pgkiln 0.83.0 → 0.85.0

package/src/builder/login-page.ts

@@ -4,6 +4,7 @@ import { APP_MFA, EMAIL_CODE_MINUTES, EMAIL_CODES_PER_HOUR, type AppMfa } from '
 import { html, raw } from '../html.ts';
 import { secretKeyConfigured } from '../secrets.ts';
 import { back, BASE, developer, flash, type Req } from './ui.ts';
+import { scopedTx as tx } from './i18n.ts';
 
 // Application settings → Sign-in methods (migration 087): the application's
 // own login page (APEX: the login page, usually 9999) and "Forgot password?".
@@ -33,47 +34,47 @@ export async function loginSettingsFields(a: AppRow) {
        from meta.app_mail_service ams join meta.mail_service s on s.id = ams.service_id where ams.app_id = $1`, [a.id],
   );
   const mailOk = !!(mail?.enabled && mail.from_address?.trim());
-  const noMail = html`<strong>Not offered yet:</strong> the application needs an enabled mail service with a From address (Workspace utilities → Mail services).`;
+  const noMail = html`<strong>${tx('lgp.not_offered_yet')}</strong> the application needs an enabled mail service with a From address (Workspace utilities → Mail services).`;
   const opt = (v: string, label: string, cur: string) => html`<option value="${v}"${v === cur ? raw(' selected') : ''}>${label}</option>`;
   const current = a.login_page ? String(a.login_page) : '';
   const page = html`<div class="form-grid">
-      <div class="field"><label class="label" for="f_login_page">Login page</label>
-        <select id="f_login_page" name="login_page">${opt('', '- the built-in sign-in page -', current)}${pages.map((p) =>
-          opt(String(p.page_no), `${p.page_no} ${p.name}${p.requires_auth ? ' (requires sign-in: not usable)' : ''}`, current))}</select>
-        <small class="help">A public page with a <em>Login</em> region (APEX: the login page); page template <em>Minimal</em> hides the header and navigation.
-          <button class="link-button" formaction="${BASE}/apps/${a.id}/login-page">Create a login page</button></small></div>
+      <div class="field"><label class="label" for="f_login_page">${tx('lgp.login_page')}</label>
+        <select id="f_login_page" name="login_page">${opt('', tx('lgp.the_built_in_sign_in'), current)}${pages.map((p) =>
+          opt(String(p.page_no), p.requires_auth ? tx('lgp.requires_signin', { page: `${p.page_no} ${p.name}` }) : `${p.page_no} ${p.name}`, current))}</select>
+        <small class="help">${tx.rich('lgp.page_help', { login: html`<em>${tx('lgp.login')}</em>`, minimal: html`<em>${tx('lgp.minimal')}</em>` })}
+          <button class="link-button" formaction="${BASE}/apps/${a.id}/login-page">${tx('lgp.create_a_login_page')}</button></small></div>
     </div>
-    <div class="field"><label class="check"><input type="checkbox" name="password_reset" value="true"${a.password_reset ? raw(' checked') : ''}> Offer "Forgot password?"</label>
-      <small class="help">Users with a password and an e-mail address in the user directory get a single-use link, valid for 30 minutes, to choose a new password. Only for the user directory's own passwords.
-        ${mailOk ? html`Sent through mail service ${mail!.service} as ${mail!.from_address}.` : noMail}</small></div>`;
+    <div class="field"><label class="check"><input type="checkbox" name="password_reset" value="true"${a.password_reset ? raw(' checked') : ''}> ${tx('lgp.offer_forgot_password')}</label>
+      <small class="help">${tx('lgp.reset_help')}
+        ${mailOk ? tx('lgp.sent_through', { service: mail!.service, from: mail!.from_address ?? '' }) : noMail}</small></div>`;
   const twoFactor = html`<div class="form-grid">
-      <div class="field"><label class="label" for="f_mfa">Second step</label>
-        <select id="f_mfa" name="mfa" aria-describedby="f_mfa_help">${(APP_MFA as string[]).map((m) => opt(m, MFA_LABELS[m as AppMfa], a.mfa))}</select>
-        <small class="help" id="f_mfa_help">After the password or an LDAP directory: a code from an authenticator app, a passkey or a recovery code, added on <em>My account</em> or while signing in.
-          ${secretKeyConfigured() ? '' : html`<strong>Not available yet:</strong> the server needs <code>PGKILN_SECRET_KEY</code> to keep the apps' secrets.`}</small></div>
-      <div class="field"><label class="label" for="f_mfa_roles">Required for roles</label>
-        <input id="f_mfa_roles" name="mfa_roles" value="${(a.mfa_roles ?? []).join(', ')}" placeholder="admin, manager" aria-describedby="f_mfa_roles_help">
-        <small class="help" id="f_mfa_roles_help">With <em>Required for some roles</em>: users with one of these roles must use it, others may.</small></div>
+      <div class="field"><label class="label" for="f_mfa">${tx('lgp.second_step')}</label>
+        <select id="f_mfa" name="mfa" aria-describedby="f_mfa_help">${(APP_MFA as string[]).map((m) => opt(m, MFA_LABELS()[m as AppMfa], a.mfa))}</select>
+        <small class="help" id="f_mfa_help">${tx.rich('lgp.mfa_help', { account: html`<em>${tx('lgp.my_account')}</em>` })}
+          ${secretKeyConfigured() ? '' : tx.rich('lgp.needs_key', { na: html`<strong>${tx('lgp.not_available_yet')}</strong>`, key: html`<code>PGKILN_SECRET_KEY</code>` })}</small></div>
+      <div class="field"><label class="label" for="f_mfa_roles">${tx('lgp.required_for_roles')}</label>
+        <input id="f_mfa_roles" name="mfa_roles" value="${(a.mfa_roles ?? []).join(', ')}" placeholder="${tx('lgp.admin_manager')}" aria-describedby="f_mfa_roles_help">
+        <small class="help" id="f_mfa_roles_help">${tx.rich('lgp.roles_help', { some: html`<em>${tx('lgp.required_for_some_roles')}</em>` })}</small></div>
     </div>
-    <div class="field"><label class="check"><input type="checkbox" name="mfa_email" value="true"${a.mfa_email ? raw(' checked') : ''}> Offer a code by e-mail</label>
-      <small class="help">Users who already have an app or a passkey may get a one-time code by e-mail instead (valid ${EMAIL_CODE_MINUTES} minutes, at most ${EMAIL_CODES_PER_HOUR} an hour); never as their only factor.
+    <div class="field"><label class="check"><input type="checkbox" name="mfa_email" value="true"${a.mfa_email ? raw(' checked') : ''}> ${tx('lgp.offer_a_code_by_e')}</label>
+      <small class="help">${tx('lgp.email_help', { minutes: EMAIL_CODE_MINUTES, per_hour: EMAIL_CODES_PER_HOUR })}
         ${mailOk ? '' : noMail}</small></div>
-    <p class="muted small">Passkeys need the application at a host name, not an IP address. Identity providers ask for their own second factor (see the provider's <em>Multi-factor sign-in</em>). To ask again before a page opens (step-up), give its authorization scheme <em>Second step within (minutes)</em> in Shared Components.</p>`;
+    <p class="muted small">${tx.rich('lgp.passkeys_note', { mfa: html`<em>${tx('lgp.multi_factor_sign_in')}</em>`, within: html`<em>${tx('lgp.second_step_within_minutes')}</em>` })}</p>`;
   return { page, twoFactor };
 }
 
-const MFA_LABELS: Record<AppMfa, string> = { off: 'Off', optional: 'Optional (users may add an app)', required: 'Required', roles: 'Required for some roles' };
+const MFA_LABELS = (): Record<AppMfa, string> => ({ off: tx('lgp.off'), optional: tx('lgp.optional_users_may_add_an'), required: tx('lgp.required'), roles: tx('lgp.required_for_some_roles') });
 
 /** Save them (with the rest of the settings form). */
 export async function saveLoginSettings(appId: string, b: Record<string, string | undefined>) {
   const page = b.login_page?.trim() ? Number(b.login_page) : null;
-  if (page !== null && !(await owner.one('select 1 from meta.page where app_id = $1 and page_no = $2', [appId, page]))) throw new Error(`Login page: there is no page ${b.login_page}.`);
+  if (page !== null && !(await owner.one('select 1 from meta.page where app_id = $1 and page_no = $2', [appId, page]))) throw new Error(tx('lgp.no_page', { n: String(b.login_page) }));
   const mfa = (APP_MFA as string[]).includes(b.mfa ?? '') ? (b.mfa as AppMfa) : 'off';
   const roles = [...new Set((b.mfa_roles ?? '').split(',').map((r) => r.trim().toLowerCase()).filter(Boolean))];
-  if (roles.some((r) => r.length > 100)) throw new Error('Two-factor sign-in: a role name is too long.');
-  if (mfa === 'roles' && !roles.length) throw new Error('Two-factor sign-in: name the roles that must use it.');
+  if (roles.some((r) => r.length > 100)) throw new Error(tx('lgp.two_factor_sign_in_a'));
+  if (mfa === 'roles' && !roles.length) throw new Error(tx('lgp.two_factor_sign_in_name'));
   // without the instance key, users could not add an app: requiring one would lock them out
-  if ((mfa === 'required' || mfa === 'roles') && !secretKeyConfigured()) throw new Error('Two-factor sign-in: the server needs PGKILN_SECRET_KEY before it can be required.');
+  if ((mfa === 'required' || mfa === 'roles') && !secretKeyConfigured()) throw new Error(tx('lgp.two_factor_sign_in_the'));
   await owner.query('update meta.app set login_page = $2, password_reset = $3, mfa = $4, mfa_roles = $5, mfa_email = $6 where id = $1',
     [appId, page, b.password_reset === 'true', mfa, roles, b.mfa_email === 'true']);
 }
@@ -102,7 +103,7 @@ export async function loginPageRoutes(app: FastifyInstance) {
     if (!a) return reply.code(404).send('Not found');
     try {
       const { page, no } = await owner.tx((c) => createLoginPage(c, a));
-      flash(s, `Page ${no} "Login" created and made the login page. Add regions around the sign-in form in the Page Designer.`);
+      flash(s, tx('lgp.created', { n: no }));
       return back(reply, s, `${BASE}/pages/${page}`);
     } catch (e) {
       flash(s, (e as Error).message, 'error');