Add Administration, starting with accounts
An account whose Stalwart role manages accounts now finds Administration in the account menu. It lists, searches, creates and edits accounts -- display name, other addresses, role, storage limit -- sets a new password, and deletes, each offered only when the role holds the matching permission. The server keeps the permissions list from GET /api/account, which it already called for the edition and threw the rest away. Everything else is JMAP x:Account, x:Domain and x:Role calls through the existing /api/jmap proxy, so nothing new is stored and Stalwart decides every call. Stalwart checks a grant against the caller's permissions but not a password change or a delete, so an account that outranks the viewer is shown read-only. Your own password is changed in Settings, which re-seals the session; changing it here would strand it. The mock server gains a directory behind the same permission names, with MOCK_ROLE choosing admin, tenant-admin, helpdesk or user. 68 new strings, translated in all nine catalogues; strings falling back to English stay at 16.
This commit is contained in:
@@ -31,6 +31,8 @@ const ContactsView = lazy(() => import("@/views/contacts/ContactsView").then((m)
|
||||
const CalendarView = lazy(() => import("@/views/calendar/CalendarView").then((m) => ({ default: m.CalendarView })));
|
||||
const FilesView = lazy(() => import("@/views/files/FilesView").then((m) => ({ default: m.FilesView })));
|
||||
const SettingsView = lazy(() => import("@/views/settings/SettingsView").then((m) => ({ default: m.SettingsView })));
|
||||
// Only ever opened by the few who administer, so nobody else downloads it.
|
||||
const AdminView = lazy(() => import("@/views/admin/AdminView").then((m) => ({ default: m.AdminView })));
|
||||
|
||||
export function App() {
|
||||
const status = useSession((s) => s.status);
|
||||
@@ -305,6 +307,7 @@ function AuthedApp() {
|
||||
<Route path="/calendar/:view?/:date?">{(p) => <CalendarView view={p.view} date={p.date} />}</Route>
|
||||
<Route path="/files/:nodeId?">{(p) => <FilesView nodeId={p.nodeId} />}</Route>
|
||||
<Route path="/settings/:section?">{(p) => <SettingsView section={p.section} />}</Route>
|
||||
<Route path="/admin/:section?/:id?">{(p) => <AdminView section={p.section} id={p.id} />}</Route>
|
||||
<Route path="/login">
|
||||
<Redirect to="/mail" />
|
||||
</Route>
|
||||
|
||||
@@ -19,6 +19,9 @@ export const CAP = {
|
||||
websocket: "urn:ietf:params:jmap:websocket",
|
||||
} as const;
|
||||
|
||||
/** Stalwart's own capability, which carries its `x:` registry methods. */
|
||||
export const STALWART_CAP = "urn:stalwart:jmap";
|
||||
|
||||
export class JmapMethodError extends Error {
|
||||
constructor(
|
||||
public readonly method: string,
|
||||
@@ -349,6 +352,9 @@ export class JmapClient {
|
||||
/** Map method name prefix → required capability URNs. */
|
||||
function usingFor(method: string): string[] {
|
||||
const type = method.split("/")[0] ?? "";
|
||||
// Stalwart's registry: accounts, domains, credentials. Advertised per
|
||||
// account rather than in the session, which supportedUsing() allows for.
|
||||
if (type.startsWith("x:")) return [STALWART_CAP];
|
||||
switch (type) {
|
||||
case "Mailbox":
|
||||
case "Thread":
|
||||
|
||||
@@ -39,6 +39,12 @@ export interface JmapSession {
|
||||
/** "oss" | "community" | "enterprise". Stalwart publishes no version. */
|
||||
edition?: string | null;
|
||||
};
|
||||
/**
|
||||
* The account's effective permissions on that server, as Stalwart reports
|
||||
* them. What the client offers is shaped by these; what is allowed is
|
||||
* decided by Stalwart on every call.
|
||||
*/
|
||||
permissions?: string[];
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { ADMIN_BASELINE, can, canGrantRole, generatePassword, hasAdministration, outranks, permissionSet, resolveRoles, type RoleDef } from "@/lib/adminAccess";
|
||||
|
||||
const set = (...p: string[]) => permissionSet(p);
|
||||
const everything = set(...ADMIN_BASELINE, "sysTenantGet", "jmapEmailGet", "impersonate");
|
||||
const helpdesk = set("sysAccountGet", "sysAccountQuery", "sysAccountUpdate", "jmapEmailGet");
|
||||
const roles = new Map<string, RoleDef>([
|
||||
["user", { id: "user", enabledPermissions: { jmapEmailGet: true } }],
|
||||
["helpdesk", { id: "helpdesk", enabledPermissions: { sysAccountGet: true, sysAccountQuery: true, sysAccountUpdate: true }, roleIds: { user: true } }],
|
||||
["dns", { id: "dns", enabledPermissions: { sysDnsServerUpdate: true }, roleIds: { user: true } }],
|
||||
["loop", { id: "loop", enabledPermissions: {}, roleIds: { loop: true } }],
|
||||
]);
|
||||
|
||||
describe("who is offered administration", () => {
|
||||
it("needs both halves of reading the account list", () => {
|
||||
expect(hasAdministration(set("sysAccountQuery", "sysAccountGet"))).toBe(true);
|
||||
expect(hasAdministration(set("sysAccountQuery"))).toBe(false);
|
||||
expect(hasAdministration(set("sysAccountGet"))).toBe(false);
|
||||
expect(hasAdministration(permissionSet(undefined))).toBe(false);
|
||||
});
|
||||
|
||||
it("reads one permission per object and operation", () => {
|
||||
expect(can(helpdesk, "Account", "Update")).toBe(true);
|
||||
expect(can(helpdesk, "Account", "Destroy")).toBe(false);
|
||||
expect(can(helpdesk, "Domain", "Get")).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
/**
|
||||
* Stalwart checks a grant, but not a password change or a delete. Without this,
|
||||
* anyone allowed to edit accounts could take over one that can do more.
|
||||
*/
|
||||
describe("an account that outranks the viewer", () => {
|
||||
it("an ordinary user never does", () => {
|
||||
expect(outranks(helpdesk, { roles: { "@type": "User" } }, null)).toBe(false);
|
||||
expect(outranks(helpdesk, {}, null)).toBe(false);
|
||||
});
|
||||
|
||||
it("an administrator does, unless the viewer is one too", () => {
|
||||
expect(outranks(helpdesk, { roles: { "@type": "Admin" } }, roles)).toBe(true);
|
||||
expect(outranks(everything, { roles: { "@type": "Admin" } }, roles)).toBe(false);
|
||||
});
|
||||
|
||||
it("a custom role does when it carries something the viewer lacks", () => {
|
||||
expect(outranks(helpdesk, { roles: { "@type": "Custom", roleIds: { helpdesk: true } } }, roles)).toBe(false);
|
||||
expect(outranks(helpdesk, { roles: { "@type": "Custom", roleIds: { dns: true } } }, roles)).toBe(true);
|
||||
});
|
||||
|
||||
it("a role that cannot be read counts against the target, not for it", () => {
|
||||
expect(outranks(helpdesk, { roles: { "@type": "Custom", roleIds: { helpdesk: true } } }, null)).toBe(true);
|
||||
expect(outranks(everything, { roles: { "@type": "Custom", roleIds: { gone: true } } }, roles)).toBe(true);
|
||||
});
|
||||
|
||||
it("extra permissions on the account itself are counted", () => {
|
||||
expect(outranks(helpdesk, { roles: { "@type": "User" }, permissions: { "@type": "Merge", enabledPermissions: { sysDomainDestroy: true } } }, roles)).toBe(true);
|
||||
// Replace ignores the roles entirely, so only what it lists matters.
|
||||
expect(outranks(helpdesk, { roles: { "@type": "Custom", roleIds: { dns: true } }, permissions: { "@type": "Replace", enabledPermissions: { jmapEmailGet: true } } }, roles)).toBe(false);
|
||||
});
|
||||
|
||||
it("survives a role that names itself", () => {
|
||||
expect(resolveRoles(["loop"], roles)).toEqual(new Set());
|
||||
});
|
||||
});
|
||||
|
||||
describe("granting a role", () => {
|
||||
it("is offered only for roles whose every permission the viewer holds", () => {
|
||||
expect(canGrantRole(helpdesk, "helpdesk", roles)).toBe(true);
|
||||
expect(canGrantRole(helpdesk, "dns", roles)).toBe(false);
|
||||
expect(canGrantRole(everything, "missing", roles)).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("generated passwords", () => {
|
||||
it("are four groups of five unambiguous characters", () => {
|
||||
const p = generatePassword();
|
||||
expect(p).toMatch(/^[a-zA-Z2-9]{5}(-[a-zA-Z2-9]{5}){3}$/);
|
||||
expect(p).not.toMatch(/[01lIO]/);
|
||||
});
|
||||
|
||||
it("skip bytes that would favour the start of the alphabet", () => {
|
||||
// 256 % 55 leaves 36 byte values over; a plain modulo would hand those to
|
||||
// the first 36 characters twice as often. Bytes of 220 and up are dropped
|
||||
// and more are drawn, so a batch of nothing but those costs a draw.
|
||||
let call = 0;
|
||||
const source = (n: number) => (call++ === 0 ? new Uint8Array(n).fill(250) : Uint8Array.from({ length: n }, (_, i) => i));
|
||||
expect(generatePassword(source)).toBe("abcde-fghjk-mnpqr-stuvw");
|
||||
expect(call).toBe(2);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,45 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { aliasList, describeDirectoryError, DirectoryError, hasPassword, passwordPatch, quotasWithDisk } from "@/lib/adminDirectory";
|
||||
|
||||
describe("setting a password", () => {
|
||||
it("writes into the existing password credential, keeping its place", () => {
|
||||
const account = { credentials: { "0": { "@type": "AppPassword" as const }, "2": { "@type": "Password" as const, secret: "[********]" } } };
|
||||
expect(passwordPatch(account, "new secret")).toEqual({ "credentials/2/secret": "new secret" });
|
||||
});
|
||||
|
||||
it("adds one after the last index when the account has none", () => {
|
||||
const account = { credentials: { "0": { "@type": "AppPassword" as const }, "3": { "@type": "ApiKey" as const } } };
|
||||
expect(passwordPatch(account, "s")).toEqual({ "credentials/4": { "@type": "Password", secret: "s" } });
|
||||
expect(passwordPatch({}, "s")).toEqual({ "credentials/0": { "@type": "Password", secret: "s" } });
|
||||
expect(hasPassword(account)).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("lists written back", () => {
|
||||
it("re-index aliases the way the server stores a list", () => {
|
||||
expect(aliasList([{ name: "b", domainId: "d1" }, { name: "c", domainId: "d2", enabled: false }])).toEqual({
|
||||
"0": { enabled: true, name: "b", domainId: "d1", description: null },
|
||||
"1": { enabled: false, name: "c", domainId: "d2", description: null },
|
||||
});
|
||||
});
|
||||
|
||||
it("change the disk limit without touching the other quotas", () => {
|
||||
expect(quotasWithDisk({ maxEmails: 10, maxDiskQuota: 5 }, 7)).toEqual({ maxEmails: 10, maxDiskQuota: 7 });
|
||||
expect(quotasWithDisk({ maxEmails: 10, maxDiskQuota: 5 }, null)).toEqual({ maxEmails: 10 });
|
||||
expect(quotasWithDisk(undefined, 0)).toEqual({});
|
||||
});
|
||||
});
|
||||
|
||||
describe("explaining a refusal", () => {
|
||||
it("says what a taken address means", () => {
|
||||
expect(describeDirectoryError(new DirectoryError("primaryKeyViolation", "exists"))).toMatch(/already in use/);
|
||||
});
|
||||
|
||||
it("keeps the server's own words for a password policy", () => {
|
||||
expect(describeDirectoryError(new DirectoryError("invalidProperties", "Password must be at least 8 characters long.", ["secret"]))).toContain("at least 8 characters");
|
||||
});
|
||||
|
||||
it("handles a method-level refusal as well as a set error", () => {
|
||||
expect(describeDirectoryError({ type: "forbidden", message: "x:Account/set: forbidden" })).toMatch(/refused/);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,146 @@
|
||||
/**
|
||||
* What the signed-in account may administer, read from the permissions Stalwart
|
||||
* reported for it at sign-in.
|
||||
*
|
||||
* None of this is a security boundary, and nothing here should read as one.
|
||||
* Every administrative call is a JMAP `x:` method sent through the ordinary
|
||||
* proxy, and Stalwart checks each of them against the credential making it --
|
||||
* scoping a tenant administrator's queries to their own tenant, and refusing a
|
||||
* write the account may not make. What this decides is only what the client
|
||||
* *offers*: a menu that appears for the people it can do something for, and
|
||||
* buttons that are there when pressing them would work.
|
||||
*
|
||||
* The one place it is more than presentation is `outranks`, which stands in
|
||||
* for a check Stalwart does not make. See there.
|
||||
*/
|
||||
|
||||
export type AdminObject = "Account" | "Domain" | "Role" | "MailingList" | "DkimSignature" | "DnsServer" | "Tenant";
|
||||
export type AdminOp = "Get" | "Query" | "Create" | "Update" | "Destroy";
|
||||
|
||||
export type Permissions = ReadonlySet<string>;
|
||||
|
||||
export function permissionSet(list: readonly string[] | null | undefined): Permissions {
|
||||
return new Set(list ?? []);
|
||||
}
|
||||
|
||||
export function can(perms: Permissions, object: AdminObject, op: AdminOp): boolean {
|
||||
return perms.has(`sys${object}${op}`);
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether to offer Administration at all.
|
||||
*
|
||||
* Accounts are the only section so far, and a list that cannot be opened is
|
||||
* not worth a menu entry, so it takes both halves of reading one.
|
||||
*/
|
||||
export function hasAdministration(perms: Permissions): boolean {
|
||||
return can(perms, "Account", "Query") && can(perms, "Account", "Get");
|
||||
}
|
||||
|
||||
/**
|
||||
* What an administrator holds, at the least: Stalwart's built-in Tenant
|
||||
* Administrator role, for the parts of it that manage people and domains.
|
||||
* Anyone who has all of this can already do anything to the accounts an
|
||||
* "Administrator" account could.
|
||||
*/
|
||||
export const ADMIN_BASELINE: readonly string[] = (["Account", "Domain", "Role", "MailingList"] as const).flatMap((o) =>
|
||||
(["Get", "Query", "Create", "Update", "Destroy"] as const).map((op) => `sys${o}${op}`),
|
||||
);
|
||||
|
||||
export type UserRoles = { "@type": "User" } | { "@type": "Admin" } | { "@type": "Custom"; roleIds: Record<string, boolean> };
|
||||
|
||||
export type PermissionsMode =
|
||||
| { "@type": "Inherit" }
|
||||
| { "@type": "Merge" | "Replace"; enabledPermissions?: Record<string, boolean>; disabledPermissions?: Record<string, boolean> };
|
||||
|
||||
export interface RoleDef {
|
||||
id: string;
|
||||
description?: string | null;
|
||||
enabledPermissions?: Record<string, boolean>;
|
||||
roleIds?: Record<string, boolean>;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether an account can do something the viewer cannot.
|
||||
*
|
||||
* Stalwart checks that a caller holds every permission they grant -- when
|
||||
* roles or permissions change, and when an account is created. It does not
|
||||
* check when only a password changes, and it does not check a delete. So an
|
||||
* account allowed to edit accounts could reset the password of one with far
|
||||
* more rights than its own and sign in as it. ihasmail refuses to offer that,
|
||||
* and treats such an account as read-only.
|
||||
*
|
||||
* It errs towards refusing. A role that cannot be read -- the viewer lacks
|
||||
* `sysRoleGet`, or the id is not in the list -- counts as outranking, because
|
||||
* an unknown grant is not a grant the viewer can be shown to hold. What it
|
||||
* cannot see is tenancy: an "Administrator" account is a tenant administrator
|
||||
* inside a tenant and a server administrator outside one, and a tenant-scoped
|
||||
* viewer is not told which it is looking at. It never sees the second kind,
|
||||
* which is why comparing against the administrator baseline is enough there.
|
||||
*/
|
||||
export function outranks(
|
||||
viewer: Permissions,
|
||||
target: { roles?: UserRoles | null; permissions?: PermissionsMode | null },
|
||||
roles: ReadonlyMap<string, RoleDef> | null,
|
||||
): boolean {
|
||||
let granted = new Set<string>();
|
||||
const kind = target.roles?.["@type"] ?? "User";
|
||||
if (kind === "Admin") {
|
||||
if (!ADMIN_BASELINE.every((p) => viewer.has(p))) return true;
|
||||
} else if (kind === "Custom") {
|
||||
const ids = Object.keys((target.roles as { roleIds?: Record<string, boolean> }).roleIds ?? {});
|
||||
const resolved = resolveRoles(ids, roles);
|
||||
if (!resolved) return true;
|
||||
granted = resolved;
|
||||
}
|
||||
const mode = target.permissions;
|
||||
if (mode && mode["@type"] !== "Inherit") {
|
||||
const enabled = Object.keys(mode.enabledPermissions ?? {});
|
||||
granted = mode["@type"] === "Replace" ? new Set(enabled) : new Set([...granted, ...enabled]);
|
||||
}
|
||||
for (const p of granted) if (!viewer.has(p)) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
/** Every permission a set of roles grants, nested roles included; null if any cannot be read. */
|
||||
export function resolveRoles(ids: readonly string[], roles: ReadonlyMap<string, RoleDef> | null): Set<string> | null {
|
||||
if (!ids.length) return new Set();
|
||||
if (!roles) return null;
|
||||
const out = new Set<string>();
|
||||
const seen = new Set<string>();
|
||||
const walk = (id: string): boolean => {
|
||||
if (seen.has(id)) return true;
|
||||
seen.add(id);
|
||||
const role = roles.get(id);
|
||||
if (!role) return false;
|
||||
for (const p of Object.keys(role.enabledPermissions ?? {})) out.add(p);
|
||||
return Object.keys(role.roleIds ?? {}).every(walk);
|
||||
};
|
||||
return ids.every(walk) ? out : null;
|
||||
}
|
||||
|
||||
/** Whether the viewer could grant a role: they hold everything it carries. */
|
||||
export function canGrantRole(viewer: Permissions, roleId: string, roles: ReadonlyMap<string, RoleDef> | null): boolean {
|
||||
const granted = resolveRoles([roleId], roles);
|
||||
return granted !== null && [...granted].every((p) => viewer.has(p));
|
||||
}
|
||||
|
||||
/**
|
||||
* A password to hand to somebody who will change it.
|
||||
*
|
||||
* Twenty characters from an alphabet without the ones people misread aloud
|
||||
* (0/O, 1/l/I), in groups of five. Rejection sampling, so every character is
|
||||
* equally likely rather than the first few of the alphabet slightly more.
|
||||
*/
|
||||
const ALPHABET = "abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789";
|
||||
|
||||
export function generatePassword(random: (n: number) => Uint8Array = (n) => crypto.getRandomValues(new Uint8Array(n))): string {
|
||||
const out: string[] = [];
|
||||
const limit = 256 - (256 % ALPHABET.length);
|
||||
while (out.length < 20) {
|
||||
for (const byte of random(32)) {
|
||||
if (byte < limit && out.length < 20) out.push(ALPHABET[byte % ALPHABET.length]!);
|
||||
}
|
||||
}
|
||||
return [0, 5, 10, 15].map((i) => out.slice(i, i + 5).join("")).join("-");
|
||||
}
|
||||
@@ -0,0 +1,246 @@
|
||||
import { client } from "@/jmap/client";
|
||||
import { t } from "@/lib/i18n";
|
||||
import type { PermissionsMode, RoleDef, UserRoles } from "@/lib/adminAccess";
|
||||
|
||||
/**
|
||||
* Stalwart 0.16's directory, over the ordinary JMAP proxy.
|
||||
*
|
||||
* 0.16 removed the REST management API (`/api/principal` and the rest); people,
|
||||
* domains and roles are registry objects now, read and written with `x:Account`,
|
||||
* `x:Domain` and `x:Role`. These go through `/api/jmap` like every other call,
|
||||
* authenticated as the signed-in account, so ihasmail holds nothing new: no
|
||||
* route of its own, no store, no cache beyond the component showing the list.
|
||||
*
|
||||
* Shapes, from the 0.16.22 source:
|
||||
*
|
||||
* - A list (credentials, aliases) is an object keyed by index, `{"0": …}`. A
|
||||
* set (memberGroupIds, role ids, permissions) is `{"id": true}`.
|
||||
* - An account's `name` is its local part, and its domain is a `domainId`.
|
||||
* `emailAddress` and `usedDiskQuota` are computed by the server.
|
||||
* - Secrets read back masked. A new password is written to the existing
|
||||
* password credential, so its id -- which OAuth tokens are tied to -- stays.
|
||||
* - Filters are AND only, and the default order is newest first.
|
||||
*
|
||||
* Query and get are two requests rather than one with a result reference.
|
||||
* Whether the registry methods resolve back-references has not been checked on
|
||||
* a live server, and a list that loads a moment slower is a better failure than
|
||||
* one that never loads.
|
||||
*/
|
||||
|
||||
export interface EmailAlias {
|
||||
enabled?: boolean;
|
||||
name: string;
|
||||
domainId: string;
|
||||
description?: string | null;
|
||||
}
|
||||
|
||||
export interface Credential {
|
||||
"@type": "Password" | "AppPassword" | "ApiKey";
|
||||
secret?: string;
|
||||
description?: string;
|
||||
}
|
||||
|
||||
export interface DirectoryAccount {
|
||||
id: string;
|
||||
"@type": "User" | "Group";
|
||||
name: string;
|
||||
domainId: string;
|
||||
emailAddress?: string;
|
||||
description?: string | null;
|
||||
roles?: UserRoles;
|
||||
permissions?: PermissionsMode;
|
||||
quotas?: Record<string, number>;
|
||||
usedDiskQuota?: number;
|
||||
aliases?: Record<string, EmailAlias>;
|
||||
memberGroupIds?: Record<string, boolean>;
|
||||
credentials?: Record<string, Credential>;
|
||||
createdAt?: string;
|
||||
}
|
||||
|
||||
export interface DirectoryDomain {
|
||||
id: string;
|
||||
name: string;
|
||||
}
|
||||
|
||||
const ACCOUNT_PROPERTIES = [
|
||||
"@type", "name", "domainId", "emailAddress", "description", "roles", "permissions", "quotas",
|
||||
"usedDiskQuota", "aliases", "memberGroupIds", "credentials", "createdAt",
|
||||
];
|
||||
|
||||
/** The one quota ihasmail edits; the others keep whatever they had. */
|
||||
export const DISK_QUOTA = "maxDiskQuota";
|
||||
|
||||
/** An error with a SetError behind it, kept so the caller can explain it. */
|
||||
export class DirectoryError extends Error {
|
||||
constructor(
|
||||
readonly type: string,
|
||||
readonly description: string | undefined,
|
||||
readonly properties: string[] = [],
|
||||
) {
|
||||
super(description ?? type);
|
||||
this.name = "DirectoryError";
|
||||
}
|
||||
}
|
||||
|
||||
interface QueryResult {
|
||||
ids: string[];
|
||||
total?: number;
|
||||
position?: number;
|
||||
}
|
||||
|
||||
export async function queryAccounts(opts: { type: "User" | "Group"; text?: string; position?: number; limit?: number }): Promise<{ ids: string[]; total: number }> {
|
||||
const filter: Record<string, unknown> = { type: opts.type };
|
||||
if (opts.text?.trim()) filter.text = opts.text.trim();
|
||||
const res = await client.call<QueryResult>("x:Account/query", {
|
||||
filter,
|
||||
position: opts.position ?? 0,
|
||||
...(opts.limit ? { limit: opts.limit } : {}),
|
||||
calculateTotal: true,
|
||||
});
|
||||
return { ids: res.ids ?? [], total: res.total ?? res.ids?.length ?? 0 };
|
||||
}
|
||||
|
||||
export async function getAccounts(ids: string[]): Promise<DirectoryAccount[]> {
|
||||
if (!ids.length) return [];
|
||||
const res = await client.call<{ list: DirectoryAccount[] }>("x:Account/get", { ids, properties: ACCOUNT_PROPERTIES });
|
||||
// In the order the query gave, which is the order the list is shown in.
|
||||
const byId = new Map(res.list.map((a) => [a.id, a]));
|
||||
return ids.map((id) => byId.get(id)).filter((a): a is DirectoryAccount => Boolean(a));
|
||||
}
|
||||
|
||||
/** Every one of a kind, for the pickers. Capped by what the server allows in a get. */
|
||||
async function all<T>(object: "Domain" | "Role", properties: string[]): Promise<T[]> {
|
||||
const q = await client.call<QueryResult>(`x:${object}/query`, { limit: client.maxObjectsInGet });
|
||||
if (!q.ids?.length) return [];
|
||||
const res = await client.call<{ list: T[] }>(`x:${object}/get`, { ids: q.ids, properties });
|
||||
return res.list;
|
||||
}
|
||||
|
||||
export const listDomains = () => all<DirectoryDomain>("Domain", ["name"]);
|
||||
export const listRoles = () => all<RoleDef>("Role", ["description", "enabledPermissions", "roleIds"]);
|
||||
|
||||
export async function listGroups(): Promise<DirectoryAccount[]> {
|
||||
const q = await queryAccounts({ type: "Group", limit: client.maxObjectsInGet });
|
||||
if (!q.ids.length) return [];
|
||||
const res = await client.call<{ list: DirectoryAccount[] }>("x:Account/get", { ids: q.ids, properties: ["name", "emailAddress", "description"] });
|
||||
return res.list;
|
||||
}
|
||||
|
||||
type SetResponse = Record<string, Record<string, { type: string; description?: string; properties?: string[] } | null> | undefined>;
|
||||
|
||||
function throwIfRefused(res: SetResponse, kind: "notCreated" | "notUpdated" | "notDestroyed"): void {
|
||||
const failure = Object.values(res[kind] ?? {})[0];
|
||||
if (failure) throw new DirectoryError(failure.type, failure.description, failure.properties);
|
||||
}
|
||||
|
||||
export interface NewAccount {
|
||||
name: string;
|
||||
domainId: string;
|
||||
description: string;
|
||||
password: string;
|
||||
roles: UserRoles;
|
||||
diskQuotaBytes: number | null;
|
||||
}
|
||||
|
||||
export async function createAccount(input: NewAccount): Promise<string> {
|
||||
const res = await client.call<SetResponse & { created?: Record<string, { id: string }> }>("x:Account/set", {
|
||||
create: {
|
||||
n: {
|
||||
"@type": "User",
|
||||
name: input.name.trim(),
|
||||
domainId: input.domainId,
|
||||
description: input.description.trim() || null,
|
||||
credentials: { "0": { "@type": "Password", secret: input.password } },
|
||||
roles: input.roles,
|
||||
permissions: { "@type": "Inherit" },
|
||||
quotas: input.diskQuotaBytes ? { [DISK_QUOTA]: input.diskQuotaBytes } : {},
|
||||
aliases: {},
|
||||
memberGroupIds: {},
|
||||
// Required on create. Turning it on is one-way and not offered here.
|
||||
encryptionAtRest: { "@type": "Disabled" },
|
||||
},
|
||||
},
|
||||
});
|
||||
throwIfRefused(res, "notCreated");
|
||||
const id = res.created?.n?.id;
|
||||
if (!id) throw new DirectoryError("serverFail", t("The server did not say whether the account was created."));
|
||||
return id;
|
||||
}
|
||||
|
||||
export async function updateAccount(id: string, patch: Record<string, unknown>): Promise<void> {
|
||||
if (!Object.keys(patch).length) return;
|
||||
const res = await client.call<SetResponse>("x:Account/set", { update: { [id]: patch } });
|
||||
throwIfRefused(res, "notUpdated");
|
||||
}
|
||||
|
||||
export async function destroyAccount(id: string): Promise<void> {
|
||||
const res = await client.call<SetResponse>("x:Account/set", { destroy: [id] });
|
||||
throwIfRefused(res, "notDestroyed");
|
||||
}
|
||||
|
||||
/**
|
||||
* The patch that sets a new password.
|
||||
*
|
||||
* Into the existing password credential when there is one, which keeps its
|
||||
* credential id; as a new credential after the last index when there is not --
|
||||
* an account that has only ever signed in through a directory, say. An account
|
||||
* holds one password at most, so adding a second is never the answer.
|
||||
*/
|
||||
export function passwordPatch(account: Pick<DirectoryAccount, "credentials">, secret: string): Record<string, unknown> {
|
||||
const entries = Object.entries(account.credentials ?? {});
|
||||
const existing = entries.find(([, c]) => c["@type"] === "Password");
|
||||
if (existing) return { [`credentials/${existing[0]}/secret`]: secret };
|
||||
const next = entries.reduce((max, [k]) => Math.max(max, Number(k) + 1), 0);
|
||||
return { [`credentials/${next}`]: { "@type": "Password", secret } };
|
||||
}
|
||||
|
||||
export function hasPassword(account: Pick<DirectoryAccount, "credentials">): boolean {
|
||||
return Object.values(account.credentials ?? {}).some((c) => c["@type"] === "Password");
|
||||
}
|
||||
|
||||
/** Re-index a list of aliases the way the server stores them. */
|
||||
export function aliasList(aliases: EmailAlias[]): Record<string, EmailAlias> {
|
||||
return Object.fromEntries(aliases.map((a, i) => [String(i), { enabled: a.enabled ?? true, name: a.name, domainId: a.domainId, description: a.description ?? null }]));
|
||||
}
|
||||
|
||||
/** The quotas object with the disk limit set or cleared, and every other quota kept. */
|
||||
export function quotasWithDisk(quotas: Record<string, number> | undefined, bytes: number | null): Record<string, number> {
|
||||
const next = { ...(quotas ?? {}) };
|
||||
if (bytes && bytes > 0) next[DISK_QUOTA] = bytes;
|
||||
else delete next[DISK_QUOTA];
|
||||
return next;
|
||||
}
|
||||
|
||||
/**
|
||||
* Say what went wrong in terms of the person's own action.
|
||||
*
|
||||
* Stalwart's descriptions are often exact and occasionally all there is -- a
|
||||
* password policy says what it wants, in English -- so a description is kept
|
||||
* where it carries something the type does not.
|
||||
*/
|
||||
export function describeDirectoryError(err: unknown): string {
|
||||
if (!(err instanceof DirectoryError)) {
|
||||
const e = err as { type?: string; message?: string };
|
||||
if (e?.type === "forbidden") return t("The mail server refused this. Your role may not allow it.");
|
||||
return e?.message ?? String(err);
|
||||
}
|
||||
switch (err.type) {
|
||||
case "forbidden":
|
||||
return err.description ? t("The mail server refused this: {reason}", { reason: err.description }) : t("The mail server refused this. Your role may not allow it.");
|
||||
case "primaryKeyViolation":
|
||||
return t("That address is already in use on this server, as an account, a list or an alias.");
|
||||
case "invalidForeignKey":
|
||||
return t("One of the chosen domain, role or group can't be used for this account.");
|
||||
case "overQuota":
|
||||
return t("Your organisation has reached the number of accounts it is allowed.");
|
||||
case "objectIsLinked":
|
||||
return t("Something still depends on this, so the server kept it.");
|
||||
case "notFound":
|
||||
return t("This account no longer exists. Someone may have deleted it.");
|
||||
case "invalidProperties":
|
||||
if (err.properties.includes("secret")) return err.description ? t("The password was not accepted: {reason}", { reason: err.description }) : t("The password was not accepted.");
|
||||
return err.description ? t("The mail server rejected a value: {reason}", { reason: err.description }) : t("The mail server rejected a value.");
|
||||
default:
|
||||
return err.description ?? err.type;
|
||||
}
|
||||
}
|
||||
@@ -55,6 +55,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "Ihr eigenes Passwort ändern Sie unter {settings}.",
|
||||
"Administration": "Verwaltung",
|
||||
"Directory": "Verzeichnis",
|
||||
"User": "Benutzer",
|
||||
"Administrator": "Administrator",
|
||||
"Custom role": "Eigene Rolle",
|
||||
"New account": "Neues Konto",
|
||||
"The people who sign in to mail on the domains you manage.": "Die Personen, die sich auf den von Ihnen verwalteten Domains bei ihrer E-Mail anmelden.",
|
||||
"Search by name or address": "Nach Name oder Adresse suchen",
|
||||
"Search accounts": "Konten durchsuchen",
|
||||
"No accounts match": "Keine passenden Konten",
|
||||
"No accounts yet": "Noch keine Konten",
|
||||
"Nothing on your domains matches “{query}”.": "Auf Ihren Domains passt nichts zu „{query}“.",
|
||||
"Open {address}": "{address} öffnen",
|
||||
"{from}–{to} of {total}": "{from}–{to} von {total}",
|
||||
"Previous page": "Vorherige Seite",
|
||||
"Next page": "Nächste Seite",
|
||||
"Storage": "Speicher",
|
||||
"Groups": "Gruppen",
|
||||
"{used} · no limit": "{used} · ohne Begrenzung",
|
||||
"Profile": "Profil",
|
||||
"Domain": "Domain",
|
||||
"No domains are available to create an account on.": "Es gibt keine Domain, auf der ein Konto angelegt werden kann.",
|
||||
"Sign-in": "Anmeldung",
|
||||
"Other addresses": "Weitere Adressen",
|
||||
"Not in any group": "In keiner Gruppe",
|
||||
"You can't change your own role.": "Sie können Ihre eigene Rolle nicht ändern.",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "Angeboten werden nur Rollen, deren Berechtigungen Sie selbst besitzen. Bei einem Konto innerhalb eines Mandanten bedeutet Administrator: Administrator dieses Mandanten.",
|
||||
"Limit in GB": "Begrenzung in GB",
|
||||
"No limit": "Ohne Begrenzung",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "Dieses Konto hat Berechtigungen, die Ihres nicht hat. Sie können es ansehen, aber nicht ändern.",
|
||||
"Your role lets you view accounts but not change them.": "Ihre Rolle erlaubt es, Konten anzusehen, aber nicht zu ändern.",
|
||||
"This account has permissions yours doesn't.": "Dieses Konto hat Berechtigungen, die Ihres nicht hat.",
|
||||
"You can't delete the account you're signed in with.": "Das Konto, mit dem Sie angemeldet sind, können Sie nicht löschen.",
|
||||
"Create account": "Konto anlegen",
|
||||
"An account needs an address.": "Ein Konto braucht eine Adresse.",
|
||||
"Created {address}": "{address} angelegt",
|
||||
"Saved {address}": "{address} gespeichert",
|
||||
"Generate a password": "Passwort erzeugen",
|
||||
"Pass it on some way other than email to this address.": "Geben Sie es nicht per E-Mail an diese Adresse weiter.",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "Dieses Konto hat kein Passwort. Möglicherweise meldet es sich über ein Verzeichnis oder Single Sign-on an.",
|
||||
"Set a new password…": "Neues Passwort festlegen…",
|
||||
"{name} will be signed out of every app and device using the old password.": "{name} wird in allen Apps und auf allen Geräten abgemeldet, die das alte Passwort verwenden.",
|
||||
"New password set for {address}": "Neues Passwort für {address} festgelegt",
|
||||
"Set password": "Passwort festlegen",
|
||||
"Remove {address}": "{address} entfernen",
|
||||
"New address": "Neue Adresse",
|
||||
"another name": "anderer Name",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "E-Mails an diese Adressen werden diesem Konto zugestellt. Änderungen gelten nach dem Speichern.",
|
||||
"Deletes the mailbox and everything in it.": "Löscht das Postfach und alles darin.",
|
||||
"Delete account…": "Konto löschen…",
|
||||
"Delete {address}?": "{address} löschen?",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "Dadurch werden die E-Mails, Kalender, Kontakte und Dateien dieses Kontos gelöscht. Der Server entfernt sie im Hintergrund, und es kann nicht rückgängig gemacht werden.",
|
||||
"Type {address} to confirm": "Zur Bestätigung {address} eingeben",
|
||||
"Delete account": "Konto löschen",
|
||||
"Deleted {address}": "{address} gelöscht",
|
||||
"The server did not say whether the account was created.": "Der Server hat nicht mitgeteilt, ob das Konto angelegt wurde.",
|
||||
"The mail server refused this. Your role may not allow it.": "Der Mailserver hat dies abgelehnt. Ihre Rolle erlaubt es möglicherweise nicht.",
|
||||
"The mail server refused this: {reason}": "Der Mailserver hat dies abgelehnt: {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "Diese Adresse wird auf diesem Server bereits verwendet – als Konto, Liste oder Alias.",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "Die gewählte Domain, Rolle oder Gruppe kann für dieses Konto nicht verwendet werden.",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "Ihre Organisation hat die Anzahl der erlaubten Konten erreicht.",
|
||||
"Something still depends on this, so the server kept it.": "Etwas hängt noch davon ab, daher hat der Server es behalten.",
|
||||
"This account no longer exists. Someone may have deleted it.": "Dieses Konto existiert nicht mehr. Möglicherweise hat es jemand gelöscht.",
|
||||
"The password was not accepted: {reason}": "Das Passwort wurde nicht akzeptiert: {reason}",
|
||||
"The password was not accepted.": "Das Passwort wurde nicht akzeptiert.",
|
||||
"The mail server rejected a value: {reason}": "Der Mailserver hat einen Wert abgelehnt: {reason}",
|
||||
"The mail server rejected a value.": "Der Mailserver hat einen Wert abgelehnt.",
|
||||
"Go to folder…": "Zu Ordner springen…",
|
||||
"Set for everyone here. You cannot change this.": "Für alle hier festgelegt. Sie können dies nicht ändern.",
|
||||
"Export iCAL file": "iCAL-Datei exportieren",
|
||||
@@ -1375,6 +1444,8 @@ export const catalog: Catalog = {
|
||||
"no address": "keine Adresse",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { one: "{n} Konto", other: "{n} Konten" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { one: "{n} Element löschen", other: "{n} Elemente löschen" },
|
||||
"Delete {n} items?": { one: "{n} Element löschen?", other: "{n} Elemente löschen?" },
|
||||
|
||||
@@ -47,6 +47,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "Cambie su propia contraseña en {settings}.",
|
||||
"Administration": "Administración",
|
||||
"Directory": "Directorio",
|
||||
"User": "Usuario",
|
||||
"Administrator": "Administrador",
|
||||
"Custom role": "Rol personalizado",
|
||||
"New account": "Nueva cuenta",
|
||||
"The people who sign in to mail on the domains you manage.": "Las personas que inician sesión en el correo en los dominios que usted administra.",
|
||||
"Search by name or address": "Buscar por nombre o dirección",
|
||||
"Search accounts": "Buscar cuentas",
|
||||
"No accounts match": "Ninguna cuenta coincide",
|
||||
"No accounts yet": "Todavía no hay cuentas",
|
||||
"Nothing on your domains matches “{query}”.": "Nada en sus dominios coincide con «{query}».",
|
||||
"Open {address}": "Abrir {address}",
|
||||
"{from}–{to} of {total}": "{from}–{to} de {total}",
|
||||
"Previous page": "Página anterior",
|
||||
"Next page": "Página siguiente",
|
||||
"Storage": "Almacenamiento",
|
||||
"Groups": "Grupos",
|
||||
"{used} · no limit": "{used} · sin límite",
|
||||
"Profile": "Perfil",
|
||||
"Domain": "Dominio",
|
||||
"No domains are available to create an account on.": "No hay ningún dominio disponible en el que crear una cuenta.",
|
||||
"Sign-in": "Inicio de sesión",
|
||||
"Other addresses": "Otras direcciones",
|
||||
"Not in any group": "No pertenece a ningún grupo",
|
||||
"You can't change your own role.": "No puede cambiar su propio rol.",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "Solo se ofrecen los roles cuyos permisos usted tiene. En una cuenta dentro de un inquilino, Administrador significa administrador de ese inquilino.",
|
||||
"Limit in GB": "Límite en GB",
|
||||
"No limit": "Sin límite",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "Esta cuenta tiene permisos que la suya no tiene, así que puede verla pero no modificarla.",
|
||||
"Your role lets you view accounts but not change them.": "Su rol le permite ver las cuentas, pero no modificarlas.",
|
||||
"This account has permissions yours doesn't.": "Esta cuenta tiene permisos que la suya no tiene.",
|
||||
"You can't delete the account you're signed in with.": "No puede eliminar la cuenta con la que ha iniciado sesión.",
|
||||
"Create account": "Crear cuenta",
|
||||
"An account needs an address.": "Una cuenta necesita una dirección.",
|
||||
"Created {address}": "{address} creada",
|
||||
"Saved {address}": "{address} guardada",
|
||||
"Generate a password": "Generar una contraseña",
|
||||
"Pass it on some way other than email to this address.": "Comuníquela por otro medio que no sea un correo a esta dirección.",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "Esta cuenta no tiene contraseña. Puede que inicie sesión mediante un directorio o un inicio de sesión único.",
|
||||
"Set a new password…": "Establecer una contraseña nueva…",
|
||||
"{name} will be signed out of every app and device using the old password.": "Se cerrará la sesión de {name} en todas las aplicaciones y dispositivos que usen la contraseña anterior.",
|
||||
"New password set for {address}": "Nueva contraseña establecida para {address}",
|
||||
"Set password": "Establecer contraseña",
|
||||
"Remove {address}": "Quitar {address}",
|
||||
"New address": "Nueva dirección",
|
||||
"another name": "otro nombre",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "El correo enviado a estas direcciones se entrega a esta cuenta. Los cambios se aplican al guardar.",
|
||||
"Deletes the mailbox and everything in it.": "Elimina el buzón y todo su contenido.",
|
||||
"Delete account…": "Eliminar cuenta…",
|
||||
"Delete {address}?": "¿Eliminar {address}?",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "Esto elimina el correo, los calendarios, los contactos y los archivos de esta cuenta. El servidor los borra en segundo plano y no se puede deshacer.",
|
||||
"Type {address} to confirm": "Escriba {address} para confirmar",
|
||||
"Delete account": "Eliminar cuenta",
|
||||
"Deleted {address}": "{address} eliminada",
|
||||
"The server did not say whether the account was created.": "El servidor no indicó si la cuenta se creó.",
|
||||
"The mail server refused this. Your role may not allow it.": "El servidor de correo lo ha rechazado. Es posible que su rol no lo permita.",
|
||||
"The mail server refused this: {reason}": "El servidor de correo lo ha rechazado: {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "Esa dirección ya está en uso en este servidor, como cuenta, lista o alias.",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "El dominio, el rol o el grupo elegido no se puede usar para esta cuenta.",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "Su organización ha alcanzado el número de cuentas permitido.",
|
||||
"Something still depends on this, so the server kept it.": "Algo todavía depende de esto, así que el servidor lo ha conservado.",
|
||||
"This account no longer exists. Someone may have deleted it.": "Esta cuenta ya no existe. Puede que alguien la haya eliminado.",
|
||||
"The password was not accepted: {reason}": "La contraseña no se ha aceptado: {reason}",
|
||||
"The password was not accepted.": "La contraseña no se ha aceptado.",
|
||||
"The mail server rejected a value: {reason}": "El servidor de correo ha rechazado un valor: {reason}",
|
||||
"The mail server rejected a value.": "El servidor de correo ha rechazado un valor.",
|
||||
"Go to folder…": "Ir a la carpeta…",
|
||||
"Set for everyone here. You cannot change this.": "Definido para todos aquí. No puedes cambiarlo.",
|
||||
"Export iCAL file": "Exportar archivo iCAL",
|
||||
@@ -1348,6 +1417,8 @@ export const catalog: Catalog = {
|
||||
"no address": "ninguna dirección",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { one: "{n} cuenta", other: "{n} cuentas" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { one: "Eliminar {n} elemento", other: "Eliminar {n} elementos" },
|
||||
"Delete {n} items?": { one: "¿Eliminar {n} elemento?", other: "¿Eliminar {n} elementos?" },
|
||||
|
||||
@@ -52,6 +52,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "Modifiez votre propre mot de passe dans {settings}.",
|
||||
"Administration": "Administration",
|
||||
"Directory": "Annuaire",
|
||||
"User": "Utilisateur",
|
||||
"Administrator": "Administrateur",
|
||||
"Custom role": "Rôle personnalisé",
|
||||
"New account": "Nouveau compte",
|
||||
"The people who sign in to mail on the domains you manage.": "Les personnes qui se connectent à leur messagerie sur les domaines que vous gérez.",
|
||||
"Search by name or address": "Rechercher par nom ou adresse",
|
||||
"Search accounts": "Rechercher des comptes",
|
||||
"No accounts match": "Aucun compte correspondant",
|
||||
"No accounts yet": "Aucun compte pour l’instant",
|
||||
"Nothing on your domains matches “{query}”.": "Rien ne correspond à « {query} » sur vos domaines.",
|
||||
"Open {address}": "Ouvrir {address}",
|
||||
"{from}–{to} of {total}": "{from}–{to} sur {total}",
|
||||
"Previous page": "Page précédente",
|
||||
"Next page": "Page suivante",
|
||||
"Storage": "Stockage",
|
||||
"Groups": "Groupes",
|
||||
"{used} · no limit": "{used} · sans limite",
|
||||
"Profile": "Profil",
|
||||
"Domain": "Domaine",
|
||||
"No domains are available to create an account on.": "Aucun domaine n’est disponible pour créer un compte.",
|
||||
"Sign-in": "Connexion",
|
||||
"Other addresses": "Autres adresses",
|
||||
"Not in any group": "Membre d’aucun groupe",
|
||||
"You can't change your own role.": "Vous ne pouvez pas modifier votre propre rôle.",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "Seuls les rôles dont vous détenez vous-même les autorisations sont proposés. Pour un compte au sein d’un locataire, Administrateur signifie administrateur de ce locataire.",
|
||||
"Limit in GB": "Limite en Go",
|
||||
"No limit": "Sans limite",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "Ce compte a des autorisations que le vôtre n’a pas : vous pouvez le consulter, mais pas le modifier.",
|
||||
"Your role lets you view accounts but not change them.": "Votre rôle vous permet de consulter les comptes, mais pas de les modifier.",
|
||||
"This account has permissions yours doesn't.": "Ce compte a des autorisations que le vôtre n’a pas.",
|
||||
"You can't delete the account you're signed in with.": "Vous ne pouvez pas supprimer le compte avec lequel vous êtes connecté.",
|
||||
"Create account": "Créer le compte",
|
||||
"An account needs an address.": "Un compte doit avoir une adresse.",
|
||||
"Created {address}": "{address} créé",
|
||||
"Saved {address}": "{address} enregistré",
|
||||
"Generate a password": "Générer un mot de passe",
|
||||
"Pass it on some way other than email to this address.": "Transmettez-le autrement que par e-mail à cette adresse.",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "Ce compte n’a pas de mot de passe. Il se connecte peut-être via un annuaire ou une authentification unique.",
|
||||
"Set a new password…": "Définir un nouveau mot de passe…",
|
||||
"{name} will be signed out of every app and device using the old password.": "{name} sera déconnecté de toutes les applications et de tous les appareils qui utilisent l’ancien mot de passe.",
|
||||
"New password set for {address}": "Nouveau mot de passe défini pour {address}",
|
||||
"Set password": "Définir le mot de passe",
|
||||
"Remove {address}": "Retirer {address}",
|
||||
"New address": "Nouvelle adresse",
|
||||
"another name": "autre nom",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "Les messages envoyés à ces adresses sont remis à ce compte. Les modifications s’appliquent à l’enregistrement.",
|
||||
"Deletes the mailbox and everything in it.": "Supprime la boîte aux lettres et tout son contenu.",
|
||||
"Delete account…": "Supprimer le compte…",
|
||||
"Delete {address}?": "Supprimer {address} ?",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "Cette action supprime les messages, agendas, contacts et fichiers de ce compte. Le serveur les efface en arrière-plan, et c’est irréversible.",
|
||||
"Type {address} to confirm": "Saisissez {address} pour confirmer",
|
||||
"Delete account": "Supprimer le compte",
|
||||
"Deleted {address}": "{address} supprimé",
|
||||
"The server did not say whether the account was created.": "Le serveur n’a pas indiqué si le compte a été créé.",
|
||||
"The mail server refused this. Your role may not allow it.": "Le serveur de messagerie a refusé. Votre rôle ne le permet peut-être pas.",
|
||||
"The mail server refused this: {reason}": "Le serveur de messagerie a refusé : {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "Cette adresse est déjà utilisée sur ce serveur, par un compte, une liste ou un alias.",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "Le domaine, le rôle ou le groupe choisi ne peut pas être utilisé pour ce compte.",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "Votre organisation a atteint le nombre de comptes autorisé.",
|
||||
"Something still depends on this, so the server kept it.": "Un autre élément en dépend encore, le serveur l’a donc conservé.",
|
||||
"This account no longer exists. Someone may have deleted it.": "Ce compte n’existe plus. Quelqu’un l’a peut-être supprimé.",
|
||||
"The password was not accepted: {reason}": "Le mot de passe a été refusé : {reason}",
|
||||
"The password was not accepted.": "Le mot de passe a été refusé.",
|
||||
"The mail server rejected a value: {reason}": "Le serveur de messagerie a refusé une valeur : {reason}",
|
||||
"The mail server rejected a value.": "Le serveur de messagerie a refusé une valeur.",
|
||||
"Go to folder…": "Aller au dossier…",
|
||||
"Set for everyone here. You cannot change this.": "Défini pour tout le monde ici. Vous ne pouvez pas le modifier.",
|
||||
"Export iCAL file": "Exporter un fichier iCAL",
|
||||
@@ -1353,6 +1422,8 @@ export const catalog: Catalog = {
|
||||
"no address": "aucune adresse",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { one: "{n} compte", other: "{n} comptes" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { one: "Supprimer {n} élément", other: "Supprimer {n} éléments" },
|
||||
"Delete {n} items?": { one: "Supprimer {n} élément ?", other: "Supprimer {n} éléments ?" },
|
||||
|
||||
@@ -46,6 +46,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "ご自身のパスワードは{settings}で変更してください。",
|
||||
"Administration": "管理",
|
||||
"Directory": "ディレクトリ",
|
||||
"User": "ユーザー",
|
||||
"Administrator": "管理者",
|
||||
"Custom role": "カスタムロール",
|
||||
"New account": "新しいアカウント",
|
||||
"The people who sign in to mail on the domains you manage.": "管理しているドメインでメールにサインインするユーザーです。",
|
||||
"Search by name or address": "名前またはアドレスで検索",
|
||||
"Search accounts": "アカウントを検索",
|
||||
"No accounts match": "一致するアカウントはありません",
|
||||
"No accounts yet": "アカウントはまだありません",
|
||||
"Nothing on your domains matches “{query}”.": "ドメイン内に「{query}」と一致するものはありません。",
|
||||
"Open {address}": "{address} を開く",
|
||||
"{from}–{to} of {total}": "{from}–{to} / {total}",
|
||||
"Previous page": "前のページ",
|
||||
"Next page": "次のページ",
|
||||
"Storage": "ストレージ",
|
||||
"Groups": "グループ",
|
||||
"{used} · no limit": "{used} · 上限なし",
|
||||
"Profile": "プロフィール",
|
||||
"Domain": "ドメイン",
|
||||
"No domains are available to create an account on.": "アカウントを作成できるドメインがありません。",
|
||||
"Sign-in": "サインイン",
|
||||
"Other addresses": "その他のアドレス",
|
||||
"Not in any group": "どのグループにも属していません",
|
||||
"You can't change your own role.": "自分のロールは変更できません。",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "ご自身が持つ権限だけで構成されたロールのみ表示されます。テナント内のアカウントでは、管理者はそのテナントの管理者を意味します。",
|
||||
"Limit in GB": "上限（GB）",
|
||||
"No limit": "上限なし",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "このアカウントにはあなたのアカウントにない権限があるため、閲覧はできますが変更はできません。",
|
||||
"Your role lets you view accounts but not change them.": "あなたのロールでは、アカウントの閲覧はできますが変更はできません。",
|
||||
"This account has permissions yours doesn't.": "このアカウントにはあなたのアカウントにない権限があります。",
|
||||
"You can't delete the account you're signed in with.": "サインイン中のアカウントは削除できません。",
|
||||
"Create account": "アカウントを作成",
|
||||
"An account needs an address.": "アカウントにはアドレスが必要です。",
|
||||
"Created {address}": "{address} を作成しました",
|
||||
"Saved {address}": "{address} を保存しました",
|
||||
"Generate a password": "パスワードを生成",
|
||||
"Pass it on some way other than email to this address.": "このアドレス宛てのメール以外の方法で伝えてください。",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "このアカウントにはパスワードがありません。ディレクトリやシングルサインオンでサインインしている可能性があります。",
|
||||
"Set a new password…": "新しいパスワードを設定…",
|
||||
"{name} will be signed out of every app and device using the old password.": "{name} は、古いパスワードを使っているすべてのアプリとデバイスからサインアウトされます。",
|
||||
"New password set for {address}": "{address} の新しいパスワードを設定しました",
|
||||
"Set password": "パスワードを設定",
|
||||
"Remove {address}": "{address} を削除",
|
||||
"New address": "新しいアドレス",
|
||||
"another name": "別の名前",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "これらのアドレス宛てのメールはこのアカウントに配信されます。変更は保存時に反映されます。",
|
||||
"Deletes the mailbox and everything in it.": "メールボックスとその中身をすべて削除します。",
|
||||
"Delete account…": "アカウントを削除…",
|
||||
"Delete {address}?": "{address} を削除しますか？",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "このアカウントのメール、カレンダー、連絡先、ファイルが削除されます。サーバーがバックグラウンドで削除し、元に戻すことはできません。",
|
||||
"Type {address} to confirm": "確認のため {address} と入力してください",
|
||||
"Delete account": "アカウントを削除",
|
||||
"Deleted {address}": "{address} を削除しました",
|
||||
"The server did not say whether the account was created.": "アカウントが作成されたかどうか、サーバーから応答がありませんでした。",
|
||||
"The mail server refused this. Your role may not allow it.": "メールサーバーに拒否されました。ロールで許可されていない可能性があります。",
|
||||
"The mail server refused this: {reason}": "メールサーバーに拒否されました: {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "このアドレスは、アカウント、リスト、またはエイリアスとして、このサーバーですでに使われています。",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "選択したドメイン、ロール、またはグループはこのアカウントには使えません。",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "組織で許可されているアカウント数の上限に達しました。",
|
||||
"Something still depends on this, so the server kept it.": "まだこれに依存しているものがあるため、サーバーは削除しませんでした。",
|
||||
"This account no longer exists. Someone may have deleted it.": "このアカウントはもう存在しません。誰かが削除した可能性があります。",
|
||||
"The password was not accepted: {reason}": "パスワードは受け付けられませんでした: {reason}",
|
||||
"The password was not accepted.": "パスワードは受け付けられませんでした。",
|
||||
"The mail server rejected a value: {reason}": "メールサーバーが値を拒否しました: {reason}",
|
||||
"The mail server rejected a value.": "メールサーバーが値を拒否しました。",
|
||||
"Go to folder…": "フォルダーへ移動…",
|
||||
"Set for everyone here. You cannot change this.": "この環境全体で設定されています。変更できません。",
|
||||
"Export iCAL file": "iCAL ファイルをエクスポート",
|
||||
@@ -1356,6 +1425,8 @@ export const catalog: Catalog = {
|
||||
"no address": "アドレスなし",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { other: "{n} 件のアカウント" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { other: "{n} 件を削除" },
|
||||
"Delete {n} items?": { other: "{n} 件を削除しますか？" },
|
||||
|
||||
@@ -43,6 +43,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "Wijzig uw eigen wachtwoord bij {settings}.",
|
||||
"Administration": "Beheer",
|
||||
"Directory": "Adreslijst",
|
||||
"User": "Gebruiker",
|
||||
"Administrator": "Beheerder",
|
||||
"Custom role": "Aangepaste rol",
|
||||
"New account": "Nieuw account",
|
||||
"The people who sign in to mail on the domains you manage.": "De mensen die op de domeinen die u beheert inloggen op hun e-mail.",
|
||||
"Search by name or address": "Zoeken op naam of adres",
|
||||
"Search accounts": "Accounts zoeken",
|
||||
"No accounts match": "Geen accounts gevonden",
|
||||
"No accounts yet": "Nog geen accounts",
|
||||
"Nothing on your domains matches “{query}”.": "Niets op uw domeinen komt overeen met ‘{query}’.",
|
||||
"Open {address}": "{address} openen",
|
||||
"{from}–{to} of {total}": "{from}–{to} van {total}",
|
||||
"Previous page": "Vorige pagina",
|
||||
"Next page": "Volgende pagina",
|
||||
"Storage": "Opslag",
|
||||
"Groups": "Groepen",
|
||||
"{used} · no limit": "{used} · geen limiet",
|
||||
"Profile": "Profiel",
|
||||
"Domain": "Domein",
|
||||
"No domains are available to create an account on.": "Er is geen domein beschikbaar om een account op aan te maken.",
|
||||
"Sign-in": "Inloggen",
|
||||
"Other addresses": "Andere adressen",
|
||||
"Not in any group": "Geen lid van een groep",
|
||||
"You can't change your own role.": "U kunt uw eigen rol niet wijzigen.",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "Alleen rollen waarvan u de rechten zelf hebt, worden aangeboden. Bij een account binnen een tenant betekent Beheerder: beheerder van die tenant.",
|
||||
"Limit in GB": "Limiet in GB",
|
||||
"No limit": "Geen limiet",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "Dit account heeft rechten die het uwe niet heeft. U kunt het bekijken, maar niet wijzigen.",
|
||||
"Your role lets you view accounts but not change them.": "Met uw rol kunt u accounts bekijken, maar niet wijzigen.",
|
||||
"This account has permissions yours doesn't.": "Dit account heeft rechten die het uwe niet heeft.",
|
||||
"You can't delete the account you're signed in with.": "U kunt het account waarmee u bent ingelogd niet verwijderen.",
|
||||
"Create account": "Account aanmaken",
|
||||
"An account needs an address.": "Een account heeft een adres nodig.",
|
||||
"Created {address}": "{address} aangemaakt",
|
||||
"Saved {address}": "{address} opgeslagen",
|
||||
"Generate a password": "Wachtwoord genereren",
|
||||
"Pass it on some way other than email to this address.": "Geef het door op een andere manier dan per e-mail naar dit adres.",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "Dit account heeft geen wachtwoord. Mogelijk logt het in via een adreslijst of single sign-on.",
|
||||
"Set a new password…": "Nieuw wachtwoord instellen…",
|
||||
"{name} will be signed out of every app and device using the old password.": "{name} wordt uitgelogd in alle apps en op alle apparaten die het oude wachtwoord gebruiken.",
|
||||
"New password set for {address}": "Nieuw wachtwoord ingesteld voor {address}",
|
||||
"Set password": "Wachtwoord instellen",
|
||||
"Remove {address}": "{address} verwijderen",
|
||||
"New address": "Nieuw adres",
|
||||
"another name": "andere naam",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "E-mail aan deze adressen wordt in dit account afgeleverd. Wijzigingen gelden na opslaan.",
|
||||
"Deletes the mailbox and everything in it.": "Verwijdert de mailbox en alles erin.",
|
||||
"Delete account…": "Account verwijderen…",
|
||||
"Delete {address}?": "{address} verwijderen?",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "Hiermee worden de e-mail, agenda’s, contacten en bestanden in dit account verwijderd. De server wist ze op de achtergrond en dit kan niet ongedaan worden gemaakt.",
|
||||
"Type {address} to confirm": "Typ {address} om te bevestigen",
|
||||
"Delete account": "Account verwijderen",
|
||||
"Deleted {address}": "{address} verwijderd",
|
||||
"The server did not say whether the account was created.": "De server heeft niet gemeld of het account is aangemaakt.",
|
||||
"The mail server refused this. Your role may not allow it.": "De mailserver heeft dit geweigerd. Uw rol staat het mogelijk niet toe.",
|
||||
"The mail server refused this: {reason}": "De mailserver heeft dit geweigerd: {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "Dat adres is op deze server al in gebruik, als account, lijst of alias.",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "Het gekozen domein, de rol of de groep kan niet voor dit account worden gebruikt.",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "Uw organisatie heeft het toegestane aantal accounts bereikt.",
|
||||
"Something still depends on this, so the server kept it.": "Er hangt nog iets van af, dus de server heeft het behouden.",
|
||||
"This account no longer exists. Someone may have deleted it.": "Dit account bestaat niet meer. Mogelijk heeft iemand het verwijderd.",
|
||||
"The password was not accepted: {reason}": "Het wachtwoord is niet geaccepteerd: {reason}",
|
||||
"The password was not accepted.": "Het wachtwoord is niet geaccepteerd.",
|
||||
"The mail server rejected a value: {reason}": "De mailserver heeft een waarde geweigerd: {reason}",
|
||||
"The mail server rejected a value.": "De mailserver heeft een waarde geweigerd.",
|
||||
"Go to folder…": "Ga naar map…",
|
||||
"Set for everyone here. You cannot change this.": "Hier voor iedereen ingesteld. U kunt dit niet wijzigen.",
|
||||
"Export iCAL file": "iCAL-bestand exporteren",
|
||||
@@ -1344,6 +1413,8 @@ export const catalog: Catalog = {
|
||||
"no address": "geen adres",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { one: "{n} account", other: "{n} accounts" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { one: "{n} item verwijderen", other: "{n} items verwijderen" },
|
||||
"Delete {n} items?": { one: "{n} item verwijderen?", other: "{n} items verwijderen?" },
|
||||
|
||||
@@ -50,6 +50,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "Altere sua própria senha em {settings}.",
|
||||
"Administration": "Administração",
|
||||
"Directory": "Diretório",
|
||||
"User": "Usuário",
|
||||
"Administrator": "Administrador",
|
||||
"Custom role": "Função personalizada",
|
||||
"New account": "Nova conta",
|
||||
"The people who sign in to mail on the domains you manage.": "As pessoas que entram no e-mail nos domínios que você administra.",
|
||||
"Search by name or address": "Pesquisar por nome ou endereço",
|
||||
"Search accounts": "Pesquisar contas",
|
||||
"No accounts match": "Nenhuma conta corresponde",
|
||||
"No accounts yet": "Ainda não há contas",
|
||||
"Nothing on your domains matches “{query}”.": "Nada nos seus domínios corresponde a “{query}”.",
|
||||
"Open {address}": "Abrir {address}",
|
||||
"{from}–{to} of {total}": "{from}–{to} de {total}",
|
||||
"Previous page": "Página anterior",
|
||||
"Next page": "Próxima página",
|
||||
"Storage": "Armazenamento",
|
||||
"Groups": "Grupos",
|
||||
"{used} · no limit": "{used} · sem limite",
|
||||
"Profile": "Perfil",
|
||||
"Domain": "Domínio",
|
||||
"No domains are available to create an account on.": "Não há nenhum domínio disponível para criar uma conta.",
|
||||
"Sign-in": "Acesso",
|
||||
"Other addresses": "Outros endereços",
|
||||
"Not in any group": "Não está em nenhum grupo",
|
||||
"You can't change your own role.": "Você não pode alterar sua própria função.",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "Só são oferecidas as funções cujas permissões você mesmo tem. Em uma conta dentro de um locatário, Administrador significa administrador desse locatário.",
|
||||
"Limit in GB": "Limite em GB",
|
||||
"No limit": "Sem limite",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "Esta conta tem permissões que a sua não tem, então você pode vê-la, mas não alterá-la.",
|
||||
"Your role lets you view accounts but not change them.": "Sua função permite ver as contas, mas não alterá-las.",
|
||||
"This account has permissions yours doesn't.": "Esta conta tem permissões que a sua não tem.",
|
||||
"You can't delete the account you're signed in with.": "Você não pode excluir a conta com a qual está conectado.",
|
||||
"Create account": "Criar conta",
|
||||
"An account needs an address.": "Uma conta precisa de um endereço.",
|
||||
"Created {address}": "{address} criada",
|
||||
"Saved {address}": "{address} salva",
|
||||
"Generate a password": "Gerar uma senha",
|
||||
"Pass it on some way other than email to this address.": "Repasse-a por outro meio que não seja um e-mail para este endereço.",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "Esta conta não tem senha. Ela pode entrar por meio de um diretório ou de login único.",
|
||||
"Set a new password…": "Definir nova senha…",
|
||||
"{name} will be signed out of every app and device using the old password.": "{name} será desconectado de todos os apps e dispositivos que usam a senha antiga.",
|
||||
"New password set for {address}": "Nova senha definida para {address}",
|
||||
"Set password": "Definir senha",
|
||||
"Remove {address}": "Remover {address}",
|
||||
"New address": "Novo endereço",
|
||||
"another name": "outro nome",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "Os e-mails enviados a estes endereços são entregues nesta conta. As alterações valem ao salvar.",
|
||||
"Deletes the mailbox and everything in it.": "Exclui a caixa de correio e tudo o que há nela.",
|
||||
"Delete account…": "Excluir conta…",
|
||||
"Delete {address}?": "Excluir {address}?",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "Isto exclui os e-mails, agendas, contatos e arquivos desta conta. O servidor os remove em segundo plano, e não é possível desfazer.",
|
||||
"Type {address} to confirm": "Digite {address} para confirmar",
|
||||
"Delete account": "Excluir conta",
|
||||
"Deleted {address}": "{address} excluída",
|
||||
"The server did not say whether the account was created.": "O servidor não informou se a conta foi criada.",
|
||||
"The mail server refused this. Your role may not allow it.": "O servidor de e-mail recusou. Talvez sua função não permita.",
|
||||
"The mail server refused this: {reason}": "O servidor de e-mail recusou: {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "Esse endereço já está em uso neste servidor, como conta, lista ou alias.",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "O domínio, a função ou o grupo escolhido não pode ser usado nesta conta.",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "Sua organização atingiu o número de contas permitido.",
|
||||
"Something still depends on this, so the server kept it.": "Algo ainda depende disto, então o servidor o manteve.",
|
||||
"This account no longer exists. Someone may have deleted it.": "Esta conta não existe mais. Talvez alguém a tenha excluído.",
|
||||
"The password was not accepted: {reason}": "A senha não foi aceita: {reason}",
|
||||
"The password was not accepted.": "A senha não foi aceita.",
|
||||
"The mail server rejected a value: {reason}": "O servidor de e-mail recusou um valor: {reason}",
|
||||
"The mail server rejected a value.": "O servidor de e-mail recusou um valor.",
|
||||
"Go to folder…": "Ir para a pasta…",
|
||||
"Set for everyone here. You cannot change this.": "Definido para todos aqui. Você não pode alterar isto.",
|
||||
"Export iCAL file": "Exportar arquivo iCAL",
|
||||
@@ -1351,6 +1420,8 @@ export const catalog: Catalog = {
|
||||
"no address": "nenhum endereço",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { one: "{n} conta", other: "{n} contas" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { one: "Excluir {n} item", other: "Excluir {n} itens" },
|
||||
"Delete {n} items?": { one: "Excluir {n} item?", other: "Excluir {n} itens?" },
|
||||
|
||||
@@ -49,6 +49,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "Свой пароль можно изменить в разделе {settings}.",
|
||||
"Administration": "Администрирование",
|
||||
"Directory": "Каталог",
|
||||
"User": "Пользователь",
|
||||
"Administrator": "Администратор",
|
||||
"Custom role": "Особая роль",
|
||||
"New account": "Новая учётная запись",
|
||||
"The people who sign in to mail on the domains you manage.": "Люди, которые входят в почту на доменах, которыми вы управляете.",
|
||||
"Search by name or address": "Поиск по имени или адресу",
|
||||
"Search accounts": "Поиск учётных записей",
|
||||
"No accounts match": "Нет подходящих учётных записей",
|
||||
"No accounts yet": "Учётных записей пока нет",
|
||||
"Nothing on your domains matches “{query}”.": "На ваших доменах нет совпадений с «{query}».",
|
||||
"Open {address}": "Открыть {address}",
|
||||
"{from}–{to} of {total}": "{from}–{to} из {total}",
|
||||
"Previous page": "Предыдущая страница",
|
||||
"Next page": "Следующая страница",
|
||||
"Storage": "Хранилище",
|
||||
"Groups": "Группы",
|
||||
"{used} · no limit": "{used} · без ограничения",
|
||||
"Profile": "Профиль",
|
||||
"Domain": "Домен",
|
||||
"No domains are available to create an account on.": "Нет доменов, на которых можно создать учётную запись.",
|
||||
"Sign-in": "Вход",
|
||||
"Other addresses": "Другие адреса",
|
||||
"Not in any group": "Не состоит ни в одной группе",
|
||||
"You can't change your own role.": "Нельзя изменить собственную роль.",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "Предлагаются только роли, все разрешения которых есть у вас самих. Для учётной записи внутри арендатора «Администратор» означает администратора этого арендатора.",
|
||||
"Limit in GB": "Ограничение в ГБ",
|
||||
"No limit": "Без ограничения",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "У этой учётной записи есть разрешения, которых нет у вашей, поэтому её можно просматривать, но не изменять.",
|
||||
"Your role lets you view accounts but not change them.": "Ваша роль позволяет просматривать учётные записи, но не изменять их.",
|
||||
"This account has permissions yours doesn't.": "У этой учётной записи есть разрешения, которых нет у вашей.",
|
||||
"You can't delete the account you're signed in with.": "Нельзя удалить учётную запись, под которой вы вошли.",
|
||||
"Create account": "Создать учётную запись",
|
||||
"An account needs an address.": "Учётной записи нужен адрес.",
|
||||
"Created {address}": "Учётная запись {address} создана",
|
||||
"Saved {address}": "Учётная запись {address} сохранена",
|
||||
"Generate a password": "Сгенерировать пароль",
|
||||
"Pass it on some way other than email to this address.": "Передайте его любым способом, кроме письма на этот адрес.",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "У этой учётной записи нет пароля. Возможно, вход выполняется через каталог или единый вход.",
|
||||
"Set a new password…": "Задать новый пароль…",
|
||||
"{name} will be signed out of every app and device using the old password.": "Для {name} будет выполнен выход во всех приложениях и на всех устройствах, где используется старый пароль.",
|
||||
"New password set for {address}": "Новый пароль для {address} задан",
|
||||
"Set password": "Задать пароль",
|
||||
"Remove {address}": "Удалить {address}",
|
||||
"New address": "Новый адрес",
|
||||
"another name": "другое имя",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "Письма на эти адреса доставляются в эту учётную запись. Изменения вступят в силу после сохранения.",
|
||||
"Deletes the mailbox and everything in it.": "Удаляет почтовый ящик и всё его содержимое.",
|
||||
"Delete account…": "Удалить учётную запись…",
|
||||
"Delete {address}?": "Удалить {address}?",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "Будут удалены почта, календари, контакты и файлы этой учётной записи. Сервер удалит их в фоновом режиме, отменить это нельзя.",
|
||||
"Type {address} to confirm": "Введите {address} для подтверждения",
|
||||
"Delete account": "Удалить учётную запись",
|
||||
"Deleted {address}": "Учётная запись {address} удалена",
|
||||
"The server did not say whether the account was created.": "Сервер не сообщил, создана ли учётная запись.",
|
||||
"The mail server refused this. Your role may not allow it.": "Почтовый сервер отклонил это действие. Возможно, ваша роль его не допускает.",
|
||||
"The mail server refused this: {reason}": "Почтовый сервер отклонил это действие: {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "Этот адрес уже используется на сервере — учётной записью, списком или псевдонимом.",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "Выбранный домен, роль или группу нельзя использовать для этой учётной записи.",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "Ваша организация достигла допустимого числа учётных записей.",
|
||||
"Something still depends on this, so the server kept it.": "От этого ещё что-то зависит, поэтому сервер это сохранил.",
|
||||
"This account no longer exists. Someone may have deleted it.": "Этой учётной записи больше нет. Возможно, её кто-то удалил.",
|
||||
"The password was not accepted: {reason}": "Пароль не принят: {reason}",
|
||||
"The password was not accepted.": "Пароль не принят.",
|
||||
"The mail server rejected a value: {reason}": "Почтовый сервер отклонил значение: {reason}",
|
||||
"The mail server rejected a value.": "Почтовый сервер отклонил значение.",
|
||||
"Go to folder…": "Перейти к папке…",
|
||||
"Set for everyone here. You cannot change this.": "Задано для всех здесь. Изменить нельзя.",
|
||||
"Export iCAL file": "Экспортировать файл iCAL",
|
||||
@@ -1350,6 +1419,8 @@ export const catalog: Catalog = {
|
||||
"no address": "нет адреса",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { one: "{n} учётная запись", few: "{n} учётные записи", many: "{n} учётных записей", other: "{n} учётной записи" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { one: "Удалить {n} объект", few: "Удалить {n} объекта", many: "Удалить {n} объектов", other: "Удалить {n} объекта" },
|
||||
"Delete {n} items?": { one: "Удалить {n} объект?", few: "Удалить {n} объекта?", many: "Удалить {n} объектов?", other: "Удалить {n} объекта?" },
|
||||
|
||||
@@ -43,6 +43,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "Власний пароль можна змінити в розділі {settings}.",
|
||||
"Administration": "Адміністрування",
|
||||
"Directory": "Каталог",
|
||||
"User": "Користувач",
|
||||
"Administrator": "Адміністратор",
|
||||
"Custom role": "Власна роль",
|
||||
"New account": "Новий обліковий запис",
|
||||
"The people who sign in to mail on the domains you manage.": "Люди, які входять у пошту на доменах, якими ви керуєте.",
|
||||
"Search by name or address": "Пошук за іменем або адресою",
|
||||
"Search accounts": "Пошук облікових записів",
|
||||
"No accounts match": "Немає відповідних облікових записів",
|
||||
"No accounts yet": "Облікових записів ще немає",
|
||||
"Nothing on your domains matches “{query}”.": "На ваших доменах немає збігів із «{query}».",
|
||||
"Open {address}": "Відкрити {address}",
|
||||
"{from}–{to} of {total}": "{from}–{to} із {total}",
|
||||
"Previous page": "Попередня сторінка",
|
||||
"Next page": "Наступна сторінка",
|
||||
"Storage": "Сховище",
|
||||
"Groups": "Групи",
|
||||
"{used} · no limit": "{used} · без обмеження",
|
||||
"Profile": "Профіль",
|
||||
"Domain": "Домен",
|
||||
"No domains are available to create an account on.": "Немає доменів, на яких можна створити обліковий запис.",
|
||||
"Sign-in": "Вхід",
|
||||
"Other addresses": "Інші адреси",
|
||||
"Not in any group": "Не входить до жодної групи",
|
||||
"You can't change your own role.": "Ви не можете змінити власну роль.",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "Пропонуються лише ролі, усі дозволи яких маєте ви самі. Для облікового запису всередині орендаря «Адміністратор» означає адміністратора цього орендаря.",
|
||||
"Limit in GB": "Обмеження в ГБ",
|
||||
"No limit": "Без обмеження",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "Цей обліковий запис має дозволи, яких немає у вашого, тому його можна переглядати, але не змінювати.",
|
||||
"Your role lets you view accounts but not change them.": "Ваша роль дозволяє переглядати облікові записи, але не змінювати їх.",
|
||||
"This account has permissions yours doesn't.": "Цей обліковий запис має дозволи, яких немає у вашого.",
|
||||
"You can't delete the account you're signed in with.": "Не можна видалити обліковий запис, під яким ви ввійшли.",
|
||||
"Create account": "Створити обліковий запис",
|
||||
"An account needs an address.": "Обліковому запису потрібна адреса.",
|
||||
"Created {address}": "Обліковий запис {address} створено",
|
||||
"Saved {address}": "Обліковий запис {address} збережено",
|
||||
"Generate a password": "Згенерувати пароль",
|
||||
"Pass it on some way other than email to this address.": "Передайте його будь-яким способом, окрім листа на цю адресу.",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "Цей обліковий запис не має пароля. Можливо, вхід виконується через каталог або єдиний вхід.",
|
||||
"Set a new password…": "Задати новий пароль…",
|
||||
"{name} will be signed out of every app and device using the old password.": "Для {name} буде виконано вихід у всіх застосунках і на всіх пристроях, де використовується старий пароль.",
|
||||
"New password set for {address}": "Новий пароль для {address} задано",
|
||||
"Set password": "Задати пароль",
|
||||
"Remove {address}": "Видалити {address}",
|
||||
"New address": "Нова адреса",
|
||||
"another name": "інше ім'я",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "Листи на ці адреси доставляються в цей обліковий запис. Зміни наберуть чинності після збереження.",
|
||||
"Deletes the mailbox and everything in it.": "Видаляє поштову скриньку й усе, що в ній.",
|
||||
"Delete account…": "Видалити обліковий запис…",
|
||||
"Delete {address}?": "Видалити {address}?",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "Буде видалено пошту, календарі, контакти й файли цього облікового запису. Сервер видалить їх у фоновому режимі, скасувати це неможливо.",
|
||||
"Type {address} to confirm": "Введіть {address} для підтвердження",
|
||||
"Delete account": "Видалити обліковий запис",
|
||||
"Deleted {address}": "Обліковий запис {address} видалено",
|
||||
"The server did not say whether the account was created.": "Сервер не повідомив, чи створено обліковий запис.",
|
||||
"The mail server refused this. Your role may not allow it.": "Поштовий сервер відхилив цю дію. Можливо, ваша роль її не дозволяє.",
|
||||
"The mail server refused this: {reason}": "Поштовий сервер відхилив цю дію: {reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "Ця адреса вже використовується на сервері — обліковим записом, списком або псевдонімом.",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "Вибраний домен, роль або групу не можна використати для цього облікового запису.",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "Ваша організація досягла дозволеної кількості облікових записів.",
|
||||
"Something still depends on this, so the server kept it.": "Від цього ще щось залежить, тому сервер це зберіг.",
|
||||
"This account no longer exists. Someone may have deleted it.": "Цього облікового запису більше немає. Можливо, його хтось видалив.",
|
||||
"The password was not accepted: {reason}": "Пароль не прийнято: {reason}",
|
||||
"The password was not accepted.": "Пароль не прийнято.",
|
||||
"The mail server rejected a value: {reason}": "Поштовий сервер відхилив значення: {reason}",
|
||||
"The mail server rejected a value.": "Поштовий сервер відхилив значення.",
|
||||
"Go to folder…": "Перейти до теки…",
|
||||
"Set for everyone here. You cannot change this.": "Задано для всіх тут. Змінити не можна.",
|
||||
"Export iCAL file": "Експортувати файл iCAL",
|
||||
@@ -1344,6 +1413,8 @@ export const catalog: Catalog = {
|
||||
"no address": "немає адреси",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { one: "{n} обліковий запис", few: "{n} облікові записи", many: "{n} облікових записів", other: "{n} облікового запису" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { one: "Видалити {n} об’єкт", few: "Видалити {n} об’єкти", many: "Видалити {n} об’єктів", other: "Видалити {n} об’єкта" },
|
||||
"Delete {n} items?": { one: "Видалити {n} об’єкт?", few: "Видалити {n} об’єкти?", many: "Видалити {n} об’єктів?", other: "Видалити {n} об’єкта?" },
|
||||
|
||||
@@ -45,6 +45,75 @@ import type { Catalog } from "@/lib/i18n";
|
||||
*/
|
||||
export const catalog: Catalog = {
|
||||
strings: {
|
||||
// ── Administration: accounts ───────────────────────────────────
|
||||
"Change your own password in {settings}.": "请在{settings}中更改您自己的密码。",
|
||||
"Administration": "管理",
|
||||
"Directory": "目录",
|
||||
"User": "用户",
|
||||
"Administrator": "管理员",
|
||||
"Custom role": "自定义角色",
|
||||
"New account": "新建账户",
|
||||
"The people who sign in to mail on the domains you manage.": "在您管理的域名上登录邮箱的人员。",
|
||||
"Search by name or address": "按姓名或地址搜索",
|
||||
"Search accounts": "搜索账户",
|
||||
"No accounts match": "没有匹配的账户",
|
||||
"No accounts yet": "暂无账户",
|
||||
"Nothing on your domains matches “{query}”.": "您的域名中没有与「{query}」匹配的内容。",
|
||||
"Open {address}": "打开 {address}",
|
||||
"{from}–{to} of {total}": "第 {from}–{to} 个，共 {total} 个",
|
||||
"Previous page": "上一页",
|
||||
"Next page": "下一页",
|
||||
"Storage": "存储",
|
||||
"Groups": "群组",
|
||||
"{used} · no limit": "{used} · 无限制",
|
||||
"Profile": "资料",
|
||||
"Domain": "域名",
|
||||
"No domains are available to create an account on.": "没有可用于创建账户的域名。",
|
||||
"Sign-in": "登录",
|
||||
"Other addresses": "其他地址",
|
||||
"Not in any group": "不属于任何群组",
|
||||
"You can't change your own role.": "您无法更改自己的角色。",
|
||||
"Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "仅提供您本人拥有其全部权限的角色。对于租户内的账户，管理员指的是该租户的管理员。",
|
||||
"Limit in GB": "限额（GB）",
|
||||
"No limit": "无限制",
|
||||
"This account has permissions yours doesn't, so you can view it but not change it.": "该账户拥有您的账户所没有的权限，因此您只能查看，无法更改。",
|
||||
"Your role lets you view accounts but not change them.": "您的角色可以查看账户，但不能更改。",
|
||||
"This account has permissions yours doesn't.": "该账户拥有您的账户所没有的权限。",
|
||||
"You can't delete the account you're signed in with.": "您无法删除当前登录的账户。",
|
||||
"Create account": "创建账户",
|
||||
"An account needs an address.": "账户需要一个地址。",
|
||||
"Created {address}": "已创建 {address}",
|
||||
"Saved {address}": "已保存 {address}",
|
||||
"Generate a password": "生成密码",
|
||||
"Pass it on some way other than email to this address.": "请通过发往此地址的邮件以外的方式转交。",
|
||||
"This account has no password. It may sign in through a directory or single sign-on.": "该账户没有密码，可能通过目录服务或单点登录进行登录。",
|
||||
"Set a new password…": "设置新密码…",
|
||||
"{name} will be signed out of every app and device using the old password.": "{name} 将在所有使用旧密码的应用和设备上被退出登录。",
|
||||
"New password set for {address}": "已为 {address} 设置新密码",
|
||||
"Set password": "设置密码",
|
||||
"Remove {address}": "移除 {address}",
|
||||
"New address": "新地址",
|
||||
"another name": "其他名称",
|
||||
"Mail to these addresses is delivered to this account. Changes apply when you save.": "发往这些地址的邮件会投递到此账户。更改在保存后生效。",
|
||||
"Deletes the mailbox and everything in it.": "删除邮箱及其中的全部内容。",
|
||||
"Delete account…": "删除账户…",
|
||||
"Delete {address}?": "删除 {address}？",
|
||||
"This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "这将删除此账户中的邮件、日历、联系人和文件。服务器会在后台移除它们，且无法撤销。",
|
||||
"Type {address} to confirm": "输入 {address} 以确认",
|
||||
"Delete account": "删除账户",
|
||||
"Deleted {address}": "已删除 {address}",
|
||||
"The server did not say whether the account was created.": "服务器没有说明账户是否已创建。",
|
||||
"The mail server refused this. Your role may not allow it.": "邮件服务器拒绝了此操作。您的角色可能不允许。",
|
||||
"The mail server refused this: {reason}": "邮件服务器拒绝了此操作：{reason}",
|
||||
"That address is already in use on this server, as an account, a list or an alias.": "该地址已在此服务器上被账户、列表或别名使用。",
|
||||
"One of the chosen domain, role or group can't be used for this account.": "所选的域名、角色或群组无法用于此账户。",
|
||||
"Your organisation has reached the number of accounts it is allowed.": "您的组织已达到允许的账户数量上限。",
|
||||
"Something still depends on this, so the server kept it.": "仍有其他内容依赖于它，因此服务器保留了它。",
|
||||
"This account no longer exists. Someone may have deleted it.": "该账户已不存在，可能已被他人删除。",
|
||||
"The password was not accepted: {reason}": "密码未被接受：{reason}",
|
||||
"The password was not accepted.": "密码未被接受。",
|
||||
"The mail server rejected a value: {reason}": "邮件服务器拒绝了一个值：{reason}",
|
||||
"The mail server rejected a value.": "邮件服务器拒绝了一个值。",
|
||||
"Go to folder…": "转到文件夹…",
|
||||
"Set for everyone here. You cannot change this.": "已为此处所有人设定，您无法更改。",
|
||||
"Export iCAL file": "导出 iCAL 文件",
|
||||
@@ -1355,6 +1424,8 @@ export const catalog: Catalog = {
|
||||
"no address": "无地址",
|
||||
},
|
||||
plurals: {
|
||||
// ── Administration ────────────────────────────────────────────────
|
||||
"{n} accounts": { other: "{n} 个账户" },
|
||||
// ── Third pass ─────────────────────────────────────────────────────
|
||||
"Delete {n} items": { other: "删除 {n} 个项目" },
|
||||
"Delete {n} items?": { other: "要删除 {n} 个项目吗？" },
|
||||
|
||||
@@ -1673,6 +1673,62 @@ select optgroup { background-color: var(--bg-elev); color: var(--fg); }
|
||||
.sessions-table th, .sessions-table td { text-align: left; padding: 8px 10px; border-bottom: 1px solid var(--border); }
|
||||
.sessions-table th { color: var(--fg-muted); font-weight: 600; font-size: .85em; }
|
||||
|
||||
/* ==========================================================================
|
||||
Administration
|
||||
Settings' layout, with a table for the list and a panel beside it for the
|
||||
one that is open. The panel is positioned against the layout rather than the
|
||||
scrolling content, so it stays put while the list scrolls under it.
|
||||
========================================================================== */
|
||||
.admin-layout { position: relative; }
|
||||
.admin-content { max-width: 960px; }
|
||||
.admin-head { display: flex; align-items: flex-start; gap: 16px; flex-wrap: wrap; }
|
||||
.admin-head .grow { min-width: 220px; }
|
||||
.admin-toolbar { display: flex; gap: 8px; align-items: center; margin-bottom: 12px; }
|
||||
.admin-search { position: relative; flex: 1; max-width: 360px; }
|
||||
.admin-search svg { position: absolute; left: 10px; top: 50%; transform: translateY(-50%); color: var(--fg-faint); pointer-events: none; }
|
||||
.admin-search .input { width: 100%; padding-left: 34px; }
|
||||
.admin-table-wrap { border: 1px solid var(--border); border-radius: var(--radius); overflow-x: auto; }
|
||||
.admin-table { width: 100%; border-collapse: collapse; font-size: .93em; }
|
||||
.admin-table th { text-align: left; padding: 9px 12px; font-size: .78em; font-weight: 700; text-transform: uppercase; letter-spacing: .05em; color: var(--fg-faint); background: var(--bg-sunken); border-bottom: 1px solid var(--border); white-space: nowrap; }
|
||||
.admin-table td { padding: 8px 12px; border-bottom: 1px solid var(--border); vertical-align: middle; }
|
||||
.admin-table tbody tr:last-child td { border-bottom: 0; }
|
||||
.admin-table tbody tr { cursor: pointer; }
|
||||
.admin-table tbody tr:hover { background: var(--bg-hover); }
|
||||
.admin-table tbody tr.selected { background: var(--bg-active); }
|
||||
.admin-table tbody tr:focus-visible { outline: none; box-shadow: inset var(--focus-ring); }
|
||||
.admin-who { display: flex; align-items: center; gap: 10px; min-width: 200px; }
|
||||
.admin-who-name { font-weight: 550; display: flex; align-items: center; gap: 6px; }
|
||||
.admin-groups { display: block; max-width: 180px; }
|
||||
.admin-role { display: inline-flex; align-items: center; height: 22px; padding: 0 8px; border-radius: 999px; font-size: .85em; font-weight: 550; white-space: nowrap; background: var(--bg-sunken); color: var(--fg-muted); }
|
||||
.admin-role.admin { background: var(--accent-soft); color: var(--accent-soft-fg); }
|
||||
.admin-role.custom { background: transparent; border: 1px solid var(--border-strong); }
|
||||
.admin-meter { min-width: 120px; }
|
||||
.admin-meter .quota-bar { margin: 0 0 4px; }
|
||||
.admin-pager { display: flex; align-items: center; justify-content: flex-end; gap: 4px; margin-top: 8px; }
|
||||
.admin-pager .hint { margin-right: 8px; font-variant-numeric: tabular-nums; }
|
||||
.admin-count { margin-top: 8px; }
|
||||
.admin-notice { display: flex; gap: 10px; align-items: flex-start; padding: 10px 12px; border-radius: var(--radius-sm); background: var(--bg-sunken); color: var(--fg-muted); font-size: .92em; margin: 8px 0; }
|
||||
.admin-notice svg { flex: none; margin-top: 2px; }
|
||||
.admin-notice.warn { background: var(--warn-soft); color: var(--fg); }
|
||||
.admin-notice.warn svg { color: var(--warn); }
|
||||
.admin-notice.error { background: var(--danger-soft); color: var(--fg); }
|
||||
.admin-sheet { position: absolute; top: 0; right: 0; bottom: 0; width: min(460px, 100%); z-index: 20; display: flex; flex-direction: column; background: var(--bg-elev); border-left: 1px solid var(--border); box-shadow: var(--shadow-3); animation: admin-sheet-in .18s var(--ease); }
|
||||
@keyframes admin-sheet-in { from { transform: translateX(24px); opacity: 0; } }
|
||||
.admin-sheet-head { display: flex; align-items: center; gap: 12px; padding: 14px 12px 12px 20px; border-bottom: 1px solid var(--border); }
|
||||
.admin-sheet-head h2 { margin: 0; padding: 0; border: 0; font-size: 1.1em; font-weight: 650; }
|
||||
.admin-sheet-body { flex: 1; overflow-y: auto; padding: 4px 20px 24px; }
|
||||
.admin-sheet-body h3 { margin: 22px 0 10px; font-size: .78em; font-weight: 700; text-transform: uppercase; letter-spacing: .06em; color: var(--fg-faint); }
|
||||
.admin-sheet-foot { display: flex; justify-content: flex-end; gap: 8px; padding: 12px 20px; border-top: 1px solid var(--border); }
|
||||
.admin-address .input:first-child { flex: 0 1 160px; min-width: 0; }
|
||||
.admin-address select.input { flex: 1; min-width: 0; }
|
||||
.admin-wide { width: 100%; }
|
||||
.admin-narrow { max-width: 140px; }
|
||||
.admin-danger { border: 1px solid color-mix(in srgb, var(--danger) 35%, transparent); border-radius: var(--radius); padding: 12px 14px; }
|
||||
.admin-danger p { margin: 0 0 10px; color: var(--fg-muted); font-size: .92em; }
|
||||
.admin-danger-btn { color: var(--danger); border-color: color-mix(in srgb, var(--danger) 45%, transparent); }
|
||||
.admin-danger-btn:hover:not(:disabled) { background: var(--danger-soft); }
|
||||
@media (prefers-reduced-motion: reduce) { .admin-sheet { animation: none; } }
|
||||
|
||||
/* ==========================================================================
|
||||
Contacts
|
||||
========================================================================== */
|
||||
@@ -1956,6 +2012,8 @@ select optgroup { background-color: var(--bg-elev); color: var(--fg); }
|
||||
.settings-layout.root .settings-nav { display: block; border-right: 0; }
|
||||
.settings-layout.root .settings-content { display: none; }
|
||||
.settings-content { --pad-b: 80px; padding: 16px 16px var(--pad-b); }
|
||||
.admin-table .hide-mobile { display: none; }
|
||||
.admin-sheet { width: 100%; border-left: 0; box-shadow: none; }
|
||||
.contacts-layout { grid-template-columns: 1fr; }
|
||||
.contacts-books { display: none; }
|
||||
.contacts-layout.detail .contacts-list { display: none; }
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { useEffect, useState, type ReactNode } from "react";
|
||||
import { Link, useLocation } from "wouter";
|
||||
import { BookOpen, Calendar, ChevronsUpDown, FolderOpen, Globe, HelpCircle, LogOut, Mail, Menu as MenuIcon, Moon, PenSquare, Plus, RefreshCw, Settings, Sun, Upload, Users, X } from "lucide-react";
|
||||
import { BookOpen, Calendar, ChevronsUpDown, FolderOpen, Globe, HelpCircle, LogOut, Mail, Menu as MenuIcon, Moon, PenSquare, Plus, RefreshCw, Settings, ShieldCheck, Sun, Upload, Users, X } from "lucide-react";
|
||||
import { useSession } from "@/store/session";
|
||||
import { withBase } from "@/lib/basePath";
|
||||
import { DEFAULT_APP_NAME } from "@/lib/brand";
|
||||
@@ -21,6 +21,8 @@ import { formatSize } from "@/lib/format";
|
||||
import { collectShare } from "@/lib/shareTarget";
|
||||
import { TranslateBoundary } from "@/ui/TranslateBoundary";
|
||||
import { t } from "@/lib/i18n";
|
||||
import { hasAdministration } from "@/lib/adminAccess";
|
||||
import { usePermissions } from "./admin/usePermissions";
|
||||
|
||||
const PUSH_LABEL = {
|
||||
connected: "Live updates connected",
|
||||
@@ -42,6 +44,7 @@ export function AppShell({ children }: { children: ReactNode }) {
|
||||
const logout = useSession((s) => s.logout);
|
||||
const appName = useSession((s) => s.session?.ihasmail?.appName) || DEFAULT_APP_NAME;
|
||||
const acctMenu = useMenu();
|
||||
const administers = hasAdministration(usePermissions());
|
||||
/*
|
||||
* "Go to folder" (#233), hosted here rather than in the mail view because
|
||||
* the `g` shortcuts are global: pressing it from the calendar should still
|
||||
@@ -156,6 +159,9 @@ export function AppShell({ children }: { children: ReactNode }) {
|
||||
app there was no way back to it. */}
|
||||
<MenuItem icon={<Globe size={16} />} label={t("About ihasmail")} href="https://ihasmail.org" external />
|
||||
<MenuItem icon={<Settings size={16} />} label={t("Settings")} onClick={() => navigate("/settings")} />
|
||||
{/* Only for an account whose Stalwart role manages other accounts.
|
||||
Nobody else is shown an entry that would open onto refusals. */}
|
||||
{administers && <MenuItem icon={<ShieldCheck size={16} />} label={t("Administration")} active={section === "admin"} onClick={() => navigate("/admin")} />}
|
||||
<MenuItem icon={<RefreshCw size={16} />} label={t("Refresh")} onClick={() => window.location.reload()} />
|
||||
<MenuItem icon={<LogOut size={16} />} label={t("Sign out")} onClick={() => void logout()} />
|
||||
</Popover>
|
||||
@@ -207,6 +213,7 @@ export function AppShell({ children }: { children: ReactNode }) {
|
||||
{section === "contacts" && <ContactsSidebar />}
|
||||
{section === "files" && <FilesTree />}
|
||||
{section === "settings" && <div className="nav-section"><span>{t("Settings")}</span></div>}
|
||||
{section === "admin" && <div className="nav-section"><span>{t("Administration")}</span></div>}
|
||||
</div>
|
||||
{(section === "mail" || section === "search") && <QuotaBar />}
|
||||
<nav className="module-bar" aria-label={t("Go to")}>
|
||||
|
||||
@@ -0,0 +1,459 @@
|
||||
import { useEffect, useMemo, useState } from "react";
|
||||
import { Copy, Dices, KeyRound, Lock, Plus, Trash2, X } from "lucide-react";
|
||||
import {
|
||||
ADMIN_BASELINE,
|
||||
can,
|
||||
canGrantRole,
|
||||
generatePassword,
|
||||
outranks,
|
||||
type UserRoles,
|
||||
} from "@/lib/adminAccess";
|
||||
import {
|
||||
aliasList,
|
||||
createAccount,
|
||||
describeDirectoryError,
|
||||
destroyAccount,
|
||||
hasPassword,
|
||||
passwordPatch,
|
||||
quotasWithDisk,
|
||||
updateAccount,
|
||||
DISK_QUOTA,
|
||||
type DirectoryAccount,
|
||||
type EmailAlias,
|
||||
} from "@/lib/adminDirectory";
|
||||
import { formatSize } from "@/lib/format";
|
||||
import { t, tNode } from "@/lib/i18n";
|
||||
import { Link } from "wouter";
|
||||
import { Avatar } from "@/ui/misc";
|
||||
import { Dialog } from "@/ui/dialog";
|
||||
import { toast } from "@/ui/toast";
|
||||
import { isSelf, roleName, type DirectoryContext } from "./directoryContext";
|
||||
import { usePermissions } from "./usePermissions";
|
||||
|
||||
const GIB = 1024 ** 3;
|
||||
|
||||
interface Props {
|
||||
/** Null to create one. */
|
||||
account: DirectoryAccount | null;
|
||||
ctx: DirectoryContext;
|
||||
onClose: () => void;
|
||||
onChanged: () => void;
|
||||
onCreated: (id: string) => void;
|
||||
onDeleted: () => void;
|
||||
}
|
||||
|
||||
/** A role as one select value: "User", "Admin", or "custom:<ids>". */
|
||||
function roleKey(roles: UserRoles | undefined): string {
|
||||
if (!roles || roles["@type"] === "User") return "User";
|
||||
if (roles["@type"] === "Admin") return "Admin";
|
||||
return `custom:${Object.keys(roles.roleIds ?? {}).sort().join(",")}`;
|
||||
}
|
||||
|
||||
function rolesFromKey(key: string): UserRoles {
|
||||
if (key === "Admin") return { "@type": "Admin" };
|
||||
if (key.startsWith("custom:")) {
|
||||
return { "@type": "Custom", roleIds: Object.fromEntries(key.slice(7).split(",").filter(Boolean).map((id) => [id, true])) };
|
||||
}
|
||||
return { "@type": "User" };
|
||||
}
|
||||
|
||||
const gibOf = (bytes: number | undefined) => (bytes ? String(Math.round((bytes / GIB) * 10) / 10) : "");
|
||||
const bytesOf = (gib: string) => {
|
||||
const n = Number(gib.replace(",", "."));
|
||||
return Number.isFinite(n) && n > 0 ? Math.round(n * GIB) : null;
|
||||
};
|
||||
|
||||
/**
|
||||
* One account, opened beside the list.
|
||||
*
|
||||
* A panel rather than a dialog, so the list stays visible and the next account
|
||||
* is one click away. Saving sends one `x:Account/set` with only what changed;
|
||||
* a password and a delete are their own calls, because each is a decision of
|
||||
* its own and should never ride along with a renamed display name.
|
||||
*/
|
||||
export function AccountSheet({ account, ctx, onClose, onChanged, onCreated, onDeleted }: Props) {
|
||||
const perms = usePermissions();
|
||||
const creating = account === null;
|
||||
const self = account ? isSelf(account, ctx) : false;
|
||||
const locked = account ? outranks(perms, account, ctx.roles) : false;
|
||||
const editable = creating ? can(perms, "Account", "Create") : can(perms, "Account", "Update") && !locked;
|
||||
|
||||
const [description, setDescription] = useState(account?.description ?? "");
|
||||
const [name, setName] = useState("");
|
||||
const [domainId, setDomainId] = useState(ctx.domains[0]?.id ?? "");
|
||||
const [password, setPassword] = useState(() => (creating ? generatePassword() : ""));
|
||||
const [role, setRole] = useState(roleKey(account?.roles));
|
||||
const [quota, setQuota] = useState(gibOf(account?.quotas?.[DISK_QUOTA]));
|
||||
const [aliases, setAliases] = useState<EmailAlias[]>(() => Object.values(account?.aliases ?? {}));
|
||||
const [busy, setBusy] = useState(false);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
|
||||
useEffect(() => {
|
||||
if (!domainId && ctx.domains[0]) setDomainId(ctx.domains[0].id);
|
||||
}, [ctx.domains, domainId]);
|
||||
|
||||
useEffect(() => {
|
||||
const onKey = (e: KeyboardEvent) => {
|
||||
if (e.key === "Escape" && !document.querySelector(".dialog-backdrop")) onClose();
|
||||
};
|
||||
window.addEventListener("keydown", onKey);
|
||||
return () => window.removeEventListener("keydown", onKey);
|
||||
}, [onClose]);
|
||||
|
||||
const domainName = (id: string) => ctx.domains.find((d) => d.id === id)?.name ?? "";
|
||||
const address = account?.emailAddress ?? `${name}@${domainName(domainId)}`;
|
||||
|
||||
const roleOptions = useMemo(() => {
|
||||
const options: { value: string; label: string }[] = [{ value: "User", label: t("User") }];
|
||||
if (ADMIN_BASELINE.every((p) => perms.has(p)) || role === "Admin") options.push({ value: "Admin", label: t("Administrator") });
|
||||
for (const r of ctx.roles?.values() ?? []) {
|
||||
if (canGrantRole(perms, r.id, ctx.roles)) options.push({ value: `custom:${r.id}`, label: r.description || r.id });
|
||||
}
|
||||
if (!options.some((o) => o.value === role)) options.push({ value: role, label: account ? roleName(account, ctx.roles) : role });
|
||||
return options;
|
||||
}, [perms, ctx.roles, role, account]);
|
||||
|
||||
const run = async (work: () => Promise<void>) => {
|
||||
setBusy(true);
|
||||
setError(null);
|
||||
try {
|
||||
await work();
|
||||
} catch (err) {
|
||||
setError(describeDirectoryError(err));
|
||||
} finally {
|
||||
setBusy(false);
|
||||
}
|
||||
};
|
||||
|
||||
const save = () =>
|
||||
run(async () => {
|
||||
if (!account) {
|
||||
if (!name.trim() || !domainId) {
|
||||
setError(t("An account needs an address."));
|
||||
return;
|
||||
}
|
||||
const id = await createAccount({ name, domainId, description, password, roles: rolesFromKey(role), diskQuotaBytes: bytesOf(quota) });
|
||||
toast.success(t("Created {address}", { address }));
|
||||
onCreated(id);
|
||||
return;
|
||||
}
|
||||
const patch: Record<string, unknown> = {};
|
||||
if ((account.description ?? "") !== description) patch.description = description.trim() || null;
|
||||
if (roleKey(account.roles) !== role) patch.roles = rolesFromKey(role);
|
||||
if ((account.quotas?.[DISK_QUOTA] ?? null) !== bytesOf(quota)) patch.quotas = quotasWithDisk(account.quotas, bytesOf(quota));
|
||||
const before = JSON.stringify(aliasList(Object.values(account.aliases ?? {})));
|
||||
if (before !== JSON.stringify(aliasList(aliases))) patch.aliases = aliasList(aliases);
|
||||
if (!Object.keys(patch).length) {
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
await updateAccount(account.id, patch);
|
||||
toast.success(t("Saved {address}", { address }));
|
||||
onChanged();
|
||||
});
|
||||
|
||||
const used = account?.usedDiskQuota ?? 0;
|
||||
const limit = account?.quotas?.[DISK_QUOTA];
|
||||
|
||||
return (
|
||||
<aside className="admin-sheet" aria-label={creating ? t("New account") : address}>
|
||||
<div className="admin-sheet-head">
|
||||
{account && <Avatar who={{ name: account.description || account.name, email: account.emailAddress }} />}
|
||||
<div className="grow">
|
||||
<h2 className="truncate">{creating ? t("New account") : account.description || account.name}</h2>
|
||||
{account && <div className="hint truncate notranslate" translate="no">{account.emailAddress}</div>}
|
||||
</div>
|
||||
<button className="icon-btn" onClick={onClose} aria-label={t("Close")}>
|
||||
<X size={20} />
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<div className="admin-sheet-body">
|
||||
{locked && (
|
||||
<p className="admin-notice warn">
|
||||
<Lock size={16} aria-hidden="true" />
|
||||
<span>{t("This account has permissions yours doesn't, so you can view it but not change it.")}</span>
|
||||
</p>
|
||||
)}
|
||||
{!creating && !locked && !can(perms, "Account", "Update") && (
|
||||
<p className="admin-notice">{t("Your role lets you view accounts but not change them.")}</p>
|
||||
)}
|
||||
|
||||
<h3>{t("Profile")}</h3>
|
||||
<div className="field">
|
||||
<label htmlFor="admin-description">{t("Display name")}</label>
|
||||
<input id="admin-description" className="input" value={description} disabled={!editable} onChange={(e) => setDescription(e.target.value)} />
|
||||
</div>
|
||||
{creating && (
|
||||
<div className="field">
|
||||
<label htmlFor="admin-name">{t("Address")}</label>
|
||||
<div className="row admin-address">
|
||||
<input id="admin-name" className="input" value={name} autoComplete="off" spellCheck={false} onChange={(e) => setName(e.target.value.trim().toLowerCase())} />
|
||||
<span className="muted">@</span>
|
||||
<select className="input" aria-label={t("Domain")} value={domainId} onChange={(e) => setDomainId(e.target.value)}>
|
||||
{ctx.domains.map((d) => <option key={d.id} value={d.id}>{d.name}</option>)}
|
||||
</select>
|
||||
</div>
|
||||
{!ctx.domains.length && <span className="hint">{t("No domains are available to create an account on.")}</span>}
|
||||
</div>
|
||||
)}
|
||||
|
||||
<h3>{t("Sign-in")}</h3>
|
||||
{creating ? (
|
||||
<PasswordField value={password} onChange={setPassword} />
|
||||
) : (
|
||||
self ? (
|
||||
// This session signs in with the password; changing it here would
|
||||
// strand it. Settings re-seals the session as it changes, so that is
|
||||
// the door for one's own.
|
||||
<p className="hint" style={{ marginTop: 0 }}>
|
||||
{tNode("Change your own password in {settings}.", { settings: <Link href="/settings/security">{t("Security & sessions")}</Link> })}
|
||||
</p>
|
||||
) : (
|
||||
<PasswordReset account={account} disabled={!editable} onDone={onChanged} />
|
||||
)
|
||||
)}
|
||||
|
||||
{!creating && (
|
||||
<>
|
||||
<h3>{t("Other addresses")}</h3>
|
||||
<Aliases aliases={aliases} setAliases={setAliases} editable={editable} domains={ctx.domains} defaultDomain={account.domainId} domainName={domainName} />
|
||||
</>
|
||||
)}
|
||||
|
||||
{!creating && (
|
||||
<>
|
||||
<h3>{t("Groups")}</h3>
|
||||
<div className="row wrap gap-4">
|
||||
{Object.keys(account.memberGroupIds ?? {}).length ? (
|
||||
Object.keys(account.memberGroupIds ?? {}).map((id) => {
|
||||
const g = ctx.groups.get(id);
|
||||
return <span key={id} className="chip">{g ? g.description || g.name : id}</span>;
|
||||
})
|
||||
) : (
|
||||
<span className="hint">{t("Not in any group")}</span>
|
||||
)}
|
||||
</div>
|
||||
</>
|
||||
)}
|
||||
|
||||
<h3>{t("Role")}</h3>
|
||||
<select className="input admin-wide" aria-label={t("Role")} value={role} disabled={!editable || self} onChange={(e) => setRole(e.target.value)}>
|
||||
{roleOptions.map((o) => <option key={o.value} value={o.value}>{o.label}</option>)}
|
||||
</select>
|
||||
<p className="hint">
|
||||
{self ? t("You can't change your own role.") : t("Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.")}
|
||||
</p>
|
||||
|
||||
<h3>{t("Storage")}</h3>
|
||||
{!creating && (
|
||||
<p className="hint" style={{ marginTop: 0 }}>
|
||||
{limit ? t("{used} of {total}", { used: formatSize(used), total: formatSize(limit) }) : t("{used} · no limit", { used: formatSize(used) })}
|
||||
</p>
|
||||
)}
|
||||
<div className="field">
|
||||
<label htmlFor="admin-quota">{t("Limit in GB")}</label>
|
||||
<input id="admin-quota" className="input admin-narrow" inputMode="decimal" value={quota} disabled={!editable} placeholder={t("No limit")} onChange={(e) => setQuota(e.target.value)} />
|
||||
</div>
|
||||
|
||||
{error && <p className="admin-notice error" role="alert">{error}</p>}
|
||||
|
||||
{!creating && can(perms, "Account", "Destroy") && (
|
||||
<DeleteAccount account={account} blocked={self ? t("You can't delete the account you're signed in with.") : locked ? t("This account has permissions yours doesn't.") : null} onDeleted={onDeleted} />
|
||||
)}
|
||||
</div>
|
||||
|
||||
{editable && (
|
||||
<div className="admin-sheet-foot">
|
||||
<button className="btn btn-ghost" onClick={onClose}>{t("Cancel")}</button>
|
||||
<button className="btn btn-primary" disabled={busy || (creating && (!name || !domainId || !password))} onClick={() => void save()}>
|
||||
{creating ? t("Create account") : t("Save changes")}
|
||||
</button>
|
||||
</div>
|
||||
)}
|
||||
</aside>
|
||||
);
|
||||
}
|
||||
|
||||
function PasswordField({ value, onChange, id = "admin-password" }: { value: string; onChange: (v: string) => void; id?: string }) {
|
||||
return (
|
||||
<div className="field">
|
||||
<label htmlFor={id}>{t("Password")}</label>
|
||||
<div className="row">
|
||||
<input id={id} className="input grow mono" value={value} autoComplete="new-password" spellCheck={false} onChange={(e) => onChange(e.target.value)} />
|
||||
<button type="button" className="icon-btn" aria-label={t("Generate a password")} title={t("Generate a password")} onClick={() => onChange(generatePassword())}>
|
||||
<Dices size={18} />
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
className="icon-btn"
|
||||
aria-label={t("Copy")}
|
||||
title={t("Copy")}
|
||||
onClick={() => void navigator.clipboard?.writeText(value).then(() => toast.success(t("Copied")), () => toast.error(t("Could not copy")))}
|
||||
>
|
||||
<Copy size={18} />
|
||||
</button>
|
||||
</div>
|
||||
<span className="hint">{t("Pass it on some way other than email to this address.")}</span>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function PasswordReset({ account, disabled, onDone }: { account: DirectoryAccount; disabled: boolean; onDone: () => void }) {
|
||||
const [open, setOpen] = useState(false);
|
||||
const [value, setValue] = useState("");
|
||||
const [busy, setBusy] = useState(false);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const first = account.description?.split(" ")[0] || account.name;
|
||||
|
||||
if (!open) {
|
||||
return (
|
||||
<div>
|
||||
{!hasPassword(account) && <p className="hint" style={{ marginTop: 0 }}>{t("This account has no password. It may sign in through a directory or single sign-on.")}</p>}
|
||||
<button className="btn" disabled={disabled} onClick={() => { setValue(generatePassword()); setOpen(true); }}>
|
||||
<KeyRound size={16} /> {t("Set a new password…")}
|
||||
</button>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
return (
|
||||
<div>
|
||||
<PasswordField id="admin-reset-password" value={value} onChange={setValue} />
|
||||
<p className="hint">{t("{name} will be signed out of every app and device using the old password.", { name: first })}</p>
|
||||
{error && <p className="admin-notice error" role="alert">{error}</p>}
|
||||
<div className="row">
|
||||
<button
|
||||
className="btn btn-primary btn-sm"
|
||||
disabled={busy || !value}
|
||||
onClick={async () => {
|
||||
setBusy(true);
|
||||
setError(null);
|
||||
try {
|
||||
await updateAccount(account.id, passwordPatch(account, value));
|
||||
toast.success(t("New password set for {address}", { address: account.emailAddress ?? account.name }));
|
||||
setOpen(false);
|
||||
onDone();
|
||||
} catch (err) {
|
||||
setError(describeDirectoryError(err));
|
||||
} finally {
|
||||
setBusy(false);
|
||||
}
|
||||
}}
|
||||
>
|
||||
{t("Set password")}
|
||||
</button>
|
||||
<button className="btn btn-ghost btn-sm" onClick={() => setOpen(false)}>{t("Cancel")}</button>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function Aliases({ aliases, setAliases, editable, domains, defaultDomain, domainName }: {
|
||||
aliases: EmailAlias[];
|
||||
setAliases: (a: EmailAlias[]) => void;
|
||||
editable: boolean;
|
||||
domains: { id: string; name: string }[];
|
||||
defaultDomain: string;
|
||||
domainName: (id: string) => string;
|
||||
}) {
|
||||
const [local, setLocal] = useState("");
|
||||
const [domain, setDomain] = useState(defaultDomain);
|
||||
const add = () => {
|
||||
const name = local.trim().toLowerCase();
|
||||
if (!name || aliases.some((a) => a.name === name && a.domainId === domain)) return;
|
||||
setAliases([...aliases, { enabled: true, name, domainId: domain }]);
|
||||
setLocal("");
|
||||
};
|
||||
return (
|
||||
<div>
|
||||
<div className="row wrap gap-4">
|
||||
{aliases.length ? (
|
||||
aliases.map((a, i) => (
|
||||
<span key={`${a.name}@${a.domainId}`} className="chip notranslate" translate="no">
|
||||
{a.name}@{domainName(a.domainId) || "…"}
|
||||
{editable && (
|
||||
<button className="chip-x" aria-label={t("Remove {address}", { address: `${a.name}@${domainName(a.domainId)}` })} onClick={() => setAliases(aliases.filter((_, j) => j !== i))}>
|
||||
<X size={12} />
|
||||
</button>
|
||||
)}
|
||||
</span>
|
||||
))
|
||||
) : (
|
||||
<span className="hint">{t("None")}</span>
|
||||
)}
|
||||
</div>
|
||||
{editable && (
|
||||
<div className="row admin-address mt-8">
|
||||
<input className="input" aria-label={t("New address")} placeholder={t("another name")} value={local} spellCheck={false} onChange={(e) => setLocal(e.target.value)} onKeyDown={(e) => { if (e.key === "Enter") { e.preventDefault(); add(); } }} />
|
||||
<span className="muted">@</span>
|
||||
<select className="input" aria-label={t("Domain")} value={domain} onChange={(e) => setDomain(e.target.value)}>
|
||||
{(domains.some((d) => d.id === defaultDomain) ? domains : [{ id: defaultDomain, name: domainName(defaultDomain) || "…" }, ...domains]).map((d) => (
|
||||
<option key={d.id} value={d.id}>{d.name}</option>
|
||||
))}
|
||||
</select>
|
||||
<button className="btn btn-sm" onClick={add} disabled={!local.trim()}>
|
||||
<Plus size={14} /> {t("Add")}
|
||||
</button>
|
||||
</div>
|
||||
)}
|
||||
{editable && <p className="hint">{t("Mail to these addresses is delivered to this account. Changes apply when you save.")}</p>}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function DeleteAccount({ account, blocked, onDeleted }: { account: DirectoryAccount; blocked: string | null; onDeleted: () => void }) {
|
||||
const [open, setOpen] = useState(false);
|
||||
const [typed, setTyped] = useState("");
|
||||
const [busy, setBusy] = useState(false);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const address = account.emailAddress ?? account.name;
|
||||
return (
|
||||
<>
|
||||
<h3>{t("Delete")}</h3>
|
||||
<div className="admin-danger">
|
||||
<p>{blocked ?? t("Deletes the mailbox and everything in it.")}</p>
|
||||
<button className="btn btn-sm admin-danger-btn" disabled={!!blocked} onClick={() => { setTyped(""); setError(null); setOpen(true); }}>
|
||||
<Trash2 size={14} /> {t("Delete account…")}
|
||||
</button>
|
||||
</div>
|
||||
<Dialog
|
||||
open={open}
|
||||
onClose={() => setOpen(false)}
|
||||
title={t("Delete {address}?", { address })}
|
||||
size="sm"
|
||||
footer={
|
||||
<>
|
||||
<button className="btn" onClick={() => setOpen(false)}>{t("Cancel")}</button>
|
||||
<button
|
||||
className="btn btn-danger"
|
||||
disabled={busy || typed.trim().toLowerCase() !== address.toLowerCase()}
|
||||
onClick={async () => {
|
||||
setBusy(true);
|
||||
setError(null);
|
||||
try {
|
||||
await destroyAccount(account.id);
|
||||
toast.success(t("Deleted {address}", { address }));
|
||||
setOpen(false);
|
||||
onDeleted();
|
||||
} catch (err) {
|
||||
setError(describeDirectoryError(err));
|
||||
} finally {
|
||||
setBusy(false);
|
||||
}
|
||||
}}
|
||||
>
|
||||
{t("Delete account")}
|
||||
</button>
|
||||
</>
|
||||
}
|
||||
>
|
||||
<p style={{ marginTop: 0 }}>{t("This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.")}</p>
|
||||
<div className="field">
|
||||
<label htmlFor="admin-delete-confirm">{t("Type {address} to confirm", { address })}</label>
|
||||
<input id="admin-delete-confirm" className="input notranslate" translate="no" value={typed} autoComplete="off" spellCheck={false} onChange={(e) => setTyped(e.target.value)} />
|
||||
</div>
|
||||
{error && <p className="admin-notice error" role="alert">{error}</p>}
|
||||
</Dialog>
|
||||
</>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,267 @@
|
||||
import { useEffect, useMemo, useState } from "react";
|
||||
import { useLocation } from "wouter";
|
||||
import { ChevronLeft, ChevronRight, Search, UserPlus, Users } from "lucide-react";
|
||||
import { useSession } from "@/store/session";
|
||||
import { STALWART_CAP } from "@/jmap/client";
|
||||
import { can, type RoleDef } from "@/lib/adminAccess";
|
||||
import {
|
||||
describeDirectoryError,
|
||||
getAccounts,
|
||||
listDomains,
|
||||
listGroups,
|
||||
listRoles,
|
||||
queryAccounts,
|
||||
DISK_QUOTA,
|
||||
type DirectoryAccount,
|
||||
type DirectoryDomain,
|
||||
} from "@/lib/adminDirectory";
|
||||
import { formatSize } from "@/lib/format";
|
||||
import { plural, t } from "@/lib/i18n";
|
||||
import { Avatar, Empty, Spinner } from "@/ui/misc";
|
||||
import { usePermissions } from "./usePermissions";
|
||||
import { isSelf, roleName, type DirectoryContext } from "./directoryContext";
|
||||
import { AccountSheet } from "./AccountSheet";
|
||||
|
||||
const PAGE_SIZE = 50;
|
||||
|
||||
export function AccountsAdmin({ selectedId }: { selectedId?: string }) {
|
||||
const [, navigate] = useLocation();
|
||||
const perms = usePermissions();
|
||||
const session = useSession((s) => s.session);
|
||||
const [text, setText] = useState("");
|
||||
const [query, setQuery] = useState("");
|
||||
const [position, setPosition] = useState(0);
|
||||
const [page, setPage] = useState<{ accounts: DirectoryAccount[]; total: number } | null>(null);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const [reload, setReload] = useState(0);
|
||||
const [serverDomains, setServerDomains] = useState<DirectoryDomain[] | null>(null);
|
||||
const [roles, setRoles] = useState<Map<string, RoleDef> | null>(null);
|
||||
const [groups, setGroups] = useState<Map<string, DirectoryAccount>>(new Map());
|
||||
const [loose, setLoose] = useState<DirectoryAccount | null>(null);
|
||||
|
||||
// Typing is not a query per keystroke.
|
||||
useEffect(() => {
|
||||
const id = window.setTimeout(() => {
|
||||
setQuery(text);
|
||||
setPosition(0);
|
||||
}, 250);
|
||||
return () => window.clearTimeout(id);
|
||||
}, [text]);
|
||||
|
||||
useEffect(() => {
|
||||
let cancelled = false;
|
||||
setError(null);
|
||||
void (async () => {
|
||||
try {
|
||||
const q = await queryAccounts({ type: "User", text: query, position, limit: PAGE_SIZE });
|
||||
const accounts = await getAccounts(q.ids);
|
||||
if (!cancelled) setPage({ accounts, total: q.total });
|
||||
} catch (err) {
|
||||
if (!cancelled) {
|
||||
setPage({ accounts: [], total: 0 });
|
||||
setError(describeDirectoryError(err));
|
||||
}
|
||||
}
|
||||
})();
|
||||
return () => {
|
||||
cancelled = true;
|
||||
};
|
||||
}, [query, position, reload]);
|
||||
|
||||
// The lists the account sheet picks from. Each is a nicety: without it the
|
||||
// sheet falls back to what it can see, or offers less.
|
||||
useEffect(() => {
|
||||
if (can(perms, "Domain", "Query") && can(perms, "Domain", "Get")) void listDomains().then(setServerDomains, () => setServerDomains(null));
|
||||
if (can(perms, "Role", "Query") && can(perms, "Role", "Get")) void listRoles().then((list) => setRoles(new Map(list.map((r) => [r.id, r]))), () => setRoles(null));
|
||||
void listGroups().then((list) => setGroups(new Map(list.map((g) => [g.id, g]))), () => setGroups(new Map()));
|
||||
}, [perms, reload]);
|
||||
|
||||
// An account opened by address that is not on the page being shown.
|
||||
useEffect(() => {
|
||||
if (!selectedId || selectedId === "new" || page?.accounts.some((a) => a.id === selectedId)) {
|
||||
setLoose(null);
|
||||
return;
|
||||
}
|
||||
let cancelled = false;
|
||||
void getAccounts([selectedId]).then(
|
||||
([a]) => { if (!cancelled) setLoose(a ?? null); },
|
||||
() => { if (!cancelled) setLoose(null); },
|
||||
);
|
||||
return () => {
|
||||
cancelled = true;
|
||||
};
|
||||
}, [selectedId, page]);
|
||||
|
||||
const ctx: DirectoryContext = useMemo(() => {
|
||||
const seen = new Map<string, DirectoryDomain>();
|
||||
for (const a of page?.accounts ?? []) {
|
||||
const domain = a.emailAddress?.split("@")[1];
|
||||
if (domain && !seen.has(a.domainId)) seen.set(a.domainId, { id: a.domainId, name: domain });
|
||||
}
|
||||
const ownId = session?.primaryAccounts?.[STALWART_CAP];
|
||||
return {
|
||||
domains: (serverDomains ?? [...seen.values()]).slice().sort((x, y) => x.name.localeCompare(y.name)),
|
||||
roles,
|
||||
groups,
|
||||
self: { ids: new Set(ownId ? [ownId] : []), address: (session?.username ?? "").toLowerCase() },
|
||||
};
|
||||
}, [page, serverDomains, roles, groups, session]);
|
||||
|
||||
const selected = selectedId && selectedId !== "new" ? (page?.accounts.find((a) => a.id === selectedId) ?? loose) : null;
|
||||
const close = () => navigate("/admin/accounts");
|
||||
const changed = () => setReload((n) => n + 1);
|
||||
|
||||
return (
|
||||
<div>
|
||||
<div className="admin-head">
|
||||
<div className="grow">
|
||||
<h1>{t("Accounts")}</h1>
|
||||
<p className="lead">{t("The people who sign in to mail on the domains you manage.")}</p>
|
||||
</div>
|
||||
{can(perms, "Account", "Create") && (
|
||||
<button className="btn btn-primary" onClick={() => navigate("/admin/accounts/new")}>
|
||||
<UserPlus size={16} /> {t("New account")}
|
||||
</button>
|
||||
)}
|
||||
</div>
|
||||
|
||||
<div className="admin-toolbar">
|
||||
<label className="admin-search">
|
||||
<Search size={16} aria-hidden="true" />
|
||||
<input
|
||||
className="input"
|
||||
type="search"
|
||||
value={text}
|
||||
onChange={(e) => setText(e.target.value)}
|
||||
placeholder={t("Search by name or address")}
|
||||
aria-label={t("Search accounts")}
|
||||
/>
|
||||
</label>
|
||||
</div>
|
||||
|
||||
{error && <p className="admin-notice error" role="alert">{error}</p>}
|
||||
|
||||
{page === null ? (
|
||||
<Spinner />
|
||||
) : page.accounts.length === 0 ? (
|
||||
!error && (
|
||||
<Empty icon={<Users size={32} />} title={query ? t("No accounts match") : t("No accounts yet")}>
|
||||
{query ? t("Nothing on your domains matches “{query}”.", { query }) : undefined}
|
||||
</Empty>
|
||||
)
|
||||
) : (
|
||||
<>
|
||||
<div className="admin-table-wrap">
|
||||
<table className="admin-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>{t("Account")}</th>
|
||||
<th>{t("Role")}</th>
|
||||
<th>{t("Storage")}</th>
|
||||
<th className="hide-mobile">{t("Groups")}</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{page.accounts.map((a) => (
|
||||
<tr
|
||||
key={a.id}
|
||||
className={a.id === selectedId ? "selected" : ""}
|
||||
tabIndex={0}
|
||||
onClick={() => navigate(`/admin/accounts/${a.id}`)}
|
||||
onKeyDown={(e) => {
|
||||
if (e.key === "Enter" || e.key === " ") {
|
||||
e.preventDefault();
|
||||
navigate(`/admin/accounts/${a.id}`);
|
||||
}
|
||||
}}
|
||||
aria-label={t("Open {address}", { address: a.emailAddress ?? a.name })}
|
||||
>
|
||||
<td>
|
||||
<div className="admin-who">
|
||||
<Avatar who={{ name: a.description || a.name, email: a.emailAddress }} size="sm" />
|
||||
<div className="grow">
|
||||
<div className="admin-who-name truncate">
|
||||
{a.description || a.name}
|
||||
{isSelf(a, ctx) && <span className="badge muted">{t("You")}</span>}
|
||||
</div>
|
||||
<div className="hint truncate notranslate" translate="no">{a.emailAddress}</div>
|
||||
</div>
|
||||
</div>
|
||||
</td>
|
||||
<td><RoleLabel account={a} roles={ctx.roles} /></td>
|
||||
<td><StorageMeter account={a} /></td>
|
||||
<td className="hide-mobile muted">
|
||||
<span className="truncate admin-groups">{groupNames(a, ctx.groups) || "—"}</span>
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<Pager position={position} shown={page.accounts.length} total={page.total} onMove={setPosition} />
|
||||
</>
|
||||
)}
|
||||
|
||||
{(selectedId === "new" || selected) && (
|
||||
<AccountSheet
|
||||
key={selectedId}
|
||||
account={selectedId === "new" ? null : selected}
|
||||
ctx={ctx}
|
||||
onClose={close}
|
||||
onChanged={changed}
|
||||
onCreated={(id) => {
|
||||
changed();
|
||||
navigate(`/admin/accounts/${id}`);
|
||||
}}
|
||||
onDeleted={() => {
|
||||
changed();
|
||||
close();
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function groupNames(a: DirectoryAccount, groups: Map<string, DirectoryAccount>): string {
|
||||
return Object.keys(a.memberGroupIds ?? {})
|
||||
.map((id) => groups.get(id))
|
||||
.filter(Boolean)
|
||||
.map((g) => g!.description || g!.name)
|
||||
.join(", ");
|
||||
}
|
||||
|
||||
function RoleLabel({ account, roles }: { account: DirectoryAccount; roles: Map<string, RoleDef> | null }) {
|
||||
const kind = account.roles?.["@type"] ?? "User";
|
||||
return <span className={`admin-role ${kind === "Admin" ? "admin" : kind === "Custom" ? "custom" : ""}`}>{roleName(account, roles)}</span>;
|
||||
}
|
||||
|
||||
function StorageMeter({ account }: { account: DirectoryAccount }) {
|
||||
const used = account.usedDiskQuota ?? 0;
|
||||
const limit = account.quotas?.[DISK_QUOTA] ?? 0;
|
||||
if (!limit) return <span className="muted small">{t("{used} · no limit", { used: formatSize(used) })}</span>;
|
||||
const pct = Math.min(100, Math.round((used / limit) * 100));
|
||||
return (
|
||||
<div className="admin-meter" title={t("{used} of {total}", { used: formatSize(used), total: formatSize(limit) })}>
|
||||
<div className="quota-bar"><span className={pct > 95 ? "danger" : pct > 80 ? "warn" : ""} style={{ width: `${pct}%` }} /></div>
|
||||
<span className="small muted">{t("{used} of {total}", { used: formatSize(used), total: formatSize(limit) })}</span>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function Pager({ position, shown, total, onMove }: { position: number; shown: number; total: number; onMove: (p: number) => void }) {
|
||||
if (total <= PAGE_SIZE && position === 0) {
|
||||
return <p className="hint admin-count">{plural(total, { one: "{n} account", other: "{n} accounts" })}</p>;
|
||||
}
|
||||
return (
|
||||
<div className="admin-pager">
|
||||
<span className="hint">{t("{from}–{to} of {total}", { from: position + 1, to: position + shown, total })}</span>
|
||||
<button className="icon-btn sm" aria-label={t("Previous page")} disabled={position === 0} onClick={() => onMove(Math.max(0, position - PAGE_SIZE))}>
|
||||
<ChevronLeft size={18} />
|
||||
</button>
|
||||
<button className="icon-btn sm" aria-label={t("Next page")} disabled={position + shown >= total} onClick={() => onMove(position + PAGE_SIZE)}>
|
||||
<ChevronRight size={18} />
|
||||
</button>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
import { Link, Redirect, useLocation } from "wouter";
|
||||
import { ArrowLeft, User } from "lucide-react";
|
||||
import { hasAdministration } from "@/lib/adminAccess";
|
||||
import { t } from "@/lib/i18n";
|
||||
import { AccountsAdmin } from "./AccountsAdmin";
|
||||
import { usePermissions } from "./usePermissions";
|
||||
|
||||
/**
|
||||
* Administration: what the signed-in account's Stalwart role lets it manage.
|
||||
*
|
||||
* Laid out like Settings, because it is the same kind of place -- a list of
|
||||
* sections and the one that is open -- and on a phone it behaves the same way,
|
||||
* the list first and a section on its own. Accounts is the only section so
|
||||
* far; the nav is written as a list so the next one is an entry, not a rework.
|
||||
*/
|
||||
export function AdminView({ section, id }: { section?: string; id?: string }) {
|
||||
const [, navigate] = useLocation();
|
||||
const perms = usePermissions();
|
||||
// Typed in by hand, or a role taken away since the menu was drawn. Stalwart
|
||||
// would refuse every call anyway; this spares the page of refusals.
|
||||
if (!hasAdministration(perms)) return <Redirect to="/mail" />;
|
||||
return (
|
||||
<div className={`settings-layout admin-layout ${section ? "section" : "root"}`}>
|
||||
<nav className="settings-nav" aria-label={t("Administration")}>
|
||||
<div className="nav-section" style={{ paddingLeft: 8 }}><span>{t("Directory")}</span></div>
|
||||
<Link href="/admin/accounts" className={`nav-item ${!section || section === "accounts" ? "active" : ""}`}>
|
||||
<User size={18} />
|
||||
<span className="nav-label">{t("Accounts")}</span>
|
||||
</Link>
|
||||
</nav>
|
||||
<div className="settings-content admin-content">
|
||||
{section && (
|
||||
<button className="btn btn-ghost btn-sm admin-back" style={{ marginBottom: 8, marginLeft: -8 }} onClick={() => navigate("/admin")}>
|
||||
<ArrowLeft size={16} /> {t("Administration")}
|
||||
</button>
|
||||
)}
|
||||
<AccountsAdmin selectedId={id} />
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
import { act } from "react";
|
||||
import { createRoot, type Root } from "react-dom/client";
|
||||
import { afterEach, beforeEach, describe, expect, it } from "vitest";
|
||||
import { Router } from "wouter";
|
||||
import { memoryLocation } from "wouter/memory-location";
|
||||
import { useSession } from "@/store/session";
|
||||
import type { JmapSession } from "@/jmap/types";
|
||||
import type { DirectoryAccount } from "@/lib/adminDirectory";
|
||||
import { AccountSheet } from "../AccountSheet";
|
||||
import type { DirectoryContext } from "../directoryContext";
|
||||
|
||||
(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
|
||||
|
||||
const HELPDESK = ["sysAccountGet", "sysAccountQuery", "sysAccountUpdate"];
|
||||
|
||||
function signIn(permissions: string[], username = "[email protected]") {
|
||||
useSession.setState({
|
||||
session: { capabilities: {}, accounts: {}, primaryAccounts: { "urn:stalwart:jmap": "self" }, username, ihasmail: { permissions } } as unknown as JmapSession,
|
||||
});
|
||||
}
|
||||
|
||||
const account = (over: Partial<DirectoryAccount>): DirectoryAccount => ({
|
||||
id: "u1",
|
||||
"@type": "User",
|
||||
name: "ada",
|
||||
domainId: "d1",
|
||||
emailAddress: "[email protected]",
|
||||
description: "Ada Lovelace",
|
||||
roles: { "@type": "User" },
|
||||
credentials: { "0": { "@type": "Password", secret: "[********]" } },
|
||||
...over,
|
||||
});
|
||||
|
||||
const ctx: DirectoryContext = { domains: [{ id: "d1", name: "example.com" }], roles: null, groups: new Map(), self: { ids: new Set(["self"]), address: "[email protected]" } };
|
||||
|
||||
const button = (host: HTMLElement, text: string) => [...host.querySelectorAll("button")].find((b) => b.textContent?.includes(text));
|
||||
|
||||
/**
|
||||
* The guards that stand in for checks Stalwart does not make. A store test
|
||||
* cannot see these: they are what the sheet renders, and what it leaves out.
|
||||
*/
|
||||
describe("the account sheet", () => {
|
||||
let host: HTMLDivElement;
|
||||
let root: Root;
|
||||
|
||||
const render = async (a: DirectoryAccount) => {
|
||||
const { hook } = memoryLocation({ path: `/admin/accounts/${a.id}` });
|
||||
await act(async () => {
|
||||
root.render(
|
||||
<Router hook={hook}>
|
||||
<AccountSheet account={a} ctx={ctx} onClose={() => {}} onChanged={() => {}} onCreated={() => {}} onDeleted={() => {}} />
|
||||
</Router>,
|
||||
);
|
||||
});
|
||||
};
|
||||
|
||||
beforeEach(() => {
|
||||
host = document.createElement("div");
|
||||
document.body.appendChild(host);
|
||||
root = createRoot(host);
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
await act(async () => root.unmount());
|
||||
host.remove();
|
||||
});
|
||||
|
||||
it("shows an account that outranks the viewer read-only, password included", async () => {
|
||||
signIn(HELPDESK);
|
||||
await render(account({ roles: { "@type": "Admin" } }));
|
||||
expect(host.textContent).toContain("permissions yours doesn't");
|
||||
expect(button(host, "Set a new password")?.disabled).toBe(true);
|
||||
expect((host.querySelector("#admin-description") as HTMLInputElement).disabled).toBe(true);
|
||||
expect(host.textContent).not.toContain("Save changes");
|
||||
});
|
||||
|
||||
it("lets the same viewer edit an ordinary account, but not delete it", async () => {
|
||||
signIn(HELPDESK);
|
||||
await render(account({}));
|
||||
expect(button(host, "Set a new password")?.disabled).toBe(false);
|
||||
expect(host.textContent).toContain("Save changes");
|
||||
expect(host.textContent).not.toContain("Delete account");
|
||||
});
|
||||
|
||||
it("sends your own password to Settings, and keeps your role and account out of reach", async () => {
|
||||
signIn([...HELPDESK, "sysAccountDestroy"]);
|
||||
await render(account({ id: "self", emailAddress: "[email protected]" }));
|
||||
expect(host.textContent).toContain("Change your own password in");
|
||||
expect(host.querySelector('a[href="/settings/security"]')).not.toBeNull();
|
||||
expect(button(host, "Set a new password")).toBeUndefined();
|
||||
expect((host.querySelector('select[aria-label="Role"]') as HTMLSelectElement).disabled).toBe(true);
|
||||
expect(button(host, "Delete account")?.disabled).toBe(true);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,25 @@
|
||||
import type { RoleDef } from "@/lib/adminAccess";
|
||||
import type { DirectoryAccount, DirectoryDomain } from "@/lib/adminDirectory";
|
||||
import { t } from "@/lib/i18n";
|
||||
|
||||
export interface DirectoryContext {
|
||||
/** Domains to offer. Read from the server when allowed, else seen on accounts. */
|
||||
domains: DirectoryDomain[];
|
||||
/** Null when the viewer cannot read roles, which `outranks` treats as unknown. */
|
||||
roles: Map<string, RoleDef> | null;
|
||||
groups: Map<string, DirectoryAccount>;
|
||||
/** Registry ids and addresses that are the signed-in account itself. */
|
||||
self: { ids: Set<string>; address: string };
|
||||
}
|
||||
|
||||
export function isSelf(a: Pick<DirectoryAccount, "id" | "emailAddress">, ctx: DirectoryContext): boolean {
|
||||
return ctx.self.ids.has(a.id) || (!!a.emailAddress && a.emailAddress.toLowerCase() === ctx.self.address);
|
||||
}
|
||||
|
||||
export function roleName(a: Pick<DirectoryAccount, "roles">, roles: Map<string, RoleDef> | null): string {
|
||||
const r = a.roles;
|
||||
if (!r || r["@type"] === "User") return t("User");
|
||||
if (r["@type"] === "Admin") return t("Administrator");
|
||||
const names = Object.keys(r.roleIds ?? {}).map((id) => roles?.get(id)?.description).filter(Boolean);
|
||||
return names.length ? names.join(", ") : t("Custom role");
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
import { useMemo } from "react";
|
||||
import { useSession } from "@/store/session";
|
||||
import { permissionSet, type Permissions } from "@/lib/adminAccess";
|
||||
|
||||
/**
|
||||
* The signed-in account's permissions, as a set, stable between renders.
|
||||
*
|
||||
* Keyed on the contents, not the array. The session is fetched again whenever
|
||||
* a response carries a different session state, and each fetch brings a new
|
||||
* array with the same names in it; a set rebuilt from identity would re-run
|
||||
* everything that depends on it, whose requests could bring another refresh.
|
||||
*/
|
||||
export function usePermissions(): Permissions {
|
||||
const key = useSession((s) => (s.session?.ihasmail?.permissions ?? []).join(","));
|
||||
return useMemo(() => permissionSet(key ? key.split(",") : []), [key]);
|
||||
}
|
||||
Reference in New Issue
Block a user