@things-factory/auth-ui 10.1.215 → 10.1.219

package/dist-client/utils/link-token.d.ts

@@ -3,9 +3,9 @@
  *
  * ## Why the token is in the fragment
  *
- * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`
- * reaches the server as `/accept-invitation` and nothing else — and the same for
- * `/reset-password`, `/unlock-user` and `/verify`. The token never appears in an
+ * A browser does not send what follows `#`, so a link shaped `…/reset-password#<token>`
+ * reaches the server as `/reset-password` and nothing else — and the same for
+ * `/unlock-user` and `/verify`. The token never appears in an
  * access log, a proxy log, or a `Referer` sent onward to some other site.
  *
  * That leaves the places the browser itself keeps it: the address bar and the history entry.

package/dist-client/utils/link-token.js

@@ -3,9 +3,9 @@
  *
  * ## Why the token is in the fragment
  *
- * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`
- * reaches the server as `/accept-invitation` and nothing else — and the same for
- * `/reset-password`, `/unlock-user` and `/verify`. The token never appears in an
+ * A browser does not send what follows `#`, so a link shaped `…/reset-password#<token>`
+ * reaches the server as `/reset-password` and nothing else — and the same for
+ * `/unlock-user` and `/verify`. The token never appears in an
  * access log, a proxy log, or a `Referer` sent onward to some other site.
  *
  * That leaves the places the browser itself keeps it: the address bar and the history entry.
@@ -20,7 +20,7 @@
  * anchor — to the server as a credential attempt. It answers empty instead, and the page shows
  * the box where the code from the mail can be pasted.
  */
-/** 16 bytes as hex, which is what `makeInvitationToken` and `makeVerificationToken` produce. */
+/** 16 bytes as hex, which is what `makeVerificationToken` produces. */
 const TOKEN = /^[0-9a-f]{32}$/;
 export function readLinkToken(href) {
     if (!href) {

package/dist-client/utils/link-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"link-token.js","sourceRoot":"","sources":["../../client/utils/link-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gGAAgG;AAChG,MAAM,KAAK,GAAG,gBAAgB,CAAA;AAS9B,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAEjC;;;OAGG;IACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC","sourcesContent":["/**\n * Taking the token out of a mailed link, and out of the address bar. (Pure rule.)\n *\n * ## Why the token is in the fragment\n *\n * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`\n * reaches the server as `/accept-invitation` and nothing else — and the same for\n * `/reset-password`, `/unlock-user` and `/verify`. The token never appears in an\n * access log, a proxy log, or a `Referer` sent onward to some other site.\n *\n * That leaves the places the browser itself keeps it: the address bar and the history entry.\n * Both are cleared by replacing the URL with the one this returns as `clean`, which is why the\n * two answers come back together — reading the token and removing it are one act, and a caller\n * that did the first without the second would leave it on screen.\n *\n * ## What it refuses to read\n *\n * A token is hex from `crypto.randomBytes(16)`. Anything else in the fragment is not one, and\n * taking it anyway would send whatever a link happened to carry — a tracking fragment, a page\n * anchor — to the server as a credential attempt. It answers empty instead, and the page shows\n * the box where the code from the mail can be pasted.\n */\n\n/** 16 bytes as hex, which is what `makeInvitationToken` and `makeVerificationToken` produce. */\nconst TOKEN = /^[0-9a-f]{32}$/\n\nexport type LinkToken = {\n  /** The token, or an empty string when the link carries none this rule will read. */\n  token: string\n  /** The same URL without its fragment, for the caller to replace the address with. */\n  clean: string\n}\n\nexport function readLinkToken(href: string): LinkToken {\n  if (!href) {\n    return { token: '', clean: '' }\n  }\n\n  const hash = href.indexOf('#')\n\n  if (hash < 0) {\n    return { token: '', clean: href }\n  }\n\n  const clean = href.slice(0, hash)\n\n  /*\n   * `#invite=<token>` as well as a bare `#<token>`. Both shapes turn up in mail clients that\n   * rewrite links, and neither costs anything to accept.\n   */\n  const raw = decodeURIComponent(href.slice(hash + 1)).replace(/^invite=/, '')\n\n  return { token: TOKEN.test(raw) ? raw : '', clean }\n}\n"]}
+{"version":3,"file":"link-token.js","sourceRoot":"","sources":["../../client/utils/link-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uEAAuE;AACvE,MAAM,KAAK,GAAG,gBAAgB,CAAA;AAS9B,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAEjC;;;OAGG;IACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC","sourcesContent":["/**\n * Taking the token out of a mailed link, and out of the address bar. (Pure rule.)\n *\n * ## Why the token is in the fragment\n *\n * A browser does not send what follows `#`, so a link shaped `…/reset-password#<token>`\n * reaches the server as `/reset-password` and nothing else — and the same for\n * `/unlock-user` and `/verify`. The token never appears in an\n * access log, a proxy log, or a `Referer` sent onward to some other site.\n *\n * That leaves the places the browser itself keeps it: the address bar and the history entry.\n * Both are cleared by replacing the URL with the one this returns as `clean`, which is why the\n * two answers come back together — reading the token and removing it are one act, and a caller\n * that did the first without the second would leave it on screen.\n *\n * ## What it refuses to read\n *\n * A token is hex from `crypto.randomBytes(16)`. Anything else in the fragment is not one, and\n * taking it anyway would send whatever a link happened to carry — a tracking fragment, a page\n * anchor — to the server as a credential attempt. It answers empty instead, and the page shows\n * the box where the code from the mail can be pasted.\n */\n\n/** 16 bytes as hex, which is what `makeVerificationToken` produces. */\nconst TOKEN = /^[0-9a-f]{32}$/\n\nexport type LinkToken = {\n  /** The token, or an empty string when the link carries none this rule will read. */\n  token: string\n  /** The same URL without its fragment, for the caller to replace the address with. */\n  clean: string\n}\n\nexport function readLinkToken(href: string): LinkToken {\n  if (!href) {\n    return { token: '', clean: '' }\n  }\n\n  const hash = href.indexOf('#')\n\n  if (hash < 0) {\n    return { token: '', clean: href }\n  }\n\n  const clean = href.slice(0, hash)\n\n  /*\n   * `#invite=<token>` as well as a bare `#<token>`. Both shapes turn up in mail clients that\n   * rewrite links, and neither costs anything to accept.\n   */\n  const raw = decodeURIComponent(href.slice(hash + 1)).replace(/^invite=/, '')\n\n  return { token: TOKEN.test(raw) ? raw : '', clean }\n}\n"]}

package/dist-client/utils/link-token.test.js

@@ -1,13 +1,13 @@
 import { readLinkToken } from './link-token';
 /**
- * Reading the invitation token out of the link, and handing back the link without it.
+ * Reading the token out of a mailed link, and handing back the link without it.
  *
  * The two answers travel together because removing the token is not optional: the fragment keeps
  * it out of server and proxy logs, and replacing the address is what keeps it out of the browser
  * history and off the screen. A caller that read it and forgot to replace would undo the point.
  */
 const TOKEN = '0123456789abcdef0123456789abcdef';
-const PAGE = 'https://acme.example.com/accept-invitation';
+const PAGE = 'https://acme.example.com/auth/reset-password';
 describe('a link with a token in it', () => {
     it('reads a bare fragment', () => {
         expect(readLinkToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE });

package/dist-client/utils/link-token.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"link-token.test.js","sourceRoot":"","sources":["../../client/utils/link-token.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,kCAAkC,CAAA;AAChD,MAAM,IAAI,GAAG,4CAA4C,CAAA;AAEzD,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD;qGAC6F;QAC7F,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD;;;WAGG;QACH,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5D,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAClE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,wFAAwF;QACxF,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,2FAA2F;QAC3F,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3D,MAAM,CAAC,aAAa,CAAC,SAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readLinkToken } from './link-token'\n\n/**\n * Reading the invitation token out of the link, and handing back the link without it.\n *\n * The two answers travel together because removing the token is not optional: the fragment keeps\n * it out of server and proxy logs, and replacing the address is what keeps it out of the browser\n * history and off the screen. A caller that read it and forgot to replace would undo the point.\n */\n\nconst TOKEN = '0123456789abcdef0123456789abcdef'\nconst PAGE = 'https://acme.example.com/accept-invitation'\n\ndescribe('a link with a token in it', () => {\n  it('reads a bare fragment', () => {\n    expect(readLinkToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads the named form some mail clients produce', () => {\n    expect(readLinkToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads one that arrived percent-encoded', () => {\n    expect(readLinkToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN)\n  })\n\n  it('hands back the address without the fragment', () => {\n    /* ⚠ What the caller replaces the address with. Without it the token stays on screen and in\n       this history entry, which is the half of the hiding the fragment does not do by itself. */\n    expect(readLinkToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`)\n  })\n})\n\ndescribe('a link with nothing usable in it', () => {\n  it('has no fragment at all', () => {\n    expect(readLinkToken(PAGE)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('has an empty fragment', () => {\n    expect(readLinkToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('⚠ carries something that is not a token', () => {\n    /*\n     * ⚠ A page anchor, a tracking fragment, anything a link happened to pick up. Sending it as a\n     * credential attempt would be this page volunteering whatever it was given.\n     */\n    expect(readLinkToken(`${PAGE}#section-2`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#utm_source=mail`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#<script>`).token).toEqual('')\n  })\n\n  it('carries something token-shaped but the wrong length', () => {\n    expect(readLinkToken(`${PAGE}#0123456789abcdef`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#${TOKEN}ff`).token).toEqual('')\n  })\n\n  it('carries hex in the wrong case', () => {\n    /* `makeInvitationToken` produces lower-case hex. Anything else did not come from us. */\n    expect(readLinkToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('')\n  })\n\n  it('still hands back a clean address to replace with', () => {\n    /* Even a fragment that is not ours should not be left sitting in the bar for this page. */\n    expect(readLinkToken(`${PAGE}#section-2`).clean).toEqual(PAGE)\n  })\n\n  it('is given nothing at all', () => {\n    expect(readLinkToken('')).toEqual({ token: '', clean: '' })\n    expect(readLinkToken(undefined as any)).toEqual({ token: '', clean: '' })\n  })\n})\n"]}
+{"version":3,"file":"link-token.test.js","sourceRoot":"","sources":["../../client/utils/link-token.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,kCAAkC,CAAA;AAChD,MAAM,IAAI,GAAG,8CAA8C,CAAA;AAE3D,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD;qGAC6F;QAC7F,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD;;;WAGG;QACH,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5D,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAClE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,wFAAwF;QACxF,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,2FAA2F;QAC3F,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3D,MAAM,CAAC,aAAa,CAAC,SAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readLinkToken } from './link-token'\n\n/**\n * Reading the token out of a mailed link, and handing back the link without it.\n *\n * The two answers travel together because removing the token is not optional: the fragment keeps\n * it out of server and proxy logs, and replacing the address is what keeps it out of the browser\n * history and off the screen. A caller that read it and forgot to replace would undo the point.\n */\n\nconst TOKEN = '0123456789abcdef0123456789abcdef'\nconst PAGE = 'https://acme.example.com/auth/reset-password'\n\ndescribe('a link with a token in it', () => {\n  it('reads a bare fragment', () => {\n    expect(readLinkToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads the named form some mail clients produce', () => {\n    expect(readLinkToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads one that arrived percent-encoded', () => {\n    expect(readLinkToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN)\n  })\n\n  it('hands back the address without the fragment', () => {\n    /* ⚠ What the caller replaces the address with. Without it the token stays on screen and in\n       this history entry, which is the half of the hiding the fragment does not do by itself. */\n    expect(readLinkToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`)\n  })\n})\n\ndescribe('a link with nothing usable in it', () => {\n  it('has no fragment at all', () => {\n    expect(readLinkToken(PAGE)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('has an empty fragment', () => {\n    expect(readLinkToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('⚠ carries something that is not a token', () => {\n    /*\n     * ⚠ A page anchor, a tracking fragment, anything a link happened to pick up. Sending it as a\n     * credential attempt would be this page volunteering whatever it was given.\n     */\n    expect(readLinkToken(`${PAGE}#section-2`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#utm_source=mail`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#<script>`).token).toEqual('')\n  })\n\n  it('carries something token-shaped but the wrong length', () => {\n    expect(readLinkToken(`${PAGE}#0123456789abcdef`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#${TOKEN}ff`).token).toEqual('')\n  })\n\n  it('carries hex in the wrong case', () => {\n    /* `makeInvitationToken` produces lower-case hex. Anything else did not come from us. */\n    expect(readLinkToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('')\n  })\n\n  it('still hands back a clean address to replace with', () => {\n    /* Even a fragment that is not ours should not be left sitting in the bar for this page. */\n    expect(readLinkToken(`${PAGE}#section-2`).clean).toEqual(PAGE)\n  })\n\n  it('is given nothing at all', () => {\n    expect(readLinkToken('')).toEqual({ token: '', clean: '' })\n    expect(readLinkToken(undefined as any)).toEqual({ token: '', clean: '' })\n  })\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-ui",
-  "version": "10.1.215",
+  "version": "10.1.219",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -40,11 +40,12 @@
     "@operato/shell": "^10.29.39",
     "@operato/styles": "^10.0.0",
     "@operato/utils": "^10.29.39",
-    "@things-factory/auth-base": "^10.1.215",
-    "@things-factory/component-ui": "^10.1.215",
-    "@things-factory/more-base": "^10.1.208",
+    "@things-factory/apptool-base": "^10.1.218",
+    "@things-factory/auth-base": "^10.1.218",
+    "@things-factory/component-ui": "^10.1.218",
+    "@things-factory/more-base": "^10.1.219",
     "base64url": "^3.0.1",
     "clipboard": "^2.0.6"
   },
-  "gitHead": "7de5e80eb1f4e2e268746aee39f820e7563f454d"
+  "gitHead": "1e96a252aafc460942bf5093b5aeed24828783d4"
 }

package/things-factory.config.js

@@ -12,7 +12,6 @@ export default {
     { tagname: 'role-privilege-page', page: 'role-privileges' },
     { tagname: 'user-list-page', page: 'users' },
     { tagname: 'audit-page', page: 'audit' },
-    { tagname: 'invitations-page', page: 'invitations' },
     { tagname: 'partner-management', page: 'partners' },
     { tagname: 'domain-management', page: 'domains' },
     { tagname: 'domain-owner-management', page: 'domain-owners' },

package/translations/en.json

@@ -1,5 +1,4 @@
 {
-  "button.accept invitation": "accept invitation",
   "button.activate": "activate",
   "button.add passkey": "Add a passkey",
   "button.add what it can do": "Add what it can do",
@@ -41,7 +40,7 @@
   "button.stand it here": "stand it here",
   "button.submit": "submit",
   "button.terminate contract": "terminate",
-  "button.transfer owner": "transfer owner",
+  "button.transfer owner": "make $t(term.domain) owner",
   "button.unlock": "unlock",
   "button.withdraw": "withdraw",
   "error.cannot_modify_system_subdomain": "the 'system' subdomain cannot be modified.",
@@ -139,8 +138,6 @@
   "label.execute": "Execute",
   "label.inactive-user": "inactive",
   "label.inherited": "Inherited",
-  "label.invitation code": "invitation code",
-  "label.invitations": "invitations",
   "label.invite customer": "invite customer",
   "label.invite user": "invite user",
   "label.language": "language",
@@ -160,7 +157,6 @@
   "label.search_domain": "search domain",
   "label.select_domain": "select domain",
   "label.send activation email": "send activation email",
-  "label.send invitation": "send invitation",
   "label.signin with": "signin with {title}",
   "label.state": "state",
   "label.subject": "subject",
@@ -175,8 +171,11 @@
   "text.a blank seat opens nothing until you give it privileges": "A blank seat opens nothing until you give it privileges.",
   "text.a role of this name exists and will be added to": "A role of this name already exists. It will be used as it stands and these privileges added to it.",
   "text.a role of this name is already visible": "a role of this name is already visible",
-  "text.account exists so joins immediately": "This account already exists. Adding it lets them in right away.",
-  "text.account will be created with the default password": "No account uses this address yet. One is created with the default password, which you have to tell them yourself.",
+  "text.add user puts an account into this domain": "One account works in several $t(term.domain)s. Find it by email, put it into this $t(term.domain) and give it roles.",
+  "label.account exists": "if the account exists",
+  "text.they join this domain at once": "they join this $t(term.domain) at once.",
+  "label.no account": "if there is no account",
+  "text.roles decide the screens they open": "decide which screens they can open.",
   "text.add template privileges": "adds the {count} privileges the {template} template grants and this role lacks: {list}",
   "text.add_domain_owner_description": "grant another domain member owner permission.",
   "text.already in this domain": "already here",
@@ -192,7 +191,7 @@
   "text.are_you_sure_to_delete_x": "are you sure to delete {x}",
   "text.are_you_sure_to_remove_domain_owner": "are you sure to remove {x} as a domain owner?",
   "text.are_you_sure_to_terminate_contract": "are you sure to terminate contract?",
-  "text.are_you_sure_to_transfer_owner": "are you sure to transfer owner?",
+  "text.are_you_sure_to_transfer_owner": "make this user the $t(term.domain) owner?",
   "text.are_you_sure_to_x": "are you sure to {x}?",
   "text.are_you_sure_to_x_user": "are you sure to {x} user?",
   "text.attribute management": "attribute management",
@@ -205,14 +204,31 @@
   "text.cannot be undone": "Cannot be undone",
   "text.cannot_delete": "cannot be deleted",
   "text.change password": "change password",
-  "text.choose a password to finish joining": "choose a password to finish joining.",
   "text.click login history": "If you want to see your recent login history, click",
   "text.completed": "completed",
   "text.confirm password": "confirm password",
-  "text.confirm the address this invitation was sent to": "enter the address this invitation was sent to.",
   "text.copied": "copied",
   "text.copying needs a secure connection": "copying needs a secure connection — select the value and copy it by hand",
   "text.could not be saved": "could not be saved — see the message above for the reason",
+  "text.could not look up the account": "could not check the account.",
+  "button.issue link": "issue link",
+  "button.copied": "copied",
+  "button.reissue setup link": "reissue setup link",
+  "button.password reset link": "password reset link",
+  "label.how the link travels": "how the link travels",
+  "label.send by mail": "send by mail",
+  "label.copy the link": "copy the link",
+  "label.password-setup-pending-user": "awaiting password",
+  "title.password setup link": "password setup link",
+  "title.set a new password": "set a new password",
+  "text.a new link retires the last one": "This account is waiting for its password. A new link retires the last one.",
+  "text.the current password stops and sessions end": "Issuing stops the current password at once and ends open sessions. They set a new one through the link.",
+  "text.the link works once for 48 hours and asks for the address": "The link works once, for 48 hours, and asks for this email address when opened.",
+  "text.hand it over yourself": "hand it over yourself, by message or on paper",
+  "text.the link was mailed to x until y": "The link was mailed to {x}. It works until {y}.",
+  "text.this link is shown only now until y": "This link is shown only now. It works until {y}; if it is lost, issue another.",
+  "text.an account is made and a setup link handed over": "an account is made and a password setup link handed over. They set their password through it within 48 hours.",
+  "text.the address this link was sent for": "the address this link was sent for",
   "text.could not register": "could not register — see the message above for the reason",
   "text.create role": "create role",
   "text.credentials": "credentials",
@@ -239,11 +255,9 @@
   "text.inherited roles are edited in their own domain": "These roles are defined in a parent domain and can only be changed there.",
   "text.invalid-email": "that is not an email address",
   "text.invalid-username": "use an id or an email address",
-  "text.invitation resent": "invitation sent again.",
   "text.missing against template": "{count} missing",
   "text.new password": "new password",
   "text.no account and no default password": "No account uses this address, and this system has no default password. They have to sign up first.",
-  "text.no account so an invitation will be mailed": "no account yet, so an invitation will be mailed. they choose their own password.",
   "text.no description for this privilege": "No description has been written for this privilege yet.",
   "text.no description for this role": "No description yet — write one in the role list.",
   "text.no domain available": "no domain available",
@@ -263,13 +277,12 @@
   "text.nothing matches x": "No module name contains \"{x}\".",
   "text.opens nothing, receives approvals": "opens nothing — this seat receives approvals",
   "text.owner opens everything without a role": "As the owner you can open every screen without a role. Everyone else needs one.",
-  "text.owner_transfer_completed": "owner transfer completed",
-  "text.password becomes the default and must be told to them": "The password goes back to the default. No email is sent, so you have to tell them the new password yourself.",
+  "text.owner_transfer_completed": "made $t(term.domain) owner.",
   "text.password rule": "make sure it's at least 15 characters OR at least 8 characters including a number and a lowercase letter.",
   "text.passwords do not match": "these passwords don't match.",
   "text.pick a module on the left": "Pick a module on the left to see what it lets this role do.",
   "text.pick a seat to see what it opens": "Pick a seat to see what it opens.",
-  "text.please enter the email of the user you want to transfer owner": "please enter the email of the user you want to transfer owner",
+  "text.please enter the email of the user you want to transfer owner": "enter the email of the user to make $t(term.domain) owner",
   "text.please enter username or email": "please enter username or email",
   "text.please try again": "Try again in a moment.",
   "text.please_fill_all_required_fields": "please fill all required fields",
@@ -297,7 +310,6 @@
   "text.the appliance could not be loaded": "the appliance could not be loaded",
   "text.the application could not be loaded": "the application could not be loaded",
   "text.the binding could not be loaded": "the binding could not be loaded",
-  "text.the code is printed in the invitation email": "the code is printed in the invitation email.",
   "text.the current access token stops working immediately": "the current access token stops working immediately, and anything using it has to be given the new one.",
   "text.the current secret stops working immediately": "the current secret stops working immediately, and anything using it has to be given the new one.",
   "text.the list could not be loaded": "the list could not be loaded",
@@ -305,7 +317,6 @@
   "text.this credential has been revoked": "this credential was revoked. the appliance cannot reach the system until a new access token is issued.",
   "text.this domain is top level and inherits from nowhere": "top level — nothing is inherited here",
   "text.this field is required": "this field is required",
-  "text.this invitation cannot be used": "this invitation cannot be used.",
   "text.this plant may call the seat what it likes": "Call the seat whatever this plant calls it.",
   "text.this role no longer exists": "this role no longer exists",
   "text.token expiry time": "token expiry time",
@@ -328,11 +339,9 @@
   "text.x_cannot_delete": "{x} cannot be deleted",
   "text.x_created_successfully": "{x} created successfully",
   "text.x_deleted_successfully": "{x} deleted successfully",
-  "text.you have joined. sign in to continue": "you have joined. sign in to continue.",
   "text.your account is locked": "your account is locked.",
   "text.your account is not activated": "your account is not activated.",
   "text.your email address": "your email address",
-  "title.accept invitation": "accept invitation",
   "title.activate account": "activate account",
   "title.add domain owner": "add domain owner",
   "title.add template privileges": "add template privileges",
@@ -350,7 +359,7 @@
   "title.move to this domain": "move to this domain",
   "title.nothing selected": "nothing selected",
   "title.open attributes view": "open attributes view",
-  "title.owner_transfer": "owner transfer",
+  "title.owner_transfer": "$t(term.domain) owner",
   "title.partners": "partners",
   "title.passkey offer": "Add a passkey",
   "title.protected-privileges": "protected privileges",
@@ -361,6 +370,7 @@
   "title.sign in": "sign in",
   "title.sign up": "sign up",
   "title.unlock account": "unlock account",
+  "title.user details": "user details",
   "access-request.title.access requests": "access requests",
   "access-request.title.my access requests": "my access requests",
   "access-request.title.decide": "decide the access request",

package/translations/es.json

@@ -1,5 +1,4 @@
 {
-  "button.accept invitation": "aceptar invitación",
   "button.activate": "activar",
   "button.add passkey": "Añadir una llave de acceso",
   "button.add what it can do": "Añadir lo que puede hacer",
@@ -41,7 +40,7 @@
   "button.stand it here": "colocarlo aquí",
   "button.submit": "enviar",
   "button.terminate contract": "rescindir",
-  "button.transfer owner": "transferir propiedad",
+  "button.transfer owner": "designar propietario del $t(term.domain)",
   "button.unlock": "desbloquear",
   "button.withdraw": "retirar",
   "error.cannot_modify_system_subdomain": "el subdominio 'system' no se puede modificar.",
@@ -139,8 +138,6 @@
   "label.execute": "Ejecutar",
   "label.inactive-user": "inactivo",
   "label.inherited": "Heredado",
-  "label.invitation code": "código de invitación",
-  "label.invitations": "invitaciones",
   "label.invite customer": "invitar cliente",
   "label.invite user": "invitar usuario",
   "label.language": "idioma",
@@ -160,7 +157,6 @@
   "label.search_domain": "buscar dominio",
   "label.select_domain": "seleccionar dominio",
   "label.send activation email": "enviar correo de activación",
-  "label.send invitation": "enviar invitación",
   "label.signin with": "iniciar sesión con {title}",
   "label.state": "estado",
   "label.subject": "asunto",
@@ -175,8 +171,11 @@
   "text.a blank seat opens nothing until you give it privileges": "Un puesto vacío no da acceso a nada hasta que se le asignen privilegios.",
   "text.a role of this name exists and will be added to": "Ya existe un rol con este nombre. Se usará tal como está y se le añadirán estos privilegios.",
   "text.a role of this name is already visible": "ya se muestra un rol con este nombre",
-  "text.account exists so joins immediately": "Esta cuenta ya existe. Al añadirla, obtendrá acceso de inmediato.",
-  "text.account will be created with the default password": "Ninguna cuenta usa todavía esta dirección. Se creará una con la contraseña predeterminada, que deberá comunicarle usted mismo.",
+  "text.add user puts an account into this domain": "Una cuenta sirve para varios dominios. Búsquela por correo, añádala a este dominio y asígnele roles.",
+  "label.account exists": "si la cuenta existe",
+  "text.they join this domain at once": "se une a este dominio de inmediato.",
+  "label.no account": "si no hay cuenta",
+  "text.roles decide the screens they open": "deciden qué pantallas puede abrir.",
   "text.add template privileges": "añade los {count} privilegios que concede la plantilla {template} y que faltan en este rol: {list}",
   "text.add_domain_owner_description": "conceder permiso de propietario a otro miembro del dominio.",
   "text.already in this domain": "ya está aquí",
@@ -192,7 +191,7 @@
   "text.are_you_sure_to_delete_x": "¿está seguro de que desea eliminar {x}?",
   "text.are_you_sure_to_remove_domain_owner": "¿está seguro de que desea quitar a {x} como propietario del dominio?",
   "text.are_you_sure_to_terminate_contract": "¿está seguro de que desea rescindir el contrato?",
-  "text.are_you_sure_to_transfer_owner": "¿está seguro de que desea transferir la propiedad?",
+  "text.are_you_sure_to_transfer_owner": "¿designar a este usuario como propietario del $t(term.domain)?",
   "text.are_you_sure_to_x": "¿está seguro de que desea {x}?",
   "text.are_you_sure_to_x_user": "¿está seguro de que desea {x} al usuario?",
   "text.attribute management": "gestión de atributos",
@@ -205,14 +204,31 @@
   "text.cannot be undone": "No se puede deshacer",
   "text.cannot_delete": "no se puede eliminar",
   "text.change password": "cambiar contraseña",
-  "text.choose a password to finish joining": "elija una contraseña para completar el registro.",
   "text.click login history": "Si desea ver su historial reciente de inicio de sesión, haga clic",
   "text.completed": "completado",
   "text.confirm password": "confirmar contraseña",
-  "text.confirm the address this invitation was sent to": "introduzca la dirección a la que se envió esta invitación.",
   "text.copied": "copiado",
   "text.copying needs a secure connection": "para copiar se necesita una conexión segura — seleccione el valor y cópielo manualmente",
   "text.could not be saved": "no se pudo guardar — consulte el motivo en el mensaje anterior",
+  "text.could not look up the account": "no se pudo comprobar la cuenta.",
+  "button.issue link": "emitir enlace",
+  "button.copied": "copiado",
+  "button.reissue setup link": "volver a emitir el enlace",
+  "button.password reset link": "enlace para restablecer la contraseña",
+  "label.how the link travels": "cómo se entrega el enlace",
+  "label.send by mail": "enviar por correo",
+  "label.copy the link": "copiar el enlace",
+  "label.password-setup-pending-user": "pendiente de contraseña",
+  "title.password setup link": "enlace de configuración de contraseña",
+  "title.set a new password": "establecer una nueva contraseña",
+  "text.a new link retires the last one": "Esta cuenta espera su contraseña. Un enlace nuevo anula el anterior.",
+  "text.the current password stops and sessions end": "Al emitirlo, la contraseña actual deja de funcionar y se cierran las sesiones abiertas. La persona establece una nueva con el enlace.",
+  "text.the link works once for 48 hours and asks for the address": "El enlace sirve una vez, durante 48 horas, y pide esta dirección de correo al abrirse.",
+  "text.hand it over yourself": "entréguelo usted mismo, por mensaje o en papel",
+  "text.the link was mailed to x until y": "El enlace se envió a {x}. Sirve hasta {y}.",
+  "text.this link is shown only now until y": "Este enlace se muestra solo ahora. Sirve hasta {y}; si se pierde, emita otro.",
+  "text.an account is made and a setup link handed over": "se crea la cuenta y se entrega un enlace de configuración de contraseña. La persona la establece con él en 48 horas.",
+  "text.the address this link was sent for": "la dirección a la que se envió este enlace",
   "text.could not register": "no se pudo registrar — consulte el motivo en el mensaje anterior",
   "text.create role": "crear rol",
   "text.credentials": "credenciales",
@@ -239,11 +255,9 @@
   "text.inherited roles are edited in their own domain": "Estos roles están definidos en un dominio principal y solo se pueden cambiar allí.",
   "text.invalid-email": "no es una dirección de correo electrónico",
   "text.invalid-username": "use un ID o una dirección de correo electrónico",
-  "text.invitation resent": "invitación enviada de nuevo.",
   "text.missing against template": "faltan {count}",
   "text.new password": "nueva contraseña",
   "text.no account and no default password": "Ninguna cuenta usa esta dirección y este sistema no tiene contraseña predeterminada. La persona debe registrarse primero.",
-  "text.no account so an invitation will be mailed": "aún no hay cuenta, así que se enviará una invitación por correo. la persona elegirá su propia contraseña.",
   "text.no description for this privilege": "Todavía no se ha redactado una descripción para este privilegio.",
   "text.no description for this role": "Todavía no hay descripción — redáctela en la lista de roles.",
   "text.no domain available": "no hay ningún dominio disponible",
@@ -263,13 +277,12 @@
   "text.nothing matches x": "Ningún nombre de módulo contiene \"{x}\".",
   "text.opens nothing, receives approvals": "no da acceso a nada — este puesto recibe aprobaciones",
   "text.owner opens everything without a role": "Como propietario, puede abrir todas las pantallas sin un rol. Los demás necesitan uno.",
-  "text.owner_transfer_completed": "transferencia de propiedad completada",
-  "text.password becomes the default and must be told to them": "La contraseña vuelve a la predeterminada. No se envía ningún correo, así que deberá comunicarle usted mismo la nueva contraseña.",
+  "text.owner_transfer_completed": "designado como propietario del $t(term.domain).",
   "text.password rule": "debe tener al menos 15 caracteres, o al menos 8 caracteres incluidos un número y una letra minúscula.",
   "text.passwords do not match": "las contraseñas no coinciden.",
   "text.pick a module on the left": "Seleccione un módulo a la izquierda para ver lo que este rol puede hacer en él.",
   "text.pick a seat to see what it opens": "Seleccione un puesto para ver a qué da acceso.",
-  "text.please enter the email of the user you want to transfer owner": "introduzca el correo electrónico del usuario al que desea transferir la propiedad",
+  "text.please enter the email of the user you want to transfer owner": "introduzca el correo del usuario que será propietario del $t(term.domain)",
   "text.please enter username or email": "introduzca el nombre de usuario o el correo electrónico",
   "text.please try again": "Vuelva a intentarlo en un momento.",
   "text.please_fill_all_required_fields": "complete todos los campos obligatorios",
@@ -297,7 +310,6 @@
   "text.the appliance could not be loaded": "no se pudo cargar el dispositivo",
   "text.the application could not be loaded": "no se pudo cargar la aplicación",
   "text.the binding could not be loaded": "no se pudo cargar la vinculación",
-  "text.the code is printed in the invitation email": "el código figura en el correo de invitación.",
   "text.the current access token stops working immediately": "el token de acceso actual deja de funcionar de inmediato, y todo lo que lo use deberá recibir el nuevo.",
   "text.the current secret stops working immediately": "el secreto actual deja de funcionar de inmediato, y todo lo que lo use deberá recibir el nuevo.",
   "text.the list could not be loaded": "no se pudo cargar la lista",
@@ -305,7 +317,6 @@
   "text.this credential has been revoked": "esta credencial se ha revocado. el dispositivo no podrá acceder al sistema hasta que se emita un nuevo token de acceso.",
   "text.this domain is top level and inherits from nowhere": "nivel superior — aquí no se hereda nada",
   "text.this field is required": "este campo es obligatorio",
-  "text.this invitation cannot be used": "esta invitación no se puede usar.",
   "text.this plant may call the seat what it likes": "Llame al puesto como lo llamen en esta planta.",
   "text.this role no longer exists": "este rol ya no existe",
   "text.token expiry time": "hora de caducidad del token",
@@ -328,11 +339,9 @@
   "text.x_cannot_delete": "{x} no se puede eliminar",
   "text.x_created_successfully": "{x} creado correctamente",
   "text.x_deleted_successfully": "{x} eliminado correctamente",
-  "text.you have joined. sign in to continue": "se ha unido. inicie sesión para continuar.",
   "text.your account is locked": "su cuenta está bloqueada.",
   "text.your account is not activated": "su cuenta no está activada.",
   "text.your email address": "su dirección de correo electrónico",
-  "title.accept invitation": "aceptar invitación",
   "title.activate account": "activar cuenta",
   "title.add domain owner": "añadir propietario del dominio",
   "title.add template privileges": "añadir privilegios de la plantilla",
@@ -350,7 +359,7 @@
   "title.move to this domain": "ir a este dominio",
   "title.nothing selected": "no hay nada seleccionado",
   "title.open attributes view": "abrir vista de atributos",
-  "title.owner_transfer": "transferencia de propiedad",
+  "title.owner_transfer": "propietario del $t(term.domain)",
   "title.partners": "socios",
   "title.passkey offer": "Añadir una llave de acceso",
   "title.protected-privileges": "privilegios protegidos",
@@ -361,6 +370,7 @@
   "title.sign in": "iniciar sesión",
   "title.sign up": "registrarse",
   "title.unlock account": "desbloquear cuenta",
+  "title.user details": "detalles del usuario",
   "access-request.title.access requests": "solicitudes de acceso",
   "access-request.title.my access requests": "mis solicitudes de acceso",
   "access-request.title.decide": "resolver la solicitud de acceso",