pgkiln 0.80.0 → 0.82.0

package/src/builder/db-users.ts

@@ -8,6 +8,7 @@ import {
   type DefaultPriv, type ExistingPriv, type RoleContext, type RoleSpec, type SchemaGrant,
 } from '../dbroles.ts';
 import { administrator, back, BASE, csrf, flash, region, send, shell, type Body, type Req } from './ui.ts';
+import { tr, type BuilderTranslate } from './i18n.ts';
 
 // (sprint 99, Database Actions DA-13) Administration → Database Users: the PostgreSQL roles of this cluster with
 // their sign-in, attributes, expiry, memberships and what they own; create, change and drop roles. Administrators
@@ -158,50 +159,51 @@ const sel = (on: boolean) => (on ? raw(' selected') : '');
 const errorList = (errors: string[]) =>
   errors.length ? html`<div class="alert alert-error" role="alert"><ul class="u-m0">${errors.map((e) => html`<li>${e}</li>`)}</ul></div>` : '';
 
-const DEFAULT_LABELS: [DefaultPriv, string][] = [['none', 'None'], ['read', 'Read (SELECT)'], ['write', 'Read and write']];
-const EXISTING_LABELS: [ExistingPriv, string][] = [['', 'No change'], ['read', 'Grant read'], ['write', 'Grant read and write'], ['revoke', 'Revoke all']];
+const DEFAULT_LABELS = (tx: BuilderTranslate): [DefaultPriv, string][] => [['none', tx('dbu.priv.none')], ['read', tx('dbu.priv.read')], ['write', tx('dbu.priv.write')]];
+const EXISTING_LABELS = (tx: BuilderTranslate): [ExistingPriv, string][] => [['', tx('dbu.existing.none')], ['read', tx('dbu.existing.read')], ['write', tx('dbu.existing.write')], ['revoke', tx('dbu.existing.revoke')]];
 
 /** The create / edit form. */
 function roleForm(s: Session, spec: RoleSpec, o: { isNew: boolean; before: RoleSpec | null; grantable: string[]; errors: string[] }) {
+  const tx = tr(s);
   const options = [...new Set([...o.grantable, ...(o.before?.memberOf ?? []), ...spec.memberOf])];
-  const pwModes: [string, string][] = o.isNew ? [['keep', 'No password'], ['set', 'Set a password']] : [['keep', 'Keep the password'], ['set', 'Set a new password'], ['remove', 'Remove the password']];
+  const pwModes: [string, string][] = o.isNew ? [['keep', tx('dbu.pw.none')], ['set', tx('dbu.pw.set')]] : [['keep', tx('dbu.pw.keep')], ['set', tx('dbu.pw.new')], ['remove', tx('dbu.pw.remove')]];
   return html`${errorList(o.errors)}
     <form method="post" action="${URL_BASE}/save" class="dbu-form">${csrf(s)}
       <input type="hidden" name="original" value="${o.isNew ? '' : spec.name}">
-      ${region('Role', html`<div class="form-grid">
-        ${o.isNew ? html`<div class="field"><label class="label" for="f_name">Name</label>
+      ${region(tx('dbu.role'), html`<div class="form-grid">
+        ${o.isNew ? html`<div class="field"><label class="label" for="f_name">${tx('dbu.name')}</label>
           <input id="f_name" name="name" value="${spec.name}" required maxlength="63" pattern="[A-Za-z_][A-Za-z0-9_$]*" autocomplete="off" spellcheck="false">
-          <small class="help">Letters, digits, _ and $; names starting with pg_ or pgkiln are reserved.</small></div>` : ''}
-        <div class="field"><span class="label">Sign in</span><label class="check"><input type="checkbox" name="login" value="1"${chk(spec.login)}> Can sign in (LOGIN)</label>
-          <small class="help">A role without it is a group role: others get its privileges by being members.</small></div>
-        <fieldset class="field"><legend class="label">Password</legend><div class="radio-group">
+          <small class="help">${tx('dbu.name_help')}</small></div>` : ''}
+        <div class="field"><span class="label">${tx('dbu.sign_in')}</span><label class="check"><input type="checkbox" name="login" value="1"${chk(spec.login)}> ${tx('dbu.can_login')}</label>
+          <small class="help">${tx('dbu.can_login_help')}</small></div>
+        <fieldset class="field"><legend class="label">${tx('dbu.password')}</legend><div class="radio-group">
           ${pwModes.map(([v, l]) => html`<label class="check"><input type="radio" name="password_mode" value="${v}"${chk(spec.password === v)}> ${l}</label>`)}
-          </div><small class="help">You type the password on the next step, after reviewing the SQL. It is stored as a SCRAM-SHA-256 verifier and never shown.</small></fieldset>
-        <div class="field"><label class="label" for="f_valid_until">Valid until</label>
+          </div><small class="help">${tx('dbu.password_help')}</small></fieldset>
+        <div class="field"><label class="label" for="f_valid_until">${tx('dbu.valid_until')}</label>
           <input id="f_valid_until" name="valid_until" type="date" value="${spec.validUntil}">
-          <small class="help">The password stops working after this date (VALID UNTIL). Empty: it doesn't expire.</small></div>
-        <div class="field"><label class="label" for="f_conn_limit">Connection limit</label>
+          <small class="help">${tx('dbu.valid_until_help')}</small></div>
+        <div class="field"><label class="label" for="f_conn_limit">${tx('dbu.conn_limit')}</label>
           <input id="f_conn_limit" name="conn_limit" type="number" min="-1" max="100000" step="1" value="${Number.isFinite(spec.connLimit) && spec.connLimit >= 0 ? String(spec.connLimit) : ''}">
-          <small class="help">Empty: no limit.</small></div>
-        <div class="field"><label class="label" for="f_search_path">Default schema (search path)</label>
+          <small class="help">${tx('dbu.conn_limit_help')}</small></div>
+        <div class="field"><label class="label" for="f_search_path">${tx('dbu.search_path')}</label>
           <input id="f_search_path" name="search_path" value="${spec.searchPath}" placeholder="sales, public" spellcheck="false" autocomplete="off">
-          <small class="help">Schemas, comma separated, for this role's sessions in this database. Empty: the server's default.</small></div>
-        <div class="field"><label class="label" for="f_comment">Comment</label>
+          <small class="help">${tx('dbu.search_path_help')}</small></div>
+        <div class="field"><label class="label" for="f_comment">${tx('dbu.comment')}</label>
           <input id="f_comment" name="comment" value="${spec.comment}" maxlength="1000"></div>
       </div>`)}
-      ${region('Member of', html`<p class="muted u-mt0">The role gets the privileges of the roles it is a member of. pgkiln's own roles, superusers, login roles and the predefined roles that reach the server's files can't be granted here.</p>
-        ${options.length ? html`<fieldset class="field"><legend class="sr-only">Member of</legend><div class="radio-group dbu-members">
+      ${region(tx('dbu.member_of'), html`<p class="muted u-mt0">${tx('dbu.member_of_intro')}</p>
+        ${options.length ? html`<fieldset class="field"><legend class="sr-only">${tx('dbu.member_of')}</legend><div class="radio-group dbu-members">
           ${options.map((m) => html`<label class="check"><input type="checkbox" name="member" value="${m}"${chk(spec.memberOf.includes(m))}> ${m}</label>`)}
-        </div></fieldset>` : html`<p class="muted">There are no group roles to grant.</p>`}`)}
-      ${region('Schemas', html`<p class="muted u-mt0"><strong>Usage</strong> lets the role use a schema's objects (as far as their own privileges allow), <strong>Create</strong> make objects in it. <strong>Future tables</strong> are default privileges on the tables (and, for writing, sequences) pgkiln's owner connection creates there from now on; <strong>Existing tables</strong> grants or revokes once on the tables there now. pgkiln's own schemas aren't listed.</p>
-        ${spec.schemas.length ? html`<div class="table-wrap"><table class="report dbu-schemas"><thead><tr><th>Schema</th><th class="te-c">Usage</th><th class="te-c">Create</th><th>Future tables</th><th>Existing tables</th></tr></thead>
+        </div></fieldset>` : html`<p class="muted">${tx('dbu.no_groups')}</p>`}`)}
+      ${region(tx('dbu.schemas'), html`<p class="muted u-mt0">${tx.rich('dbu.schemas_intro', { usage: html`<strong>${tx('dbu.col.usage')}</strong>`, create: html`<strong>${tx('dbu.col.create')}</strong>`, future: html`<strong>${tx('dbu.col.future')}</strong>`, existing: html`<strong>${tx('dbu.col.existing')}</strong>` })}</p>
+        ${spec.schemas.length ? html`<div class="table-wrap"><table class="report dbu-schemas"><thead><tr><th>${tx('dbu.col.schema')}</th><th class="te-c">${tx('dbu.col.usage')}</th><th class="te-c">${tx('dbu.col.create')}</th><th>${tx('dbu.col.future')}</th><th>${tx('dbu.col.existing')}</th></tr></thead>
         <tbody>${spec.schemas.map((x, i) => html`<tr><td><code>${x.schema}</code><input type="hidden" name="s.${i}.name" value="${x.schema}"></td>
-          <td class="te-c"><input type="checkbox" name="s.${i}.usage" value="1" aria-label="Usage on ${x.schema}"${chk(x.usage)}></td>
-          <td class="te-c"><input type="checkbox" name="s.${i}.create" value="1" aria-label="Create in ${x.schema}"${chk(x.create)}></td>
-          <td><select name="s.${i}.defaults" aria-label="Future tables in ${x.schema}">${x.defaults === 'custom' ? html`<option value="custom" selected>As they are (custom)</option>` : ''}${DEFAULT_LABELS.map(([v, l]) => html`<option value="${v}"${sel(x.defaults === v)}>${l}</option>`)}</select></td>
-          <td><select name="s.${i}.existing" aria-label="Existing tables in ${x.schema}">${EXISTING_LABELS.map(([v, l]) => html`<option value="${v}"${sel((x.existing ?? '') === v)}>${l}</option>`)}</select></td></tr>`)}
-        </tbody></table></div>` : html`<p class="muted">No schemas.</p>`}`)}
-      <div class="buttons"><button class="btn btn-hot" name="mode" value="review">${icon('eye')} Review SQL</button><a class="btn" href="${URL_BASE}">Cancel</a></div>
+          <td class="te-c"><input type="checkbox" name="s.${i}.usage" value="1" aria-label="${tx('dbu.usage_on', { schema: x.schema })}"${chk(x.usage)}></td>
+          <td class="te-c"><input type="checkbox" name="s.${i}.create" value="1" aria-label="${tx('dbu.create_in', { schema: x.schema })}"${chk(x.create)}></td>
+          <td><select name="s.${i}.defaults" aria-label="${tx('dbu.future_in', { schema: x.schema })}">${x.defaults === 'custom' ? html`<option value="custom" selected>${tx('dbu.custom')}</option>` : ''}${DEFAULT_LABELS(tx).map(([v, l]) => html`<option value="${v}"${sel(x.defaults === v)}>${l}</option>`)}</select></td>
+          <td><select name="s.${i}.existing" aria-label="${tx('dbu.existing_in', { schema: x.schema })}">${EXISTING_LABELS(tx).map(([v, l]) => html`<option value="${v}"${sel((x.existing ?? '') === v)}>${l}</option>`)}</select></td></tr>`)}
+        </tbody></table></div>` : html`<p class="muted">${tx('dbu.no_schemas')}</p>`}`)}
+      <div class="buttons"><button class="btn btn-hot" name="mode" value="review">${icon('eye')} ${tx('dbu.review')}</button><a class="btn" href="${URL_BASE}">${tx('dbu.cancel')}</a></div>
     </form>`;
 }
 
@@ -220,64 +222,66 @@ const hiddenSpec = (spec: RoleSpec, isNew: boolean) => html`
 
 /** The review step: the SQL (the password masked), the password fields when one is set, Apply. */
 function reviewForm(s: Session, spec: RoleSpec, stmts: string[], o: { isNew: boolean; errors: string[]; output?: Raw | '' }) {
+  const tx = tr(s);
   return html`${errorList(o.errors)}${o.output ?? ''}
-    ${region('SQL', stmts.length
-      ? html`<p class="muted u-mt0">These statements run in one transaction when you apply them: all of them, or none.${spec.password === 'set' ? ' The password shows as \'********\': pgkiln sends PostgreSQL only its SCRAM-SHA-256 verifier.' : ''}</p>
-        <pre class="source dbu-sql" data-code-view="sql" tabindex="0" aria-label="Generated SQL">${maskSql(stmts)}</pre>`
-      : html`<p class="muted u-mt0">Nothing to change: the role is as the form says.</p>`)}
+    ${region(tx('dbu.sql'), stmts.length
+      ? html`<p class="muted u-mt0">${tx('dbu.sql_intro')}${spec.password === 'set' ? ` ${tx('dbu.sql_masked')}` : ''}</p>
+        <pre class="source dbu-sql" data-code-view="sql" tabindex="0" aria-label="${tx('dbu.generated_sql')}">${maskSql(stmts)}</pre>`
+      : html`<p class="muted u-mt0">${tx('dbu.nothing_sql')}</p>`)}
     <form method="post" action="${URL_BASE}/save" class="dbu-form">${csrf(s)}${hiddenSpec(spec, o.isNew)}
       <input type="hidden" name="reviewed" value="${reviewDigest(stmts)}">
-      ${spec.password === 'set' ? region('Password', html`<div class="form-grid">
-        <div class="field"><label class="label" for="f_password">Password</label><input id="f_password" name="password" type="password" autocomplete="new-password" minlength="8" maxlength="1024" required></div>
-        <div class="field"><label class="label" for="f_confirm">Confirm password</label><input id="f_confirm" name="confirm" type="password" autocomplete="new-password" minlength="8" maxlength="1024" required></div>
-      </div><small class="help">At least 8 characters. It is hashed by pgkiln before it reaches the database, and it is not kept.</small>`) : ''}
-      <div class="buttons">${stmts.length ? html`<button class="btn btn-hot" name="mode" value="apply">${icon('check')} Apply</button>` : ''}
-        <button class="btn" name="mode" value="edit" formnovalidate>Back to the form</button></div>
+      ${spec.password === 'set' ? region(tx('dbu.password'), html`<div class="form-grid">
+        <div class="field"><label class="label" for="f_password">${tx('dbu.password')}</label><input id="f_password" name="password" type="password" autocomplete="new-password" minlength="8" maxlength="1024" required></div>
+        <div class="field"><label class="label" for="f_confirm">${tx('dbu.confirm_password')}</label><input id="f_confirm" name="confirm" type="password" autocomplete="new-password" minlength="8" maxlength="1024" required></div>
+      </div><small class="help">${tx('dbu.password_note')}</small>`) : ''}
+      <div class="buttons">${stmts.length ? html`<button class="btn btn-hot" name="mode" value="apply">${icon('check')} ${tx('dbu.apply')}</button>` : ''}
+        <button class="btn" name="mode" value="edit" formnovalidate>${tx('dbu.back_form')}</button></div>
     </form>`;
 }
 
 /** A role's attributes as tags. */
-const attrTags = (r: RoleRow) => html`${r.pgkiln ? html`<span class="tag tag-info">pgkiln</span> ` : ''}${r.used_by.length ? html`<span class="tag" title="${r.used_by.join(', ')}">in use</span> ` : ''}${
-  r.superuser ? html`<span class="tag tag-error">superuser</span> ` : ''}${r.bypassrls ? html`<span class="tag tag-warning">bypass RLS</span> ` : ''}${
-  r.createrole ? html`<span class="tag tag-warning">create role</span> ` : ''}${r.createdb ? html`<span class="tag">create DB</span> ` : ''}${r.replication ? html`<span class="tag">replication</span>` : ''}`;
+const attrTags = (tx: BuilderTranslate, r: RoleRow) => html`${r.pgkiln ? html`<span class="tag tag-info">pgkiln</span> ` : ''}${r.used_by.length ? html`<span class="tag" title="${r.used_by.join(', ')}">${tx('dbu.tag.in_use')}</span> ` : ''}${
+  r.superuser ? html`<span class="tag tag-error">${tx('dbu.tag.superuser')}</span> ` : ''}${r.bypassrls ? html`<span class="tag tag-warning">${tx('dbu.tag.bypassrls')}</span> ` : ''}${
+  r.createrole ? html`<span class="tag tag-warning">${tx('dbu.tag.createrole')}</span> ` : ''}${r.createdb ? html`<span class="tag">${tx('dbu.tag.createdb')}</span> ` : ''}${r.replication ? html`<span class="tag">${tx('dbu.tag.replication')}</span>` : ''}`;
 
-const expiry = (r: RoleRow) => r.valid_until === null ? html`<span class="muted">never</span>` : html`${r.valid_until}${
-  r.days_left !== null && r.days_left < 0 ? html` <span class="tag tag-error">expired</span>` : r.days_left !== null && r.days_left <= 30 ? html` <span class="tag tag-warning">in ${String(r.days_left)} day${r.days_left === 1 ? '' : 's'}</span>` : ''}`;
+const expiry = (tx: BuilderTranslate, r: RoleRow) => r.valid_until === null ? html`<span class="muted">${tx('dbu.never')}</span>` : html`${r.valid_until}${
+  r.days_left !== null && r.days_left < 0 ? html` <span class="tag tag-error">${tx('dbu.expired')}</span>` : r.days_left !== null && r.days_left <= 30 ? html` <span class="tag tag-warning">${tx(r.days_left === 1 ? 'dbu.in_days_one' : 'dbu.in_days', { n: r.days_left })}</span>` : ''}`;
 
-const FILTERS: [string, string, (r: RoleRow) => boolean][] = [
-  ['', 'All roles', () => true],
-  ['login', 'Can sign in', (r) => r.login],
-  ['expiring', 'Password expires within 30 days', (r) => r.login && r.days_left !== null && r.days_left >= 0 && r.days_left <= 30],
-  ['bypassrls', 'Bypass row level security', (r) => r.bypassrls],
-  ['owners', 'No sign-in, but own objects', (r) => !r.login && r.owned > 0],
-  ['pgkiln', 'pgkiln\'s own', (r) => r.pgkiln],
-];
+const FILTERS: [string, 'dbu.f.all', (r: RoleRow) => boolean][] = ([
+  ['', 'dbu.f.all', () => true],
+  ['login', 'dbu.f.login', (r) => r.login],
+  ['expiring', 'dbu.f.expiring', (r) => r.login && r.days_left !== null && r.days_left >= 0 && r.days_left <= 30],
+  ['bypassrls', 'dbu.f.bypassrls', (r) => r.bypassrls],
+  ['owners', 'dbu.f.owners', (r) => !r.login && r.owned > 0],
+  ['pgkiln', 'dbu.f.pgkiln', (r) => r.pgkiln],
+] as [string, string, (r: RoleRow) => boolean][]) as [string, 'dbu.f.all', (r: RoleRow) => boolean][];
 
 async function listPage(req: Req, reply: FastifyReply, s: Session) {
   const roles = await listRoles();
   const f = FILTERS.find(([k]) => k === (req.query.f ?? '')) ?? FILTERS[0];
   const q = String(req.query.q ?? '').trim().toLowerCase().slice(0, 100);
   const shown = roles.filter((r) => f[2](r) && (!q || r.name.toLowerCase().includes(q)));
-  const main = html`<div class="ide-head-title u-mb1"><div><h1>${TITLE}</h1><span class="muted small">The PostgreSQL roles of this server (pg_roles), without the predefined pg_ roles.</span></div>
-      <div class="buttons ide-head-actions"><a class="btn btn-hot" href="${URL_BASE}/new">${icon('plus')} Create database user</a></div></div>
-    <nav class="stat-grid u-mb1 dbu-stats" aria-label="Filters">${FILTERS.map(([k, label, fn]) => html`<a class="stat" href="${URL_BASE}${k ? `?f=${k}` : ''}"${k === f[0] ? raw(' aria-current="page"') : ''}><b>${String(roles.filter(fn).length)}</b><span>${label}</span></a>`)}</nav>
-    ${region(f[1], html`<form method="get" action="${URL_BASE}" class="dbu-search u-mb1" role="search">${f[0] ? html`<input type="hidden" name="f" value="${f[0]}">` : ''}
-        <label class="sr-only" for="dbu-q">Search roles</label><input id="dbu-q" name="q" type="search" value="${q}" placeholder="Search roles" autocomplete="off"> <button class="btn btn-sm">${icon('search')} Search</button></form>
-      <div class="table-wrap"><table class="report report-reflow dbu-list"><thead><tr><th>Role</th><th>Sign in</th><th>Attributes</th><th class="num">Connections</th><th>Valid until</th><th>Member of</th><th>Owns</th></tr></thead>
+  const tx = tr(s);
+  const main = html`<div class="ide-head-title u-mb1"><div><h1>${tx('dbu.title')}</h1><span class="muted small">${tx('dbu.list_intro')}</span></div>
+      <div class="buttons ide-head-actions"><a class="btn btn-hot" href="${URL_BASE}/new">${icon('plus')} ${tx('dbu.create_user')}</a></div></div>
+    <nav class="stat-grid u-mb1 dbu-stats" aria-label="${tx('dbu.filters')}">${FILTERS.map(([k, label, fn]) => html`<a class="stat" href="${URL_BASE}${k ? `?f=${k}` : ''}"${k === f[0] ? raw(' aria-current="page"') : ''}><b>${String(roles.filter(fn).length)}</b><span>${tx(label)}</span></a>`)}</nav>
+    ${region(tx(f[1]), html`<form method="get" action="${URL_BASE}" class="dbu-search u-mb1" role="search">${f[0] ? html`<input type="hidden" name="f" value="${f[0]}">` : ''}
+        <label class="sr-only" for="dbu-q">${tx('dbu.search_roles')}</label><input id="dbu-q" name="q" type="search" value="${q}" placeholder="${tx('dbu.search_roles')}" autocomplete="off"> <button class="btn btn-sm">${icon('search')} ${tx('dbu.search')}</button></form>
+      <div class="table-wrap"><table class="report report-reflow dbu-list"><thead><tr><th>${tx('dbu.role')}</th><th>${tx('dbu.sign_in')}</th><th>${tx('dbu.col.attributes')}</th><th class="num">${tx('dbu.col.connections')}</th><th>${tx('dbu.valid_until')}</th><th>${tx('dbu.member_of')}</th><th>${tx('dbu.col.owns')}</th></tr></thead>
       <tbody>${shown.length ? shown.map((r) => html`<tr>
-        <td data-label="Role" class="u-break"><a href="${roleUrl(r.name)}"><strong>${r.name}</strong></a>${r.comment ? html`<br><span class="muted small">${r.comment}</span>` : ''}</td>
-        <td data-label="Sign in">${r.login ? 'Yes' : html`<span class="muted">No</span>`}</td>
-        <td data-label="Attributes">${attrTags(r)}</td>
-        <td data-label="Connections" class="num">${r.conn_limit < 0 ? html`<span class="muted">no limit</span>` : String(r.conn_limit)}</td>
-        <td data-label="Valid until">${expiry(r)}</td>
-        <td data-label="Member of" class="u-break">${r.member_of.join(', ')}</td>
-        <td data-label="Owns" class="u-break">${r.schemas.length ? html`schemas ${r.schemas.join(', ')}; ` : ''}${r.owned ? `${r.owned} object${r.owned === 1 ? '' : 's'}` : r.schemas.length ? '' : html`<span class="muted">nothing</span>`}${r.owned_elsewhere ? html` <span class="muted">(+${String(r.owned_elsewhere)} elsewhere)</span>` : ''}</td></tr>`)
-        : html`<tr><td colspan="7" class="empty">No roles.</td></tr>`}</tbody></table></div>
-      <p class="muted small">PostgreSQL doesn't record when a role was created. <span class="tag tag-info">pgkiln</span> roles are pgkiln's own connections and roles: they are shown, not changed here. Roles <span class="tag">in use</span> by an application or an isolated workspace can be changed but not dropped.</p>`)}`;
-  return send(reply, s, shell(s, TITLE, crumbs(), main, 'users'));
+        <td data-label="${tx('dbu.role')}" class="u-break"><a href="${roleUrl(r.name)}"><strong>${r.name}</strong></a>${r.comment ? html`<br><span class="muted small">${r.comment}</span>` : ''}</td>
+        <td data-label="${tx('dbu.sign_in')}">${r.login ? tx('dbu.yes') : html`<span class="muted">${tx('dbu.no')}</span>`}</td>
+        <td data-label="${tx('dbu.col.attributes')}">${attrTags(tx, r)}</td>
+        <td data-label="${tx('dbu.col.connections')}" class="num">${r.conn_limit < 0 ? html`<span class="muted">${tx('dbu.no_limit')}</span>` : String(r.conn_limit)}</td>
+        <td data-label="${tx('dbu.valid_until')}">${expiry(tx, r)}</td>
+        <td data-label="${tx('dbu.member_of')}" class="u-break">${r.member_of.join(', ')}</td>
+        <td data-label="${tx('dbu.col.owns')}" class="u-break">${r.schemas.length ? html`${tx('dbu.owns_schemas', { list: r.schemas.join(', ') })}; ` : ''}${r.owned ? tx(r.owned === 1 ? 'dbu.n_objects_one' : 'dbu.n_objects', { n: r.owned }) : r.schemas.length ? '' : html`<span class="muted">${tx('dbu.nothing')}</span>`}${r.owned_elsewhere ? html` <span class="muted">${tx('dbu.elsewhere', { n: r.owned_elsewhere })}</span>` : ''}</td></tr>`)
+        : html`<tr><td colspan="7" class="empty">${tx('dbu.no_roles')}</td></tr>`}</tbody></table></div>
+      <p class="muted small">${tx.rich('dbu.list_note', { pgkiln: html`<span class="tag tag-info">pgkiln</span>`, in_use: html`<span class="tag">${tx('dbu.tag.in_use')}</span>` })}</p>`)}`;
+  return send(reply, s, shell(s, tx('dbu.title'), crumbs(tx), main, 'users'));
 }
 
-const crumbs = (...more: [string, string?][]): [string, string?][] => [['Workspace utilities', `${BASE}/utilities`], [TITLE, more.length ? URL_BASE : undefined], ...more];
+const crumbs = (tx: BuilderTranslate, ...more: [string, string?][]): [string, string?][] => [[tx('admin.utilities'), `${BASE}/utilities`], [tx('dbu.title'), more.length ? URL_BASE : undefined], ...more];
 
 /** A role's details: owned objects, members, users of it. */
 async function details(r: RoleRow) {
@@ -290,73 +294,73 @@ async function details(r: RoleRow) {
   return { owned, members };
 }
 
-function detailRegion(r: RoleRow, d: { owned: string[]; members: string[] }) {
-  return region('Details', html`<dl class="dbu-facts">
-    <dt>Attributes</dt><dd>${r.login ? 'Can sign in' : 'No sign-in (a group role)'} ${attrTags(r)}</dd>
-    <dt>Valid until</dt><dd>${expiry(r)}</dd>
-    <dt>Connection limit</dt><dd>${r.conn_limit < 0 ? 'no limit' : String(r.conn_limit)}</dd>
-    <dt>Member of</dt><dd class="u-break">${r.member_of.join(', ') || html`<span class="muted">none</span>`}</dd>
-    <dt>Members</dt><dd class="u-break">${d.members.join(', ') || html`<span class="muted">none</span>`}</dd>
-    ${r.used_by.length ? html`<dt>Used by</dt><dd class="u-break">${r.used_by.join(', ')}</dd>` : ''}
-    <dt>Owns</dt><dd class="u-break">${d.owned.length ? html`${r.owned > d.owned.length ? `${r.owned} objects, the first ${d.owned.length}: ` : ''}${d.owned.join(', ')}` : html`<span class="muted">nothing in this database</span>`}${r.owned_elsewhere ? html` <span class="tag tag-warning">${String(r.owned_elsewhere)} in other databases or shared</span>` : ''}</dd>
+function detailRegion(tx: BuilderTranslate, r: RoleRow, d: { owned: string[]; members: string[] }) {
+  return region(tx('dbu.details'), html`<dl class="dbu-facts">
+    <dt>${tx('dbu.col.attributes')}</dt><dd>${r.login ? tx('dbu.f.login') : tx('dbu.no_login')} ${attrTags(tx, r)}</dd>
+    <dt>${tx('dbu.valid_until')}</dt><dd>${expiry(tx, r)}</dd>
+    <dt>${tx('dbu.conn_limit')}</dt><dd>${r.conn_limit < 0 ? tx('dbu.no_limit') : String(r.conn_limit)}</dd>
+    <dt>${tx('dbu.member_of')}</dt><dd class="u-break">${r.member_of.join(', ') || html`<span class="muted">${tx('dbu.none')}</span>`}</dd>
+    <dt>${tx('dbu.members')}</dt><dd class="u-break">${d.members.join(', ') || html`<span class="muted">${tx('dbu.none')}</span>`}</dd>
+    ${r.used_by.length ? html`<dt>${tx('dbu.used_by')}</dt><dd class="u-break">${r.used_by.join(', ')}</dd>` : ''}
+    <dt>${tx('dbu.col.owns')}</dt><dd class="u-break">${d.owned.length ? html`${r.owned > d.owned.length ? `${tx('dbu.owned_first', { n: r.owned, first: d.owned.length })} ` : ''}${d.owned.join(', ')}` : html`<span class="muted">${tx('dbu.nothing_here')}</span>`}${r.owned_elsewhere ? html` <span class="tag tag-warning">${tx('dbu.owned_other', { n: r.owned_elsewhere })}</span>` : ''}</dd>
   </dl>`);
 }
 
 /** Can this role be changed here? A message when not. */
-const protectedMessage = (r: RoleRow) => r.pgkiln
-  ? `${r.name} is one of pgkiln's own roles (its owner or runtime connection, a pgkiln_ role or the bootstrap superuser): pgkiln needs it as it is, so it isn't changed or dropped here.`
-  : '';
+const protectedMessage = (tx: BuilderTranslate, r: RoleRow) => r.pgkiln ? tx('dbu.protected', { name: r.name }) : '';
 
 async function rolePage(reply: FastifyReply, s: Session, name: string | null, o: { spec?: RoleSpec; errors?: string[] } = {}) {
+  const tx = tr(s);
   const [ctx, schemas, grantable] = await Promise.all([context(), grantSchemas(), grantableRoles()]);
   if (name === null) {
     const spec = o.spec ?? { ...emptyRole(), login: true, schemas: schemas.map((schema) => ({ schema, usage: false, create: false, defaults: 'none' as DefaultPriv })) };
-    const main = html`<h1 class="u-mb1">Create database user</h1>${roleForm(s, spec, { isNew: true, before: null, grantable, errors: o.errors ?? [] })}`;
-    return send(reply, s, shell(s, 'Create database user', crumbs(['Create']), main, 'users'));
+    const main = html`<h1 class="u-mb1">${tx('dbu.create_user')}</h1>${roleForm(s, spec, { isNew: true, before: null, grantable, errors: o.errors ?? [] })}`;
+    return send(reply, s, shell(s, tx('dbu.create_user'), crumbs(tx, [tx('dbu.crumb.create')]), main, 'users'));
   }
   const r = await oneRole(name);
   if (!r) return reply.code(404).send('Not found');
   const d = await details(r);
-  const msg = protectedMessage(r);
+  const msg = protectedMessage(tx, r);
   const before = msg ? null : await readSpec(r, schemas, ctx.creator);
-  const main = html`<div class="ide-head-title u-mb1"><div><h1 class="u-break">Role ${r.name}</h1>${r.comment ? html`<span class="muted small">${r.comment}</span>` : ''}</div>
-      ${msg || r.used_by.length ? '' : html`<div class="buttons ide-head-actions"><a class="btn btn-danger" href="${roleUrl(r.name)}/drop">${icon('trash')} Drop role…</a></div>`}</div>
+  const main = html`<div class="ide-head-title u-mb1"><div><h1 class="u-break">${tx('dbu.role_title', { name: r.name })}</h1>${r.comment ? html`<span class="muted small">${r.comment}</span>` : ''}</div>
+      ${msg || r.used_by.length ? '' : html`<div class="buttons ide-head-actions"><a class="btn btn-danger" href="${roleUrl(r.name)}/drop">${icon('trash')} ${tx('dbu.drop_role_link')}</a></div>`}</div>
     ${msg ? html`<div class="alert alert-info" role="status">${msg}</div>` : ''}
-    ${!msg && r.used_by.length ? html`<div class="alert alert-info" role="status">${r.used_by.join(', ')} use${r.used_by.length === 1 ? 's' : ''} this role: it can be changed, not dropped.</div>` : ''}
-    ${detailRegion(r, d)}
+    ${!msg && r.used_by.length ? html`<div class="alert alert-info" role="status">${tx(r.used_by.length === 1 ? 'dbu.used_change_only_one' : 'dbu.used_change_only', { users: r.used_by.join(', ') })}</div>` : ''}
+    ${detailRegion(tx, r, d)}
     ${before ? roleForm(s, o.spec ?? before, { isNew: false, before, grantable, errors: o.errors ?? [] }) : ''}`;
-  return send(reply, s, shell(s, `Role ${r.name}`, crumbs([r.name]), main, 'users'));
+  return send(reply, s, shell(s, tx('dbu.role_title', { name: r.name }), crumbs(tx, [r.name]), main, 'users'));
 }
 
 async function save(req: Req, reply: FastifyReply, s: Session) {
   const b = req.body ?? {};
+  const tx = tr(s);
   const original = one(b.original);
   const isNew = !original;
   const [ctx, schemas, grantable] = await Promise.all([context(), grantSchemas(), grantableRoles()]);
   const r = isNew ? null : await oneRole(original);
   if (!isNew && !r) return reply.code(404).send('Not found');
   if (r && r.pgkiln) {
-    const main = html`<h1 class="u-mb1">Role ${r.name}</h1><div class="alert alert-error" role="alert">${protectedMessage(r)}</div>`;
-    return send(reply.code(403), s, shell(s, `Role ${r.name}`, crumbs([r.name]), main, 'users'));
+    const main = html`<h1 class="u-mb1">${tx('dbu.role_title', { name: r.name })}</h1><div class="alert alert-error" role="alert">${protectedMessage(tx, r)}</div>`;
+    return send(reply.code(403), s, shell(s, tx('dbu.role_title', { name: r.name }), crumbs(tx, [r.name]), main, 'users'));
   }
   const before = r ? await readSpec(r, schemas, ctx.creator) : null;
   const spec = specFromBody(b, isNew, original);
   const mode = one(b.mode);
   if (mode === 'edit') return rolePage(reply, s, isNew ? null : original, { spec });
   const errors = checkRole(spec, { isNew, grantable, schemas, before });
-  if (isNew && !errors.length && (await owner.one('select 1 from pg_roles where lower(rolname) = lower($1)', [spec.name]))) errors.push(`A role named ${spec.name} exists already.`);
+  if (isNew && !errors.length && (await owner.one('select 1 from pg_roles where lower(rolname) = lower($1)', [spec.name]))) errors.push(tx('dbu.exists', { name: spec.name }));
   if (errors.length) return rolePage(reply, s, isNew ? null : original, { spec, errors });
   const stmts = roleSql(before, spec, ctx);
-  const title = isNew ? `Create database user ${spec.name}` : `Change role ${spec.name}`;
+  const title = isNew ? tx('dbu.create_title', { name: spec.name }) : tx('dbu.change_title', { name: spec.name });
   const page = (errs: string[], output: Raw | '' = '') => {
     const main = html`<h1 class="u-mb1 u-break">${title}</h1>${reviewForm(s, spec, stmts, { isNew, errors: errs, output })}`;
-    const trail: [string, string?][] = isNew ? [['Create', `${URL_BASE}/new`], ['Review']] : [[spec.name, roleUrl(spec.name)], ['Review']];
-    return send(reply.code(errs.length || output ? 422 : 200), s, shell(s, title, crumbs(...trail), main, 'users'));
+    const trail: [string, string?][] = isNew ? [[tx('dbu.crumb.create'), `${URL_BASE}/new`], [tx('dbu.crumb.review')]] : [[spec.name, roleUrl(spec.name)], [tx('dbu.crumb.review')]];
+    return send(reply.code(errs.length || output ? 422 : 200), s, shell(s, title, crumbs(tx, ...trail), main, 'users'));
   };
   if (mode !== 'apply') return page([]);
   // Apply runs exactly what the review showed: a change in the form or the catalog since then shows the review again
-  if (one(b.reviewed) !== reviewDigest(stmts)) return page(['The statements changed since you reviewed them (the role or the form changed): review them again.']);
-  if (!stmts.length) return page(['Nothing to change.']);
+  if (one(b.reviewed) !== reviewDigest(stmts)) return page([tx('dbu.changed_since')]);
+  if (!stmts.length) return page([tx('dbu.nothing_change')]);
   const password = one(b.password);
   if (spec.password === 'set') {
     const bad = checkPassword(password, one(b.confirm));
@@ -379,9 +383,9 @@ async function save(req: Req, reply: FastifyReply, s: Session) {
   }
   await logActivity({ username: s.username, event: 'db_role', ip: clientIp(req), detail: `${failed ? 'failed: ' : ''}${maskSql(stmts)}`.slice(0, 4000) });
   if (failed) {
-    return page([], html`<div class="alert alert-error" role="alert"><p><strong>Nothing was changed</strong>: the statements ran in one transaction, which was rolled back.</p><p>${failed}</p>${at >= 0 ? html`<pre class="source">${maskSql([stmts[at]])}</pre>` : ''}</div>`);
+    return page([], html`<div class="alert alert-error" role="alert"><p>${tx.rich('dbu.rolled_back', { nothing: html`<strong>${tx('dbu.nothing_changed')}</strong>` })}</p><p>${failed}</p>${at >= 0 ? html`<pre class="source">${maskSql([stmts[at]])}</pre>` : ''}</div>`);
   }
-  flash(s, `${isNew ? 'Created' : 'Changed'} the role ${spec.name}: ${stmts.length} statement${stmts.length === 1 ? '' : 's'}.`);
+  flash(s, tx(isNew ? (stmts.length === 1 ? 'dbu.created_one' : 'dbu.created') : (stmts.length === 1 ? 'dbu.changed_one' : 'dbu.changed'), { name: spec.name, n: stmts.length }));
   return back(reply, s, isNew ? URL_BASE : roleUrl(spec.name));
 }
 
@@ -392,43 +396,45 @@ const reassignTargets = async (name: string) =>
 async function dropPage(req: Req, reply: FastifyReply, s: Session, name: string, o: { to?: string; errors?: string[]; output?: Raw | '' } = {}) {
   const r = await oneRole(name);
   if (!r) return reply.code(404).send('Not found');
-  const refusal = r.pgkiln ? protectedMessage(r) : r.used_by.length ? `${r.used_by.join(', ')} use${r.used_by.length === 1 ? 's' : ''} ${r.name}: it isn't dropped while they do.` : '';
+  const tx = tr(s);
+  const refusal = r.pgkiln ? protectedMessage(tx, r) : r.used_by.length ? tx(r.used_by.length === 1 ? 'dbu.drop_refused_one' : 'dbu.drop_refused', { users: r.used_by.join(', '), name: r.name }) : '';
   const d = await details(r);
   const targets = await reassignTargets(name);
   const to = o.to !== undefined && (o.to === '' || targets.includes(o.to)) ? o.to : r.owned ? targets[0] ?? '' : '';
   const stmts = dropSql(r.name, to || null);
-  const main = html`<h1 class="u-mb1 u-break">Drop role ${r.name}</h1>
+  const main = html`<h1 class="u-mb1 u-break">${tx('dbu.drop_title', { name: r.name })}</h1>
     ${refusal ? html`<div class="alert alert-error" role="alert">${refusal}</div>` : ''}${errorList(o.errors ?? [])}${o.output ?? ''}
-    ${detailRegion(r, d)}
+    ${detailRegion(tx, r, d)}
     ${refusal ? '' : html`
-    ${r.owned || r.owned_elsewhere ? html`<div class="alert alert-error" role="alert"><p><strong>${r.name} owns ${String(r.owned)} object${r.owned === 1 ? '' : 's'} in this database${r.owned_elsewhere ? html` and ${String(r.owned_elsewhere)} in other databases or shared (databases, tablespaces)` : ''}.</strong>
-      Reassign them to another role, or drop them with the role.${r.owned_elsewhere ? ' Objects in other databases must be reassigned or dropped there first, or DROP ROLE fails.' : ''}</p></div>` : ''}
-    ${region('Owned objects', html`<form method="get" action="${roleUrl(r.name)}/drop" class="form-grid">
-        <div class="field"><label class="label" for="f_to">Objects it owns</label><select id="f_to" name="to">
-          ${targets.map((t) => html`<option value="${t}"${sel(t === to)}>Reassign to ${t}</option>`)}
-          <option value=""${sel(to === '')}>${r.owned ? 'Drop them with the role (DROP OWNED)' : 'It owns nothing here: just revoke its privileges'}</option></select>
-          <small class="help">DROP OWNED also revokes the privileges granted to the role in this database.</small></div>
-        <div class="buttons"><button class="btn">${icon('eye')} Review SQL</button></div></form>`)}
-    ${region('SQL', html`<pre class="source dbu-sql" data-code-view="sql" tabindex="0" aria-label="Generated SQL">${maskSql(stmts)}</pre>
+    ${r.owned || r.owned_elsewhere ? html`<div class="alert alert-error" role="alert"><p><strong>${tx(r.owned === 1 ? 'dbu.owns_here_one' : 'dbu.owns_here', { name: r.name, n: r.owned })}${r.owned_elsewhere ? ` ${tx('dbu.owns_elsewhere', { n: r.owned_elsewhere })}` : ''}.</strong>
+      ${tx('dbu.reassign_note')}${r.owned_elsewhere ? ` ${tx('dbu.elsewhere_note')}` : ''}</p></div>` : ''}
+    ${region(tx('dbu.owned_objects'), html`<form method="get" action="${roleUrl(r.name)}/drop" class="form-grid">
+        <div class="field"><label class="label" for="f_to">${tx('dbu.objects_it_owns')}</label><select id="f_to" name="to">
+          ${targets.map((t) => html`<option value="${t}"${sel(t === to)}>${tx('dbu.reassign_to', { name: t })}</option>`)}
+          <option value=""${sel(to === '')}>${r.owned ? tx('dbu.drop_owned') : tx('dbu.owns_nothing')}</option></select>
+          <small class="help">${tx('dbu.drop_owned_help')}</small></div>
+        <div class="buttons"><button class="btn">${icon('eye')} ${tx('dbu.review')}</button></div></form>`)}
+    ${region(tx('dbu.sql'), html`<pre class="source dbu-sql" data-code-view="sql" tabindex="0" aria-label="${tx('dbu.generated_sql')}">${maskSql(stmts)}</pre>
       <form method="post" action="${URL_BASE}/drop" class="dbu-form">${csrf(s)}
         <input type="hidden" name="name" value="${r.name}"><input type="hidden" name="to" value="${to}"><input type="hidden" name="reviewed" value="${reviewDigest(stmts)}">
-        ${!to && r.owned ? html`<label class="check u-mb1"><input type="checkbox" name="drop_objects" value="1" required> Drop the ${String(r.owned)} object${r.owned === 1 ? '' : 's'} ${r.name} owns, with their data</label>` : ''}
-        <div class="buttons"><button class="btn btn-danger" data-confirm="Drop the role ${r.name}?">${icon('trash')} Drop role</button><a class="btn" href="${roleUrl(r.name)}">Cancel</a></div></form>`)}`}`;
-  return send(reply.code(refusal ? 403 : o.errors?.length || o.output ? 422 : 200), s, shell(s, `Drop role ${r.name}`, crumbs([r.name, roleUrl(r.name)], ['Drop']), main, 'users'));
+        ${!to && r.owned ? html`<label class="check u-mb1"><input type="checkbox" name="drop_objects" value="1" required> ${tx(r.owned === 1 ? 'dbu.drop_objects_one' : 'dbu.drop_objects', { n: r.owned, name: r.name })}</label>` : ''}
+        <div class="buttons"><button class="btn btn-danger" data-confirm="${tx('dbu.drop_confirm', { name: r.name })}">${icon('trash')} ${tx('dbu.drop_btn')}</button><a class="btn" href="${roleUrl(r.name)}">${tx('dbu.cancel')}</a></div></form>`)}`}`;
+  return send(reply.code(refusal ? 403 : o.errors?.length || o.output ? 422 : 200), s, shell(s, tx('dbu.drop_title', { name: r.name }), crumbs(tx, [r.name, roleUrl(r.name)], [tx('dbu.crumb.drop')]), main, 'users'));
 }
 
 async function drop(req: Req, reply: FastifyReply, s: Session) {
   const b = req.body ?? {};
+  const tx = tr(s);
   const name = one(b.name);
   const to = one(b.to);
   const r = await oneRole(name);
   if (!r) return reply.code(404).send('Not found');
   if (r.pgkiln || r.used_by.length) return dropPage(req, reply, s, name, { to });
   const targets = await reassignTargets(name);
-  if (to && !targets.includes(to)) return dropPage(req, reply, s, name, { errors: ['Choose a role to reassign the objects to.'] });
+  if (to && !targets.includes(to)) return dropPage(req, reply, s, name, { errors: [tx('dbu.choose_target')] });
   const stmts = dropSql(r.name, to || null);
-  if (one(b.reviewed) !== reviewDigest(stmts)) return dropPage(req, reply, s, name, { to, errors: ['The statements changed since you reviewed them: review them again.'] });
-  if (!to && r.owned && !b.drop_objects) return dropPage(req, reply, s, name, { to, errors: [`Tick the box to drop the objects ${r.name} owns, or reassign them.`] });
+  if (one(b.reviewed) !== reviewDigest(stmts)) return dropPage(req, reply, s, name, { to, errors: [tx('dbu.changed_since_drop')] });
+  if (!to && r.owned && !b.drop_objects) return dropPage(req, reply, s, name, { to, errors: [tx('dbu.tick_box', { name: r.name })] });
   let failed = '';
   try {
     await owner.tx(async (c) => {
@@ -439,8 +445,8 @@ async function drop(req: Req, reply: FastifyReply, s: Session) {
     failed = (e as Error).message;
   }
   await logActivity({ username: s.username, event: 'db_role', ip: clientIp(req), detail: `${failed ? 'failed: ' : ''}${maskSql(stmts)}`.slice(0, 4000) });
-  if (failed) return dropPage(req, reply, s, name, { to, output: html`<div class="alert alert-error" role="alert"><p><strong>Nothing was changed</strong>: the statements ran in one transaction, which was rolled back.</p><p>${failed}</p></div>` });
-  flash(s, `Dropped the role ${r.name}.`);
+  if (failed) return dropPage(req, reply, s, name, { to, output: html`<div class="alert alert-error" role="alert"><p>${tx.rich('dbu.rolled_back', { nothing: html`<strong>${tx('dbu.nothing_changed')}</strong>` })}</p><p>${failed}</p></div>` });
+  flash(s, tx('dbu.dropped', { name: r.name }));
   return back(reply, s, URL_BASE);
 }
 

package/src/builder/designer.ts

@@ -1,3 +1,4 @@
+import { conditionWords, serverCondition } from './conditions.ts';
 import { pageIssuesNote } from './team.ts';
 import type { FastifyInstance, FastifyReply } from 'fastify';
 import { owner } from '../db.ts';
@@ -107,7 +108,14 @@ export async function designerRoutes(app: FastifyInstance) {
     const post = `${BASE}/pages/${p.id}`;
     const isSel = (key: string) => sel === key || (key === 'page' && !sel && !newKind);
     const cur = (key: string) => (isSel(key) ? raw(' aria-current="true"') : '');
-    const badges = (r: any) => html`${r.authz ? html`<span class="pd-tag" title="${tx('pd.badge.authz', { name: r.authz })}">${icon('shield')}<span class="sr-only">${tx('pd.badge.authz', { name: r.authz })}</span></span>` : ''}${r.condition || r.readonly_condition || r.condition_type ? html`<span class="pd-tag" title="${tx('pd.badge.condition')}">${icon('filter')}<span class="sr-only">${tx('pd.badge.condition')}</span></span>` : ''}${r.build_option ? html`<span class="pd-tag" title="${tx('pd.badge.build_option', { name: r.build_option })}">${icon('settings')}<span class="sr-only">${tx('pd.badge.build_option', { name: r.build_option })}</span></span>` : ''}`;
+    const badges = (r: any) => html`${r.authz ? html`<span class="pd-tag" title="${tx('pd.badge.authz', { name: r.authz })}">${icon('shield')}<span class="sr-only">${tx('pd.badge.authz', { name: r.authz })}</span></span>` : ''}${condBadge(r)}${r.build_option ? html`<span class="pd-tag" title="${tx('pd.badge.build_option', { name: r.build_option })}">${icon('settings')}<span class="sr-only">${tx('pd.badge.build_option', { name: r.build_option })}</span></span>` : ''}`;
+    // (154) the server-side condition in words ("When the request is SAVE, CREATE"); other conditions: "Has a condition"
+    const condBadge = (r: any) => {
+      const sc = serverCondition(r);
+      if (!sc && !r.readonly_condition && !r.condition_type) return '';
+      const words = sc ? conditionWords(tx, sc) : tx('pd.badge.condition');
+      return html`<span class="pd-tag" title="${words}" data-condition="${sc?.condition_type ?? ''}">${icon('filter')}<span class="sr-only">${words}</span></span>`;
+    };
     const regionTitle = (r: any) => r.title ?? `(${r.type})`;
 
     // ------------------------------------------------------------ left: component tree