simple-module-core 0.0.32__tar.gz → 0.0.34__tar.gz

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_core
-Version: 0.0.32
+Version: 0.0.34
 Summary: Module-system primitives for the simple_module framework — ModuleBase, discovery, diagnostics, events
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_core"
-version = "0.0.32"
+version = "0.0.34"
 description = "Module-system primitives for the simple_module framework — ModuleBase, discovery, diagnostics, events"
 readme = "README.md"
 license = "MIT"

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/__init__.py

@@ -1,6 +1,6 @@
 """SimpleModule Core - Module system, menu, permissions, events, and diagnostics."""
 
-from simple_module_core.audit_links import AuditLink, AuditLinkRegistry
+from simple_module_core.audit_links import AuditLink, AuditLinkRegistry, LabelResolver
 from simple_module_core.csp import CspSourceError, CspSourceRegistry
 from simple_module_core.design_packs import DesignPack, DesignPackRegistry
 from simple_module_core.diagnostics import (
@@ -41,6 +41,7 @@ from simple_module_core.module import ModuleBase, ModuleMeta
 from simple_module_core.permissions import PermissionRegistry
 from simple_module_core.public_routes import PublicRoute, PublicRouteRegistry
 from simple_module_core.services import Services
+from simple_module_core.setup_steps import SetupRegistry, SetupStep
 from simple_module_core.versioning import FRAMEWORK_API_VERSION, check_framework_compatibility
 
 __all__ = [
@@ -65,6 +66,7 @@ __all__ = [
     "HealthStatus",
     "I18nRegistry",
     "InvalidModuleError",
+    "LabelResolver",
     "MenuItem",
     "MenuRegistry",
     "MenuSection",
@@ -77,6 +79,8 @@ __all__ = [
     "PublicRoute",
     "PublicRouteRegistry",
     "Services",
+    "SetupRegistry",
+    "SetupStep",
     "Translator",
     "ValidationError",
     "check_framework_compatibility",

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/__main__.py

@@ -7,10 +7,14 @@ Usage::
 
 Exits with status 1 if any ERROR-level diagnostics are reported.
 
-i18n checks are included when ``SM_I18N_SUPPORTED_LOCALES`` is set in env
-(or ``.env``). Host-level ``host/locales/`` and shared ``packages/ui/locales/``
-are picked up relative to the project root (``SM_PROJECT_ROOT``, else the
-directory of the discovered ``.env``, else the current working dir).
+i18n checks always run. ``SM_I18N_SUPPORTED_LOCALES`` (env or ``.env``)
+declares the locale set this install promises, which also enables SM013 for a
+namespace that never shipped one; with it unset, each namespace is checked
+against the locale files it actually has, so key drift between two shipped
+translations is still caught. Host-level ``host/locales/`` and shared
+``packages/ui/locales/`` are picked up relative to the project root
+(``SM_PROJECT_ROOT``, else the directory of the discovered ``.env``, else the
+current working dir).
 """
 
 from __future__ import annotations
@@ -36,8 +40,14 @@ from simple_module_core.dotenv import find_env_file, parse_dotenv
 from simple_module_core.exceptions import InvalidModuleError
 
 
-def _load_i18n_settings_from_env() -> tuple[list[str], str] | tuple[None, None]:
-    """Return ``(supported_locales, default_locale)`` or ``(None, None)`` if unset.
+def _load_i18n_settings_from_env() -> tuple[list[str] | None, str]:
+    """Return ``(supported_locales, default_locale)``.
+
+    ``supported_locales`` is ``None`` when ``SM_I18N_SUPPORTED_LOCALES`` is
+    unset or unparseable — the diagnostic then falls back to the locale files
+    each namespace ships rather than running no locale checks at all. The
+    default locale always has a value, because a parity comparison needs to
+    know which side is the source of truth.
 
     Reads env vars directly to avoid a dependency on ``simple_module_hosting``.
     Honors ``.env`` by merging it into ``os.environ`` if present (pydantic-
@@ -46,9 +56,10 @@ def _load_i18n_settings_from_env() -> tuple[list[str], str] | tuple[None, None]:
     for key, value in parse_dotenv().items():
         os.environ.setdefault(key, value)
 
+    default = os.environ.get("SM_I18N_DEFAULT_LOCALE", "en")
     supported_raw = os.environ.get("SM_I18N_SUPPORTED_LOCALES")
     if not supported_raw:
-        return None, None
+        return None, default
 
     try:
         supported = json.loads(supported_raw)
@@ -57,9 +68,8 @@ def _load_i18n_settings_from_env() -> tuple[list[str], str] | tuple[None, None]:
         supported = [s.strip() for s in supported_raw.split(",") if s.strip()]
 
     if not isinstance(supported, list) or not supported:
-        return None, None
+        return None, default
 
-    default = os.environ.get("SM_I18N_DEFAULT_LOCALE", "en")
     return supported, default
 
 

simple_module_core-0.0.34/simple_module_core/audit_links.py

@@ -0,0 +1,142 @@
+"""Audit-link registry — modules teach the audit log how to reach their records.
+
+An audit entry stores the *model class name* and primary key of the row that
+changed (``StoredFile``, ``a91f3c2b…`` — ``snapshot_changes`` records
+``type(obj).__name__``, never ``__tablename__``). That is enough to prove what
+happened and useless for doing anything about it: the reader has an id and no
+way to open the record it names.
+
+A module declares where its rows live via
+:meth:`~simple_module_core.module.ModuleBase.register_audit_links`; the host
+collects them into one registry at boot and stores it on
+``app.state.sm.audit_links``.
+
+**A link is a route, not an authorisation.** The registry does not verify the
+row exists or that the reader may open it — following a link to a deleted
+record lands on that screen's own 404, and permissions are enforced by the
+target route as usual.
+
+The one exception is ``label_permission``: the *name* of a row travels in the
+audit payload itself, so no downstream route ever gets the chance to refuse it.
+A module whose row names disclose something it gates elsewhere says so there,
+and readers without that permission see the id instead.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass, field
+from typing import Any
+
+LabelResolver = Callable[[Any, list[str]], Awaitable[dict[str, str]]]
+"""Batch "what is this row called" for one entity type.
+
+Called with the request's database session and every entity id of that type on
+the page, and returns ``{entity_id: display name}``. Ids it cannot name are
+simply absent — the caller falls back to the id, which is what the audit row
+actually stored.
+
+The session is typed ``Any`` because ``simple_module_core`` must not depend on
+SQLAlchemy; in practice it is the ``AsyncSession`` the request is already
+using, so a resolver adds one query per entity type per page and no session
+management of its own.
+"""
+
+_ID_PLACEHOLDER = "{id}"
+
+
+@dataclass(frozen=True)
+class AuditLink:
+    """Where the records of one audited model can be viewed.
+
+    Args:
+        entity_type: The **model class name**, matching
+            ``AuditEntry.entity_type`` (e.g. ``"User"``, not ``"users_user"``).
+            ``snapshot_changes`` records ``type(obj).__name__``, so keying this
+            off ``__tablename__`` silently never matches — and because an
+            unmatched lookup falls back to showing ``entity_type`` as the
+            label, a table-name key looks like it worked.
+        url_template: Path containing ``{id}``, substituted with the entity id
+            (e.g. ``"/admin/users/{id}/edit"``). Empty means *these rows have
+            no screen* — join tables and stored files are audited but have
+            nowhere to open — and the cell renders the name unlinked. A module
+            still registers those, because it is the only thing that knows what
+            the table is called and what its rows are named.
+        label: Human-readable name for the entity kind, shown instead of the
+            raw class name (e.g. ``"User account"``).
+        label_key: Catalog key for ``label``. Empty, or unresolved, falls back
+            to ``label`` — a missing translation shows English rather than a
+            raw dotted key. Rows are rendered server-side, so the audit view
+            translates these before they reach the page.
+        table_name: ``__tablename__`` of the table these rows live in
+            (``"users_user"``), shown as the type tag beside the row's name.
+            Not derivable from ``entity_type`` in either direction, so the
+            module that owns the table states both. ``None`` falls back to the
+            class name.
+        label_resolver: Optional :data:`LabelResolver` naming individual rows.
+            Without it a reader gets a primary key and has to paste it into
+            another screen to learn which record changed; only the owning
+            module knows that a ``Setting`` is named by its key and a ``User``
+            by ``full_name or email``. Excluded from equality: it is typically
+            a closure, and two boots would build two unequal objects out of one
+            module — a registry conflict is about two modules claiming one
+            entity type, which the identity fields already express.
+        label_permission: Permission a reader must hold before
+            ``label_resolver`` is *run* for them. Empty — the default — means
+            the name is safe for anyone allowed to read the audit trail at all.
+            Set it when naming the row discloses something the module gates
+            elsewhere: ``users`` names an account by ``full_name or email``, so
+            without this an ``audit_log.view`` grant is a back door onto the
+            user directory that ``users.manage`` guards at the front. Denied
+            readers still see the row, the action and the id — the audit trail
+            stays complete, it just stops volunteering the name.
+    """
+
+    entity_type: str
+    url_template: str
+    label: str = ""
+    label_key: str = ""
+    table_name: str | None = None
+    label_resolver: LabelResolver | None = field(default=None, compare=False)
+    label_permission: str = ""
+
+    def __post_init__(self) -> None:
+        if self.url_template and _ID_PLACEHOLDER not in self.url_template:
+            raise ValueError(
+                f"AuditLink for {self.entity_type!r} has url_template "
+                f"{self.url_template!r}, which contains no {_ID_PLACEHOLDER} — "
+                f"every row would link to the same page"
+            )
+
+    def url_for(self, entity_id: str) -> str | None:
+        """The row's page, or ``None`` when this kind of row has no screen."""
+        if not self.url_template:
+            return None
+        return self.url_template.replace(_ID_PLACEHOLDER, entity_id)
+
+
+class AuditLinkRegistry:
+    """Aggregates every module's :class:`AuditLink` declarations.
+
+    Populated once during boot (``register_audit_links`` hook) and read
+    thereafter by the audit log view when it renders each row.
+    """
+
+    def __init__(self) -> None:
+        self._links: dict[str, AuditLink] = {}
+
+    def register(self, link: AuditLink) -> None:
+        existing = self._links.get(link.entity_type)
+        if existing is not None and existing != link:
+            raise ValueError(
+                f"Two modules claim audit links for {link.entity_type!r}: "
+                f"{existing.url_template!r} and {link.url_template!r}"
+            )
+        self._links[link.entity_type] = link
+
+    def get(self, entity_type: str) -> AuditLink | None:
+        return self._links.get(entity_type)
+
+    @property
+    def all_links(self) -> dict[str, AuditLink]:
+        return dict(self._links)

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/diagnostics/__init__.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 from simple_module_core.diagnostics._i18n import I18nDiagnostics
 from simple_module_core.diagnostics._migration import MigrationDiagnostics
 from simple_module_core.diagnostics._module import ModuleDiagnostics
+from simple_module_core.diagnostics._pages import collect_tsx_pages
 from simple_module_core.diagnostics._runner import print_diagnostics, run_diagnostics
 from simple_module_core.diagnostics._types import Diagnostic, DiagnosticLevel
 
@@ -19,6 +20,7 @@ __all__ = [
     "I18nDiagnostics",
     "MigrationDiagnostics",
     "ModuleDiagnostics",
+    "collect_tsx_pages",
     "print_diagnostics",
     "run_diagnostics",
 ]

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/diagnostics/_i18n.py

@@ -25,19 +25,28 @@ class I18nDiagnostics:
 
     def __init__(
         self,
-        supported_locales: list[str],
+        supported_locales: list[str] | None,
         default_locale: str,
         extra_sources: list[tuple[str, str, Path]] | None = None,
     ) -> None:
         """Build the diagnostic.
 
+        ``supported_locales`` is the set of locales this install promises to
+        ship. ``None`` means *nobody declared one* — each namespace is then
+        checked against the locale files it actually has on disk. SM013 is
+        skipped in that mode (a locale nothing promised cannot be missing),
+        but SM014/SM015 still hold every shipped translation to the default
+        locale's key set. Without this, an install that never set
+        ``SM_I18N_SUPPORTED_LOCALES`` ran no locale checks at all and drift
+        accumulated with nothing to flag it.
+
         ``extra_sources`` is an optional list of ``(reporter_name, namespace,
         locale_dir)`` triples for locale directories that aren't owned by any
         ``ModuleBase`` instance — notably the host's ``host/locales/`` and
         the shared ``packages/ui/locales/``. ``reporter_name`` is used as the
         ``module_name`` field on findings for display purposes.
         """
-        self.supported_locales = list(supported_locales)
+        self.supported_locales = None if supported_locales is None else list(supported_locales)
         self.default_locale = default_locale
         self.extra_sources = list(extra_sources or [])
 
@@ -55,10 +64,14 @@ class I18nDiagnostics:
     ) -> list[Diagnostic]:
         findings: list[Diagnostic] = []
         per_locale_keys: dict[str, set[str]] = {}
+        declared = self.supported_locales is not None
+        locales = self.supported_locales if declared else self._locales_on_disk(locale_dir)
 
-        for locale in self.supported_locales:
+        for locale in locales or ():
             path = locale_dir / f"{locale}.json"
             if not path.is_file():
+                if not declared:
+                    continue
                 findings.append(
                     Diagnostic(
                         level=DiagnosticLevel.WARNING,
@@ -119,3 +132,14 @@ class I18nDiagnostics:
                     )
                 )
         return findings
+
+    @staticmethod
+    def _locales_on_disk(locale_dir: Path) -> list[str]:
+        """Locale tags a directory actually ships, from its ``<tag>.json`` files.
+
+        The default locale sorts first only by accident of the alphabet, which
+        does not matter: the parity comparison below looks it up by name.
+        """
+        if not locale_dir.is_dir():
+            return []
+        return sorted(path.stem for path in locale_dir.glob("*.json"))

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/diagnostics/_pages.py

@@ -12,17 +12,62 @@ if TYPE_CHECKING:
     from simple_module_core.module import ModuleBase
 
 
+def _assignment(s: ast.stmt) -> tuple[ast.Name, ast.expr] | None:
+    """Return ``(target, value)`` for a single-target top-level assignment.
+
+    Covers both ``NAME = ...`` and the annotated ``NAME: Final = ...`` form
+    module constants are conventionally written in.
+    """
+    if isinstance(s, ast.Assign) and len(s.targets) == 1 and isinstance(s.targets[0], ast.Name):
+        return s.targets[0], s.value
+    if isinstance(s, ast.AnnAssign) and isinstance(s.target, ast.Name) and s.value is not None:
+        return s.target, s.value
+    return None
+
+
 def _module_level_str_consts(tree: ast.Module) -> dict[str, str]:
     """Return ``{name: literal}`` for top-level ``NAME = "string"`` assignments."""
-    return {
-        s.targets[0].id: s.value.value
-        for s in tree.body
-        if isinstance(s, ast.Assign)
-        and len(s.targets) == 1
-        and isinstance(s.targets[0], ast.Name)
-        and isinstance(s.value, ast.Constant)
-        and isinstance(s.value.value, str)
-    }
+    consts: dict[str, str] = {}
+    for s in tree.body:
+        assignment = _assignment(s)
+        if assignment is None:
+            continue
+        target, value = assignment
+        if isinstance(value, ast.Constant) and isinstance(value.value, str):
+            consts[target.id] = value.value
+    return consts
+
+
+def _resolve_fstring_consts(tree: ast.Module, consts: dict[str, str]) -> dict[str, str]:
+    """Resolve top-level ``NAME = f"{CONST}/lit"`` against already-known consts.
+
+    Only plain interpolations of known string constants count — a conversion,
+    format spec, or unknown name makes the value non-static, so it is skipped
+    rather than guessed at.
+    """
+    resolved: dict[str, str] = {}
+    for s in tree.body:
+        assignment = _assignment(s)
+        if assignment is None or not isinstance(assignment[1], ast.JoinedStr):
+            continue
+        target, value = assignment
+        parts: list[str] = []
+        for piece in value.values:
+            if isinstance(piece, ast.Constant) and isinstance(piece.value, str):
+                parts.append(piece.value)
+            elif (
+                isinstance(piece, ast.FormattedValue)
+                and isinstance(piece.value, ast.Name)
+                and piece.value.id in consts
+                and piece.conversion == -1
+                and piece.format_spec is None
+            ):
+                parts.append(consts[piece.value.id])
+            else:
+                break
+        else:
+            resolved[target.id] = "".join(parts)
+    return resolved
 
 
 def _iter_render_components(tree: ast.Module, consts: dict[str, str]) -> list[str]:
@@ -79,6 +124,19 @@ def find_render_calls(mod: ModuleBase, src_dir: Path) -> set[str]:
     consts: dict[str, str] = {}
     for tree in trees:
         consts.update(_module_level_str_consts(tree))
+    # Then f-string constants built from the plain ones above
+    # (``PAGE = f"{MODULE_NAME}/Browse"`` is the conventional shape). Repeat to
+    # a fixed point so a chain — ``PREFIX = f"{NAME}/sub"`` then
+    # ``PAGE = f"{PREFIX}/Browse"`` — resolves too; one pass would only learn
+    # the first hop and report the page as an SM003 orphan.
+    while True:
+        resolved: dict[str, str] = {}
+        for tree in trees:
+            resolved.update(_resolve_fstring_consts(tree, consts))
+        new = {k: v for k, v in resolved.items() if consts.get(k) != v}
+        if not new:
+            break
+        consts.update(new)
 
     prefix = f"{mod.meta.name}/"
     rendered: set[str] = set()

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/diagnostics/_runner.py

@@ -30,18 +30,20 @@ def run_diagnostics(
     """Convenience function to run all diagnostics.
 
     When ``migration_state`` is provided, also runs migration diagnostics.
-    When ``i18n_supported_locales`` and ``i18n_default_locale`` are provided,
-    also runs i18n locale coverage diagnostics. ``i18n_extra_sources`` lets
-    callers include host/ui locale dirs that aren't owned by a ``ModuleBase``.
+    ``i18n_default_locale`` turns on the locale checks; ``i18n_supported_locales``
+    is the declared locale set, and leaving it empty runs those checks against
+    whatever locale files are on disk instead of skipping them entirely (see
+    :class:`I18nDiagnostics`). ``i18n_extra_sources`` lets callers include
+    host/ui locale dirs that aren't owned by a ``ModuleBase``.
     """
     diagnostics = ModuleDiagnostics().run(modules)
 
-    if i18n_supported_locales and i18n_default_locale:
+    if i18n_default_locale:
         from simple_module_core.diagnostics._i18n import I18nDiagnostics
 
         diagnostics.extend(
             I18nDiagnostics(
-                supported_locales=i18n_supported_locales,
+                supported_locales=i18n_supported_locales or None,
                 default_locale=i18n_default_locale,
                 extra_sources=i18n_extra_sources,
             ).run(modules)

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/i18n.py

@@ -145,8 +145,18 @@ class I18nRegistry:
         # Plain-dict snapshots for serialization callers. ``dict(msgs)`` runs
         # once here rather than on every Inertia render. The public variant
         # (admin namespaces excluded) is what anonymous visitors receive.
-        self._message_snapshots = {locale: dict(msgs) for locale, msgs in self._messages.items()}
-        self._public_snapshots = public_messages
+        #
+        # Each non-default locale layers over the default one, so a key it has
+        # not translated yet resolves to the default language instead of
+        # reaching the browser missing. The client cannot recover on its own:
+        # i18next is initialised with ``fallbackLng`` equal to the active
+        # locale, so an absent key renders as the raw dotted key — a partially
+        # translated locale would put "dashboard.home.health" on screen. The
+        # server-side ``Translator`` has always fallen back this way; this
+        # makes the payload behave the same, and makes partial translations a
+        # safe, incremental state to be in.
+        self._message_snapshots = self._layered_snapshots(self._messages)
+        self._public_snapshots = self._layered_snapshots(public_messages)
         self._available_locales = tuple(locale for locale, msgs in self._messages.items() if msgs)
         self._available_locales_list = list(self._available_locales)
         self._loaded = True
@@ -162,6 +172,16 @@ class I18nRegistry:
             return self._available_locales_list
         return [locale for locale, msgs in self._messages.items() if msgs]
 
+    def _layered_snapshots(self, messages: dict[str, dict[str, str]]) -> dict[str, dict[str, str]]:
+        """Snapshot per locale, each layered over the default locale's."""
+        base = messages.get(self.default_locale, {})
+        return {
+            locale: dict(msgs)
+            if locale == self.default_locale
+            else {**base, **msgs}  # translated entries win; the rest read as default
+            for locale, msgs in messages.items()
+        }
+
     def messages(self, locale: str) -> Mapping[str, str]:
         """Flat dotted-key map for the given locale. Empty mapping if unknown.
 

{simple_module_core-0.0.32 → simple_module_core-0.0.34}/simple_module_core/menu.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Callable
 from dataclasses import dataclass, field
 from enum import StrEnum
 from typing import Literal
@@ -24,6 +25,15 @@ class MenuItem:
 
     label: str
     url: str
+    label_key: str = ""
+    """Catalog key for ``label``. Empty = ship ``label`` verbatim.
+
+    Menu labels are rendered on every page, so they are translated on the
+    server — the payload carries finished text and every render site (sidebar,
+    topbar, command palette) keeps working untouched. A key that resolves to
+    nothing falls back to ``label``, so a missing translation degrades to
+    English rather than to a raw dotted key on screen.
+    """
     icon: str = ""
     order: int = 0
     section: MenuSection = MenuSection.SIDEBAR
@@ -42,6 +52,14 @@ class MenuItem:
     method: MenuItemMethod = "get"
     """HTTP method used when the item is activated. ``"post"`` renders as an
     Inertia form submission so the target endpoint can be POST-only (e.g. logout)."""
+    group_key: str = ""
+    """Catalog key for ``group``, with the same fallback rule as ``label_key``.
+
+    Group headers are shared vocabulary — several modules file entries under
+    "Administration" — so they live in the ``ui`` namespace. Letting each
+    module invent its own key would let one translation drift from another and
+    split a single header in two.
+    """
     group: str = ""
     """Sidebar group label. Empty = ungrouped (renders flat, no header).
     Items in the same section that share a group are visually clustered under a
@@ -79,6 +97,7 @@ class MenuRegistry:
         is_authenticated: bool,
         roles: list[str] | None = None,
         permissions: list[str] | None = None,
+        translate: Callable[[str], str] | None = None,
     ) -> dict[str, list[dict]]:
         """Return menu items grouped by section, filtered by auth/roles/permissions.
 
@@ -86,12 +105,25 @@ class MenuRegistry:
         wildcards). Items declaring permissions the caller lacks are dropped,
         so the sidebar never offers a screen that will 403 on click.
 
+        ``translate`` resolves ``label_key``/``group_key`` against the request's
+        locale. Omitting it (or omitting the keys) ships the literal ``label``
+        and ``group``, which is what third-party modules predating the keys do.
+
         Returns a dict ready to be serialized into Inertia shared props.
         """
         roles = roles or []
         granted = set(permissions or [])
         result: dict[str, list[dict]] = {s.value: [] for s in MenuSection}
 
+        def render(key: str, fallback: str) -> str:
+            # Translator.t() echoes the key back when the catalog has no entry.
+            # Showing "users.nav.users" in the sidebar would be worse than the
+            # English it replaced, so an unresolved key keeps the literal.
+            if not key or translate is None:
+                return fallback
+            translated = translate(key)
+            return fallback if translated == key else translated
+
         for item in self.all_items:
             if item.requires_auth and not is_authenticated:
                 continue
@@ -103,11 +135,11 @@ class MenuRegistry:
                 continue
             result[item.section.value].append(
                 {
-                    "label": item.label,
+                    "label": render(item.label_key, item.label),
                     "url": item.url,
                     "icon": item.icon,
                     "method": item.method,
-                    "group": item.group,
+                    "group": render(item.group_key, item.group),
                 }
             )