last access",
+  "audit.field.checkins": "Accesses",
+  "audit.field.failed-signins": "Failed sign-ins",
+  "audit.field.granted": "Allowed",
+  "audit.field.denied": "Refused",
+  "audit.field.people": "People",
+  "audit.field.privilege": "Privilege",
+  "audit.field.time": "Time",
+  "audit.field.actor": "User",
+  "audit.field.actions": "Actions",
+  "audit.field.request": "Request",
+  "audit.field.address": "IP address",
+  "audit.field.duration": "ms",
+  "audit.door.owner": "domain owner",
+  "audit.door.super": "superuser",
+  "audit.kind.auth.signin": "Sign-in",
+  "audit.kind.auth.checkin": "Access",
+  "audit.kind.auth.signout": "Sign-out",
+  "audit.kind.password.change": "Password changed",
+  "audit.kind.password.reset-by-admin": "Password reset",
+  "audit.kind.credential.issue": "Credential reissued",
+  "audit.kind.webauthn.register": "Passkey registered",
+  "audit.kind.role.grant": "Role granted",
+  "audit.kind.role.revoke": "Role revoked",
+  "audit.kind.role.privilege.add": "Privilege added to role",
+  "audit.kind.role.privilege.remove": "Privilege removed from role",
+  "audit.kind.role.delete": "Role deleted",
+  "audit.kind.user.status": "Account status",
+  "audit.kind.domain.owner.add": "Domain owner added",
+  "audit.kind.domain.owner.remove": "Domain owner removed",
+  "audit.kind.invitation.create": "Invitation sent",
+  "audit.kind.invitation.status": "Invitation status"
 }

package/translations/es.json

@@ -420,5 +420,72 @@
   "access-request.dock.example today": "resolver las solicitudes de acceso de hoy",
   "access-request.dock.example smallest": "conceder cada una con el rol más reducido que lo permita",
   "access-request.dock.example one person": "mostrar lo que pidió una persona y lo que daría cada rol",
-  "access-request.text.and more": "{list} y {count} más"
+  "access-request.text.and more": "{list} y {count} más",
+  "label.privileges view": "Privilegios",
+  "label.tasks view": "Tareas",
+  "label.template view": "Frente a una plantilla",
+  "text.counted from the saved privileges": "Contado sobre los privilegios guardados.",
+  "text.this role holds no task": "Este rol no tiene ningún privilegio de ninguna tarea.",
+  "label.tasks this role does not hold": "Tareas de las que este rol no tiene nada",
+  "button.unfold": "Mostrar",
+  "button.fold": "Ocultar",
+  "label.privileges no task names": "Privilegios que ninguna tarea nombra",
+  "text.task names an undeclared privilege": "Error de definición",
+  "text.task held whole": "Todo",
+  "text.task held in part": "{held} de {total}",
+  "text.not held x": "No tiene: {x}",
+  "text.no template to compare with": "No hay plantilla con la que comparar, o no tiene privilegio para leerlas.",
+  "text.pick a template to compare with": "Elegir una plantilla",
+  "text.template cannot be applied because": "Esta plantilla no se puede aplicar: {list}.",
+  "text.template cannot be applied": "No aplicable",
+  "label.missing against the template": "Falta frente a la plantilla",
+  "text.nothing missing against the template": "No falta nada.",
+  "label.wider than the template": "Más amplio que la plantilla",
+  "audit.title": "Registro de auditoría",
+  "audit.view.people": "Por persona",
+  "audit.view.doors": "Por privilegio",
+  "audit.view.records": "Registros",
+  "audit.period.days": "{count} días",
+  "audit.period.from": "Desde",
+  "audit.period.to": "Hasta",
+  "audit.outcome.all": "Todo",
+  "audit.outcome.denied": "Rechazado",
+  "audit.outcome.error": "Error",
+  "audit.outcome.failed": "Fallido",
+  "audit.button.all-people": "Todas las personas",
+  "audit.button.all-privileges": "Todos los privilegios",
+  "audit.health.failures": "{count} sin registrar (desde {since})",
+  "audit.health.unknown": "No se pudo leer el número de fallos",
+  "audit.field.last-checkin": "Último acceso",
+  "audit.field.checkins": "Accesos",
+  "audit.field.failed-signins": "Inicios fallidos",
+  "audit.field.granted": "Permitidos",
+  "audit.field.denied": "Rechazados",
+  "audit.field.people": "Personas",
+  "audit.field.privilege": "Privilegio",
+  "audit.field.time": "Hora",
+  "audit.field.actor": "Usuario",
+  "audit.field.actions": "Acciones",
+  "audit.field.request": "Solicitud",
+  "audit.field.address": "Dirección IP",
+  "audit.field.duration": "ms",
+  "audit.door.owner": "propietario del dominio",
+  "audit.door.super": "superusuario",
+  "audit.kind.auth.signin": "Inicio de sesión",
+  "audit.kind.auth.checkin": "Acceso",
+  "audit.kind.auth.signout": "Cierre de sesión",
+  "audit.kind.password.change": "Cambio de contraseña",
+  "audit.kind.password.reset-by-admin": "Restablecimiento de contraseña",
+  "audit.kind.credential.issue": "Credencial reemitida",
+  "audit.kind.webauthn.register": "Llave de acceso registrada",
+  "audit.kind.role.grant": "Rol concedido",
+  "audit.kind.role.revoke": "Rol retirado",
+  "audit.kind.role.privilege.add": "Privilegio añadido al rol",
+  "audit.kind.role.privilege.remove": "Privilegio quitado del rol",
+  "audit.kind.role.delete": "Rol eliminado",
+  "audit.kind.user.status": "Estado de la cuenta",
+  "audit.kind.domain.owner.add": "Propietario del dominio añadido",
+  "audit.kind.domain.owner.remove": "Propietario del dominio quitado",
+  "audit.kind.invitation.create": "Invitación enviada",
+  "audit.kind.invitation.status": "Estado de la invitación"
 }

package/translations/ja.json

@@ -420,5 +420,72 @@
   "access-request.dock.example today": "今日届いた権限リクエストを整理して",
   "access-request.dock.example smallest": "リクエストごとに最小のロールで付与案を作って",
   "access-request.dock.example one person": "一人のリクエストと、ロールごとに追加で与えるものを見せて",
-  "access-request.text.and more": "{list} ほか {count} 件"
+  "access-request.text.and more": "{list} ほか {count} 件",
+  "label.privileges view": "権限",
+  "label.tasks view": "業務",
+  "label.template view": "テンプレートと比較",
+  "text.counted from the saved privileges": "保存した権限で数えます。",
+  "text.this role holds no task": "このロールはどの業務の権限も持っていません。",
+  "label.tasks this role does not hold": "このロールにない業務",
+  "button.unfold": "開く",
+  "button.fold": "閉じる",
+  "label.privileges no task names": "どの業務にもない権限",
+  "text.task names an undeclared privilege": "定義エラー",
+  "text.task held whole": "すべて",
+  "text.task held in part": "一部 {held}/{total}",
+  "text.not held x": "ない権限: {x}",
+  "text.no template to compare with": "比較するテンプレートがないか、テンプレートを読む権限がありません。",
+  "text.pick a template to compare with": "テンプレートを選ぶ",
+  "text.template cannot be applied because": "このテンプレートは適用できません: {list}。",
+  "text.template cannot be applied": "適用不可",
+  "label.missing against the template": "テンプレートにあってこのロールにない権限",
+  "text.nothing missing against the template": "足りない権限はありません。",
+  "label.wider than the template": "テンプレートより広い権限",
+  "audit.title": "監査ログ",
+  "audit.view.people": "ユーザー別",
+  "audit.view.doors": "権限別",
+  "audit.view.records": "記録",
+  "audit.period.days": "{count}日",
+  "audit.period.from": "開始日",
+  "audit.period.to": "終了日",
+  "audit.outcome.all": "すべて",
+  "audit.outcome.denied": "拒否",
+  "audit.outcome.error": "エラー",
+  "audit.outcome.failed": "失敗",
+  "audit.button.all-people": "全員",
+  "audit.button.all-privileges": "すべての権限",
+  "audit.health.failures": "記録失敗 {count}件（{since} 以降）",
+  "audit.health.unknown": "記録失敗数を取得できません",
+  "audit.field.last-checkin": "最終アクセス",
+  "audit.field.checkins": "アクセス",
+  "audit.field.failed-signins": "ログイン失敗",
+  "audit.field.granted": "許可",
+  "audit.field.denied": "拒否",
+  "audit.field.people": "人数",
+  "audit.field.privilege": "権限",
+  "audit.field.time": "日時",
+  "audit.field.actor": "ユーザー",
+  "audit.field.actions": "操作",
+  "audit.field.request": "リクエスト",
+  "audit.field.address": "接続IP",
+  "audit.field.duration": "処理 ms",
+  "audit.door.owner": "$t(term.domain)のオーナー",
+  "audit.door.super": "スーパーユーザー",
+  "audit.kind.auth.signin": "ログイン",
+  "audit.kind.auth.checkin": "アクセス",
+  "audit.kind.auth.signout": "ログアウト",
+  "audit.kind.password.change": "パスワード変更",
+  "audit.kind.password.reset-by-admin": "パスワード初期化",
+  "audit.kind.credential.issue": "認証情報の再発行",
+  "audit.kind.webauthn.register": "パスキー登録",
+  "audit.kind.role.grant": "ロール付与",
+  "audit.kind.role.revoke": "ロール取消",
+  "audit.kind.role.privilege.add": "ロールに権限追加",
+  "audit.kind.role.privilege.remove": "ロールから権限除外",
+  "audit.kind.role.delete": "ロール削除",
+  "audit.kind.user.status": "アカウント状態",
+  "audit.kind.domain.owner.add": "$t(term.domain)オーナー追加",
+  "audit.kind.domain.owner.remove": "$t(term.domain)オーナー解除",
+  "audit.kind.invitation.create": "招待",
+  "audit.kind.invitation.status": "招待状態"
 }

package/translations/ko.json

@@ -420,5 +420,72 @@
   "access-request.dock.example today": "오늘 들어온 권한 요청 정리해 줘",
   "access-request.dock.example smallest": "요청마다 가장 작은 역할로 부여안을 만들어 줘",
   "access-request.dock.example one person": "한 사람이 요청한 것과 역할마다 더 주는 것을 보여 줘",
-  "access-request.text.and more": "{list} 외 {count}개"
+  "access-request.text.and more": "{list} 외 {count}개",
+  "label.privileges view": "권한",
+  "label.tasks view": "업무",
+  "label.template view": "템플릿과 견주기",
+  "text.counted from the saved privileges": "저장한 권한으로 셉니다.",
+  "text.this role holds no task": "이 역할은 어느 업무의 권한도 갖고 있지 않습니다.",
+  "label.tasks this role does not hold": "이 역할에 없는 업무",
+  "button.unfold": "펼치기",
+  "button.fold": "접기",
+  "label.privileges no task names": "어느 업무에도 없는 권한",
+  "text.task names an undeclared privilege": "정의 오류",
+  "text.task held whole": "전부",
+  "text.task held in part": "일부 {held}/{total}",
+  "text.not held x": "없는 권한: {x}",
+  "text.no template to compare with": "견줄 템플릿이 없거나 템플릿을 읽을 권한이 없습니다.",
+  "text.pick a template to compare with": "템플릿 고르기",
+  "text.template cannot be applied because": "이 템플릿은 적용할 수 없습니다: {list}.",
+  "text.template cannot be applied": "적용 불가",
+  "label.missing against the template": "템플릿에 있고 이 역할에 없는 권한",
+  "text.nothing missing against the template": "빠진 권한이 없습니다.",
+  "label.wider than the template": "템플릿보다 넓은 권한",
+  "audit.title": "감사 기록",
+  "audit.view.people": "사람별",
+  "audit.view.doors": "권한별",
+  "audit.view.records": "기록",
+  "audit.period.days": "{count}일",
+  "audit.period.from": "시작일",
+  "audit.period.to": "종료일",
+  "audit.outcome.all": "전체",
+  "audit.outcome.denied": "거절",
+  "audit.outcome.error": "오류",
+  "audit.outcome.failed": "실패",
+  "audit.button.all-people": "모든 사람",
+  "audit.button.all-privileges": "모든 권한",
+  "audit.health.failures": "기록 실패 {count}건 ({since} 이후)",
+  "audit.health.unknown": "기록 실패 수를 읽지 못함",
+  "audit.field.last-checkin": "마지막 접속",
+  "audit.field.checkins": "접속",
+  "audit.field.failed-signins": "로그인 실패",
+  "audit.field.granted": "통과",
+  "audit.field.denied": "거절",
+  "audit.field.people": "사람 수",
+  "audit.field.privilege": "권한",
+  "audit.field.time": "시각",
+  "audit.field.actor": "사용자",
+  "audit.field.actions": "행위",
+  "audit.field.request": "요청",
+  "audit.field.address": "접속 IP",
+  "audit.field.duration": "처리 ms",
+  "audit.door.owner": "$t(term.domain) 소유자",
+  "audit.door.super": "수퍼유저",
+  "audit.kind.auth.signin": "로그인",
+  "audit.kind.auth.checkin": "접속",
+  "audit.kind.auth.signout": "로그아웃",
+  "audit.kind.password.change": "비밀번호 변경",
+  "audit.kind.password.reset-by-admin": "비밀번호 초기화",
+  "audit.kind.credential.issue": "인증 정보 재발급",
+  "audit.kind.webauthn.register": "패스키 등록",
+  "audit.kind.role.grant": "역할 부여",
+  "audit.kind.role.revoke": "역할 회수",
+  "audit.kind.role.privilege.add": "역할에 권한 추가",
+  "audit.kind.role.privilege.remove": "역할에서 권한 제외",
+  "audit.kind.role.delete": "역할 삭제",
+  "audit.kind.user.status": "계정 상태",
+  "audit.kind.domain.owner.add": "$t(term.domain) 소유자 지정",
+  "audit.kind.domain.owner.remove": "$t(term.domain) 소유자 해제",
+  "audit.kind.invitation.create": "초대",
+  "audit.kind.invitation.status": "초대 상태"
 }

package/translations/ms.json

@@ -420,5 +420,72 @@
   "access-request.dock.example today": "susun permintaan akses hari ini",
   "access-request.dock.example smallest": "sediakan draf pemberian dengan peranan terkecil bagi setiap permintaan",
   "access-request.dock.example one person": "tunjukkan apa yang diminta seseorang dan apa yang diberi oleh setiap peranan",
-  "access-request.text.and more": "{list} dan {count} lagi"
+  "access-request.text.and more": "{list} dan {count} lagi",
+  "label.privileges view": "Keistimewaan",
+  "label.tasks view": "Tugas",
+  "label.template view": "Berbanding templat",
+  "text.counted from the saved privileges": "Dikira daripada keistimewaan yang disimpan.",
+  "text.this role holds no task": "Peranan ini tidak memegang keistimewaan mana-mana tugas.",
+  "label.tasks this role does not hold": "Tugas yang tiada pada peranan ini",
+  "button.unfold": "Tunjuk",
+  "button.fold": "Sembunyi",
+  "label.privileges no task names": "Keistimewaan yang tiada dalam mana-mana tugas",
+  "text.task names an undeclared privilege": "Ralat definisi",
+  "text.task held whole": "Semua",
+  "text.task held in part": "{held} daripada {total}",
+  "text.not held x": "Tiada: {x}",
+  "text.no template to compare with": "Tiada templat untuk dibandingkan, atau anda tiada keistimewaan untuk membacanya.",
+  "text.pick a template to compare with": "Pilih templat",
+  "text.template cannot be applied because": "Templat ini tidak boleh digunakan: {list}.",
+  "text.template cannot be applied": "Tidak boleh digunakan",
+  "label.missing against the template": "Tiada berbanding templat",
+  "text.nothing missing against the template": "Tiada yang kurang.",
+  "label.wider than the template": "Lebih luas daripada templat",
+  "audit.title": "Log audit",
+  "audit.view.people": "Mengikut orang",
+  "audit.view.doors": "Mengikut keistimewaan",
+  "audit.view.records": "Rekod",
+  "audit.period.days": "{count} hari",
+  "audit.period.from": "Dari",
+  "audit.period.to": "Hingga",
+  "audit.outcome.all": "Semua",
+  "audit.outcome.denied": "Ditolak",
+  "audit.outcome.error": "Ralat",
+  "audit.outcome.failed": "Gagal",
+  "audit.button.all-people": "Semua orang",
+  "audit.button.all-privileges": "Semua keistimewaan",
+  "audit.health.failures": "{count} tidak direkod (sejak {since})",
+  "audit.health.unknown": "Bilangan gagal rekod tidak dapat dibaca",
+  "audit.field.last-checkin": "Akses terakhir",
+  "audit.field.checkins": "Akses",
+  "audit.field.failed-signins": "Log masuk gagal",
+  "audit.field.granted": "Dibenarkan",
+  "audit.field.denied": "Ditolak",
+  "audit.field.people": "Orang",
+  "audit.field.privilege": "Keistimewaan",
+  "audit.field.time": "Masa",
+  "audit.field.actor": "Pengguna",
+  "audit.field.actions": "Tindakan",
+  "audit.field.request": "Permintaan",
+  "audit.field.address": "Alamat IP",
+  "audit.field.duration": "ms",
+  "audit.door.owner": "pemilik $t(term.domain)",
+  "audit.door.super": "superuser",
+  "audit.kind.auth.signin": "Log masuk",
+  "audit.kind.auth.checkin": "Akses",
+  "audit.kind.auth.signout": "Log keluar",
+  "audit.kind.password.change": "Kata laluan ditukar",
+  "audit.kind.password.reset-by-admin": "Set semula kata laluan",
+  "audit.kind.credential.issue": "Kelayakan dikeluarkan semula",
+  "audit.kind.webauthn.register": "Kunci laluan didaftar",
+  "audit.kind.role.grant": "Peranan diberi",
+  "audit.kind.role.revoke": "Peranan ditarik",
+  "audit.kind.role.privilege.add": "Keistimewaan ditambah pada peranan",
+  "audit.kind.role.privilege.remove": "Keistimewaan dibuang daripada peranan",
+  "audit.kind.role.delete": "Peranan dipadam",
+  "audit.kind.user.status": "Status akaun",
+  "audit.kind.domain.owner.add": "Pemilik $t(term.domain) ditambah",
+  "audit.kind.domain.owner.remove": "Pemilik $t(term.domain) dibuang",
+  "audit.kind.invitation.create": "Jemputan dihantar",
+  "audit.kind.invitation.status": "Status jemputan"
 }