@things-factory/auth-ui 10.1.41 → 10.1.46

package/dist-client/utils/{invitation-token.d.ts → link-token.d.ts}

@@ -1,10 +1,11 @@
 /**
- * Taking the invitation token out of the link, and out of the address bar. (Pure rule.)
+ * Taking the token out of a mailed link, and out of the address bar. (Pure rule.)
  *
  * ## Why the token is in the fragment
  *
  * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`
- * reaches the server as `/accept-invitation` and nothing else. The token never appears in an
+ * reaches the server as `/accept-invitation` and nothing else — and the same for
+ * `/reset-password`, `/unlock-user` and `/verify`. The token never appears in an
  * access log, a proxy log, or a `Referer` sent onward to some other site.
  *
  * That leaves the places the browser itself keeps it: the address bar and the history entry.
@@ -19,10 +20,10 @@
  * anchor — to the server as a credential attempt. It answers empty instead, and the page shows
  * the box where the code from the mail can be pasted.
  */
-export type InvitationLink = {
+export type LinkToken = {
     /** The token, or an empty string when the link carries none this rule will read. */
     token: string;
     /** The same URL without its fragment, for the caller to replace the address with. */
     clean: string;
 };
-export declare function readInvitationToken(href: string): InvitationLink;
+export declare function readLinkToken(href: string): LinkToken;

package/dist-client/utils/{invitation-token.js → link-token.js}

@@ -1,10 +1,11 @@
 /**
- * Taking the invitation token out of the link, and out of the address bar. (Pure rule.)
+ * Taking the token out of a mailed link, and out of the address bar. (Pure rule.)
  *
  * ## Why the token is in the fragment
  *
  * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`
- * reaches the server as `/accept-invitation` and nothing else. The token never appears in an
+ * reaches the server as `/accept-invitation` and nothing else — and the same for
+ * `/reset-password`, `/unlock-user` and `/verify`. The token never appears in an
  * access log, a proxy log, or a `Referer` sent onward to some other site.
  *
  * That leaves the places the browser itself keeps it: the address bar and the history entry.
@@ -19,9 +20,9 @@
  * anchor — to the server as a credential attempt. It answers empty instead, and the page shows
  * the box where the code from the mail can be pasted.
  */
-/** 16 bytes as hex, which is what `makeInvitationToken` produces. */
+/** 16 bytes as hex, which is what `makeInvitationToken` and `makeVerificationToken` produce. */
 const TOKEN = /^[0-9a-f]{32}$/;
-export function readInvitationToken(href) {
+export function readLinkToken(href) {
     if (!href) {
         return { token: '', clean: '' };
     }
@@ -37,4 +38,4 @@ export function readInvitationToken(href) {
     const raw = decodeURIComponent(href.slice(hash + 1)).replace(/^invite=/, '');
     return { token: TOKEN.test(raw) ? raw : '', clean };
 }
-//# sourceMappingURL=invitation-token.js.map
+//# sourceMappingURL=link-token.js.map

package/dist-client/utils/link-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-token.js","sourceRoot":"","sources":["../../client/utils/link-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gGAAgG;AAChG,MAAM,KAAK,GAAG,gBAAgB,CAAA;AAS9B,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAEjC;;;OAGG;IACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC","sourcesContent":["/**\n * Taking the token out of a mailed link, and out of the address bar. (Pure rule.)\n *\n * ## Why the token is in the fragment\n *\n * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`\n * reaches the server as `/accept-invitation` and nothing else — and the same for\n * `/reset-password`, `/unlock-user` and `/verify`. The token never appears in an\n * access log, a proxy log, or a `Referer` sent onward to some other site.\n *\n * That leaves the places the browser itself keeps it: the address bar and the history entry.\n * Both are cleared by replacing the URL with the one this returns as `clean`, which is why the\n * two answers come back together — reading the token and removing it are one act, and a caller\n * that did the first without the second would leave it on screen.\n *\n * ## What it refuses to read\n *\n * A token is hex from `crypto.randomBytes(16)`. Anything else in the fragment is not one, and\n * taking it anyway would send whatever a link happened to carry — a tracking fragment, a page\n * anchor — to the server as a credential attempt. It answers empty instead, and the page shows\n * the box where the code from the mail can be pasted.\n */\n\n/** 16 bytes as hex, which is what `makeInvitationToken` and `makeVerificationToken` produce. */\nconst TOKEN = /^[0-9a-f]{32}$/\n\nexport type LinkToken = {\n  /** The token, or an empty string when the link carries none this rule will read. */\n  token: string\n  /** The same URL without its fragment, for the caller to replace the address with. */\n  clean: string\n}\n\nexport function readLinkToken(href: string): LinkToken {\n  if (!href) {\n    return { token: '', clean: '' }\n  }\n\n  const hash = href.indexOf('#')\n\n  if (hash < 0) {\n    return { token: '', clean: href }\n  }\n\n  const clean = href.slice(0, hash)\n\n  /*\n   * `#invite=<token>` as well as a bare `#<token>`. Both shapes turn up in mail clients that\n   * rewrite links, and neither costs anything to accept.\n   */\n  const raw = decodeURIComponent(href.slice(hash + 1)).replace(/^invite=/, '')\n\n  return { token: TOKEN.test(raw) ? raw : '', clean }\n}\n"]}

package/dist-client/utils/link-token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/{invitation-token.test.js → link-token.test.js}

@@ -1,4 +1,4 @@
-import { readInvitationToken } from './invitation-token';
+import { readLinkToken } from './link-token';
 /**
  * Reading the invitation token out of the link, and handing back the link without it.
  *
@@ -10,51 +10,51 @@ const TOKEN = '0123456789abcdef0123456789abcdef';
 const PAGE = 'https://acme.example.com/accept-invitation';
 describe('a link with a token in it', () => {
     it('reads a bare fragment', () => {
-        expect(readInvitationToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE });
+        expect(readLinkToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE });
     });
     it('reads the named form some mail clients produce', () => {
-        expect(readInvitationToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE });
+        expect(readLinkToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE });
     });
     it('reads one that arrived percent-encoded', () => {
-        expect(readInvitationToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN);
+        expect(readLinkToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN);
     });
     it('hands back the address without the fragment', () => {
         /* ⚠ What the caller replaces the address with. Without it the token stays on screen and in
            this history entry, which is the half of the hiding the fragment does not do by itself. */
-        expect(readInvitationToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`);
+        expect(readLinkToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`);
     });
 });
 describe('a link with nothing usable in it', () => {
     it('has no fragment at all', () => {
-        expect(readInvitationToken(PAGE)).toEqual({ token: '', clean: PAGE });
+        expect(readLinkToken(PAGE)).toEqual({ token: '', clean: PAGE });
     });
     it('has an empty fragment', () => {
-        expect(readInvitationToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE });
+        expect(readLinkToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE });
     });
     it('⚠ carries something that is not a token', () => {
         /*
          * ⚠ A page anchor, a tracking fragment, anything a link happened to pick up. Sending it as a
          * credential attempt would be this page volunteering whatever it was given.
          */
-        expect(readInvitationToken(`${PAGE}#section-2`).token).toEqual('');
-        expect(readInvitationToken(`${PAGE}#utm_source=mail`).token).toEqual('');
-        expect(readInvitationToken(`${PAGE}#<script>`).token).toEqual('');
+        expect(readLinkToken(`${PAGE}#section-2`).token).toEqual('');
+        expect(readLinkToken(`${PAGE}#utm_source=mail`).token).toEqual('');
+        expect(readLinkToken(`${PAGE}#<script>`).token).toEqual('');
     });
     it('carries something token-shaped but the wrong length', () => {
-        expect(readInvitationToken(`${PAGE}#0123456789abcdef`).token).toEqual('');
-        expect(readInvitationToken(`${PAGE}#${TOKEN}ff`).token).toEqual('');
+        expect(readLinkToken(`${PAGE}#0123456789abcdef`).token).toEqual('');
+        expect(readLinkToken(`${PAGE}#${TOKEN}ff`).token).toEqual('');
     });
     it('carries hex in the wrong case', () => {
         /* `makeInvitationToken` produces lower-case hex. Anything else did not come from us. */
-        expect(readInvitationToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('');
+        expect(readLinkToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('');
     });
     it('still hands back a clean address to replace with', () => {
         /* Even a fragment that is not ours should not be left sitting in the bar for this page. */
-        expect(readInvitationToken(`${PAGE}#section-2`).clean).toEqual(PAGE);
+        expect(readLinkToken(`${PAGE}#section-2`).clean).toEqual(PAGE);
     });
     it('is given nothing at all', () => {
-        expect(readInvitationToken('')).toEqual({ token: '', clean: '' });
-        expect(readInvitationToken(undefined)).toEqual({ token: '', clean: '' });
+        expect(readLinkToken('')).toEqual({ token: '', clean: '' });
+        expect(readLinkToken(undefined)).toEqual({ token: '', clean: '' });
     });
 });
-//# sourceMappingURL=invitation-token.test.js.map
+//# sourceMappingURL=link-token.test.js.map

package/dist-client/utils/link-token.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-token.test.js","sourceRoot":"","sources":["../../client/utils/link-token.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,kCAAkC,CAAA;AAChD,MAAM,IAAI,GAAG,4CAA4C,CAAA;AAEzD,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD;qGAC6F;QAC7F,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD;;;WAGG;QACH,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5D,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAClE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,wFAAwF;QACxF,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,2FAA2F;QAC3F,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3D,MAAM,CAAC,aAAa,CAAC,SAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readLinkToken } from './link-token'\n\n/**\n * Reading the invitation token out of the link, and handing back the link without it.\n *\n * The two answers travel together because removing the token is not optional: the fragment keeps\n * it out of server and proxy logs, and replacing the address is what keeps it out of the browser\n * history and off the screen. A caller that read it and forgot to replace would undo the point.\n */\n\nconst TOKEN = '0123456789abcdef0123456789abcdef'\nconst PAGE = 'https://acme.example.com/accept-invitation'\n\ndescribe('a link with a token in it', () => {\n  it('reads a bare fragment', () => {\n    expect(readLinkToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads the named form some mail clients produce', () => {\n    expect(readLinkToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads one that arrived percent-encoded', () => {\n    expect(readLinkToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN)\n  })\n\n  it('hands back the address without the fragment', () => {\n    /* ⚠ What the caller replaces the address with. Without it the token stays on screen and in\n       this history entry, which is the half of the hiding the fragment does not do by itself. */\n    expect(readLinkToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`)\n  })\n})\n\ndescribe('a link with nothing usable in it', () => {\n  it('has no fragment at all', () => {\n    expect(readLinkToken(PAGE)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('has an empty fragment', () => {\n    expect(readLinkToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('⚠ carries something that is not a token', () => {\n    /*\n     * ⚠ A page anchor, a tracking fragment, anything a link happened to pick up. Sending it as a\n     * credential attempt would be this page volunteering whatever it was given.\n     */\n    expect(readLinkToken(`${PAGE}#section-2`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#utm_source=mail`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#<script>`).token).toEqual('')\n  })\n\n  it('carries something token-shaped but the wrong length', () => {\n    expect(readLinkToken(`${PAGE}#0123456789abcdef`).token).toEqual('')\n    expect(readLinkToken(`${PAGE}#${TOKEN}ff`).token).toEqual('')\n  })\n\n  it('carries hex in the wrong case', () => {\n    /* `makeInvitationToken` produces lower-case hex. Anything else did not come from us. */\n    expect(readLinkToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('')\n  })\n\n  it('still hands back a clean address to replace with', () => {\n    /* Even a fragment that is not ours should not be left sitting in the bar for this page. */\n    expect(readLinkToken(`${PAGE}#section-2`).clean).toEqual(PAGE)\n  })\n\n  it('is given nothing at all', () => {\n    expect(readLinkToken('')).toEqual({ token: '', clean: '' })\n    expect(readLinkToken(undefined as any)).toEqual({ token: '', clean: '' })\n  })\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-ui",
-  "version": "10.1.41",
+  "version": "10.1.46",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -38,11 +38,11 @@
     "@operato/p13n": "^10.0.0",
     "@operato/popup": "^10.15.0",
     "@operato/styles": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.40",
-    "@things-factory/component-ui": "^10.1.41",
-    "@things-factory/more-base": "^10.1.40",
+    "@things-factory/auth-base": "^10.1.46",
+    "@things-factory/component-ui": "^10.1.46",
+    "@things-factory/more-base": "^10.1.46",
     "base64url": "^3.0.1",
     "clipboard": "^2.0.6"
   },
-  "gitHead": "4f41243edca4c965bc6992a10fb52d75a58fd3a9"
+  "gitHead": "d3467cde550453f3348fed0ed6c79a12a6ba0db4"
 }

package/translations/en.json

@@ -116,6 +116,7 @@
   "field.user-type": "user type",
   "field.username": "user id",
   "field.username or email": "username or email",
+  "field.vs template": "vs template",
   "field.webhook": "webhook",
   "label.access token": "access token",
   "label.activated": "activated",
@@ -184,6 +185,7 @@
   "text.a role of this name is already visible": "a role of this name is already visible",
   "text.account exists so joins immediately": "This account already exists. Adding it lets them in right away.",
   "text.account will be created with the default password": "No account uses this address yet. One is created with the default password, which you have to tell them yourself.",
+  "text.add template privileges": "adds the {count} privileges the {template} template grants and this role lacks: {list}",
   "text.add_domain_owner_description": "grant another domain member owner permission.",
   "text.already in this domain": "already here",
   "text.an application signs in on its own behalf": "an application signs in on its own behalf, with its own key and its own privileges",
@@ -248,6 +250,7 @@
   "text.invalid-username": "use an id or an email address",
   "text.invitation resent": "invitation sent again.",
   "text.loading": "loading…",
+  "text.missing against template": "{count} missing",
   "text.new password": "new password",
   "text.no account and no default password": "No account uses this address, and this system has no default password. They have to sign up first.",
   "text.no account so an invitation will be mailed": "no account yet, so an invitation will be mailed. they choose their own password.",
@@ -336,7 +339,9 @@
   "text.your account is not activated": "your account is not activated.",
   "text.your email address": "your email address",
   "title.accept invitation": "accept invitation",
+  "title.activate account": "activate account",
   "title.add domain owner": "add domain owner",
+  "title.add template privileges": "add template privileges",
   "title.attribute model": "attribute model",
   "title.attribute-item list": "attribute-item list",
   "title.attributes": "attributes",

package/translations/ja.json

@@ -102,6 +102,7 @@
   "field.user-id or email": "ユーザーIDまたはメール",
   "field.user-type": "ユーザー タイプ",
   "field.username": "ユーザーID",
+  "field.vs template": "テンプレート比",
   "field.webhook": "webhook",
   "label.access token": "アクセストークン",
   "label.activated": "使用中",
@@ -158,6 +159,7 @@
   "text.a blank seat opens nothing until you give it privileges": "A blank seat opens nothing until you give it privileges.",
   "text.a role of this name exists and will be added to": "A role of this name already exists. It will be used as it stands and these privileges added to it.",
   "text.a role of this name is already visible": "同じ名前のロールが既に見えています",
+  "text.add template privileges": "{template} テンプレートが付与し、このロールにない権限 {count}件を追加します: {list}",
   "text.already in this domain": "already here",
   "text.an application signs in on its own behalf": "アプリケーションは自身のキーと権限でログインします",
   "text.appliance": "端末装置",
@@ -209,6 +211,7 @@
   "text.invalid-email": "メールアドレスの形式が違います",
   "text.invalid-username": "IDまたはメールアドレスを入力してください",
   "text.invitation resent": "招待メールを再送しました。",
+  "text.missing against template": "{count}件不足",
   "text.new password": "新しいパスワード",
   "text.no account so an invitation will be mailed": "アカウントがないため招待メールを送ります。パスワードは本人が決めます。",
   "text.no domain available": "使用できる$t(term.domain)がありません.",
@@ -267,6 +270,8 @@
   "text.your account is not activated": "アカウントがアクティブ化されていません.",
   "text.your email address": "ユーザー メール",
   "title.accept invitation": "招待を受ける",
+  "title.activate account": "アカウント有効化",
+  "title.add template privileges": "テンプレートの権限を追加",
   "title.attribute model": "属性モデル",
   "title.attribute-item list": "属性アイテム リスト",
   "title.attributes": "属性",

package/translations/ko.json

@@ -116,6 +116,7 @@
   "field.user-type": "사용자유형",
   "field.username": "사용자 아이디",
   "field.username or email": "사용자명 또는 이메일",
+  "field.vs template": "템플릿 대비",
   "field.webhook": "webhook",
   "label.access token": "액세스 토큰",
   "label.activated": "사용 중",
@@ -184,6 +185,7 @@
   "text.a role of this name is already visible": "같은 이름의 역할이 이미 보입니다",
   "text.account exists so joins immediately": "이미 계정이 있습니다. 넣으면 바로 들어옵니다.",
   "text.account will be created with the default password": "이 이메일로 가입한 계정이 없습니다. 기본 비밀번호로 계정을 만들어 넣습니다. 비밀번호는 직접 알려 주셔야 합니다.",
+  "text.add template privileges": "{template} 템플릿이 여는데 이 역할에 없는 권한 {count}개를 더합니다: {list}",
   "text.add_domain_owner_description": "$t(term.domain) 멤버 중 한 명에게 소유자 권한을 부여합니다.",
   "text.already in this domain": "이미 있음",
   "text.an application signs in on its own behalf": "응용프로그램은 자기 키와 자기 권한으로 스스로 로그인합니다",
@@ -247,6 +249,7 @@
   "text.invalid-username": "아이디나 이메일 주소를 적으십시오",
   "text.invitation resent": "초대 메일을 다시 보냈습니다.",
   "text.loading": "읽는 중…",
+  "text.missing against template": "{count}개 빠짐",
   "text.new password": "새 비밀번호",
   "text.no account and no default password": "이 이메일로 가입한 계정이 없고, 이 시스템에는 기본 비밀번호가 설정되어 있지 않습니다. 그 사람이 먼저 가입해야 부를 수 있습니다.",
   "text.no account so an invitation will be mailed": "계정이 없어 초대 메일을 보냅니다. 비밀번호는 본인이 정합니다.",
@@ -335,7 +338,9 @@
   "text.your account is not activated": "계정이 활성화되지 않았습니다.",
   "text.your email address": "사용자 이메일",
   "title.accept invitation": "초대 수락",
+  "title.activate account": "계정 활성화",
   "title.add domain owner": "$t(term.domain) 소유자 추가",
+  "title.add template privileges": "템플릿의 권한 더하기",
   "title.attribute model": "속성 모델",
   "title.attribute-item list": "속성 아이템 리스트",
   "title.attributes": "속성",

package/translations/ms.json

@@ -102,6 +102,7 @@
   "field.user-id or email": "ID pengguna atau e-mel",
   "field.user-type": "jenis pengguna",
   "field.username": "ID pengguna",
+  "field.vs template": "berbanding templat",
   "field.webhook": "webhook",
   "label.access token": "token akses",
   "label.activated": "diaktifkan",
@@ -158,6 +159,7 @@
   "text.a blank seat opens nothing until you give it privileges": "A blank seat opens nothing until you give it privileges.",
   "text.a role of this name exists and will be added to": "A role of this name already exists. It will be used as it stands and these privileges added to it.",
   "text.a role of this name is already visible": "peranan dengan nama ini sudah kelihatan",
+  "text.add template privileges": "menambah {count} keizinan yang diberi oleh templat {template} tetapi tiada pada peranan ini: {list}",
   "text.already in this domain": "already here",
   "text.an application signs in on its own behalf": "aplikasi log masuk bagi pihaknya sendiri, dengan kunci dan keizinannya sendiri",
   "text.appliance": "perkakas terminal",
@@ -211,6 +213,7 @@
   "text.invalid-email": "itu bukan alamat emel",
   "text.invalid-username": "gunakan id atau alamat emel",
   "text.invitation resent": "jemputan dihantar semula.",
+  "text.missing against template": "{count} tiada",
   "text.new password": "kata laluan baru",
   "text.no account so an invitation will be mailed": "tiada akaun lagi, jadi jemputan akan dihantar melalui e-mel. mereka memilih kata laluan sendiri.",
   "text.no domain available": "maaf, tiada domain untuk dipilih",
@@ -268,6 +271,8 @@
   "text.your account is not activated": "akaun anda belum diaktifkan",
   "text.your email address": "alamat emel anda",
   "title.accept invitation": "terima jemputan",
+  "title.activate account": "aktifkan akaun",
+  "title.add template privileges": "tambah keizinan templat",
   "title.attribute model": "model atribut",
   "title.attribute-item list": "senarai ciri-ciri",
   "title.attributes": "ciri-ciri",

package/translations/zh.json

@@ -102,6 +102,7 @@
   "field.user-id or email": "用户名或电子邮件",
   "field.user-type": "用户类型",
   "field.username": "用户名",
+  "field.vs template": "对照模板",
   "field.webhook": "webhook",
   "label.access token": "访问令牌",
   "label.activated": "已启用",
@@ -158,6 +159,7 @@
   "text.a blank seat opens nothing until you give it privileges": "A blank seat opens nothing until you give it privileges.",
   "text.a role of this name exists and will be added to": "A role of this name already exists. It will be used as it stands and these privileges added to it.",
   "text.a role of this name is already visible": "同名角色已可见",
+  "text.add template privileges": "添加 {template} 模板授予而此角色缺少的 {count} 项权限: {list}",
   "text.already in this domain": "already here",
   "text.an application signs in on its own behalf": "应用程序以自己的密钥和权限登录",
   "text.appliance": "终端设备",
@@ -210,6 +212,7 @@
   "text.invalid-email": "电子邮件地址格式不正确",
   "text.invalid-username": "请输入 ID 或电子邮件地址",
   "text.invitation resent": "已重新发送邀请邮件。",
+  "text.missing against template": "缺少 {count} 项",
   "text.new password": "新密码",
   "text.no account so an invitation will be mailed": "尚无账号，将发送邀请邮件，由本人设置密码。",
   "text.no domain available": "抱歉，没有$t(term.domain)名",
@@ -268,6 +271,8 @@
   "text.your account is not activated": "您的账号还没验证",
   "text.your email address": "您的邮件地址",
   "title.accept invitation": "接受邀请",
+  "title.activate account": "激活帐户",
+  "title.add template privileges": "添加模板权限",
   "title.attribute model": "属性模型",
   "title.attribute-item list": "属性列表",
   "title.attributes": "属性",

package/dist-client/utils/invitation-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invitation-token.js","sourceRoot":"","sources":["../../client/utils/invitation-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,qEAAqE;AACrE,MAAM,KAAK,GAAG,gBAAgB,CAAA;AAS9B,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAEjC;;;OAGG;IACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC","sourcesContent":["/**\n * Taking the invitation token out of the link, and out of the address bar. (Pure rule.)\n *\n * ## Why the token is in the fragment\n *\n * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`\n * reaches the server as `/accept-invitation` and nothing else. The token never appears in an\n * access log, a proxy log, or a `Referer` sent onward to some other site.\n *\n * That leaves the places the browser itself keeps it: the address bar and the history entry.\n * Both are cleared by replacing the URL with the one this returns as `clean`, which is why the\n * two answers come back together — reading the token and removing it are one act, and a caller\n * that did the first without the second would leave it on screen.\n *\n * ## What it refuses to read\n *\n * A token is hex from `crypto.randomBytes(16)`. Anything else in the fragment is not one, and\n * taking it anyway would send whatever a link happened to carry — a tracking fragment, a page\n * anchor — to the server as a credential attempt. It answers empty instead, and the page shows\n * the box where the code from the mail can be pasted.\n */\n\n/** 16 bytes as hex, which is what `makeInvitationToken` produces. */\nconst TOKEN = /^[0-9a-f]{32}$/\n\nexport type InvitationLink = {\n  /** The token, or an empty string when the link carries none this rule will read. */\n  token: string\n  /** The same URL without its fragment, for the caller to replace the address with. */\n  clean: string\n}\n\nexport function readInvitationToken(href: string): InvitationLink {\n  if (!href) {\n    return { token: '', clean: '' }\n  }\n\n  const hash = href.indexOf('#')\n\n  if (hash < 0) {\n    return { token: '', clean: href }\n  }\n\n  const clean = href.slice(0, hash)\n\n  /*\n   * `#invite=<token>` as well as a bare `#<token>`. Both shapes turn up in mail clients that\n   * rewrite links, and neither costs anything to accept.\n   */\n  const raw = decodeURIComponent(href.slice(hash + 1)).replace(/^invite=/, '')\n\n  return { token: TOKEN.test(raw) ? raw : '', clean }\n}\n"]}

package/dist-client/utils/invitation-token.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invitation-token.test.js","sourceRoot":"","sources":["../../client/utils/invitation-token.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAExD;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,kCAAkC,CAAA;AAChD,MAAM,IAAI,GAAG,4CAA4C,CAAA;AAEzD,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD;qGAC6F;QAC7F,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD;;;WAGG;QACH,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAClE,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACxE,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACzE,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,wFAAwF;QACxF,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,2FAA2F;QAC3F,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QACjE,MAAM,CAAC,mBAAmB,CAAC,SAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readInvitationToken } from './invitation-token'\n\n/**\n * Reading the invitation token out of the link, and handing back the link without it.\n *\n * The two answers travel together because removing the token is not optional: the fragment keeps\n * it out of server and proxy logs, and replacing the address is what keeps it out of the browser\n * history and off the screen. A caller that read it and forgot to replace would undo the point.\n */\n\nconst TOKEN = '0123456789abcdef0123456789abcdef'\nconst PAGE = 'https://acme.example.com/accept-invitation'\n\ndescribe('a link with a token in it', () => {\n  it('reads a bare fragment', () => {\n    expect(readInvitationToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads the named form some mail clients produce', () => {\n    expect(readInvitationToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads one that arrived percent-encoded', () => {\n    expect(readInvitationToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN)\n  })\n\n  it('hands back the address without the fragment', () => {\n    /* ⚠ What the caller replaces the address with. Without it the token stays on screen and in\n       this history entry, which is the half of the hiding the fragment does not do by itself. */\n    expect(readInvitationToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`)\n  })\n})\n\ndescribe('a link with nothing usable in it', () => {\n  it('has no fragment at all', () => {\n    expect(readInvitationToken(PAGE)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('has an empty fragment', () => {\n    expect(readInvitationToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('⚠ carries something that is not a token', () => {\n    /*\n     * ⚠ A page anchor, a tracking fragment, anything a link happened to pick up. Sending it as a\n     * credential attempt would be this page volunteering whatever it was given.\n     */\n    expect(readInvitationToken(`${PAGE}#section-2`).token).toEqual('')\n    expect(readInvitationToken(`${PAGE}#utm_source=mail`).token).toEqual('')\n    expect(readInvitationToken(`${PAGE}#<script>`).token).toEqual('')\n  })\n\n  it('carries something token-shaped but the wrong length', () => {\n    expect(readInvitationToken(`${PAGE}#0123456789abcdef`).token).toEqual('')\n    expect(readInvitationToken(`${PAGE}#${TOKEN}ff`).token).toEqual('')\n  })\n\n  it('carries hex in the wrong case', () => {\n    /* `makeInvitationToken` produces lower-case hex. Anything else did not come from us. */\n    expect(readInvitationToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('')\n  })\n\n  it('still hands back a clean address to replace with', () => {\n    /* Even a fragment that is not ours should not be left sitting in the bar for this page. */\n    expect(readInvitationToken(`${PAGE}#section-2`).clean).toEqual(PAGE)\n  })\n\n  it('is given nothing at all', () => {\n    expect(readInvitationToken('')).toEqual({ token: '', clean: '' })\n    expect(readInvitationToken(undefined as any)).toEqual({ token: '', clean: '' })\n  })\n})\n"]}