pgkiln 0.58.0 → 0.59.0

package/src/builder/i18n/en.ts

@@ -1386,4 +1386,332 @@ export const en = {
   'st.saved': 'Saved.',
   'st.settings_saved': 'Settings saved.',
   'st.app_deleted': 'Application deleted.',
+  // ------------------------------------------------------------ Users and identity providers (sprint 125)
+  'us.hints_none': "This app doesn't check any roles yet. Roles only matter where an authorization scheme or {fn} checks them (Shared Components → Authorization schemes).",
+  'us.hints_label': 'Roles this app checks',
+  'us.hints_add': 'Add',
+  'us.hints_app': '{app} checks',
+  'us.title': 'Users',
+  'us.providers_btn': 'Identity providers (single sign-on)',
+  'us.ldap_btn': 'LDAP directories',
+  'us.intro': "One account per person. Give accounts access to applications, with roles per application, here or under an application's {where}.",
+  'us.access_path': 'Shared Components → Access control',
+  'us.accounts': 'Accounts',
+  'us.search_ph': 'Search name, username or e-mail…',
+  'us.search_label': 'Search accounts',
+  'us.search': 'Search',
+  'us.username': 'Username',
+  'us.name': 'Name',
+  'us.apps_roles': 'Applications (roles)',
+  'us.applications': 'Applications',
+  'us.signin': 'Sign-in',
+  'us.status': 'Status',
+  'us.none': 'none',
+  'us.password': 'password',
+  'us.no_password': 'no password',
+  'us.active': 'active',
+  'us.inactive': 'inactive',
+  'us.last': 'last {at}',
+  'us.no_accounts': 'No accounts found.',
+  'us.create': 'Create account',
+  'us.username_help': 'No spaces or colons; not case-sensitive.',
+  'us.email': 'E-mail',
+  'us.password_label': 'Password',
+  'us.password_help': 'At least 8 characters. Leave empty for accounts that only sign in through single sign-on.',
+  'us.must_change': 'Require change of password on first use',
+  'us.settings': 'Account settings',
+  'us.min_length': 'Minimum password length',
+  'us.lifetime': 'Password lifetime (days)',
+  'us.lifetime_help': 'After this many days users must choose a new password at sign-in. 0 = never.',
+  'us.mixed': 'Passwords need letters and digits',
+  'us.policy_note': 'Passwords may never contain the username. Sign-in is locked for {minutes} minutes after {failures} failed attempts (Workspace utilities → Instance settings); Unlock on an account lifts it.',
+  'us.save_settings': 'Save settings',
+  'us.created': 'Account created. Now give it access to applications.',
+  'us.exists': 'An account with that username already exists.',
+  'us.settings_saved': 'Account settings saved.',
+  'us.details': 'Details',
+  'us.active_label': 'Active',
+  'us.active_help': "Inactive accounts can't sign in to any application; deactivating ends their sessions.",
+  'us.save': 'Save',
+  'us.password_title': 'Password',
+  'us.set': 'Set',
+  'us.set_on': 'Set on {date}',
+  'us.sso_only': 'No password (single sign-on only)',
+  'us.must_next': 'Must be changed at the next sign-in',
+  'us.expires': 'Expires in {n} day(s)',
+  'us.fails': '{n} failed sign-in(s) in the last hour',
+  'us.unexpire': 'Unexpire password',
+  'us.expire': 'Expire password',
+  'us.unlock': 'Unlock sign-in',
+  'us.new_password': 'New password',
+  'us.set_password_label': 'Set a password',
+  'us.ends_sessions': 'Ends the account’s sessions.',
+  'us.set_password': 'Set password',
+  'us.remove_confirm': 'Remove the password? The account can then only sign in through single sign-on.',
+  'us.remove_password': 'Remove password',
+  'us.delete_confirm': 'Delete account {user} and all its application access?',
+  'us.delete': 'Delete account',
+  'us.app_access': 'Application access',
+  'us.application': 'Application',
+  'us.roles': 'Roles',
+  'us.roles_in': 'Roles in {app}',
+  'us.roles_ph': 'no roles (e.g. {example})',
+  'us.revoke_confirm': 'Revoke access to {app}?',
+  'us.revoke': 'Revoke',
+  'us.no_access': 'No access to any application yet.',
+  'us.grant': 'Grant access',
+  'us.roles_comma': 'comma separated, or pick below',
+  'us.saved': 'Account saved.',
+  'us.pw_removed': 'Password removed.',
+  'us.pw_set': 'Password set.',
+  'us.pw_expired': 'Password expired: it must be changed at the next sign-in.',
+  'us.pw_unexpired': 'Password no longer expired.',
+  'us.unlocked': 'Sign-in unlocked.',
+  'us.deleted': 'Account deleted.',
+  'us.granted': 'Access granted.',
+  'us.roles_saved': 'Roles saved. The user gets them at the next sign-in.',
+  'us.revoked': 'Access revoked.',
+  'idp.title': 'Identity providers',
+  'idp.name': 'Name (in URLs)',
+  'idp.name_help': 'lowercase, e.g. entra, google, keycloak',
+  'idp.protocol': 'Protocol',
+  'idp.label': 'Button label',
+  'idp.label_help': 'Shown as "Sign in with …"',
+  'idp.issuer': 'Issuer (OIDC: URL; SAML: the IdP entity ID)',
+  'idp.issuer_help': 'e.g. https://login.microsoftonline.com/<tenant>/v2.0, https://keycloak.example.com/realms/acme, or for SAML the entityID of the IdP metadata',
+  'idp.client_id': "Client ID (SAML: pgkiln's entity ID)",
+  'idp.client_id_help': 'OIDC: required. SAML: empty = the metadata URL of this provider.',
+  'idp.sso_url': 'SAML: IdP sign-in URL',
+  'idp.sso_url_help': 'The SingleSignOnService location (HTTP-Redirect binding) from the IdP metadata.',
+  'idp.cert': 'SAML: IdP signing certificate (PEM)',
+  'idp.cert_help': 'From the IdP metadata (X509Certificate, wrapped in BEGIN/END CERTIFICATE lines). Assertions must be signed with it.',
+  'idp.secret': 'Client secret',
+  'idp.secret_kept': 'A secret is stored. Leave empty to keep it.',
+  'idp.secret_public': 'Leave empty for a public client (PKCE only).',
+  'idp.scopes': 'Scopes',
+  'idp.username_claim': 'Username claim',
+  'idp.username_claim_help': 'Use a claim users cannot change themselves (e.g. preferred_username, upn, email). SAML: an attribute name, or nameID.',
+  'idp.groups_claim': 'Groups claim',
+  'idp.groups_claim_help': 'Dot paths work, e.g. realm_access.roles',
+  'idp.auto_create': 'Create accounts automatically on first sign-in',
+  'idp.auto_create_help': 'Otherwise only people with an account linked to this provider (or allowed below) can sign in.',
+  'idp.link': 'Link existing accounts with the same username on their first sign-in',
+  'idp.link_help': "Only when users can't choose the username claim themselves at this provider: otherwise someone could register the name of an existing account and take it over. With the e-mail claim, only verified addresses link. Turn it off once the accounts are linked.",
+  'idp.enabled': 'Enabled',
+  'idp.remove_secret': 'Remove the stored client secret',
+  'idp.add': 'Add provider',
+  'idp.intro': 'OpenID Connect providers for single sign-on (Microsoft Entra ID, Google, Okta, Keycloak, Auth0, …). Register pgkiln at the provider as a web application with the redirect URI shown, then enable the provider per application under {where}.',
+  'idp.where': 'Settings → Sign-in methods',
+  'idp.providers': 'Providers',
+  'idp.provider': 'Provider',
+  'idp.issuer_col': 'Issuer',
+  'idp.used_by': 'Used by',
+  'idp.linked': 'Linked accounts',
+  'idp.no_apps': 'no apps',
+  'idp.enabled_s': 'enabled',
+  'idp.disabled_s': 'disabled',
+  'idp.auto_s': 'auto-create',
+  'idp.links_s': 'links existing accounts',
+  'idp.none': 'No identity providers yet.',
+  'idp.settings': 'Settings',
+  'idp.delete_confirm': 'Delete {name}? Linked identities are removed; accounts stay.',
+  'idp.delete': 'Delete provider',
+  'idp.register_idp': 'Register at the identity provider',
+  'idp.sp_metadata': 'Service provider metadata (import it at the IdP):',
+  'idp.by_hand': 'Or by hand: entity ID {entity}, assertion consumer service (HTTP-POST) {acs}.',
+  'idp.saml_note': 'Based on {env}. Sign the assertions; send the groups in the {claim} attribute to map them to roles.',
+  'idp.register': 'Register at the provider',
+  'idp.redirect': 'Redirect URI (callback):',
+  'idp.public_url': 'Based on {env}; set it to the address users see (e.g. https://apps.example.com).',
+  'idp.grant': 'Grant type: {type} with PKCE. Scopes: {scopes}. Include a {claim} claim in the ID token to map groups to roles.',
+  'idp.auth_code': 'authorization code',
+  'idp.test': 'Test discovery',
+  'idp.added': 'Provider added. Register the redirect URI at the provider, then test the connection.',
+  'idp.saved': 'Provider saved.',
+  'idp.works': 'Discovery works. Authorization endpoint: {url}',
+  'idp.failed': 'Discovery failed: {error}',
+  'idp.deleted': 'Provider deleted.',
+  // ------------------------------------------------------------ Workspaces (sprint 125)
+  'wsp.title': 'Workspaces',
+  'wsp.admins_only': 'Only administrators manage workspaces.',
+  'wsp.err.exists': 'A workspace with this name exists already.',
+  'wsp.err.name_check': 'The name is 1 to 60 characters, without spaces at the start or end.',
+  'wsp.err.name': 'The name is 1 to 60 characters.',
+  'wsp.iso.secret': "set PGKILN_SECRET_KEY (at least 32 characters) in the server's environment: the workspace's database logins get passwords derived from it.",
+  'wsp.iso.runtime': 'set RUNTIME_DATABASE_URL: applications run on the owner connection, so no workspace can be isolated.',
+  'wsp.err.role_taken': 'this role belongs to another workspace already.',
+  'wsp.err.role_has': 'the workspace has this role already.',
+  'wsp.isolated_tag': 'isolated',
+  'wsp.iso.on': "Its applications run as {run} and its developers' SQL (SQL Workshop, code checks, the Advisor) as {dev}. Both reach only the roles below, and see only this workspace's applications, sessions and accounts in pgkiln's own tables. Developers who also belong to a shared workspace keep that workspace's rights there.",
+  'wsp.db_role': 'Database role',
+  'wsp.used_by': 'Used by',
+  'wsp.missing': 'missing',
+  'wsp.no_app': 'no application',
+  'wsp.remove': 'Remove',
+  'wsp.no_roles': "No database roles: applications here can't run as a role of their own.",
+  'wsp.add_role': 'Add a database role',
+  'wsp.add_role_help': "An existing role (not a superuser, not one that creates roles or bypasses row-level security). Its rights become this workspace's; it can't belong to another workspace.",
+  'wsp.add_role_btn': 'Add role',
+  'wsp.make_shared_confirm': "Make {name} shared again? Its applications then run on the shared runtime connection, and its developers' SQL as the owner.",
+  'wsp.make_shared': 'Make shared',
+  'wsp.shared_text': "Shared: the applications run on the shared runtime connection and the developers' SQL as the owner, like every shared workspace's.",
+  'wsp.iso_help': "Isolating gives the workspace two database logins of its own and the database roles its applications use now. Application code then reaches only those roles and this workspace's applications; its developers' SQL Workshop runs on the workspace's login instead of the owner. New applications get a new role and schema of their own.",
+  'wsp.to_isolate': 'To isolate a workspace, {problem}',
+  'wsp.isolate_confirm': 'Isolate {name}?',
+  'wsp.isolate': 'Isolate this workspace',
+  'wsp.isolation': 'Isolation',
+  'wsp.service': 'Manage service',
+  'wsp.message': 'Workspace message',
+  'wsp.message_help': "Shown to this workspace's developers on the App Builder home, e.g. a maintenance window. Plain text.",
+  'wsp.banner': 'Environment banner',
+  'wsp.banner_help': 'A short label shown at the top of every builder page while this workspace is current. Empty: no banner.',
+  'wsp.banner_colour': 'Banner colour',
+  'wsp.save': 'Save',
+  'wsp.prefs': 'Workspace preferences',
+  'wsp.sql_on': 'Enable the SQL Workshop',
+  'wsp.sql_on_help': 'Off: the SQL Worksheet, the Object Browser, SQL scripts, data loading and unloading, Quick SQL, the query builder, DDL, Compare and AI are refused while this workspace is current, for every developer.',
+  'wsp.rest_on': 'Enable RESTful services',
+  'wsp.rest_on_help': "Off: the REST modules of this workspace's applications answer 404 (Not found) at {path}; they can still be edited.",
+  'wsp.builder_home': 'Builder links open',
+  'wsp.home.apps': 'App Builder',
+  'wsp.home.home': 'Workspace home',
+  'wsp.builder_home_help': 'Where a link to /builder (a bookmark from before the Workspace home) leads in this workspace. Signing in always opens the Workspace home; the App Builder is at /builder/apps.',
+  'wsp.save_prefs': 'Save preferences',
+  'wsp.links': 'Extension links',
+  'wsp.links_help': "Links to other tools this workspace's developers use (monitoring, a wiki, a ticket system), in the builder's {menu} menu while the workspace is current. They open in a new tab.",
+  'wsp.extensions': 'Extensions',
+  'wsp.label': 'Label',
+  'wsp.url': 'URL',
+  'wsp.order': 'Order',
+  'wsp.delete_link_confirm': 'Delete the link {label}?',
+  'wsp.delete': 'Delete',
+  'wsp.no_links': 'No extension links.',
+  'wsp.label_ph': 'Monitoring',
+  'wsp.description': 'Description',
+  'wsp.add_link': 'Add link',
+  'wsp.switched': 'Workspace {name}.',
+  'wsp.intro': "A workspace groups applications and the developers who build them. Developers see and change the applications of their own workspaces; administrators see all of them. A shared workspace is not a security boundary between developers who write SQL: its SQL Workshop and application code run with this installation's rights. An {isolated} workspace is: its applications and SQL run on database logins of its own that reach only its database roles and its own applications.",
+  'wsp.isolated_word': 'isolated',
+  'wsp.workspace': 'Workspace',
+  'wsp.applications': 'Applications',
+  'wsp.developers': 'Developers',
+  'wsp.admins_text': 'administrators only',
+  'wsp.add': 'Add workspace',
+  'wsp.name': 'Name',
+  'wsp.name_help': 'For example the team or department that builds its applications here.',
+  'wsp.first_dev': 'You become its first developer; add others on its page.',
+  'wsp.added': 'Workspace {name} added.',
+  'wsp.settings': 'Settings',
+  'wsp.default_no_delete': "The Default workspace can't be deleted: imported applications and applications made with the command line start here.",
+  'wsp.delete_confirm': 'Delete workspace {name}?',
+  'wsp.delete_ws': 'Delete workspace',
+  'wsp.move_first': 'Move its applications to another workspace first.',
+  'wsp.devs_help': 'Developers of this workspace see and change its applications. Administrators see every workspace.',
+  'wsp.administrator': '(administrator)',
+  'wsp.ws_admins': 'Workspace administrators',
+  'wsp.ws_admins_help': "They manage this workspace's name and developers. Isolation, database roles, moving applications and deleting the workspace stay with administrators.",
+  'wsp.save_devs': 'Save developers',
+  'wsp.mail_net': 'Mail and network access',
+  'wsp.mail_net_text': "This workspace's own {mail} for its applications without one of their own, its {network} list (which hosts its applications may call, within the installation's list), and the {queue}.",
+  'wsp.mail_service': 'mail service',
+  'wsp.network': 'network access',
+  'wsp.queue': 'mail queue',
+  'wsp.iso_short_on': 'Isolated: its applications and SQL run on database logins of its own.',
+  'wsp.iso_short_off': 'Shared.',
+  'wsp.admins_change': 'Administrators change it.',
+  'wsp.application': 'Application',
+  'wsp.move_to': 'Move to',
+  'wsp.move_label': 'Move {app} to',
+  'wsp.move': 'Move',
+  'wsp.no_other': 'no other workspace',
+  'wsp.no_apps': 'No applications.',
+  'wsp.saved': 'Workspace saved.',
+  'wsp.not_found': 'Not found.',
+  'wsp.devs_saved': 'Developers saved.',
+  'wsp.not_moved': 'Not moved: {why}',
+  'wsp.moved': 'Application moved to {name}.',
+  'wsp.err.default': 'The Default workspace cannot be deleted.',
+  'wsp.err.isolated': 'Make the workspace shared (not isolated) before deleting it.',
+  'wsp.err.has_apps': 'Move the applications of this workspace to another workspace first.',
+  'wsp.deleted': 'Workspace {name} deleted.',
+  'wsp.isolated_now': 'The workspace is isolated: its applications and SQL now run on its own database logins.',
+  'wsp.shared_now': 'The workspace is shared again: its applications run on the shared runtime connection.',
+  'wsp.not_isolated': 'Not isolated: {why}',
+  'wsp.not_changed': 'Not changed: {why}',
+  'wsp.err.role_name': 'A role name is a letter or _ followed by letters, digits, _ or $ (at most 63).',
+  'wsp.err.no_role': 'There is no database role {role}.',
+  'wsp.err.role_used_one': '{apps} runs as {role}: give it another role first.',
+  'wsp.err.role_used': '{apps} run as {role}: give them another role first.',
+  'wsp.role_removed': 'Role {role} removed.',
+  'wsp.role_added': 'Role {role} added.',
+  'wsp.not_saved': 'Not saved: {why}',
+  'wsp.err.message': 'The message is at most 2000 characters.',
+  'wsp.err.banner': 'The banner label is at most 40 characters.',
+  'wsp.service_saved': 'Message and banner saved.',
+  'wsp.prefs_saved': 'Preferences saved.',
+  'wsp.err.label': 'The label is 1 to 60 characters.',
+  'wsp.err.url': 'The URL starts with http:// or https://.',
+  'wsp.err.description': 'The description is at most 500 characters.',
+  'wsp.err.order': 'The order is a whole number.',
+  'wsp.link_added': 'Link {label} added.',
+  'wsp.link_exists': 'There is a link {label} already.',
+  'wsp.link_not_saved': 'The link was not saved.',
+  'wsp.link_deleted': 'Link deleted.',
+  'wsp.util_title': 'Workspace utilization: {name}',
+  'wsp.pages': 'Pages',
+  'wsp.views30': 'Page views (30 days)',
+  'wsp.scripts': 'SQL scripts',
+  'wsp.regions': 'Regions',
+  'wsp.items': 'Items',
+  'wsp.users30': 'Users (30 days)',
+  'wsp.static': 'Static files',
+  'wsp.views': 'Page views',
+  'wsp.users': 'Users',
+  'wsp.schemas': 'Schemas',
+  'wsp.schemas_help': "The schemas the workspace's database roles may use, with the storage of their tables, indexes and TOAST data.",
+  'wsp.schema': 'Schema',
+  'wsp.owner': 'Owner',
+  'wsp.tables': 'Tables',
+  'wsp.storage': 'Storage',
+  'wsp.no_schemas': "No schemas: the workspace's applications have no database role of their own.",
+  'wsp.utilization': 'Utilization',
+  'wsp.util_crumb': 'Utilization: {name}',
+  // ------------------------------------------------------------ Developers (sprint 125)
+  'dev.title': 'Developers',
+  'dev.change_pw': 'Change your password',
+  'dev.current': 'Current password',
+  'dev.new': 'New password',
+  'dev.min8': 'At least 8 characters.',
+  'dev.change_btn': 'Change password',
+  'dev.your_email': 'Your e-mail address',
+  'dev.email': 'E-mail address',
+  'dev.email_help': '"Find my workspace" on the sign-in page sends your workspaces to it. Empty: none.',
+  'dev.save': 'Save',
+  'dev.accounts': 'Developer accounts',
+  'dev.accounts_help': "Administrators add and remove developers and can break other developers' page and application locks.",
+  'dev.username': 'Username',
+  'dev.role': 'Role',
+  'dev.email_col': 'E-mail',
+  'dev.you': '(you)',
+  'dev.administrator': 'Administrator',
+  'dev.developer': 'Developer',
+  'dev.email_of': 'E-mail address of {user}',
+  'dev.none': 'none',
+  'dev.make_dev': 'Make developer',
+  'dev.make_admin': 'Make administrator',
+  'dev.remove_confirm': 'Remove developer {user}?',
+  'dev.remove': 'Remove',
+  'dev.add': 'Add developer',
+  'dev.password': 'Password',
+  'dev.optional_email': 'Optional: for "Find my workspace".',
+  'dev.admins_only': 'Only administrators add and remove developers.',
+  'dev.err.email': 'The e-mail address is not valid.',
+  'dev.added_ws': 'Developer added to workspace {name}.',
+  'dev.added': 'Developer added.',
+  'dev.err.current': 'The current password is not correct.',
+  'dev.pw_changed': 'Password changed.',
+  'dev.email_saved': 'E-mail address saved.',
+  'dev.not_found': 'Not found.',
+  'dev.role_changed': 'Role changed.',
+  'dev.removed': 'Developer removed.',
 } as const;