aimeat 1.5.0 → 1.6.1

package/dist/.env.example

@@ -34,6 +34,21 @@ AIMEAT_PORT=40050
 # CORS: comma-separated list of allowed origins, or * for all (default: *)
 # AIMEAT_CORS_ALLOWED_ORIGINS=*
 # AIMEAT_CORS_ALLOWED_ORIGINS=https://portal.aimeat.fi,https://my-app.example.com
+# ── Security Limits ────────────────────────────────────────────
+# AIMEAT_LOGIN_RATE_LIMIT_MAX=15              # Max login attempts per window (default: 15)
+# AIMEAT_LOGIN_RATE_LIMIT_WINDOW_MS=60000     # Login rate limit window in ms (default: 60s)
+# AIMEAT_REGISTRATION_RATE_LIMIT_MAX=5        # Max registrations per window (default: 5)
+# AIMEAT_REGISTRATION_RATE_LIMIT_WINDOW_MS=60000
+# AIMEAT_ADMIN_AUTH_RATE_LIMIT_MAX=5          # Max admin auth attempts per window (default: 5)
+# AIMEAT_ADMIN_AUTH_RATE_LIMIT_WINDOW_MS=60000
+# AIMEAT_PASSWORD_LOCKOUT_ATTEMPTS=5          # Failed attempts before lockout (default: 5)
+# AIMEAT_PASSWORD_LOCKOUT_MINUTES=15          # Lockout duration in minutes (default: 15)
+# AIMEAT_JSON_BODY_LIMIT_MB=5                 # Default JSON body limit (default: 5MB)
+# AIMEAT_JSON_BODY_LIMIT_LARGE_MB=15          # Large body limit for apps/extensions (default: 15MB)
+# AIMEAT_EXT_MAX_DEBIT=100                    # Max morsels per extension wallet.consume() call
+# AIMEAT_FEDERATION_AUTH_POLICY=disabled       # disabled | all_peers | specific_peers
+# AIMEAT_FEDERATION_DEFAULT_SCOPES=memory:read,catalogue:read
+
 # ── Auth & Tokens ──────────────────────────────────────────────
 # AIMEAT_JWT_TTL=3600              # JWT lifetime in seconds (default: 1h)
 # AIMEAT_OTK_TTL_MS=300000        # OTK expiry in ms (default: 5min)

package/dist/locales/en.json

@@ -2229,7 +2229,8 @@
     "errUserShort": "Username must be at least 3 characters",
     "errPassShort": "Password must be at least 4 characters",
     "errWrongPass": "Wrong password for that username.",
-    "errFederatedLogin": "Federated login is not yet supported. This node is {localNode}, but the identity belongs to {remoteNode}.",
+    "connectingHome": "Connecting to home node...",
+    "errFederatedLogin": "Could not reach home node {remoteNode} for federated login.",
     "loggedIn": "logged in",
     "logoutBtn": "Logout",
     "usernameLabel": "Username",
@@ -2993,6 +2994,63 @@
     "pushUnsubscribeBtn": "Unsubscribe",
     "pushNoBrowserSupport": "This browser does not support push notifications",
 
+    "blocked": "Blocked",
+    "blockedCooldown": "Cooldown",
+    "blockedDisabled": "Disabled",
+    "blockedQuietHours": "Quiet Hours",
+    "breakdownFailed": "Failed",
+    "breakdownRetried": "Retried",
+    "breakdownSent": "Sent",
+    "breakdownType": "Type",
+    "channelEmail": "Email",
+    "channelPush": "Push",
+    "channels": "Channels",
+    "emailDelivery": "Email Delivery",
+    "emailType": {
+      "group_send": "Group Send",
+      "magic_link": "Magic Link",
+      "match_suggestion": "Match Suggestion",
+      "notification": "Notification",
+      "verification": "Verification"
+    },
+    "emailsFailed": "Emails Failed",
+    "emailsRetried": "Emails Retried",
+    "emailsSent": "Emails Sent",
+    "expiredSubs": "Expired Subs",
+    "live": "live",
+    "mailboxNotifBlocked": "Mailbox Blocked",
+    "mailboxNotifFailed": "Mailbox Failed",
+    "mailboxNotifSent": "Mailbox Sent",
+    "mailboxNotifications": "Mailbox Notifications",
+    "period30Days": "30 Days",
+    "period7Days": "7 Days",
+    "periodAll": "All",
+    "periodApply": "Apply",
+    "periodCustom": "Custom",
+    "periodFrom": "From",
+    "periodLabel": "Period",
+    "periodThisWeek": "This Week",
+    "periodTo": "To",
+    "periodToday": "Today",
+    "weekMon": "Mon",
+    "weekTue": "Tue",
+    "weekWed": "Wed",
+    "weekThu": "Thu",
+    "weekFri": "Fri",
+    "weekSat": "Sat",
+    "weekSun": "Sun",
+    "pushDelivery": "Push Notifications",
+    "pushFailed": "Push Failed",
+    "pushSent": "Push Sent",
+    "pushType": {
+      "board": "Board",
+      "federation": "Federation",
+      "general": "General",
+      "organism": "Organism",
+      "test": "Test",
+      "work": "Work"
+    },
+
     "totalEntries": "Total Entries",
     "cities": "Cities",
     "categories": "Categories",
@@ -3211,6 +3269,13 @@
     "fedShareCatalogue": "Share Catalogue",
     "fedReplicateMemory": "Replicate Memory",
     "fedAllowRouting": "Allow Routing",
+    "fedAllowAuth": "Allow Federated Login",
+    "fedAuthPolicyTitle": "Federation Auth Policy",
+    "fedAuthPolicyDesc": "Control whether users from other nodes can log in here and what they can do.",
+    "fedAuthDisabled": "Disabled (no federated logins)",
+    "fedAuthAllPeers": "All peers (any active peer's users can log in)",
+    "fedAuthSpecificPeers": "Specific peers (per-peer control)",
+    "fedDefaultScopes": "Default scopes for federated users:",
     "fedPeerMode": "Peer Mode",
     "fedPeerModeFederation": "Federation",
     "fedPeerModePrivate": "Private P2P",
@@ -3257,6 +3322,17 @@
     "cfgGroup_totp": "TOTP",
     "cfgGroup_matching": "Matching",
     "cfgGroup_extensions": "Extensions",
+    "cfgGroup_security": "Security",
+    "cfg_security_login_rate_limit_max": "Login rate limit (max per window)",
+    "cfg_security_login_rate_limit_window_ms": "Login rate limit window (ms)",
+    "cfg_security_registration_rate_limit_max": "Registration rate limit (max per window)",
+    "cfg_security_registration_rate_limit_window_ms": "Registration rate limit window (ms)",
+    "cfg_security_admin_auth_rate_limit_max": "Admin auth rate limit (max per window)",
+    "cfg_security_admin_auth_rate_limit_window_ms": "Admin auth rate limit window (ms)",
+    "cfg_security_password_lockout_attempts": "Password lockout after N failures",
+    "cfg_security_password_lockout_minutes": "Password lockout duration (minutes)",
+    "cfg_security_json_body_limit_mb": "JSON body size limit (MB)",
+    "cfg_security_json_body_limit_large_mb": "Large body size limit for apps/extensions (MB)",
     "cfgGroup_marketplace": "Marketplace",
     "cfgGroup_push": "Push",
     "cfgGroup_eudiw": "EUDIW",
@@ -3887,7 +3963,8 @@
       "errUserShort": "Username must be at least 3 characters",
       "errPassShort": "Password must be at least 4 characters",
       "errWrongPass": "Wrong password for that username.",
-      "errFederatedLogin": "Federated login is not yet supported. This node is {localNode}, but the identity belongs to {remoteNode}.",
+      "connectingHome": "Connecting to home node...",
+      "errFederatedLogin": "Could not reach home node {remoteNode} for federated login.",
       "loggedIn": "logged in",
       "logoutBtn": "Logout",
       "whyTitle": "✨ What do you get?",

package/dist/locales/fi.json

@@ -2229,7 +2229,8 @@
     "errUserShort": "Käyttäjänimen tulee olla vähintään 3 merkkiä",
     "errPassShort": "Salasanan tulee olla vähintään 4 merkkiä",
     "errWrongPass": "Väärä salasana tälle käyttäjänimelle.",
-    "errFederatedLogin": "Federoitu kirjautuminen ei ole vielä tuettu. Tämä solmu on {localNode}, mutta identiteetti kuuluu solmuun {remoteNode}.",
+    "connectingHome": "Yhdistetään kotisolmuun...",
+    "errFederatedLogin": "Kotisolmuun {remoteNode} ei saatu yhteyttä federoitua kirjautumista varten.",
     "loggedIn": "kirjautuneena",
     "logoutBtn": "Kirjaudu ulos",
     "usernameLabel": "Käyttäjänimi",
@@ -2993,6 +2994,63 @@
     "pushUnsubscribeBtn": "Peru tilaus",
     "pushNoBrowserSupport": "Tämä selain ei tue push-ilmoituksia",
 
+    "blocked": "Estetyt",
+    "blockedCooldown": "Jäähdytys",
+    "blockedDisabled": "Pois käytöstä",
+    "blockedQuietHours": "Hiljaiset tunnit",
+    "breakdownFailed": "Epäonnistuneet",
+    "breakdownRetried": "Uudelleenyritykset",
+    "breakdownSent": "Lähetetyt",
+    "breakdownType": "Tyyppi",
+    "channelEmail": "Sähköposti",
+    "channelPush": "Push",
+    "channels": "Kanavat",
+    "emailDelivery": "Sähköpostin toimitus",
+    "emailType": {
+      "group_send": "Ryhmälähetys",
+      "magic_link": "Kirjautumislinkki",
+      "match_suggestion": "Ehdotus",
+      "notification": "Ilmoitus",
+      "verification": "Vahvistus"
+    },
+    "emailsFailed": "Epäonnistuneet",
+    "emailsRetried": "Uudelleenyritykset",
+    "emailsSent": "Lähetetyt",
+    "expiredSubs": "Vanhentuneet",
+    "live": "live",
+    "mailboxNotifBlocked": "Postilaatikko estetyt",
+    "mailboxNotifFailed": "Postilaatikko epäonn.",
+    "mailboxNotifSent": "Postilaatikko lähet.",
+    "mailboxNotifications": "Postilaatikkoilmoitukset",
+    "period30Days": "30 päivää",
+    "period7Days": "7 päivää",
+    "periodAll": "Kaikki",
+    "periodApply": "Hae",
+    "periodCustom": "Mukautettu",
+    "periodFrom": "Alkaen",
+    "periodLabel": "Ajanjakso",
+    "periodThisWeek": "Tämä viikko",
+    "periodTo": "Asti",
+    "periodToday": "Tänään",
+    "weekMon": "Ma",
+    "weekTue": "Ti",
+    "weekWed": "Ke",
+    "weekThu": "To",
+    "weekFri": "Pe",
+    "weekSat": "La",
+    "weekSun": "Su",
+    "pushDelivery": "Push-ilmoitukset",
+    "pushFailed": "Epäonnistuneet",
+    "pushSent": "Lähetetyt",
+    "pushType": {
+      "board": "Keskustelu",
+      "federation": "Federaatio",
+      "general": "Yleinen",
+      "organism": "Organismi",
+      "test": "Testi",
+      "work": "Työ"
+    },
+
     "totalEntries": "Merkintöjä yhteensä",
     "cities": "Kaupungit",
     "categories": "Kategoriat",
@@ -3211,6 +3269,13 @@
     "fedShareCatalogue": "Jaa katalogi",
     "fedReplicateMemory": "Replikoi muisti",
     "fedAllowRouting": "Salli reititys",
+    "fedAllowAuth": "Salli federaatiokirjautuminen",
+    "fedAuthPolicyTitle": "Federaation todennuspolitiikka",
+    "fedAuthPolicyDesc": "Hallitse voivatko muiden solmujen kayttajat kirjautua tanne ja mita he voivat tehda.",
+    "fedAuthDisabled": "Pois kaytosta (ei federaatiokirjautumisia)",
+    "fedAuthAllPeers": "Kaikki vertaiset (kaikkien aktiivisten vertaisten kayttajat voivat kirjautua)",
+    "fedAuthSpecificPeers": "Tietyt vertaiset (vertaiskohtainen hallinta)",
+    "fedDefaultScopes": "Oletuslaajuudet federoiduille kayttajille:",
     "fedPeerMode": "Vertaistila",
     "fedPeerModeFederation": "Federaatio",
     "fedPeerModePrivate": "Yksityinen P2P",
@@ -3257,6 +3322,17 @@
     "cfgGroup_totp": "TOTP",
     "cfgGroup_matching": "Matchaus",
     "cfgGroup_extensions": "Laajennukset",
+    "cfgGroup_security": "Turvallisuus",
+    "cfg_security_login_rate_limit_max": "Kirjautumisen nopeusrajoitus (max per ikkuna)",
+    "cfg_security_login_rate_limit_window_ms": "Kirjautumisen nopeusrajoitusikkuna (ms)",
+    "cfg_security_registration_rate_limit_max": "Rekisteroinnin nopeusrajoitus (max per ikkuna)",
+    "cfg_security_registration_rate_limit_window_ms": "Rekisteroinnin nopeusrajoitusikkuna (ms)",
+    "cfg_security_admin_auth_rate_limit_max": "Admin-todennuksen nopeusrajoitus (max per ikkuna)",
+    "cfg_security_admin_auth_rate_limit_window_ms": "Admin-todennuksen nopeusrajoitusikkuna (ms)",
+    "cfg_security_password_lockout_attempts": "Salasanalukitus N epaonnistumisen jalkeen",
+    "cfg_security_password_lockout_minutes": "Salasanalukituksen kesto (minuuttia)",
+    "cfg_security_json_body_limit_mb": "JSON-sisallon kokoraja (Mt)",
+    "cfg_security_json_body_limit_large_mb": "Suuri kokoraja sovelluksille/laajennuksille (Mt)",
     "cfgGroup_marketplace": "Kauppapaikka",
     "cfgGroup_push": "Push-ilmoitukset",
     "cfgGroup_eudiw": "EUDIW",
@@ -3887,7 +3963,8 @@
       "errUserShort": "Käyttäjänimen tulee olla vähintään 3 merkkiä",
       "errPassShort": "Salasanan tulee olla vähintään 4 merkkiä",
       "errWrongPass": "Väärä salasana tälle käyttäjänimelle.",
-      "errFederatedLogin": "Federoitu kirjautuminen ei ole vielä tuettu. Tämä solmu on {localNode}, mutta identiteetti kuuluu solmuun {remoteNode}.",
+      "connectingHome": "Yhdistetään kotisolmuun...",
+      "errFederatedLogin": "Kotisolmuun {remoteNode} ei saatu yhteyttä federoitua kirjautumista varten.",
       "loggedIn": "kirjautuneena",
       "logoutBtn": "Kirjaudu ulos",
       "whyTitle": "✨ Mitä saat?",

package/dist/public/css/views/admin.css

@@ -111,6 +111,7 @@
 /* Cards */
 .adm-grid { display: grid; gap: 16px; margin-bottom: 20px; }
 .adm-grid-4 { grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); }
+.adm-grid-3 { grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); }
 .adm-grid-2 { grid-template-columns: repeat(auto-fit, minmax(340px, 1fr)); }
 .adm-card {
   background: var(--glass-bg, #FFFFFF);
@@ -575,3 +576,99 @@
 .adm-member-add { display: flex; gap: 8px; align-items: center; }
 .adm-member-add .adm-input { flex: 1; font-size: .85rem; }
 .adm-font-mono { font-family: 'JetBrains Mono', monospace; }
+
+/* ── Stats Time Range Selector ── */
+.adm-time-range {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 20px;
+  padding: 12px 16px;
+  background: var(--glass-bg, #FFFFFF);
+  border: 1px solid var(--glass-border, #E5E7EB);
+  border-radius: 8px;
+}
+.adm-time-range-label {
+  font-size: 0.8rem;
+  color: var(--text-dim);
+  margin-right: 4px;
+}
+.adm-time-btn {
+  padding: 4px 12px;
+  font-size: 0.75rem;
+  border: 1px solid var(--glass-border, #E5E7EB);
+  border-radius: 6px;
+  background: transparent;
+  color: #1A1A2E;
+  cursor: pointer;
+  font-family: inherit;
+  transition: all 0.15s;
+}
+.adm-time-btn:hover { border-color: var(--accent); color: var(--accent); }
+.adm-time-btn.active { background: var(--accent); color: #fff; border-color: var(--accent); }
+.adm-time-custom {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-left: auto;
+}
+.adm-time-custom input[type="date"] {
+  padding: 3px 8px;
+  font-size: 0.75rem;
+  border: 1px solid var(--glass-border, #E5E7EB);
+  border-radius: 4px;
+  background: #FAFAF8;
+  color: #1A1A2E;
+  font-family: inherit;
+}
+
+/* ── Stats Breakdown Table ── */
+.adm-breakdown-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.78rem;
+  margin-top: 8px;
+}
+.adm-breakdown-table th {
+  text-align: left;
+  padding: 6px 10px;
+  color: var(--text-dim);
+  border-bottom: 1px solid var(--glass-border, #E5E7EB);
+  font-weight: 500;
+}
+.adm-breakdown-table td {
+  padding: 5px 10px;
+  border-bottom: 1px solid #F3F4F6;
+}
+.adm-breakdown-table td.num {
+  text-align: right;
+  font-variant-numeric: tabular-nums;
+}
+
+/* ── Stats Section Header Colors ── */
+.adm-section-purple  { color: #a855f7; }
+.adm-section-cyan    { color: #06b6d4; }
+.adm-section-violet  { color: #8b5cf6; }
+.adm-section-amber   { color: #f59e0b; }
+.adm-section-red     { color: #ef4444; }
+
+/* ── Breakdown Table ── */
+.adm-breakdown-table th.num { text-align: right; }
+
+/* ── Stats Inline Breakdown ── */
+.adm-date-separator { color: var(--text-dim); }
+.adm-mailbox-inline { padding: 10px 16px; }
+.adm-blocked-reasons { margin-bottom: 6px; color: var(--text-dim); }
+.adm-channels-summary { color: var(--text-dim); }
+
+.adm-badge-live {
+  display: inline-block;
+  font-size: 0.6rem;
+  padding: 1px 6px;
+  border-radius: 4px;
+  background: var(--accent);
+  color: #fff;
+  vertical-align: middle;
+  margin-left: 6px;
+}

package/dist/public/js/services/admin.js

@@ -173,7 +173,13 @@ export const getAdminMemory = (params = {}) => {
 export const deleteAdminMemory = (owner, key) => apiDelete(`/v1/admin/memory/${encodeURIComponent(owner)}/${encodeURIComponent(key)}`);
 
 // ── Stats ──
-export const getStats        = ()       => apiGet('/v1/stats');
+export const getStats = (from, to) => {
+  const params = new URLSearchParams();
+  if (from) params.set('from', from);
+  if (to) params.set('to', to);
+  const qs = params.toString();
+  return apiGet('/v1/stats' + (qs ? '?' + qs : ''));
+};
 
 // ── Extensions & Instances ──
 export const getAvailableExtensions   = ()              => apiGet('/v1/admin/extensions/available');

package/dist/public/views/admin/federation-tab.js

@@ -9,6 +9,7 @@ import {
   getFederationPeers, getFederationDirectory, approvePeeringRequest, rejectPeeringRequest,
   deletePeeringRequest, activatePeer, addPeerDirect, removePeer, removePeerEmergency,
   testFederationNode, joinGenesisNetwork, updatePeerPolicy, getNetworkDirectory,
+  getConfig, saveConfig,
 } from '/js/services/admin.js';
 import { useConfirm } from '/components/Modal.js';
 
@@ -30,6 +31,39 @@ export default function FederationTab({ data, reload }) {
   const [joining, setJoining] = useState(false);
   const [joinResult, setJoinResult] = useState(null);
 
+  // ── Federation Auth Policy state ──
+  const [authPolicy, setAuthPolicy] = useState('disabled');
+  const [defaultScopes, setDefaultScopes] = useState([]);
+  const [authPolicyLoading, setAuthPolicyLoading] = useState(true);
+
+  useEffect(() => {
+    getConfig().then(res => {
+      if (res.ok && res.data?.config) {
+        const c = res.data.config;
+        setAuthPolicy(c.federation?.auth_policy ?? c.federationAuthPolicy ?? 'disabled');
+        const scopes = c.federation?.default_scopes ?? c.federationDefaultScopes ?? 'memory:read,catalogue:read';
+        setDefaultScopes(typeof scopes === 'string' ? scopes.split(',').filter(Boolean) : (scopes || []));
+      }
+      setAuthPolicyLoading(false);
+    });
+  }, []);
+
+  const doSaveAuthPolicy = async (policy, scopes) => {
+    const changes = [
+      { key: 'federation.auth_policy', value: policy },
+      { key: 'federation.default_scopes', value: Array.isArray(scopes) ? scopes.join(',') : scopes },
+    ];
+    const res = await saveConfig(changes);
+    if (res.ok) { setActionSuccess(t('dashboard.fedPolicyUpdated')); setTimeout(() => setActionSuccess(null), 3000); }
+    else setActionError(res.error?.message || 'Failed to save');
+  };
+
+  const toggleScope = (scope) => {
+    const next = defaultScopes.includes(scope) ? defaultScopes.filter(s => s !== scope) : [...defaultScopes, scope];
+    setDefaultScopes(next);
+    doSaveAuthPolicy(authPolicy, next);
+  };
+
   // ── Network Directory state ──
   const [dirEntries, setDirEntries] = useState([]);
   const [dirSearch, setDirSearch] = useState('');
@@ -217,6 +251,31 @@ export default function FederationTab({ data, reload }) {
       { label: t('dashboard.fedPendingRequests'), value: pendingRequests.length, color: '#06b6d4' },
     ]} />
 
+    <!-- ═══ Federation Auth Policy ═══ -->
+    <div class="adm-card adm-mt-lg">
+      <h4 class="adm-mb-sm" style="margin:0">${t('dashboard.fedAuthPolicyTitle')}</h4>
+      <p class="adm-text-dim adm-text-base adm-mb-md" style="margin:0">${t('dashboard.fedAuthPolicyDesc')}</p>
+      ${authPolicyLoading ? html`<p class="adm-text-dim">...</p>` : html`
+        <div style="display:flex;gap:12px;align-items:center;flex-wrap:wrap">
+          <select class="adm-input" style="max-width:240px" value=${authPolicy} onChange=${(e) => { setAuthPolicy(e.target.value); doSaveAuthPolicy(e.target.value, defaultScopes); }}>
+            <option value="disabled">${t('dashboard.fedAuthDisabled')}</option>
+            <option value="all_peers">${t('dashboard.fedAuthAllPeers')}</option>
+            <option value="specific_peers">${t('dashboard.fedAuthSpecificPeers')}</option>
+          </select>
+        </div>
+        ${authPolicy !== 'disabled' && html`
+          <div class="adm-mt-md">
+            <p class="adm-text-sm adm-text-dim adm-mb-sm">${t('dashboard.fedDefaultScopes')}</p>
+            <div style="display:flex;gap:8px;flex-wrap:wrap">
+              ${['memory:read','memory:write','catalogue:read','social:read','social:write','work:request','boards:read','boards:write'].map(s => html`
+                <label class="adm-text-sm"><input type="checkbox" checked=${defaultScopes.includes(s)} onChange=${() => toggleScope(s)} /> ${s}</label>
+              `)}
+            </div>
+          </div>
+        `}
+      `}
+    </div>
+
     <!-- ═══ Network Directory ═══ -->
     <div class="adm-card adm-mt-lg">
       <h4 class="adm-mb-sm" style="margin:0">${t('dashboard.fedNetworkDirectoryTitle')}</h4>
@@ -313,6 +372,7 @@ export default function FederationTab({ data, reload }) {
                 <label class="adm-text-sm"><input type="checkbox" checked=${p.share_catalogue !== false} onChange=${(e) => doUpdatePolicy(p.node_id, 'share_catalogue', e.target.checked)} /> ${t('dashboard.fedShareCatalogue')}</label>
                 <label class="adm-text-sm"><input type="checkbox" checked=${p.replicate_memory !== false} onChange=${(e) => doUpdatePolicy(p.node_id, 'replicate_memory', e.target.checked)} /> ${t('dashboard.fedReplicateMemory')}</label>
                 <label class="adm-text-sm"><input type="checkbox" checked=${p.allow_routing !== false} onChange=${(e) => doUpdatePolicy(p.node_id, 'allow_routing', e.target.checked)} /> ${t('dashboard.fedAllowRouting')}</label>
+                <label class="adm-text-sm"><input type="checkbox" checked=${!!p.allow_federated_auth} onChange=${(e) => doUpdatePolicy(p.node_id, 'allow_federated_auth', e.target.checked)} /> ${t('dashboard.fedAllowAuth')}</label>
                 <select class="adm-input" style="font-size:.75rem;padding:2px 4px;margin-top:4px" value=${p.peer_mode || 'federation'} onChange=${(e) => doUpdatePolicy(p.node_id, 'peer_mode', e.target.value)}>
                   <option value="federation">${t('dashboard.fedPeerModeFederation')}</option>
                   <option value="private">${t('dashboard.fedPeerModePrivate')}</option>