pgkiln 0.80.0 → 0.82.0

package/src/builder/ldap.ts

@@ -4,6 +4,7 @@ import { html, raw } from '../html.ts';
 import { testDirectory, type Directory } from '../ldap.ts';
 import { administrator, back, BASE, csrf, flash, input, region, send, shell, type Req } from './ui.ts';
 import { builderSignInRegion } from './builder-sso.ts';
+import { tr, type BuilderTranslate } from './i18n.ts';
 
 // Users → LDAP directories: the directories an application's password form
 // can check (enabled per app under Settings → Sign-in methods). The bind
@@ -12,36 +13,36 @@ import { builderSignInRegion } from './builder-sso.ts';
 const check = (name: string, label: string, on: boolean, help?: string) =>
   html`<div class="field"><label class="check"><input type="checkbox" name="${name}" value="true"${on ? raw(' checked') : ''}> ${label}</label>${help ? html`<small class="help">${help}</small>` : ''}</div>`;
 
-function directoryForm(d: Partial<Directory> & { has_password?: boolean }, action: string, csrfField: ReturnType<typeof csrf>, isNew: boolean) {
+function directoryForm(tx: BuilderTranslate, d: Partial<Directory> & { has_password?: boolean }, action: string, csrfField: ReturnType<typeof csrf>, isNew: boolean) {
   return html`<form method="post" action="${action}">${csrfField}
-    <fieldset class="prop-group"><legend>Server</legend><div class="form-grid">
-      ${isNew ? input('name', 'Name', '', { required: true, help: 'lowercase, e.g. corp or ad' }) : ''}
-      ${input('display_name', 'Display name', d.display_name, { required: true })}
-      ${input('url', 'URL', d.url, { required: true, placeholder: 'ldaps://ldap.example.com or ldap://…:389', help: 'ldaps:// (TLS) or ldap://, with StartTLS below. Plain ldap:// sends passwords unencrypted.' })}
-      ${input('bind_dn', 'Service account DN', d.bind_dn, { placeholder: 'cn=pgkiln,ou=services,dc=example,dc=org', help: 'Searches users (and groups). Empty: an anonymous search.' })}
-      ${input('bind_password', 'Service account password', '', { type: 'password', auto: 'new-password', help: d.has_password ? 'A password is stored. Leave empty to keep it.' : '' })}
+    <fieldset class="prop-group"><legend>${tx('ldap.server')}</legend><div class="form-grid">
+      ${isNew ? input('name', tx('ldap.name'), '', { required: true, help: tx('ldap.name_help') }) : ''}
+      ${input('display_name', tx('ldap.display_name'), d.display_name, { required: true })}
+      ${input('url', tx('ldap.url'), d.url, { required: true, placeholder: 'ldaps://ldap.example.com or ldap://…:389', help: tx('ldap.url_help') })}
+      ${input('bind_dn', tx('ldap.bind_dn'), d.bind_dn, { placeholder: 'cn=pgkiln,ou=services,dc=example,dc=org', help: tx('ldap.bind_dn_help') })}
+      ${input('bind_password', tx('ldap.bind_password'), '', { type: 'password', auto: 'new-password', help: d.has_password ? tx('ldap.password_stored') : '' })}
     </div>
-    ${check('start_tls', 'StartTLS (for ldap:// URLs)', !!d.start_tls)}
-    ${check('tls_verify', 'Verify the server certificate', d.tls_verify !== false, 'Turn off only for test servers with self-signed certificates.')}
-    ${!isNew && d.has_password ? check('remove_password', 'Remove the stored password (anonymous search)', false) : ''}
+    ${check('start_tls', tx('ldap.start_tls'), !!d.start_tls)}
+    ${check('tls_verify', tx('ldap.tls_verify'), d.tls_verify !== false, tx('ldap.tls_verify_help'))}
+    ${!isNew && d.has_password ? check('remove_password', tx('ldap.remove_password'), false) : ''}
     </fieldset>
-    <fieldset class="prop-group"><legend>Users</legend><div class="form-grid">
-      ${input('user_base', 'User search base', d.user_base, { required: true, placeholder: 'ou=people,dc=example,dc=org' })}
-      ${input('user_filter', 'User filter', d.user_filter ?? '(uid={username})', { help: '{username} is replaced by the escaped username. Active Directory: (sAMAccountName={username})' })}
-      ${input('username_attribute', 'Username attribute', d.username_attribute ?? 'uid', { help: 'The pgkiln username; AD: sAMAccountName' })}
-      ${input('display_name_attribute', 'Display name attribute', d.display_name_attribute ?? 'cn')}
-      ${input('email_attribute', 'E-mail attribute', d.email_attribute ?? 'mail')}
+    <fieldset class="prop-group"><legend>${tx('ldap.users')}</legend><div class="form-grid">
+      ${input('user_base', tx('ldap.user_base'), d.user_base, { required: true, placeholder: 'ou=people,dc=example,dc=org' })}
+      ${input('user_filter', tx('ldap.user_filter'), d.user_filter ?? '(uid={username})', { help: tx('ldap.user_filter_help', { ad: '(sAMAccountName={username})' }) })}
+      ${input('username_attribute', tx('ldap.username_attr'), d.username_attribute ?? 'uid', { help: tx('ldap.username_attr_help') })}
+      ${input('display_name_attribute', tx('ldap.display_attr'), d.display_name_attribute ?? 'cn')}
+      ${input('email_attribute', tx('ldap.email_attr'), d.email_attribute ?? 'mail')}
     </div>
-    ${check('auto_create', 'Create accounts automatically on first sign-in', !!d.auto_create, 'Otherwise only people with an existing account (same username) can sign in.')}
+    ${check('auto_create', tx('ldap.auto_create'), !!d.auto_create, tx('ldap.auto_create_help'))}
     </fieldset>
-    <fieldset class="prop-group"><legend>Groups (mapped to roles under each app's Access control)</legend><div class="form-grid">
-      ${input('group_attribute', 'Group attribute of the user', d.group_attribute ?? 'memberOf', { help: 'Group DNs; the first value of each is the group name. Empty: not used.' })}
-      ${input('group_base', 'Group search base', d.group_base, { placeholder: 'ou=groups,dc=example,dc=org', help: 'Optional: search groups as well.' })}
-      ${input('group_filter', 'Group filter', d.group_filter ?? '(|(member={dn})(uniqueMember={dn}))', { help: '{dn}: the user\'s DN, {username}: the username (both escaped).' })}
-      ${input('group_name_attribute', 'Group name attribute', d.group_name_attribute ?? 'cn')}
+    <fieldset class="prop-group"><legend>${tx('ldap.groups')}</legend><div class="form-grid">
+      ${input('group_attribute', tx('ldap.group_attr'), d.group_attribute ?? 'memberOf', { help: tx('ldap.group_attr_help') })}
+      ${input('group_base', tx('ldap.group_base'), d.group_base, { placeholder: 'ou=groups,dc=example,dc=org', help: tx('ldap.group_base_help') })}
+      ${input('group_filter', tx('ldap.group_filter'), d.group_filter ?? '(|(member={dn})(uniqueMember={dn}))', { help: tx('ldap.group_filter_help') })}
+      ${input('group_name_attribute', tx('ldap.group_name_attr'), d.group_name_attribute ?? 'cn')}
     </div></fieldset>
-    ${check('enabled', 'Enabled', d.enabled !== false)}
-    <div class="buttons"><button class="btn btn-hot">${isNew ? 'Add directory' : 'Save'}</button></div>
+    ${check('enabled', tx('ldap.enabled'), d.enabled !== false)}
+    <div class="buttons"><button class="btn btn-hot">${isNew ? tx('ldap.add') : tx('ldap.save')}</button></div>
   </form>`;
 }
 
@@ -62,22 +63,23 @@ export async function ldapRoutes(app: FastifyInstance) {
         (select count(*) from meta.ldap_identity i where i.directory_id = d.id)::int as linked,
         (select string_agg(a.alias, ', ' order by a.alias) from meta.app a where d.name = any(a.ldap_directories)) as apps
       from meta.ldap_directory d order by display_name`)).rows;
+    const tx = tr(s);
     const main = html`
-      <div class="title-row"><h1>LDAP directories</h1></div>
-      <p class="muted u-mt0">OpenLDAP, Active Directory and other LDAP servers. An application's sign-in form checks local passwords first, then the directories enabled under <b>Settings → Sign-in methods</b>. Directory groups map to roles under each application's <b>Access control</b>.</p>
+      <div class="title-row"><h1>${tx('ldap.title')}</h1></div>
+      <p class="muted u-mt0">${tx.rich('ldap.intro', { where: html`<b>${tx('ldap.where')}</b>`, access: html`<b>${tx('ldap.access')}</b>` })}</p>
       <div class="columns wide-left">
-        ${region('Directories', html`<div class="table-wrap"><table class="report report-reflow">
-          <thead><tr><th>Directory</th><th>URL</th><th>Used by</th><th>Linked accounts</th><th>Status</th></tr></thead>
+        ${region(tx('ldap.directories'), html`<div class="table-wrap"><table class="report report-reflow">
+          <thead><tr><th>${tx('ldap.col.directory')}</th><th>${tx('ldap.url')}</th><th>${tx('ldap.col.used_by')}</th><th>${tx('ldap.col.linked')}</th><th>${tx('ldap.col.status')}</th></tr></thead>
           <tbody>${rows.length ? rows.map((r) => html`<tr>
-            <td data-label="Directory"><a href="${BASE}/users/directories/${r.id}">${r.display_name}</a> <span class="muted">${r.name}</span></td>
-            <td data-label="URL">${r.url}</td>
-            <td data-label="Used by">${r.apps ?? html`<span class="muted">no apps</span>`}</td>
-            <td data-label="Linked accounts">${r.linked}</td>
-            <td data-label="Status">${r.enabled ? 'enabled' : html`<b>disabled</b>`}${r.auto_create ? ' · auto-create' : ''}</td>
-          </tr>`) : html`<tr><td colspan="5" class="empty">No LDAP directories yet.</td></tr>`}</tbody></table></div>`)}
-        ${region('Add directory', directoryForm({}, `${BASE}/users/directories`, csrf(s), true))}
+            <td data-label="${tx('ldap.col.directory')}"><a href="${BASE}/users/directories/${r.id}">${r.display_name}</a> <span class="muted">${r.name}</span></td>
+            <td data-label="${tx('ldap.url')}">${r.url}</td>
+            <td data-label="${tx('ldap.col.used_by')}">${r.apps ?? html`<span class="muted">${tx('ldap.no_apps')}</span>`}</td>
+            <td data-label="${tx('ldap.col.linked')}">${r.linked}</td>
+            <td data-label="${tx('ldap.col.status')}">${r.enabled ? tx('ldap.status_enabled') : html`<b>${tx('ldap.status_disabled')}</b>`}${r.auto_create ? ` · ${tx('ldap.status_auto')}` : ''}</td>
+          </tr>`) : html`<tr><td colspan="5" class="empty">${tx('ldap.none')}</td></tr>`}</tbody></table></div>`)}
+        ${region(tx('ldap.add'), directoryForm(tx, {}, `${BASE}/users/directories`, csrf(s), true))}
       </div>`;
-    return send(reply, s, shell(s, 'LDAP directories', [['Users', `${BASE}/users`], ['LDAP directories']], main, 'users'));
+    return send(reply, s, shell(s, tx('ldap.title'), [[tx('wu.users'), `${BASE}/users`], [tx('ldap.title')]], main, 'users'));
   });
 
   app.post(`${BASE}/users/directories`, async (req: Req, reply) => {
@@ -90,7 +92,7 @@ export async function ldapRoutes(app: FastifyInstance) {
          values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18) returning id`,
         [b.name?.trim().toLowerCase(), ...values(b), b.bind_password || null],
       );
-      flash(s, 'Directory added. Test the connection, then enable it for an application.');
+      flash(s, tr(s)('ldap.added'));
       return back(reply, s, `${BASE}/users/directories/${r.id}`);
     } catch (e) {
       flash(s, (e as Error).message, 'error');
@@ -104,20 +106,21 @@ export async function ldapRoutes(app: FastifyInstance) {
     const d = /^\d+$/.test(req.params.id) ? await owner.one('select *, bind_password is not null as has_password from meta.ldap_directory where id = $1', [req.params.id]) : undefined;
     if (!d) return reply.code(404).send('Not found');
     delete d.bind_password; // never sent to the browser
+    const tx = tr(s);
     const main = html`
       <div class="title-row"><h1>${d.display_name}</h1></div>
       <div class="columns wide-left">
-        ${region('Settings', html`${directoryForm(d, `${BASE}/users/directories/${d.id}`, csrf(s), false)}
+        ${region(tx('ldap.settings'), html`${directoryForm(tx, d, `${BASE}/users/directories/${d.id}`, csrf(s), false)}
           <form method="post" action="${BASE}/users/directories/${d.id}/delete" class="danger-zone">${csrf(s)}
-            <button class="btn btn-danger" data-confirm="Delete ${d.display_name}? Links to accounts are removed; accounts stay.">Delete directory</button></form>`)}
-        ${region('Test connection', html`
-          <p class="muted u-mt0">Connects, binds as the service account (or anonymously) and checks the search base; with a username, looks the user up with the filter. No password is checked.</p>
+            <button class="btn btn-danger" data-confirm="${tx('ldap.delete_confirm', { name: d.display_name })}">${tx('ldap.delete')}</button></form>`)}
+        ${region(tx('ldap.test'), html`
+          <p class="muted u-mt0">${tx('ldap.test_intro')}</p>
           <form method="post" action="${BASE}/users/directories/${d.id}/test" class="search u-mwnone">${csrf(s)}
-            <input name="username" placeholder="Username (optional)" aria-label="Username to look up" maxlength="100">
-            <button class="btn">Test</button></form>`)}
+            <input name="username" placeholder="${tx('ldap.test_username')}" aria-label="${tx('ldap.test_username_label')}" maxlength="100">
+            <button class="btn">${tx('ldap.test_btn')}</button></form>`)}
         ${await builderSignInRegion(s, 'directory', d)}
       </div>`;
-    return send(reply, s, shell(s, d.display_name, [['Users', `${BASE}/users`], ['LDAP directories', `${BASE}/users/directories`], [d.display_name]], main, 'users'));
+    return send(reply, s, shell(s, d.display_name, [[tx('wu.users'), `${BASE}/users`], [tx('ldap.title'), `${BASE}/users/directories`], [d.display_name]], main, 'users'));
   });
 
   app.post(`${BASE}/users/directories/:id`, async (req: Req, reply) => {
@@ -131,7 +134,7 @@ export async function ldapRoutes(app: FastifyInstance) {
           where id = $1`,
         [req.params.id, ...values(b), b.bind_password || null, b.remove_password === 'true'],
       );
-      flash(s, 'Directory saved.');
+      flash(s, tr(s)('ldap.saved'));
     } catch (e) {
       flash(s, (e as Error).message, 'error');
     }
@@ -146,7 +149,7 @@ export async function ldapRoutes(app: FastifyInstance) {
     try {
       flash(s, await testDirectory(d, (req.body?.username ?? '').trim().slice(0, 100) || undefined));
     } catch (e) {
-      flash(s, `The test failed: ${(e as Error).message}`, 'error');
+      flash(s, tr(s)('ldap.test_failed', { error: (e as Error).message }), 'error');
     }
     return back(reply, s, `${BASE}/users/directories/${d.id}`);
   });
@@ -157,7 +160,7 @@ export async function ldapRoutes(app: FastifyInstance) {
     const d = await owner.one('delete from meta.ldap_directory where id = $1 returning name', [req.params.id]);
     // and from the applications that used it
     if (d) await owner.query('update meta.app set ldap_directories = array_remove(ldap_directories, $1) where $1 = any(ldap_directories)', [d.name]);
-    flash(s, 'Directory deleted.');
+    flash(s, tr(s)('ldap.deleted'));
     return back(reply, s, `${BASE}/users/directories`);
   });
 }

package/src/builder/mail-queue.ts

@@ -6,6 +6,7 @@ import { clientIp, logActivity, type Session } from '../session.ts';
 import { isAdmin } from './locks.ts';
 import { back, BASE, csrf, developer, flash, region, select, send, shell, type Req } from './ui.ts';
 import { workspaceAdmin } from './workspaces.ts';
+import { tr } from './i18n.ts';
 
 // (sprint 118, WS-9; APEX 26.2 Administration → Mail queue) Delivery health of
 // the mail queue (meta.mail_queue): queued, sent, failed and retrying mail per
@@ -18,6 +19,8 @@ import { workspaceAdmin } from './workspaces.ts';
 // attachments are never shown here.
 
 export const PERIODS: [string, string][] = [['24', 'Last 24 hours'], ['48', 'Last 48 hours'], ['168', 'Last 7 days']];
+/** (sprint 152) the periods in the developer's language */
+const periods = (tx: ReturnType<typeof tr>): [string, string][] => PERIODS.map(([v]) => [v, tx(`mq.period.${v}` as 'mq.period.24')]);
 
 /** The mail a developer may see: every workspace (null) or one; false when none. */
 export async function queueScope(s: Session): Promise<{ admin: boolean; workspace: number | null } | false> {
@@ -27,8 +30,9 @@ export async function queueScope(s: Session): Promise<{ admin: boolean; workspac
 }
 
 async function refuse(s: Session, reply: FastifyReply) {
-  const main = html`<h1 class="u-mb1">Mail queue</h1><div class="alert alert-error" role="alert">Only administrators and workspace administrators see the mail queue.</div>`;
-  await send(reply.code(403), s, shell(s, 'Mail queue', [['Administration'], ['Mail queue']], main, 'users'));
+  const tx = tr(s);
+  const main = html`<h1 class="u-mb1">${tx('mq.title')}</h1><div class="alert alert-error" role="alert">${tx('mq.refused')}</div>`;
+  await send(reply.code(403), s, shell(s, tx('mq.title'), [[tx('rail.admin')], [tx('mq.title')]], main, 'users'));
 }
 
 const when = (d: Date | string | null) => (d ? new Date(d).toISOString().slice(0, 16).replace('T', ' ') : '');
@@ -42,6 +46,7 @@ export async function mailQueueRoutes(app: FastifyInstance) {
     if (!s) return;
     const scope = await queueScope(s);
     if (!scope) return refuse(s, reply);
+    const tx = tr(s);
     const hours = PERIODS.some(([v]) => v === req.query.period) ? Number(req.query.period) : 24;
     const ws = scope.admin ? id(req.query.ws) : scope.workspace;
     const appId = id(req.query.app);
@@ -94,10 +99,10 @@ export async function mailQueueRoutes(app: FastifyInstance) {
     ]);
     const wsName = ws ? (scope.admin ? workspaces.find((w) => w.id === ws)?.name : s.workspace?.name) : null;
     const filters = html`<form method="get" class="filter-row mail-queue-filters">
-        ${select('period', 'Period', String(hours), PERIODS)}
-        ${scope.admin ? select('ws', 'Workspace', ws ? String(ws) : '', [['', 'All workspaces'], ...workspaces.map((w): [string, string] => [String(w.id), w.name])]) : ''}
-        ${select('app', 'Application', appId ? String(appId) : '', [['', 'All applications'], ...apps.map((a): [string, string] => [String(a.id), a.alias])])}
-        <div class="buttons"><button class="btn">Show</button></div></form>`;
+        ${select('period', tx('mq.period'), String(hours), periods(tx))}
+        ${scope.admin ? select('ws', tx('mq.workspace'), ws ? String(ws) : '', [['', tx('mq.all_workspaces')], ...workspaces.map((w): [string, string] => [String(w.id), w.name])]) : ''}
+        ${select('app', tx('mq.app'), appId ? String(appId) : '', [['', tx('mq.all_apps')], ...apps.map((a): [string, string] => [String(a.id), a.alias])])}
+        <div class="buttons"><button class="btn">${tx('common.show')}</button></div></form>`;
     const total = totals.sent + totals.failed;
     const health = total ? Math.round((totals.sent / total) * 1000) / 10 : null;
     const stat = (n: unknown, label: string, cls = '') => html`<div class="stat${cls}"><b>${n ?? '–'}</b><span>${label}</span></div>`;
@@ -105,50 +110,50 @@ export async function mailQueueRoutes(app: FastifyInstance) {
     const action = (path: string, label: unknown, cls: string, confirm?: string) =>
       html`<form method="post" action="${BASE}/mail-queue${path}?${keep}" class="inline-form">${csrf(s)}<button class="btn btn-sm${cls}"${confirm ? html` data-confirm="${confirm}"` : ''}>${label}</button></form>`;
     const main = html`
-      <div class="title-row"><h1>Mail queue</h1></div>
-      <p class="muted u-mt0">Delivery of the mail ${wsName ? html`of workspace <b>${wsName}</b>` : 'of every workspace'}: what was queued, sent and failed, which mail is being retried, how long the providers took, and the failures with the provider's answer. Mail is kept 30 days.${scope.admin ? '' : ' You see your workspace\'s applications only.'}</p>
+      <div class="title-row"><h1>${tx('mq.title')}</h1></div>
+      <p class="muted u-mt0">${wsName ? tx.rich('mq.intro_ws', { workspace: html`<b>${wsName}</b>` }) : tx('mq.intro_all')}${scope.admin ? '' : ` ${tx('mq.only_yours')}`}</p>
       ${filters}
       <div class="stat-grid mail-queue-stats">
-        ${stat(totals.queued, 'queued now')}${stat(totals.retrying, 'retrying now')}${stat(totals.sending, 'being sent')}
-        ${stat(totals.sent, 'sent')}${stat(totals.failed, 'failed', totals.failed ? ' stat-bad' : '')}
-        ${stat(health === null ? null : `${health}%`, 'delivered')}${stat(totals.avg_ms === null ? null : `${totals.avg_ms} ms`, 'average provider call')}
+        ${stat(totals.queued, tx('mq.stat.queued'))}${stat(totals.retrying, tx('mq.stat.retrying'))}${stat(totals.sending, tx('mq.stat.sending'))}
+        ${stat(totals.sent, tx('mq.stat.sent'))}${stat(totals.failed, tx('mq.stat.failed'), totals.failed ? ' stat-bad' : '')}
+        ${stat(health === null ? null : `${health}%`, tx('mq.stat.delivered'))}${stat(totals.avg_ms === null ? null : `${totals.avg_ms} ms`, tx('mq.stat.avg'))}
       </div>
       <div class="columns">
-        ${region('Per hour', html`<div class="table-wrap"><table class="report report-reflow">
-          <thead><tr><th>Hour (UTC)</th><th class="num">Queued</th><th class="num">Sent</th><th class="num">Failed</th><th class="num">Retrying</th></tr></thead>
-          <tbody>${perHour.length ? perHour.map((h) => html`<tr><td data-label="Hour">${when(h.hour)}</td><td class="num" data-label="Queued">${h.queued}</td>
-              <td class="num" data-label="Sent">${h.sent}</td><td class="num" data-label="Failed">${h.failed ? html`<b>${h.failed}</b>` : 0}</td><td class="num" data-label="Retrying">${h.retrying}</td></tr>`)
-            : html`<tr><td colspan="5" class="empty">No mail in this period.</td></tr>`}</tbody></table></div>`)}
-        ${region('Slowest provider calls', html`<div class="table-wrap"><table class="report report-reflow">
-          <thead><tr><th>When (UTC)</th><th>Application</th><th>Service</th><th>Status</th><th class="num">Time</th></tr></thead>
-          <tbody>${slowest.length ? slowest.map((m) => html`<tr><td data-label="When">${when(m.last_attempt_at)}</td><td data-label="Application">${m.alias}</td>
-              <td data-label="Service" class="u-break">${m.service ?? ''}${m.provider ? html` <span class="muted">${m.provider}</span>` : ''}</td>
-              <td data-label="Status"><span class="tag${m.status === 'sent' ? ' tag-ok' : m.status === 'error' ? ' tag-error' : ''}">${m.status === 'queued' ? 'retrying' : m.status}</span></td>
-              <td class="num" data-label="Time">${m.duration_ms} ms</td></tr>`)
-            : html`<tr><td colspan="5" class="empty">No provider calls in this period.</td></tr>`}</tbody></table></div>`)}
+        ${region(tx('mq.per_hour'), html`<div class="table-wrap"><table class="report report-reflow">
+          <thead><tr><th>${tx('mq.col.hour')}</th><th class="num">${tx('mq.col.queued')}</th><th class="num">${tx('mq.col.sent')}</th><th class="num">${tx('mq.col.failed')}</th><th class="num">${tx('mq.col.retrying')}</th></tr></thead>
+          <tbody>${perHour.length ? perHour.map((h) => html`<tr><td data-label="${tx('mq.col.hour_short')}">${when(h.hour)}</td><td class="num" data-label="${tx('mq.col.queued')}">${h.queued}</td>
+              <td class="num" data-label="${tx('mq.col.sent')}">${h.sent}</td><td class="num" data-label="${tx('mq.col.failed')}">${h.failed ? html`<b>${h.failed}</b>` : 0}</td><td class="num" data-label="${tx('mq.col.retrying')}">${h.retrying}</td></tr>`)
+            : html`<tr><td colspan="5" class="empty">${tx('mq.none_period')}</td></tr>`}</tbody></table></div>`)}
+        ${region(tx('mq.slowest'), html`<div class="table-wrap"><table class="report report-reflow">
+          <thead><tr><th>${tx('mq.col.when')}</th><th>${tx('mq.app')}</th><th>${tx('mq.col.service')}</th><th>${tx('mq.col.status')}</th><th class="num">${tx('mq.col.time')}</th></tr></thead>
+          <tbody>${slowest.length ? slowest.map((m) => html`<tr><td data-label="${tx('mq.col.when_short')}">${when(m.last_attempt_at)}</td><td data-label="${tx('mq.app')}">${m.alias}</td>
+              <td data-label="${tx('mq.col.service')}" class="u-break">${m.service ?? ''}${m.provider ? html` <span class="muted">${m.provider}</span>` : ''}</td>
+              <td data-label="${tx('mq.col.status')}"><span class="tag${m.status === 'sent' ? ' tag-ok' : m.status === 'error' ? ' tag-error' : ''}">${m.status === 'queued' ? tx('mq.status.retrying') : ['sent', 'error', 'sending', 'cancelled'].includes(m.status) ? tx(`mq.status.${m.status}` as 'mq.status.sent') : m.status}</span></td>
+              <td class="num" data-label="${tx('mq.col.time')}">${m.duration_ms} ms</td></tr>`)
+            : html`<tr><td colspan="5" class="empty">${tx('mq.none_calls')}</td></tr>`}</tbody></table></div>`)}
       </div>
-      ${region('Per workspace and application', html`<div class="table-wrap"><table class="report report-reflow">
-        <thead><tr><th>Workspace</th><th>Application</th><th class="num">Sent</th><th class="num">Failed</th><th class="num">Retrying</th><th class="num">Queued</th><th class="num">Average</th><th class="num">Slowest</th></tr></thead>
-        <tbody>${usage.length ? usage.map((u) => html`<tr><td data-label="Workspace">${u.workspace}</td>
-            <td data-label="Application"><a href="${BASE}/mail-queue?${new URLSearchParams({ period: String(hours), ...(scope.admin && ws ? { ws: String(ws) } : {}), app: String(u.app_id) }).toString()}">${u.alias}</a></td>
-            <td class="num" data-label="Sent">${u.sent}</td><td class="num" data-label="Failed">${u.failed ? html`<b>${u.failed}</b>` : 0}</td>
-            <td class="num" data-label="Retrying">${u.retrying}</td><td class="num" data-label="Queued">${u.queued}</td>
-            <td class="num" data-label="Average">${u.avg_ms === null ? '–' : `${u.avg_ms} ms`}</td><td class="num" data-label="Slowest">${u.max_ms === null ? '–' : `${u.max_ms} ms`}</td></tr>`)
-          : html`<tr><td colspan="8" class="empty">No mail in this period.</td></tr>`}</tbody></table></div>`)}
-      ${region('Failures', html`<p class="muted u-mt0">Mail that will not be tried again: the provider refused it, or it failed ${5} times. <b>Retry</b> queues it again with fresh attempts; <b>Purge</b> deletes it.</p>
+      ${region(tx('mq.per_app'), html`<div class="table-wrap"><table class="report report-reflow">
+        <thead><tr><th>${tx('mq.workspace')}</th><th>${tx('mq.app')}</th><th class="num">${tx('mq.col.sent')}</th><th class="num">${tx('mq.col.failed')}</th><th class="num">${tx('mq.col.retrying')}</th><th class="num">${tx('mq.col.queued')}</th><th class="num">${tx('mq.col.average')}</th><th class="num">${tx('mq.col.slowest')}</th></tr></thead>
+        <tbody>${usage.length ? usage.map((u) => html`<tr><td data-label="${tx('mq.workspace')}">${u.workspace}</td>
+            <td data-label="${tx('mq.app')}"><a href="${BASE}/mail-queue?${new URLSearchParams({ period: String(hours), ...(scope.admin && ws ? { ws: String(ws) } : {}), app: String(u.app_id) }).toString()}">${u.alias}</a></td>
+            <td class="num" data-label="${tx('mq.col.sent')}">${u.sent}</td><td class="num" data-label="${tx('mq.col.failed')}">${u.failed ? html`<b>${u.failed}</b>` : 0}</td>
+            <td class="num" data-label="${tx('mq.col.retrying')}">${u.retrying}</td><td class="num" data-label="${tx('mq.col.queued')}">${u.queued}</td>
+            <td class="num" data-label="${tx('mq.col.average')}">${u.avg_ms === null ? '–' : `${u.avg_ms} ms`}</td><td class="num" data-label="${tx('mq.col.slowest')}">${u.max_ms === null ? '–' : `${u.max_ms} ms`}</td></tr>`)
+          : html`<tr><td colspan="8" class="empty">${tx('mq.none_period')}</td></tr>`}</tbody></table></div>`)}
+      ${region(tx('mq.failures'), html`<p class="muted u-mt0">${tx.rich('mq.failures_intro', { n: 5, retry: html`<b>${tx('mq.retry')}</b>`, purge: html`<b>${tx('mq.purge')}</b>` })}</p>
         <div class="table-wrap"><table class="report report-reflow mail-failures">
-        <thead><tr><th>Failed (UTC)</th><th>Application</th><th>To</th><th>Subject</th><th>Provider's answer</th><th>Actions</th></tr></thead>
+        <thead><tr><th>${tx('mq.col.failed_at')}</th><th>${tx('mq.app')}</th><th>${tx('mq.col.to')}</th><th>${tx('mq.col.subject')}</th><th>${tx('mq.col.answer')}</th><th>${tx('mq.col.actions')}</th></tr></thead>
         <tbody>${failures.length ? failures.map((m) => html`<tr>
-            <td data-label="Failed">${when(m.failed_at)}<br><span class="muted small">queued ${when(m.created_at)} · ${m.attempts} attempt${m.attempts === 1 ? '' : 's'}</span></td>
-            <td data-label="Application">${m.alias}${scope.admin && !ws ? html`<br><span class="muted small">${m.workspace}</span>` : ''}</td>
-            <td data-label="To" class="u-break">${[...m.to_addresses, ...m.cc_addresses].join(', ')}${m.bcc_addresses.length ? html` <span class="muted">+${m.bcc_addresses.length} bcc</span>` : ''}</td>
-            <td data-label="Subject" class="u-break">${m.subject}</td>
-            <td data-label="Provider's answer" class="u-break">${m.service ? html`<span class="muted small">${m.service}${m.provider ? ` (${m.provider})` : ''}</span><br>` : ''}<span class="mail-answer">${m.message ?? ''}</span></td>
-            <td data-label="Actions"><div class="buttons u-mt0">${action(`/${m.id}/retry`, 'Retry', '')}${action(`/${m.id}/purge`, 'Purge', ' btn-danger', 'Delete this mail?')}</div></td></tr>`)
-          : html`<tr><td colspan="6" class="empty">No failed mail.</td></tr>`}</tbody></table></div>
-        ${failures.length ? html`<div class="buttons">${action('/retry', html`${icon('refresh')} Retry all failed`, '')}${action('/purge', html`${icon('trash')} Purge all failed`, ' btn-danger', 'Delete every failed mail shown here?')}</div>` : ''}`,
+            <td data-label="${tx('mq.col.failed')}">${when(m.failed_at)}<br><span class="muted small">${tx('mq.queued_at', { when: when(m.created_at) })} · ${tx(m.attempts === 1 ? 'mq.attempts_one' : 'mq.attempts', { n: m.attempts })}</span></td>
+            <td data-label="${tx('mq.app')}">${m.alias}${scope.admin && !ws ? html`<br><span class="muted small">${m.workspace}</span>` : ''}</td>
+            <td data-label="${tx('mq.col.to')}" class="u-break">${[...m.to_addresses, ...m.cc_addresses].join(', ')}${m.bcc_addresses.length ? html` <span class="muted">+${m.bcc_addresses.length} bcc</span>` : ''}</td>
+            <td data-label="${tx('mq.col.subject')}" class="u-break">${m.subject}</td>
+            <td data-label="${tx('mq.col.answer')}" class="u-break">${m.service ? html`<span class="muted small">${m.service}${m.provider ? ` (${m.provider})` : ''}</span><br>` : ''}<span class="mail-answer">${m.message ?? ''}</span></td>
+            <td data-label="${tx('mq.col.actions')}"><div class="buttons u-mt0">${action(`/${m.id}/retry`, tx('mq.retry'), '')}${action(`/${m.id}/purge`, tx('mq.purge'), ' btn-danger', tx('mq.purge_confirm'))}</div></td></tr>`)
+          : html`<tr><td colspan="6" class="empty">${tx('mq.none_failed')}</td></tr>`}</tbody></table></div>
+        ${failures.length ? html`<div class="buttons">${action('/retry', html`${icon('refresh')} ${tx('mq.retry_all')}`, '')}${action('/purge', html`${icon('trash')} ${tx('mq.purge_all')}`, ' btn-danger', tx('mq.purge_all_confirm'))}</div>` : ''}`,
         '', 'failures')}`;
-    return send(reply, s, shell(s, 'Mail queue', [['Administration'], ['Mail queue']], main, 'users'));
+    return send(reply, s, shell(s, tx('mq.title'), [[tx('rail.admin')], [tx('mq.title')]], main, 'users'));
   });
 
   /** One mail's id when this developer may act on it (its application is in their scope). */
@@ -174,7 +179,7 @@ export async function mailQueueRoutes(app: FastifyInstance) {
     const r = await owner.query(`update meta.mail_queue set status = 'queued', attempts = 0, not_before = now(), message = null where id = $1 and status in ('error', 'cancelled')`, [m.id]);
     if (r.rowCount) await owner.query(`select pg_notify('pgkiln_mail', $1)`, [String(m.id)]);
     await logActivity({ appId: m.app_id, username: s.username, event: 'mail_queue', ip: clientIp(req), detail: `retry mail ${m.id}` });
-    flash(s, r.rowCount ? 'The mail is queued again.' : 'The mail has changed meanwhile.', r.rowCount ? 'ok' : 'error');
+    flash(s, r.rowCount ? tr(s)('mq.requeued') : tr(s)('mq.changed'), r.rowCount ? 'ok' : 'error');
     return back(reply, s, redirect(req));
   });
 
@@ -187,7 +192,7 @@ export async function mailQueueRoutes(app: FastifyInstance) {
     // mail that is waiting or being sent is cancelled on the application's Mail page, not purged
     const r = await owner.query(`delete from meta.mail_queue where id = $1 and status in ('error', 'cancelled', 'sent')`, [m.id]);
     await logActivity({ appId: m.app_id, username: s.username, event: 'mail_queue', ip: clientIp(req), detail: `purged mail ${m.id}` });
-    flash(s, r.rowCount ? 'The mail is deleted.' : 'Only sent, failed or cancelled mail can be purged.', r.rowCount ? 'ok' : 'error');
+    flash(s, r.rowCount ? tr(s)('mq.deleted') : tr(s)('mq.only_done'), r.rowCount ? 'ok' : 'error');
     return back(reply, s, redirect(req));
   });
 
@@ -206,7 +211,7 @@ export async function mailQueueRoutes(app: FastifyInstance) {
       if (what === 'retry' && r.rowCount) await owner.query(`select pg_notify('pgkiln_mail', '')`);
       await logActivity({ appId: appId, username: s.username, event: 'mail_queue', ip: clientIp(req),
         detail: `${what === 'retry' ? 'retried' : 'purged'} ${r.rowCount} failed mail(s)${ws ? ` of workspace ${ws}` : ''}${appId ? ` of application ${appId}` : ''}` });
-      flash(s, `${r.rowCount} mail${r.rowCount === 1 ? '' : 's'} ${what === 'retry' ? 'queued again' : 'deleted'}.`);
+      flash(s, tr(s)(what === 'retry' ? (r.rowCount === 1 ? 'mq.n_requeued_one' : 'mq.n_requeued') : (r.rowCount === 1 ? 'mq.n_deleted_one' : 'mq.n_deleted'), { n: r.rowCount ?? 0 }));
       return back(reply, s, redirect(req));
     });
 }

package/src/builder/network-access.ts

@@ -10,6 +10,7 @@ import { clearResponseCache } from '../websources.ts';
 import { isAdmin } from './locks.ts';
 import { back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
 import { workspaceAdmin } from './workspaces.ts';
+import { tr } from './i18n.ts';
 
 // (sprint 118, WS-9; APEX 26.2 workspace network ACLs) Administration →
 // Network access: the installation's allow-list (PGKILN_REST_ALLOWED_HOSTS,
@@ -31,12 +32,13 @@ async function manageable(s: Session, wanted: unknown): Promise<{ admin: boolean
 }
 
 async function refuse(s: Session, reply: FastifyReply) {
-  const main = html`<h1 class="u-mb1">Network access</h1><div class="alert alert-error" role="alert">Only administrators and workspace administrators manage network access.</div>`;
-  await send(reply.code(403), s, shell(s, 'Network access', [['Administration'], ['Network access']], main, 'users'));
+  const tx = tr(s);
+  const main = html`<h1 class="u-mb1">${tx('na.title')}</h1><div class="alert alert-error" role="alert">${tx('na.refused')}</div>`;
+  await send(reply.code(403), s, shell(s, tx('na.title'), [[tx('rail.admin')], [tx('na.title')]], main, 'users'));
 }
 
 const when = (d: Date | string | null) => (d ? new Date(d).toISOString().slice(0, 16).replace('T', ' ') : '');
-const entries = (list: string[]) => (list.length ? html`<ul class="host-list">${list.map((h) => html`<li><code>${h}</code></li>`)}</ul>` : html`<p class="muted">None.</p>`);
+const entries = (list: string[], none: string) => (list.length ? html`<ul class="host-list">${list.map((h) => html`<li><code>${h}</code></li>`)}</ul>` : html`<p class="muted">${none}</p>`);
 
 export async function networkAccessRoutes(app: FastifyInstance) {
   app.get(`${BASE}/network`, async (req: Req, reply) => {
@@ -44,6 +46,7 @@ export async function networkAccessRoutes(app: FastifyInstance) {
     if (!s) return;
     const m = await manageable(s, req.query.ws);
     if (!m) return refuse(s, reply);
+    const tx = tr(s);
     const w = await owner.one<{ id: number; name: string; network_restricted: boolean; network_hosts: string[] }>(
       'select id, name, network_restricted, network_hosts from meta.workspace where id = $1', [m.workspace]);
     if (!w) return reply.code(404).send('Not found');
@@ -93,60 +96,60 @@ export async function networkAccessRoutes(app: FastifyInstance) {
       try {
         url = new URL(tryUrl);
       } catch {
-        verdict = { ok: false, text: 'The URL is not valid.' };
+        verdict = { ok: false, text: tx('na.url_invalid') };
       }
       if (url) {
         const scope = await scopeForWorkspace(w.id, 'check');
         const problem = urlProblem(url) ?? scopeProblem(scope, url);
-        verdict = problem ? { ok: false, text: problem } : { ok: true, text: `${url.host} may be called by this workspace's applications (the address it resolves to is checked when the call is made).` };
+        verdict = problem ? { ok: false, text: problem } : { ok: true, text: tx('na.url_ok', { host: url.host }) };
       }
     }
     const main = html`
-      <div class="title-row"><h1>Network access</h1></div>
-      <p class="muted u-mt0">Which web services the applications may call: <code>meta.web_request</code>, REST data sources, the Invoke API process and workflow step, web credential token endpoints, object storage and REST source catalogs. The installation's list applies to every workspace; a workspace's own list can only narrow it, never widen it. Private and loopback addresses stay refused unless the installation allows them, whatever a workspace lists.</p>
+      <div class="title-row"><h1>${tx('na.title')}</h1></div>
+      <p class="muted u-mt0">${tx.rich('na.intro', { web_request: html`<code>meta.web_request</code>` })}</p>
       <div class="columns wide-left">
-        ${region(`Workspace ${w.name}`, html`<form method="post" action="${BASE}/network">${csrf(s)}<input type="hidden" name="ws" value="${w.id}">
-            <fieldset class="field"><legend class="label">Outgoing calls of this workspace's applications</legend><div class="radio-group">
-              <label class="check"><input type="radio" name="restricted" value="false"${w.network_restricted ? '' : raw(' checked')}> Any host the installation allows</label>
-              <label class="check"><input type="radio" name="restricted" value="true"${w.network_restricted ? raw(' checked') : ''}> Only the hosts below (and the installation must allow them too)</label>
+        ${region(tx('na.workspace', { name: w.name }), html`<form method="post" action="${BASE}/network">${csrf(s)}<input type="hidden" name="ws" value="${w.id}">
+            <fieldset class="field"><legend class="label">${tx('na.outgoing')}</legend><div class="radio-group">
+              <label class="check"><input type="radio" name="restricted" value="false"${w.network_restricted ? '' : raw(' checked')}> ${tx('na.any_host')}</label>
+              <label class="check"><input type="radio" name="restricted" value="true"${w.network_restricted ? raw(' checked') : ''}> ${tx('na.only_hosts')}</label>
             </div></fieldset>
-            <div class="field"><label class="label" for="f_hosts">Hosts</label>
+            <div class="field"><label class="label" for="f_hosts">${tx('na.hosts')}</label>
               <textarea id="f_hosts" name="hosts" rows="6" spellcheck="false">${w.network_hosts.join('\n')}</textarea>
-              <small class="help">One per line: <code>api.example.com</code>, <code>*.example.com</code> for its subdomains, <code>api.example.com:8443</code> for one port only. No scheme or path. Restricted with no hosts: no outgoing calls at all.</small></div>
-            ${unreachable.length ? html`<div class="alert alert-warning" role="status">Not on the installation's list, so never reachable: ${unreachable.join(', ')}.</div>` : ''}
-            ${w.network_hosts.some((h) => serversOf(h).length) ? html`<p class="muted small">Remote servers on these hosts: ${w.network_hosts.filter((h) => serversOf(h).length).map((h) => `${h} (${serversOf(h).join(', ')})`).join('; ')}.</p>` : ''}
-            <div class="buttons"><button class="btn btn-hot">Save</button></div></form>`, '', 'workspace-list')}
-        ${region('Installation', html`<p class="muted u-mt0">Set in the server's environment by its administrators (<code>PGKILN_REST_ALLOWED_HOSTS</code>).</p>
-            ${inst.allowed.includes('*') ? html`<p>Any public host (<code>*</code>).</p>` : entries(inst.allowed)}
-            ${m.admin ? html`<h3 class="u-mt1">Private hosts</h3><p class="muted small">Hosts on private or loopback addresses that may be called (<code>PGKILN_REST_PRIVATE_HOSTS</code>).</p>${entries(inst.private)}` : ''}`)}
+              <small class="help">${tx.rich('na.hosts_help', { a: html`<code>api.example.com</code>`, b: html`<code>*.example.com</code>`, c: html`<code>api.example.com:8443</code>` })}</small></div>
+            ${unreachable.length ? html`<div class="alert alert-warning" role="status">${tx('na.unreachable', { hosts: unreachable.join(', ') })}</div>` : ''}
+            ${w.network_hosts.some((h) => serversOf(h).length) ? html`<p class="muted small">${tx('na.servers_on_hosts', { list: w.network_hosts.filter((h) => serversOf(h).length).map((h) => `${h} (${serversOf(h).join(', ')})`).join('; ') })}</p>` : ''}
+            <div class="buttons"><button class="btn btn-hot">${tx('na.save')}</button></div></form>`, '', 'workspace-list')}
+        ${region(tx('na.installation'), html`<p class="muted u-mt0">${tx.rich('na.installation_note', { env: html`<code>PGKILN_REST_ALLOWED_HOSTS</code>` })}</p>
+            ${inst.allowed.includes('*') ? html`<p>${tx.rich('na.any_public', { star: html`<code>*</code>` })}</p>` : entries(inst.allowed, tx('na.none'))}
+            ${m.admin ? html`<h3 class="u-mt1">${tx('na.private')}</h3><p class="muted small">${tx.rich('na.private_note', { env: html`<code>PGKILN_REST_PRIVATE_HOSTS</code>` })}</p>${entries(inst.private, tx('na.none'))}` : ''}`)}
       </div>
-      ${region('Remote servers', html`<p class="muted u-mt0">The hosts this workspace's <a href="${BASE}/remote-servers">remote servers</a> stand for now: the REST data sources, catalogs and AI services on a server call this host.</p>
+      ${region(tx('na.servers'), html`<p class="muted u-mt0">${tx.rich('na.servers_intro', { link: html`<a href="${BASE}/remote-servers">${tx('na.servers_link')}</a>` })}</p>
         <div class="table-wrap"><table class="report report-reflow">
-        <thead><tr><th>Server</th><th>Host</th><th>From</th><th>Would be called</th></tr></thead>
-        <tbody>${servers.length ? servers.map((x) => html`<tr><td data-label="Server">${x.static_id}</td>
-            <td data-label="Host" class="u-break">${x.host ? html`<code>${x.host}</code>` : html`<span class="muted">none</span>`}</td>
-            <td data-label="From">${x.from === 'env' ? x.env_var : x.from === 'stored' ? 'base URL' : ''}</td>
-            <td data-label="Would be called">${x.problem ? html`<span class="tag tag-error">no</span> <span class="muted small">${x.problem}</span>` : html`<span class="tag tag-ok">yes</span>`}</td></tr>`)
-          : html`<tr><td colspan="4" class="empty">No remote servers.</td></tr>`}</tbody></table></div>`, '', 'servers')}
-      ${region('Check a URL', html`<form method="get" action="${BASE}/network" class="search u-mwnone">
+        <thead><tr><th>${tx('na.col.server')}</th><th>${tx('na.col.host')}</th><th>${tx('na.col.from')}</th><th>${tx('na.col.called')}</th></tr></thead>
+        <tbody>${servers.length ? servers.map((x) => html`<tr><td data-label="${tx('na.col.server')}">${x.static_id}</td>
+            <td data-label="${tx('na.col.host')}" class="u-break">${x.host ? html`<code>${x.host}</code>` : html`<span class="muted">${tx('na.host_none')}</span>`}</td>
+            <td data-label="${tx('na.col.from')}">${x.from === 'env' ? x.env_var : x.from === 'stored' ? tx('na.base_url') : ''}</td>
+            <td data-label="${tx('na.col.called')}">${x.problem ? html`<span class="tag tag-error">${tx('na.no')}</span> <span class="muted small">${x.problem}</span>` : html`<span class="tag tag-ok">${tx('na.yes')}</span>`}</td></tr>`)
+          : html`<tr><td colspan="4" class="empty">${tx('na.no_servers')}</td></tr>`}</tbody></table></div>`, '', 'servers')}
+      ${region(tx('na.check'), html`<form method="get" action="${BASE}/network" class="search u-mwnone">
           <input type="hidden" name="ws" value="${w.id}">
-          ${input('url', 'URL', tryUrl, { type: 'url', placeholder: 'https://api.example.com/v1/items' })}
-          <div class="buttons"><button class="btn">${icon('search')} Check</button></div></form>
+          ${input('url', tx('na.url'), tryUrl, { type: 'url', placeholder: 'https://api.example.com/v1/items' })}
+          <div class="buttons"><button class="btn">${icon('search')} ${tx('na.check_btn')}</button></div></form>
         <div role="status">${verdict ? html`<div class="alert ${verdict.ok ? 'alert-success' : 'alert-error'}">${verdict.text}</div>` : ''}</div>
-        <p class="muted small">Nothing is called: this applies the lists to the URL as they are now.</p>`)}
-      ${m.admin ? region('Workspaces', html`<div class="table-wrap"><table class="report report-reflow">
-          <thead><tr><th>Workspace</th><th>Outgoing calls</th></tr></thead>
-          <tbody>${all.map((x) => html`<tr><td data-label="Workspace"><a href="${BASE}/network?ws=${x.id}">${x.name}</a></td>
-            <td data-label="Outgoing calls">${x.network_restricted ? html`<span class="tag">${icon('lock')} ${x.n} host${x.n === 1 ? '' : 's'}</span>` : html`<span class="muted">the installation's list</span>`}</td></tr>`)}</tbody></table></div>`) : ''}
-      ${region('Refused calls', html`<p class="muted u-mt0">The last 100 calls of this workspace that a list refused (kept 7 days). The application's debug log has them too.</p>
+        <p class="muted small">${tx('na.check_note')}</p>`)}
+      ${m.admin ? region(tx('na.workspaces'), html`<div class="table-wrap"><table class="report report-reflow">
+          <thead><tr><th>${tx('na.col.workspace')}</th><th>${tx('na.col.outgoing')}</th></tr></thead>
+          <tbody>${all.map((x) => html`<tr><td data-label="${tx('na.col.workspace')}"><a href="${BASE}/network?ws=${x.id}">${x.name}</a></td>
+            <td data-label="${tx('na.col.outgoing')}">${x.network_restricted ? html`<span class="tag">${icon('lock')} ${tx(x.n === 1 ? 'na.n_hosts_one' : 'na.n_hosts', { n: x.n })}</span>` : html`<span class="muted">${tx('na.inst_list')}</span>`}</td></tr>`)}</tbody></table></div>`) : ''}
+      ${region(tx('na.refusals'), html`<p class="muted u-mt0">${tx('na.refusals_intro')}</p>
         <div class="table-wrap"><table class="report report-reflow">
-        <thead><tr><th>When (UTC)</th><th>Application</th><th>Call</th><th>Host</th><th>Refused by</th></tr></thead>
-        <tbody>${refusals.length ? refusals.map((r) => html`<tr><td data-label="When">${when(r.at)}</td><td data-label="Application">${r.alias ?? html`<span class="muted">–</span>`}</td>
-            <td data-label="Call" class="u-break">${r.what}<br><span class="muted small">${r.url ?? ''}</span></td>
-            <td data-label="Host" class="u-break"><code>${r.host}</code></td>
-            <td data-label="Refused by">${r.list === 'workspace' ? 'the workspace\'s list' : 'the installation\'s list'}</td></tr>`)
-          : html`<tr><td colspan="5" class="empty">No refused calls.</td></tr>`}</tbody></table></div>`, '', 'refusals')}`;
-    return send(reply, s, shell(s, 'Network access', [['Administration'], ['Network access']], main, 'users'));
+        <thead><tr><th>${tx('na.col.when')}</th><th>${tx('na.col.app')}</th><th>${tx('na.col.call')}</th><th>${tx('na.col.host')}</th><th>${tx('na.col.refused_by')}</th></tr></thead>
+        <tbody>${refusals.length ? refusals.map((r) => html`<tr><td data-label="${tx('na.col.when_short')}">${when(r.at)}</td><td data-label="${tx('na.col.app')}">${r.alias ?? html`<span class="muted">–</span>`}</td>
+            <td data-label="${tx('na.col.call')}" class="u-break">${r.what}<br><span class="muted small">${r.url ?? ''}</span></td>
+            <td data-label="${tx('na.col.host')}" class="u-break"><code>${r.host}</code></td>
+            <td data-label="${tx('na.col.refused_by')}">${r.list === 'workspace' ? tx('na.ws_list') : tx('na.inst_list')}</td></tr>`)
+          : html`<tr><td colspan="5" class="empty">${tx('na.no_refusals')}</td></tr>`}</tbody></table></div>`, '', 'refusals')}`;
+    return send(reply, s, shell(s, tx('na.title'), [[tx('rail.admin')], [tx('na.title')]], main, 'users'));
   });
 
   app.post(`${BASE}/network`, async (req: Req, reply) => {
@@ -164,7 +167,7 @@ export async function networkAccessRoutes(app: FastifyInstance) {
       clearResponseCache();
       await logActivity({ appId: null, username: s.username, event: 'workspace', ip: clientIp(req),
         detail: `network access of workspace ${m.workspace}: ${restricted ? `only ${hosts.join(', ') || 'no hosts'}` : 'the installation\'s list'}`.slice(0, 1000) });
-      flash(s, restricted ? `Saved: this workspace's applications call ${hosts.length ? 'only these hosts' : 'no hosts at all'}.` : 'Saved: the installation\'s list applies.');
+      flash(s, tr(s)(restricted ? (hosts.length ? 'na.saved_only' : 'na.saved_none') : 'na.saved_inst'));
     } catch (e) {
       flash(s, (e as Error).message, 'error');
     }

package/src/builder/region-help.ts

@@ -7,6 +7,7 @@
 const GUIDE = 'https://pgkiln.vargar.eu/docs';
 
 export const REGION_CONFIG_HELP: [string[], string][] = [
+  [['workflow_diagram'], '{"instance_item": "P9_WORKFLOW_ID"}: the item holding the workflow instance to draw (only instances the user started or administers; sprint 160)'],
   [['report'], '{"page_size":15,"pagination":"range" (rows X–Y without a total),"keyset":["id"] (with range: Next/Previous seek on these unique columns),"max_rows":10000,"searchable":true,"sortable":true,"interactive":true,"mobile":"reflow"|"scroll","hidden":["col"],"headings":{"col":"Label"},"link":{"column":"id","page":3,"items":{"P3_ID":"#id#"}},"empty":"No rows","pdf":{"layout":"NAME","columns":["col"],"widths":{"col":40},"align":{"col":"right"}}} (pdf widths in mm; layouts under Shared Components → Report layouts)'],
   [['report', 'classic_report', 'grid', 'cards'], '{"formats":{"sal":"FML999G990D00","hiredate":"DD-MON-YYYY"}} (number or date format masks per column)'],
   [['chart'], '{"kind":"bar"|"column"|"line"|"area"|"donut","max_rows":1000,"format_mask":"FML999G990"}'],
@@ -59,6 +60,7 @@ const ANCHORS: Record<string, string> = {
   plugin: 'plug-ins-with-their-own-code',
   tasks: 'approvals-and-the-task-list',
   workflows: 'workflows',
+  workflow_diagram: 'workflow-diagram-region',
   login: 'the-login-page',
   classic_report: 'classic_report-classic-report',
   breadcrumb: 'breadcrumb-and-help_text',
@@ -73,7 +75,7 @@ export function regionConfigHelp(type: string | null | undefined): { text: strin
   if (!type) return { text: ALL_REGION_CONFIG_HELP, url: null };
   const own = REGION_CONFIG_HELP.filter(([types]) => types.includes(type)).map(([, text]) => text);
   const any = REGION_CONFIG_HELP.filter(([types]) => types.includes('*')).map(([, text]) => `any region: ${text}`);
-  const chapter = type === 'tasks' || type === 'workflows' ? 'processing' : type === 'login' ? 'security' : 'pages-and-regions';
+  const chapter = type === 'tasks' || type === 'workflows' || type === 'workflow_diagram' ? 'processing' : type === 'login' ? 'security' : 'pages-and-regions';
   return {
     text: [...own, ...any].join(' · ') || 'No attributes of its own.',
     url: ANCHORS[type] ? `${GUIDE}/${chapter}#${ANCHORS[type]}` : null,