iobroker.zeiterfassung 0.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alex <sadam6752@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,365 @@
+![Logo](admin/zeiterfassung.png)
+
+# ioBroker.zeiterfassung
+
+[![NPM version](https://img.shields.io/npm/v/iobroker.zeiterfassung.svg)](https://www.npmjs.com/package/iobroker.zeiterfassung)
+[![Downloads](https://img.shields.io/npm/dm/iobroker.zeiterfassung.svg)](https://www.npmjs.com/package/iobroker.zeiterfassung)
+![Number of Installations](https://iobroker.live/badges/zeiterfassung-installed.svg)
+![Current version in stable repository](https://iobroker.live/badges/zeiterfassung-stable.svg)
+
+[![NPM](https://nodei.co/npm/iobroker.zeiterfassung.png?downloads=true)](https://nodei.co/npm/iobroker.zeiterfassung/)
+
+**Tests:** ![Test and Release](https://github.com/sadam6752-tech/ioBroker.zeiterfassung/workflows/Test%20and%20Release/badge.svg)
+
+## zeiterfassung adapter for ioBroker
+
+Time tracking (**clock-in/clock-out**) for ioBroker – self-hosted, multi-user, with an installable web app
+(PWA), a badge/PIN terminal, absence and vacation management, and monthly reports.
+
+> **Status: work in progress.** The adapter is implemented and tested: database with migrations, domain logic
+> (time pairs, breaks, target time, overtime models, vacation, holidays), REST API with roles and permissions,
+> web app (PWA) incl. offline queue, badge/PIN terminal, RFID scan, monthly reports (PDF/XLS), live events and
+> backups with a tested restore. Still missing before the first release: the acceptance tests and the publication itself. The package is therefore **not installable from npm**
+> yet and there are no stable states.
+
+## Features
+
+Everything in this table is implemented unless it is marked as open. The remaining work is listed under
+[Development](#development).
+
+| Area                | Content                                                                                                                                                                                           |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Punching            | Web app (PWA, installable, offline-capable with queued sync), kiosk terminal with badge/PIN, NFC deep links                                                                                       |
+| Users & rights      | Multi-user with roles (admin/manager/employee) and a full permission catalogue – all decisions server-side                                                                                        |
+| Working time        | Target time from weekly hours / employment level / working days, break rules (graduated, applied per time pair), overtime models (monthly/yearly/cumulative), carryover, rounding for quick punch |
+| Absences & vacation | Absence types with factors, half days, planned vacation preview, holidays incl. movable feasts                                                                                                    |
+| Corrections         | Administration fixes punches (change, delete, add a single punch or a whole day); every change carries a reason, and the history of a punch (who changed it and why) is shown in the app          |
+| Reports             | Monthly PDF timesheet, XLS export, statistics, payouts/compensation                                                                                                                               |
+| ioBroker            | Aggregates and events as states (`info.*`, `users.<id>.*`, `global.*`, `event.*`) and `command.*` for automations                                                                                 |
+| Data                | SQLite file (WAL) in the adapter's data directory; only aggregates are published as states                                                                                                        |
+
+## Requirements
+
+- ioBroker with js-controller >= 6.0.11 and **Node.js >= 22** (required by the bundled SQLite driver `better-sqlite3`)
+- HTTPS for the web app (required for PWA/service worker); a reverse proxy with Let's Encrypt is recommended
+
+## Installation
+
+Not published yet: the adapter is neither on npm nor in the official repository list. To run the current
+state, build it locally (see [Development](#development)) and start it with the dev server:
+
+```bash
+npm ci && npm run install:pwa && npm run build:pwa && npm run build
+```
+
+Once released:
+
+```bash
+iobroker add zeiterfassung
+```
+
+## Configuration
+
+The adapter is configured in the instance settings:
+
+| Setting                             | Meaning                                                                                                |
+| ----------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| Port                                | Port of the built-in HTTP server (web app, API, terminal)                                              |
+| Bind address                        | Interface to listen on (`0.0.0.0` = all)                                                               |
+| Instance time zone                  | Fallback time zone (IANA name), e.g. `Europe/Berlin`                                                   |
+| Default language for new users      | One of the 11 supported languages                                                                      |
+| Holiday country                     | Country used to generate public holidays                                                               |
+| Database file                       | Optional path; empty = adapter data directory                                                          |
+| Enable kiosk terminal               | Switches the shared badge/PIN terminal on                                                              |
+| Trust the reverse proxy             | Use `X-Forwarded-*` of a proxy (client address, HTTPS)                                                 |
+| Session secret                      | Secret for CSRF tokens (**encrypted at rest**; empty = generated once and stored next to the database) |
+| Badge link secret (HMAC)            | Secret for signed badge/NFC links (**encrypted at rest**)                                              |
+| Session lifetime in minutes         | Session TTL                                                                                            |
+| Days users may edit on their own    | Retroactive editing window for employees                                                               |
+| Round quick punches to minutes      | Quick-time rounding (0 = off)                                                                          |
+| Calculate absences only until today | Future absences are not deducted from the target time                                                  |
+| Subtract working time from absences | May convert vacation into overtime                                                                     |
+| Keep database backups for days      | Retention of `VACUUM INTO` backups                                                                     |
+
+Instance settings (editable through `PUT /api/settings`, permission `settings.edit`) complement the
+configuration; `report_font_path` is one of them: the path of a `.ttf`/`.otf` file used for PDF statements.
+It is only needed for languages the built-in PDF fonts cannot display (`ru`, `uk`, `zh-cn`); everything else
+works without an additional file.
+
+## Web interface and API
+
+The adapter runs its own HTTP server on the configured port and serves two things from it:
+
+| Path                    | Content                                                                                                           |
+| ----------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `/` and all other paths | the built web app from `www/` (`index.html`, assets; unknown paths fall back to the page for client side routing) |
+| `/api/...`              | the REST API (JSON, errors as `application/problem+json`)                                                         |
+| `/api/stream`           | live events over a WebSocket (session token as query parameter)                                                   |
+
+The API is deliberately mounted below `/api`, so the web app owns every other path. If no `www/` folder is
+part of the installation (for example while the web app is still being developed), the adapter keeps running
+and only the API is reachable — a log line states which of both applies.
+
+Downloads are real files, not JSON: `GET /api/reports/xls?year=&month=` returns the monthly work time
+statement of the caller as an Excel workbook (`.xlsx`) and `GET /api/reports/pdf?year=&month=` the same
+statement as a PDF — both with `content-disposition: attachment`, generated in the language and time zone of
+the employee. The PDF is one page per month with the day table, the totals, the absences and two signature
+lines; for `ru`, `uk` and `zh-cn` a Unicode font has to be configured (`report_font_path`), because the
+built-in PDF fonts only cover Latin-1 — the export refuses such a language with a clear message
+(`report_font_missing`) instead of drawing empty boxes. The web app offers both files as buttons in the month
+view and in the year report, so nobody has to build a URL by hand.
+
+The web app itself covers the punch screen, the month calendar, the year report (including the two downloads),
+absences, the offline queue with its conflict view and the profile. Callers holding `user.view` or `backup.run`
+additionally get an **administration** entry in the menu: employees (create, activate/deactivate, badge PIN) and
+database backups (list, retention, "create now").
+
+### Kiosk terminal
+
+With **Enable kiosk terminal** switched on, a tablet in the workshop or at the entrance can punch for everybody
+without logging in. Create the device in the administration of the web app (**Administration → Terminals**; the
+API below it is `POST /api/terminals` with the permission `terminal.manage`). The device token is shown **exactly
+once** — copy it right away, because only its hash is stored — and the screen also offers the ready-made address
+for the tablet. Then open it on the device:
+
+```
+http://<adapter host>:<port>/terminal?token=<device token>
+```
+
+The screen keeps the token in the browser, so the URL is only needed for the first start. Afterwards it shows the
+badge field (scan or type, Enter punches), the list of active employees for the name plus PIN punch, the server
+clock and — after every punch — the name, the direction and the figures of that day for eight seconds. While the
+kiosk is switched off the screen says so and nothing else happens; a revoked token sends it back to the setup
+form. For the name/PIN path an employee needs a badge PIN (`POST /api/users/:id/pin`, 4–8 digits), for scanning an
+RFID card id (`rfidCard`).
+
+A device stands for one place, so it can be limited to the people that work there: the administration offers the
+employees of the device when it is created and later through the **Employees** button of its row
+(`POST /api/terminals` with `userIds`, `PUT /api/terminals/:id/users`). A device without an assignment shows
+everybody, so the behaviour of an existing installation does not change.
+
+**Employees need their PIN** is a switch per device. With it switched on a badge **and** the personal PIN are
+required; with it switched off the badge alone is enough and a name picked from the list punches right away. A
+wrong PIN is refused on both kinds of device, and the lock after too many wrong attempts stays active.
+
+The same device serves two screens: `/terminal` is the classic kiosk described above, `/presence` shows the
+employees as tiles with their picture and the state of the day — the screen for “who is at the workplace right
+now”. Both keep the device token in the browser of the tablet.
+
+### Branding
+
+The installation can carry its own look: the administration (**Administration → Settings → Company branding**) takes
+a **logo**, a **background picture** and an accent colour and applies them to the login screen, the header and the
+kiosk screens. The pictures are kept with the settings but delivered through their own cacheable routes
+(`GET /api/branding/logo`, `GET /api/branding/background`), so the payload of the settings API stays small.
+
+A picture straight from a phone is scaled down in the browser (longest edge 2560 px, JPEG in several quality steps)
+until it fits the 512 KiB the API accepts; the field reports the resulting size. The twelve preset colours are all
+light tones that keep the dark text readable — with a very dark background picture the text is the one thing that
+can become hard to read, so a light picture or a light background colour next to it is the safe choice.
+
+### Reverse proxy and HTTPS
+
+HTTPS is required for the service worker (PWA installation), so put nginx or caddy in front of the adapter and
+switch on **Trust the reverse proxy** in the instance settings. The adapter then uses the client address the proxy
+appends to `x-forwarded-for` for the rate limits and the audit trail, and `x-forwarded-proto: https` makes the
+session cookie `Secure`. Without that switch both headers are ignored — every client may send them, so a single
+client could otherwise move itself into another rate limit bucket. Only the hop directly in front is evaluated:
+with `x-forwarded-for: client, proxy` the rightmost entry counts, because the left part is client controlled.
+
+The sessions of the web app travel in an `httpOnly` cookie (`SameSite=Lax`, `Secure` behind HTTPS), so a script
+injected into the page cannot read them. The web app itself only keeps the CSRF token and the user in its
+`localStorage`; the session token never leaves the cookie. Sessions that were opened before that switch stored a
+token as well — they keep working and are moved over with the next login. State changing requests additionally
+need the `x-csrf-token` header, which `GET /api/auth/me` hands out for the own session (that is also how a browser
+that only holds the cookie learns it again after a reload). Integration clients keep using the `x-session-token`
+header from the login response; that path needs no CSRF token, because a foreign page cannot equip a request with
+a header of its own. Point the proxy at the whole adapter: the web app, `/api` and the WebSocket `/api/stream`
+live on the same port — the stream accepts the cookie too, so the browser needs no token in the URL.
+
+## States (overview)
+
+| State                                            | Type    | Role                | Purpose                                   |
+| ------------------------------------------------ | ------- | ------------------- | ----------------------------------------- |
+| `zeiterfassung.0.info.connection`                | boolean | indicator.connected | adapter/service ready                     |
+| `zeiterfassung.0.info.lastBackup`                | number  | value.time          | instant of the newest database backup     |
+| `zeiterfassung.0.users.<id>.displayName`         | string  | info.name           | name of the employee                      |
+| `zeiterfassung.0.users.<id>.hasOpenEntry`        | boolean | indicator.working   | employee is clocked in                    |
+| `zeiterfassung.0.users.<id>.lastPunch`           | number  | value.time          | instant of the last punch of today        |
+| `zeiterfassung.0.users.<id>.todayWorkedMinutes`  | number  | value               | minutes worked today                      |
+| `zeiterfassung.0.users.<id>.todayBalanceMinutes` | number  | value               | balance of today in minutes               |
+| `zeiterfassung.0.users.<id>.openConflicts`       | number  | value               | punches waiting for a decision            |
+| `zeiterfassung.0.commands.punchUserId`           | number  | value               | employee the punch commands apply to      |
+| `zeiterfassung.0.commands.punch`                 | boolean | button              | punch in or out                           |
+| `zeiterfassung.0.commands.quickPunch`            | boolean | button              | punch with the configured quick rounding  |
+| `zeiterfassung.0.commands.closeMonth`            | string  | text                | close a month, value `YYYY-MM`            |
+| `zeiterfassung.0.commands.recalc`                | string  | text                | recalculate a period, `YYYY-MM` or `YYYY` |
+| `zeiterfassung.0.commands.backup`                | boolean | button              | write a database backup                   |
+
+Punch records themselves are **not** mirrored into states – they live in the SQLite database.
+
+## First start
+
+The first start creates the database, the roles, the settings — and, when the instance has no administrator
+yet, **one administrator account**, because otherwise nobody could log in:
+
+| Setting                                     | Meaning                                                                                |
+| ------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `Login of the first administrator`          | login of that account, default `admin`                                                 |
+| `Start password of the first administrator` | password of that account; empty = a random password is written to the adapter log once |
+
+The account is created with `must_change_pw`, so the start password opens the door exactly once and the web
+app asks for a new password right after the login. Accounts created later in the admin area start the same way.
+
+The instance settings of the ioBroker admin are applied on every start and **win over the values stored in the
+database** — holiday country, time zone (also the time zone of new accounts), default language for new users,
+edit window, quick rounding, session lifetime, backup retention and the absence switches. `PUT /api/settings`
+stays for the keys the admin UI does not offer; an empty field never wipes a stored value. The adapter also
+publishes `info.version`, `info.schemaVersion`, `info.dbSizeBytes` and `info.lastError`.
+
+## Languages
+
+The adapter's admin UI, the web app and the generated reports are shipped in **11 languages**
+(the ioBroker standard set):
+
+`en` (base and fallback), `de`, `ru`, `pt`, `nl`, `fr`, `it`, `es`, `pl`, `uk`, `zh-cn`
+
+- Admin UI: `admin/i18n/<lang>.json`, kept in sync with the `io-package.json` metadata by `translate-adapter`
+- Web app: `src-pwa/src/i18n/<lang>.json` (`i18next`), using the same keys
+- Reports (PDF/XLS) use the language of the respective user; the instance language is the fallback
+- Dates, numbers, currencies and units are formatted with `Intl` and the user's time zone
+- Additional translations are welcome – see [`docs/i18n.md`](docs/i18n.md)
+- The API returns stable error **codes** instead of translated messages; the client translates them
+- This README is maintained in English with a German summary at the end
+
+## Privacy
+
+Everything runs on your own ioBroker host: no cloud service, no telemetry. Punch and personal data stay in
+the local SQLite file; access is role-based and corrections are audited.
+
+## Links
+
+- Repository: https://github.com/sadam6752-tech/ioBroker.zeiterfassung
+- Issues: https://github.com/sadam6752-tech/ioBroker.zeiterfassung/issues
+- ioBroker forum: https://forum.iobroker.net/
+
+## Development
+
+This repository is the adapter itself; the web app is a sub-project:
+
+```
+src/          adapter sources (TypeScript)
+src-pwa/      Progressive Web App (Vite + React + MUI) – built into www/
+src-shared/   types and validation shared by adapter and web app
+admin/        jsonConfig configuration and translations (11 languages)
+test/         package and integration tests (@iobroker/testing)
+docs/         operator and translator guide
+```
+
+| Script                     | Description                                                                 |
+| -------------------------- | --------------------------------------------------------------------------- |
+| `npm run build`            | Compile the TypeScript sources                                              |
+| `npm run watch`            | Compile and watch for changes                                               |
+| `npm run install:pwa`      | Install the dependencies of the web app (`src-pwa`, own `node_modules`)     |
+| `npm run build:pwa`        | Type check and build the web app into `www/`                                |
+| `npm run dev:pwa`          | Vite dev server with `/api` proxied to the running instance                 |
+| `npm run lint`             | ESLint with `@iobroker/eslint-config` (adapter and web app)                 |
+| `npm run lint:pwa`         | ESLint for the web app only                                                 |
+| `npm run check`            | TypeScript type check (adapter and web app)                                 |
+| `npm run test:ts`          | Unit tests for the adapter sources                                          |
+| `npm run test:package`     | Validate `package.json` / `io-package.json`                                 |
+| `npm run test:integration` | Adapter startup against a real js-controller (packs `build/` and `www/`)    |
+| `npm run translate`        | Keep the 11 translation files in sync                                       |
+| `npm run check:i18n`       | Verify that all 11 languages are complete                                   |
+| `npm run check:adapter`    | Local pre-check of the ioBroker adapter rules (see `docs/adapter-check.md`) |
+| `npm run release`          | Create a release (version, changelog, tag)                                  |
+| `dev-server watch`         | Run and debug the adapter locally                                           |
+
+The web app is built into `www/`, which the adapter serves on its own port (`/` = app, `/api` = REST). Both
+steps are needed for a release:
+
+```bash
+npm run install:pwa
+npm run build:pwa
+npm run build
+```
+
+`node tools/make-pwa-icons.mjs` regenerates the app icons (checked in, no image library required).
+
+### Still open
+
+- **Acceptance on real data:** the golden comparison against a full year of real punches (needs the `Data`
+  directory of the predecessor system) and the sign-off of the layouts and of the PDF rendering for `ru`, `uk` and
+  `zh-cn` (they need a Unicode font through `report_font_path`).
+- **Publication:** npm package (the CI workflow publishes through npm trusted publishing), entry in
+  `ioBroker.repositories` and the run of the official adapter checker.
+- **Smaller gaps:** the NFC comfort in the admin area (reading and writing a badge link with a phone); the language
+  files of the web app are machine translated and wait for a review by native speakers; a very dark background
+  picture can make the light text of the app hard to read.
+
+Working rules (see [`CONTRIBUTING.md`](CONTRIBUTING.md)): specification first, then tests, then
+flags must follow the official role rules; secrets only via `encryptedNative`/`protectedNative`.
+
+## Changelog
+
+### **WORK IN PROGRESS**
+
+<!--
+	Platzhalter für die nächste Version (am Zeilenanfang):
+	### **WORK IN PROGRESS**
+-->
+
+### 0.0.4 (2026-09-16)
+
+- (Alex) fix: the unit tests get a generous timeout (30 s), so cleaning up temporary directories cannot fail them on a slow runner
+
+### 0.0.3 (2026-09-16)
+
+- (Alex) fix: the integration tests read the version from `package.json`, so a version bump cannot break them
+
+### 0.0.2 (2026-09-16)
+
+- (Alex) project scaffolding: adapter skeleton (TypeScript + jsonConfig), 11-language metadata, admin configuration fields, CI workflow (@iobroker/testing, Node 22/24/26), i18n checks
+- (Alex) kiosk terminals: employees per device, optional PIN duty per device, on-screen keypad, presence screen with pictures
+- (Alex) branding: company logo, background picture and accent colour for the web app and the kiosk (scaled down in the browser, delivered through cacheable routes)
+- (Alex) session secret: generated once and stored next to the database when the instance settings do not define one
+- (Alex) fixes from the first field test: large picture uploads (body limit), terminals without PIN duty, integration tests on a free port
+
+### 0.0.1
+
+- initial release (not published yet)
+
+## Provenance
+
+This project is an independent implementation of the time tracking described in the internal specification.
+Behaviour, calculation rules and data formats follow that specification; **no source code** was taken from any
+other project. The verification record is kept outside this repository.
+
+## German summary
+
+A short summary in German (and why the README itself is English-only) is in
+[`docs/kurzfassung-de.md`](docs/kurzfassung-de.md).
+
+## License
+
+MIT License
+
+Copyright (c) 2026 Alex <sadam6752@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/admin/i18n/de.json

@@ -0,0 +1,26 @@
+{
+	"Badge link secret (HMAC)": "Geheimnis für Badge-Links (HMAC)",
+	"Bind address": "Bind-Adresse",
+	"Calculate absences only until today": "Abwesenheiten nur bis heute berechnen",
+	"Database file (empty = adapter data directory)": "Datenbankdatei (leer = Datenverzeichnis des Adapters)",
+	"Days users may edit on their own": "Tage, die Benutzer selbst bearbeiten dürfen",
+	"Default language for new users": "Standardsprache für neue Benutzer",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "leer = der Adapter erzeugt einmalig eines und legt es neben der Datenbank ab, damit Sitzungen Neustarts überleben",
+	"Enable kiosk terminal": "Kiosk-Terminal aktivieren",
+	"General": "Allgemein",
+	"Holiday country": "Land für Feiertage",
+	"Instance time zone": "Zeitzone der Instanz",
+	"Keep database backups for days": "Datenbank-Backups aufbewahren für Tage",
+	"Migration and backup": "Migration und Backup",
+	"Port": "Port",
+	"Round quick punches to minutes (0 = off)": "Schnellstempel auf Minuten runden (0 = aus)",
+	"Security": "Sicherheit",
+	"Session lifetime in minutes": "Sitzungsdauer in Minuten",
+	"Session secret": "Sitzungsgeheimnis",
+	"Subtract working time from absences": "Arbeitszeit von Abwesenheiten abziehen",
+	"Time rules": "Zeitregeln",
+	"zeiterfassung adapter settings": "Adaptereinstellungen für Zeiterfassung",
+	"127.0.0.1 = only this machine": "127.0.0.1 = nur dieser Rechner",
+	"Trust the reverse proxy (X-Forwarded-*)": "Reverse-Proxy vertrauen (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "nur einschalten, wenn ein Reverse-Proxy vor dem Adapter steht"
+}

package/admin/i18n/en.json

@@ -0,0 +1,26 @@
+{
+	"zeiterfassung adapter settings": "Adapter settings for zeiterfassung",
+	"General": "General",
+	"Security": "Security",
+	"Time rules": "Time rules",
+	"Migration and backup": "Migration and backup",
+	"Port": "Port",
+	"Bind address": "Bind address",
+	"Instance time zone": "Instance time zone",
+	"Default language for new users": "Default language for new users",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "empty = the adapter generates one once and stores it next to the database, so sessions survive restarts",
+	"Holiday country": "Holiday country",
+	"Database file (empty = adapter data directory)": "Database file (empty = adapter data directory)",
+	"Enable kiosk terminal": "Enable kiosk terminal",
+	"Session secret": "Session secret",
+	"Badge link secret (HMAC)": "Badge link secret (HMAC)",
+	"Session lifetime in minutes": "Session lifetime in minutes",
+	"Days users may edit on their own": "Days users may edit on their own",
+	"Round quick punches to minutes (0 = off)": "Round quick punches to minutes (0 = off)",
+	"Calculate absences only until today": "Calculate absences only until today",
+	"Subtract working time from absences": "Subtract working time from absences",
+	"Keep database backups for days": "Keep database backups for days",
+	"127.0.0.1 = only this machine": "127.0.0.1 = only this machine",
+	"Trust the reverse proxy (X-Forwarded-*)": "Trust the reverse proxy (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "only switch this on when a reverse proxy is in front of the adapter"
+}

package/admin/i18n/es.json

@@ -0,0 +1,26 @@
+{
+	"Badge link secret (HMAC)": "Secreto de enlace de insignia (HMAC)",
+	"Bind address": "dirección de enlace",
+	"Calculate absences only until today": "Calcular ausencias solo hasta hoy",
+	"Database file (empty = adapter data directory)": "Archivo de base de datos (vacío = directorio de datos del adaptador)",
+	"Days users may edit on their own": "Días que los usuarios pueden editar por su cuenta",
+	"Default language for new users": "Idioma predeterminado para nuevos usuarios",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vacío = el adaptador genera uno una vez y lo guarda junto a la base de datos, para que las sesiones sobrevivan a los reinicios",
+	"Enable kiosk terminal": "Habilitar terminal de quiosco",
+	"General": "General",
+	"Holiday country": "País de vacaciones",
+	"Instance time zone": "Zona horaria de la instancia",
+	"Keep database backups for days": "Mantenga copias de seguridad de la base de datos durante días",
+	"Migration and backup": "Migración y copia de seguridad",
+	"Port": "Puerto",
+	"Round quick punches to minutes (0 = off)": "Redondear golpes rápidos a minutos (0 = desactivado)",
+	"Security": "Seguridad",
+	"Session lifetime in minutes": "Duración de la sesión en minutos",
+	"Session secret": "Secreto de sesión",
+	"Subtract working time from absences": "Restar el tiempo de trabajo de las ausencias",
+	"Time rules": "reglas de tiempo",
+	"zeiterfassung adapter settings": "Configuración del adaptador para zeiterfassung",
+	"127.0.0.1 = only this machine": "127.0.0.1 = solo este equipo",
+	"Trust the reverse proxy (X-Forwarded-*)": "Confiar en el proxy inverso (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "activar solo si hay un proxy inverso delante del adaptador"
+}

package/admin/i18n/fr.json

@@ -0,0 +1,26 @@
+{
+	"Badge link secret (HMAC)": "Secret du lien du badge (HMAC)",
+	"Bind address": "Lier l'adresse",
+	"Calculate absences only until today": "Calculez les absences uniquement jusqu'à aujourd'hui",
+	"Database file (empty = adapter data directory)": "Fichier de base de données (vide = répertoire de données de l'adaptateur)",
+	"Days users may edit on their own": "Jours pendant lesquels les utilisateurs peuvent modifier eux-mêmes",
+	"Default language for new users": "Langue par défaut pour les nouveaux utilisateurs",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vide = l'adaptateur en génère un une fois et le stocke à côté de la base de données, pour que les sessions survivent aux redémarrages",
+	"Enable kiosk terminal": "Activer le terminal kiosque",
+	"General": "Général",
+	"Holiday country": "Pays de vacances",
+	"Instance time zone": "Fuseau horaire de l'instance",
+	"Keep database backups for days": "Conservez les sauvegardes de la base de données pendant des jours",
+	"Migration and backup": "Migration et sauvegarde",
+	"Port": "Port",
+	"Round quick punches to minutes (0 = off)": "Arrondir les pointages rapides en minutes (0 = désactivé)",
+	"Security": "Sécurité",
+	"Session lifetime in minutes": "Durée de vie de la session en minutes",
+	"Session secret": "Secret de séance",
+	"Subtract working time from absences": "Soustraire le temps de travail des absences",
+	"Time rules": "Règles de temps",
+	"zeiterfassung adapter settings": "Paramètres de l'adaptateur pour zeiterfassung",
+	"127.0.0.1 = only this machine": "127.0.0.1 = uniquement cette machine",
+	"Trust the reverse proxy (X-Forwarded-*)": "Faire confiance au proxy inverse (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "à activer uniquement si un proxy inverse se trouve devant l'adaptateur"
+}

package/admin/i18n/it.json

@@ -0,0 +1,26 @@
+{
+	"Badge link secret (HMAC)": "Segreto collegamento badge (HMAC)",
+	"Bind address": "Associa l'indirizzo",
+	"Calculate absences only until today": "Calcola le assenze solo fino ad oggi",
+	"Database file (empty = adapter data directory)": "File di database (vuoto = directory dei dati dell'adattatore)",
+	"Days users may edit on their own": "Giorni in cui gli utenti possono modificare autonomamente",
+	"Default language for new users": "Lingua predefinita per i nuovi utenti",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vuoto = l'adattatore ne genera uno una volta e lo salva accanto al database, così le sessioni sopravvivono ai riavvii",
+	"Enable kiosk terminal": "Abilita il terminale kiosk",
+	"General": "Generale",
+	"Holiday country": "Paese di vacanza",
+	"Instance time zone": "Fuso orario dell'istanza",
+	"Keep database backups for days": "Conserva i backup del database per giorni",
+	"Migration and backup": "Migrazione e backup",
+	"Port": "Porta",
+	"Round quick punches to minutes (0 = off)": "Arrotonda i colpi rapidi ai minuti (0 = disattivato)",
+	"Security": "Sicurezza",
+	"Session lifetime in minutes": "Durata della sessione in minuti",
+	"Session secret": "Segreto della sessione",
+	"Subtract working time from absences": "Sottrarre l'orario di lavoro dalle assenze",
+	"Time rules": "Regole del tempo",
+	"zeiterfassung adapter settings": "Impostazioni dell'adattatore per zeiterfassung",
+	"127.0.0.1 = only this machine": "127.0.0.1 = solo questa macchina",
+	"Trust the reverse proxy (X-Forwarded-*)": "Fidati del proxy inverso (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "attivare solo se davanti all'adattatore c'è un proxy inverso"
+}

package/admin/i18n/nl.json

@@ -0,0 +1,26 @@
+{
+	"Badge link secret (HMAC)": "Badgelinkgeheim (HMAC)",
+	"Bind address": "Bind adres",
+	"Calculate absences only until today": "Bereken de afwezigheden tot en met vandaag",
+	"Database file (empty = adapter data directory)": "Databasebestand (leeg = adaptergegevensmap)",
+	"Days users may edit on their own": "Dagen waarop gebruikers zelf kunnen bewerken",
+	"Default language for new users": "Standaardtaal voor nieuwe gebruikers",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "leeg = de adapter genereert er eenmalig een en bewaart het naast de database, zodat sessies herstarts overleven",
+	"Enable kiosk terminal": "Schakel kioskterminal in",
+	"General": "Algemeen",
+	"Holiday country": "Vakantie land",
+	"Instance time zone": "Tijdzone van instantie",
+	"Keep database backups for days": "Bewaar databaseback-ups dagenlang",
+	"Migration and backup": "Migratie en back-up",
+	"Port": "Haven",
+	"Round quick punches to minutes (0 = off)": "Snelle stoten afronden op minuten (0 = uit)",
+	"Security": "Beveiliging",
+	"Session lifetime in minutes": "Sessielevensduur in minuten",
+	"Session secret": "Sessiegeheim",
+	"Subtract working time from absences": "Trek de werktijd af van de afwezigheden",
+	"Time rules": "Tijd regels",
+	"zeiterfassung adapter settings": "Adapterinstellingen voor zeiterfassung",
+	"127.0.0.1 = only this machine": "127.0.0.1 = alleen deze computer",
+	"Trust the reverse proxy (X-Forwarded-*)": "Reverse proxy vertrouwen (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "alleen inschakelen als er een reverse proxy voor de adapter staat"
+}

package/admin/i18n/pl.json

@@ -0,0 +1,26 @@
+{
+	"Badge link secret (HMAC)": "Tajny link do plakietki (HMAC)",
+	"Bind address": "Powiąż adres",
+	"Calculate absences only until today": "Oblicz nieobecności tylko do dzisiaj",
+	"Database file (empty = adapter data directory)": "Plik bazy danych (pusty = katalog danych adaptera)",
+	"Days users may edit on their own": "Dni, które użytkownicy mogą edytować samodzielnie",
+	"Default language for new users": "Domyślny język dla nowych użytkowników",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "puste = adapter wygeneruje raz wartość i zapisze ją obok bazy danych, aby sesje przetrwały restarty",
+	"Enable kiosk terminal": "Włącz terminal kiosku",
+	"General": "Ogólny",
+	"Holiday country": "Wakacyjny kraj",
+	"Instance time zone": "Strefa czasowa instancji",
+	"Keep database backups for days": "Przechowuj kopie zapasowe bazy danych przez kilka dni",
+	"Migration and backup": "Migracja i kopia zapasowa",
+	"Port": "Port",
+	"Round quick punches to minutes (0 = off)": "Zaokrąglij szybkie uderzenia do minut (0 = wyłączone)",
+	"Security": "Bezpieczeństwo",
+	"Session lifetime in minutes": "Czas życia sesji w minutach",
+	"Session secret": "Sekret sesji",
+	"Subtract working time from absences": "Odejmij czas pracy od nieobecności",
+	"Time rules": "Zasady czasu",
+	"zeiterfassung adapter settings": "Ustawienia adaptera dla zeiterfassung",
+	"127.0.0.1 = only this machine": "127.0.0.1 = tylko ten komputer",
+	"Trust the reverse proxy (X-Forwarded-*)": "Ufaj odwrotnemu proxy (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "włączać tylko, gdy przed adapterem stoi odwrotne proxy"
+}

package/admin/i18n/pt.json

@@ -0,0 +1,26 @@
+{
+	"Badge link secret (HMAC)": "Segredo do link do crachá (HMAC)",
+	"Bind address": "Endereço de vinculação",
+	"Calculate absences only until today": "Calcular faltas apenas até hoje",
+	"Database file (empty = adapter data directory)": "Arquivo de banco de dados (vazio = diretório de dados do adaptador)",
+	"Days users may edit on their own": "Dias em que os usuários podem editar por conta própria",
+	"Default language for new users": "Idioma padrão para novos usuários",
+	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vazio = o adaptador gera um uma vez e guarda-o junto à base de dados, para que as sessões sobrevivam aos reinícios",
+	"Enable kiosk terminal": "Habilitar terminal de quiosque",
+	"General": "Em geral",
+	"Holiday country": "País de férias",
+	"Instance time zone": "Fuso horário da instância",
+	"Keep database backups for days": "Mantenha backups de banco de dados por dias",
+	"Migration and backup": "Migração e backup",
+	"Port": "Porta",
+	"Round quick punches to minutes (0 = off)": "Arredondar socos rápidos para minutos (0 = desativado)",
+	"Security": "Segurança",
+	"Session lifetime in minutes": "Duração da sessão em minutos",
+	"Session secret": "Segredo da sessão",
+	"Subtract working time from absences": "Subtraia o tempo de trabalho das ausências",
+	"Time rules": "Regras de tempo",
+	"zeiterfassung adapter settings": "Configurações do adaptador para zeiterfassung",
+	"127.0.0.1 = only this machine": "127.0.0.1 = apenas este computador",
+	"Trust the reverse proxy (X-Forwarded-*)": "Confiar no proxy inverso (X-Forwarded-*)",
+	"only switch this on when a reverse proxy is in front of the adapter": "ativar apenas quando um proxy inverso está à frente do adaptador"
+}