@things-factory/auth-ui 10.1.29 → 10.1.33

package/dist-client/utils/role-origin.js

@@ -0,0 +1,47 @@
+/**
+ * When a list of roles has to say where each one came from. (Pure rule.)
+ *
+ * ## The situation it is for
+ *
+ * Roles are visible one level up: a domain sees its own and its parent's. Nothing stops a
+ * domain having a role with the same name as one it inherits — the duplicate checks on the
+ * server ask only about the domain itself — so a picker can offer two rows reading `approver`
+ * with no way to tell them apart. Whichever gets ticked decides who a gate lets through, and
+ * an approval line can end up pointing at the one nobody looks at (ADR-0062 decision 3).
+ *
+ * ## Why the rule is about the list and not about one role
+ *
+ * A role does not know whether it is inherited — that depends on which domain is being looked
+ * at, and a list of roles from one domain is the ordinary case. So the question is asked of the
+ * list: **does this set span more than one domain?** If it does, every row says which, and the
+ * rows that shared a name stop being identical. If it does not, nothing is added and the
+ * ordinary case stays quiet.
+ *
+ * That also answers correctly for a role whose name happens to be unique but which still comes
+ * from somewhere else — granting one of those is a different act from granting your own, and
+ * the operator should be able to see which they are doing.
+ */
+/**
+ * Should this list show where each role comes from?
+ *
+ * False when every role names the same domain, when none of them names one at all, and for an
+ * empty list. A list that is only partly labelled counts as spanning — one row that cannot say
+ * where it came from, beside rows that can, is the ambiguity this exists to remove.
+ */
+export function showsRoleOrigin(roles) {
+    if (!roles || roles.length < 2) {
+        return false;
+    }
+    const origins = new Set(roles.map(role => role?.domain?.name || ''));
+    return origins.size > 1;
+}
+/**
+ * What to print beside a role, or an empty string.
+ *
+ * A role with no domain on it prints nothing rather than a placeholder: the list is already
+ * labelled, so an unlabelled row reads as "not said" instead of as a domain called something.
+ */
+export function roleOrigin(role) {
+    return role?.domain?.name || '';
+}
+//# sourceMappingURL=role-origin.js.map

package/dist-client/utils/role-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-origin.js","sourceRoot":"","sources":["../../client/utils/role-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAA0C;IACxE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IAEpE,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAA;AACjC,CAAC","sourcesContent":["/**\n * When a list of roles has to say where each one came from. (Pure rule.)\n *\n * ## The situation it is for\n *\n * Roles are visible one level up: a domain sees its own and its parent's. Nothing stops a\n * domain having a role with the same name as one it inherits — the duplicate checks on the\n * server ask only about the domain itself — so a picker can offer two rows reading `approver`\n * with no way to tell them apart. Whichever gets ticked decides who a gate lets through, and\n * an approval line can end up pointing at the one nobody looks at (ADR-0062 decision 3).\n *\n * ## Why the rule is about the list and not about one role\n *\n * A role does not know whether it is inherited — that depends on which domain is being looked\n * at, and a list of roles from one domain is the ordinary case. So the question is asked of the\n * list: **does this set span more than one domain?** If it does, every row says which, and the\n * rows that shared a name stop being identical. If it does not, nothing is added and the\n * ordinary case stays quiet.\n *\n * That also answers correctly for a role whose name happens to be unique but which still comes\n * from somewhere else — granting one of those is a different act from granting your own, and\n * the operator should be able to see which they are doing.\n */\n\n/** The part of a role this rule reads. `domain` is absent on lists that never asked for it. */\nexport type RoleWithOrigin = {\n  domain?: { name?: string | null } | null\n} | null | undefined\n\n/**\n * Should this list show where each role comes from?\n *\n * False when every role names the same domain, when none of them names one at all, and for an\n * empty list. A list that is only partly labelled counts as spanning — one row that cannot say\n * where it came from, beside rows that can, is the ambiguity this exists to remove.\n */\nexport function showsRoleOrigin(roles: RoleWithOrigin[] | null | undefined): boolean {\n  if (!roles || roles.length < 2) {\n    return false\n  }\n\n  const origins = new Set(roles.map(role => role?.domain?.name || ''))\n\n  return origins.size > 1\n}\n\n/**\n * What to print beside a role, or an empty string.\n *\n * A role with no domain on it prints nothing rather than a placeholder: the list is already\n * labelled, so an unlabelled row reads as \"not said\" instead of as a domain called something.\n */\nexport function roleOrigin(role: RoleWithOrigin): string {\n  return role?.domain?.name || ''\n}\n"]}

package/dist-client/utils/role-origin.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/role-origin.test.js

@@ -0,0 +1,60 @@
+import { roleOrigin, showsRoleOrigin } from './role-origin';
+/**
+ * Whether a role picker has to say where each role came from.
+ *
+ * The cost of being wrong is not symmetric. Saying nothing when the list spans two domains
+ * leaves two identical checkboxes, and ticking the wrong one points a gate — or an approval
+ * line — at a role nobody looks at. Saying it when there is nothing to disambiguate only adds
+ * a word.
+ */
+const OURS = { domain: { name: 'acme' } };
+const THEIRS = { domain: { name: 'system' } };
+describe('a list that needs to say', () => {
+    it('spans two domains', () => {
+        /* ⚠ The case. Two rows can read the same name and only this separates them. */
+        expect(showsRoleOrigin([OURS, THEIRS])).toBe(true);
+    });
+    it('says so even when the names do not collide', () => {
+        /*
+         * Granting an inherited role is a different act from granting your own, whether or not
+         * some other row happens to share its name.
+         */
+        expect(showsRoleOrigin([{ domain: { name: 'acme' } }, { domain: { name: 'system' } }])).toBe(true);
+    });
+    it('counts a row that cannot say where it came from as a difference', () => {
+        /*
+         * ⚠ A half-labelled list is the ambiguity, not the cure. One blank row beside labelled ones
+         * is exactly what the reader cannot resolve.
+         */
+        expect(showsRoleOrigin([OURS, {}])).toBe(true);
+        expect(showsRoleOrigin([OURS, { domain: null }])).toBe(true);
+    });
+});
+describe('a list that does not', () => {
+    it('is all one domain', () => {
+        expect(showsRoleOrigin([OURS, OURS, OURS])).toBe(false);
+    });
+    it('never asked for the domain at all', () => {
+        /* Nothing to say. Labelling every row with nothing would be noise, not information. */
+        expect(showsRoleOrigin([{}, {}])).toBe(false);
+    });
+    it('has one role, or none', () => {
+        expect(showsRoleOrigin([OURS])).toBe(false);
+        expect(showsRoleOrigin([])).toBe(false);
+        expect(showsRoleOrigin(null)).toBe(false);
+        expect(showsRoleOrigin(undefined)).toBe(false);
+    });
+});
+describe('what is printed beside a role', () => {
+    it('is the domain it came from', () => {
+        expect(roleOrigin(OURS)).toEqual('acme');
+    });
+    it('is nothing when the role does not carry one', () => {
+        /* Not a placeholder. An unlabelled row reads as "not said", not as a domain named that. */
+        expect(roleOrigin({})).toEqual('');
+        expect(roleOrigin({ domain: null })).toEqual('');
+        expect(roleOrigin(null)).toEqual('');
+        expect(roleOrigin({ domain: { name: null } })).toEqual('');
+    });
+});
+//# sourceMappingURL=role-origin.test.js.map

package/dist-client/utils/role-origin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-origin.test.js","sourceRoot":"","sources":["../../client/utils/role-origin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE3D;;;;;;;GAOG;AAEH,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;AACzC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAA;AAE7C,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,+EAA+E;QAC/E,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD;;;WAGG;QACH,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE;;;WAGG;QACH,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,uFAAuF;QACvF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,2FAA2F;QAC3F,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { roleOrigin, showsRoleOrigin } from './role-origin'\n\n/**\n * Whether a role picker has to say where each role came from.\n *\n * The cost of being wrong is not symmetric. Saying nothing when the list spans two domains\n * leaves two identical checkboxes, and ticking the wrong one points a gate — or an approval\n * line — at a role nobody looks at. Saying it when there is nothing to disambiguate only adds\n * a word.\n */\n\nconst OURS = { domain: { name: 'acme' } }\nconst THEIRS = { domain: { name: 'system' } }\n\ndescribe('a list that needs to say', () => {\n  it('spans two domains', () => {\n    /* ⚠ The case. Two rows can read the same name and only this separates them. */\n    expect(showsRoleOrigin([OURS, THEIRS])).toBe(true)\n  })\n\n  it('says so even when the names do not collide', () => {\n    /*\n     * Granting an inherited role is a different act from granting your own, whether or not\n     * some other row happens to share its name.\n     */\n    expect(showsRoleOrigin([{ domain: { name: 'acme' } }, { domain: { name: 'system' } }])).toBe(true)\n  })\n\n  it('counts a row that cannot say where it came from as a difference', () => {\n    /*\n     * ⚠ A half-labelled list is the ambiguity, not the cure. One blank row beside labelled ones\n     * is exactly what the reader cannot resolve.\n     */\n    expect(showsRoleOrigin([OURS, {}])).toBe(true)\n    expect(showsRoleOrigin([OURS, { domain: null }])).toBe(true)\n  })\n})\n\ndescribe('a list that does not', () => {\n  it('is all one domain', () => {\n    expect(showsRoleOrigin([OURS, OURS, OURS])).toBe(false)\n  })\n\n  it('never asked for the domain at all', () => {\n    /* Nothing to say. Labelling every row with nothing would be noise, not information. */\n    expect(showsRoleOrigin([{}, {}])).toBe(false)\n  })\n\n  it('has one role, or none', () => {\n    expect(showsRoleOrigin([OURS])).toBe(false)\n    expect(showsRoleOrigin([])).toBe(false)\n    expect(showsRoleOrigin(null)).toBe(false)\n    expect(showsRoleOrigin(undefined)).toBe(false)\n  })\n})\n\ndescribe('what is printed beside a role', () => {\n  it('is the domain it came from', () => {\n    expect(roleOrigin(OURS)).toEqual('acme')\n  })\n\n  it('is nothing when the role does not carry one', () => {\n    /* Not a placeholder. An unlabelled row reads as \"not said\", not as a domain named that. */\n    expect(roleOrigin({})).toEqual('')\n    expect(roleOrigin({ domain: null })).toEqual('')\n    expect(roleOrigin(null)).toEqual('')\n    expect(roleOrigin({ domain: { name: null } })).toEqual('')\n  })\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-ui",
-  "version": "10.1.29",
+  "version": "10.1.33",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -38,11 +38,11 @@
     "@operato/p13n": "^10.0.0",
     "@operato/popup": "^10.0.0",
     "@operato/styles": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.29",
-    "@things-factory/component-ui": "^10.1.29",
-    "@things-factory/more-base": "^10.1.29",
+    "@things-factory/auth-base": "^10.1.33",
+    "@things-factory/component-ui": "^10.1.33",
+    "@things-factory/more-base": "^10.1.33",
     "base64url": "^3.0.1",
     "clipboard": "^2.0.6"
   },
-  "gitHead": "e6bf9dec003fe5e794746aaeb5852b3b50478232"
+  "gitHead": "7fb7b6587846b5ff6ee7a4983652d9561b4d6b2c"
 }

package/things-factory.config.js

@@ -11,6 +11,7 @@ export default {
     { tagname: 'role-list-page', page: 'roles' },
     { tagname: 'role-privilege-page', page: 'role-privileges' },
     { tagname: 'user-list-page', page: 'users' },
+    { tagname: 'invitations-page', page: 'invitations' },
     { tagname: 'partner-management', page: 'partners' },
     { tagname: 'domain-management', page: 'domains' },
     { tagname: 'domain-owner-management', page: 'domain-owners' },

package/translations/en.json

@@ -1,4 +1,5 @@
 {
+  "button.accept invitation": "accept invitation",
   "button.activate": "activate",
   "button.add what it can do": "Add what it can do",
   "button.cancel": "cancel",
@@ -25,17 +26,22 @@
   "button.remove from domain": "Remove from domain",
   "button.remove owner": "remove owner",
   "button.renew access token": "renew access token",
+  "button.resend": "send again",
   "button.reveal": "reveal",
+  "button.revoke credential": "revoke credential",
   "button.save": "save",
   "button.security-key registration": "security key registration",
   "button.show-all": "Show all",
   "button.show-orphans-only": "Show orphans only",
+  "button.sign in": "sign in",
   "button.sign_in": "sign in",
+  "button.stand it here": "stand it here",
   "button.submit": "submit",
   "button.terminate contract": "terminate",
   "button.transfer owner": "transfer owner",
   "button.unlock": "unlock",
   "button.update": "update",
+  "button.withdraw": "withdraw",
   "error.cannot_modify_system_subdomain": "the 'system' subdomain cannot be modified.",
   "error.domain not allowed": "the '{subdomain}' domain is not allowed for this user.",
   "error.new-password-and-confirm-password-do-not-match": "new password and confirm password do not match",
@@ -48,6 +54,7 @@
   "error.value is empty": "{value} is empty",
   "error.x already exists in y": "{x} already exists in {y}",
   "error: domain name should consist only of letters or dashes": "a domain name can use letters and dashes only",
+  "field.accepted at": "accepted at",
   "field.access token url": "access token url",
   "field.accessed-at": "accessed at",
   "field.app key": "app key",
@@ -61,14 +68,17 @@
   "field.client-secret": "client secret",
   "field.confirm password": "confirm password",
   "field.contact email": "contact email",
+  "field.created at": "created at",
   "field.description": "description",
   "field.email": "email address",
   "field.entity": "entity",
+  "field.expires at": "expires at",
   "field.forgot-password": "forgot password",
   "field.granted at": "granted at",
   "field.granted by": "granted by",
   "field.granted privileges": "What it can do",
   "field.hidden": "hidden",
+  "field.invited": "invited",
   "field.ip_address": "IP address",
   "field.model": "model",
   "field.module": "Module",
@@ -94,6 +104,7 @@
   "field.sign up": "sign up",
   "field.source": "Source",
   "field.source-domain": "source domain",
+  "field.state": "state",
   "field.status": "status",
   "field.tag": "tag",
   "field.target-domain": "target domain",
@@ -136,6 +147,8 @@
   "label.execute": "Execute",
   "label.inactive-user": "inactive",
   "label.inherited": "Inherited",
+  "label.invitation code": "invitation code",
+  "label.invitations": "invitations",
   "label.invite customer": "invite customer",
   "label.invite user": "invite user",
   "label.language": "language",
@@ -155,6 +168,7 @@
   "label.search_domain": "search domain",
   "label.select_domain": "select domain",
   "label.send activation email": "send activation email",
+  "label.send invitation": "send invitation",
   "label.signin with": "signin with {title}",
   "label.state": "state",
   "label.subject": "subject",
@@ -168,6 +182,7 @@
   "label.x name": "{x} name",
   "text.a blank seat opens nothing until you give it privileges": "A blank seat opens nothing until you give it privileges.",
   "text.a role of this name exists and will be added to": "A role of this name already exists. It will be used as it stands and these privileges added to it.",
+  "text.a role of this name is already visible": "a role of this name is already visible",
   "text.account exists so joins immediately": "This account already exists. Adding it lets them in right away.",
   "text.account will be created with the default password": "No account uses this address yet. One is created with the default password, which you have to tell them yourself.",
   "text.add_domain_owner_description": "grant another domain member owner permission.",
@@ -197,9 +212,11 @@
   "text.cannot be undone": "Cannot be undone",
   "text.cannot_delete": "cannot be deleted",
   "text.change password": "change password",
+  "text.choose a password to finish joining": "choose a password to finish joining.",
   "text.click login history": "If you want to see your recent login history, click",
   "text.completed": "completed",
   "text.confirm password": "confirm password",
+  "text.confirm the address this invitation was sent to": "enter the address this invitation was sent to.",
   "text.copied": "copied",
   "text.copying needs a secure connection": "copying needs a secure connection — select the value and copy it by hand",
   "text.could not be saved": "could not be saved — see the message above for the reason",
@@ -225,13 +242,16 @@
   "text.failed": "failed",
   "text.failed to fetch": "could not read the list",
   "text.filter by module name": "Filter by module name",
+  "text.from x": "from {x}",
   "text.inherited from x": "inherited from {x}",
   "text.inherited roles are edited in their own domain": "These roles are defined in a parent domain and can only be changed there.",
   "text.invalid-email": "that is not an email address",
   "text.invalid-username": "use an id or an email address",
+  "text.invitation resent": "invitation sent again.",
   "text.loading": "loading…",
   "text.new password": "new password",
   "text.no account and no default password": "No account uses this address, and this system has no default password. They have to sign up first.",
+  "text.no account so an invitation will be mailed": "no account yet, so an invitation will be mailed. they choose their own password.",
   "text.no description for this privilege": "No description has been written for this privilege yet.",
   "text.no description for this role": "No description yet — write one in the role list.",
   "text.no domain available": "no domain available",
@@ -266,6 +286,7 @@
   "text.registered roles": "registered roles",
   "text.remaining time": "{days} days {hours} hours {mins} mins {secs} seconds remain",
   "text.remove the role from x people first": "To delete this role, first take it away from the {x} people who hold it.",
+  "text.revoking stops every token this appliance holds": "this appliance stops being able to reach the system from the next request. nothing it holds keeps working, and issuing a new access token is the only way back.",
   "text.role belongs to x domain and is edited there": "This role is defined in {x} and can only be edited there. It is shown here because it can be granted here.",
   "text.role_management": "role management",
   "text.roles in use are kept": "Roles that someone still holds are kept. Only the unused ones are deleted.",
@@ -274,6 +295,7 @@
   "text.signed in": "signed in",
   "text.signed out": "signed out",
   "text.source_and_target_domain_cannot_be_same": "source and target domain cannot be same",
+  "text.stand this domain own role of the same name": "{name} is defined in {domain} and is already visible here. stand this domain's own role of the same name only if you mean to replace what it inherits — the name stays the same.",
   "text.start from a blank seat": "start from a blank seat",
   "text.struck through are not installed here": "Struck through are privileges this installation does not have.",
   "text.subdomain_change_critical_warning": "warning: changing the subdomain will alter the full access URL (/{type}/{subdomain}/...) and may invalidate existing external links, bookmarks, and active user sessions. please proceed with caution.",
@@ -281,12 +303,15 @@
   "text.the appliance could not be loaded": "the appliance could not be loaded",
   "text.the application could not be loaded": "the application could not be loaded",
   "text.the binding could not be loaded": "the binding could not be loaded",
+  "text.the code is printed in the invitation email": "the code is printed in the invitation email.",
   "text.the current access token stops working immediately": "the current access token stops working immediately, and anything using it has to be given the new one.",
   "text.the current secret stops working immediately": "the current secret stops working immediately, and anything using it has to be given the new one.",
   "text.the list could not be loaded": "the list could not be loaded",
   "text.they lose access to this domain but keep the account": "They lose access to this domain. The account itself remains, so you can add them again later.",
+  "text.this credential has been revoked": "this credential was revoked. the appliance cannot reach the system until a new access token is issued.",
   "text.this domain is top level and inherits from nowhere": "top level — nothing is inherited here",
   "text.this field is required": "this field is required",
+  "text.this invitation cannot be used": "this invitation cannot be used.",
   "text.this plant may call the seat what it likes": "Call the seat whatever this plant calls it.",
   "text.this role no longer exists": "this role no longer exists",
   "text.token expiry time": "token expiry time",
@@ -294,6 +319,7 @@
   "text.updated_successfully": "updated successfully",
   "text.user invitation prompt": "Please enter the username or email address of the user you wish to invite.",
   "text.user management": "user management",
+  "text.users": "users",
   "text.view only": "Inherited role — view only",
   "text.where an integration asks for an authorization code": "where an integration asks for an authorization code",
   "text.where that code is exchanged for an access token": "where that code is exchanged for an access token",
@@ -307,8 +333,10 @@
   "text.x_cannot_delete": "{x} cannot be deleted",
   "text.x_created_successfully": "{x} created successfully",
   "text.x_deleted_successfully": "{x} deleted successfully",
+  "text.you have joined. sign in to continue": "you have joined. sign in to continue.",
   "text.your account is not activated": "your account is not activated.",
   "text.your email address": "your email address",
+  "title.accept invitation": "accept invitation",
   "title.add domain owner": "add domain owner",
   "title.attribute model": "attribute model",
   "title.attribute-item list": "attribute-item list",

package/translations/ja.json

@@ -1,4 +1,5 @@
 {
+  "button.accept invitation": "招待を受ける",
   "button.activate": "アクティブ化",
   "button.cancel": "キャンセル",
   "button.close": "閉じる",
@@ -20,16 +21,21 @@
   "button.name it yourself": "name it yourself",
   "button.register": "登録",
   "button.renew access token": "アクセストークンを更新",
+  "button.resend": "再送する",
   "button.reveal": "表示",
+  "button.revoke credential": "資格情報を取り消す",
   "button.save": "保存",
   "button.security-key registration": "セキュリティキー登録",
   "button.show-all": "すべて表示",
   "button.show-orphans-only": "Orphanのみ表示",
+  "button.sign in": "ログイン",
   "button.sign_in": "ログイン",
+  "button.stand it here": "ここに作る",
   "button.submit": "送信",
   "button.terminate contract": "契約解除",
   "button.transfer owner": "管理者付与",
   "button.update": "更新",
+  "button.withdraw": "招待を取り消す",
   "error.cannot_modify_system_subdomain": "'system'サブドメインは変更できません。",
   "error.domain not allowed": "このドメインは許可されていません.",
   "error.new-password-and-confirm-password-do-not-match": "新しいパスワードと確認パスワードが一致しません.",
@@ -42,6 +48,7 @@
   "error.value is empty": "{value}の値が存在しません.",
   "error.x already exists in y": "{x}が既に{y}に存在します.",
   "error: domain name should consist only of letters or dashes": "ドメイン名には英字とハイフンのみ使えます",
+  "field.accepted at": "承諾日時",
   "field.access token url": "access token url",
   "field.accessed-at": "ログイン日時",
   "field.app key": "app key",
@@ -55,11 +62,14 @@
   "field.client-secret": "クライアントシークレット",
   "field.confirm password": "パスワード確認",
   "field.contact email": "連絡先メール",
+  "field.created at": "送信日時",
   "field.description": "説明",
   "field.email": "メール",
   "field.entity": "エンティティ",
+  "field.expires at": "有効期限",
   "field.forgot-password": "パスワードを忘れましたか?",
   "field.hidden": "隠し",
+  "field.invited": "招待",
   "field.ip_address": "IPアドレス",
   "field.model": "モデル",
   "field.name": "名前",
@@ -80,6 +90,7 @@
   "field.sign out": "ログアウト",
   "field.sign up": "ユーザー登録",
   "field.source-domain": "ソースドメイン",
+  "field.state": "状態",
   "field.status": "状態",
   "field.tag": "タグ",
   "field.target-domain": "ターゲットドメイン",
@@ -114,6 +125,8 @@
   "label.draft": "下書き",
   "label.email": "メール",
   "label.inactive-user": "非アクティブ",
+  "label.invitation code": "招待コード",
+  "label.invitations": "招待",
   "label.invite customer": "顧客社パートナー招待",
   "label.invite user": "ユーザー招待",
   "label.language": "言語",
@@ -131,6 +144,7 @@
   "label.search_domain": "ドメイン検索",
   "label.select_domain": "ドメイン選択",
   "label.send activation email": "アクティブ化要求メール送信",
+  "label.send invitation": "招待メールを送る",
   "label.signin with": "{title} でサインイン",
   "label.state": "状態",
   "label.subject": "タイトル",
@@ -143,6 +157,7 @@
   "label.x name": "{x}名前",
   "text.a blank seat opens nothing until you give it privileges": "A blank seat opens nothing until you give it privileges.",
   "text.a role of this name exists and will be added to": "A role of this name already exists. It will be used as it stands and these privileges added to it.",
+  "text.a role of this name is already visible": "同じ名前のロールが既に見えています",
   "text.already in this domain": "already here",
   "text.an application signs in on its own behalf": "アプリケーションは自身のキーと権限でログインします",
   "text.appliance": "端末装置",
@@ -166,9 +181,11 @@
   "text.bound applications": "連携アプリケーション",
   "text.cannot_delete": "削除できません.",
   "text.change password": "パスワード変更",
+  "text.choose a password to finish joining": "パスワードを決めると参加できます。",
   "text.click login history": "最近のログイン履歴を確認したい場合は、こちらをクリックしてください。",
   "text.completed": "完了しました.",
   "text.confirm password": "パスワード確認",
+  "text.confirm the address this invitation was sent to": "招待を受け取ったアドレスを入力してください。",
   "text.copied": "コピーしました",
   "text.copying needs a secure connection": "コピーは安全な接続でのみ可能です — 値を選択して手動でコピーしてください",
   "text.could not be saved": "保存できませんでした — 理由は上の通知をご覧ください",
@@ -187,10 +204,13 @@
   "text.env-var-list-page": "環境変数リスト",
   "text.expired": "期限切れ",
   "text.expires at x": "{x} 失効",
+  "text.from x": "{x} のロール",
   "text.inherited from x": "{x} から継承しています",
   "text.invalid-email": "メールアドレスの形式が違います",
   "text.invalid-username": "IDまたはメールアドレスを入力してください",
+  "text.invitation resent": "招待メールを再送しました。",
   "text.new password": "新しいパスワード",
+  "text.no account so an invitation will be mailed": "アカウントがないため招待メールを送ります。パスワードは本人が決めます。",
   "text.no domain available": "使用できるドメインがありません.",
   "text.no role to show": "ロールが指定されずに開かれた画面です",
   "text.not issued": "未発行",
@@ -206,12 +226,14 @@
   "text.register new application": "アプリケーションの登録",
   "text.registered roles": "登録されたロールリスト",
   "text.remaining time": "{days}日 {hours}時間 {mins}分 {secs}秒 残っています",
+  "text.revoking stops every token this appliance holds": "この機器は次のリクエストからシステムに接続できなくなります。保持しているトークンはすべて無効になり、新しいアクセストークンを発行するまで戻りません。",
   "text.role_management": "ロール管理",
   "text.select domain": "ドメイン選択",
   "text.should select at least one of x": "少なくとも1つ以上{x}を選択してください.",
   "text.signed in": "ログイン",
   "text.signed out": "ログアウト",
   "text.source_and_target_domain_cannot_be_same": "ソースドメインとターゲットドメインは同じにできません",
+  "text.stand this domain own role of the same name": "{name} は {domain} に定義されており、ここからも見えています。継承しているものを置き換えるつもりの場合のみ、このドメインに同じ名前で作成します。名前はそのままです。",
   "text.start from a blank seat": "start from a blank seat",
   "text.struck through are not installed here": "Struck through are privileges this installation does not have.",
   "text.subdomain_change_critical_warning": "警告: サブドメインを変更すると、フルアクセスURL(/{type}/{subdomain}/...)が変更され、既存のブックマークや外部リンク、アクティブなセッションが無効化される可能性があります。慎重に確認して進めてください。",
@@ -219,17 +241,21 @@
   "text.the appliance could not be loaded": "端末装置を読み込めませんでした",
   "text.the application could not be loaded": "アプリケーションを読み込めませんでした",
   "text.the binding could not be loaded": "連携を読み込めませんでした",
+  "text.the code is printed in the invitation email": "招待メールにコードが記載されています。",
   "text.the current access token stops working immediately": "現在のアクセストークンは直ちに無効になります。利用中の箇所に新しいトークンを渡す必要があります。",
   "text.the current secret stops working immediately": "現在のシークレットは直ちに無効になります。利用中の箇所に新しいシークレットを渡す必要があります。",
   "text.the list could not be loaded": "リストを読み込めませんでした",
+  "text.this credential has been revoked": "取り消された資格情報です。新しいアクセストークンを発行するまで、この機器はシステムに接続できません。",
   "text.this domain is top level and inherits from nowhere": "最上位ドメイン — 継承元がありません",
   "text.this field is required": "必須項目です",
+  "text.this invitation cannot be used": "この招待は使用できません。",
   "text.this plant may call the seat what it likes": "Call the seat whatever this plant calls it.",
   "text.this role no longer exists": "このロールは存在しません",
   "text.token expiry time": "トークン有効期限",
   "text.updated_successfully": "正常にアップデートしました.",
   "text.user invitation prompt": "招待したいユーザーのユーザー名またはメールアドレスを入力してください。",
   "text.user management": "ユーザー管理",
+  "text.users": "ユーザー",
   "text.where an integration asks for an authorization code": "連携側が認可コードを要求するアドレス",
   "text.where that code is exchanged for an access token": "そのコードをアクセストークンに交換するアドレス",
   "text.x modules y privileges": "{x} modules · {y} privileges",
@@ -237,8 +263,10 @@
   "text.x_cannot_delete": "{x}は削除できません.",
   "text.x_created_successfully": "{x}が成功的に作成されました.",
   "text.x_deleted_successfully": "{x}が成功的に削除されました.",
+  "text.you have joined. sign in to continue": "参加しました。ログインしてください。",
   "text.your account is not activated": "アカウントがアクティブ化されていません.",
   "text.your email address": "ユーザー メール",
+  "title.accept invitation": "招待を受ける",
   "title.attribute model": "属性モデル",
   "title.attribute-item list": "属性アイテム リスト",
   "title.attributes": "属性",