pgkiln 0.64.0 → 0.66.0

package/src/api.ts

@@ -1,4 +1,5 @@
 import { SignJWT } from 'jose';
+import { accountMustUseMfa } from './account-mfa.ts';
 import { owner } from './db.ts';
 
 // Tokens for the REST API that PostgREST serves next to pgkiln. They're
@@ -47,9 +48,11 @@ export async function apiStatus(): Promise<{ ok: boolean; detail: string }> {
  * active and have access to the app. Roles are not put in the token:
  * meta.has_role() reads them from meta.app_access at each request, and
  * meta.api_check() rejects the token once the account loses access.
+ * (sprint 131) `self`: the user asked for it on My account (two-step.ts checked the second step); `internal`: the
+ * token never leaves the server (the builder's Try it).
  */
-export async function issueApiToken(appId: number, username: string, hours: number) {
-  const app = await owner.one('select alias, api_role, access_control from meta.app where id = $1', [appId]);
+export async function issueApiToken(appId: number, username: string, hours: number, opts: { self?: boolean; internal?: boolean } = {}) {
+  const app = await owner.one('select id, alias, api_role, access_control, authentication, mfa, mfa_roles from meta.app where id = $1', [appId]);
   if (!app) throw new Error('No such application.');
   // without an API role the token is for pgkiln's own REST modules only (they run as the app's role)
   const problem = app.api_role ? await apiRoleProblem(app.api_role) : null;
@@ -63,6 +66,10 @@ export async function issueApiToken(appId: number, username: string, hours: numb
   if (!acc) throw new Error(`There is no account "${username}".`);
   if (!acc.active) throw new Error('This account is inactive.');
   if (!acc.has_access && app.access_control !== 'any_user') throw new Error('This account has no access to the application.');
+  // (sprint 131, SEC-3) a user who must sign in in two steps gets a token only from their own sign-in, after a second
+  // step (My account, src/runtime/two-step.ts), never one a developer issues for them
+  if (!opts.self && !opts.internal && (await accountMustUseMfa(app, acc.username)))
+    throw new Error(`The application requires two-factor sign-in of "${acc.username}": they create their own on My account, after a second step (REST API → Users create their own tokens).`);
   const ttl = Math.max(1, Math.min(MAX_TOKEN_HOURS, Math.round(hours)));
   const token = await new SignJWT({ ...(app.api_role ? { role: app.api_role } : {}), app_user: acc.username, app: app.alias })
     .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })

package/src/builder/api.ts

@@ -123,6 +123,8 @@ async function apiPage(s: Session, a: any, issued?: { token: string; username: s
         <form method="post" action="${BASE}/apps/${a.id}/api">${csrf(s)}
           <div class="form-grid">
             ${input('api_role', 'API database role', role, { placeholder: 'e.g. myapp_api', help: 'For PostgREST: grant it only the api schema’s views and functions, and grant it to pgkiln_authenticator. Empty: tokens work for the REST modules pgkiln serves (Shared Components → REST modules) only.' })}
+            <div class="field"><span class="label" aria-hidden="true"></span><label class="check"><input type="checkbox" name="api_self_tokens" value="true"${a.api_self_tokens ? raw(' checked') : ''}> Users create their own tokens</label>
+              <small class="help">On <em>My account</em>, signed-in users create a token that acts as them. A user the application requires two-factor sign-in of gives a second step first (if their last one is older than 15 minutes); for such users this is the only way to get a token.</small></div>
           </div>
           <div class="buttons"><button class="btn btn-hot">Save</button></div>
         </form>
@@ -171,7 +173,7 @@ export async function apiRoutes(app: FastifyInstance) {
     try {
       const problem = role ? await apiRoleProblem(role) : null;
       if (problem) throw new Error(problem);
-      await owner.query('update meta.app set api_role = $2, updated_at = now() where id = $1', [req.params.id, role]);
+      await owner.query('update meta.app set api_role = $2, api_self_tokens = $3, updated_at = now() where id = $1', [req.params.id, role, req.body?.api_self_tokens === 'true']);
       flash(s, role ? `API role set to ${role}.` : 'API role removed; new tokens work for the REST modules pgkiln serves only.');
     } catch (e) {
       flash(s, (e as Error).message, 'error');

package/src/builder/components.ts

@@ -420,6 +420,7 @@ export const COMPONENTS: Record<string, ComponentSpec> = {
       { name: 'type', label: 'Type', kind: 'select', options: ['role', 'sql'] },
       { name: 'value', label: 'Role name / SQL expression', kind: 'code', wide: true, help: "role: e.g. admin · sql: e.g. meta.has_role('manager') or :APP_USER = 'boss'" },
       { name: 'error_message', label: 'Error message', kind: 'text', wide: true },
+      { name: 'mfa_minutes', label: 'Second step within (minutes)', kind: 'int', help: 'Step-up: the scheme passes only when the user gave a second factor (code or passkey) at most this many minutes ago; a page that needs it asks again, then opens. Users without one are refused. Empty: no step-up.' },
     ],
   },
   lov: {

package/src/builder/i18n/de.ts

@@ -1295,6 +1295,9 @@ export const de: BuilderMessages = {
   'st.custom_post_help': 'Optionales PL/pgSQL nach einer erfolgreichen Prüfung, mit p_username (und meta.app_user()), z. B. um die letzte Anmeldung zu speichern. Eine Exception lehnt die Anmeldung ab. Anwendungsprozesse „after login“ laufen danach wie gewohnt.',
   'st.signin': 'Anmeldung',
   'st.methods': 'Anmeldemethoden',
+  'st.signin_page': 'Anmeldeseite',
+  'st.staying': 'Angemeldet bleiben',
+  'st.two_factor': 'Zwei-Faktor-Anmeldung',
   'st.local': 'Benutzername und Passwort',
   'st.ldap': 'Passwörter aus LDAP: {name}',
   'st.disabled': '(deaktiviert)',
@@ -1509,6 +1512,16 @@ export const de: BuilderMessages = {
   'idp.disabled_s': 'deaktiviert',
   'idp.auto_s': 'automatisch anlegen',
   'idp.links_s': 'verknüpft vorhandene Konten',
+  'idp.mfa_title': 'Mehrstufige Anmeldung',
+  'idp.mfa_required': 'Mehrstufige Anmeldung bei diesem Anbieter verlangen',
+  'idp.mfa_required_help': 'Anmeldungen (bei Anwendungen und im Builder) ablehnen, die der Anbieter nicht als mehrstufig kennzeichnet: bei OpenID Connect über den amr- oder acr-Claim des ID-Tokens, bei SAML über die AuthnContextClassRef.',
+  'idp.mfa_request': 'Beim Anbieter anfordern',
+  'idp.mfa_request_help': 'OpenID-Connect-acr_values oder SAML-AuthnContextClassRef-Werte, durch Leerzeichen getrennt. Leer: nichts anfordern.',
+  'idp.mfa_values': 'Werte, die mehrstufig bedeuten',
+  'idp.mfa_values_help': 'amr-, acr- oder AuthnContextClassRef-Werte, durch Leerzeichen getrennt; einer davon genügt. Entra ID und Okta setzen „mfa“ in amr.',
+  'idp.local_step': 'Nach diesem Anbieter den eigenen zweiten Schritt von pgkiln verlangen',
+  'idp.local_step_help': 'Für Anbieter, die keine mehrstufige Anmeldung erzwingen können: Die Zwei-Schritt-Regel der Anwendung gilt wie nach einem Passwort, und Entwickler mit einem zweiten Faktor geben ihn ebenfalls an. Eine erneute Bestätigung fragt dann nach dem Faktor in pgkiln, statt sich erneut beim Anbieter anzumelden.',
+  'idp.mfa_s': 'verlangt MFA',
   'idp.none': 'Noch keine Identitätsanbieter.',
   'idp.settings': 'Einstellungen',
   'idp.delete_confirm': '{name} löschen? Verknüpfte Identitäten werden entfernt; die Konten bleiben.',

package/src/builder/i18n/en.ts

@@ -1298,6 +1298,9 @@ export const en = {
   'st.custom_post_help': 'Optional PL/pgSQL run after a successful check, with p_username (and meta.app_user()), e.g. to record the last sign-in. Raising an exception refuses the sign-in. Application processes "after login" run afterwards as usual.',
   'st.signin': 'Sign-in',
   'st.methods': 'Sign-in methods',
+  'st.signin_page': 'Sign-in page',
+  'st.staying': 'Staying signed in',
+  'st.two_factor': 'Two-factor sign-in',
   'st.local': 'Username and password',
   'st.ldap': 'Passwords from LDAP: {name}',
   'st.disabled': '(disabled)',
@@ -1512,6 +1515,16 @@ export const en = {
   'idp.disabled_s': 'disabled',
   'idp.auto_s': 'auto-create',
   'idp.links_s': 'links existing accounts',
+  'idp.mfa_title': 'Multi-factor sign-in',
+  'idp.mfa_required': 'Require multi-factor sign-in at this provider',
+  'idp.mfa_required_help': "Refuse sign-ins (to applications and to the builder) that the provider does not mark as multi-factor: OpenID Connect through the ID token's amr or acr claim, SAML through the AuthnContextClassRef.",
+  'idp.mfa_request': 'Ask the provider for',
+  'idp.mfa_request_help': 'OpenID Connect acr_values or SAML AuthnContextClassRef values, separated by spaces. Empty: ask for nothing.',
+  'idp.mfa_values': 'Values that mean multi-factor',
+  'idp.mfa_values_help': 'amr, acr or AuthnContextClassRef values, separated by spaces; any one of them is enough. Entra ID and Okta put "mfa" in amr.',
+  'idp.local_step': "Ask pgkiln's own second step after this provider",
+  'idp.local_step_help': "For providers that cannot require multi-factor sign-in: the application's two-step rule applies as after a password, and developers with a second factor give it too. Step-up then asks for pgkiln's factor instead of signing in at the provider again.",
+  'idp.mfa_s': 'requires MFA',
   'idp.none': 'No identity providers yet.',
   'idp.settings': 'Settings',
   'idp.delete_confirm': 'Delete {name}? Linked identities are removed; accounts stay.',

package/src/builder/i18n/es.ts

@@ -1295,6 +1295,9 @@ export const es: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL opcional que se ejecuta tras una comprobación correcta, con p_username (y meta.app_user()), p. ej. para registrar el último inicio de sesión. Lanzar una excepción rechaza el inicio de sesión. Los procesos de aplicación «after login» se ejecutan después como siempre.',
   'st.signin': 'Inicio de sesión',
   'st.methods': 'Métodos de inicio de sesión',
+  'st.signin_page': 'Página de inicio de sesión',
+  'st.staying': 'Mantener la sesión',
+  'st.two_factor': 'Inicio de sesión en dos pasos',
   'st.local': 'Nombre de usuario y contraseña',
   'st.ldap': 'Contraseñas de LDAP: {name}',
   'st.disabled': '(desactivado)',
@@ -1509,6 +1512,16 @@ export const es: BuilderMessages = {
   'idp.disabled_s': 'desactivado',
   'idp.auto_s': 'creación automática',
   'idp.links_s': 'vincula cuentas existentes',
+  'idp.mfa_title': 'Inicio de sesión multifactor',
+  'idp.mfa_required': 'Exigir inicio de sesión multifactor en este proveedor',
+  'idp.mfa_required_help': 'Rechaza los inicios de sesión (en aplicaciones y en el builder) que el proveedor no marca como multifactor: en OpenID Connect por el claim amr o acr del token de ID, en SAML por el AuthnContextClassRef.',
+  'idp.mfa_request': 'Solicitar al proveedor',
+  'idp.mfa_request_help': 'Valores acr_values de OpenID Connect o AuthnContextClassRef de SAML, separados por espacios. Vacío: no solicitar nada.',
+  'idp.mfa_values': 'Valores que significan multifactor',
+  'idp.mfa_values_help': 'Valores amr, acr o AuthnContextClassRef, separados por espacios; basta con uno. Entra ID y Okta ponen «mfa» en amr.',
+  'idp.local_step': 'Pedir el segundo paso propio de pgkiln después de este proveedor',
+  'idp.local_step_help': 'Para proveedores que no pueden exigir multifactor: la regla de dos pasos de la aplicación se aplica como después de una contraseña, y los desarrolladores con un segundo factor también lo indican. La nueva confirmación pide entonces el factor de pgkiln en lugar de volver a iniciar sesión en el proveedor.',
+  'idp.mfa_s': 'exige MFA',
   'idp.none': 'Todavía no hay proveedores de identidad.',
   'idp.settings': 'Ajustes',
   'idp.delete_confirm': '¿Eliminar {name}? Se quitan las identidades vinculadas; las cuentas se mantienen.',

package/src/builder/i18n/fr.ts

@@ -1295,6 +1295,9 @@ export const fr: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL facultatif exécuté après une vérification réussie, avec p_username (et meta.app_user()), p. ex. pour enregistrer la dernière connexion. Lever une exception refuse la connexion. Les processus d’application « after login » s’exécutent ensuite comme d’habitude.',
   'st.signin': 'Connexion',
   'st.methods': 'Méthodes de connexion',
+  'st.signin_page': 'Page de connexion',
+  'st.staying': 'Rester connecté',
+  'st.two_factor': 'Connexion en deux étapes',
   'st.local': 'Nom d’utilisateur et mot de passe',
   'st.ldap': 'Mots de passe LDAP : {name}',
   'st.disabled': '(désactivé)',
@@ -1509,6 +1512,16 @@ export const fr: BuilderMessages = {
   'idp.disabled_s': 'désactivé',
   'idp.auto_s': 'création automatique',
   'idp.links_s': 'lie les comptes existants',
+  'idp.mfa_title': 'Connexion multifacteur',
+  'idp.mfa_required': 'Exiger une connexion multifacteur chez ce fournisseur',
+  'idp.mfa_required_help': 'Refuser les connexions (aux applications et au builder) que le fournisseur ne marque pas comme multifacteur : en OpenID Connect par le claim amr ou acr du jeton d’identité, en SAML par l’AuthnContextClassRef.',
+  'idp.mfa_request': 'Demander au fournisseur',
+  'idp.mfa_request_help': 'Valeurs acr_values (OpenID Connect) ou AuthnContextClassRef (SAML), séparées par des espaces. Vide : ne rien demander.',
+  'idp.mfa_values': 'Valeurs qui signifient multifacteur',
+  'idp.mfa_values_help': 'Valeurs amr, acr ou AuthnContextClassRef, séparées par des espaces ; une seule suffit. Entra ID et Okta mettent « mfa » dans amr.',
+  'idp.local_step': 'Demander la deuxième étape de pgkiln après ce fournisseur',
+  'idp.local_step_help': 'Pour les fournisseurs qui ne peuvent pas exiger le multifacteur : la règle de connexion en deux étapes de l’application s’applique comme après un mot de passe, et les développeurs ayant un second facteur le donnent aussi. Une nouvelle confirmation demande alors le facteur de pgkiln au lieu de se reconnecter chez le fournisseur.',
+  'idp.mfa_s': 'exige la MFA',
   'idp.none': 'Pas encore de fournisseurs d’identité.',
   'idp.settings': 'Paramètres',
   'idp.delete_confirm': 'Supprimer {name} ? Les identités liées sont retirées ; les comptes restent.',

package/src/builder/i18n/nl.ts

@@ -1295,6 +1295,9 @@ export const nl: BuilderMessages = {
   'st.custom_post_help': 'Optionele PL/pgSQL die draait na een geslaagde controle, met p_username (en meta.app_user()), bijv. om de laatste aanmelding vast te leggen. Een exception weigert de aanmelding. Applicatieprocessen “after login” draaien daarna zoals gewoonlijk.',
   'st.signin': 'Aanmelden',
   'st.methods': 'Aanmeldmethoden',
+  'st.signin_page': 'Aanmeldpagina',
+  'st.staying': 'Aangemeld blijven',
+  'st.two_factor': 'Aanmelden in twee stappen',
   'st.local': 'Gebruikersnaam en wachtwoord',
   'st.ldap': 'Wachtwoorden uit LDAP: {name}',
   'st.disabled': '(uitgeschakeld)',
@@ -1509,6 +1512,16 @@ export const nl: BuilderMessages = {
   'idp.disabled_s': 'uitgeschakeld',
   'idp.auto_s': 'automatisch aanmaken',
   'idp.links_s': 'koppelt bestaande accounts',
+  'idp.mfa_title': 'Meervoudige aanmelding',
+  'idp.mfa_required': 'Meervoudige aanmelding bij deze provider vereisen',
+  'idp.mfa_required_help': 'Aanmeldingen (bij applicaties en in de builder) weigeren die de provider niet als meervoudig aanmerkt: bij OpenID Connect via de amr- of acr-claim van het ID-token, bij SAML via de AuthnContextClassRef.',
+  'idp.mfa_request': 'Vragen aan de provider',
+  'idp.mfa_request_help': 'OpenID Connect-acr_values of SAML-AuthnContextClassRef-waarden, gescheiden door spaties. Leeg: niets vragen.',
+  'idp.mfa_values': 'Waarden die meervoudig betekenen',
+  'idp.mfa_values_help': 'amr-, acr- of AuthnContextClassRef-waarden, gescheiden door spaties; één ervan is genoeg. Entra ID en Okta zetten "mfa" in amr.',
+  'idp.local_step': 'Na deze provider ook de eigen tweede stap van pgkiln vragen',
+  'idp.local_step_help': 'Voor providers die geen meervoudige aanmelding kunnen afdwingen: de tweestapsregel van de applicatie geldt zoals na een wachtwoord, en ontwikkelaars met een tweede factor geven die ook. Opnieuw bevestigen vraagt dan de factor in pgkiln in plaats van opnieuw aanmelden bij de provider.',
+  'idp.mfa_s': 'vereist MFA',
   'idp.none': 'Nog geen identiteitsproviders.',
   'idp.settings': 'Instellingen',
   'idp.delete_confirm': '{name} verwijderen? Gekoppelde identiteiten worden verwijderd; de accounts blijven.',

package/src/builder/i18n/pt.ts

@@ -1295,6 +1295,9 @@ export const pt: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL opcional executado após uma verificação bem-sucedida, com p_username (e meta.app_user()), por exemplo para registrar o último login. Lançar uma exceção recusa o login. Processos de aplicação “after login” são executados depois, como de costume.',
   'st.signin': 'Login',
   'st.methods': 'Métodos de login',
+  'st.signin_page': 'Página de acesso',
+  'st.staying': 'Manter o acesso',
+  'st.two_factor': 'Acesso em duas etapas',
   'st.local': 'Nome de usuário e senha',
   'st.ldap': 'Senhas do LDAP: {name}',
   'st.disabled': '(desativado)',
@@ -1509,6 +1512,16 @@ export const pt: BuilderMessages = {
   'idp.disabled_s': 'desativado',
   'idp.auto_s': 'criação automática',
   'idp.links_s': 'vincula contas existentes',
+  'idp.mfa_title': 'Acesso multifator',
+  'idp.mfa_required': 'Exigir acesso multifator neste provedor',
+  'idp.mfa_required_help': 'Recusar acessos (às aplicações e ao builder) que o provedor não marca como multifator: no OpenID Connect pelo claim amr ou acr do token de ID, no SAML pelo AuthnContextClassRef.',
+  'idp.mfa_request': 'Pedir ao provedor',
+  'idp.mfa_request_help': 'Valores acr_values do OpenID Connect ou AuthnContextClassRef do SAML, separados por espaços. Vazio: não pedir nada.',
+  'idp.mfa_values': 'Valores que significam multifator',
+  'idp.mfa_values_help': 'Valores amr, acr ou AuthnContextClassRef, separados por espaços; basta um deles. Entra ID e Okta colocam "mfa" em amr.',
+  'idp.local_step': 'Pedir a segunda etapa do próprio pgkiln após este provedor',
+  'idp.local_step_help': 'Para provedores que não conseguem exigir multifator: a regra de duas etapas da aplicação vale como após uma senha, e desenvolvedores com um segundo fator também o informam. A nova confirmação pede então o fator do pgkiln em vez de entrar de novo no provedor.',
+  'idp.mfa_s': 'exige MFA',
   'idp.none': 'Ainda não há provedores de identidade.',
   'idp.settings': 'Configurações',
   'idp.delete_confirm': 'Excluir {name}? As identidades vinculadas são removidas; as contas ficam.',

package/src/builder/login-page.ts

@@ -1,6 +1,6 @@
 import type { FastifyInstance } from 'fastify';
 import { owner } from '../db.ts';
-import { APP_MFA, type AppMfa } from '../account-mfa.ts';
+import { APP_MFA, EMAIL_CODE_MINUTES, EMAIL_CODES_PER_HOUR, type AppMfa } from '../account-mfa.ts';
 import { html, raw } from '../html.ts';
 import { secretKeyConfigured } from '../secrets.ts';
 import { back, BASE, developer, flash, type Req } from './ui.ts';
@@ -9,7 +9,7 @@ import { back, BASE, developer, flash, type Req } from './ui.ts';
 // own login page (APEX: the login page, usually 9999) and "Forgot password?".
 // "Create login page" adds a minimal public page with a login region and
 // makes it the login page. (sprint 130, SEC-3) Two-factor sign-in for the
-// application's users: off, optional, required, or required for some roles.
+// application's users: off, optional, required, or required for some roles. (sprint 131) A code by e-mail.
 
 interface AppRow {
   id: number;
@@ -20,9 +20,10 @@ interface AppRow {
   password_reset: boolean;
   mfa: AppMfa;
   mfa_roles: string[];
+  mfa_email: boolean;
 }
 
-/** The fields in the settings form. */
+/** The fields in the settings form: the sign-in page, and two-factor sign-in (each placed by the settings page). */
 export async function loginSettingsFields(a: AppRow) {
   const pages = (await owner.query<{ page_no: number; name: string; requires_auth: boolean }>(
     'select page_no, name, requires_auth from meta.page where app_id = $1 order by page_no', [a.id],
@@ -32,31 +33,33 @@ export async function loginSettingsFields(a: AppRow) {
        from meta.app_mail_service ams join meta.mail_service s on s.id = ams.service_id where ams.app_id = $1`, [a.id],
   );
   const mailOk = !!(mail?.enabled && mail.from_address?.trim());
+  const noMail = html`<strong>Not offered yet:</strong> the application needs an enabled mail service with a From address (Workspace utilities → Mail services).`;
   const opt = (v: string, label: string, cur: string) => html`<option value="${v}"${v === cur ? raw(' selected') : ''}>${label}</option>`;
   const current = a.login_page ? String(a.login_page) : '';
-  return html`<div class="form-grid">
+  const page = html`<div class="form-grid">
       <div class="field"><label class="label" for="f_login_page">Login page</label>
         <select id="f_login_page" name="login_page">${opt('', '- the built-in sign-in page -', current)}${pages.map((p) =>
           opt(String(p.page_no), `${p.page_no} ${p.name}${p.requires_auth ? ' (requires sign-in: not usable)' : ''}`, current))}</select>
-        <small class="help">A page of the application with a <em>Login</em> region replaces the built-in sign-in page (APEX: the login page). It must not require authentication; with page template <em>Minimal</em> it has no header and navigation.
+        <small class="help">A public page with a <em>Login</em> region (APEX: the login page); page template <em>Minimal</em> hides the header and navigation.
           <button class="link-button" formaction="${BASE}/apps/${a.id}/login-page">Create a login page</button></small></div>
-      <div class="field"><span class="label" aria-hidden="true"></span><label class="check"><input type="checkbox" name="password_reset" value="true"${a.password_reset ? raw(' checked') : ''}> Offer "Forgot password?"</label>
-        <small class="help">Users with a password and an e-mail address in the user directory get a link to choose a new password (single-use, valid for 30 minutes).
-          ${mailOk
-            ? html`Sent through mail service ${mail!.service} as ${mail!.from_address}.`
-            : html`<strong>Not offered yet:</strong> the application needs an enabled mail service with a From address (Workspace utilities → Mail services).`}
-          Only for the user directory's own passwords: not for LDAP, single sign-on, database accounts or custom authentication.</small></div>
     </div>
-    <h3 id="two-factor">Two-factor sign-in</h3>
-    <div class="form-grid">
+    <div class="field"><label class="check"><input type="checkbox" name="password_reset" value="true"${a.password_reset ? raw(' checked') : ''}> Offer "Forgot password?"</label>
+      <small class="help">Users with a password and an e-mail address in the user directory get a single-use link, valid for 30 minutes, to choose a new password. Only for the user directory's own passwords.
+        ${mailOk ? html`Sent through mail service ${mail!.service} as ${mail!.from_address}.` : noMail}</small></div>`;
+  const twoFactor = html`<div class="form-grid">
       <div class="field"><label class="label" for="f_mfa">Second step</label>
         <select id="f_mfa" name="mfa" aria-describedby="f_mfa_help">${(APP_MFA as string[]).map((m) => opt(m, MFA_LABELS[m as AppMfa], a.mfa))}</select>
-        <small class="help" id="f_mfa_help">After the password (or an LDAP directory), users give a code from an authenticator app or a recovery code. They add the app on <em>My account</em>, or while signing in when it is required. An identity provider asks for its own second factor. Accounts share their apps across applications.
+        <small class="help" id="f_mfa_help">After the password or an LDAP directory: a code from an authenticator app, a passkey or a recovery code, added on <em>My account</em> or while signing in.
           ${secretKeyConfigured() ? '' : html`<strong>Not available yet:</strong> the server needs <code>PGKILN_SECRET_KEY</code> to keep the apps' secrets.`}</small></div>
       <div class="field"><label class="label" for="f_mfa_roles">Required for roles</label>
         <input id="f_mfa_roles" name="mfa_roles" value="${(a.mfa_roles ?? []).join(', ')}" placeholder="admin, manager" aria-describedby="f_mfa_roles_help">
         <small class="help" id="f_mfa_roles_help">With <em>Required for some roles</em>: users with one of these roles must use it, others may.</small></div>
-    </div>`;
+    </div>
+    <div class="field"><label class="check"><input type="checkbox" name="mfa_email" value="true"${a.mfa_email ? raw(' checked') : ''}> Offer a code by e-mail</label>
+      <small class="help">Users who already have an app or a passkey may get a one-time code by e-mail instead (valid ${EMAIL_CODE_MINUTES} minutes, at most ${EMAIL_CODES_PER_HOUR} an hour); never as their only factor.
+        ${mailOk ? '' : noMail}</small></div>
+    <p class="muted small">Passkeys need the application at a host name, not an IP address. Identity providers ask for their own second factor (see the provider's <em>Multi-factor sign-in</em>). To ask again before a page opens (step-up), give its authorization scheme <em>Second step within (minutes)</em> in Shared Components.</p>`;
+  return { page, twoFactor };
 }
 
 const MFA_LABELS: Record<AppMfa, string> = { off: 'Off', optional: 'Optional (users may add an app)', required: 'Required', roles: 'Required for some roles' };
@@ -71,8 +74,8 @@ export async function saveLoginSettings(appId: string, b: Record<string, string
   if (mfa === 'roles' && !roles.length) throw new Error('Two-factor sign-in: name the roles that must use it.');
   // without the instance key, users could not add an app: requiring one would lock them out
   if ((mfa === 'required' || mfa === 'roles') && !secretKeyConfigured()) throw new Error('Two-factor sign-in: the server needs PGKILN_SECRET_KEY before it can be required.');
-  await owner.query('update meta.app set login_page = $2, password_reset = $3, mfa = $4, mfa_roles = $5 where id = $1',
-    [appId, page, b.password_reset === 'true', mfa, roles]);
+  await owner.query('update meta.app set login_page = $2, password_reset = $3, mfa = $4, mfa_roles = $5, mfa_email = $6 where id = $1',
+    [appId, page, b.password_reset === 'true', mfa, roles, b.mfa_email === 'true']);
 }
 
 export async function loginPageRoutes(app: FastifyInstance) {

package/src/builder/rest-modules.ts

@@ -599,7 +599,7 @@ export async function restModuleRoutes(app: FastifyInstance) {
       const headers: Record<string, string> = {};
       if (as) {
         if (!(await tryAccounts(m.app_id)).includes(as)) throw new Error('Choose an account with access to the application.');
-        headers.authorization = `Bearer ${(await issueApiToken(m.app_id, as, 1)).token}`;
+        headers.authorization = `Bearer ${(await issueApiToken(m.app_id, as, 1, { internal: true })).token}`;
       }
       const raw = h.method === 'GET' || h.method === 'DELETE' ? '' : String(b.body ?? '').trim();
       if (raw) {

package/src/builder/routes.ts

@@ -264,7 +264,16 @@ export async function builderRoutes(app: FastifyInstance) {
     const username = await resolveDeveloper(src, { ...result.identity, username: result.username, groups: result.groups });
     const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [username]);
     if (!dev) throw new SsoError('The developer was removed.');
-    return finishSignIn(req, reply, null, dev, { ws: null, workspace: '', next: safeNext(result.next), remember: false, weak: false, picked: null, detail: `builder sso:${p.name}`, sso: p.name });
+    // (sprint 132, SEC-4) the provider leaves the second step to pgkiln: as after a password (the trusted-browser
+    // cookie belongs to /builder and doesn't reach this callback, so the step is always asked); a developer without a
+    // factor signs in without __SSO, so a 2FA rule makes them add one (ui.ts)
+    if (p.local_second_step && (await hasFactor(dev.username))) {
+      const ns = await createSession(reply, null, BASE);
+      ns.state.__MFA = JSON.stringify({ u: dev.username, ws: null, w: '', next: safeNext(result.next), remember: false, weak: false, at: Date.now() });
+      await saveState(ns);
+      return reply.redirect(`${BASE}/login/2fa`, 303);
+    }
+    return finishSignIn(req, reply, null, dev, { ws: null, workspace: '', next: safeNext(result.next), remember: false, weak: false, picked: null, detail: `builder sso:${p.name}${result.mfa ? ' (mfa)' : ''}`, sso: p.local_second_step ? undefined : p.name });
   });
 
   // (sprint 128, SEC-2) signing in with a passkey alone: no user name, no password. The browser offers the
@@ -762,6 +771,7 @@ export async function builderRoutes(app: FastifyInstance) {
     if (!a) return reply.code(404).send('Not found');
     const providers = (await owner.query('select name, display_name, enabled from meta.auth_provider order by display_name')).rows;
     const directories = (await owner.query('select name, display_name, enabled from meta.ldap_directory order by display_name')).rows;
+    const signinFields = await loginSettingsFields(a);
     const lists = (await owner.query('select name from meta.list where app_id = $1 order by name', [a.id])).rows.map((r) => r.name as string);
     const listChoices = (v: string | null, none: string): [string, string][] => [['', none], ...lists.map((n): [string, string] => [n, n]), ...(v && !lists.includes(v) ? [[v, tx('st.missing', { name: v })] as [string, string]] : [])];
     // (sprint 74) tabs like APEX's Edit Application Definition and Security Attributes: every tab of the
@@ -822,15 +832,21 @@ export async function builderRoutes(app: FastifyInstance) {
             <h3>${tx('st.methods')}</h3>
             <div class="field"><label class="check"><input type="checkbox" name="local_login" value="true"${a.local_login ? raw(' checked') : ''}> ${tx('st.local')}</label></div>
             ${directories.length
-              ? directories.map((d) => html`<div class="field"><label class="check"><input type="checkbox" name="ldap_directories" value="${d.name}"${a.ldap_directories.includes(d.name) ? raw(' checked') : ''}> ${tx('st.ldap', { name: d.display_name })}${d.enabled ? '' : ` ${tx('st.disabled')}`}</label></div>`)
-              : html`<p class="muted">${tx.rich('st.no_ldap', { add: html`<a href="${BASE}/users/directories">${tx('st.add_one')}</a>` })}</p>`}
-            <small class="help">${tx('st.ldap_help')}</small>
-            <div class="form-grid">${input('session_group', tx('st.session_group'), a.session_group ?? '', { placeholder: tx('st.session_group_ph'), help: tx('st.session_group_help') })}</div>
-            ${await loginSettingsFields(a)}
-            <div class="form-grid">${input('remember_me_days', tx('st.remember'), a.remember_me_days ?? '', { type: 'number', placeholder: tx('st.remember_ph'), help: tx('st.remember_help') })}</div>
+              ? html`${directories.map((d) => html`<div class="field"><label class="check"><input type="checkbox" name="ldap_directories" value="${d.name}"${a.ldap_directories.includes(d.name) ? raw(' checked') : ''}> ${tx('st.ldap', { name: d.display_name })}${d.enabled ? '' : ` ${tx('st.disabled')}`}</label></div>`)}
+                <small class="help">${tx('st.ldap_help')}</small>`
+              : html`<p class="muted small">${tx.rich('st.no_ldap', { add: html`<a href="${BASE}/users/directories">${tx('st.add_one')}</a>` })}</p>`}
             ${providers.length
               ? providers.map((pr) => html`<div class="field"><label class="check"><input type="checkbox" name="sso_providers" value="${pr.name}"${a.sso_providers.includes(pr.name) ? raw(' checked') : ''}> ${tx('st.sso', { name: pr.display_name })}${pr.enabled ? '' : ` ${tx('st.disabled')}`}</label></div>`)
-              : html`<p class="muted">${tx.rich('st.no_sso', { add: html`<a href="${BASE}/users/providers">${tx('st.add_one')}</a>` })}</p>`}
+              : html`<p class="muted small">${tx.rich('st.no_sso', { add: html`<a href="${BASE}/users/providers">${tx('st.add_one')}</a>` })}</p>`}
+            <h3>${tx('st.signin_page')}</h3>
+            ${signinFields.page}
+            <h3>${tx('st.staying')}</h3>
+            <div class="form-grid">
+              ${input('remember_me_days', tx('st.remember'), a.remember_me_days ?? '', { type: 'number', placeholder: tx('st.remember_ph'), help: tx('st.remember_help') })}
+              ${input('session_group', tx('st.session_group'), a.session_group ?? '', { placeholder: tx('st.session_group_ph'), help: tx('st.session_group_help') })}
+            </div>
+            <h3 id="two-factor">${tx('st.two_factor')}</h3>
+            ${signinFields.twoFactor}
             `)}${end}
             ${panel('ui')}${region(tx('st.tab.ui'), html`
             <h3>${tx('st.theme')}</h3>

package/src/builder/security.ts

@@ -11,7 +11,7 @@ import {
 import { qrSvg } from '../qrcode.ts';
 import { secretKeyConfigured } from '../secrets.ts';
 import { clientIp, logActivity, saveState, type Session } from '../session.ts';
-import { ALGORITHMS, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
+import { ALGORITHMS, giveChallenge, relyingParty, takeChallenge, verifyRegistration, WebAuthnError } from '../webauthn.ts';
 import { tr } from './i18n.ts';
 import { isAdmin } from './locks.ts';
 import { identitiesRegion } from './builder-sso.ts';
@@ -28,24 +28,8 @@ import { back, BASE, csrf, developer, flash, input, region, send, shell, type Re
 // (public/builder.js, [data-passkey]); without JavaScript the button stays hidden. Trusted browsers can be
 // forgotten here; the instance decides how long a browser may be trusted (0 = never).
 
-const CHALLENGE_SECONDS = 300;
-
-/** A one-time WebAuthn challenge kept in the session (for this purpose only), or null when there is none or it expired. */
-export function takeChallenge(s: Session, purpose: 'create' | 'get'): string | null {
-  try {
-    const p = JSON.parse(String(s.state.__PK ?? ''));
-    delete s.state.__PK;
-    return p && p.purpose === purpose && Date.now() - Number(p.at) < CHALLENGE_SECONDS * 1000 && typeof p.c === 'string' ? p.c : null;
-  } catch {
-    delete s.state.__PK;
-    return null;
-  }
-}
-export function giveChallenge(s: Session, purpose: 'create' | 'get'): string {
-  const c = newChallenge();
-  s.state.__PK = JSON.stringify({ c, purpose, at: Date.now() });
-  return c;
-}
+// (sprint 131) the challenge helpers moved to src/webauthn.ts: application users have passkeys too
+export { giveChallenge, takeChallenge };
 
 const SECRET_MINUTES = 10;
 

package/src/builder/shared.ts

@@ -156,7 +156,8 @@ export async function sharedRoutes(app: FastifyInstance) {
       rows[kind] = (await owner.query(`select * from ${COMPONENTS[kind].table} where app_id = $1 order by ${ORDER[kind] ?? 'name'}`, [a.id])).rows;
     const users = (
       await owner.query(
-        `select ac.id, ac.username, ac.display_name, ac.active, ac.last_login_at, aa.roles
+        `select ac.id, ac.username, ac.display_name, ac.active, ac.last_login_at, aa.roles,
+                exists (select 1 from meta.account_factor f where f.account_id = ac.id) as mfa
            from meta.app_access aa join meta.account ac on ac.id = aa.account_id
           where aa.app_id = $1 order by lower(ac.username)`,
         [a.id],
@@ -247,7 +248,7 @@ export async function sharedRoutes(app: FastifyInstance) {
           <button class="btn u-selfend">${tx('sc.save')}</button>
         </form>
         <p class="muted">${tx.rich('sc.access_help', { directory: html`<a href="${BASE}/users">${tx('sc.directory')}</a>`, app: html`<b>${a.name}</b>`, fn: html`<code>meta.has_role()</code>` })}</p>
-        <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('sc.account')}</th><th>${tx('sc.roles_in_app')}</th><th>${tx('sc.last_signin')}</th><th></th></tr></thead><tbody>
+        <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('sc.account')}</th><th>${tx('sc.roles_in_app')}</th><th>${tx('sc.last_signin')}</th><th>${tx('mfa.column')}</th><th></th></tr></thead><tbody>
           ${users.length
             ? users.map((u) => html`<tr>
                 <td data-label="${tx('sc.account')}"><a href="${BASE}/users/${u.id}">${u.username}</a>${u.display_name ? html` <span class="muted">${u.display_name}</span>` : ''}${u.active ? '' : html` <b>${tx('sc.inactive')}</b>`}</td>
@@ -255,9 +256,10 @@ export async function sharedRoutes(app: FastifyInstance) {
                   <input name="roles" value="${u.roles.join(', ')}" aria-label="${tx('sc.roles_of', { user: u.username })}" placeholder="${tx('sc.no_roles')}"><button class="btn">${tx('sc.save')}</button>
                   ${roleHintsHtml(appHints, tx('us.hints_add'), tx)}</form></td>
                 <td data-label="${tx('sc.last_signin')}">${u.last_login_at ? String(u.last_login_at).slice(0, 16) : '—'}</td>
+                <td data-label="${tx('mfa.column')}">${u.mfa ? html`${icon('lock')} ${tx('mfa.on')}` : html`<span class="muted">${tx('mfa.off')}</span>`}</td>
                 <td data-label=""><form method="post" action="${BASE}/apps/${a.id}/access/${u.id}/revoke">${csrf(s)}<button class="link-button" data-confirm="${tx('sc.revoke_confirm', { user: u.username, app: a.name })}">${tx('sc.revoke')}</button></form></td>
               </tr>`)
-            : html`<tr><td colspan="4" class="empty">${tx('sc.no_access')}</td></tr>`}
+            : html`<tr><td colspan="5" class="empty">${tx('sc.no_access')}</td></tr>`}
         </tbody></table></div>
         ${groupMap}
         <h3>${tx('sc.grant')}</h3>

package/src/builder/users.ts

@@ -398,6 +398,9 @@ export async function usersRoutes(app: FastifyInstance) {
   });
 
   // ---------------------------------------------------------------- identity providers (OpenID Connect)
+  /** (134) the values a new provider counts as a second factor: amr "mfa" (Entra ID, Okta), Entra ID's and SAML's own */
+  const DEFAULT_MFA_VALUES = ['mfa', 'http://schemas.microsoft.com/claims/multipleauthn',
+    'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract', 'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered'];
   const providerForm = (pr: any, action: string, csrfField: ReturnType<typeof csrf>, isNew: boolean, tx: BuilderTranslate) => html`
     <form method="post" action="${action}">${csrfField}
       <div class="form-grid">
@@ -419,6 +422,16 @@ export async function usersRoutes(app: FastifyInstance) {
         <small class="help">${tx('idp.auto_create_help')}</small></div>
       <div class="field"><label class="check"><input type="checkbox" name="link_existing" value="true"${pr.link_existing ? raw(' checked') : ''}> ${tx('idp.link')}</label>
         <small class="help">${tx('idp.link_help')}</small></div>
+      <fieldset class="prop-group u-mt075"><legend>${tx('idp.mfa_title')}</legend>
+        <div class="field"><label class="check"><input type="checkbox" name="mfa_required" value="true"${pr.mfa_required ? raw(' checked') : ''}> ${tx('idp.mfa_required')}</label>
+          <small class="help">${tx('idp.mfa_required_help')}</small></div>
+        <div class="form-grid">
+          ${input('mfa_request', tx('idp.mfa_request'), pr.mfa_request ?? '', { help: tx('idp.mfa_request_help') })}
+          ${input('mfa_values', tx('idp.mfa_values'), (pr.mfa_values ?? DEFAULT_MFA_VALUES).join(' '), { help: tx('idp.mfa_values_help') })}
+        </div>
+        <div class="field"><label class="check"><input type="checkbox" name="local_second_step" value="true"${pr.local_second_step ? raw(' checked') : ''}> ${tx('idp.local_step')}</label>
+          <small class="help">${tx('idp.local_step_help')}</small></div>
+      </fieldset>
       <div class="field"><label class="check"><input type="checkbox" name="enabled" value="true"${pr.enabled !== false ? raw(' checked') : ''}> ${tx('idp.enabled')}</label></div>
       ${!isNew && pr.has_secret ? html`<div class="field"><label class="check"><input type="checkbox" name="remove_secret" value="true"> ${tx('idp.remove_secret')}</label></div>` : ''}
       <div class="buttons"><button class="btn btn-hot">${isNew ? tx('idp.add') : tx('us.save')}</button></div>
@@ -439,13 +452,17 @@ export async function usersRoutes(app: FastifyInstance) {
     b.auto_create === 'true', b.enabled === 'true',
     protocol === 'saml' ? b.idp_sso_url?.trim() || null : null, protocol === 'saml' ? pem(b.idp_cert) : null,
     b.link_existing === 'true',
+    // (sprint 132, SEC-4) multi-factor sign-in at the provider
+    b.mfa_required === 'true', b.mfa_request?.trim().replace(/\s+/g, ' ').slice(0, 500) || null,
+    words(b.mfa_values).length ? words(b.mfa_values) : DEFAULT_MFA_VALUES, b.local_second_step === 'true',
   ];
+  const words = (v: string | undefined) => [...new Set((v ?? '').split(/\s+/).filter(Boolean))].slice(0, 20);
 
   app.get(`${BASE}/users/providers`, async (req: Req, reply) => {
     const s = await administrator(req, reply, 'Identity providers');
     if (!s) return;
     const tx = tr(s);
-    const rows = (await owner.query(`select id, name, display_name, issuer, enabled, auto_create, link_existing,
+    const rows = (await owner.query(`select id, name, display_name, issuer, enabled, auto_create, link_existing, mfa_required,
         (select count(*) from meta.account_identity i where i.provider_id = p.id)::int as linked,
         (select string_agg(a.alias, ', ' order by a.alias) from meta.app a where p.name = any(a.sso_providers)) as apps
       from meta.auth_provider p order by display_name`)).rows;
@@ -460,7 +477,7 @@ export async function usersRoutes(app: FastifyInstance) {
             <td data-label="${tx('idp.issuer_col')}">${r.issuer}</td>
             <td data-label="${tx('idp.used_by')}">${r.apps ?? html`<span class="muted">${tx('idp.no_apps')}</span>`}</td>
             <td data-label="${tx('idp.linked')}">${r.linked}</td>
-            <td data-label="${tx('us.status')}">${r.enabled ? tx('idp.enabled_s') : html`<b>${tx('idp.disabled_s')}</b>`}${r.auto_create ? ` · ${tx('idp.auto_s')}` : ''}${r.link_existing ? ` · ${tx('idp.links_s')}` : ''}</td>
+            <td data-label="${tx('us.status')}">${r.enabled ? tx('idp.enabled_s') : html`<b>${tx('idp.disabled_s')}</b>`}${r.auto_create ? ` · ${tx('idp.auto_s')}` : ''}${r.link_existing ? ` · ${tx('idp.links_s')}` : ''}${r.mfa_required ? ` · ${tx('idp.mfa_s')}` : ''}</td>
           </tr>`) : html`<tr><td colspan="5" class="empty">${tx('idp.none')}</td></tr>`}</tbody></table></div>`)}
         ${region(tx('idp.add'), providerForm({}, `${BASE}/users/providers`, csrf(s), true, tx))}
       </div>`;
@@ -473,8 +490,9 @@ export async function usersRoutes(app: FastifyInstance) {
     const b = req.body ?? {};
     try {
       const r = await owner.one(
-        `insert into meta.auth_provider (name, display_name, issuer, client_id, scopes, username_claim, groups_claim, auto_create, enabled, idp_sso_url, idp_cert, link_existing, protocol, client_secret)
-         values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) returning id`,
+        `insert into meta.auth_provider (name, display_name, issuer, client_id, scopes, username_claim, groups_claim, auto_create, enabled, idp_sso_url, idp_cert, link_existing,
+                                         mfa_required, mfa_request, mfa_values, local_second_step, protocol, client_secret)
+         values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18) returning id`,
         [b.name?.trim().toLowerCase(), ...providerValues(b, protocolOf(b.protocol), b.name?.trim().toLowerCase() ?? ''), protocolOf(b.protocol), b.client_secret || null],
       );
       flash(s, tr(s)('idp.added'));
@@ -523,7 +541,8 @@ export async function usersRoutes(app: FastifyInstance) {
       await owner.query(
         `update meta.auth_provider set display_name = $2, issuer = $3, client_id = $4, scopes = $5, username_claim = $6,
                 groups_claim = $7, auto_create = $8, enabled = $9, idp_sso_url = $10, idp_cert = $11, link_existing = $12,
-                client_secret = case when $14 then null when $13::text is null then client_secret else $13 end
+                mfa_required = $13, mfa_request = $14, mfa_values = $15, local_second_step = $16,
+                client_secret = case when $18 then null when $17::text is null then client_secret else $17 end
           where id = $1`,
         [req.params.id, ...providerValues(b, current.protocol, current.name), b.client_secret || null, b.remove_secret === 'true'],
       );

package/src/i18n/ar.ts

@@ -839,4 +839,35 @@ export const ar: Record<MessageKey, string> = {
   "mfa.codes_left": "رموز الاسترداد المتبقية: {n}",
   "mfa.codes_new": "رموز استرداد جديدة",
   "mfa.recovery_used": "سجّلت الدخول باستخدام رمز استرداد. رموز الاسترداد المتبقية: {n}.",
+  // (sprint 131) passkeys, e-mail codes, step-up, API tokens
+  "mfa.on_any": "عند تسجيل الدخول، تُدخل أيضًا رمزًا أو تستخدم مفتاح مرور.",
+  "mfa.use_passkey": "استخدام مفتاح مرور",
+  "mfa.passkey_failed": "لم يعمل مفتاح المرور. حاول مرة أخرى أو أدخل رمزًا.",
+  "mfa.email_send": "أرسل لي رمزًا بالبريد الإلكتروني بدلًا من ذلك",
+  "mfa.email_sent": "أرسلنا رمزًا إلى عنوان بريدك الإلكتروني. وهو صالح لمدة {minutes} دقيقة.",
+  "mfa.email_failed": "تعذّر إرسال رمز الآن. استخدم تطبيق المصادقة أو مفتاح مرور أو رمز استرداد.",
+  "mfa.email_subject": "رمز تسجيل الدخول إلى {app}",
+  "mfa.email_body": "رمز تسجيل الدخول إلى {app} هو {code}. وهو صالح لمدة {minutes} دقيقة.\n\nإذا لم تحاول تسجيل الدخول، فغيّر كلمة المرور.",
+  "mfa.stepup_title": "أكّد أنك أنت",
+  "mfa.stepup_intro": "تطلب هذه الصفحة خطوتك الثانية مرة أخرى. أدخل رمزًا من تطبيق المصادقة أو رمز استرداد، أو استخدم مفتاح مرور.",
+  "mfa.stepup_none": "تتطلب هذه الصفحة تسجيل الدخول بخطوتين. أضف أولًا تطبيق مصادقة أو مفتاح مرور في حسابي.",
+  "mfa.my_account": "حسابي",
+  "mfa.passkey_default": "مفتاح مرور",
+  "mfa.add_passkey": "إضافة مفتاح مرور",
+  "mfa.passkey_intro": "يتيح لك مفتاح المرور تسجيل الدخول ببصمة الإصبع أو الوجه أو قفل الشاشة أو مفتاح أمان، دون كتابة رمز.",
+  "mfa.passkey_added": "تمت إضافة مفتاح المرور.",
+  "mfa.passkey_removed": "تمت إزالة مفتاح المرور.",
+  "mfa.passkey_known": "تمت إضافة مفتاح المرور هذا من قبل.",
+  "mfa.passkey_needs_host": "تتطلب مفاتيح المرور أن يكون عنوان التطبيق اسم مضيف، لا عنوان IP.",
+  "mfa.passkey_needs_js": "تتطلب إضافة مفتاح مرور JavaScript.",
+  "mfa.or_passkey": "أو أضف مفتاح مرور بدلًا من ذلك:",
+  "mfa.kind_passkey": "مفتاح مرور",
+  "mfa.kind_app": "تطبيق المصادقة",
+  "token.title": "رمز REST API المميز",
+  "token.intro": "يتيح الرمز المميز لبرنامج نصي استخدام REST API لهذا التطبيق باسمك حتى تنتهي صلاحيته. يُعرض مرة واحدة فقط.",
+  "token.needs_step": "تُقدّم خطوتك الثانية مرة أخرى أولًا.",
+  "token.hours": "صالح لمدة (ساعات)",
+  "token.create": "إنشاء رمز مميز",
+  "token.shown_once": "رمزك المميز (يُعرض مرة واحدة، صالح {hours} ساعة):",
+  "token.step_first": "أكّد أنك أنت قبل إنشاء رمز مميز.",
 };