From c0d03e9aaa47f07a41b730ed0689e70680b27e96 Mon Sep 17 00:00:00 2001 From: khannurien Date: Fri, 9 Oct 2026 14:23:00 +0000 Subject: [PATCH] =?UTF-8?q?v4:=20users=20sign=20in=20to=20one=20gerbeur=20?= =?UTF-8?q?instance=20with=20their=20account=20on=20another=20=E2=80=94=20?= =?UTF-8?q?topic=20instances,=20each=20with=20its=20own=20admins,=20domain?= =?UTF-8?q?=20and=20data,=20had=20no=20way=20to=20share=20accounts.=20Sign?= =?UTF-8?q?-in=20is=20federated=20over=20a=20subset=20of=20OpenID=20Connec?= =?UTF-8?q?t,=20the=20authorization=20code=20flow=20with=20PKCE:=20each=20?= =?UTF-8?q?instance=20is=20an=20identity=20provider=20for=20its=20own=20us?= =?UTF-8?q?ers=20and=20a=20client=20for=20the=20others',=20and=20signs=20w?= =?UTF-8?q?hat=20it=20tells=20them=20with=20an=20Ed25519=20key=20kept=20in?= =?UTF-8?q?=20federation=5Fkeys=20and=20published=20at=20/.well-known/jwks?= =?UTF-8?q?.json,=20beside=20its=20metadata=20at=20/.well-known/openid-con?= =?UTF-8?q?figuration.=20Only=20sign-in=20is=20federated:=20an=20account?= =?UTF-8?q?=20from=20another=20instance=20is=20a=20local=20users=20row=20l?= =?UTF-8?q?inked=20to=20(issuer,=20subject)=20in=20user=5Fidentities,=20wi?= =?UTF-8?q?th=20no=20password=20(password=5Fhash=20''),=20so=20sessions,?= =?UTF-8?q?=20roles,=20permissions,=20the=20socket=20and=20every=20foreign?= =?UTF-8?q?=20key=20work=20as=20before.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A remote user is name@host here, in users.username, in paths (/@alice@music.example) and in mentions, through one handle rule in shared/validation.ts that paths, MENTION_RE and Markdown all build on; Markdown undoes GFM's email autolink of a handle. Their name, email and avatar come from their home at each sign-in and by its signed events (federation_outbox, delivered by the federation job with backoff): a rename at home leaves the old handle an alias here, and a password change or a withdrawn grant ends their sessions here. Their password, email, avatar and name can't change here (assertLocalUser), nor can they sign in elsewhere from here. An admin keeps the trusted and blocked instances on /manage (federation:manage): a trusted instance's users sign in from a button on the login page, a blocked one's can't and are signed out at once, and any other's join with an invite from the register page. The /authorize page asks the user once per instance, and /settings lists the instances their account signs in to, each disconnectable; /login?next= brings a signed-out visitor back to /authorize. Emails stay unique among local accounts only, and migration 0024 adds the tables, makes that index partial and reserves authorize and federation as category slugs. remote/gerbeur-instance.ts is the only way to other instances: https and public addresses only, no redirects, no certificate fallback, unless GERBEUR_FEDERATION_ALLOW_PRIVATE lets two instances on one machine talk. 298 backend tests and 702 frontend tests pass, and deno check, deno fmt, deno lint, tsc, eslint, doc:lint and i18n:compile --strict are clean; checked end to end with two built instances on one machine: sign-in through the other's login and consent pages, consent skipped once granted and asked again after disconnecting, a rename and a password change at home reaching the other, and blocking; screenshots of the login, consent, profile, settings and manage pages at 1280 and 390px. Co-Authored-By: Claude Opus 5.5 --- .env.example | 5 + API.md | 210 +++++---- README.md | 37 +- api/config.ts | 10 + api/db/migrate.ts | 2 + api/db/migrations/0024_federation.ts | 105 +++++ api/db/schema.sql | 67 ++- api/lib/jwt.ts | 113 ++++- api/lib/reserved-slugs.ts | 5 +- api/main.ts | 8 + api/model/user.ts | 23 +- api/remote/gerbeur-instance.ts | 224 +++++++++ api/routes/avatars.ts | 38 +- api/routes/federation.ts | 149 ++++++ api/routes/me.ts | 49 +- api/routes/oauth.ts | 78 ++++ api/routes/users.ts | 8 +- api/routes/well-known.ts | 36 ++ api/services/federation-peer-service.ts | 125 +++++ api/services/federation-service.ts | 376 +++++++++++++++ api/services/identity-provider-service.ts | 438 ++++++++++++++++++ api/services/instance-key-service.ts | 73 +++ api/services/user-service.ts | 158 ++++++- api/test/db/migrate.test.ts | 4 +- .../db/migrations/0024_federation.test.ts | 43 ++ api/test/helpers.ts | 147 +++++- api/test/services/federation-service.test.ts | 326 +++++++++++++ .../identity-provider-service.test.ts | 268 +++++++++++ api/validators/federation.ts | 56 +++ locales/en.mjs | 2 +- locales/en.po | 276 ++++++++--- locales/fr.mjs | 2 +- locales/fr.po | 276 ++++++++--- shared/federation.ts | 267 +++++++++++ shared/mention.ts | 10 +- shared/paths.ts | 19 +- shared/permissions.ts | 4 +- shared/test/federation.test.ts | 49 ++ shared/test/mention.test.ts | 21 + shared/test/paths.test.ts | 20 + shared/validation.ts | 42 +- src/App.css | 100 ++++ src/App.tsx | 21 +- src/components/editor/Markdown.tsx | 39 +- src/components/federation/FederatedSignIn.tsx | 119 +++++ src/components/federation/GrantList.tsx | 101 ++++ src/components/federation/PeerManager.tsx | 177 +++++++ src/components/layout/UserMenu.tsx | 7 +- src/components/profile/ProfileHeader.tsx | 36 +- src/pages/Authorize.tsx | 164 +++++++ src/pages/FederationCallback.tsx | 78 ++++ src/pages/Manage.tsx | 34 +- src/pages/RestrictedGuest.tsx | 11 +- src/pages/Settings.tsx | 55 ++- src/pages/UserLogin.tsx | 14 +- src/pages/UserRegister.tsx | 6 +- src/test/components/editor/Markdown.test.tsx | 11 + src/test/pages/Authorize.test.tsx | 109 +++++ src/test/pages/FederationCallback.test.tsx | 51 ++ src/test/pages/Manage.test.tsx | 50 ++ src/test/pages/Settings.test.tsx | 39 ++ src/test/pages/UserLogin.test.tsx | 96 +++- src/test/pages/UserPublicProfile.test.tsx | 21 + src/test/utils/auth/next.test.ts | 15 + src/utils/auth/home.ts | 30 ++ src/utils/auth/next.ts | 25 + src/utils/shared/deserialize.ts | 22 + 67 files changed, 5261 insertions(+), 339 deletions(-) create mode 100644 api/db/migrations/0024_federation.ts create mode 100644 api/remote/gerbeur-instance.ts create mode 100644 api/routes/federation.ts create mode 100644 api/routes/oauth.ts create mode 100644 api/routes/well-known.ts create mode 100644 api/services/federation-peer-service.ts create mode 100644 api/services/federation-service.ts create mode 100644 api/services/identity-provider-service.ts create mode 100644 api/services/instance-key-service.ts create mode 100644 api/test/db/migrations/0024_federation.test.ts create mode 100644 api/test/services/federation-service.test.ts create mode 100644 api/test/services/identity-provider-service.test.ts create mode 100644 api/validators/federation.ts create mode 100644 shared/federation.ts create mode 100644 shared/test/federation.test.ts create mode 100644 shared/test/mention.test.ts create mode 100644 src/components/federation/FederatedSignIn.tsx create mode 100644 src/components/federation/GrantList.tsx create mode 100644 src/components/federation/PeerManager.tsx create mode 100644 src/pages/Authorize.tsx create mode 100644 src/pages/FederationCallback.tsx create mode 100644 src/test/pages/Authorize.test.tsx create mode 100644 src/test/pages/FederationCallback.test.tsx create mode 100644 src/test/utils/auth/next.test.ts create mode 100644 src/utils/auth/home.ts create mode 100644 src/utils/auth/next.ts diff --git a/.env.example b/.env.example index 8fb25b98..11bd7f60 100644 --- a/.env.example +++ b/.env.example @@ -71,6 +71,11 @@ GERBEUR_DEFAULT_STYLE=smooth # How often, in minutes, the /community page's figures are recomputed. GERBEUR_COMMUNITY_REFRESH_MINUTES=15 +# Set to 1 to let federated sign-in reach other instances on private addresses +# (localhost included) and over plain http, so that two instances on one +# machine can trust each other in development. Never in production. +# GERBEUR_FEDERATION_ALLOW_PRIVATE=1 + # Markdown body of the welcome email sent on account creation, replacing the # built-in one (written in GERBEUR_EMAIL_LOCALE). Supports {{username}} and # {{site_name}}. Use \n for line breaks in single-line .env values, or a diff --git a/API.md b/API.md index f1e218df..2b6d7a16 100644 --- a/API.md +++ b/API.md @@ -1,44 +1,47 @@ # gerbeur's URLs -Every page and every API endpoint follows one of two rules. This file -summarizes them. Each router's module doc in `api/routes/` lists its own -endpoints in full, and a route change updates both. `shared/paths.ts` builds -and parses the page paths. +Every page and every API endpoint follows one of two rules. This file summarizes +them. Each router's module doc in `api/routes/` lists its own endpoints in full, +and a route change updates both. `shared/paths.ts` builds and parses the page +paths. ## The two rules -**Pages.** The path is a hierarchy. `@name` is a user. Any other word under -the root is a category or an app page. Under a user, each segment is a fixed -tab name, and under `dumps` or `playlists`, a slug. A view of a page is one -more segment. A default view is the bare path, with no redirect. +**Pages.** The path is a hierarchy. `@name` is a user, and `@name@host` a user +whose account lives on another instance. Any other word under the root is a +category or an app page. Under a user, each segment is a fixed tab name, and +under `dumps` or `playlists`, a slug. A view of a page is one more segment. A +default view is the bare path, with no redirect. -**API.** A resource is `/api//[/]`. Its key is its id, -except a user's, which may also be `@name`. The `@` keeps the two apart, so no -regex sniffing is needed. A read by page path mirrors the page: +**API.** A resource is `/api//[/]`. Its key is its id, except +a user's, which may also be `@name`. The `@` keeps the two apart, so no regex +sniffing is needed. A read by page path mirrors the page: `/api/users/@bob/dumps/`. The caller's own things live under `/api/me`. -Media is a sub-resource. A lookup by another key is a query filter. Each -concept has one word, the same as in pages. +Media is a sub-resource. A lookup by another key is a query filter. Each concept +has one word, the same as in pages. ## Pages -| Path | Views | Access | Page | -|---|---|---|---| -| `/` | `/hot`, `/new`, `/journal`, `/follow`; the bare `/` is the viewer's default tab | anyone, `/follow` signed in | `Index` | -| `/` | `//hot`, `/new`, `/journal`, `/follow` | anyone | `Index` | -| `/@` | the overview: dumps beside upvoted | anyone | `UserPublicProfile` | -| `/@/dumps`, `/upvoted`, `/playlists`, `/invitees` | | anyone | `UserPublicProfile` | -| `/@/follow` | `/@/follow/playlists`; the bare tab lists users | anyone | `UserPublicProfile` | -| `/@/manage` | | `user:manage`, on others' profiles | `UserPublicProfile` | -| `/@/dumps/` | | anyone; a private dump, its poster | `Dump` | -| `/@/dumps//edit` | | its poster, `dump:moderate` | `DumpEdit` | -| `/@/playlists/` | | anyone; a private playlist, its owner | `PlaylistDetail` | -| `/search?q=` | `/search/users?q=`, `/search/playlists?q=` | anyone | `Search` | -| `/notifications` | | signed in | `Notifications` | -| `/community` | `/community/monthly`; the bare path is the week | signed in | `Community` | -| `/settings` | | signed in | `Settings` | -| `/manage` | | `category:manage` | `Manage` | -| `/login`, `/register?token=` | | signed out | `UserLogin`, `UserRegister` | -| `/reset-password?token=`, `/unsubscribe?token=` | | anyone | `ResetPassword`, `Unsubscribe` | +| Path | Views | Access | Page | +| ------------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------------------- | ------------------------------ | +| `/` | `/hot`, `/new`, `/journal`, `/follow`; the bare `/` is the viewer's default tab | anyone, `/follow` signed in | `Index` | +| `/` | `//hot`, `/new`, `/journal`, `/follow` | anyone | `Index` | +| `/@` | the overview: dumps beside upvoted | anyone | `UserPublicProfile` | +| `/@/dumps`, `/upvoted`, `/playlists`, `/invitees` | | anyone | `UserPublicProfile` | +| `/@/follow` | `/@/follow/playlists`; the bare tab lists users | anyone | `UserPublicProfile` | +| `/@/manage` | | `user:manage`, on others' profiles | `UserPublicProfile` | +| `/@/dumps/` | | anyone; a private dump, its poster | `Dump` | +| `/@/dumps//edit` | | its poster, `dump:moderate` | `DumpEdit` | +| `/@/playlists/` | | anyone; a private playlist, its owner | `PlaylistDetail` | +| `/search?q=` | `/search/users?q=`, `/search/playlists?q=` | anyone | `Search` | +| `/notifications` | | signed in | `Notifications` | +| `/community` | `/community/monthly`; the bare path is the week | signed in | `Community` | +| `/settings` | | signed in | `Settings` | +| `/manage` | | `category:manage`, `federation:manage` | `Manage` | +| `/login`, `/register?token=` | `/login?next=` comes back to a page | signed out | `UserLogin`, `UserRegister` | +| `/authorize?client_id=…` | | signed in, else via `/login?next=` | `Authorize` | +| `/federation/callback?code=&state=` | | anyone | `FederationCallback` | +| `/reset-password?token=`, `/unsubscribe?token=` | | anyone | `ResetPassword`, `Unsubscribe` | `/?share_url=` opens the create form on a link shared from Android, `/?chat=open` opens the chat over any page, and `#comment-` scrolls a dump's @@ -46,39 +49,44 @@ page to a comment. ## Names -- **Slugs** of categories, dumps and playlists are lowercase letters and - digits in words joined by single hyphens (`shared/slug.ts`). A category's is - at most 50 characters, a dump's or a playlist's at most 60. +- **Slugs** of categories, dumps and playlists are lowercase letters and digits + in words joined by single hyphens (`shared/slug.ts`). A category's is at most + 50 characters, a dump's or a playlist's at most 60. - **A dump's or a playlist's slug** is made from its title when it is created, unique among its owner's items of that kind: a clash gets `-2`, `-3`. It - changes only when someone edits it: the edit forms propose - `slugify(newTitle)` when the title changes. Its owner may change it 3 times - a day; moderators (`dump:moderate`, `playlist:moderate`) may edit any slug, - at any time. -- **A username** is 1 to 32 letters, digits and underscores, unique in any - case. A page writes it in its stored case, and another case still resolves. - Users can't rename themselves: those with `user:manage` rename anyone, from + changes only when someone edits it: the edit forms propose `slugify(newTitle)` + when the title changes. Its owner may change it 3 times a day; moderators + (`dump:moderate`, `playlist:moderate`) may edit any slug, at any time. +- **A username** is 1 to 32 letters, digits and underscores, unique in any case. + A page writes it in its stored case, and another case still resolves. Users + can't rename themselves: those with `user:manage` rename anyone, from `/@/manage`. +- **A user from another instance** is `name@host` here: their name at home and + their home's host, with its port if it has one (`alice@music.example`). Their + name is their home's to change, which leaves the old handle an alias here too. + Mentions write the whole handle. - **Aliases.** A slug or a name left behind stays an alias for good, which always names the item or user itself, so redirects never chain. Nobody else - can take one. An item can take back one of its own. Deleting an item frees - its aliases. -- **Redirects.** A page reached by an alias, or by a name in another case, - gets the item from the API under its current path and replaces its URL. - The server answers the same path with a 301 to crawlers and full page loads. + can take one. An item can take back one of its own. Deleting an item frees its + aliases. +- **Redirects.** A page reached by an alias, or by a name in another case, gets + the item from the API under its current path and replaces its URL. The server + answers the same path with a 301 to crawlers and full page loads. - **Reserved words.** A category can't take a word the root already uses: `hot new journal follow search login register notifications reset-password - unsubscribe settings manage community api ws assets emojibase` - (`api/lib/reserved-slugs.ts`). Dump and playlist slugs reserve nothing, and - no slug has an `@`. + unsubscribe settings manage community authorize federation api ws assets + emojibase` + (`api/lib/reserved-slugs.ts`). Dump and playlist slugs reserve nothing, and no + slug has an `@`. ## API Every JSON endpoint answers the envelope of `shared/api.ts`: -`{ "success": true, "data": … }`, or `{ "success": false, "error": { "code", -"message" } }` with the matching HTTP status. A list answers -`{ "items", "hasMore" }` and takes `?page=` (from 1) and `?limit=` (20 by -default, 100 at most). "Signed in" means a session token as +`{ "success": true, "data": … }`, or +`{ "success": false, "error": { "code", +"message" } }` with the matching HTTP +status. A list answers `{ "items", "hasMore" }` and takes `?page=` (from 1) and +`?limit=` (20 by default, 100 at most). "Signed in" means a session token as `Authorization: Bearer …`. Media can't send a header, so a private file, thumbnail, waveform, cover or attachment takes the owner's media token as `?token=`. @@ -89,19 +97,25 @@ thumbnail, waveform, cover or attachment takes the owner's media token as - `PATCH /api/me` — signed in. Changes the description and email. - `GET /api/me/media-token` — signed in. A media token. - `GET`, `PATCH /api/me/settings` — signed in. The caller's settings. -- `PUT /api/me/password` — signed in, with the current one. A new password, - and fresh tokens. +- `PUT /api/me/password` — signed in, with the current one. A new password, and + fresh tokens. - `PUT /api/me/avatar` — signed in. A new avatar (multipart). -- `GET /api/me/playlists?contains=:dumpId` — signed in. The caller's - playlists, and whether each holds the dump. -- `GET /api/me/follow` — signed in. The ids of the users and playlists - followed. +- `GET /api/me/playlists?contains=:dumpId` — signed in. The caller's playlists, + and whether each holds the dump. +- `GET /api/me/follow` — signed in. The ids of the users and playlists followed. - `PUT`, `DELETE /api/me/follow/users/:id`, `/api/me/follow/playlists/:id` — signed in. Follows or stops following. - `GET /api/me/feed?from=users|playlists&category=` — signed in. The dumps of what the caller follows. - `GET /api/me/notifications` — signed in. The caller's notifications. - `POST /api/me/notifications/read` — signed in. Marks them all read. +- `GET /api/me/grants` — signed in. The other instances the caller's account + signs in to. +- `DELETE /api/me/grants/:host` — signed in. Withdraws one, ending the caller's + sessions there. + +An account from another instance changes its password, email, avatar and name +there: those endpoints answer it 400. ### users @@ -109,10 +123,10 @@ thumbnail, waveform, cover or attachment takes the owner's media token as - `GET /api/users?q=` — anyone. Up to 8 users whose name starts with `q`. - `GET /api/users/:key` — anyone. A profile. - `GET /api/users/:key/avatar` — anyone. The avatar. -- `GET /api/users/:key/dumps`, `/upvoted`, `/playlists` — anyone; private - items to their owner only. Their lists. -- `GET /api/users/:key/dumps/:slug`, `/playlists/:slug` — anyone; private - items to their owner only. An item by its page path, by an alias too. +- `GET /api/users/:key/dumps`, `/upvoted`, `/playlists` — anyone; private items + to their owner only. Their lists. +- `GET /api/users/:key/dumps/:slug`, `/playlists/:slug` — anyone; private items + to their owner only. An item by its page path, by an alias too. - `GET /api/users/:key/follow/users`, `/follow/playlists` — anyone. What they follow. - `GET /api/users/:key/invitees` — anyone. The tree of users they invited. @@ -125,16 +139,16 @@ thumbnail, waveform, cover or attachment takes the owner's media token as - `GET /api/dumps` — anyone. The feed; `?category=` narrows it, and `?url=` answers the dumps of the same link instead. - `GET /api/dumps/:id` — anyone who may see it. A dump. -- `GET /api/dumps/:id/voters`, `/related`, `/playlists` — the same. Who - upvoted it, the dumps linked to or from it, the playlists holding it. +- `GET /api/dumps/:id/voters`, `/related`, `/playlists` — the same. Who upvoted + it, the dumps linked to or from it, the playlists holding it. - `PUT /api/dumps/:id` — its poster, `dump:moderate`. Title, slug, note, visibility, categories, link. - `POST /api/dumps/:id/metadata` — the same. Fetches a link's preview again. - `DELETE /api/dumps/:id` — the same. Deletes it. - `GET`, `PUT /api/dumps/:id/file` — the file; a new one, by its poster or `dump:moderate`. -- `GET`, `PUT`, `DELETE /api/dumps/:id/thumbnail` — the thumbnail; a custom - one, set or removed by its poster or `dump:moderate`. +- `GET`, `PUT`, `DELETE /api/dumps/:id/thumbnail` — the thumbnail; a custom one, + set or removed by its poster or `dump:moderate`. - `GET /api/dumps/:id/waveform` — anyone who may see it. An audio file's waveform, `{ "peaks" }`, for the player to seek on. - `GET`, `POST /api/dumps/:id/comments` — anyone who may see the dump; posting @@ -144,18 +158,18 @@ thumbnail, waveform, cover or attachment takes the owner's media token as - `POST /api/playlists` — signed in. Creates a playlist. - `GET /api/playlists/:id` — anyone who may see it. A playlist and its dumps. -- `PUT`, `DELETE /api/playlists/:id` — its owner, `playlist:moderate`. - Title, slug, description, visibility; deletion. -- `POST`, `DELETE /api/playlists/:id/dumps/:dumpId` — the same. Adds or - removes a dump. +- `PUT`, `DELETE /api/playlists/:id` — its owner, `playlist:moderate`. Title, + slug, description, visibility; deletion. +- `POST`, `DELETE /api/playlists/:id/dumps/:dumpId` — the same. Adds or removes + a dump. - `PUT /api/playlists/:id/order` — the same. Reorders its dumps. -- `GET`, `PUT /api/playlists/:id/cover` — the cover; a new one, by its owner - or `playlist:moderate`. +- `GET`, `PUT /api/playlists/:id/cover` — the cover; a new one, by its owner or + `playlist:moderate`. ### comments -- `PATCH`, `DELETE /api/comments/:id` — its author, `comment:moderate`. Edits - or deletes a comment. +- `PATCH`, `DELETE /api/comments/:id` — its author, `comment:moderate`. Edits or + deletes a comment. - `GET /api/comments/:id/likers` — anyone. Who likes it. ### categories @@ -166,17 +180,17 @@ thumbnail, waveform, cover or attachment takes the owner's media token as ### community -- `GET /api/community?period=weekly|monthly` — signed in. The site's top - dumps, new members, new public playlists and totals over the last week (by - default) or month, as of the server's last refresh. +- `GET /api/community?period=weekly|monthly` — signed in. The site's top dumps, + new members, new public playlists and totals over the last week (by default) + or month, as of the server's last refresh. ### chat - `GET /api/chat?before=&after=` — signed in. A page of messages. The chat itself goes over `/ws`. -- A message from a moderator or an admin (`chat:everyone`) that says - `@everyone` notifies every user who doesn't have the chat open, and comes - flagged `mentionsEveryone`. No account may be named `everyone`. +- A message from a moderator or an admin (`chat:everyone`) that says `@everyone` + notifies every user who doesn't have the chat open, and comes flagged + `mentionsEveryone`. No account may be named `everyone`. ### invites @@ -188,10 +202,36 @@ thumbnail, waveform, cover or attachment takes the owner's media token as - `POST /api/sessions` — anyone. Signs in. - `POST /api/password-resets` — anyone. Emails a reset link. - `PUT /api/password-resets/:token` — with the link's token. A new password. -- `POST /api/unsubscribe?token=` — with a digest's token. Turns it off. Its - v3 path, `POST /api/users/unsubscribe`, stays for good, since sent emails' +- `POST /api/unsubscribe?token=` — with a digest's token. Turns it off. Its v3 + path, `POST /api/users/unsubscribe`, stays for good, since sent emails' `List-Unsubscribe` headers name it. +### federation, oauth, .well-known + +Federated sign-in (`shared/federation.ts`): a user signs in here with their +account on another gerbeur instance, their home, by OpenID Connect's +authorization code flow with PKCE, with tokens signed by each instance's Ed25519 +key. + +- `GET /.well-known/openid-configuration`, `/.well-known/jwks.json` — anyone. + The instance's metadata and public keys, bare JSON: the one exception to the + `/api/` rule, at the paths the standard fixes. +- `POST /api/federation/logins` — anyone. Starts a sign-in with an account on + another instance; one neither trusted nor already home to someone here needs + an invite. +- `POST /api/federation/sessions` — anyone. Finishes it, as a sign-in. +- `POST /api/federation/events` — another instance. Its signed news of one of + its users here: a new name, email or avatar, or the end of their sessions. +- `GET /api/federation/peers` — anyone the trusted instances, + `federation:manage` every listed one. +- `PUT /api/federation/peers`, `DELETE /api/federation/peers/:host` — + `federation:manage`. Trusts or blocks an instance, or takes it off the lists. +- `GET /api/oauth/clients?client_id=` — signed in. The instance asking to sign + the caller in. +- `POST /api/oauth/codes` — signed in. The caller's consent, and a code. +- `POST /api/oauth/tokens` — another instance, form-encoded. Trades a code for + an identity token, bare JSON. + ### search - `GET /api/search?q=` — anyone. A page of dumps, and up to 20 users and @@ -211,5 +251,5 @@ thumbnail, waveform, cover or attachment takes the owner's media token as ### /ws -- `GET /ws?token=` — anyone; a session token signs it in. The WebSocket of - live updates and the chat (`shared/ws.ts`). +- `GET /ws?token=` — anyone; a session token signs it in. The WebSocket of live + updates and the chat (`shared/ws.ts`). diff --git a/README.md b/README.md index 655497d5..7bc283b4 100644 --- a/README.md +++ b/README.md @@ -60,6 +60,7 @@ variables: | `GERBEUR_EMAIL_LOCALE` | Language of every email: `en` or `fr` | `en` | | `GERBEUR_DEFAULT_STYLE` | The instance's style (`smooth`, `brutalist`, `geocities`, `nyt`, `kanagawa`, `melange`): the site's until one is picked, and the welcome and reset emails' | `smooth` | | `GERBEUR_WELCOME_EMAIL_BODY` | Markdown body for the account-creation welcome email; supports `{{username}}` and `{{site_name}}` | built-in template | +| `GERBEUR_FEDERATION_ALLOW_PRIVATE` | `1` lets federated sign-in reach instances on private addresses and over http — for two instances on one machine, never in production | unset | | `GERBEUR_COMMUNITY_REFRESH_MINUTES` | How often, in minutes, the `/community` page's figures are recomputed | `15` | | `VITE_API_PROTOCOL` | API protocol baked into the frontend bundle (see [Production](#production)) | `http` | | `VITE_API_HOSTNAME` | API hostname baked into the frontend bundle | `localhost` | @@ -122,6 +123,28 @@ example.com { } ``` +### Several instances + +Each instance is its own deployment, with its own database, uploads, admins and +domain, but its users can sign in to the others with their account, and the +other way round. A user from `music.example` is `@alice@music.example` on the +instances they sign in to. Their password, email, avatar and name stay on their +home instance, and the others follow its changes. + +Every instance is ready for it: nothing to configure, as long as +`GERBEUR_PUBLIC_URL` is the instance's https origin (no path) and the instances +can reach each other. An admin decides who comes in, on `/manage`: + +- users of a **trusted** instance sign in directly, from a button on the login + page; +- users of a **blocked** instance can't, and those already in are signed out; +- users of **any other** instance join with an invite, from the register page, + and sign in without one afterwards. + +To try it on one machine, run two instances on different ports with +`GERBEUR_FEDERATION_ALLOW_PRIVATE=1`, which lets them reach each other over +plain http on localhost. Never set it in production. + ## Project structure ``` @@ -165,13 +188,13 @@ public/ # Static assets (favicon, manifest, service worker) ### URLs -Every page and API path follows one of two rules, which [API.md](API.md) -states, along with every page, the slug and username rules and every -endpoint. Pages are a hierarchy under `@name` for users and plain words for -categories and app pages (`/@bob/dumps/never-gonna`, `/music/hot`), built and -parsed by `shared/paths.ts`. API resources are `/api//`, the -caller's own under `/api/me`. A route change updates its router's module doc -and API.md together. +Every page and API path follows one of two rules, which [API.md](API.md) states, +along with every page, the slug and username rules and every endpoint. Pages are +a hierarchy under `@name` for users and plain words for categories and app pages +(`/@bob/dumps/never-gonna`, `/music/hot`), built and parsed by +`shared/paths.ts`. API resources are `/api//`, the caller's own +under `/api/me`. A route change updates its router's module doc and API.md +together. Whatever crosses the wire is defined once, in `shared/`: the API envelope (`shared/api.ts`), each domain's types and request bodies (`shared/dump.ts`, diff --git a/api/config.ts b/api/config.ts index 6eab9ed8..12f576d6 100644 --- a/api/config.ts +++ b/api/config.ts @@ -222,3 +222,13 @@ export const ALLOWED_ORIGINS: string[] = Array.from( ...rawOrigins.split(",").map((o) => o.trim()).filter(Boolean), ]), ); + +/** + * Lets federated sign-in reach instances on private addresses, `localhost` + * among them, and over plain http (`GERBEUR_FEDERATION_ALLOW_PRIVATE=1`), so + * that two instances on one machine can trust each other in development. + * Off, `remote/gerbeur-instance.ts` reaches only public https instances, since + * an identity is only as safe as the connection it came over. + */ +export const FEDERATION_ALLOW_PRIVATE: boolean = + Deno.env.get("GERBEUR_FEDERATION_ALLOW_PRIVATE")?.trim() === "1"; diff --git a/api/db/migrate.ts b/api/db/migrate.ts index c171e117..d00433ce 100644 --- a/api/db/migrate.ts +++ b/api/db/migrate.ts @@ -30,6 +30,7 @@ import { up as up0020DigestSchedule } from "./migrations/0020_digest_schedule.ts import { up as up0021PageUrls } from "./migrations/0021_page_urls.ts"; import { up as up0022ReserveCommunity } from "./migrations/0022_reserve_community.ts"; import { up as up0023MentionEveryone } from "./migrations/0023_mention_everyone.ts"; +import { up as up0024Federation } from "./migrations/0024_federation.ts"; interface Migration { name: string; @@ -72,6 +73,7 @@ const MIGRATIONS: Migration[] = [ { name: "0021_page_urls", up: up0021PageUrls }, { name: "0022_reserve_community", up: up0022ReserveCommunity }, { name: "0023_mention_everyone", up: up0023MentionEveryone }, + { name: "0024_federation", up: up0024Federation }, ]; /** diff --git a/api/db/migrations/0024_federation.ts b/api/db/migrations/0024_federation.ts new file mode 100644 index 00000000..032824c4 --- /dev/null +++ b/api/db/migrations/0024_federation.ts @@ -0,0 +1,105 @@ +/** + * Prepares federated sign-in, by which a user signs in here with their + * account on another gerbeur instance, and the other way round. It adds the + * instance's signing key, the link from a local account to the one it stands + * for elsewhere, the instances an admin trusts or blocks, the state of the + * sign-ins in progress on both sides, the grants users gave other instances, + * and the events owed to them. + * + * `/authorize` and `/federation/callback` become pages, so their first + * segments are reserved. + * + * An account from another instance has no password here: its `password_hash` + * is `''`, which no password verifies. Emails stay unique among local accounts + * only, since the same person may also have a local account, or come from two + * instances, with one address. + * + * @module + */ + +import type { DatabaseSync } from "node:sqlite"; +import { renameReservedCategories } from "../../lib/reserved-slugs.ts"; + +/** + * Run once by `runMigrations`. Nothing exists to convert, since every account + * so far is local, but `authorize` and `federation` become the pages of a + * sign-in, so a category that had one as its slug is renamed. + */ +export function up(db: DatabaseSync): void { + db.exec(` + CREATE TABLE IF NOT EXISTS federation_keys ( + kid TEXT PRIMARY KEY, + private_jwk TEXT NOT NULL, + public_jwk TEXT NOT NULL, + created_at TEXT NOT NULL + ); + + CREATE TABLE IF NOT EXISTS user_identities ( + user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE, + issuer TEXT NOT NULL, + subject TEXT NOT NULL, + picture TEXT, + synced_at TEXT NOT NULL + ); + CREATE UNIQUE INDEX IF NOT EXISTS idx_user_identities_subject + ON user_identities(issuer, subject); + + CREATE TABLE IF NOT EXISTS federation_peers ( + issuer TEXT PRIMARY KEY, + status TEXT NOT NULL, + name TEXT, + created_at TEXT NOT NULL + ); + + CREATE TABLE IF NOT EXISTS federation_logins ( + state TEXT PRIMARY KEY, + issuer TEXT NOT NULL, + code_verifier TEXT NOT NULL, + nonce TEXT NOT NULL, + invite_token TEXT, + created_at TEXT NOT NULL + ); + + CREATE TABLE IF NOT EXISTS oauth_codes ( + code_hash TEXT PRIMARY KEY, + user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, + client_id TEXT NOT NULL, + redirect_uri TEXT NOT NULL, + code_challenge TEXT NOT NULL, + nonce TEXT NOT NULL, + expires_at TEXT NOT NULL + ); + + CREATE TABLE IF NOT EXISTS federation_grants ( + user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, + client_id TEXT NOT NULL, + client_name TEXT, + granted_at TEXT NOT NULL, + last_used_at TEXT NOT NULL, + PRIMARY KEY (user_id, client_id) + ); + + CREATE TABLE IF NOT EXISTS federation_outbox ( + id TEXT PRIMARY KEY, + client_id TEXT NOT NULL, + event TEXT NOT NULL, + attempts INTEGER NOT NULL DEFAULT 0, + next_attempt_at TEXT NOT NULL, + created_at TEXT NOT NULL + ); + CREATE INDEX IF NOT EXISTS idx_federation_outbox_next + ON federation_outbox(next_attempt_at); + `); + + const emailIndex = db.prepare( + `SELECT sql FROM sqlite_master WHERE name = 'idx_users_email_lower';`, + ).get() as { sql: string } | undefined; + if (!emailIndex?.sql.includes("WHERE")) { + db.exec(` + DROP INDEX IF EXISTS idx_users_email_lower; + CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email)) + WHERE password_hash != ''; + `); + } + renameReservedCategories(db); +} diff --git a/api/db/schema.sql b/api/db/schema.sql index f4cdd1cd..42d55c9b 100644 --- a/api/db/schema.sql +++ b/api/db/schema.sql @@ -176,7 +176,10 @@ CREATE TABLE invites ( CREATE INDEX idx_invites_inviter ON invites(inviter_id); CREATE INDEX idx_users_invited_by ON users(invited_by); CREATE UNIQUE INDEX idx_users_username_lower ON users(lower(username)); -CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email)); +-- An account from another instance has no password (''), and its email may +-- also be a local account's. +CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email)) + WHERE password_hash != ''; CREATE TABLE attachments ( id TEXT PRIMARY KEY, @@ -270,3 +273,65 @@ CREATE TABLE chat_messages ( ); CREATE INDEX idx_chat_messages_created_id ON chat_messages(created_at, id); CREATE INDEX idx_chat_messages_user ON chat_messages(user_id); + +CREATE TABLE federation_keys ( + kid TEXT PRIMARY KEY, + private_jwk TEXT NOT NULL, + public_jwk TEXT NOT NULL, + created_at TEXT NOT NULL +); + +CREATE TABLE user_identities ( + user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE, + issuer TEXT NOT NULL, + subject TEXT NOT NULL, + picture TEXT, + synced_at TEXT NOT NULL +); +CREATE UNIQUE INDEX idx_user_identities_subject + ON user_identities(issuer, subject); + +CREATE TABLE federation_peers ( + issuer TEXT PRIMARY KEY, + status TEXT NOT NULL, + name TEXT, + created_at TEXT NOT NULL +); + +CREATE TABLE federation_logins ( + state TEXT PRIMARY KEY, + issuer TEXT NOT NULL, + code_verifier TEXT NOT NULL, + nonce TEXT NOT NULL, + invite_token TEXT, + created_at TEXT NOT NULL +); + +CREATE TABLE oauth_codes ( + code_hash TEXT PRIMARY KEY, + user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, + client_id TEXT NOT NULL, + redirect_uri TEXT NOT NULL, + code_challenge TEXT NOT NULL, + nonce TEXT NOT NULL, + expires_at TEXT NOT NULL +); + +CREATE TABLE federation_grants ( + user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, + client_id TEXT NOT NULL, + client_name TEXT, + granted_at TEXT NOT NULL, + last_used_at TEXT NOT NULL, + PRIMARY KEY (user_id, client_id) +); + +CREATE TABLE federation_outbox ( + id TEXT PRIMARY KEY, + client_id TEXT NOT NULL, + event TEXT NOT NULL, + attempts INTEGER NOT NULL DEFAULT 0, + next_attempt_at TEXT NOT NULL, + created_at TEXT NOT NULL +); +CREATE INDEX idx_federation_outbox_next ON federation_outbox(next_attempt_at); diff --git a/api/lib/jwt.ts b/api/lib/jwt.ts index 5e9e8067..d4eef608 100644 --- a/api/lib/jwt.ts +++ b/api/lib/jwt.ts @@ -4,12 +4,27 @@ * expiry are checked here: `lib/auth.ts` checks a session or media token * against its user. * + * It also signs and verifies the tokens instances exchange for federated + * sign-in (identity tokens and events), EdDSA with the instance's Ed25519 key, + * whose public half other instances fetch: `instance-key-service.ts` keeps + * the key, and the federation services pass it in. + * * Importing this module throws when `GERBEUR_JWT_SECRET` is unset. * * @module */ -import { jwtVerify, SignJWT } from "@panva/jose"; +import { + createLocalJWKSet, + exportJWK, + generateKeyPair, + importJWK, + type JSONWebKeySet, + type JWK, + type JWTPayload, + jwtVerify, + SignJWT, +} from "@panva/jose"; import { type AuthPayload, @@ -184,3 +199,99 @@ export async function verifyUnsubscribeToken( return null; } } + +/** + * The algorithm of the tokens instances exchange: Ed25519 signatures, short + * and fast, with no parameters to get wrong. + */ +const INSTANCE_ALG = "EdDSA"; + +/** + * An instance's key, ready to sign, from {@link importInstanceKey}. Its + * `kid` names the public half in the instance's JWKS. + */ +export interface InstanceSigningKey { + kid: string; + privateKey: CryptoKey; +} + +/** + * Returns a new Ed25519 key pair as JWKs, with a random `kid`, for + * `instance-key-service.ts` to store when the instance has none. The public + * JWK carries the `kid`, `alg` and `use` a JWKS entry needs. + */ +export async function generateInstanceKey(): Promise< + { kid: string; privateJwk: JWK; publicJwk: JWK } +> { + const { privateKey, publicKey } = await generateKeyPair(INSTANCE_ALG, { + crv: "Ed25519", + extractable: true, + }); + const kid = crypto.randomUUID(); + return { + kid, + privateJwk: await exportJWK(privateKey), + publicJwk: { + ...await exportJWK(publicKey), + kid, + alg: INSTANCE_ALG, + use: "sig", + }, + }; +} + +/** Returns the stored private JWK `privateJwk` as a key to sign with. */ +export async function importInstanceKey( + kid: string, + privateJwk: JWK, +): Promise { + const privateKey = await importJWK(privateJwk, INSTANCE_ALG); + if (!(privateKey instanceof CryptoKey)) { + throw new Error("The instance key is not an asymmetric key"); + } + return { kid, privateKey }; +} + +/** + * Signs `payload` with the instance's key, from `issuer` (this instance) to + * `audience` (the instance it is for), valid for `expiresIn`, with a random + * `jti`. The identity tokens of `POST /api/oauth/tokens` and the events of + * the outbox are signed with it. + */ +export async function signInstanceToken( + payload: JWTPayload, + key: InstanceSigningKey, + claims: { issuer: string; audience: string; subject: string }, + expiresIn: string, +): Promise { + return await new SignJWT(payload) + .setProtectedHeader({ alg: INSTANCE_ALG, kid: key.kid }) + .setIssuer(claims.issuer) + .setAudience(claims.audience) + .setSubject(claims.subject) + .setIssuedAt() + .setJti(crypto.randomUUID()) + .setExpirationTime(expiresIn) + .sign(key.privateKey); +} + +/** + * Returns the payload of `token` once its signature checks against `jwks`, + * the keys of `issuer`, and it is addressed to `audience` and unexpired. + * + * @throws {Error} jose's error when it doesn't verify; its `code` is + * `ERR_JWKS_NO_MATCHING_KEY` when no key of `jwks` has its `kid`, which + * tells the caller to refetch the keys, the issuer having rotated them. + */ +export async function verifyInstanceToken( + token: string, + jwks: JSONWebKeySet, + claims: { issuer: string; audience: string }, +): Promise { + const { payload } = await jwtVerify(token, createLocalJWKSet(jwks), { + issuer: claims.issuer, + audience: claims.audience, + algorithms: [INSTANCE_ALG], + }); + return payload; +} diff --git a/api/lib/reserved-slugs.ts b/api/lib/reserved-slugs.ts index 14281273..a222c9f9 100644 --- a/api/lib/reserved-slugs.ts +++ b/api/lib/reserved-slugs.ts @@ -32,6 +32,8 @@ export const RESERVED_SLUGS: readonly string[] = [ "settings", "manage", "community", + "authorize", + "federation", "api", "ws", "assets", @@ -46,7 +48,8 @@ export function isReservedSlug(slug: string): boolean { /** * Renames each category whose slug is now reserved, such as `hot`, to the * first of `-2`, `-3`… that is free, and logs it. Migration 0021 - * runs it for v4's words, and 0022 for `community`. + * runs it for v4's words, 0022 for `community`, and 0024 for `authorize` and + * `federation`. */ export function renameReservedCategories(db: DatabaseSync): void { const rows = db.prepare(`SELECT id, slug FROM categories;`).all() as { diff --git a/api/main.ts b/api/main.ts index 7de740ae..a72708eb 100644 --- a/api/main.ts +++ b/api/main.ts @@ -19,10 +19,12 @@ import communityRouter from "./routes/community.ts"; import commentsRouter from "./routes/comments.ts"; import dumpsRouter from "./routes/dumps.ts"; import filesRouter from "./routes/files.ts"; +import federationRouter from "./routes/federation.ts"; import followsRouter from "./routes/follows.ts"; import invitesRouter from "./routes/invites.ts"; import meRouter from "./routes/me.ts"; import notificationsRouter from "./routes/notifications.ts"; +import oauthRouter from "./routes/oauth.ts"; import passwordResetsRouter from "./routes/password-resets.ts"; import playlistsRouter from "./routes/playlists.ts"; import remoteRouter from "./routes/remote.ts"; @@ -32,6 +34,7 @@ import thumbnailsRouter from "./routes/thumbnails.ts"; import waveformsRouter from "./routes/waveforms.ts"; import unsubscribeRouter from "./routes/unsubscribe.ts"; import usersRouter from "./routes/users.ts"; +import wellKnownRouter from "./routes/well-known.ts"; import wsRouter from "./routes/ws.ts"; import { ALLOWED_ORIGINS, LISTEN_HOST, PORT, PUBLIC_URL } from "./config.ts"; @@ -43,6 +46,7 @@ import { rateLimitSweepJob } from "./lib/rate-limit.ts"; import { digestJob } from "./services/digest-service.ts"; import { communityJob } from "./services/community-service.ts"; import { pingJob, typingExpiryJob } from "./services/ws-service.ts"; +import { outboxJob } from "./services/identity-provider-service.ts"; /** * The whole server, exported so the tests' helpers can send it requests @@ -87,6 +91,9 @@ for ( invitesRouter, attachmentsRouter, remoteRouter, + federationRouter, + oauthRouter, + wellKnownRouter, wsRouter, ] ) { @@ -114,6 +121,7 @@ if (import.meta.main) { pingJob, typingExpiryJob, rateLimitSweepJob, + outboxJob, ]); await app.listen({ hostname: LISTEN_HOST, port: PORT }); } diff --git a/api/model/user.ts b/api/model/user.ts index a4a195de..0aafb1ca 100644 --- a/api/model/user.ts +++ b/api/model/user.ts @@ -19,8 +19,22 @@ import { * it carries the password hash. */ export interface User extends SelfUser { - /** From `hashPassword`, as `hash.salt`. */ - passwordHash: string; + /** + * From `hashPassword`, as `hash.salt`, or null for an account from another + * instance ({@link isRemoteUser}), which signs in there and never with a + * password here. The row stores that as `''`. + */ + passwordHash: string | null; +} + +/** + * Checks whether `user`'s account lives on another instance, whose user signs + * in here through federation (`federation-service.ts`). Their password, + * email, avatar and name are that instance's to change, so the routes that + * change them here refuse. + */ +export function isRemoteUser(user: User): boolean { + return user.passwordHash === null; } /** @@ -49,6 +63,7 @@ export function toSelfUser({ passwordHash: _, ...user }: User): SelfUser { export interface UserRow { id: string; username: string; + /** `''` for an account from another instance, which has no password. */ password_hash: string; role: Role; created_at: string; @@ -97,7 +112,7 @@ export function userRowToApi(row: UserRow): User { return { id: row.id, username: row.username, - passwordHash: row.password_hash, + passwordHash: row.password_hash || null, role: row.role, createdAt: new Date(row.created_at), updatedAt: row.updated_at ? new Date(row.updated_at) : undefined, @@ -118,7 +133,7 @@ export function userApiToRow(user: User): UserRow { return { id: user.id, username: user.username, - password_hash: user.passwordHash, + password_hash: user.passwordHash ?? "", role: user.role, created_at: user.createdAt.toISOString(), updated_at: user.updatedAt?.toISOString() ?? null, diff --git a/api/remote/gerbeur-instance.ts b/api/remote/gerbeur-instance.ts new file mode 100644 index 00000000..a5bb9ba4 --- /dev/null +++ b/api/remote/gerbeur-instance.ts @@ -0,0 +1,224 @@ +/** + * Talks to other gerbeur instances for federated sign-in: it reads their + * metadata and public keys, trades a code for an identity token, delivers + * events, and fetches a user's avatar. `federation-service.ts`, + * `identity-provider-service.ts` and `federation-peer-service.ts` reach other + * instances only through it. + * + * An identity is only as safe as the connection it came over, so unlike + * `fetch.ts` it never falls back to skipping certificate checks, and follows + * no redirect. It reaches only https instances on public addresses, unless + * `GERBEUR_FEDERATION_ALLOW_PRIVATE` lets two instances on one machine talk. + * + * @module + */ + +import type { JSONWebKeySet } from "@panva/jose"; +import { + type InstanceMetadata, + isInstanceMetadata, +} from "../../shared/federation.ts"; +import { + FEDERATION_ALLOW_PRIVATE, + MAX_IMAGE_SIZE_BYTES, + OG_SITE_NAME, +} from "../config.ts"; +import { resolvePublicAddress } from "./public-address.ts"; +import { readBytesCapped, readTextCapped } from "./fetch.ts"; +import { TtlCache } from "../lib/ttl-cache.ts"; + +/** How long a request to another instance may take, body included. */ +const TIMEOUT_MS = 8000; + +/** Caps a metadata document, a key set or a token response. */ +const MAX_JSON_BYTES = 64 * 1024; + +const USER_AGENT = `gerbeur (${OG_SITE_NAME}; federation)`; + +/** + * Keeps each instance's metadata and keys for 10 minutes, so that a sign-in + * or an event doesn't fetch them each time. A key set is refetched sooner + * when a token names a key it lacks ({@link fetchKeys} with `fresh`). + */ +const metadataCache = new TtlCache(10 * 60_000, 500); +const keysCache = new TtlCache(10 * 60_000, 500); + +/** + * Checks that `url` may be reached: https on a public address, or anything + * under `GERBEUR_FEDERATION_ALLOW_PRIVATE`. + * + * @throws {Error} When it may not. + */ +export async function assertReachable(url: URL): Promise { + if (FEDERATION_ALLOW_PRIVATE) { + if (url.protocol !== "https:" && url.protocol !== "http:") { + throw new Error(`Unsupported protocol ${url.protocol}`); + } + return; + } + if (url.protocol !== "https:") { + throw new Error(`Refusing to reach ${url.origin} without https`); + } + await resolvePublicAddress(url); +} + +/** + * Makes one request to another instance, after {@link assertReachable}, with + * the deadline covering the body. The caller reads or cancels the body. + */ +async function request(url: string, init: RequestInit = {}): Promise { + const target = new URL(url); + await assertReachable(target); + return await fetch(target, { + ...init, + redirect: "error", + signal: AbortSignal.timeout(TIMEOUT_MS), + headers: { + "User-Agent": USER_AGENT, + "Accept": "application/json", + ...init.headers, + }, + }); +} + +/** + * Returns the JSON body of `res`, up to {@link MAX_JSON_BYTES}. + * + * @throws {Error} When the status isn't a success or the body isn't JSON. + */ +async function readJson(res: Response, what: string): Promise { + if (!res.ok) { + await res.body?.cancel(); + throw new Error(`${what} answered ${res.status}`); + } + return JSON.parse(await readTextCapped(res, MAX_JSON_BYTES)); +} + +/** + * Returns the metadata of the instance at `origin`, from its + * `/.well-known/openid-configuration`, cached. It must name `origin` as its + * issuer and speak this protocol's version. + * + * @throws {Error} When it can't be reached or isn't a gerbeur instance. + */ +export async function fetchMetadata(origin: string): Promise { + const hit = metadataCache.get(origin); + if (hit) return hit; + const body = await readJson( + await request(`${origin}/.well-known/openid-configuration`), + origin, + ); + if (!isInstanceMetadata(body)) { + throw new Error(`${origin} is not a gerbeur instance this one can trust`); + } + if (body.issuer !== origin) { + throw new Error(`${origin} names itself ${body.issuer}`); + } + return metadataCache.set(origin, body); +} + +/** + * Returns the public keys of the instance at `origin`, cached unless `fresh` + * asks to refetch them. + * + * @throws {Error} When they can't be fetched. + */ +export async function fetchKeys( + origin: string, + fresh = false, +): Promise { + const hit = fresh ? undefined : keysCache.get(origin); + if (hit) return hit; + const { jwks_uri } = await fetchMetadata(origin); + const body = await readJson(await request(jwks_uri), `${origin}'s keys`); + if ( + !body || typeof body !== "object" || + !Array.isArray((body as { keys?: unknown }).keys) + ) { + throw new Error(`${origin}'s keys are not a key set`); + } + return keysCache.set(origin, body as JSONWebKeySet); +} + +/** + * Trades `code` for an identity token at the token endpoint of the instance + * at `origin`, and returns the token, unverified. + * + * @throws {Error} When the instance refuses or answers no token. + */ +export async function exchangeCode( + origin: string, + params: { + code: string; + clientId: string; + redirectUri: string; + codeVerifier: string; + }, +): Promise { + const { token_endpoint } = await fetchMetadata(origin); + const body = await readJson( + await request(token_endpoint, { + method: "POST", + headers: { "Content-Type": "application/x-www-form-urlencoded" }, + body: new URLSearchParams({ + grant_type: "authorization_code", + code: params.code, + client_id: params.clientId, + redirect_uri: params.redirectUri, + code_verifier: params.codeVerifier, + }), + }), + `${origin}'s token endpoint`, + ); + const idToken = (body as { id_token?: unknown } | null)?.id_token; + if (typeof idToken !== "string") { + throw new Error(`${origin} answered no identity token`); + } + return idToken; +} + +/** + * Sends the signed event `event` to the events endpoint of the instance at + * `origin`, and returns whether it took it. A 4xx other than 429 means it never + * will, which the caller treats as delivered. + * + * @throws {Error} When it can't be reached, or answers 429 or a 5xx. + */ +export async function postEvent( + origin: string, + event: string, +): Promise { + const { gerbeur_events_endpoint } = await fetchMetadata(origin); + const res = await request(gerbeur_events_endpoint, { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ event }), + }); + await res.body?.cancel(); + if (res.ok) return true; + if (res.status === 429 || res.status >= 500) { + throw new Error(`${origin}'s events endpoint answered ${res.status}`); + } + return false; +} + +/** + * Returns the image at `url`, a user's avatar on their home instance, up to + * the size an avatar may be. + * + * @throws {Error} When it can't be fetched. + */ +export async function fetchAvatar(url: string): Promise { + const res = await request(url, { headers: { "Accept": "image/*" } }); + if (!res.ok) { + await res.body?.cancel(); + throw new Error(`The avatar at ${url} answered ${res.status}`); + } + return await readBytesCapped(res, MAX_IMAGE_SIZE_BYTES + 1); +} + +/** Empties the caches, for the tests' reset between cases. */ +export function clearInstanceCaches(): void { + metadataCache.clear(); + keysCache.clear(); +} diff --git a/api/routes/avatars.ts b/api/routes/avatars.ts index abe2f32e..8e01b364 100644 --- a/api/routes/avatars.ts +++ b/api/routes/avatars.ts @@ -5,7 +5,8 @@ * * - `PUT /api/me/avatar` — signed in. Replaces the caller's avatar (multipart * `file`, at most 5 MB), sends `user_updated` to everyone, and answers the - * caller's user. + * caller's user. 400 for an account from another instance, whose avatar + * comes from there. The instances the caller signed in to are told. * - `GET /api/users/:key/avatar` — public. Serves a user's avatar; 404 without * one. * @@ -15,23 +16,17 @@ import { Router } from "@oak/oak"; import { authMiddleware } from "../middleware/auth.ts"; import { + assertLocalUser, getUserById, resolveUserKey, - updateUserAvatar, + setUserAvatar, } from "../services/user-service.ts"; -import { - broadcastUserUpdated, - updateClientAvatar, -} from "../services/ws-service.ts"; import { type APIResponse } from "../../shared/api.ts"; import { APIException } from "../lib/api-exception.ts"; import type { SelfUser } from "../../shared/user.ts"; -import { toPublicUser, toSelfUser } from "../model/user.ts"; -import { - replaceUploadedFile, - serveUploadedFile, - validateImageUpload, -} from "../lib/upload.ts"; +import { toSelfUser } from "../model/user.ts"; +import { serveUploadedFile } from "../lib/upload.ts"; +import { notifyClients } from "../services/identity-provider-service.ts"; import { AVATARS_DIR } from "../config.ts"; /** @@ -54,19 +49,12 @@ router.put("/api/me/avatar", authMiddleware, async (ctx) => { throw new APIException(400, "Missing file field"); } - const data = new Uint8Array(await file.arrayBuffer()); - const mime = validateImageUpload(data); - - // Written before the record announces it, or clients would fetch it too - // early. - await replaceUploadedFile(`${AVATARS_DIR}/${authPayload.userId}`, data); - updateUserAvatar(authPayload.userId, mime); - updateClientAvatar(authPayload.userId, mime); - - const user = getUserById(authPayload.userId); - // Presence alone would update only the online list; `user_updated` reaches - // every avatar on screen, and its bumped `updatedAt` busts their cache. - broadcastUserUpdated(toPublicUser(user)); + assertLocalUser(getUserById(authPayload.userId)); + const user = await setUserAvatar( + authPayload.userId, + new Uint8Array(await file.arrayBuffer()), + ); + await notifyClients(user.id, { type: "update" }); const responseBody: APIResponse = { success: true, data: toSelfUser(user), diff --git a/api/routes/federation.ts b/api/routes/federation.ts new file mode 100644 index 00000000..9e4f54b2 --- /dev/null +++ b/api/routes/federation.ts @@ -0,0 +1,149 @@ +/** + * Lets users of other gerbeur instances sign in here with their account + * there, as `federation-service.ts` describes, and lets admins pick the + * instances to trust or block. The login and register pages start a sign-in, + * the `/federation/callback` page finishes it, `/manage` edits the peers, and + * the other instances' servers send their events. + * + * - `POST /api/federation/logins` — public. Starts a sign-in with an account + * on another instance (`FederationLoginRequest`, with an invite unless it + * is trusted), and answers its `/authorize` page to go to. Rate-limited per + * instance. + * - `POST /api/federation/sessions` — public. Finishes it + * (`FederationSessionRequest`) and answers the user and their tokens, as a + * sign-in does. Rate-limited per instance. + * - `POST /api/federation/events` — public, server to server. Applies a + * home instance's signed event about one of its users (`{ event }`). + * - `GET /api/federation/peers` — optional sign-in. Answers the trusted + * instances, or every listed one to `federation:manage`. + * - `PUT /api/federation/peers` — permission `federation:manage`. Trusts or + * blocks an instance (`SetPeerRequest`) and answers it; 502 when it + * doesn't answer as a gerbeur. + * - `DELETE /api/federation/peers/:host` — permission `federation:manage`. + * Takes an instance off the lists. + * + * @module + */ + +import { Router } from "@oak/oak"; +import type { APIResponse } from "../../shared/api.ts"; +import { + type FederationLoginResponse, + type FederationPeer, + parseInstance, +} from "../../shared/federation.ts"; +import type { AuthResponse } from "../../shared/user.ts"; +import { APIException } from "../lib/api-exception.ts"; +import { parseOptionalAuth } from "../lib/auth.ts"; +import { issueTokens } from "../lib/jwt.ts"; +import { hasPermission } from "../../shared/permissions.ts"; +import { type RateLimit, takeToken } from "../lib/rate-limit.ts"; +import { + type AuthContext, + authMiddleware, + requirePermission, +} from "../middleware/auth.ts"; +import { toSelfUser } from "../model/user.ts"; +import { + isFederationLoginRequest, + isFederationSessionRequest, + isSetPeerRequest, +} from "../validators/federation.ts"; +import { + completeLogin, + receiveEvent, + startLogin, +} from "../services/federation-service.ts"; +import { + listPeers, + removePeer, + setPeer, +} from "../services/federation-peer-service.ts"; +import { getUserById } from "../services/user-service.ts"; +import { fieldOf } from "../validators/user.ts"; + +/** + * Allows a burst of 30 sign-ins per instance, then one every 2 seconds, so + * that nobody makes this instance hammer another. + */ +const LOGIN_LIMIT: RateLimit = { capacity: 30, refill: 1 / 2 }; + +/** + * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware. + * An `APIException` thrown by a handler becomes the JSON error response there. + */ +const router: Router = new Router({ prefix: "/api/federation" }); + +router.post("/logins", async (ctx) => { + const body: unknown = await ctx.request.body.json(); + if (!isFederationLoginRequest(body)) { + throw new APIException(400, "Invalid request"); + } + if (!takeToken(`federation:${parseInstance(body.instance)}`, LOGIN_LIMIT)) { + throw new APIException(429, "Too many sign-ins — try again in a minute"); + } + const responseBody: APIResponse = { + success: true, + data: { authorizeUrl: await startLogin(body) }, + }; + ctx.response.body = responseBody; +}); + +router.post("/sessions", async (ctx) => { + const body: unknown = await ctx.request.body.json(); + if (!isFederationSessionRequest(body)) { + throw new APIException(400, "Invalid request"); + } + const user = await completeLogin(body); + const responseBody: APIResponse = { + success: true, + data: { ...await issueTokens(user), user: toSelfUser(user) }, + }; + ctx.response.body = responseBody; +}); + +router.post("/events", async (ctx) => { + const event = fieldOf(await ctx.request.body.json(), "event"); + if (typeof event !== "string") throw new APIException(400, "Invalid event"); + await receiveEvent(event); + ctx.response.status = 204; +}); + +router.get("/peers", async (ctx) => { + const userId = await parseOptionalAuth(ctx); + const all = !!userId && + hasPermission(getUserById(userId).role, "federation:manage"); + const responseBody: APIResponse = { + success: true, + data: listPeers(!all), + }; + ctx.response.body = responseBody; +}); + +router.put( + "/peers", + authMiddleware, + requirePermission("federation:manage"), + async (ctx: AuthContext) => { + const body: unknown = await ctx.request.body.json(); + if (!isSetPeerRequest(body)) throw new APIException(400, "Invalid request"); + const responseBody: APIResponse = { + success: true, + data: await setPeer(body.instance, body.status), + }; + ctx.response.body = responseBody; + }, +); + +router.delete( + "/peers/:host", + authMiddleware, + requirePermission("federation:manage"), + (ctx: AuthContext<"/peers/:host">) => { + removePeer(ctx.params.host); + const responseBody: APIResponse = { success: true, data: null }; + ctx.response.body = responseBody; + }, +); + +export default router; diff --git a/api/routes/me.ts b/api/routes/me.ts index 8511da4c..963a7f16 100644 --- a/api/routes/me.ts +++ b/api/routes/me.ts @@ -7,7 +7,8 @@ * * - `GET /api/me` — signed in. Answers the caller's own user. * - `PATCH /api/me` — signed in. Changes the caller's description and email, - * and answers their user. A username changes only by `user:manage`, through + * and answers their user. The email of an account from another instance is + * that instance's: 400. A username changes only by `user:manage`, through * `PATCH /api/users/:key/username`. * - `GET /api/me/media-token` — signed in. Answers a media token, for a * session that predates them. @@ -15,9 +16,17 @@ * - `PATCH /api/me/settings` — signed in. Changes some of the caller's * settings, and answers them all. * - `PUT /api/me/password` — signed in, with the current password. Sets a new - * one, ending every other session, and answers fresh tokens. + * one, ending every other session, and answers fresh tokens. 400 for an + * account from another instance, which has no password here. * - `GET /api/me/playlists?contains=:dumpId` — signed in. Answers each of the * caller's playlists and whether it holds the dump. + * - `GET /api/me/grants` — signed in. Answers the other instances the caller + * let their account sign in to. + * - `DELETE /api/me/grants/:host` — signed in. Withdraws that grant, which + * ends the caller's sessions there. + * + * A change to the caller's email or password is told to those instances + * (`notifyClients`). * * @module */ @@ -39,11 +48,21 @@ import { toPublicUser, toSelfUser } from "../model/user.ts"; import { createMediaToken, issueTokens } from "../lib/jwt.ts"; import { verifyPassword } from "../lib/password.ts"; import { type AuthContext, authMiddleware } from "../middleware/auth.ts"; -import { getUserById, updateUser } from "../services/user-service.ts"; +import { + assertLocalUser, + getUserById, + updateUser, +} from "../services/user-service.ts"; import { getSettings, updateSettings } from "../services/settings-service.ts"; import { getPlaylistMembershipsForDump } from "../services/playlist-service.ts"; import { broadcastUserUpdated } from "../services/ws-service.ts"; import { VALIDATION } from "../../shared/validation.ts"; +import type { FederationGrant } from "../../shared/federation.ts"; +import { + listGrants, + notifyClients, + revokeGrant, +} from "../services/identity-provider-service.ts"; /** * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware. @@ -65,6 +84,7 @@ router.patch("/", authMiddleware, async (ctx: AuthContext) => { throw new APIException(400, "Invalid request"); } const userId = ctx.state.user.userId; + if (body.email !== undefined) assertLocalUser(getUserById(userId)); // Only these fields: a stolen token alone must not change the role or the // password, which needs the current one. const updated = await updateUser(userId, { @@ -72,6 +92,7 @@ router.patch("/", authMiddleware, async (ctx: AuthContext) => { email: body.email, }); broadcastUserUpdated(toPublicUser(updated)); + if (body.email !== undefined) await notifyClients(userId, { type: "update" }); const responseBody: APIResponse = { success: true, data: toSelfUser(updated), @@ -127,7 +148,8 @@ router.put("/password", authMiddleware, async (ctx: AuthContext) => { } const user = getUserById(ctx.state.user.userId); - const valid = await verifyPassword(currentPassword, user.passwordHash); + assertLocalUser(user); + const valid = await verifyPassword(currentPassword, user.passwordHash ?? ""); if (!valid) { throw new APIException(403, "Current password is incorrect"); } @@ -137,6 +159,7 @@ router.put("/password", authMiddleware, async (ctx: AuthContext) => { const updated = await updateUser(ctx.state.user.userId, { password: newPassword, }); + await notifyClients(updated.id, { type: "revoke" }); const responseBody: APIResponse = { success: true, data: await issueTokens(updated), @@ -154,4 +177,22 @@ router.get("/playlists", authMiddleware, (ctx: AuthContext) => { ctx.response.body = responseBody; }); +router.get("/grants", authMiddleware, (ctx: AuthContext) => { + const responseBody: APIResponse = { + success: true, + data: listGrants(ctx.state.user.userId), + }; + ctx.response.body = responseBody; +}); + +router.delete( + "/grants/:host", + authMiddleware, + async (ctx: AuthContext<"/grants/:host">) => { + await revokeGrant(ctx.state.user.userId, ctx.params.host); + const responseBody: APIResponse = { success: true, data: null }; + ctx.response.body = responseBody; + }, +); + export default router; diff --git a/api/routes/oauth.ts b/api/routes/oauth.ts new file mode 100644 index 00000000..dae63db7 --- /dev/null +++ b/api/routes/oauth.ts @@ -0,0 +1,78 @@ +/** + * Lets this instance's users sign in to other gerbeur instances with their + * account here, as `identity-provider-service.ts` describes. The client's + * `/authorize` page calls the first two; the other instance's server calls the + * last. + * + * - `GET /api/oauth/clients?client_id=` — signed in. Answers the instance + * asking to sign the caller in (`OAuthClient`), and whether they already + * let it; 400 for an account from another instance, 403 when that instance + * is blocked here, 502 when it doesn't answer as a gerbeur. + * - `POST /api/oauth/codes` — signed in. Records the caller's consent to the + * request (`AuthorizeRequest`) and answers where to send them, the + * instance's callback page with a code. + * - `POST /api/oauth/tokens` — public, form-encoded, server to server. Trades + * a code and its PKCE verifier for an identity token (`id_token`), bare + * JSON as OAuth has it; 400 when anything doesn't match. Rate-limited per + * client. + * + * @module + */ + +import { Router } from "@oak/oak"; +import type { APIResponse } from "../../shared/api.ts"; +import type { + AuthorizeResponse, + OAuthClient, +} from "../../shared/federation.ts"; +import { APIException } from "../lib/api-exception.ts"; +import { type RateLimit, takeToken } from "../lib/rate-limit.ts"; +import { type AuthContext, authMiddleware } from "../middleware/auth.ts"; +import { isAuthorizeRequest } from "../validators/federation.ts"; +import { + createAuthorizationCode, + describeClient, + exchangeCode, +} from "../services/identity-provider-service.ts"; + +/** Allows a burst of 30 code trades per client instance, then one a second. */ +const TOKEN_LIMIT: RateLimit = { capacity: 30, refill: 1 }; + +/** + * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware. + * An `APIException` thrown by a handler becomes the JSON error response there. + */ +const router: Router = new Router({ prefix: "/api/oauth" }); + +router.get("/clients", authMiddleware, async (ctx: AuthContext) => { + const clientId = ctx.request.url.searchParams.get("client_id"); + if (!clientId) throw new APIException(400, "client_id is required"); + const responseBody: APIResponse = { + success: true, + data: await describeClient(ctx.state.user.userId, clientId), + }; + ctx.response.body = responseBody; +}); + +router.post("/codes", authMiddleware, async (ctx: AuthContext) => { + const body: unknown = await ctx.request.body.json(); + if (!isAuthorizeRequest(body)) throw new APIException(400, "Invalid request"); + const responseBody: APIResponse = { + success: true, + data: { + redirectTo: await createAuthorizationCode(ctx.state.user.userId, body), + }, + }; + ctx.response.body = responseBody; +}); + +router.post("/tokens", async (ctx) => { + const params = new URLSearchParams(await ctx.request.body.text()); + if (!takeToken(`oauth-token:${params.get("client_id")}`, TOKEN_LIMIT)) { + throw new APIException(429, "Too many requests"); + } + ctx.response.headers.set("Cache-Control", "no-store"); + ctx.response.body = await exchangeCode(params); +}); + +export default router; diff --git a/api/routes/users.ts b/api/routes/users.ts index 9f634e5d..843c172a 100644 --- a/api/routes/users.ts +++ b/api/routes/users.ts @@ -31,7 +31,9 @@ * - `PATCH /api/users/:key/role` — permission `user:manage`. Sets another * user's role. * - `PATCH /api/users/:key/username` — permission `user:manage`. Renames a - * user, the caller included. It is the only way a name changes. + * user, the caller included. It is the only way a local name changes; a + * user from another instance is named there (400). The instances the user + * signed in to are told. * * @module */ @@ -64,6 +66,7 @@ import { import { parseOptionalAuth } from "../lib/auth.ts"; import { parsePagination } from "../lib/pagination.ts"; import { + assertLocalUser, createUser, getInviteTree, renameUser, @@ -73,6 +76,7 @@ import { updateUser, } from "../services/user-service.ts"; import { claimInvite, releaseInvite } from "../services/invite-service.ts"; +import { notifyClients } from "../services/identity-provider-service.ts"; import { broadcastUserUpdated, updateClientUsername, @@ -293,9 +297,11 @@ router.patch( throw new APIException(400, "Invalid request"); } const user = resolveUserKey(ctx.params.key); + assertLocalUser(user); const publicUser = toPublicUser(renameUser(user.id, username)); updateClientUsername(publicUser.id, publicUser.username); broadcastUserUpdated(publicUser); + await notifyClients(publicUser.id, { type: "update" }); const responseBody: APIResponse = { success: true, data: publicUser, diff --git a/api/routes/well-known.ts b/api/routes/well-known.ts new file mode 100644 index 00000000..cd69831c --- /dev/null +++ b/api/routes/well-known.ts @@ -0,0 +1,36 @@ +/** + * Serves what other gerbeur instances read about this one before federated + * sign-in, at the root paths OpenID Connect fixes, which are the one + * exception to the API's `/api/` rule. `remote/gerbeur-instance.ts` reads + * them on the other side. + * + * - `GET /.well-known/openid-configuration` — public. Answers the instance's + * metadata (`InstanceMetadata`): its endpoints, its name and the protocol's + * version. Bare JSON, not the API's envelope. + * - `GET /.well-known/jwks.json` — public. Answers the public keys its tokens + * are signed with. Bare JSON. + * + * @module + */ + +import { Router } from "@oak/oak"; +import { getInstanceMetadata } from "../services/identity-provider-service.ts"; +import { getPublicKeys } from "../services/instance-key-service.ts"; + +/** + * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware. + * An `APIException` thrown by a handler becomes the JSON error response there. + */ +const router: Router = new Router({ prefix: "/.well-known" }); + +router.get("/openid-configuration", (ctx) => { + ctx.response.headers.set("Cache-Control", "public, max-age=600"); + ctx.response.body = getInstanceMetadata(); +}); + +router.get("/jwks.json", async (ctx) => { + ctx.response.headers.set("Cache-Control", "public, max-age=600"); + ctx.response.body = await getPublicKeys(); +}); + +export default router; diff --git a/api/services/federation-peer-service.ts b/api/services/federation-peer-service.ts new file mode 100644 index 00000000..0311ff26 --- /dev/null +++ b/api/services/federation-peer-service.ts @@ -0,0 +1,125 @@ +/** + * Keeps the instances an admin trusts or blocks for federated sign-in + * (`federation_peers`). Users of a trusted instance sign in here directly, + * those of a blocked one never do, and an instance on neither list is invite + * only. `federation-service.ts` reads it at each sign-in, `/manage` edits it + * through `routes/federation.ts`, and the login page offers the trusted ones. + * + * @module + */ + +import { APIException } from "../lib/api-exception.ts"; +import { db } from "../db/connection.ts"; +import { PUBLIC_URL } from "../config.ts"; +import { + type FederationPeer, + instanceHost, + isPeerStatus, + parseInstance, + type PeerStatus, +} from "../../shared/federation.ts"; +import { fetchMetadata } from "../remote/gerbeur-instance.ts"; +import { closeUserSockets } from "./ws-service.ts"; + +interface PeerRow { + issuer: string; + status: string; + name: string | null; + created_at: string; +} + +/** Converts a row to a {@link FederationPeer}. */ +function rowToPeer(row: PeerRow): FederationPeer { + return { + issuer: row.issuer, + host: instanceHost(row.issuer), + name: row.name, + status: isPeerStatus(row.status) ? row.status : "blocked", + createdAt: new Date(row.created_at), + }; +} + +/** + * Returns what an admin decided about the instance at `issuer`, or null when + * it is on neither list. + */ +export function getPeerStatus(issuer: string): PeerStatus | null { + const row = db.prepare( + `SELECT status FROM federation_peers WHERE issuer = ?;`, + ).get(issuer) as { status: string } | undefined; + return row && isPeerStatus(row.status) ? row.status : null; +} + +/** + * Returns the instances on the lists, by name: every one for `/manage`, or + * only the trusted ones, which the login page offers. + */ +export function listPeers(trustedOnly: boolean): FederationPeer[] { + const rows = db.prepare( + `SELECT issuer, status, name, created_at FROM federation_peers + ${trustedOnly ? "WHERE status = 'trusted'" : ""} + ORDER BY lower(coalesce(name, issuer));`, + ).all() as unknown as PeerRow[]; + return rows.map(rowToPeer); +} + +/** + * Puts the instance `instance` names on the list of `status`, for `/manage`, + * and returns it. It must answer as a gerbeur instance, whose name is kept. + * Blocking one ends the sessions of its users here at once: their tokens stop + * counting by `getSessionState`, and this closes their sockets. + * + * @throws {APIException} 400 when `instance` names no instance, or this one, + * 502 when it doesn't answer as a gerbeur instance. + */ +export async function setPeer( + instance: string, + status: PeerStatus, +): Promise { + const issuer = parseInstance(instance); + if (!issuer) throw new APIException(400, "Not an instance's address"); + if (issuer === PUBLIC_URL) { + throw new APIException(400, "That is this instance"); + } + let name: string; + try { + name = (await fetchMetadata(issuer)).gerbeur_site_name; + } catch (err) { + console.error(`[federation] ${issuer} can't be added:`, err); + throw new APIException(502, "That address doesn't answer as a gerbeur"); + } + db.prepare( + `INSERT INTO federation_peers (issuer, status, name, created_at) + VALUES (?, ?, ?, ?) + ON CONFLICT (issuer) DO UPDATE SET status = excluded.status, name = excluded.name;`, + ).run(issuer, status, name, new Date().toISOString()); + + if (status === "blocked") { + const users = db.prepare( + `SELECT user_id FROM user_identities WHERE issuer = ?;`, + ).all(issuer) as { user_id: string }[]; + for (const { user_id } of users) { + closeUserSockets(user_id, "Instance blocked"); + } + } + + const row = db.prepare( + `SELECT issuer, status, name, created_at FROM federation_peers WHERE issuer = ?;`, + ).get(issuer) as unknown as PeerRow; + return rowToPeer(row); +} + +/** + * Takes the instance whose host is `host` off the lists, for `/manage`: its + * users are invite only again, and those already here may sign in again if it + * was blocked. + * + * @throws {APIException} 404 when no listed instance has that host. + */ +export function removePeer(host: string): void { + const peer = listPeers(false).find((p) => p.host === host.toLowerCase()); + if (!peer) throw new APIException(404, "Instance not found"); + db.prepare(`DELETE FROM federation_peers WHERE issuer = ?;`).run( + peer.issuer, + ); +} diff --git a/api/services/federation-service.ts b/api/services/federation-service.ts new file mode 100644 index 00000000..5e514af2 --- /dev/null +++ b/api/services/federation-service.ts @@ -0,0 +1,376 @@ +/** + * Plays the client in federated sign-in: it lets users of other gerbeur + * instances sign in here with their account there, their home. + * + * 1. The login or register page names the user's home, and + * {@link startLogin} answers the home's `/authorize` page with a request: + * a random state, the hash of a PKCE verifier, and a nonce, kept in + * `federation_logins` for 10 minutes. + * 2. The home sends the user back to the `/federation/callback` page with a + * code. {@link completeLogin} trades it for the home's identity token, + * checks its signature against the home's keys, and finds or creates the + * local account linked to it (`user_identities`), named `@`. + * 3. The home's events ({@link receiveEvent}) keep the account's name, email + * and avatar in step, and end its sessions when the home says so. + * + * Whether a user of another instance may join is the admin's call + * (`federation-peer-service.ts`): from a trusted instance they may, from a + * blocked one they may not, and from any other only with an invite, which the + * register page carries. Once here, an account works like any other, but its + * password, email, avatar and name are its home's (`assertLocalUser`). + * + * @module + */ + +import { decodeJwt } from "@panva/jose"; +import { createHash, randomBytes } from "node:crypto"; +import { APIException } from "../lib/api-exception.ts"; +import { db, transaction } from "../db/connection.ts"; +import { verifyInstanceToken } from "../lib/jwt.ts"; +import { + type FederationLoginRequest, + type FederationSessionRequest, + type IdentityClaims, + instanceHost, + isFederationEvent, + isIdentityClaims, + parseInstance, +} from "../../shared/federation.ts"; +import { EMAIL_RE, USERNAME_RE } from "../../shared/validation.ts"; +import { toPublicUser, type User } from "../model/user.ts"; +import { + exchangeCode, + fetchAvatar, + fetchKeys, + fetchMetadata, +} from "../remote/gerbeur-instance.ts"; +import { ISSUER, REDIRECT_URI } from "./identity-provider-service.ts"; +import { getPeerStatus } from "./federation-peer-service.ts"; +import { + claimInvite, + releaseInvite, + validateInvite, +} from "./invite-service.ts"; +import { + createRemoteUser, + getUserById, + revokeSessions, + sendWelcomeEmail, + setUserAvatar, + setUsername, + updateUser, +} from "./user-service.ts"; +import { broadcastUserUpdated, updateClientUsername } from "./ws-service.ts"; + +/** How long a sign-in may take, from the login page to the callback. */ +const LOGIN_TTL_MS = 10 * 60_000; + +/** + * Returns the origin of the instance `instance` names, checked as a home: not + * this instance, nor a blocked one. + * + * @throws {APIException} 400 when it names no instance or this one, 403 when + * it is blocked. + */ +function homeOf(instance: string): string { + const issuer = parseInstance(instance); + if (!issuer) throw new APIException(400, "Not an instance's address"); + if (issuer === ISSUER) throw new APIException(400, "That is this instance"); + if (getPeerStatus(issuer) === "blocked") { + throw new APIException(403, "This instance is blocked here"); + } + return issuer; +} + +/** + * Starts a sign-in with an account on the instance `request.instance` names, + * and returns its `/authorize` page with the request, for + * `POST /api/federation/logins`. Unless that instance is trusted, or someone + * here already comes from it, the request must carry a valid invite, which is + * claimed only once the account is made; {@link completeLogin} makes no + * account without one. + * + * @throws {APIException} 400 when the instance isn't one; 403 when it is + * blocked, or neither trusted nor invited; 404 or 409 when the invite doesn't + * work; 502 when it doesn't answer as a gerbeur. + */ +export async function startLogin( + request: FederationLoginRequest, +): Promise { + const issuer = homeOf(request.instance); + if (request.inviteToken) { + validateInvite(request.inviteToken); + } else if ( + getPeerStatus(issuer) !== "trusted" && + // Someone who joined with an invite signs in again without one; whether + // this user is one of them is only known once their home answers. + !db.prepare(`SELECT 1 FROM user_identities WHERE issuer = ? LIMIT 1;`) + .get(issuer) + ) { + throw new APIException( + 403, + "Users of this instance need an invite to join", + ); + } + + let authorizationEndpoint: string; + try { + authorizationEndpoint = (await fetchMetadata(issuer)) + .authorization_endpoint; + } catch (err) { + console.error(`[federation] ${issuer} unreachable:`, err); + throw new APIException(502, "That instance doesn't answer as a gerbeur"); + } + + const state = randomBytes(24).toString("base64url"); + const verifier = randomBytes(48).toString("base64url"); + const nonce = randomBytes(24).toString("base64url"); + const now = new Date(); + transaction(() => { + db.prepare(`DELETE FROM federation_logins WHERE created_at < ?;`).run( + new Date(now.getTime() - LOGIN_TTL_MS).toISOString(), + ); + db.prepare( + `INSERT INTO federation_logins (state, issuer, code_verifier, nonce, invite_token, created_at) + VALUES (?, ?, ?, ?, ?, ?);`, + ).run( + state, + issuer, + verifier, + nonce, + request.inviteToken ?? null, + now.toISOString(), + ); + }); + + const url = new URL(authorizationEndpoint); + url.search = new URLSearchParams({ + response_type: "code", + scope: "openid profile email", + client_id: ISSUER, + redirect_uri: REDIRECT_URI, + state, + code_challenge: createHash("sha256").update(verifier).digest("base64url"), + code_challenge_method: "S256", + nonce, + }).toString(); + return url.href; +} + +/** + * Returns the payload of `token`, an identity token or an event from the + * instance at `issuer`, once its signature checks against that instance's + * keys and it is addressed to this one. The keys are refetched once when the + * token names one they lack. + * + * @throws {APIException} 401 when it doesn't verify. + */ +async function verifyFrom( + token: string, + issuer: string, +): Promise> { + const claims = { issuer, audience: ISSUER }; + try { + try { + return await verifyInstanceToken(token, await fetchKeys(issuer), claims); + } catch (err) { + if ((err as { code?: string }).code !== "ERR_JWKS_NO_MATCHING_KEY") { + throw err; + } + return await verifyInstanceToken( + token, + await fetchKeys(issuer, true), + claims, + ); + } + } catch (err) { + console.error(`[federation] a token from ${issuer} failed:`, err); + throw new APIException(401, "Invalid token"); + } +} + +/** + * Returns `claims` once checked: a name a local user could have, and an email. + * + * @throws {APIException} 502 when the home sent something else. + */ +function checkClaims(claims: unknown): IdentityClaims { + if ( + !isIdentityClaims(claims) || + !USERNAME_RE.test(claims.preferred_username) || + !EMAIL_RE.test(claims.email) + ) { + throw new APIException(502, "The instance sent an invalid identity"); + } + return claims; +} + +/** + * Finishes a sign-in begun by {@link startLogin}, for + * `POST /api/federation/sessions`, and returns the account it signs in to: + * the one linked to the identity, brought up to date, or a new one. A login + * works once. A new account needs the home to be trusted, or the invite the + * login was started with, claimed now. + * + * @throws {APIException} 400 when the login is unknown or expired; 401 when + * the identity token doesn't verify; 403 when the account may not be created; + * 409 when its handle is someone's; 502 when the home fails. + */ +export async function completeLogin( + request: FederationSessionRequest, +): Promise { + const login = db.prepare( + `DELETE FROM federation_logins WHERE state = ? + RETURNING issuer, code_verifier, nonce, invite_token, created_at;`, + ).get(request.state) as + | { + issuer: string; + code_verifier: string; + nonce: string; + invite_token: string | null; + created_at: string; + } + | undefined; + if ( + !login || + Date.now() - new Date(login.created_at).getTime() > LOGIN_TTL_MS + ) { + throw new APIException(400, "This sign-in has expired, start again"); + } + const issuer = login.issuer; + + let idToken: string; + try { + idToken = await exchangeCode(issuer, { + code: request.code, + clientId: ISSUER, + redirectUri: REDIRECT_URI, + codeVerifier: login.code_verifier, + }); + } catch (err) { + console.error(`[federation] ${issuer} refused a code:`, err); + throw new APIException(502, "The instance refused the sign-in"); + } + const payload = await verifyFrom(idToken, issuer); + if (payload.nonce !== login.nonce || typeof payload.sub !== "string") { + throw new APIException(401, "Invalid token"); + } + const claims = checkClaims(payload); + const subject = payload.sub; + + const identity = db.prepare( + `SELECT user_id FROM user_identities WHERE issuer = ? AND subject = ?;`, + ).get(issuer, subject) as { user_id: string } | undefined; + if (getPeerStatus(issuer) === "blocked") { + throw new APIException(403, "This instance is blocked here"); + } + if (identity) { + return await applyClaims(identity.user_id, issuer, claims); + } + + const trusted = getPeerStatus(issuer) === "trusted"; + if (!trusted && !login.invite_token) { + throw new APIException( + 403, + "Users of this instance need an invite to join", + ); + } + const inviterId = trusted ? null : claimInvite(login.invite_token!); + let user: User; + try { + user = transaction(() => { + const created = createRemoteUser({ + username: `${claims.preferred_username}@${instanceHost(issuer)}`, + email: claims.email, + }, inviterId); + db.prepare( + `INSERT INTO user_identities (user_id, issuer, subject, synced_at) VALUES (?, ?, ?, ?);`, + ).run(created.id, issuer, subject, new Date().toISOString()); + return created; + }); + } catch (err) { + if (!trusted) releaseInvite(login.invite_token!); + throw err; + } + sendWelcomeEmail(user); + return await applyClaims(user.id, issuer, claims); +} + +/** + * Brings the account `userId`, from the instance at `issuer`, in step with + * `claims` and returns it: a new name at home renames it, the old handle + * staying its alias, and a new email or avatar replaces its own. A failed + * avatar fetch is logged, and tried again at the next change or sign-in. + * + * @throws {APIException} 409 when the new handle is someone else's. + */ +async function applyClaims( + userId: string, + issuer: string, + claims: IdentityClaims, +): Promise { + let user = getUserById(userId); + const handle = `${claims.preferred_username}@${instanceHost(issuer)}`; + if (handle !== user.username) { + user = setUsername(userId, handle); + updateClientUsername(userId, handle); + broadcastUserUpdated(toPublicUser(user)); + } + if (claims.email !== user.email) { + user = await updateUser(userId, { email: claims.email }); + } + + const { picture } = db.prepare( + `SELECT picture FROM user_identities WHERE user_id = ?;`, + ).get(userId) as { picture: string | null }; + let synced = claims.picture ?? null; + if (claims.picture && claims.picture !== picture) { + try { + user = await setUserAvatar(userId, await fetchAvatar(claims.picture)); + } catch (err) { + console.error(`[federation] ${handle}'s avatar failed:`, err); + synced = picture; + } + } + db.prepare( + `UPDATE user_identities SET picture = ?, synced_at = ? WHERE user_id = ?;`, + ).run(synced, new Date().toISOString(), userId); + return user; +} + +/** + * Applies the signed event `token` from a user's home, for + * `POST /api/federation/events`: `update` brings their account in step, + * `revoke` ends their sessions here. Only an instance some account here comes + * from may send one, about one of those accounts. + * + * @throws {APIException} 400 when it isn't an event of a known instance about + * one of its users; 401 when it doesn't verify. + */ +export async function receiveEvent(token: string): Promise { + let issuer: unknown; + try { + issuer = decodeJwt(token).iss; + } catch { + throw new APIException(400, "Invalid event"); + } + if ( + typeof issuer !== "string" || + !db.prepare(`SELECT 1 FROM user_identities WHERE issuer = ? LIMIT 1;`) + .get(issuer) + ) { + throw new APIException(400, "Unknown instance"); + } + const payload = await verifyFrom(token, issuer); + const identity = db.prepare( + `SELECT user_id FROM user_identities WHERE issuer = ? AND subject = ?;`, + ).get(issuer, String(payload.sub)) as { user_id: string } | undefined; + if (!identity || !isFederationEvent(payload)) { + throw new APIException(400, "Invalid event"); + } + if (payload.type === "revoke") { + revokeSessions(identity.user_id, new Date(), "Signed out by home"); + } else { + await applyClaims(identity.user_id, issuer, checkClaims(payload.claims)); + } +} diff --git a/api/services/identity-provider-service.ts b/api/services/identity-provider-service.ts new file mode 100644 index 00000000..8aead0bb --- /dev/null +++ b/api/services/identity-provider-service.ts @@ -0,0 +1,438 @@ +/** + * Plays the home instance in federated sign-in: it lets this instance's users + * sign in to other gerbeur instances with their account here. + * + * The flow is OpenID Connect's authorization code with PKCE, in three steps. + * + * 1. Another instance, the client, sends the user to the `/authorize` page + * with a request. The page shows who asks ({@link describeClient}) and, + * once the user consents, gets a code ({@link createAuthorizationCode}), + * which it carries back to the client's callback page. + * 2. The client trades the code for an identity token, server to server + * ({@link exchangeCode}): this user's name, email and avatar, signed with + * the instance key. + * 3. While the user's grant lasts, the client hears of their changes: a new + * name, email or avatar, and the end of their sessions after a password + * change. {@link notifyClients} queues the signed events in + * `federation_outbox`, and {@link outboxJob} delivers them. + * + * Only a local account signs in elsewhere: a user who came from another + * instance signs in from there. `routes/oauth.ts`, `routes/well-known.ts` and + * the routes that change a user call it. + * + * @module + */ + +import { createHash, randomBytes } from "node:crypto"; +import { APIException } from "../lib/api-exception.ts"; +import { db, transaction } from "../db/connection.ts"; +import { FRONTEND_URL, OG_SITE_NAME, PUBLIC_URL } from "../config.ts"; +import { signInstanceToken } from "../lib/jwt.ts"; +import type { Job } from "../lib/scheduler.ts"; +import { + type AuthorizeRequest, + FEDERATION_VERSION, + type FederationEvent, + type FederationGrant, + type IdentityClaims, + instanceHost, + type InstanceMetadata, + type OAuthClient, + parseInstance, +} from "../../shared/federation.ts"; +import { fetchMetadata, postEvent } from "../remote/gerbeur-instance.ts"; +import { isRemoteUser, type User } from "../model/user.ts"; +import { getSigningKey } from "./instance-key-service.ts"; +import { getUserById } from "./user-service.ts"; +import { getPeerStatus } from "./federation-peer-service.ts"; + +/** + * The instance's name in every token it signs and every token addressed to + * it: its public URL, which must be an origin for other instances to find + * its metadata. + */ +export const ISSUER: string = PUBLIC_URL; + +/** + * The client's page a home instance sends the user back to, on the frontend. + * Its metadata announces it, and a home accepts no other. + */ +export const REDIRECT_URI = `${FRONTEND_URL}/federation/callback`; + +/** How long a code may wait to be traded, from the consent. */ +const CODE_TTL_MS = 60_000; + +/** + * How long an identity token is valid: enough to cross from one server to the + * other, never enough to be replayed later. + */ +const ID_TOKEN_TTL = "5m"; + +/** + * How long an event is valid, and so how long the outbox keeps trying to + * deliver it before giving up. + */ +const EVENT_TTL_MS = 3 * 86_400_000; + +/** The longest wait between two tries of an event. */ +const MAX_RETRY_MS = 6 * 3_600_000; + +/** + * Returns the instance's metadata, served at + * `/.well-known/openid-configuration`. + */ +export function getInstanceMetadata(): InstanceMetadata { + return { + issuer: ISSUER, + authorization_endpoint: `${FRONTEND_URL}/authorize`, + token_endpoint: `${PUBLIC_URL}/api/oauth/tokens`, + jwks_uri: `${PUBLIC_URL}/.well-known/jwks.json`, + response_types_supported: ["code"], + grant_types_supported: ["authorization_code"], + subject_types_supported: ["public"], + id_token_signing_alg_values_supported: ["EdDSA"], + code_challenge_methods_supported: ["S256"], + scopes_supported: ["openid", "profile", "email"], + gerbeur_federation: FEDERATION_VERSION, + gerbeur_site_name: OG_SITE_NAME, + gerbeur_redirect_uri: REDIRECT_URI, + gerbeur_events_endpoint: `${PUBLIC_URL}/api/federation/events`, + }; +} + +/** Returns the SHA-256 of `value`, as base64url. */ +function sha256(value: string): string { + return createHash("sha256").update(value).digest("base64url"); +} + +/** + * Returns what this instance tells another of `user`: their name, email and + * avatar, whose URL changes with each new one. + */ +export function identityClaims(user: User): IdentityClaims { + return { + preferred_username: user.username, + email: user.email, + ...(user.avatarMime && { + picture: `${PUBLIC_URL}/api/users/${user.id}/avatar?v=${ + user.updatedAt?.getTime() ?? 0 + }`, + }), + }; +} + +/** + * Returns the client `clientId` names, checked: an instance other than this + * one, not blocked here, answering as a gerbeur. `user` must have a local + * account, which alone may sign in elsewhere. + * + * @throws {APIException} 400 when `clientId` isn't an instance's address, is + * this instance, or `user` comes from another instance; 403 when the client + * is blocked here; 502 when it doesn't answer as a gerbeur. + */ +async function checkClient( + user: User, + clientId: string, +): Promise<{ clientId: string; metadata: InstanceMetadata }> { + if (isRemoteUser(user)) { + throw new APIException( + 400, + "This account signs in from the instance it comes from", + ); + } + if (parseInstance(clientId) !== clientId || clientId === ISSUER) { + throw new APIException(400, "Invalid client"); + } + if (getPeerStatus(clientId) === "blocked") { + throw new APIException(403, "This instance is blocked here"); + } + try { + return { clientId, metadata: await fetchMetadata(clientId) }; + } catch (err) { + console.error(`[federation] client ${clientId} unreachable:`, err); + throw new APIException(502, "That instance doesn't answer as a gerbeur"); + } +} + +/** + * Returns the instance `clientId` names, for the `/authorize` page's question + * to user `userId`, and whether they already let it sign them in. + * + * @throws {APIException} As {@link checkClient}. + */ +export async function describeClient( + userId: string, + clientId: string, +): Promise { + const { metadata } = await checkClient(getUserById(userId), clientId); + const granted = !!db.prepare( + `SELECT 1 FROM federation_grants WHERE user_id = ? AND client_id = ?;`, + ).get(userId, clientId); + return { + clientId, + host: instanceHost(clientId), + name: metadata.gerbeur_site_name, + granted, + }; +} + +/** + * Records user `userId`'s consent to sign in to the client of `request`, and + * returns where to send them: the client's callback page with a code, which + * the client trades within a minute ({@link exchangeCode}). The grant lasts + * until they withdraw it, so the page asks no more. + * + * @throws {APIException} 400 when the request is malformed or its + * `redirectUri` isn't the client's own; otherwise as {@link checkClient}. + */ +export async function createAuthorizationCode( + userId: string, + request: AuthorizeRequest, +): Promise { + const user = getUserById(userId); + const { clientId, metadata } = await checkClient(user, request.clientId); + if (request.redirectUri !== metadata.gerbeur_redirect_uri) { + throw new APIException(400, "Invalid redirect URI"); + } + if ( + request.codeChallengeMethod !== "S256" || + !/^[A-Za-z0-9_-]{43}$/.test(request.codeChallenge) || + !request.state || request.state.length > 512 || + !request.nonce || request.nonce.length > 512 + ) { + throw new APIException(400, "Invalid request"); + } + + const code = randomBytes(32).toString("base64url"); + const now = new Date(); + transaction(() => { + db.prepare(`DELETE FROM oauth_codes WHERE expires_at < ?;`).run( + now.toISOString(), + ); + db.prepare( + `INSERT INTO oauth_codes (code_hash, user_id, client_id, redirect_uri, code_challenge, nonce, expires_at) + VALUES (?, ?, ?, ?, ?, ?, ?);`, + ).run( + sha256(code), + userId, + clientId, + request.redirectUri, + request.codeChallenge, + request.nonce, + new Date(now.getTime() + CODE_TTL_MS).toISOString(), + ); + db.prepare( + `INSERT INTO federation_grants (user_id, client_id, client_name, granted_at, last_used_at) + VALUES (?, ?, ?, ?, ?) + ON CONFLICT (user_id, client_id) DO UPDATE SET client_name = excluded.client_name;`, + ).run( + userId, + clientId, + metadata.gerbeur_site_name, + now.toISOString(), + now.toISOString(), + ); + }); + + const redirect = new URL(request.redirectUri); + redirect.searchParams.set("code", code); + redirect.searchParams.set("state", request.state); + // RFC 9207: tells the client which instance answered, against mix-ups. + redirect.searchParams.set("iss", ISSUER); + return redirect.href; +} + +/** + * Trades a code for an identity token, for `POST /api/oauth/tokens`, which + * the client calls server to server with the form `params`. A code works once, + * within a minute, for the client and redirect it was made for, and with the + * verifier whose hash the request carried (PKCE). The token, signed with the + * instance key and addressed to the client, carries {@link identityClaims} + * and the request's nonce. + * + * @throws {APIException} 400 when anything doesn't match. + */ +export async function exchangeCode( + params: URLSearchParams, +): Promise<{ id_token: string; token_type: string }> { + const code = params.get("code"); + const clientId = params.get("client_id"); + const verifier = params.get("code_verifier"); + if ( + params.get("grant_type") !== "authorization_code" || !code || !clientId || + !verifier || !/^[A-Za-z0-9._~-]{43,128}$/.test(verifier) + ) { + throw new APIException(400, "invalid_request"); + } + + // Taken in the same statement that finds it, so it can't be traded twice. + const row = db.prepare( + `DELETE FROM oauth_codes WHERE code_hash = ? + RETURNING user_id, client_id, redirect_uri, code_challenge, nonce, expires_at;`, + ).get(sha256(code)) as + | { + user_id: string; + client_id: string; + redirect_uri: string; + code_challenge: string; + nonce: string; + expires_at: string; + } + | undefined; + if ( + !row || row.expires_at < new Date().toISOString() || + row.client_id !== clientId || + row.redirect_uri !== params.get("redirect_uri") || + row.code_challenge !== sha256(verifier) + ) { + throw new APIException(400, "invalid_grant"); + } + + const user = getUserById(row.user_id); + if (isRemoteUser(user)) throw new APIException(400, "invalid_grant"); + db.prepare( + `UPDATE federation_grants SET last_used_at = ? WHERE user_id = ? AND client_id = ?;`, + ).run(new Date().toISOString(), user.id, clientId); + + const idToken = await signInstanceToken( + { ...identityClaims(user), nonce: row.nonce }, + await getSigningKey(), + { issuer: ISSUER, audience: clientId, subject: user.id }, + ID_TOKEN_TTL, + ); + return { id_token: idToken, token_type: "Bearer" }; +} + +interface GrantRow { + client_id: string; + client_name: string | null; + granted_at: string; + last_used_at: string; +} + +/** + * Returns the instances user `userId` let their account sign in to, the most + * recently used first, for the settings page. + */ +export function listGrants(userId: string): FederationGrant[] { + const rows = db.prepare( + `SELECT client_id, client_name, granted_at, last_used_at FROM federation_grants + WHERE user_id = ? ORDER BY last_used_at DESC;`, + ).all(userId) as unknown as GrantRow[]; + return rows.map((r) => ({ + clientId: r.client_id, + host: instanceHost(r.client_id), + name: r.client_name, + grantedAt: new Date(r.granted_at), + lastUsedAt: new Date(r.last_used_at), + })); +} + +/** + * Withdraws user `userId`'s grant to the instance whose host is `host`: it + * stops answering for them there, and is told to end their sessions. + * + * @throws {APIException} 404 when they gave that instance no grant. + */ +export async function revokeGrant(userId: string, host: string): Promise { + const grant = listGrants(userId).find((g) => g.host === host.toLowerCase()); + if (!grant) throw new APIException(404, "Grant not found"); + await notifyClients(userId, { type: "revoke" }, [grant.clientId]); + db.prepare( + `DELETE FROM federation_grants WHERE user_id = ? AND client_id = ?;`, + ).run(userId, grant.clientId); +} + +/** + * Tells each instance user `userId` signed in to of `event`, or only those of + * `clientIds`: `update` when their name, email or avatar changed, `revoke` + * when their sessions there must end. The routes that change a user call it, + * and for an `update`, `event` may be just the type: the claims are read now. + * The events are queued in the outbox and their delivery starts at once. + */ +export async function notifyClients( + userId: string, + event: FederationEvent | { type: "update" }, + clientIds?: string[], +): Promise { + const clients = clientIds ?? listGrants(userId).map((g) => g.clientId); + if (clients.length === 0) return; + const payload: FederationEvent = event.type === "update" + ? { type: "update", claims: identityClaims(getUserById(userId)) } + : event; + + const key = await getSigningKey(); + const now = new Date(); + for (const clientId of clients) { + const token = await signInstanceToken( + { ...payload }, + key, + { issuer: ISSUER, audience: clientId, subject: userId }, + `${EVENT_TTL_MS / 1000}s`, + ); + db.prepare( + `INSERT INTO federation_outbox (id, client_id, event, next_attempt_at, created_at) + VALUES (?, ?, ?, ?, ?);`, + ).run( + crypto.randomUUID(), + clientId, + token, + now.toISOString(), + now.toISOString(), + ); + } + deliverOutbox().catch((err) => + console.error("[federation] delivery failed:", err) + ); +} + +/** Set while {@link deliverOutbox} runs, so that two runs don't overlap. */ +let delivering = false; + +/** + * Sends each due event of the outbox to its instance. One it took, or refused + * for good, leaves the outbox; one that failed waits twice as long as the time + * before, up to 6 hours, until it expires after 3 days. + */ +export async function deliverOutbox(): Promise { + if (delivering) return; + delivering = true; + try { + const now = new Date(); + db.prepare(`DELETE FROM federation_outbox WHERE created_at < ?;`).run( + new Date(now.getTime() - EVENT_TTL_MS).toISOString(), + ); + const due = db.prepare( + `SELECT id, client_id, event, attempts FROM federation_outbox + WHERE next_attempt_at <= ? ORDER BY created_at LIMIT 100;`, + ).all(now.toISOString()) as { + id: string; + client_id: string; + event: string; + attempts: number; + }[]; + for (const row of due) { + try { + if (!await postEvent(row.client_id, row.event)) { + console.error(`[federation] ${row.client_id} refused an event`); + } + db.prepare(`DELETE FROM federation_outbox WHERE id = ?;`).run(row.id); + } catch (err) { + const wait = Math.min(60_000 * 2 ** row.attempts, MAX_RETRY_MS); + db.prepare( + `UPDATE federation_outbox SET attempts = attempts + 1, next_attempt_at = ? WHERE id = ?;`, + ).run(new Date(Date.now() + wait).toISOString(), row.id); + console.error(`[federation] ${row.client_id} unreachable:`, err); + } + } + } finally { + delivering = false; + } +} + +/** Retries the outbox's failed events every minute. */ +export const outboxJob: Job = { + name: "federation", + everyMs: 60_000, + run: deliverOutbox, +}; diff --git a/api/services/instance-key-service.ts b/api/services/instance-key-service.ts new file mode 100644 index 00000000..17233448 --- /dev/null +++ b/api/services/instance-key-service.ts @@ -0,0 +1,73 @@ +/** + * Keeps the instance's Ed25519 key, which signs what it tells other instances + * in federated sign-in: the identity tokens of `identity-provider-service.ts` + * and the events of its outbox. The key is made the first time it's needed + * and stored in `federation_keys`, so it survives restarts; other instances + * fetch its public half from `GET /.well-known/jwks.json`. + * + * @module + */ + +import type { JSONWebKeySet, JWK } from "@panva/jose"; +import { db } from "../db/connection.ts"; +import { + generateInstanceKey, + importInstanceKey, + type InstanceSigningKey, +} from "../lib/jwt.ts"; + +/** + * Holds the key once loaded. It is a promise so that two first requests in a + * row don't each make a key. + */ +let current: Promise | null = null; + +/** + * Returns the key the instance signs with now: the newest stored, or a new + * one, stored, when there is none. + */ +export function getSigningKey(): Promise { + current ??= loadOrCreate().catch((err) => { + current = null; + throw err; + }); + return current; +} + +/** Reads the newest stored key, or makes and stores the first one. */ +async function loadOrCreate(): Promise { + const row = db.prepare( + `SELECT kid, private_jwk FROM federation_keys ORDER BY created_at DESC LIMIT 1;`, + ).get() as { kid: string; private_jwk: string } | undefined; + if (row) { + return await importInstanceKey(row.kid, JSON.parse(row.private_jwk)); + } + const { kid, privateJwk, publicJwk } = await generateInstanceKey(); + db.prepare( + `INSERT INTO federation_keys (kid, private_jwk, public_jwk, created_at) VALUES (?, ?, ?, ?);`, + ).run( + kid, + JSON.stringify(privateJwk), + JSON.stringify(publicJwk), + new Date().toISOString(), + ); + return await importInstanceKey(kid, privateJwk); +} + +/** + * Returns the public halves of every stored key, for + * `GET /.well-known/jwks.json`. It makes the first key when there is none, so + * that the set is never empty. + */ +export async function getPublicKeys(): Promise { + await getSigningKey(); + const rows = db.prepare( + `SELECT public_jwk FROM federation_keys ORDER BY created_at DESC;`, + ).all() as { public_jwk: string }[]; + return { keys: rows.map((r) => JSON.parse(r.public_jwk) as JWK) }; +} + +/** Forgets the loaded key, for the tests, which wipe the table between cases. */ +export function resetSigningKey(): void { + current = null; +} diff --git a/api/services/user-service.ts b/api/services/user-service.ts index 6ddb4e6b..9adf36f1 100644 --- a/api/services/user-service.ts +++ b/api/services/user-service.ts @@ -17,6 +17,7 @@ import type { UserSuggestion, } from "../../shared/user.ts"; import { + isRemoteUser, isUserRow, toPublicUser, type User, @@ -24,7 +25,13 @@ import { userRowToApi, } from "../model/user.ts"; import { db, transaction } from "../db/connection.ts"; -import { closeUserSockets } from "./ws-service.ts"; +import { + broadcastUserUpdated, + closeUserSockets, + updateClientAvatar, +} from "./ws-service.ts"; +import { replaceUploadedFile, validateImageUpload } from "../lib/upload.ts"; +import { AVATARS_DIR } from "../config.ts"; import { hashPassword } from "../lib/password.ts"; import { linkAttachments } from "./attachment-service.ts"; @@ -116,6 +123,39 @@ export async function createUser( }; } +/** + * Creates the account of a user from another instance, named `username` + * (their handle here, `name@host`), with no password, for + * `federation-service.ts`, which links it to their identity there in the same + * transaction. `inviterId` is whoever invited them, or null when their + * instance is trusted. + * + * @throws {APIException} 409 when the handle is or was someone else's. + */ +export function createRemoteUser( + request: { username: string; email: string }, + inviterId: string | null, +): User { + const userId = crypto.randomUUID(); + const createdAt = new Date(); + assertUsernameAvailable(request.username); + try { + db.prepare( + `INSERT INTO users (id, username, password_hash, role, created_at, invited_by, email) + VALUES (?, ?, '', 'user', ?, ?, ?);`, + ).run( + userId, + request.username, + createdAt.toISOString(), + inviterId, + request.email, + ); + } catch (err) { + throw uniqueViolationToConflict(err); + } + return getUserById(userId); +} + /** * Emails `user` the welcome message, if email is configured. The register * route calls it once the account exists, and doesn't wait: a slow or failing @@ -146,18 +186,28 @@ export function getUserById(userId: string): User { /** * Returns the user's live role and their last password change, before which - * their tokens don't count, or undefined when the user is gone. `lib/auth.ts` - * checks every session and media token against it. + * their tokens don't count, or undefined when the user is gone, or comes from + * an instance an admin blocked. `lib/auth.ts` checks every session and media + * token against it. */ export function getSessionState( userId: string, ): { role: Role; tokensValidAfter: string | null } | undefined { const row = db.prepare( - `SELECT role, tokens_valid_after FROM users WHERE id = ?;`, + `SELECT u.role, u.tokens_valid_after, p.status AS peer_status + FROM users u + LEFT JOIN user_identities ui ON ui.user_id = u.id + LEFT JOIN federation_peers p ON p.issuer = ui.issuer + WHERE u.id = ?;`, ).get(userId) as - | { role: Role; tokens_valid_after: string | null } + | { + role: Role; + tokens_valid_after: string | null; + peer_status: string | null; + } | undefined; - return row && { + if (!row || row.peer_status === "blocked") return undefined; + return { role: row.role, tokensValidAfter: row.tokens_valid_after, }; @@ -225,6 +275,19 @@ export function renameUser(userId: string, username: string): User { `Username must be ${VALIDATION.USERNAME_MIN}–${VALIDATION.USERNAME_MAX} characters and contain only letters, numbers, or underscores`, ); } + return setUsername(userId, username); +} + +/** + * Names user `userId` `username`, keeping the old name as their alias as + * {@link renameUser} describes, and returns them. The caller has checked the + * name: {@link renameUser} checks a local one, and `federation-service.ts` + * the handle of a user renamed on their home instance. + * + * @throws {APIException} 404 when there is no such user, 409 when the name is + * or was someone else's. + */ +export function setUsername(userId: string, username: string): User { const user = getUserById(userId); if (username === user.username) return user; @@ -246,13 +309,29 @@ export function renameUser(userId: string, username: string): User { } /** - * Throws a 409 when an account other than `exceptUserId` has `email`, in any - * case. Password resets are looked up by email, so an address must belong to - * one account only. + * Throws a 400 when `user`'s account lives on another instance + * ({@link isRemoteUser}), whose password, email, avatar and name are that + * instance's to change. The routes that change them call it first. + */ +export function assertLocalUser(user: User): void { + if (isRemoteUser(user)) { + throw new APIException( + 400, + "This account is managed on the instance it comes from", + ); + } +} + +/** + * Throws a 409 when a local account other than `exceptUserId` has `email`, in + * any case. Password resets are looked up by email, so an address must belong + * to one local account only; an account from another instance may share it, + * as the same person may have both. */ function assertEmailAvailable(email: string, exceptUserId?: string): void { const row = db.prepare( - `SELECT id FROM users WHERE lower(email) = lower(?) AND id != ?;`, + `SELECT id FROM users + WHERE lower(email) = lower(?) AND id != ? AND password_hash != '';`, ).get(email, exceptUserId ?? ""); if (row) { throw new APIException(409, "Email already in use"); @@ -271,12 +350,13 @@ function uniqueViolationToConflict(err: unknown): unknown { } /** - * Returns the user whose email is `email`, in any case, or null, for - * `requestPasswordReset`. + * Returns the local user whose email is `email`, in any case, or null, for + * `requestPasswordReset`. An account from another instance has no password + * here to reset. */ export function getUserByEmail(email: string): User | null { const userRow = db.prepare( - `${USER_SELECT} WHERE lower(u.email) = lower(?)`, + `${USER_SELECT} WHERE lower(u.email) = lower(?) AND u.password_hash != ''`, ).get(email); if (!userRow || !isUserRow(userRow)) return null; @@ -385,13 +465,7 @@ export async function updateUser( throw new APIException(404, "User not found"); } - if (password) { - db.prepare(`UPDATE users SET tokens_valid_after = ? WHERE id = ?;`).run( - now.toISOString(), - userId, - ); - closeUserSockets(userId, "Password changed"); - } + if (password) revokeSessions(userId, now, "Password changed"); if (updatedUser.description) { linkAttachments(updatedUser.description, "user", userId); @@ -400,14 +474,54 @@ export async function updateUser( return updatedUser; } +/** + * Ends every session of user `userId` opened before `at`, closing their + * sockets with `reason`: their tokens stop counting + * (`users.tokens_valid_after`, which `getSessionState` reads). A password + * change calls it, and so does the sign-out of a user from another instance, + * when that instance says so or an admin blocks it. + */ +export function revokeSessions(userId: string, at: Date, reason: string): void { + db.prepare(`UPDATE users SET tokens_valid_after = ? WHERE id = ?;`).run( + at.toISOString(), + userId, + ); + closeUserSockets(userId, reason); +} + +/** + * Makes the image `data` user `userId`'s avatar and returns them, for an + * upload (`PUT /api/me/avatar`) and for the avatar a user from another + * instance has there (`federation-service.ts`). Presence alone would update + * only the online list, so it also sends `user_updated`, which reaches every + * avatar on screen, its bumped `updatedAt` busting their cache. + * + * @throws {APIException} 400 when `data` isn't an image an avatar may be, 404 + * when there is no such user. + */ +export async function setUserAvatar( + userId: string, + data: Uint8Array, +): Promise { + const mime = validateImageUpload(data); + // Written before the record announces it, or clients would fetch it too + // early. + await replaceUploadedFile(`${AVATARS_DIR}/${userId}`, data); + updateUserAvatar(userId, mime); + updateClientAvatar(userId, mime); + const user = getUserById(userId); + broadcastUserUpdated(toPublicUser(user)); + return user; +} + /** * Records that user `userId` now has an avatar of type `mime`, once - * `PUT /api/me/avatar` has written the file. It bumps `updated_at`, which + * {@link setUserAvatar} has written the file. It bumps `updated_at`, which * the client uses to reload the image. * * @throws {APIException} 404 when there is no such user. */ -export function updateUserAvatar(userId: string, mime: string): void { +function updateUserAvatar(userId: string, mime: string): void { const result = db.prepare( `UPDATE users SET avatar_mime = ?, updated_at = ? WHERE id = ?`, ).run(mime, new Date().toISOString(), userId); diff --git a/api/test/db/migrate.test.ts b/api/test/db/migrate.test.ts index 765969f1..cd9fd6b9 100644 --- a/api/test/db/migrate.test.ts +++ b/api/test/db/migrate.test.ts @@ -28,14 +28,14 @@ Deno.test("runMigrations: a fresh database is left as schema.sql made it", () => .get() as { n: number; }; - assertEquals(applied.n, 23); + assertEquals(applied.n, 24); // Running again applies nothing. runMigrations(db); assertEquals( (db.prepare(`SELECT COUNT(*) as n FROM schema_migrations;`).get() as { n: number; }).n, - 23, + 24, ); db.close(); }); diff --git a/api/test/db/migrations/0024_federation.test.ts b/api/test/db/migrations/0024_federation.test.ts new file mode 100644 index 00000000..907f59c1 --- /dev/null +++ b/api/test/db/migrations/0024_federation.test.ts @@ -0,0 +1,43 @@ +import "../../setup.ts"; +import { assertEquals, assertThrows } from "@std/assert"; +import { DatabaseSync } from "node:sqlite"; +import { up as up0024 } from "../../../db/migrations/0024_federation.ts"; + +Deno.test("migration 0024 adds federation and frees remote accounts' emails", () => { + const db = new DatabaseSync(":memory:"); + db.exec(` + CREATE TABLE users (id TEXT PRIMARY KEY, username TEXT, password_hash TEXT, email TEXT); + CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email)); + CREATE TABLE categories (id TEXT PRIMARY KEY, slug TEXT); + INSERT INTO users VALUES ('a', 'ann', 'h.s', 'a@x.test'); + INSERT INTO categories VALUES ('c', 'authorize'), ('d', 'music'); + `); + up0024(db); + up0024(db); // idempotent + + // Two accounts without a password may share an address with a local one. + db.exec(` + INSERT INTO users VALUES ('b', 'ann@one.test', '', 'a@x.test'); + INSERT INTO users VALUES ('c', 'ann@two.test', '', 'A@x.test'); + `); + assertThrows(() => + db.exec(`INSERT INTO users VALUES ('d', 'dup', 'h.s', 'a@X.test');`) + ); + const slugs = db.prepare(`SELECT slug FROM categories ORDER BY id;`) + .all() as { slug: string }[]; + assertEquals(slugs.map((r) => r.slug), ["authorize-2", "music"]); + for ( + const table of [ + "federation_keys", + "user_identities", + "federation_peers", + "federation_logins", + "oauth_codes", + "federation_grants", + "federation_outbox", + ] + ) { + db.prepare(`SELECT COUNT(*) FROM ${table};`).get(); + } + db.close(); +}); diff --git a/api/test/helpers.ts b/api/test/helpers.ts index ddab51dc..b6309390 100644 --- a/api/test/helpers.ts +++ b/api/test/helpers.ts @@ -4,7 +4,13 @@ import { TEST_DIR } from "./setup.ts"; import { stub } from "@std/testing/mock"; import { app } from "../main.ts"; import { db } from "../db/connection.ts"; -import { createJWT, createMediaToken } from "../lib/jwt.ts"; +import { + createJWT, + createMediaToken, + generateInstanceKey, + importInstanceKey, + signInstanceToken, +} from "../lib/jwt.ts"; import { hashPassword } from "../lib/password.ts"; import { uniqueSlug } from "../lib/slugify.ts"; import { slugify } from "../../shared/slug.ts"; @@ -12,6 +18,7 @@ import { dumpPath, playlistPath } from "../../shared/paths.ts"; import { canonicalizeUrl } from "../lib/canonical-url.ts"; import { clearRichContentCache } from "../services/rich-content-service.ts"; import { clearImageCache } from "../remote/image-proxy.ts"; +import { clearInstanceCaches } from "../remote/gerbeur-instance.ts"; import { type OutgoingEmail, setEmailTransport, @@ -24,6 +31,12 @@ export { app, db, TEST_DIR }; // ── Database ───────────────────────────────────────────────────────────────── const TABLES = [ + "user_identities", + "federation_peers", + "federation_logins", + "oauth_codes", + "federation_grants", + "federation_outbox", "dump_backlinks", "dump_categories", "playlist_dumps", @@ -393,6 +406,7 @@ export function stubNetwork( // A new network: metadata cached from the last one no longer describes it. clearRichContentCache(); clearImageCache(); + clearInstanceCaches(); const fetchStub = stub( globalThis, "fetch", @@ -419,6 +433,137 @@ export function stubNetwork( }; } +// ── Federation ─────────────────────────────────────────────────────────────── + +/** A user of a {@link FakeInstance}, as its identity tokens describe them. */ +export interface FakeIdentity { + sub: string; + preferred_username: string; + email: string; + picture?: string; +} + +/** + * Another gerbeur instance at `origin`, answering through {@link stubNetwork} + * (`stubNetwork((url, init) => fake.handle(url, init) ?? ...)`): its metadata, + * its keys, a token endpoint that trades the codes the test `issue`s, an + * events endpoint recording what it receives, and avatars. + */ +export interface FakeInstance { + origin: string; + /** + * Makes a code for `identity`, answering the authorize URL `authorizeUrl` + * (this instance's request) as the home would after consent. + */ + issue(authorizeUrl: string, identity: FakeIdentity): string; + /** Signs an event about `sub` for this instance, as its outbox would. */ + event(sub: string, payload: Record): Promise; + /** The events posted to it, as their JWTs. */ + received: string[]; + /** Answers a request to it, or null when `url` isn't on it. */ + handle(url: URL, init?: RequestInit): Promise | null; +} + +/** Makes a {@link FakeInstance} at `origin` with a fresh key. */ +export async function fakeInstance(origin: string): Promise { + const { kid, privateJwk, publicJwk } = await generateInstanceKey(); + const key = await importInstanceKey(kid, privateJwk); + const codes = new Map< + string, + { identity: FakeIdentity; nonce: string; challenge: string; client: string } + >(); + const received: string[] = []; + const json = (body: unknown, status = 200) => + new Response(JSON.stringify(body), { + status, + headers: { "content-type": "application/json" }, + }); + const handle = async (url: URL, init?: RequestInit): Promise => { + switch (url.pathname) { + case "/.well-known/openid-configuration": + return json({ + issuer: origin, + authorization_endpoint: `${origin}/authorize`, + token_endpoint: `${origin}/api/oauth/tokens`, + jwks_uri: `${origin}/.well-known/jwks.json`, + response_types_supported: ["code"], + grant_types_supported: ["authorization_code"], + subject_types_supported: ["public"], + id_token_signing_alg_values_supported: ["EdDSA"], + code_challenge_methods_supported: ["S256"], + scopes_supported: ["openid", "profile", "email"], + gerbeur_federation: 1, + gerbeur_site_name: `Fake ${new URL(origin).host}`, + gerbeur_redirect_uri: `${origin}/federation/callback`, + gerbeur_events_endpoint: `${origin}/api/federation/events`, + }); + case "/.well-known/jwks.json": + return json({ keys: [publicJwk] }); + case "/api/oauth/tokens": { + const form = new URLSearchParams(String(init?.body)); + const entry = codes.get(form.get("code") ?? ""); + codes.delete(form.get("code") ?? ""); + const verifier = form.get("code_verifier") ?? ""; + const hash = new Uint8Array( + await crypto.subtle.digest( + "SHA-256", + new TextEncoder().encode(verifier), + ), + ); + const challenge = btoa(String.fromCharCode(...hash)) + .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""); + if ( + !entry || entry.challenge !== challenge || + entry.client !== form.get("client_id") + ) { + return json({ error: "invalid_grant" }, 400); + } + const { sub, ...claims } = entry.identity; + return json({ + id_token: await signInstanceToken( + { ...claims, nonce: entry.nonce }, + key, + { issuer: origin, audience: entry.client, subject: sub }, + "5m", + ), + }); + } + case "/api/federation/events": + received.push(JSON.parse(String(init?.body)).event); + return new Response(null, { status: 204 }); + default: + if (url.pathname.endsWith("/avatar")) { + return new Response(PNG, { + headers: { "content-type": "image/png" }, + }); + } + return json({ error: "not found" }, 404); + } + }; + return { + origin, + received, + issue(authorizeUrl, identity) { + const q = new URL(authorizeUrl).searchParams; + const code = crypto.randomUUID(); + codes.set(code, { + identity, + nonce: q.get("nonce") ?? "", + challenge: q.get("code_challenge") ?? "", + client: q.get("client_id") ?? "", + }); + return code; + }, + event: (sub, payload) => + signInstanceToken(payload, key, { + issuer: origin, + audience: BASE_URL, + subject: sub, + }, "1h"), + handle: (url, init) => url.origin === origin ? handle(url, init) : null, + }; +} + // ── Email ──────────────────────────────────────────────────────────────────── /** diff --git a/api/test/services/federation-service.test.ts b/api/test/services/federation-service.test.ts new file mode 100644 index 00000000..5b487e37 --- /dev/null +++ b/api/test/services/federation-service.test.ts @@ -0,0 +1,326 @@ +import { + createUser, + db, + del, + type FakeInstance, + fakeInstance, + formWithFile, + get, + patch, + PNG, + post, + put, + stubNetwork, + test, +} from "../helpers.ts"; +import { assert, assertEquals, assertMatch } from "@std/assert"; +import type { + FederationLoginResponse, + FederationPeer, +} from "../../../shared/federation.ts"; +import type { AuthResponse, SelfUser } from "../../../shared/user.ts"; + +const HOME = "https://home.test"; + +/** Puts `fake` behind the network, every other host answering 404. */ +function network(...fakes: FakeInstance[]) { + return stubNetwork((url, init) => { + for (const fake of fakes) { + const res = fake.handle(url, init); + if (res) return res; + } + return new Response("", { status: 404 }); + }); +} + +async function trust(issuer: string, status = "trusted") { + const admin = await createUser({ role: "admin" }); + return await put("/api/federation/peers", { + auth: admin.auth, + json: { instance: issuer, status }, + }); +} + +/** Signs in through `home` as `identity`, as the pages would. */ +async function signIn( + home: FakeInstance, + identity: { + sub: string; + preferred_username: string; + email: string; + picture?: string; + }, + inviteToken?: string, +) { + const start = await post("/api/federation/logins", { + json: { instance: new URL(home.origin).host, inviteToken }, + }); + if (start.status !== 200) return start; + const authorizeUrl = start.data.authorizeUrl; + const code = home.issue(authorizeUrl, identity); + return await post("/api/federation/sessions", { + json: { code, state: new URL(authorizeUrl).searchParams.get("state") }, + }); +} + +const ALICE = { + sub: "alice-id", + preferred_username: "alice", + email: "alice@home.example", + picture: `${HOME}/api/users/alice-id/avatar?v=1`, +}; + +test("federation: a trusted instance's user signs in as name@host, once made", async () => { + const home = await fakeInstance(HOME); + using net = network(home); + assertEquals((await trust("home.test")).data.name, "Fake home.test"); + + const start = await post("/api/federation/logins", { + json: { instance: "home.test" }, + }); + const url = new URL(start.data.authorizeUrl); + assertEquals(url.origin + url.pathname, `${HOME}/authorize`); + assertEquals(url.searchParams.get("client_id"), "http://gerbeur.test"); + assertEquals( + url.searchParams.get("redirect_uri"), + "http://gerbeur.test/federation/callback", + ); + assertEquals(url.searchParams.get("code_challenge_method"), "S256"); + + const first = await signIn(home, ALICE); + const { user, token } = first.data as AuthResponse; + assertEquals(user.username, "alice@home.test"); + assertEquals(user.email, "alice@home.example"); + assertEquals(user.role, "user"); + assertEquals(user.avatarMime, "image/png"); + assert(net.calls.some((u) => u.pathname === "/api/users/alice-id/avatar")); + + const me = await get("/api/me", { + auth: { Authorization: `Bearer ${token}` }, + }); + assertEquals(me.data.id, user.id); + + // The same identity signs in to the same account. + const again = await signIn(home, ALICE); + assertEquals((again.data as AuthResponse).user.id, user.id); + + // It has no password here. + const login = await post("/api/sessions", { + json: { username: "alice@home.test", password: "" }, + }); + assertEquals(login.status, 401); + assertEquals( + (await get("/api/users/@alice@home.test")).data.id, + user.id, + ); + // The client encodes the handle's `@`. + assertEquals( + (await get("/api/users/@alice%40home.test")).data.id, + user.id, + ); +}); + +test("federation: a login works once, with the code the home made for it", async () => { + const home = await fakeInstance(HOME); + using _net = network(home); + await trust(HOME); + const start = await post("/api/federation/logins", { + json: { instance: HOME }, + }); + const state = new URL(start.data.authorizeUrl).searchParams.get("state"); + const wrong = await post("/api/federation/sessions", { + json: { code: "made-up", state }, + }); + assertEquals(wrong.status, 502); + // The failed try used the login up. + const code = home.issue(start.data.authorizeUrl, ALICE); + const replay = await post("/api/federation/sessions", { + json: { code, state }, + }); + assertEquals(replay.status, 400); +}); + +test("federation: an instance on neither list needs an invite, claimed on joining", async () => { + const home = await fakeInstance(HOME); + using _net = network(home); + const refused = await signIn(home, ALICE); + assertEquals(refused.status, 403); + + const inviter = await createUser(); + const { token } = (await post<{ token: string }>("/api/invites", { + auth: inviter.auth, + })).data; + const joined = await signIn(home, ALICE, token); + const { user } = joined.data as AuthResponse; + assertEquals(user.username, "alice@home.test"); + const row = db.prepare(`SELECT invited_by FROM users WHERE id = ?;`).get( + user.id, + ) as { invited_by: string }; + assertEquals(row.invited_by, inviter.id); + assertEquals((await get(`/api/invites/${token}`)).status, 404); + + // Once here, no invite is needed; another user of that instance still + // needs one. + assertEquals((await signIn(home, ALICE)).status, 200); + const bob = { ...ALICE, sub: "bob-id", preferred_username: "bob" }; + assertEquals((await signIn(home, bob)).status, 403); +}); + +test("federation: blocking an instance refuses its users and ends their sessions", async () => { + const home = await fakeInstance(HOME); + using _net = network(home); + await trust(HOME); + const { token } = (await signIn(home, ALICE)).data as AuthResponse; + const auth = { Authorization: `Bearer ${token}` }; + assertEquals((await get("/api/me", { auth })).status, 200); + + await trust(HOME, "blocked"); + assertEquals((await get("/api/me", { auth })).status, 401); + assertEquals((await signIn(home, ALICE)).status, 403); + + const admin = await createUser({ role: "admin" }); + const peers = await get("/api/federation/peers", { + auth: admin.auth, + }); + assertEquals(peers.data.map((p) => p.status), ["blocked"]); + assertEquals((await get("/api/federation/peers")).data, []); + assertEquals( + (await del("/api/federation/peers/home.test", { auth: admin.auth })) + .status, + 200, + ); + assertEquals((await get("/api/me", { auth })).status, 200); +}); + +test("federation: only admins edit the peers, which must answer as gerbeurs", async () => { + const home = await fakeInstance(HOME); + using _net = network(home); + const user = await createUser(); + const admin = await createUser({ role: "admin" }); + assertEquals( + (await put("/api/federation/peers", { + auth: user.auth, + json: { instance: HOME, status: "trusted" }, + })).status, + 403, + ); + for (const instance of ["elsewhere.test", "https://home.test/path"]) { + const res = await put("/api/federation/peers", { + auth: admin.auth, + json: { instance, status: "trusted" }, + }); + assert(res.status >= 400, instance); + } + assertEquals( + (await put("/api/federation/peers", { + auth: admin.auth, + json: { instance: "http://gerbeur.test", status: "trusted" }, + })).status, + 400, + ); +}); + +test("federation: the home's events rename, update and sign out its users", async () => { + const home = await fakeInstance(HOME); + const other = await fakeInstance("https://other.test"); + using _net = network(home, other); + await trust(HOME); + const { user, token } = (await signIn(home, ALICE)).data as AuthResponse; + const auth = { Authorization: `Bearer ${token}` }; + + const update = await home.event(ALICE.sub, { + type: "update", + claims: { ...ALICE, preferred_username: "alicia", email: "a@new.example" }, + }); + assertEquals( + (await post("/api/federation/events", { json: { event: update } })) + .status, + 204, + ); + const renamed = await get("/api/me", { auth }); + assertEquals(renamed.data.username, "alicia@home.test"); + assertEquals(renamed.data.email, "a@new.example"); + // The old handle still leads to them. + assertEquals( + (await get("/api/users/@alice@home.test")).data.id, + user.id, + ); + + // Another instance can't speak for this one's users. + const forged = await other.event(ALICE.sub, { type: "revoke" }); + assertEquals( + (await post("/api/federation/events", { json: { event: forged } })) + .status, + 400, + ); + + // Revoking a little later than the token was issued, as it would be. + await new Promise((r) => setTimeout(r, 1100)); + const revoke = await home.event(ALICE.sub, { type: "revoke" }); + assertEquals( + (await post("/api/federation/events", { json: { event: revoke } })) + .status, + 204, + ); + assertEquals((await get("/api/me", { auth })).status, 401); +}); + +test("federation: an account from another instance changes its password, email, avatar and name there", async () => { + const home = await fakeInstance(HOME); + using _net = network(home); + await trust(HOME); + const { user, token } = (await signIn(home, ALICE)).data as AuthResponse; + const auth = { Authorization: `Bearer ${token}` }; + const admin = await createUser({ role: "admin" }); + + assertEquals( + (await put("/api/me/password", { + auth, + json: { currentPassword: "", newPassword: "long-enough" }, + })).status, + 400, + ); + assertEquals( + (await patch("/api/me", { auth, json: { email: "x@example.test" } })) + .status, + 400, + ); + assertEquals( + (await patch("/api/me", { auth, json: { description: "hi" } })) + .data.description, + "hi", + ); + assertEquals( + (await put("/api/me/avatar", { auth, form: formWithFile(PNG) })).status, + 400, + ); + assertEquals( + (await patch(`/api/users/${user.id}/username`, { + auth: admin.auth, + json: { username: "bob" }, + })).status, + 400, + ); +}); + +test("federation: an email may be both a local account's and a remote one's", async () => { + const home = await fakeInstance(HOME); + using _net = network(home); + await trust(HOME); + const local = await createUser({ email: ALICE.email }); + const res = await signIn(home, ALICE); + assertMatch((res.data as AuthResponse).user.username, /@home\.test$/); + // A reset by that address reaches the local account only. + const row = db.prepare( + `SELECT COUNT(*) AS n FROM users WHERE lower(email) = lower(?);`, + ).get(ALICE.email) as { n: number }; + assertEquals(row.n, 2); + assertEquals( + (await post("/api/password-resets", { json: { email: ALICE.email } })) + .status, + 200, + ); + const tokens = db.prepare(`SELECT user_id FROM password_reset_tokens;`) + .all() as { user_id: string }[]; + assert(tokens.every((t) => t.user_id === local.id)); +}); diff --git a/api/test/services/identity-provider-service.test.ts b/api/test/services/identity-provider-service.test.ts new file mode 100644 index 00000000..ad5e4598 --- /dev/null +++ b/api/test/services/identity-provider-service.test.ts @@ -0,0 +1,268 @@ +import { + app, + BASE_URL, + createUser, + db, + del, + type FakeInstance, + fakeInstance, + get, + patch, + post, + put, + stubNetwork, + test, +} from "../helpers.ts"; +import { assert, assertEquals } from "@std/assert"; +import { createHash } from "node:crypto"; +import { decodeJwt, type JSONWebKeySet } from "@panva/jose"; +import { verifyInstanceToken } from "../../lib/jwt.ts"; +import type { + AuthorizeResponse, + FederationGrant, + InstanceMetadata, + OAuthClient, +} from "../../../shared/federation.ts"; + +const CLIENT = "https://client.test"; +const CALLBACK = `${CLIENT}/federation/callback`; + +function network(fake: FakeInstance, events?: () => Response) { + return stubNetwork((url, init) => { + if (events && url.pathname === "/api/federation/events") return events(); + return fake.handle(url, init) ?? new Response("", { status: 404 }); + }); +} + +/** A PKCE pair: the verifier, and the challenge the request carries. */ +function pkce() { + const verifier = crypto.randomUUID() + crypto.randomUUID(); + return { + verifier, + challenge: createHash("sha256").update(verifier).digest("base64url"), + }; +} + +function authorize( + auth: { Authorization: string }, + challenge: string, + overrides: Record = {}, +) { + return post("/api/oauth/codes", { + auth, + json: { + clientId: CLIENT, + redirectUri: CALLBACK, + state: "the-state", + codeChallenge: challenge, + codeChallengeMethod: "S256", + nonce: "the-nonce", + ...overrides, + }, + }); +} + +/** Trades `code` at the token endpoint, as the client's server would. */ +async function trade(code: string, verifier: string, client = CLIENT) { + const res = await app.handle( + new Request(`${BASE_URL}/api/oauth/tokens`, { + method: "POST", + headers: { "Content-Type": "application/x-www-form-urlencoded" }, + body: new URLSearchParams({ + grant_type: "authorization_code", + code, + client_id: client, + redirect_uri: CALLBACK, + code_verifier: verifier, + }), + }), + ); + return { status: res!.status, body: await res!.json() }; +} + +async function until(check: () => boolean) { + for (let i = 0; i < 50 && !check(); i++) { + await new Promise((r) => setTimeout(r, 10)); + } +} + +test("identity provider: metadata and keys are served at the well-known paths", async () => { + const meta = await get("/.well-known/openid-configuration"); + const body = JSON.parse( + new TextDecoder().decode(meta.bytes), + ) as InstanceMetadata; + assertEquals(body.issuer, BASE_URL); + assertEquals(body.authorization_endpoint, `${BASE_URL}/authorize`); + assertEquals(body.gerbeur_redirect_uri, `${BASE_URL}/federation/callback`); + assertEquals(body.gerbeur_federation, 1); + const jwks = await get("/.well-known/jwks.json"); + const keys = JSON.parse(new TextDecoder().decode(jwks.bytes)).keys; + assertEquals(keys[0].crv, "Ed25519"); + assertEquals(keys[0].d, undefined); +}); + +test("identity provider: a consenting user's code trades once for their identity", async () => { + const fake = await fakeInstance(CLIENT); + using _net = network(fake); + const user = await createUser({ username: "carol" }); + + const client = await get( + `/api/oauth/clients?client_id=${encodeURIComponent(CLIENT)}`, + { auth: user.auth }, + ); + assertEquals(client.data, { + clientId: CLIENT, + host: "client.test", + name: "Fake client.test", + granted: false, + }); + + const { verifier, challenge } = pkce(); + const redirect = new URL( + (await authorize(user.auth, challenge)).data + .redirectTo, + ); + assertEquals(redirect.origin + redirect.pathname, CALLBACK); + assertEquals(redirect.searchParams.get("state"), "the-state"); + assertEquals(redirect.searchParams.get("iss"), BASE_URL); + const code = redirect.searchParams.get("code")!; + + assertEquals((await trade(code, pkce().verifier)).status, 400); + // A failed trade used the code up too. + assertEquals((await trade(code, verifier)).status, 400); + + const { challenge: c2, verifier: v2 } = pkce(); + const code2 = new URL((await authorize(user.auth, c2)).data.redirectTo) + .searchParams.get("code")!; + assertEquals((await trade(code2, v2, "https://elsewhere.test")).status, 400); + const { challenge: c3, verifier: v3 } = pkce(); + const code3 = new URL((await authorize(user.auth, c3)).data.redirectTo) + .searchParams.get("code")!; + const traded = await trade(code3, v3); + assertEquals(traded.status, 200); + + const keys = JSON.parse( + new TextDecoder().decode((await get("/.well-known/jwks.json")).bytes), + ) as JSONWebKeySet; + const claims = await verifyInstanceToken(traded.body.id_token, keys, { + issuer: BASE_URL, + audience: CLIENT, + }); + assertEquals(claims.sub, user.id); + assertEquals(claims.preferred_username, "carol"); + assertEquals(claims.email, user.email); + assertEquals(claims.nonce, "the-nonce"); + + const again = await get( + `/api/oauth/clients?client_id=${encodeURIComponent(CLIENT)}`, + { auth: user.auth }, + ); + assertEquals(again.data.granted, true); + const grants = await get("/api/me/grants", { + auth: user.auth, + }); + assertEquals(grants.data.map((g) => g.host), ["client.test"]); +}); + +test("identity provider: codes are only for a known client's own callback", async () => { + const fake = await fakeInstance(CLIENT); + using _net = network(fake); + const user = await createUser(); + const admin = await createUser({ role: "admin" }); + const { challenge } = pkce(); + assertEquals( + (await authorize(user.auth, challenge, { + redirectUri: "https://evil.test/cb", + })).status, + 400, + ); + assertEquals( + (await authorize(user.auth, challenge, { clientId: BASE_URL })).status, + 400, + ); + assertEquals( + (await authorize(user.auth, challenge, { codeChallengeMethod: "plain" })) + .status, + 400, + ); + assertEquals( + (await authorize(user.auth, challenge, { + clientId: "https://nowhere.test", + })).status, + 502, + ); + await put("/api/federation/peers", { + auth: admin.auth, + json: { instance: CLIENT, status: "blocked" }, + }); + assertEquals((await authorize(user.auth, challenge)).status, 403); +}); + +test("identity provider: an account from another instance doesn't sign in elsewhere from here", async () => { + const fake = await fakeInstance(CLIENT); + using _net = network(fake); + const user = await createUser(); + db.prepare(`UPDATE users SET password_hash = '' WHERE id = ?;`).run(user.id); + assertEquals((await authorize(user.auth, pkce().challenge)).status, 400); +}); + +test("identity provider: the instances a user signed in to hear of their changes", async () => { + const fake = await fakeInstance(CLIENT); + using _net = network(fake); + const user = await createUser({ username: "dave" }); + const admin = await createUser({ role: "admin" }); + await authorize(user.auth, pkce().challenge); + + await patch(`/api/users/${user.id}/username`, { + auth: admin.auth, + json: { username: "david" }, + }); + await until(() => fake.received.length === 1); + const update = decodeJwt(fake.received[0]); + assertEquals(update.type, "update"); + assertEquals(update.sub, user.id); + assertEquals(update.aud, CLIENT); + assertEquals( + (update.claims as { preferred_username: string }).preferred_username, + "david", + ); + + await put("/api/me/password", { + auth: user.auth, + json: { currentPassword: "correct-horse", newPassword: "new-password" }, + }); + await until(() => fake.received.length === 2); + assertEquals(decodeJwt(fake.received[1]).type, "revoke"); + + const token = (await post<{ token: string }>("/api/sessions", { + json: { username: "david", password: "new-password" }, + })).data.token; + const auth = { Authorization: `Bearer ${token}` }; + assertEquals( + (await del("/api/me/grants/client.test", { auth })).status, + 200, + ); + await until(() => fake.received.length === 3); + assertEquals(decodeJwt(fake.received[2]).type, "revoke"); + assertEquals( + (await get("/api/me/grants", { auth })).data, + [], + ); +}); + +test("identity provider: an event an instance fails to take waits in the outbox", async () => { + const fake = await fakeInstance(CLIENT); + using _net = network(fake, () => new Response("", { status: 503 })); + const user = await createUser(); + await authorize(user.auth, pkce().challenge); + await patch("/api/me", { auth: user.auth, json: { email: "e@new.test" } }); + let row: { attempts: number } | undefined; + await until(() => { + row = db.prepare(`SELECT attempts FROM federation_outbox;`).get() as + | { attempts: number } + | undefined; + return (row?.attempts ?? 0) > 0; + }); + assert(row); + assertEquals(row.attempts, 1); +}); diff --git a/api/validators/federation.ts b/api/validators/federation.ts new file mode 100644 index 00000000..efdc2f99 --- /dev/null +++ b/api/validators/federation.ts @@ -0,0 +1,56 @@ +/** + * Checks the JSON bodies that the federation routes (`routes/federation.ts`, + * `routes/oauth.ts`) receive before they read them. They check the shapes + * only: whether an instance answers, or a code or an invite works, is the + * services' check. + * + * @module + */ + +import { + type AuthorizeRequest, + type FederationLoginRequest, + type FederationSessionRequest, + isPeerStatus, + type SetPeerRequest, +} from "../../shared/federation.ts"; + +/** Returns whether `obj` is an object whose `keys` are all strings. */ +function hasStrings(obj: unknown, keys: string[]): boolean { + return !!obj && typeof obj === "object" && + keys.every((k) => typeof (obj as Record)[k] === "string"); +} + +/** Checks whether `obj` is a {@link FederationLoginRequest}. */ +export function isFederationLoginRequest( + obj: unknown, +): obj is FederationLoginRequest { + if (!hasStrings(obj, ["instance"])) return false; + const invite = (obj as Record).inviteToken; + return invite === undefined || typeof invite === "string"; +} + +/** Checks whether `obj` is a {@link FederationSessionRequest}. */ +export function isFederationSessionRequest( + obj: unknown, +): obj is FederationSessionRequest { + return hasStrings(obj, ["code", "state"]); +} + +/** Checks whether `obj` is an {@link AuthorizeRequest}. */ +export function isAuthorizeRequest(obj: unknown): obj is AuthorizeRequest { + return hasStrings(obj, [ + "clientId", + "redirectUri", + "state", + "codeChallenge", + "codeChallengeMethod", + "nonce", + ]); +} + +/** Checks whether `obj` is a {@link SetPeerRequest}. */ +export function isSetPeerRequest(obj: unknown): obj is SetPeerRequest { + return hasStrings(obj, ["instance"]) && + isPeerStatus((obj as Record).status); +} diff --git a/locales/en.mjs b/locales/en.mjs index 772d1a0a..f9f3d663 100644 --- a/locales/en.mjs +++ b/locales/en.mjs @@ -1 +1 @@ -/*eslint-disable*/export const messages=JSON.parse("{\"-K9EZb\":[\"Add email…\"],\"-Ya-b9\":[\"Failed to save\"],\"-iDCtG\":[\"Your settings\"],\"-siMqD\":[\"Journal\"],\"1CalO6\":[\"Style\"],\"1HfJWf\":[\"Search dumps, users, playlists…\"],\"1QfxQT\":[\"Dismiss\"],\"1YKhJ3\":[\"1 new message\"],\"1njn7W\":[\"Light\"],\"1utXA6\":[\"Dumps\"],\"26iNma\":[\"Post comment\"],\"2DoBvq\":[\"Feeds\"],\"2Hlmdt\":[\"Write a reply…\"],\"2_DHgA\":[\"URL slug\"],\"2nrsEn\":[\"deleted message\"],\"2wxgft\":[\"Rename\"],\"2ygf_L\":[\"← Back\"],\"3KKSM4\":[\"private\"],\"3QuNUr\":[\"Several people are typing…\"],\"3SEwY1\":[\"Delete category \\\"\",[\"0\"],\"\\\"? This cannot be undone.\"],\"3qkggm\":[\"Fullscreen\"],\"3yfh3D\":[\"<0>\",[\"0\"],\" followed your playlist <1>\",[\"1\"],\"\"],\"48e2R8\":[\"Edit email\"],\"49voTZ\":[[\"label\"],\" (\",[\"count\"],\")\"],\"4B6w_o\":[\"Dumped!\"],\"4GKuCs\":[\"Login failed\"],\"4HH9iB\":[\"Not following anyone yet.\"],\"4OjqAQ\":[\"Keep editing\"],\"4RtQ1k\":[\"Unfollow \",[\"targetUsername\"]],\"4c-qBx\":[\"Your password has been changed. You can now log in.\"],\"4yj9xV\":[\"Live updates are temporarily disconnected. Trying to reconnect…\"],\"5KHDCi\":[[\"0\"],\" and \",[\"1\"],\" are typing…\"],\"5NZ3tg\":[\"Turning off…\"],\"5TviPn\":[\"Cancel search\"],\"5cC8f2\":[\"Edited \",[\"0\"]],\"5oD9f_\":[\"Earlier\"],\"6Qly-0\":[\"a comment\"],\"6YE0P6\":[\"Editing \",[\"0\"]],\"6YtxFj\":[\"Name\"],\"6_dCYd\":[\"Overview\"],\"6gRgw8\":[\"Retry\"],\"7PHCIN\":[\"Cancel removal\"],\"7PzzBU\":[\"User\"],\"7d1a0d\":[\"Public\"],\"7noMWp\":[\"Nothing happened this week.\"],\"7sNhEz\":[\"Username\"],\"8-8abB\":[\"Disconnected — reconnecting…\"],\"8F1i42\":[\"Page not found\"],\"8JplJJ\":[\"Unsubscribed\"],\"8Ug9jB\":[\"Related\"],\"8ZsakT\":[\"Password\"],\"92o1-U\":[\"Failed to delete\"],\"9BruTc\":[\"Why?\"],\"9l4qcT\":[\"Drop a replacement here\"],\"9uI_rE\":[\"Undo\"],\"A0y396\":[\"+ Invite someone\"],\"A1taO8\":[\"Search\"],\"AEfu-D\":[\"In collections\"],\"AHZflp\":[\"Chat\"],\"AQbgNR\":[\"Follow \",[\"targetUsername\"]],\"AS7WoE\":[\"Start fresh\"],\"ATGYL1\":[\"Email address\"],\"AZctoV\":[[\"0\",\"plural\",{\"one\":[\"#\",\" comment\"],\"other\":[\"#\",\" comments\"]}]],\"Ade-6d\":[\"Live updates unavailable.\"],\"AeXO77\":[\"Account\"],\"AhNP40\":[\"Seek\"],\"AnRu_j\":[\"Cancel reply\"],\"B4LeYP\":[\"Delete failed (\",[\"0\"],\")\"],\"BjitBo\":[\"Download \",[\"0\"]],\"BlpJ2G\":[\"Picked up where you left off.\"],\"CI50ct\":[\"Upvoted\"],\"C_qQE4\":[\"Already dumped by \",[\"0\"],\" \",[\"1\"]],\"Cf_gxi\":[\"Turn off the weekly digest?\"],\"Cj24wt\":[\"Registering…\"],\"CnqayG\":[\"Couldn't update. Try again.\"],\"D8DRYV\":[\"Delete this message?\"],\"DI3NBO\":[\"Open on \",[\"0\"]],\"DPfwMq\":[\"Done\"],\"DdeHXH\":[\"Delete this dump? This cannot be undone.\"],\"Dp1JhP\":[\"<0>\",[\"0\"],\" upvoted <1>\",[\"1\"],\"\"],\"E417RG\":[\"You won't get the weekly digest any more. You can turn it back on in your settings.\"],\"EBU6O6\":[\"Connection lost — this message may not have been sent\"],\"ECiS12\":[\"View dump →\"],\"ED8n0z\":[\"the chat\"],\"EarrCe\":[\"Search emoji\"],\"Evcm2Z\":[\"Close without posting? The attached file won't be kept — everything you typed will.\"],\"EwVrWF\":[\"The dump couldn't be removed. Try again.\"],\"ExR0Fr\":[\"URL is required.\"],\"F5Js1v\":[\"Unfollow playlist\"],\"FdTlEG\":[\"Track \",[\"0\"]],\"FgAxTj\":[\"Log out\"],\"Fxf4jq\":[\"Description (optional)\"],\"GCWCCo\":[\"Close player\"],\"GDvlUT\":[\"Role\"],\"GLukaH\":[\"Moderator\"],\"GNSsCc\":[\"Failed to create playlist\"],\"GQ38dl\":[\"Chat (\",[\"unreadChatCount\"],\" unread)\"],\"GY6uSc\":[\"Next →\"],\"GbqhrN\":[[\"0\"],\"–\",[\"1\"],\" characters: letters, numbers, or underscores\"],\"GptGxg\":[\"Change password\"],\"Gv5nA5\":[\"Unexpected response format\"],\"H4MGkI\":[\"Expand player\"],\"H4o4sk\":[\"No one yet.\"],\"H8pzW-\":[\"Failed to update avatar\"],\"HTLDA4\":[\"Loading more…\"],\"H_PnT8\":[\"Insert emoji\"],\"I-x669\":[\"Invitees\"],\"IF7RiR\":[\"Cover\"],\"IO9KL_\":[\"Next track\"],\"IZX7TO\":[\"Failed to generate invite\"],\"IagCbF\":[\"URL\"],\"IgrLD_\":[\"Pause\"],\"IhK90M\":[\"Letters, numbers and underscores only\"],\"ImOQa9\":[\"Reply\"],\"JJ-Bhk\":[\"Your email address\"],\"JLasL-\":[\"Couldn't unsubscribe\"],\"JRQitQ\":[\"Confirm new password\"],\"JXr41k\":[\"<0>\",[\"0\"],\" commented on <1>\",[\"1\"],\"\"],\"Jd58Fo\":[\"Hot\"],\"Jf0PuK\":[\"Go to login\"],\"JlFcis\":[\"Send\"],\"K7tIrx\":[\"Category\"],\"KDGWg5\":[\"Remove from playlist\"],\"KDw4GX\":[\"Try again\"],\"KKZxBU\":[\"Uploading \",[\"0\"],\"%\"],\"K_F6pa\":[\"Saving…\"],\"KtYF-t\":[\"Sounds\"],\"L-rMC9\":[\"Reset to default\"],\"L7_rsx\":[\"Uploading image…\"],\"MHrjPM\":[\"Title\"],\"MKEPCY\":[\"Follow\"],\"MTb2Ot\":[\"No messages yet. Say hello!\"],\"Mj6oCJ\":[[\"0\"],\" is typing…\"],\"N40H-G\":[\"All\"],\"N6j2JH\":[\"Edit \",[\"0\"]],\"NUrY9o\":[\"Categories\"],\"Nu4oKW\":[\"Description\"],\"O32mmL\":[\"Edit description\"],\"O3oNi5\":[\"Email\"],\"Oprv1v\":[\"Password (min. \",[\"0\"],\" characters)\"],\"P5MuiB\":[\"Add image\"],\"PJTy3N\":[[\"totalUnread\",\"plural\",{\"one\":[\"#\",\" new\"],\"other\":[\"#\",\" new\"]}]],\"PN3pBl\":[\"No reply from the server — this message may not have been sent\"],\"PUe8Yk\":[\"Collapse player\"],\"PiH3UR\":[\"Copied!\"],\"Pn2B7_\":[\"Current password\"],\"Pwqkdw\":[\"Loading…\"],\"Q4WUjR\":[\"Search emoji…\"],\"Q6n4F4\":[\"Refresh metadata\"],\"QGaQRo\":[\"Failed to update role\"],\"QKsaQr\":[\"or <0>browse files\"],\"QLtPBd\":[\"No dumps in this playlist yet.\"],\"QctOgc\":[\"Could not connect to the server. Check your connection and try again.\"],\"R7SsBE\":[\"Mute\"],\"R9Khdg\":[\"Auto\"],\"RCcPrX\":[\"Delete this playlist? This cannot be undone.\"],\"RTksSy\":[\"<0>\",[\"0\"],\" started following you\"],\"RaKjrM\":[\"Failed to save edit\"],\"RcUHRT\":[\"Followed\"],\"RfwZxd\":[\"Reset password\"],\"Rrp6-J\":[\"Log in to like\"],\"RvVJBH\":[\"Refreshing stream…\"],\"S1xV5B\":[\"At most \",[\"maxLength\"],\" characters.\"],\"SBTElJ\":[\"Searching…\"],\"SMaFdc\":[\"Unsubscribe\"],\"Sad2tK\":[\"Sending…\"],\"So7gCD\":[\"Paste a link…\"],\"StovX6\":[\"This page does not exist.\"],\"Sxm8rQ\":[\"Users\"],\"T8ejtZ\":[\"This comment couldn't be deleted. Try again.\"],\"T91vKp\":[\"Play\"],\"T9bjWt\":[\"<0>\",[\"0\"],\" was added to <1>\",[\"1\"],\"\"],\"TAtbho\":[\"Loading messages…\"],\"TN382O\":[\"Invalid link\"],\"Tv9vbB\":[\"Follow playlist\"],\"Tz0i8g\":[\"Settings\"],\"U3pytU\":[\"Admin\"],\"UNMVei\":[\"Forgot password?\"],\"UOZith\":[\"Failed to post\"],\"URAieT\":[\"Log in to vote\"],\"V38P77\":[\"Only its poster or a moderator can edit this dump.\"],\"VCoEm-\":[\"Back to login\"],\"VKsaTi\":[\"Replying to\"],\"VLAd8f\":[\"Max \",[\"limit\"]],\"V_e7nf\":[\"Set new password\"],\"VnNJbN\":[\"From playlists\"],\"VskHIx\":[\"Delete category\"],\"VyTYmS\":[\"Change avatar\"],\"W5A0Ly\":[\"An unexpected error occurred.\"],\"W9FRBT\":[\"Like\"],\"WAcnnR\":[\"The image couldn't be uploaded.\"],\"WE_r9K\":[\"Failed to create category\"],\"WfffrI\":[\"slug\"],\"WhimMi\":[\"Reset failed\"],\"WpXcBJ\":[\"Nothing here yet.\"],\"XHqhoS\":[\"Couldn't load the chat.\"],\"XJVYo8\":[\"Why & where\"],\"XJy2oN\":[\"Logging in…\"],\"Xan6QP\":[\"New dump\"],\"XgRtUf\":[\"Could not change password\"],\"XnL-Eu\":[\"No users match \\\"\",[\"q\"],\"\\\".\"],\"Xs2Lez\":[\"This reset link is missing or malformed.\"],\"YK1Dhc\":[\"a post\"],\"YWnSuq\":[\"This unsubscribe link is missing or malformed.\"],\"YZxXK8\":[\"Close emoji picker\"],\"YcjhhX\":[\"User management\"],\"Ye9RMF\":[\"<0>\",[\"0\"],\" liked your comment on <1>\",[\"1\"],\"\"],\"YpkCca\":[\"No followed playlists yet.\"],\"Z5HWHd\":[\"On\"],\"ZBdbv9\":[\"Edit title\"],\"ZCpU0u\":[\"No playlists match \\\"\",[\"q\"],\"\\\".\"],\"ZWxjuD\":[\"Some images couldn't be uploaded.\"],\"ZmD2o6\":[\"Create & Add\"],\"_3O5R_\":[\"Request failed\"],\"_DwR-n\":[\"Creating…\"],\"_I1_HN\":[\"Lowercase letters, numbers and single hyphens only\"],\"_R_sGB\":[\"Password changed successfully.\"],\"_aept4\":[\"Post reply\"],\"_cF7Rs\":[\"Volume\"],\"_karOe\":[\"You're offline — not sent\"],\"_nT6AE\":[\"New password\"],\"_t4W-i\":[\"From people\"],\"aAIQg2\":[\"Appearance\"],\"aDvLhk\":[\"Add a comment…\"],\"az8lvo\":[\"Off\"],\"b3Thhd\":[\"Upload failed\"],\"b8XMJ8\":[[\"visibleCount\",\"plural\",{\"one\":[\"#\",\" comment\"],\"other\":[\"#\",\" comments\"]}]],\"bQhwn-\":[\"Loading playlist…\"],\"b_1P1D\":[\"Renaming…\"],\"bzSI52\":[\"Discard\"],\"cILfnJ\":[\"Remove file\"],\"cNu4my\":[[\"0\"],\" more online: \",[\"restNames\"]],\"cYP9Sb\":[\"+ Playlist\"],\"cbeBbZ\":[\"At least \",[\"0\"],\" characters\"],\"cnGeoo\":[\"Delete\"],\"dAs22m\":[\"Replace file\"],\"dEgA5A\":[\"Cancel\"],\"dMizp8\":[\"New playlist\"],\"dau1Pl\":[[\"unseenCount\"],\" new messages\"],\"digest.community\":[\"Community\"],\"digest.count.comments\":[[\"n\",\"plural\",{\"one\":[\"comment\"],\"other\":[\"comments\"]}]],\"digest.count.upvotes\":[[\"n\",\"plural\",{\"one\":[\"upvote\"],\"other\":[\"upvotes\"]}]],\"digest.invitedBy\":[\"invited by @\",[\"username\"]],\"digest.invitedByYou\":[\"invited by you\"],\"digest.monthly\":[\"Monthly recap\"],\"digest.monthly.off\":[\"Turn off monthly recaps\"],\"digest.newMembers\":[\"New members\"],\"digest.newPlaylists\":[\"New public playlists\"],\"digest.stat.chat\":[[\"n\",\"plural\",{\"one\":[\"chat message\"],\"other\":[\"chat messages\"]}]],\"digest.stat.dumps\":[[\"n\",\"plural\",{\"one\":[\"dump\"],\"other\":[\"dumps\"]}]],\"digest.topMonth\":[\"Top this month\"],\"digest.topWeek\":[\"Top this week\"],\"digest.weekly\":[\"Weekly digest\"],\"digest.weekly.off\":[\"Turn off weekly digests\"],\"dqwCfR\":[\"Couldn't load a preview for this link — check it, or post it as-is and refresh the preview later.\"],\"dznB-Y\":[\"Only images can be dropped here.\"],\"eFSqvc\":[\"Failed to post reply\"],\"eIEHHV\":[\"Change skin tone\"],\"eOfXq3\":[\"Title is required.\"],\"ePK91l\":[\"Edit\"],\"eaUTwS\":[\"Send reset link\"],\"ecUA8p\":[\"Today\"],\"ef9nPf\":[\"Loading dump…\"],\"eloqXQ\":[\"You can post it anyway.\"],\"email.digest.addedTo\":[\"added to \",[\"playlist\"]],\"email.digest.andMore\":[\"and \",[\"n\"],\" more\"],\"email.digest.by\":[\"by @\",[\"username\"]],\"email.digest.chatWeek\":[[\"n\",\"plural\",{\"one\":[\"#\",\" message this week\"],\"other\":[\"#\",\" messages this week\"]}]],\"email.digest.communityPage\":[\"See it all on the community page\"],\"email.digest.count.followers\":[[\"n\",\"plural\",{\"one\":[\"new follower\"],\"other\":[\"new followers\"]}]],\"email.digest.count.likes\":[[\"n\",\"plural\",{\"one\":[\"comment like\"],\"other\":[\"comment likes\"]}]],\"email.digest.count.mentions\":[[\"n\",\"plural\",{\"one\":[\"mention\"],\"other\":[\"mentions\"]}]],\"email.digest.count.playlistFollows\":[[\"n\",\"plural\",{\"one\":[\"playlist follow\"],\"other\":[\"playlist follows\"]}]],\"email.digest.forYou\":[\"For you\"],\"email.digest.hl.comment\":[[\"who\"],\" commented on your dump \",[\"target\"]],\"email.digest.hl.commentLike\":[[\"who\"],\" liked your comment on \",[\"target\"]],\"email.digest.hl.mentionComment\":[[\"who\"],\" mentioned you in a comment on \",[\"target\"]],\"email.digest.hl.mentionEveryone\":[[\"who\"],\" mentioned everyone in \",[\"target\"]],\"email.digest.hl.mentionIn\":[[\"who\"],\" mentioned you in \",[\"target\"]],\"email.digest.hl.mentionPlaylist\":[[\"who\"],\" mentioned you in the playlist \",[\"target\"]],\"email.digest.hl.playlistFollow\":[[\"who\"],\" followed your playlist \",[\"target\"]],\"email.digest.hl.userFollow\":[[\"who\"],\" started following you\"],\"email.digest.inChat\":[\"In the chat\"],\"email.digest.monthly.reason\":[\"You're getting the monthly recap because it's on in your settings.\"],\"email.digest.monthly.subject\":[\"The month on \",[\"site\"],\", \",[\"range\"]],\"email.digest.monthly.title\":[\"The month on \",[\"site\"]],\"email.digest.more\":[[\"n\"],\" more on your Followed feed\"],\"email.digest.network\":[\"From people you follow\"],\"email.digest.openChat\":[\"Open the chat\"],\"email.digest.playlistMeta\":[\"by @\",[\"username\"],\" · \",[\"n\",\"plural\",{\"one\":[\"#\",\" dump\"],\"other\":[\"#\",\" dumps\"]}]],\"email.digest.pre.members\":[[\"n\",\"plural\",{\"one\":[\"#\",\" new member\"],\"other\":[\"#\",\" new members\"]}]],\"email.digest.pre.network\":[[\"n\",\"plural\",{\"one\":[\"#\",\" new dump from people you follow\"],\"other\":[\"#\",\" new dumps from people you follow\"]}]],\"email.digest.pre.playlists\":[[\"n\",\"plural\",{\"one\":[\"#\",\" new playlist\"],\"other\":[\"#\",\" new playlists\"]}]],\"email.digest.pre.topMonth\":[[\"n\",\"plural\",{\"one\":[\"the most upvoted dump of the month\"],\"other\":[\"the \",\"#\",\" most upvoted dumps of the month\"]}]],\"email.digest.pre.topWeek\":[[\"n\",\"plural\",{\"one\":[\"the most upvoted dump of the week\"],\"other\":[\"the \",\"#\",\" most upvoted dumps of the week\"]}]],\"email.digest.seeAll\":[[\"n\",\"plural\",{\"one\":[\"See the notification\"],\"other\":[\"See all \",\"#\",\" notifications\"]}]],\"email.digest.theChat\":[\"the chat\"],\"email.digest.totals\":[[\"dumps\",\"plural\",{\"one\":[\"#\",\" dump\"],\"other\":[\"#\",\" dumps\"]}],\", \",[\"upvotes\",\"plural\",{\"one\":[\"#\",\" upvote\"],\"other\":[\"#\",\" upvotes\"]}],\" and \",[\"comments\",\"plural\",{\"one\":[\"#\",\" comment\"],\"other\":[\"#\",\" comments\"]}],\".\"],\"email.digest.upload\":[\"upload\"],\"email.digest.weekly.reason\":[\"You're getting the weekly digest because it's on in your settings.\"],\"email.digest.weekly.subject\":[\"Your week on \",[\"site\"],\", \",[\"range\"]],\"email.digest.weekly.title\":[\"Your week, \",[\"username\"]],\"email.digest.yours\":[\"yours\"],\"email.reset.body\":[\"Someone asked to reset the password of your \",[\"site\"],\" account. The button below lets you choose a new one. It works once, for \",[\"hours\",\"plural\",{\"one\":[\"#\",\" hour\"],\"other\":[\"#\",\" hours\"]}],\".\"],\"email.reset.button\":[\"Reset password\"],\"email.reset.fallback\":[\"If the button doesn't work, paste this link into your browser:\"],\"email.reset.hi\":[\"Hi \",[\"username\"],\",\"],\"email.reset.ignore\":[\"If you didn't ask for this, ignore this email. Your password stays the same.\"],\"email.reset.preheader\":[\"The link works once, for \",[\"hours\",\"plural\",{\"one\":[\"#\",\" hour\"],\"other\":[\"#\",\" hours\"]}],\".\"],\"email.reset.reason\":[\"You're getting this email because a password reset was requested for this address.\"],\"email.reset.subject\":[\"Reset your \",[\"site\"],\" password\"],\"email.reset.title\":[\"Reset your password\"],\"email.settings\":[\"Settings\"],\"email.welcome.body\":[\"# Welcome to \",[\"site\"],\"!\\n\\nHi **\",[\"username\"],\"**,\\n\\nYour account has been created successfully. Welcome aboard!\"],\"email.welcome.button\":[\"Open \",[\"site\"]],\"email.welcome.digests\":[\"Once a week you'll get a digest of what happened here, and once a month a recap of the most upvoted dumps. You can turn either off in your settings.\"],\"email.welcome.preheader\":[\"Your account is ready.\"],\"email.welcome.reason\":[\"You're getting this email because an account was created on \",[\"site\"],\" with this address.\"],\"email.welcome.subject\":[\"Welcome to \",[\"site\"]],\"en9o7K\":[\"Failed to post comment\"],\"etFQQS\":[\"What makes it worth it?\"],\"f3cEDO\":[\"Change image\"],\"fC6mXb\":[\"Upvote\"],\"fI-mNw\":[\"Playlists\"],\"fgLNSM\":[\"Register\"],\"gANddk\":[\"Uploading…\"],\"gGx5tM\":[\"Editing\"],\"gIQQwD\":[\"Failed to load\"],\"gIpLuy\":[\"A link is required\"],\"gL9KKi\":[\"Who can see it\"],\"gLfZlz\":[\"Add to playlist\"],\"gjJ-sb\":[\"Can't connect to the live updates server. Upvotes and notifications may not sync until it reconnects.\"],\"goWEhR\":[\"Previous track\"],\"hBuUKa\":[\"Change password…\"],\"hD7w09\":[\"You've reached the end.\"],\"hJSliC\":[\"<0>\",[\"0\"],\" posted <1>\",[\"1\"],\"\"],\"hT8hgO\":[\"Reset to the suggested title\"],\"hYgDIe\":[\"Create\"],\"he3ygx\":[\"Copy\"],\"hpCc_Z\":[\"Close anyway\"],\"i7K_Te\":[\"Who am I?\"],\"iDNBZe\":[\"Notifications\"],\"iWpEwy\":[\"Go home\"],\"ipYn7W\":[\"If that address is registered you'll receive a reset link shortly.\"],\"isRobC\":[\"New\"],\"jTGs8A\":[\"This site doesn't send email, so no digest goes out.\"],\"jbernk\":[\"Loading profile…\"],\"jnrIbz\":[\"Upvoted (\",[\"0\"],\")\"],\"joEmfT\":[\"Server unreachable\"],\"jrZTZl\":[\"No dumps yet. Be the first!\"],\"k112DD\":[\"Load older messages\"],\"k36iJ-\":[\"Failed to save category\"],\"k4b5_X\":[\"edited\"],\"kLttbL\":[\"Registration failed\"],\"lUanmi\":[\"You'll be notified when someone follows your playlists, upvotes your dumps, or posts new content.\"],\"lY5h1V\":[[\"0\",\"plural\",{\"one\":[\"#\",\" dump\"],\"other\":[\"#\",\" dumps\"]}]],\"lcfvr_\":[\"Delete this comment?\"],\"lpIMne\":[\"Passwords do not match\"],\"mDJo8W\":[\"Dumps (\",[\"0\"],\")\"],\"mb_Wju\":[\"Drop a file here, or paste one\"],\"mt6O6E\":[\"This is a mirage.\"],\"nbm5sI\":[\"No dumps match \\\"\",[\"q\"],\"\\\".\"],\"nrjqON\":[\"Checking invite…\"],\"nucyoV\":[\"<0>\",[\"0\"],\" mentioned everyone in <1>\",[\"where\"],\"\"],\"nwtY4N\":[\"Something went wrong\"],\"nx4kaN\":[\"Could not save\"],\"oTYvvN\":[[\"0\",\"plural\",{\"one\":[\"and \",\"#\",\" earlier dump\"],\"other\":[\"and \",\"#\",\" earlier dumps\"]}]],\"oW3yYY\":[\"This month\"],\"ogtYkT\":[\"Password updated\"],\"pCpd9p\":[\"<0>\",[\"0\"],\" mentioned you in <1>\",[\"where\"],\"\"],\"pSheLH\":[\"No invitees yet.\"],\"pd3FCq\":[\"That file is over \",[\"limit\"],\".\"],\"pvnfJD\":[\"Dark\"],\"qIMfNQ\":[\"Delete playlist\"],\"qItrqH\":[\"You won't get the monthly recap any more. You can turn it back on in your settings.\"],\"qbDAcy\":[\"Dump it\"],\"qgx_78\":[\"Follow some public playlists to see their dumps here.\"],\"qnUJBI\":[\"The new order couldn't be saved. Try again.\"],\"qsqt0w\":[\"Invite link\"],\"qvFa8r\":[\"public\"],\"qvz_Pp\":[\"Dump\"],\"rCbqPX\":[\"This invite link is missing, expired, or already used.\"],\"rDMzDU\":[\"Type a message…\"],\"rg9pXu\":[\"Search failed\"],\"rn6SBY\":[\"Unmute\"],\"sEXJPi\":[\"Link or file\"],\"sGeXL3\":[\"Thumbnail\"],\"sQia9P\":[\"Log in\"],\"sTiqbm\":[\"invited by\"],\"sdP5Aa\":[\"[deleted]\"],\"sgX7B-\":[\"Single use, valid for 7 days.\"],\"shHs8T\":[\"Enter a query to search.\"],\"smeBfS\":[\"Invalid invite\"],\"teaneZ\":[\"image\"],\"tfDRzk\":[\"Save\"],\"tvmuQ0\":[\"Color scheme\"],\"tyiiHe\":[\"Nothing happened this month.\"],\"u1lDX2\":[\"Fetching preview…\"],\"uD0qXQ\":[\"Drop a file here\"],\"uISnsY\":[\"Could not delete\"],\"uMGUnV\":[\"No playlists yet.\"],\"ub1EEL\":[\"edited \",[\"0\"]],\"uomLas\":[\"Add category\"],\"v-Wp--\":[\"Open source\"],\"vJBF1r\":[\"Posting…\"],\"vLhLLO\":[\"Notifications (\",[\"unreadNotificationCount\"],\" unread)\"],\"vQMkHu\":[\"Remove vote\"],\"vuosjb\":[\"User menu\"],\"wckWOP\":[\"Manage\"],\"wixIgH\":[\"Already have an account? <0>Log in\"],\"wtxFp4\":[\"File too large (max \",[\"max\"],\").\"],\"x6tjuK\":[\"Default tab\"],\"xEWkgZ\":[\"← Back to all dumps\"],\"xPHtx0\":[\"Submit search\"],\"xVuNgt\":[\"+ New playlist\"],\"xc9O_u\":[\"Delete dump\"],\"y1G_DI\":[\"Could not rename\"],\"y6sq5j\":[\"Following\"],\"yA_6BX\":[\"View all →\"],\"yBBtRm\":[\"Follow some users to see their dumps here.\"],\"yByRxz\":[\"This week\"],\"yQ2kGp\":[\"Load more\"],\"y_0uwd\":[\"Yesterday\"],\"yxlcv5\":[\"Turn off the monthly recap?\"],\"yz7wBu\":[\"Close\"],\"yzF66j\":[\"Link\"],\"z0ROB3\":[\"Remove like\"],\"z1uNN0\":[\"No emoji found.\"],\"zVuxvN\":[\"Refreshing…\"],\"zwBp5t\":[\"Private\"]}"); \ No newline at end of file +/*eslint-disable*/export const messages=JSON.parse("{\"-K0AvT\":[\"Disconnect\"],\"-K9EZb\":[\"Add email…\"],\"-Ya-b9\":[\"Failed to save\"],\"-iDCtG\":[\"Your settings\"],\"-siMqD\":[\"Journal\"],\"1CalO6\":[\"Style\"],\"1HfJWf\":[\"Search dumps, users, playlists…\"],\"1QfxQT\":[\"Dismiss\"],\"1YKhJ3\":[\"1 new message\"],\"1njn7W\":[\"Light\"],\"1utXA6\":[\"Dumps\"],\"26iNma\":[\"Post comment\"],\"2DoBvq\":[\"Feeds\"],\"2Hlmdt\":[\"Write a reply…\"],\"2_DHgA\":[\"URL slug\"],\"2nrsEn\":[\"deleted message\"],\"2rwzb1\":[\"You haven't signed in to another gerbeur with this account yet.\"],\"2wxgft\":[\"Rename\"],\"2ygf_L\":[\"← Back\"],\"32TndD\":[\"Blocked\"],\"3KKSM4\":[\"private\"],\"3QuNUr\":[\"Several people are typing…\"],\"3SEwY1\":[\"Delete category \\\"\",[\"0\"],\"\\\"? This cannot be undone.\"],\"3qkggm\":[\"Fullscreen\"],\"3yfh3D\":[\"<0>\",[\"0\"],\" followed your playlist <1>\",[\"1\"],\"\"],\"48e2R8\":[\"Edit email\"],\"49voTZ\":[[\"label\"],\" (\",[\"count\"],\")\"],\"4B6w_o\":[\"Dumped!\"],\"4GKuCs\":[\"Login failed\"],\"4HH9iB\":[\"Not following anyone yet.\"],\"4OjqAQ\":[\"Keep editing\"],\"4RtQ1k\":[\"Unfollow \",[\"targetUsername\"]],\"4c-qBx\":[\"Your password has been changed. You can now log in.\"],\"4yj9xV\":[\"Live updates are temporarily disconnected. Trying to reconnect…\"],\"5KHDCi\":[[\"0\"],\" and \",[\"1\"],\" are typing…\"],\"5NZ3tg\":[\"Turning off…\"],\"5TviPn\":[\"Cancel search\"],\"5cC8f2\":[\"Edited \",[\"0\"]],\"5oD9f_\":[\"Earlier\"],\"6C4kKS\":[\"Other instances\"],\"6Qly-0\":[\"a comment\"],\"6YE0P6\":[\"Editing \",[\"0\"]],\"6YtxFj\":[\"Name\"],\"6_dCYd\":[\"Overview\"],\"6gRgw8\":[\"Retry\"],\"7PHCIN\":[\"Cancel removal\"],\"7PzzBU\":[\"User\"],\"7d1a0d\":[\"Public\"],\"7noMWp\":[\"Nothing happened this week.\"],\"7sNhEz\":[\"Username\"],\"8-8abB\":[\"Disconnected — reconnecting…\"],\"8F1i42\":[\"Page not found\"],\"8JplJJ\":[\"Unsubscribed\"],\"8Ug9jB\":[\"Related\"],\"8ZsakT\":[\"Password\"],\"8rPWOT\":[\"Can't sign in there\"],\"92o1-U\":[\"Failed to delete\"],\"9BruTc\":[\"Why?\"],\"9eEYEq\":[\"This sign-in link is incomplete.\"],\"9l4qcT\":[\"Drop a replacement here\"],\"9uI_rE\":[\"Undo\"],\"A0y396\":[\"+ Invite someone\"],\"A1taO8\":[\"Search\"],\"AEfu-D\":[\"In collections\"],\"AHZflp\":[\"Chat\"],\"AQbgNR\":[\"Follow \",[\"targetUsername\"]],\"AS7WoE\":[\"Start fresh\"],\"ATGYL1\":[\"Email address\"],\"AZctoV\":[[\"0\",\"plural\",{\"one\":[\"#\",\" comment\"],\"other\":[\"#\",\" comments\"]}]],\"Ade-6d\":[\"Live updates unavailable.\"],\"AeXO77\":[\"Account\"],\"AhNP40\":[\"Seek\"],\"AnRu_j\":[\"Cancel reply\"],\"AwUsnG\":[\"Instances\"],\"B4LeYP\":[\"Delete failed (\",[\"0\"],\")\"],\"BjitBo\":[\"Download \",[\"0\"]],\"BlpJ2G\":[\"Picked up where you left off.\"],\"CI50ct\":[\"Upvoted\"],\"CJkEfx\":[\"Block\"],\"C_qQE4\":[\"Already dumped by \",[\"0\"],\" \",[\"1\"]],\"Cf_gxi\":[\"Turn off the weekly digest?\"],\"Cj24wt\":[\"Registering…\"],\"CnqayG\":[\"Couldn't update. Try again.\"],\"D8DRYV\":[\"Delete this message?\"],\"DI3NBO\":[\"Open on \",[\"0\"]],\"DPfwMq\":[\"Done\"],\"DdeHXH\":[\"Delete this dump? This cannot be undone.\"],\"Dp1JhP\":[\"<0>\",[\"0\"],\" upvoted <1>\",[\"1\"],\"\"],\"E417RG\":[\"You won't get the weekly digest any more. You can turn it back on in your settings.\"],\"EBU6O6\":[\"Connection lost — this message may not have been sent\"],\"ECiS12\":[\"View dump →\"],\"ED8n0z\":[\"the chat\"],\"EarrCe\":[\"Search emoji\"],\"Evcm2Z\":[\"Close without posting? The attached file won't be kept — everything you typed will.\"],\"EwVrWF\":[\"The dump couldn't be removed. Try again.\"],\"ExR0Fr\":[\"URL is required.\"],\"F5Js1v\":[\"Unfollow playlist\"],\"FdTlEG\":[\"Track \",[\"0\"]],\"FgAxTj\":[\"Log out\"],\"Fxf4jq\":[\"Description (optional)\"],\"GCWCCo\":[\"Close player\"],\"GDvlUT\":[\"Role\"],\"GLukaH\":[\"Moderator\"],\"GNSsCc\":[\"Failed to create playlist\"],\"GQ38dl\":[\"Chat (\",[\"unreadChatCount\"],\" unread)\"],\"GY6uSc\":[\"Next →\"],\"GbqhrN\":[[\"0\"],\"–\",[\"1\"],\" characters: letters, numbers, or underscores\"],\"GptGxg\":[\"Change password\"],\"Gv5nA5\":[\"Unexpected response format\"],\"H4MGkI\":[\"Expand player\"],\"H4o4sk\":[\"No one yet.\"],\"H8pzW-\":[\"Failed to update avatar\"],\"HTLDA4\":[\"Loading more…\"],\"H_PnT8\":[\"Insert emoji\"],\"I-x669\":[\"Invitees\"],\"IF7RiR\":[\"Cover\"],\"IO9KL_\":[\"Next track\"],\"IZX7TO\":[\"Failed to generate invite\"],\"IagCbF\":[\"URL\"],\"IgrLD_\":[\"Pause\"],\"IhK90M\":[\"Letters, numbers and underscores only\"],\"ImOQa9\":[\"Reply\"],\"JJ-Bhk\":[\"Your email address\"],\"JLasL-\":[\"Couldn't unsubscribe\"],\"JRQitQ\":[\"Confirm new password\"],\"JXr41k\":[\"<0>\",[\"0\"],\" commented on <1>\",[\"1\"],\"\"],\"Jd58Fo\":[\"Hot\"],\"Jf0PuK\":[\"Go to login\"],\"JlFcis\":[\"Send\"],\"JrFTcr\":[\"Connecting…\"],\"K7tIrx\":[\"Category\"],\"KDGWg5\":[\"Remove from playlist\"],\"KDw4GX\":[\"Try again\"],\"KKZxBU\":[\"Uploading \",[\"0\"],\"%\"],\"K_F6pa\":[\"Saving…\"],\"KtYF-t\":[\"Sounds\"],\"L-rMC9\":[\"Reset to default\"],\"L7_rsx\":[\"Uploading image…\"],\"MHrjPM\":[\"Title\"],\"MKEPCY\":[\"Follow\"],\"MTb2Ot\":[\"No messages yet. Say hello!\"],\"MbkoRn\":[\"Or join with your account on another gerbeur\"],\"Mj6oCJ\":[[\"0\"],\" is typing…\"],\"MrIc3x\":[\"Or log in with your account on another gerbeur\"],\"N40H-G\":[\"All\"],\"N6j2JH\":[\"Edit \",[\"0\"]],\"NUrY9o\":[\"Categories\"],\"Nu4oKW\":[\"Description\"],\"O32mmL\":[\"Edit description\"],\"O3oNi5\":[\"Email\"],\"Oprv1v\":[\"Password (min. \",[\"0\"],\" characters)\"],\"P5MuiB\":[\"Add image\"],\"PJTy3N\":[[\"totalUnread\",\"plural\",{\"one\":[\"#\",\" new\"],\"other\":[\"#\",\" new\"]}]],\"PN3pBl\":[\"No reply from the server — this message may not have been sent\"],\"PUe8Yk\":[\"Collapse player\"],\"PiH3UR\":[\"Copied!\"],\"Pn2B7_\":[\"Current password\"],\"Pwqkdw\":[\"Loading…\"],\"Q4WUjR\":[\"Search emoji…\"],\"Q6n4F4\":[\"Refresh metadata\"],\"QGaQRo\":[\"Failed to update role\"],\"QKsaQr\":[\"or <0>browse files\"],\"QLtPBd\":[\"No dumps in this playlist yet.\"],\"QctOgc\":[\"Could not connect to the server. Check your connection and try again.\"],\"R7SsBE\":[\"Mute\"],\"R9Khdg\":[\"Auto\"],\"RCcPrX\":[\"Delete this playlist? This cannot be undone.\"],\"RLe7Vk\":[\"Checking…\"],\"RTksSy\":[\"<0>\",[\"0\"],\" started following you\"],\"RaKjrM\":[\"Failed to save edit\"],\"RcUHRT\":[\"Followed\"],\"RfwZxd\":[\"Reset password\"],\"Rrp6-J\":[\"Log in to like\"],\"RvVJBH\":[\"Refreshing stream…\"],\"S1xV5B\":[\"At most \",[\"maxLength\"],\" characters.\"],\"SBTElJ\":[\"Searching…\"],\"SLaP1b\":[\"Not from here\"],\"SMaFdc\":[\"Unsubscribe\"],\"Sad2tK\":[\"Sending…\"],\"So7gCD\":[\"Paste a link…\"],\"StovX6\":[\"This page does not exist.\"],\"Sxm8rQ\":[\"Users\"],\"T8ejtZ\":[\"This comment couldn't be deleted. Try again.\"],\"T91vKp\":[\"Play\"],\"T9bjWt\":[\"<0>\",[\"0\"],\" was added to <1>\",[\"1\"],\"\"],\"TAkYGZ\":[\"Your account lives on \",[\"home\"],\": sign in to other instances from there.\"],\"TAtbho\":[\"Loading messages…\"],\"TN382O\":[\"Invalid link\"],\"ToADL_\":[\"<0>\",[\"name\"],\" (\",[\"host\"],\") asks to sign you in with your account here, <1>@\",[\"username\"],\". It will receive your username, your email address and your avatar.\"],\"Tv9vbB\":[\"Follow playlist\"],\"Tz0i8g\":[\"Settings\"],\"U3pytU\":[\"Admin\"],\"UNMVei\":[\"Forgot password?\"],\"UOV0wi\":[\"Signing you in…\"],\"UOZith\":[\"Failed to post\"],\"URAieT\":[\"Log in to vote\"],\"V38P77\":[\"Only its poster or a moderator can edit this dump.\"],\"VCoEm-\":[\"Back to login\"],\"VKsaTi\":[\"Replying to\"],\"VLAd8f\":[\"Max \",[\"limit\"]],\"V_e7nf\":[\"Set new password\"],\"VnNJbN\":[\"From playlists\"],\"VsMqsD\":[\"Its address, like music.example\"],\"VskHIx\":[\"Delete category\"],\"VyTYmS\":[\"Change avatar\"],\"W5A0Ly\":[\"An unexpected error occurred.\"],\"W9FRBT\":[\"Like\"],\"WAcnnR\":[\"The image couldn't be uploaded.\"],\"WE_r9K\":[\"Failed to create category\"],\"WMw63e\":[\"Couldn't reach that instance\"],\"WfffrI\":[\"slug\"],\"WhimMi\":[\"Reset failed\"],\"WpXcBJ\":[\"Nothing here yet.\"],\"XHqhoS\":[\"Couldn't load the chat.\"],\"XJVYo8\":[\"Why & where\"],\"XJy2oN\":[\"Logging in…\"],\"XWbTfu\":[\"last used \",[\"0\"]],\"Xan6QP\":[\"New dump\"],\"XgRtUf\":[\"Could not change password\"],\"XnL-Eu\":[\"No users match \\\"\",[\"q\"],\"\\\".\"],\"Xs2Lez\":[\"This reset link is missing or malformed.\"],\"YK1Dhc\":[\"a post\"],\"YWnSuq\":[\"This unsubscribe link is missing or malformed.\"],\"YZxXK8\":[\"Close emoji picker\"],\"YcjhhX\":[\"User management\"],\"Ye9RMF\":[\"<0>\",[\"0\"],\" liked your comment on <1>\",[\"1\"],\"\"],\"YpkCca\":[\"No followed playlists yet.\"],\"Z5HWHd\":[\"On\"],\"ZBdbv9\":[\"Edit title\"],\"ZCpU0u\":[\"No playlists match \\\"\",[\"q\"],\"\\\".\"],\"ZWxjuD\":[\"Some images couldn't be uploaded.\"],\"ZmD2o6\":[\"Create & Add\"],\"_0oJwI\":[\"Trust\"],\"_3O5R_\":[\"Request failed\"],\"_DwR-n\":[\"Creating…\"],\"_I1_HN\":[\"Lowercase letters, numbers and single hyphens only\"],\"_R_sGB\":[\"Password changed successfully.\"],\"_aept4\":[\"Post reply\"],\"_cF7Rs\":[\"Volume\"],\"_eZzBf\":[\"Sign in elsewhere\"],\"_karOe\":[\"You're offline — not sent\"],\"_nT6AE\":[\"New password\"],\"_t4W-i\":[\"From people\"],\"aAIQg2\":[\"Appearance\"],\"aDvLhk\":[\"Add a comment…\"],\"az8lvo\":[\"Off\"],\"b3Thhd\":[\"Upload failed\"],\"b8XMJ8\":[[\"visibleCount\",\"plural\",{\"one\":[\"#\",\" comment\"],\"other\":[\"#\",\" comments\"]}]],\"bQhwn-\":[\"Loading playlist…\"],\"b_1P1D\":[\"Renaming…\"],\"b_VouM\":[\"Your account lives on \",[\"home\"],\": your password, email address, avatar and username change there.\"],\"bzSI52\":[\"Discard\"],\"cILfnJ\":[\"Remove file\"],\"cNu4my\":[[\"0\"],\" more online: \",[\"restNames\"]],\"cYP9Sb\":[\"+ Playlist\"],\"cbeBbZ\":[\"At least \",[\"0\"],\" characters\"],\"cnGeoo\":[\"Delete\"],\"dAs22m\":[\"Replace file\"],\"dEgA5A\":[\"Cancel\"],\"dMizp8\":[\"New playlist\"],\"dau1Pl\":[[\"unseenCount\"],\" new messages\"],\"digest.community\":[\"Community\"],\"digest.count.comments\":[[\"n\",\"plural\",{\"one\":[\"comment\"],\"other\":[\"comments\"]}]],\"digest.count.upvotes\":[[\"n\",\"plural\",{\"one\":[\"upvote\"],\"other\":[\"upvotes\"]}]],\"digest.invitedBy\":[\"invited by @\",[\"username\"]],\"digest.invitedByYou\":[\"invited by you\"],\"digest.monthly\":[\"Monthly recap\"],\"digest.monthly.off\":[\"Turn off monthly recaps\"],\"digest.newMembers\":[\"New members\"],\"digest.newPlaylists\":[\"New public playlists\"],\"digest.stat.chat\":[[\"n\",\"plural\",{\"one\":[\"chat message\"],\"other\":[\"chat messages\"]}]],\"digest.stat.dumps\":[[\"n\",\"plural\",{\"one\":[\"dump\"],\"other\":[\"dumps\"]}]],\"digest.topMonth\":[\"Top this month\"],\"digest.topWeek\":[\"Top this week\"],\"digest.weekly\":[\"Weekly digest\"],\"digest.weekly.off\":[\"Turn off weekly digests\"],\"dqwCfR\":[\"Couldn't load a preview for this link — check it, or post it as-is and refresh the preview later.\"],\"dznB-Y\":[\"Only images can be dropped here.\"],\"eFSqvc\":[\"Failed to post reply\"],\"eIEHHV\":[\"Change skin tone\"],\"eOfXq3\":[\"Title is required.\"],\"ePK91l\":[\"Edit\"],\"eaUTwS\":[\"Send reset link\"],\"ecUA8p\":[\"Today\"],\"ef9nPf\":[\"Loading dump…\"],\"eloqXQ\":[\"You can post it anyway.\"],\"email.digest.addedTo\":[\"added to \",[\"playlist\"]],\"email.digest.andMore\":[\"and \",[\"n\"],\" more\"],\"email.digest.by\":[\"by @\",[\"username\"]],\"email.digest.chatWeek\":[[\"n\",\"plural\",{\"one\":[\"#\",\" message this week\"],\"other\":[\"#\",\" messages this week\"]}]],\"email.digest.communityPage\":[\"See it all on the community page\"],\"email.digest.count.followers\":[[\"n\",\"plural\",{\"one\":[\"new follower\"],\"other\":[\"new followers\"]}]],\"email.digest.count.likes\":[[\"n\",\"plural\",{\"one\":[\"comment like\"],\"other\":[\"comment likes\"]}]],\"email.digest.count.mentions\":[[\"n\",\"plural\",{\"one\":[\"mention\"],\"other\":[\"mentions\"]}]],\"email.digest.count.playlistFollows\":[[\"n\",\"plural\",{\"one\":[\"playlist follow\"],\"other\":[\"playlist follows\"]}]],\"email.digest.forYou\":[\"For you\"],\"email.digest.hl.comment\":[[\"who\"],\" commented on your dump \",[\"target\"]],\"email.digest.hl.commentLike\":[[\"who\"],\" liked your comment on \",[\"target\"]],\"email.digest.hl.mentionComment\":[[\"who\"],\" mentioned you in a comment on \",[\"target\"]],\"email.digest.hl.mentionEveryone\":[[\"who\"],\" mentioned everyone in \",[\"target\"]],\"email.digest.hl.mentionIn\":[[\"who\"],\" mentioned you in \",[\"target\"]],\"email.digest.hl.mentionPlaylist\":[[\"who\"],\" mentioned you in the playlist \",[\"target\"]],\"email.digest.hl.playlistFollow\":[[\"who\"],\" followed your playlist \",[\"target\"]],\"email.digest.hl.userFollow\":[[\"who\"],\" started following you\"],\"email.digest.inChat\":[\"In the chat\"],\"email.digest.monthly.reason\":[\"You're getting the monthly recap because it's on in your settings.\"],\"email.digest.monthly.subject\":[\"The month on \",[\"site\"],\", \",[\"range\"]],\"email.digest.monthly.title\":[\"The month on \",[\"site\"]],\"email.digest.more\":[[\"n\"],\" more on your Followed feed\"],\"email.digest.network\":[\"From people you follow\"],\"email.digest.openChat\":[\"Open the chat\"],\"email.digest.playlistMeta\":[\"by @\",[\"username\"],\" · \",[\"n\",\"plural\",{\"one\":[\"#\",\" dump\"],\"other\":[\"#\",\" dumps\"]}]],\"email.digest.pre.members\":[[\"n\",\"plural\",{\"one\":[\"#\",\" new member\"],\"other\":[\"#\",\" new members\"]}]],\"email.digest.pre.network\":[[\"n\",\"plural\",{\"one\":[\"#\",\" new dump from people you follow\"],\"other\":[\"#\",\" new dumps from people you follow\"]}]],\"email.digest.pre.playlists\":[[\"n\",\"plural\",{\"one\":[\"#\",\" new playlist\"],\"other\":[\"#\",\" new playlists\"]}]],\"email.digest.pre.topMonth\":[[\"n\",\"plural\",{\"one\":[\"the most upvoted dump of the month\"],\"other\":[\"the \",\"#\",\" most upvoted dumps of the month\"]}]],\"email.digest.pre.topWeek\":[[\"n\",\"plural\",{\"one\":[\"the most upvoted dump of the week\"],\"other\":[\"the \",\"#\",\" most upvoted dumps of the week\"]}]],\"email.digest.seeAll\":[[\"n\",\"plural\",{\"one\":[\"See the notification\"],\"other\":[\"See all \",\"#\",\" notifications\"]}]],\"email.digest.theChat\":[\"the chat\"],\"email.digest.totals\":[[\"dumps\",\"plural\",{\"one\":[\"#\",\" dump\"],\"other\":[\"#\",\" dumps\"]}],\", \",[\"upvotes\",\"plural\",{\"one\":[\"#\",\" upvote\"],\"other\":[\"#\",\" upvotes\"]}],\" and \",[\"comments\",\"plural\",{\"one\":[\"#\",\" comment\"],\"other\":[\"#\",\" comments\"]}],\".\"],\"email.digest.upload\":[\"upload\"],\"email.digest.weekly.reason\":[\"You're getting the weekly digest because it's on in your settings.\"],\"email.digest.weekly.subject\":[\"Your week on \",[\"site\"],\", \",[\"range\"]],\"email.digest.weekly.title\":[\"Your week, \",[\"username\"]],\"email.digest.yours\":[\"yours\"],\"email.reset.body\":[\"Someone asked to reset the password of your \",[\"site\"],\" account. The button below lets you choose a new one. It works once, for \",[\"hours\",\"plural\",{\"one\":[\"#\",\" hour\"],\"other\":[\"#\",\" hours\"]}],\".\"],\"email.reset.button\":[\"Reset password\"],\"email.reset.fallback\":[\"If the button doesn't work, paste this link into your browser:\"],\"email.reset.hi\":[\"Hi \",[\"username\"],\",\"],\"email.reset.ignore\":[\"If you didn't ask for this, ignore this email. Your password stays the same.\"],\"email.reset.preheader\":[\"The link works once, for \",[\"hours\",\"plural\",{\"one\":[\"#\",\" hour\"],\"other\":[\"#\",\" hours\"]}],\".\"],\"email.reset.reason\":[\"You're getting this email because a password reset was requested for this address.\"],\"email.reset.subject\":[\"Reset your \",[\"site\"],\" password\"],\"email.reset.title\":[\"Reset your password\"],\"email.settings\":[\"Settings\"],\"email.welcome.body\":[\"# Welcome to \",[\"site\"],\"!\\n\\nHi **\",[\"username\"],\"**,\\n\\nYour account has been created successfully. Welcome aboard!\"],\"email.welcome.button\":[\"Open \",[\"site\"]],\"email.welcome.digests\":[\"Once a week you'll get a digest of what happened here, and once a month a recap of the most upvoted dumps. You can turn either off in your settings.\"],\"email.welcome.preheader\":[\"Your account is ready.\"],\"email.welcome.reason\":[\"You're getting this email because an account was created on \",[\"site\"],\" with this address.\"],\"email.welcome.subject\":[\"Welcome to \",[\"site\"]],\"en9o7K\":[\"Failed to post comment\"],\"etFQQS\":[\"What makes it worth it?\"],\"f3cEDO\":[\"Change image\"],\"fC6mXb\":[\"Upvote\"],\"fI-mNw\":[\"Playlists\"],\"fgLNSM\":[\"Register\"],\"fn1ZQX\":[\"Sign in to \",[\"name\"],\"?\"],\"gANddk\":[\"Uploading…\"],\"gGx5tM\":[\"Editing\"],\"gIQQwD\":[\"Failed to load\"],\"gIpLuy\":[\"A link is required\"],\"gL9KKi\":[\"Who can see it\"],\"gLfZlz\":[\"Add to playlist\"],\"gjJ-sb\":[\"Can't connect to the live updates server. Upvotes and notifications may not sync until it reconnects.\"],\"goWEhR\":[\"Previous track\"],\"hBuUKa\":[\"Change password…\"],\"hD7w09\":[\"You've reached the end.\"],\"hJSliC\":[\"<0>\",[\"0\"],\" posted <1>\",[\"1\"],\"\"],\"hLAe-z\":[\"Back to the login page\"],\"hT8hgO\":[\"Reset to the suggested title\"],\"hYgDIe\":[\"Create\"],\"he3ygx\":[\"Copy\"],\"hpCc_Z\":[\"Close anyway\"],\"i7K_Te\":[\"Who am I?\"],\"iDNBZe\":[\"Notifications\"],\"iWpEwy\":[\"Go home\"],\"ipYn7W\":[\"If that address is registered you'll receive a reset link shortly.\"],\"isRobC\":[\"New\"],\"jTGs8A\":[\"This site doesn't send email, so no digest goes out.\"],\"jZNg18\":[\"Account on <0>\",[\"host\"],\"\"],\"jbernk\":[\"Loading profile…\"],\"jnrIbz\":[\"Upvoted (\",[\"0\"],\")\"],\"joEmfT\":[\"Server unreachable\"],\"jrZTZl\":[\"No dumps yet. Be the first!\"],\"k112DD\":[\"Load older messages\"],\"k36iJ-\":[\"Failed to save category\"],\"k4b5_X\":[\"edited\"],\"kLttbL\":[\"Registration failed\"],\"lUanmi\":[\"You'll be notified when someone follows your playlists, upvotes your dumps, or posts new content.\"],\"lY5h1V\":[[\"0\",\"plural\",{\"one\":[\"#\",\" dump\"],\"other\":[\"#\",\" dumps\"]}]],\"lcfvr_\":[\"Delete this comment?\"],\"lpIMne\":[\"Passwords do not match\"],\"m9Uf3I\":[\"Users of a trusted instance sign in here with their account there. Those of a blocked one can't. Users of any other instance need an invite.\"],\"mDJo8W\":[\"Dumps (\",[\"0\"],\")\"],\"mb_Wju\":[\"Drop a file here, or paste one\"],\"mt6O6E\":[\"This is a mirage.\"],\"nbm5sI\":[\"No dumps match \\\"\",[\"q\"],\"\\\".\"],\"nrjqON\":[\"Checking invite…\"],\"nucyoV\":[\"<0>\",[\"0\"],\" mentioned everyone in <1>\",[\"where\"],\"\"],\"nwtY4N\":[\"Something went wrong\"],\"nx4kaN\":[\"Could not save\"],\"oTYvvN\":[[\"0\",\"plural\",{\"one\":[\"and \",\"#\",\" earlier dump\"],\"other\":[\"and \",\"#\",\" earlier dumps\"]}]],\"oW3yYY\":[\"This month\"],\"ogtYkT\":[\"Password updated\"],\"pCpd9p\":[\"<0>\",[\"0\"],\" mentioned you in <1>\",[\"where\"],\"\"],\"pSheLH\":[\"No invitees yet.\"],\"pd3FCq\":[\"That file is over \",[\"limit\"],\".\"],\"pvnfJD\":[\"Dark\"],\"q018gJ\":[\"Couldn't add that instance\"],\"qIMfNQ\":[\"Delete playlist\"],\"qItrqH\":[\"You won't get the monthly recap any more. You can turn it back on in your settings.\"],\"qVdjD5\":[\"Trusted\"],\"qbDAcy\":[\"Dump it\"],\"qgx_78\":[\"Follow some public playlists to see their dumps here.\"],\"qnUJBI\":[\"The new order couldn't be saved. Try again.\"],\"qsqt0w\":[\"Invite link\"],\"qvFa8r\":[\"public\"],\"qvz_Pp\":[\"Dump\"],\"rCbqPX\":[\"This invite link is missing, expired, or already used.\"],\"rDMzDU\":[\"Type a message…\"],\"rg9pXu\":[\"Search failed\"],\"rn6SBY\":[\"Unmute\"],\"sEXJPi\":[\"Link or file\"],\"sGeXL3\":[\"Thumbnail\"],\"sQia9P\":[\"Log in\"],\"sTiqbm\":[\"invited by\"],\"sdP5Aa\":[\"[deleted]\"],\"sgX7B-\":[\"Single use, valid for 7 days.\"],\"shHs8T\":[\"Enter a query to search.\"],\"smeBfS\":[\"Invalid invite\"],\"tOHgQw\":[\"Continue as @\",[\"username\"]],\"teaneZ\":[\"image\"],\"tfDRzk\":[\"Save\"],\"tvmuQ0\":[\"Color scheme\"],\"tyiiHe\":[\"Nothing happened this month.\"],\"u1lDX2\":[\"Fetching preview…\"],\"u8pttd\":[\"Change it on \",[\"home\"]],\"uACFmj\":[\"Log in with \",[\"0\"]],\"uD0qXQ\":[\"Drop a file here\"],\"uISnsY\":[\"Could not delete\"],\"uMGUnV\":[\"No playlists yet.\"],\"ub1EEL\":[\"edited \",[\"0\"]],\"uomLas\":[\"Add category\"],\"v-Wp--\":[\"Open source\"],\"v6Lbin\":[\"An instance's address, like music.example\"],\"vJBF1r\":[\"Posting…\"],\"vLhLLO\":[\"Notifications (\",[\"unreadNotificationCount\"],\" unread)\"],\"vQMkHu\":[\"Remove vote\"],\"vuosjb\":[\"User menu\"],\"w61W3L\":[\"Remove \",[\"0\"]],\"wckWOP\":[\"Manage\"],\"wixIgH\":[\"Already have an account? <0>Log in\"],\"wtxFp4\":[\"File too large (max \",[\"max\"],\").\"],\"x6tjuK\":[\"Default tab\"],\"xEWkgZ\":[\"← Back to all dumps\"],\"xGVfLh\":[\"Continue\"],\"xPHtx0\":[\"Submit search\"],\"xVuNgt\":[\"+ New playlist\"],\"xc9O_u\":[\"Delete dump\"],\"y1G_DI\":[\"Could not rename\"],\"y6sq5j\":[\"Following\"],\"yA_6BX\":[\"View all →\"],\"yBBtRm\":[\"Follow some users to see their dumps here.\"],\"yByRxz\":[\"This week\"],\"yQ2kGp\":[\"Load more\"],\"y_0uwd\":[\"Yesterday\"],\"yxlcv5\":[\"Turn off the monthly recap?\"],\"yz7wBu\":[\"Close\"],\"yzF66j\":[\"Link\"],\"z0ROB3\":[\"Remove like\"],\"z1uNN0\":[\"No emoji found.\"],\"zVuxvN\":[\"Refreshing…\"],\"zwBp5t\":[\"Private\"]}"); \ No newline at end of file diff --git a/locales/en.po b/locales/en.po index cd6828b7..bd2aca54 100644 --- a/locales/en.po +++ b/locales/en.po @@ -51,7 +51,7 @@ msgstr "{0} more online: {restNames}" #. placeholder {0}: VALIDATION.USERNAME_MIN #. placeholder {1}: VALIDATION.USERNAME_MAX -#: src/pages/UserRegister.tsx:145 +#: src/pages/UserRegister.tsx:147 msgid "{0}–{1} characters: letters, numbers, or underscores" msgstr "{0}–{1} characters: letters, numbers, or underscores" @@ -280,6 +280,10 @@ msgstr "<0>{0} upvoted <1>{1}" msgid "<0>{0} was added to <1>{1}" msgstr "<0>{0} was added to <1>{1}" +#: src/pages/Authorize.tsx:138 +msgid "<0>{name} ({host}) asks to sign you in with your account here, <1>@{username}. It will receive your username, your email address and your avatar." +msgstr "<0>{name} ({host}) asks to sign you in with your account here, <1>@{username}. It will receive your username, your email address and your avatar." + #: src/components/chat/ChatModal.tsx:778 msgid "1 new message" msgstr "1 new message" @@ -296,10 +300,14 @@ msgstr "A link is required" msgid "a post" msgstr "a post" -#: src/pages/Settings.tsx:85 +#: src/pages/Settings.tsx:89 msgid "Account" msgstr "Account" +#: src/components/profile/ProfileHeader.tsx:144 +msgid "Account on <0>{host}" +msgstr "Account on <0>{host}" + #: src/components/comment/CommentThread.tsx:102 msgid "Add a comment…" msgstr "Add a comment…" @@ -309,7 +317,7 @@ msgstr "Add a comment…" msgid "Add category" msgstr "Add category" -#: src/components/profile/ProfileHeader.tsx:153 +#: src/components/profile/ProfileHeader.tsx:173 msgid "Add email…" msgstr "Add email…" @@ -342,10 +350,14 @@ msgstr "All" msgid "Already dumped by {0} {1}" msgstr "Already dumped by {0} {1}" -#: src/pages/UserRegister.tsx:175 +#: src/pages/UserRegister.tsx:179 msgid "Already have an account? <0>Log in" msgstr "Already have an account? <0>Log in" +#: src/components/federation/PeerManager.tsx:149 +msgid "An instance's address, like music.example" +msgstr "An instance's address, like music.example" + #: src/utils/shared/api.ts:35 msgid "An unexpected error occurred." msgstr "An unexpected error occurred." @@ -355,14 +367,14 @@ msgstr "An unexpected error occurred." msgid "email.digest.andMore" msgstr "and {n} more" -#: src/pages/Settings.tsx:101 +#: src/pages/Settings.tsx:134 msgid "Appearance" msgstr "Appearance" #. placeholder {0}: VALIDATION.PASSWORD_MIN #: src/components/profile/ChangePasswordModal.tsx:101 #: src/pages/ResetPassword.tsx:124 -#: src/pages/UserRegister.tsx:164 +#: src/pages/UserRegister.tsx:166 msgid "At least {0} characters" msgstr "At least {0} characters" @@ -370,7 +382,7 @@ msgstr "At least {0} characters" msgid "At most {maxLength} characters." msgstr "At most {maxLength} characters." -#: src/pages/Settings.tsx:46 +#: src/pages/Settings.tsx:48 msgid "Auto" msgstr "Auto" @@ -379,6 +391,18 @@ msgstr "Auto" msgid "Back to login" msgstr "Back to login" +#: src/pages/FederationCallback.tsx:66 +msgid "Back to the login page" +msgstr "Back to the login page" + +#: src/components/federation/PeerManager.tsx:163 +msgid "Block" +msgstr "Block" + +#: src/components/federation/PeerManager.tsx:33 +msgid "Blocked" +msgstr "Blocked" + #. js-lingui-explicit-id #: api/mail/digest.ts:225 msgid "email.digest.by" @@ -394,6 +418,11 @@ msgstr "by @{username} · {n, plural, one {# dump} other {# dumps}}" msgid "Can't connect to the live updates server. Upvotes and notifications may not sync until it reconnects." msgstr "Can't connect to the live updates server. Upvotes and notifications may not sync until it reconnects." +#: src/pages/Authorize.tsx:117 +#: src/pages/Authorize.tsx:145 +msgid "Can't sign in there" +msgstr "Can't sign in there" + #: src/components/category/CategoryManager.tsx:225 #: src/components/category/CategoryManager.tsx:226 #: src/components/chat/ChatEditBox.tsx:92 @@ -404,6 +433,7 @@ msgstr "Can't connect to the live updates server. Upvotes and notifications may #: src/components/profile/DescriptionEditor.tsx:97 #: src/components/profile/EmailEditor.tsx:83 #: src/components/shared/ConfirmModal.tsx:63 +#: src/pages/Authorize.tsx:158 #: src/pages/Dump.tsx:445 #: src/pages/DumpEdit.tsx:565 msgid "Cancel" @@ -423,7 +453,7 @@ msgid "Cancel search" msgstr "Cancel search" #: src/components/category/CategorySelect.tsx:33 -#: src/pages/Manage.tsx:30 +#: src/pages/Manage.tsx:36 msgid "Categories" msgstr "Categories" @@ -431,7 +461,7 @@ msgstr "Categories" msgid "Category" msgstr "Category" -#: src/components/profile/ProfileHeader.tsx:95 +#: src/components/profile/ProfileHeader.tsx:102 msgid "Change avatar" msgstr "Change avatar" @@ -439,12 +469,16 @@ msgstr "Change avatar" msgid "Change image" msgstr "Change image" +#: src/pages/Settings.tsx:101 +msgid "Change it on {home}" +msgstr "Change it on {home}" + #: src/components/profile/ChangePasswordModal.tsx:66 #: src/components/profile/ChangePasswordModal.tsx:120 msgid "Change password" msgstr "Change password" -#: src/pages/Settings.tsx:96 +#: src/pages/Settings.tsx:112 msgid "Change password…" msgstr "Change password…" @@ -464,10 +498,14 @@ msgstr "Chat" msgid "Chat ({unreadChatCount} unread)" msgstr "Chat ({unreadChatCount} unread)" -#: src/pages/UserRegister.tsx:106 +#: src/pages/UserRegister.tsx:108 msgid "Checking invite…" msgstr "Checking invite…" +#: src/components/federation/PeerManager.tsx:154 +msgid "Checking…" +msgstr "Checking…" + #: src/components/profile/ChangePasswordModal.tsx:75 #: src/components/shared/Modal.tsx:76 msgid "Close" @@ -493,7 +531,7 @@ msgstr "Close without posting? The attached file won't be kept — everything yo msgid "Collapse player" msgstr "Collapse player" -#: src/pages/Settings.tsx:110 +#: src/pages/Settings.tsx:143 msgid "Color scheme" msgstr "Color scheme" @@ -507,10 +545,22 @@ msgstr "Community" msgid "Confirm new password" msgstr "Confirm new password" +#: src/components/federation/FederatedSignIn.tsx:111 +msgid "Connecting…" +msgstr "Connecting…" + #: src/contexts/ws/WSProvider.tsx:757 msgid "Connection lost — this message may not have been sent" msgstr "Connection lost — this message may not have been sent" +#: src/components/federation/FederatedSignIn.tsx:113 +msgid "Continue" +msgstr "Continue" + +#: src/pages/Authorize.tsx:155 +msgid "Continue as @{username}" +msgstr "Continue as @{username}" + #: src/components/profile/ProfileOwnActions.tsx:99 msgid "Copied!" msgstr "Copied!" @@ -540,6 +590,10 @@ msgstr "Could not rename" msgid "Could not save" msgstr "Could not save" +#: src/components/federation/PeerManager.tsx:146 +msgid "Couldn't add that instance" +msgstr "Couldn't add that instance" + #: src/components/dump/create/DumpCreateModal.tsx:607 msgid "Couldn't load a preview for this link — check it, or post it as-is and refresh the preview later." msgstr "Couldn't load a preview for this link — check it, or post it as-is and refresh the preview later." @@ -548,6 +602,10 @@ msgstr "Couldn't load a preview for this link — check it, or post it as-is and msgid "Couldn't load the chat." msgstr "Couldn't load the chat." +#: src/components/federation/FederatedSignIn.tsx:102 +msgid "Couldn't reach that instance" +msgstr "Couldn't reach that instance" + #: src/pages/Unsubscribe.tsx:116 msgid "Couldn't unsubscribe" msgstr "Couldn't unsubscribe" @@ -576,11 +634,11 @@ msgstr "Creating…" msgid "Current password" msgstr "Current password" -#: src/pages/Settings.tsx:48 +#: src/pages/Settings.tsx:50 msgid "Dark" msgstr "Dark" -#: src/pages/Settings.tsx:121 +#: src/pages/Settings.tsx:154 msgid "Default tab" msgstr "Default tab" @@ -655,6 +713,10 @@ msgstr "Description (optional)" msgid "Discard" msgstr "Discard" +#: src/components/federation/GrantList.tsx:84 +msgid "Disconnect" +msgstr "Disconnect" + #: src/components/chat/ChatModal.tsx:743 msgid "Disconnected — reconnecting…" msgstr "Disconnected — reconnecting…" @@ -730,7 +792,7 @@ msgstr "Edit {0}" msgid "Edit description" msgstr "Edit description" -#: src/components/profile/ProfileHeader.tsx:151 +#: src/components/profile/ProfileHeader.tsx:171 msgid "Edit email" msgstr "Edit email" @@ -772,11 +834,11 @@ msgstr "Editing" msgid "Editing {0}" msgstr "Editing {0}" -#: src/pages/Settings.tsx:145 +#: src/pages/Settings.tsx:178 msgid "Email" msgstr "Email" -#: src/pages/UserRegister.tsx:152 +#: src/pages/UserRegister.tsx:154 msgid "Email address" msgstr "Email address" @@ -822,6 +884,8 @@ msgstr "Failed to post comment" msgid "Failed to post reply" msgstr "Failed to post reply" +#: src/components/federation/GrantList.tsx:98 +#: src/components/federation/PeerManager.tsx:143 #: src/components/playlist/PlaylistEditForm.tsx:185 #: src/components/profile/DescriptionEditor.tsx:99 #: src/components/profile/EmailEditor.tsx:86 @@ -836,7 +900,7 @@ msgstr "Failed to save category" msgid "Failed to save edit" msgstr "Failed to save edit" -#: src/components/profile/ProfileHeader.tsx:162 +#: src/components/profile/ProfileHeader.tsx:182 msgid "Failed to update avatar" msgstr "Failed to update avatar" @@ -844,7 +908,7 @@ msgstr "Failed to update avatar" msgid "Failed to update role" msgstr "Failed to update role" -#: src/pages/Settings.tsx:119 +#: src/pages/Settings.tsx:152 msgid "Feeds" msgstr "Feeds" @@ -879,7 +943,7 @@ msgstr "Follow some users to see their dumps here." #: src/components/feed/FeedTabBar.tsx:43 #: src/components/profile/ProfileFollowTab.tsx:140 -#: src/pages/Settings.tsx:55 +#: src/pages/Settings.tsx:57 #: src/pages/UserPublicProfile.tsx:161 msgid "Followed" msgstr "Followed" @@ -894,7 +958,7 @@ msgstr "Following" msgid "email.digest.forYou" msgstr "For you" -#: src/pages/UserLogin.tsx:97 +#: src/pages/UserLogin.tsx:101 msgid "Forgot password?" msgstr "Forgot password?" @@ -929,11 +993,11 @@ msgid "email.reset.hi" msgstr "Hi {username}," #: src/components/feed/FeedTabBar.tsx:39 -#: src/pages/Settings.tsx:52 +#: src/pages/Settings.tsx:54 msgid "Hot" msgstr "Hot" -#: src/pages/UserLogin.tsx:136 +#: src/pages/UserLogin.tsx:142 msgid "If that address is registered you'll receive a reset link shortly." msgstr "If that address is registered you'll receive a reset link shortly." @@ -965,7 +1029,11 @@ msgstr "In the chat" msgid "Insert emoji" msgstr "Insert emoji" -#: src/pages/UserRegister.tsx:117 +#: src/pages/Manage.tsx:43 +msgid "Instances" +msgstr "Instances" + +#: src/pages/UserRegister.tsx:119 msgid "Invalid invite" msgstr "Invalid invite" @@ -979,7 +1047,7 @@ msgstr "Invalid link" msgid "Invite link" msgstr "Invite link" -#: src/components/profile/ProfileHeader.tsx:116 +#: src/components/profile/ProfileHeader.tsx:126 msgid "invited by" msgstr "invited by" @@ -998,8 +1066,12 @@ msgstr "invited by you" msgid "Invitees" msgstr "Invitees" +#: src/components/federation/FederatedSignIn.tsx:105 +msgid "Its address, like music.example" +msgstr "Its address, like music.example" + #: src/components/feed/FeedTabBar.tsx:41 -#: src/pages/Settings.tsx:54 +#: src/pages/Settings.tsx:56 msgid "Journal" msgstr "Journal" @@ -1007,11 +1079,16 @@ msgstr "Journal" msgid "Keep editing" msgstr "Keep editing" +#. placeholder {0}: relativeTime(grant.lastUsedAt) +#: src/components/federation/GrantList.tsx:77 +msgid "last used {0}" +msgstr "last used {0}" + #: src/components/profile/UsernameField.tsx:59 msgid "Letters, numbers and underscores only" msgstr "Letters, numbers and underscores only" -#: src/pages/Settings.tsx:47 +#: src/pages/Settings.tsx:49 msgid "Light" msgstr "Light" @@ -1068,17 +1145,20 @@ msgstr "Loading profile…" #: src/components/category/CategoryManager.tsx:60 #: src/components/chat/ChatModal.tsx:763 #: src/components/editor/EmojiPickerPopup.tsx:125 +#: src/components/federation/PeerManager.tsx:108 #: src/components/playlist/PlaylistMembershipPanel.tsx:45 #: src/components/shared/ListState.tsx:38 #: src/components/shared/LoadMoreButton.tsx:32 #: src/components/social/UserListPopover.tsx:151 +#: src/pages/Authorize.tsx:122 msgid "Loading…" msgstr "Loading…" #: src/components/layout/AppHeader.tsx:208 -#: src/pages/UserLogin.tsx:41 -#: src/pages/UserLogin.tsx:67 -#: src/pages/UserLogin.tsx:86 +#: src/pages/FederationCallback.tsx:31 +#: src/pages/UserLogin.tsx:44 +#: src/pages/UserLogin.tsx:71 +#: src/pages/UserLogin.tsx:90 msgid "Log in" msgstr "Log in" @@ -1090,16 +1170,22 @@ msgstr "Log in to like" msgid "Log in to vote" msgstr "Log in to vote" -#: src/components/layout/UserMenu.tsx:126 +#. placeholder {0}: peer.name ?? peer.host +#: src/components/federation/FederatedSignIn.tsx:97 +msgid "Log in with {0}" +msgstr "Log in with {0}" + +#: src/components/layout/UserMenu.tsx:127 #: src/pages/UserPublicProfile.tsx:131 msgid "Log out" msgstr "Log out" -#: src/pages/UserLogin.tsx:85 +#: src/pages/UserLogin.tsx:89 msgid "Logging in…" msgstr "Logging in…" -#: src/pages/UserLogin.tsx:72 +#: src/pages/FederationCallback.tsx:63 +#: src/pages/UserLogin.tsx:76 msgid "Login failed" msgstr "Login failed" @@ -1107,9 +1193,9 @@ msgstr "Login failed" msgid "Lowercase letters, numbers and single hyphens only" msgstr "Lowercase letters, numbers and single hyphens only" -#: src/components/layout/UserMenu.tsx:113 -#: src/pages/Manage.tsx:24 -#: src/pages/Manage.tsx:29 +#: src/components/layout/UserMenu.tsx:114 +#: src/pages/Manage.tsx:27 +#: src/pages/Manage.tsx:34 #: src/pages/UserPublicProfile.tsx:164 msgid "Manage" msgstr "Manage" @@ -1138,7 +1224,7 @@ msgstr "Name" #: src/components/chat/ChatModal.tsx:692 #: src/components/feed/FeedTabBar.tsx:40 -#: src/pages/Settings.tsx:53 +#: src/pages/Settings.tsx:55 msgid "New" msgstr "New" @@ -1231,6 +1317,10 @@ msgstr "No users match \"{q}\"." msgid "Not following anyone yet." msgstr "Not following anyone yet." +#: src/pages/Authorize.tsx:103 +msgid "Not from here" +msgstr "Not from here" + #: src/pages/Community.tsx:127 msgid "Nothing happened this month." msgstr "Nothing happened this month." @@ -1248,7 +1338,7 @@ msgstr "Nothing here yet." #: src/components/layout/NotificationBell.tsx:57 #: src/pages/Notifications.tsx:387 #: src/pages/Notifications.tsx:505 -#: src/pages/Settings.tsx:130 +#: src/pages/Settings.tsx:163 msgid "Notifications" msgstr "Notifications" @@ -1256,11 +1346,11 @@ msgstr "Notifications" msgid "Notifications ({unreadNotificationCount} unread)" msgstr "Notifications ({unreadNotificationCount} unread)" -#: src/pages/Settings.tsx:60 +#: src/pages/Settings.tsx:62 msgid "Off" msgstr "Off" -#: src/pages/Settings.tsx:59 +#: src/pages/Settings.tsx:61 msgid "On" msgstr "On" @@ -1300,6 +1390,18 @@ msgstr "Open the chat" msgid "or <0>browse files" msgstr "or <0>browse files" +#: src/components/federation/FederatedSignIn.tsx:82 +msgid "Or join with your account on another gerbeur" +msgstr "Or join with your account on another gerbeur" + +#: src/components/federation/FederatedSignIn.tsx:83 +msgid "Or log in with your account on another gerbeur" +msgstr "Or log in with your account on another gerbeur" + +#: src/pages/Settings.tsx:128 +msgid "Other instances" +msgstr "Other instances" + #: src/pages/UserPublicProfile.tsx:157 msgid "Overview" msgstr "Overview" @@ -1308,13 +1410,14 @@ msgstr "Overview" msgid "Page not found" msgstr "Page not found" -#: src/pages/Settings.tsx:90 -#: src/pages/UserLogin.tsx:82 +#: src/pages/Settings.tsx:96 +#: src/pages/Settings.tsx:106 +#: src/pages/UserLogin.tsx:86 msgid "Password" msgstr "Password" #. placeholder {0}: VALIDATION.PASSWORD_MIN -#: src/pages/UserRegister.tsx:158 +#: src/pages/UserRegister.tsx:160 msgid "Password (min. {0} characters)" msgstr "Password (min. {0} characters)" @@ -1416,17 +1519,17 @@ msgstr "Refreshing stream…" msgid "Refreshing…" msgstr "Refreshing…" -#: src/pages/UserRegister.tsx:45 -#: src/pages/UserRegister.tsx:129 -#: src/pages/UserRegister.tsx:169 +#: src/pages/UserRegister.tsx:47 +#: src/pages/UserRegister.tsx:131 +#: src/pages/UserRegister.tsx:171 msgid "Register" msgstr "Register" -#: src/pages/UserRegister.tsx:168 +#: src/pages/UserRegister.tsx:170 msgid "Registering…" msgstr "Registering…" -#: src/pages/UserRegister.tsx:134 +#: src/pages/UserRegister.tsx:136 msgid "Registration failed" msgstr "Registration failed" @@ -1434,6 +1537,12 @@ msgstr "Registration failed" msgid "Related" msgstr "Related" +#. placeholder {0}: peer.host +#: src/components/federation/PeerManager.tsx:133 +#: src/components/federation/PeerManager.tsx:134 +msgid "Remove {0}" +msgstr "Remove {0}" + #: src/components/form/FileDropZone.tsx:139 msgid "Remove file" msgstr "Remove file" @@ -1472,7 +1581,7 @@ msgstr "Reply" msgid "Replying to" msgstr "Replying to" -#: src/pages/UserLogin.tsx:148 +#: src/pages/UserLogin.tsx:154 msgid "Request failed" msgstr "Request failed" @@ -1579,12 +1688,12 @@ msgstr "Seek" msgid "Send" msgstr "Send" -#: src/pages/UserLogin.tsx:157 +#: src/pages/UserLogin.tsx:163 msgid "Send reset link" msgstr "Send reset link" #: src/components/chat/PendingItem.tsx:104 -#: src/pages/UserLogin.tsx:156 +#: src/pages/UserLogin.tsx:162 msgid "Sending…" msgstr "Sending…" @@ -1603,8 +1712,8 @@ msgid "email.settings" msgstr "Settings" #: src/components/layout/UserMenu.tsx:104 -#: src/pages/Settings.tsx:72 -#: src/pages/Settings.tsx:84 +#: src/pages/Settings.tsx:75 +#: src/pages/Settings.tsx:88 msgid "Settings" msgstr "Settings" @@ -1612,6 +1721,19 @@ msgstr "Settings" msgid "Several people are typing…" msgstr "Several people are typing…" +#: src/pages/Authorize.tsx:37 +msgid "Sign in elsewhere" +msgstr "Sign in elsewhere" + +#: src/pages/Authorize.tsx:135 +msgid "Sign in to {name}?" +msgstr "Sign in to {name}?" + +#: src/pages/Authorize.tsx:154 +#: src/pages/FederationCallback.tsx:73 +msgid "Signing you in…" +msgstr "Signing you in…" + #: src/components/profile/ProfileOwnActions.tsx:102 msgid "Single use, valid for 7 days." msgstr "Single use, valid for 7 days." @@ -1636,7 +1758,7 @@ msgstr "Someone asked to reset the password of your {site} account. The button b msgid "Something went wrong" msgstr "Something went wrong" -#: src/pages/Settings.tsx:132 +#: src/pages/Settings.tsx:165 msgid "Sounds" msgstr "Sounds" @@ -1644,7 +1766,7 @@ msgstr "Sounds" msgid "Start fresh" msgstr "Start fresh" -#: src/pages/Settings.tsx:103 +#: src/pages/Settings.tsx:136 msgid "Style" msgstr "Style" @@ -1696,11 +1818,11 @@ msgstr "The new order couldn't be saved. Try again." msgid "This comment couldn't be deleted. Try again." msgstr "This comment couldn't be deleted. Try again." -#: src/pages/UserRegister.tsx:118 +#: src/pages/UserRegister.tsx:120 msgid "This invite link is missing, expired, or already used." msgstr "This invite link is missing, expired, or already used." -#: src/pages/UserLogin.tsx:104 +#: src/pages/UserLogin.tsx:110 msgid "This is a mirage." msgstr "This is a mirage." @@ -1716,7 +1838,11 @@ msgstr "This page does not exist." msgid "This reset link is missing or malformed." msgstr "This reset link is missing or malformed." -#: src/pages/Settings.tsx:168 +#: src/pages/FederationCallback.tsx:38 +msgid "This sign-in link is incomplete." +msgstr "This sign-in link is incomplete." + +#: src/pages/Settings.tsx:201 msgid "This site doesn't send email, so no digest goes out." msgstr "This site doesn't send email, so no digest goes out." @@ -1763,6 +1889,14 @@ msgstr "Top this week" msgid "Track {0}" msgstr "Track {0}" +#: src/components/federation/PeerManager.tsx:155 +msgid "Trust" +msgstr "Trust" + +#: src/components/federation/PeerManager.tsx:32 +msgid "Trusted" +msgstr "Trusted" + #: src/components/chat/ChatModal.tsx:668 msgid "Try again" msgstr "Try again" @@ -1826,7 +1960,7 @@ msgstr "Unsubscribed" msgid "email.digest.upload" msgstr "upload" -#: src/components/profile/ProfileHeader.tsx:72 +#: src/components/profile/ProfileHeader.tsx:79 msgid "Upload failed" msgstr "Upload failed" @@ -1883,9 +2017,9 @@ msgstr "User menu" #: src/components/profile/ProfileManageTab.tsx:61 #: src/components/profile/UsernameField.tsx:51 -#: src/pages/Settings.tsx:87 -#: src/pages/UserLogin.tsx:75 -#: src/pages/UserRegister.tsx:137 +#: src/pages/Settings.tsx:91 +#: src/pages/UserLogin.tsx:79 +#: src/pages/UserRegister.tsx:139 msgid "Username" msgstr "Username" @@ -1894,6 +2028,10 @@ msgstr "Username" msgid "Users" msgstr "Users" +#: src/components/federation/PeerManager.tsx:169 +msgid "Users of a trusted instance sign in here with their account there. Those of a blocked one can't. Users of any other instance need an invite." +msgstr "Users of a trusted instance sign in here with their account there. Those of a blocked one can't. Users of any other instance need an invite." + #: src/components/profile/ProfileSection.tsx:43 msgid "View all →" msgstr "View all →" @@ -1952,6 +2090,10 @@ msgstr "Yesterday" msgid "You can post it anyway." msgstr "You can post it anyway." +#: src/components/federation/GrantList.tsx:93 +msgid "You haven't signed in to another gerbeur with this account yet." +msgstr "You haven't signed in to another gerbeur with this account yet." + #: src/pages/Unsubscribe.tsx:94 msgid "You won't get the monthly recap any more. You can turn it back on in your settings." msgstr "You won't get the monthly recap any more. You can turn it back on in your settings." @@ -1997,7 +2139,15 @@ msgstr "You've reached the end." msgid "email.welcome.preheader" msgstr "Your account is ready." -#: src/pages/UserLogin.tsx:152 +#: src/pages/Authorize.tsx:104 +msgid "Your account lives on {home}: sign in to other instances from there." +msgstr "Your account lives on {home}: sign in to other instances from there." + +#: src/pages/Settings.tsx:119 +msgid "Your account lives on {home}: your password, email address, avatar and username change there." +msgstr "Your account lives on {home}: your password, email address, avatar and username change there." + +#: src/pages/UserLogin.tsx:158 msgid "Your email address" msgstr "Your email address" diff --git a/locales/fr.mjs b/locales/fr.mjs index c53e36ec..fd83ed23 100644 --- a/locales/fr.mjs +++ b/locales/fr.mjs @@ -1 +1 @@ -/*eslint-disable*/export const messages=JSON.parse("{\"-K9EZb\":[\"Ajouter un e-mail…\"],\"-Ya-b9\":[\"Enregistrement échoué\"],\"-iDCtG\":[\"Vos paramètres\"],\"-siMqD\":[\"Journal\"],\"1CalO6\":[\"Style\"],\"1HfJWf\":[\"Rechercher des recos, utilisateurs, collections…\"],\"1QfxQT\":[\"Fermer\"],\"1YKhJ3\":[\"1 nouveau message\"],\"1njn7W\":[\"Clair\"],\"1utXA6\":[\"Recos\"],\"26iNma\":[\"Publier le commentaire\"],\"2DoBvq\":[\"Flux\"],\"2Hlmdt\":[\"Écrire une réponse…\"],\"2_DHgA\":[\"Identifiant d’URL\"],\"2nrsEn\":[\"message supprimé\"],\"2wxgft\":[\"Renommer\"],\"2ygf_L\":[\"← Retour\"],\"3KKSM4\":[\"privé\"],\"3QuNUr\":[\"Plusieurs personnes écrivent…\"],\"3SEwY1\":[\"Supprimer la catégorie \\\"\",[\"0\"],\"\\\" ? Cette action est irréversible.\"],\"3qkggm\":[\"Plein écran\"],\"3yfh3D\":[\"<0>\",[\"0\"],\" a suivi votre collection <1>\",[\"1\"],\"\"],\"48e2R8\":[\"Modifier l'e-mail\"],\"49voTZ\":[[\"label\"],\" (\",[\"count\"],\")\"],\"4B6w_o\":[\"Recommandé !\"],\"4GKuCs\":[\"Connexion échouée\"],\"4HH9iB\":[\"Aucun abonnement pour le moment.\"],\"4OjqAQ\":[\"Continuer l'édition\"],\"4RtQ1k\":[\"Ne plus suivre \",[\"targetUsername\"]],\"4c-qBx\":[\"Votre mot de passe a été modifié. Vous pouvez maintenant vous connecter.\"],\"4yj9xV\":[\"Les mises à jour en direct sont temporairement interrompues. Tentative de reconnexion…\"],\"5KHDCi\":[[\"0\"],\" et \",[\"1\"],\" sont en train d'écrire…\"],\"5NZ3tg\":[\"Désactivation…\"],\"5TviPn\":[\"Annuler la recherche\"],\"5cC8f2\":[\"Modifié le \",[\"0\"]],\"5oD9f_\":[\"Plus tôt\"],\"6Qly-0\":[\"un commentaire\"],\"6YE0P6\":[\"Édition de \",[\"0\"]],\"6YtxFj\":[\"Nom\"],\"6_dCYd\":[\"Aperçu\"],\"6gRgw8\":[\"Réessayer\"],\"7PHCIN\":[\"Annuler la suppression\"],\"7PzzBU\":[\"Utilisateur\"],\"7d1a0d\":[\"Public\"],\"7noMWp\":[\"Rien de neuf cette semaine.\"],\"7sNhEz\":[\"Nom d'utilisateur\"],\"8-8abB\":[\"Déconnecté — reconnexion…\"],\"8F1i42\":[\"Page introuvable\"],\"8JplJJ\":[\"Désabonné\"],\"8Ug9jB\":[\"Connexe\"],\"8ZsakT\":[\"Mot de passe\"],\"92o1-U\":[\"Suppression échouée\"],\"9BruTc\":[\"Pourquoi ?\"],\"9l4qcT\":[\"Déposez un fichier de remplacement ici\"],\"9uI_rE\":[\"Annuler\"],\"A0y396\":[\"+ Inviter quelqu'un\"],\"A1taO8\":[\"Rechercher\"],\"AEfu-D\":[\"Dans les collections\"],\"AHZflp\":[\"Tribune\"],\"AQbgNR\":[\"Suivre \",[\"targetUsername\"]],\"AS7WoE\":[\"Repartir de zéro\"],\"ATGYL1\":[\"Adresse e-mail\"],\"AZctoV\":[[\"0\",\"plural\",{\"one\":[\"#\",\" commentaire\"],\"other\":[\"#\",\" commentaires\"]}]],\"Ade-6d\":[\"Mises à jour en direct indisponibles.\"],\"AeXO77\":[\"Compte\"],\"AhNP40\":[\"Position\"],\"AnRu_j\":[\"Annuler la réponse\"],\"B4LeYP\":[\"Échec de la suppression (\",[\"0\"],\")\"],\"BjitBo\":[\"Télécharger \",[\"0\"]],\"BlpJ2G\":[\"Reprise de votre brouillon.\"],\"CI50ct\":[\"Voté\"],\"C_qQE4\":[\"Déjà recommandé par \",[\"0\"],\" \",[\"1\"]],\"Cf_gxi\":[\"Ne plus recevoir le résumé hebdomadaire ?\"],\"Cj24wt\":[\"Inscription…\"],\"CnqayG\":[\"La mise à jour a échoué. Réessayez.\"],\"D8DRYV\":[\"Supprimer ce message ?\"],\"DI3NBO\":[\"Ouvrir sur \",[\"0\"]],\"DPfwMq\":[\"Terminé\"],\"DdeHXH\":[\"Supprimer cette reco ? Cette action est irréversible.\"],\"Dp1JhP\":[\"<0>\",[\"0\"],\" a voté pour <1>\",[\"1\"],\"\"],\"E417RG\":[\"Vous ne recevrez plus le résumé hebdomadaire. Vous pouvez le réactiver dans vos paramètres.\"],\"EBU6O6\":[\"Connexion perdue — ce message n'a peut-être pas été envoyé\"],\"ECiS12\":[\"Voir la reco →\"],\"ED8n0z\":[\"la tribune\"],\"EarrCe\":[\"Rechercher un emoji\"],\"Evcm2Z\":[\"Fermer sans publier ? Le fichier joint sera perdu — ce que vous avez écrit sera conservé.\"],\"EwVrWF\":[\"Le dump n'a pas pu être retiré. Réessayez.\"],\"ExR0Fr\":[\"L'URL est obligatoire.\"],\"F5Js1v\":[\"Ne plus suivre la collection\"],\"FdTlEG\":[\"Piste \",[\"0\"]],\"FgAxTj\":[\"Se déconnecter\"],\"Fxf4jq\":[\"Description (facultatif)\"],\"GCWCCo\":[\"Fermer le lecteur\"],\"GDvlUT\":[\"Rôle\"],\"GLukaH\":[\"Modérateur\"],\"GNSsCc\":[\"Impossible de créer la collection\"],\"GQ38dl\":[[\"unreadChatCount\"],\" messages non lus\"],\"GY6uSc\":[\"Suivant →\"],\"GbqhrN\":[[\"0\"],\"–\",[\"1\"],\" caractères : lettres, chiffres ou tirets bas\"],\"GptGxg\":[\"Changer le mot de passe\"],\"Gv5nA5\":[\"Format de réponse inattendu\"],\"H4MGkI\":[\"Agrandir le lecteur\"],\"H4o4sk\":[\"Personne pour le moment.\"],\"H8pzW-\":[\"Impossible de mettre à jour l'avatar\"],\"HTLDA4\":[\"Chargement…\"],\"H_PnT8\":[\"Insérer un emoji\"],\"I-x669\":[\"Invités\"],\"IF7RiR\":[\"Couverture\"],\"IO9KL_\":[\"Piste suivante\"],\"IZX7TO\":[\"Impossible de générer une invitation\"],\"IagCbF\":[\"URL\"],\"IgrLD_\":[\"Pause\"],\"IhK90M\":[\"Lettres, chiffres et tirets bas seulement\"],\"ImOQa9\":[\"Répondre\"],\"JJ-Bhk\":[\"Votre adresse e-mail\"],\"JLasL-\":[\"Désabonnement impossible\"],\"JRQitQ\":[\"Confirmer le nouveau mot de passe\"],\"JXr41k\":[\"<0>\",[\"0\"],\" a commenté sur <1>\",[\"1\"],\"\"],\"Jd58Fo\":[\"Tendances\"],\"Jf0PuK\":[\"Aller à la connexion\"],\"JlFcis\":[\"Envoyer\"],\"K7tIrx\":[\"Catégorie\"],\"KDGWg5\":[\"Retirer de la collection\"],\"KDw4GX\":[\"Réessayer\"],\"KKZxBU\":[\"Envoi \",[\"0\"],\" %\"],\"K_F6pa\":[\"Enregistrement…\"],\"KtYF-t\":[\"Sons\"],\"L-rMC9\":[\"Réinitialiser par défaut\"],\"L7_rsx\":[\"Envoi de l'image…\"],\"MHrjPM\":[\"Titre\"],\"MKEPCY\":[\"Suivre\"],\"MTb2Ot\":[\"Aucun message pour l'instant. Dites bonjour !\"],\"Mj6oCJ\":[[\"0\"],\" est en train d'écrire…\"],\"N40H-G\":[\"Tout\"],\"N6j2JH\":[\"Modifier \",[\"0\"]],\"NUrY9o\":[\"Catégories\"],\"Nu4oKW\":[\"Description\"],\"O32mmL\":[\"Modifier la description\"],\"O3oNi5\":[\"E-mail\"],\"Oprv1v\":[\"Mot de passe (min. \",[\"0\"],\" caractères)\"],\"P5MuiB\":[\"Ajouter une image\"],\"PJTy3N\":[[\"totalUnread\",\"plural\",{\"one\":[\"#\",\" nouvelle\"],\"other\":[\"#\",\" nouvelles\"]}]],\"PN3pBl\":[\"Pas de réponse du serveur — ce message n'a peut-être pas été envoyé\"],\"PUe8Yk\":[\"Réduire le lecteur\"],\"PiH3UR\":[\"Copié !\"],\"Pn2B7_\":[\"Mot de passe actuel\"],\"Pwqkdw\":[\"Chargement…\"],\"Q4WUjR\":[\"Rechercher un emoji…\"],\"Q6n4F4\":[\"Actualiser les métadonnées\"],\"QGaQRo\":[\"Erreur lors de la mise à jour du rôle\"],\"QKsaQr\":[\"ou <0>parcourir les fichiers\"],\"QLtPBd\":[\"Aucune reco dans cette collection pour l'instant.\"],\"QctOgc\":[\"Impossible de joindre le serveur. Vérifiez votre connexion et réessayez.\"],\"R7SsBE\":[\"Couper le son\"],\"R9Khdg\":[\"Auto\"],\"RCcPrX\":[\"Supprimer cette collection ? Cette action est irréversible.\"],\"RTksSy\":[\"<0>\",[\"0\"],\" a commencé à vous suivre\"],\"RaKjrM\":[\"Impossible d'enregistrer la modification\"],\"RcUHRT\":[\"Suivi\"],\"RfwZxd\":[\"Réinitialiser le mot de passe\"],\"Rrp6-J\":[\"Se connecter pour aimer\"],\"RvVJBH\":[\"Actualisation du flux…\"],\"S1xV5B\":[[\"maxLength\"],\" caractères au maximum.\"],\"SBTElJ\":[\"Recherche…\"],\"SMaFdc\":[\"Se désabonner\"],\"Sad2tK\":[\"Envoi…\"],\"So7gCD\":[\"Collez un lien…\"],\"StovX6\":[\"Rien à voir, circulez.\"],\"Sxm8rQ\":[\"Utilisateurs\"],\"T8ejtZ\":[\"Ce commentaire n'a pas pu être supprimé. Réessayez.\"],\"T91vKp\":[\"Lecture\"],\"T9bjWt\":[\"<0>\",[\"0\"],\" a été ajouté à <1>\",[\"1\"],\"\"],\"TAtbho\":[\"Chargement des messages…\"],\"TN382O\":[\"Lien invalide\"],\"Tv9vbB\":[\"Suivre la collection\"],\"Tz0i8g\":[\"Paramètres\"],\"U3pytU\":[\"Administrateur\"],\"UNMVei\":[\"Mot de passe oublié ?\"],\"UOZith\":[\"Publication échouée\"],\"URAieT\":[\"Se connecter pour voter\"],\"V38P77\":[\"Seuls son auteur et les modérateurs peuvent modifier ce dump.\"],\"VCoEm-\":[\"Retour à la connexion\"],\"VKsaTi\":[\"En réponse à\"],\"VLAd8f\":[\"Max \",[\"limit\"]],\"V_e7nf\":[\"Définir un nouveau mot de passe\"],\"VnNJbN\":[\"De collections\"],\"VskHIx\":[\"Supprimer la catégorie\"],\"VyTYmS\":[\"Changer l'avatar\"],\"W5A0Ly\":[\"Une erreur inattendue s'est produite.\"],\"W9FRBT\":[\"Aimer\"],\"WAcnnR\":[\"L'image n'a pas pu être envoyée.\"],\"WE_r9K\":[\"Échec de la création de la catégorie\"],\"WfffrI\":[\"identifiant\"],\"WhimMi\":[\"Échec de la réinitialisation\"],\"WpXcBJ\":[\"Rien ici pour l'instant.\"],\"XHqhoS\":[\"Impossible de charger le chat.\"],\"XJVYo8\":[\"Pourquoi & où\"],\"XJy2oN\":[\"Connexion…\"],\"Xan6QP\":[\"Nouvelle reco\"],\"XgRtUf\":[\"Impossible de changer le mot de passe\"],\"XnL-Eu\":[\"Aucun utilisateur ne correspond à « \",[\"q\"],\" ».\"],\"Xs2Lez\":[\"Ce lien de réinitialisation est absent ou malformé.\"],\"YK1Dhc\":[\"une publication\"],\"YWnSuq\":[\"Ce lien de désabonnement est absent ou mal formé.\"],\"YZxXK8\":[\"Fermer le sélecteur d'emoji\"],\"YcjhhX\":[\"Gestion utilisateur\"],\"Ye9RMF\":[\"<0>\",[\"0\"],\" a aimé votre commentaire sur <1>\",[\"1\"],\"\"],\"YpkCca\":[\"Pas encore de collections suivies.\"],\"Z5HWHd\":[\"Activés\"],\"ZBdbv9\":[\"Modifier le titre\"],\"ZCpU0u\":[\"Aucune collection ne correspond à « \",[\"q\"],\" ».\"],\"ZWxjuD\":[\"Certaines images n'ont pas pu être envoyées.\"],\"ZmD2o6\":[\"Créer et ajouter\"],\"_3O5R_\":[\"Échec de la demande\"],\"_DwR-n\":[\"Création…\"],\"_I1_HN\":[\"Minuscules, chiffres et tirets simples seulement\"],\"_R_sGB\":[\"Mot de passe modifié avec succès.\"],\"_aept4\":[\"Publier la réponse\"],\"_cF7Rs\":[\"Volume\"],\"_karOe\":[\"Hors ligne — message non envoyé\"],\"_nT6AE\":[\"Nouveau mot de passe\"],\"_t4W-i\":[\"De personnes\"],\"aAIQg2\":[\"Apparence\"],\"aDvLhk\":[\"Ajouter un commentaire…\"],\"az8lvo\":[\"Désactivés\"],\"b3Thhd\":[\"Envoi échoué\"],\"b8XMJ8\":[[\"visibleCount\",\"plural\",{\"one\":[\"#\",\" commentaire\"],\"other\":[\"#\",\" commentaires\"]}]],\"bQhwn-\":[\"Chargement de la collection…\"],\"b_1P1D\":[\"Renommage…\"],\"bzSI52\":[\"Abandonner\"],\"cILfnJ\":[\"Supprimer le fichier\"],\"cNu4my\":[[\"0\"],\" de plus en ligne : \",[\"restNames\"]],\"cYP9Sb\":[\"+ Collection\"],\"cbeBbZ\":[\"Au moins \",[\"0\"],\" caractères\"],\"cnGeoo\":[\"Supprimer\"],\"dAs22m\":[\"Remplacer le fichier\"],\"dEgA5A\":[\"Annuler\"],\"dMizp8\":[\"Nouvelle collection\"],\"dau1Pl\":[[\"unseenCount\"],\" nouveaux messages\"],\"digest.community\":[\"Communauté\"],\"digest.count.comments\":[[\"n\",\"plural\",{\"one\":[\"commentaire\"],\"other\":[\"commentaires\"]}]],\"digest.count.upvotes\":[[\"n\",\"plural\",{\"one\":[\"vote\"],\"other\":[\"votes\"]}]],\"digest.invitedBy\":[\"sur invitation de @\",[\"username\"]],\"digest.invitedByYou\":[\"sur votre invitation\"],\"digest.monthly\":[\"Récap mensuel\"],\"digest.monthly.off\":[\"Ne plus recevoir le récap mensuel\"],\"digest.newMembers\":[\"Nouveaux membres\"],\"digest.newPlaylists\":[\"Nouvelles collections publiques\"],\"digest.stat.chat\":[[\"n\",\"plural\",{\"one\":[\"message dans la tribune\"],\"other\":[\"messages dans la tribune\"]}]],\"digest.stat.dumps\":[[\"n\",\"plural\",{\"one\":[\"reco\"],\"other\":[\"recos\"]}]],\"digest.topMonth\":[\"Les plus votées du mois\"],\"digest.topWeek\":[\"Les plus votées de la semaine\"],\"digest.weekly\":[\"Résumé hebdomadaire\"],\"digest.weekly.off\":[\"Ne plus recevoir le résumé hebdomadaire\"],\"dqwCfR\":[\"Impossible de charger un aperçu pour ce lien — vérifiez-le, ou publiez-le tel quel et actualisez l'aperçu plus tard.\"],\"dznB-Y\":[\"Seules les images peuvent être déposées ici.\"],\"eFSqvc\":[\"Impossible de publier la réponse\"],\"eIEHHV\":[\"Changer la couleur de peau\"],\"eOfXq3\":[\"Un titre est requis.\"],\"ePK91l\":[\"Modifier\"],\"eaUTwS\":[\"Envoyer le lien de réinitialisation\"],\"ecUA8p\":[\"Aujourd'hui\"],\"ef9nPf\":[\"Chargement de la reco…\"],\"eloqXQ\":[\"Vous pouvez la publier quand même.\"],\"email.digest.addedTo\":[\"ajoutée à \",[\"playlist\"]],\"email.digest.andMore\":[\"et \",[\"n\"],\" de plus\"],\"email.digest.by\":[\"par @\",[\"username\"]],\"email.digest.chatWeek\":[[\"n\",\"plural\",{\"one\":[\"#\",\" message cette semaine\"],\"other\":[\"#\",\" messages cette semaine\"]}]],\"email.digest.communityPage\":[\"Tout voir sur la page de la communauté\"],\"email.digest.count.followers\":[[\"n\",\"plural\",{\"one\":[\"nouvel abonné\"],\"other\":[\"nouveaux abonnés\"]}]],\"email.digest.count.likes\":[[\"n\",\"plural\",{\"one\":[\"j'aime sur vos commentaires\"],\"other\":[\"j'aime sur vos commentaires\"]}]],\"email.digest.count.mentions\":[[\"n\",\"plural\",{\"one\":[\"mention\"],\"other\":[\"mentions\"]}]],\"email.digest.count.playlistFollows\":[[\"n\",\"plural\",{\"one\":[\"abonnement à vos collections\"],\"other\":[\"abonnements à vos collections\"]}]],\"email.digest.forYou\":[\"Pour vous\"],\"email.digest.hl.comment\":[[\"who\"],\" a commenté votre reco \",[\"target\"]],\"email.digest.hl.commentLike\":[[\"who\"],\" a aimé votre commentaire sur \",[\"target\"]],\"email.digest.hl.mentionComment\":[[\"who\"],\" vous a mentionné dans un commentaire sur \",[\"target\"]],\"email.digest.hl.mentionEveryone\":[[\"who\"],\" a mentionné tout le monde dans \",[\"target\"]],\"email.digest.hl.mentionIn\":[[\"who\"],\" vous a mentionné dans \",[\"target\"]],\"email.digest.hl.mentionPlaylist\":[[\"who\"],\" vous a mentionné dans la collection \",[\"target\"]],\"email.digest.hl.playlistFollow\":[[\"who\"],\" a suivi votre collection \",[\"target\"]],\"email.digest.hl.userFollow\":[[\"who\"],\" vous suit désormais\"],\"email.digest.inChat\":[\"Dans la tribune\"],\"email.digest.monthly.reason\":[\"Vous recevez ce récap mensuel car il est activé dans vos paramètres.\"],\"email.digest.monthly.subject\":[\"Le mois sur \",[\"site\"],\", \",[\"range\"]],\"email.digest.monthly.title\":[\"Le mois sur \",[\"site\"]],\"email.digest.more\":[[\"n\"],\" de plus dans votre fil Suivi\"],\"email.digest.network\":[\"De ceux que vous suivez\"],\"email.digest.openChat\":[\"Ouvrir la tribune\"],\"email.digest.playlistMeta\":[\"par @\",[\"username\"],\" · \",[\"n\",\"plural\",{\"one\":[\"#\",\" reco\"],\"other\":[\"#\",\" recos\"]}]],\"email.digest.pre.members\":[[\"n\",\"plural\",{\"one\":[\"#\",\" nouveau membre\"],\"other\":[\"#\",\" nouveaux membres\"]}]],\"email.digest.pre.network\":[[\"n\",\"plural\",{\"one\":[\"#\",\" nouvelle reco de ceux que vous suivez\"],\"other\":[\"#\",\" nouvelles recos de ceux que vous suivez\"]}]],\"email.digest.pre.playlists\":[[\"n\",\"plural\",{\"one\":[\"#\",\" nouvelle collection\"],\"other\":[\"#\",\" nouvelles collections\"]}]],\"email.digest.pre.topMonth\":[[\"n\",\"plural\",{\"one\":[\"la reco la plus votée du mois\"],\"other\":[\"les \",\"#\",\" recos les plus votées du mois\"]}]],\"email.digest.pre.topWeek\":[[\"n\",\"plural\",{\"one\":[\"la reco la plus votée de la semaine\"],\"other\":[\"les \",\"#\",\" recos les plus votées de la semaine\"]}]],\"email.digest.seeAll\":[[\"n\",\"plural\",{\"one\":[\"Voir la notification\"],\"other\":[\"Voir les \",\"#\",\" notifications\"]}]],\"email.digest.theChat\":[\"la tribune\"],\"email.digest.totals\":[[\"dumps\",\"plural\",{\"one\":[\"#\",\" reco\"],\"other\":[\"#\",\" recos\"]}],\", \",[\"upvotes\",\"plural\",{\"one\":[\"#\",\" vote\"],\"other\":[\"#\",\" votes\"]}],\" et \",[\"comments\",\"plural\",{\"one\":[\"#\",\" commentaire\"],\"other\":[\"#\",\" commentaires\"]}],\".\"],\"email.digest.upload\":[\"fichier\"],\"email.digest.weekly.reason\":[\"Vous recevez ce résumé hebdomadaire car il est activé dans vos paramètres.\"],\"email.digest.weekly.subject\":[\"Votre semaine sur \",[\"site\"],\", \",[\"range\"]],\"email.digest.weekly.title\":[\"Votre semaine, \",[\"username\"]],\"email.digest.yours\":[\"à vous\"],\"email.reset.body\":[\"Quelqu'un a demandé à réinitialiser le mot de passe de votre compte \",[\"site\"],\". Le bouton ci-dessous vous permet d'en choisir un nouveau. Il ne fonctionne qu'une fois, pendant \",[\"hours\",\"plural\",{\"one\":[\"#\",\" heure\"],\"other\":[\"#\",\" heures\"]}],\".\"],\"email.reset.button\":[\"Choisir un nouveau mot de passe\"],\"email.reset.fallback\":[\"Si le bouton ne fonctionne pas, collez ce lien dans votre navigateur :\"],\"email.reset.hi\":[\"Bonjour \",[\"username\"],\",\"],\"email.reset.ignore\":[\"Si vous n'êtes pas à l'origine de cette demande, ignorez cet e-mail. Votre mot de passe ne change pas.\"],\"email.reset.preheader\":[\"Le lien ne fonctionne qu'une fois, pendant \",[\"hours\",\"plural\",{\"one\":[\"#\",\" heure\"],\"other\":[\"#\",\" heures\"]}],\".\"],\"email.reset.reason\":[\"Vous recevez cet e-mail car une réinitialisation de mot de passe a été demandée pour cette adresse.\"],\"email.reset.subject\":[\"Réinitialisez votre mot de passe \",[\"site\"]],\"email.reset.title\":[\"Réinitialiser votre mot de passe\"],\"email.settings\":[\"Paramètres\"],\"email.welcome.body\":[\"# Bienvenue sur \",[\"site\"],\" !\\n\\nBonjour **\",[\"username\"],\"**,\\n\\nVotre compte a bien été créé. Bienvenue à bord !\"],\"email.welcome.button\":[\"Ouvrir \",[\"site\"]],\"email.welcome.digests\":[\"Chaque semaine, vous recevrez un résumé de ce qui s'est passé ici, et chaque mois un récap des recos les plus votées. Vous pouvez désactiver l'un ou l'autre dans vos paramètres.\"],\"email.welcome.preheader\":[\"Votre compte est prêt.\"],\"email.welcome.reason\":[\"Vous recevez cet e-mail car un compte \",[\"site\"],\" a été créé avec cette adresse.\"],\"email.welcome.subject\":[\"Bienvenue sur \",[\"site\"]],\"en9o7K\":[\"Impossible de publier le commentaire\"],\"etFQQS\":[\"Pourquoi on en voudrait ?\"],\"f3cEDO\":[\"Changer l'image\"],\"fC6mXb\":[\"Voter\"],\"fI-mNw\":[\"Collections\"],\"fgLNSM\":[\"S'inscrire\"],\"gANddk\":[\"Envoi…\"],\"gGx5tM\":[\"Modification\"],\"gIQQwD\":[\"Chargement échoué\"],\"gIpLuy\":[\"Il faut un lien\"],\"gL9KKi\":[\"Qui peut la voir\"],\"gLfZlz\":[\"Ajouter à la collection\"],\"gjJ-sb\":[\"Impossible de se connecter au serveur de mises à jour en direct. Les votes et les notifications pourraient ne pas se synchroniser avant la reconnexion.\"],\"goWEhR\":[\"Piste précédente\"],\"hBuUKa\":[\"Changer le mot de passe…\"],\"hD7w09\":[\"Vous avez tout lu, tout vu, tout bu.\"],\"hJSliC\":[\"<0>\",[\"0\"],\" a publié <1>\",[\"1\"],\"\"],\"hT8hgO\":[\"Rétablir le titre suggéré\"],\"hYgDIe\":[\"Créer\"],\"he3ygx\":[\"Copier\"],\"hpCc_Z\":[\"Fermer quand même\"],\"i7K_Te\":[\"Qui suis-je ?\"],\"iDNBZe\":[\"Notifications\"],\"iWpEwy\":[\"Accueil\"],\"ipYn7W\":[\"Si cette adresse est enregistrée, vous recevrez un lien de réinitialisation sous peu.\"],\"isRobC\":[\"Nouveau\"],\"jTGs8A\":[\"Ce site n'envoie pas d'e-mails, aucun résumé ne part donc.\"],\"jbernk\":[\"Chargement du profil…\"],\"jnrIbz\":[\"Voté (\",[\"0\"],\")\"],\"joEmfT\":[\"Serveur inaccessible\"],\"jrZTZl\":[\"Pas encore de recos. Soyez le premier !\"],\"k112DD\":[\"Charger les messages plus anciens\"],\"k36iJ-\":[\"Échec de l’enregistrement de la catégorie\"],\"k4b5_X\":[\"modifié\"],\"kLttbL\":[\"Inscription échouée\"],\"lUanmi\":[\"Vous serez notifié lorsque quelqu'un suit vos collections, vote pour vos recos ou publie du nouveau contenu.\"],\"lY5h1V\":[[\"0\",\"plural\",{\"one\":[\"#\",\" reco\"],\"other\":[\"#\",\" recos\"]}]],\"lcfvr_\":[\"Supprimer ce commentaire ?\"],\"lpIMne\":[\"Les mots de passe ne correspondent pas\"],\"mDJo8W\":[\"Recos (\",[\"0\"],\")\"],\"mb_Wju\":[\"Déposez un fichier ici, ou collez-en un\"],\"mt6O6E\":[\"C'est un mirage.\"],\"nbm5sI\":[\"Aucune reco ne correspond à « \",[\"q\"],\" ».\"],\"nrjqON\":[\"Vérification de l'invitation…\"],\"nucyoV\":[\"<0>\",[\"0\"],\" a mentionné tout le monde dans <1>\",[\"where\"],\"\"],\"nwtY4N\":[\"Une erreur est survenue\"],\"nx4kaN\":[\"Sauvegarde impossible\"],\"oTYvvN\":[[\"0\",\"plural\",{\"one\":[\"et \",\"#\",\" reco plus ancienne\"],\"other\":[\"et \",\"#\",\" recos plus anciennes\"]}]],\"oW3yYY\":[\"Ce mois-ci\"],\"ogtYkT\":[\"Mot de passe mis à jour\"],\"pCpd9p\":[\"<0>\",[\"0\"],\" vous a mentionné dans <1>\",[\"where\"],\"\"],\"pSheLH\":[\"Aucun invité pour le moment.\"],\"pd3FCq\":[\"Ce fichier dépasse \",[\"limit\"],\".\"],\"pvnfJD\":[\"Sombre\"],\"qIMfNQ\":[\"Supprimer la collection\"],\"qItrqH\":[\"Vous ne recevrez plus le récap mensuel. Vous pouvez le réactiver dans vos paramètres.\"],\"qbDAcy\":[\"Recommander\"],\"qgx_78\":[\"Suivez des collections publiques pour voir leurs recos ici.\"],\"qnUJBI\":[\"Le nouvel ordre n'a pas pu être enregistré. Réessayez.\"],\"qsqt0w\":[\"Lien d'invitation\"],\"qvFa8r\":[\"public\"],\"qvz_Pp\":[\"Reco\"],\"rCbqPX\":[\"Ce lien d'invitation est manquant, expiré ou déjà utilisé.\"],\"rDMzDU\":[\"Écrivez un message…\"],\"rg9pXu\":[\"Recherche échouée\"],\"rn6SBY\":[\"Rétablir le son\"],\"sEXJPi\":[\"Lien ou fichier\"],\"sGeXL3\":[\"Miniature\"],\"sQia9P\":[\"Se connecter\"],\"sTiqbm\":[\"invité par\"],\"sdP5Aa\":[\"[supprimé]\"],\"sgX7B-\":[\"Usage unique, valable 7 jours.\"],\"shHs8T\":[\"Saisissez une recherche.\"],\"smeBfS\":[\"Invitation invalide\"],\"teaneZ\":[\"image\"],\"tfDRzk\":[\"Enregistrer\"],\"tvmuQ0\":[\"Thème de couleur\"],\"tyiiHe\":[\"Rien de neuf ce mois-ci.\"],\"u1lDX2\":[\"Récupération de l'aperçu…\"],\"uD0qXQ\":[\"Déposez un fichier ici\"],\"uISnsY\":[\"Suppression impossible\"],\"uMGUnV\":[\"Pas encore de collections.\"],\"ub1EEL\":[\"modifié \",[\"0\"]],\"uomLas\":[\"Ajouter une catégorie\"],\"v-Wp--\":[\"Ouvrir la source\"],\"vJBF1r\":[\"Publication…\"],\"vLhLLO\":[\"Notifications (\",[\"unreadNotificationCount\"],\" non lues)\"],\"vQMkHu\":[\"Retirer le vote\"],\"vuosjb\":[\"Menu utilisateur\"],\"wckWOP\":[\"Administration\"],\"wixIgH\":[\"Vous avez déjà un compte ? <0>Se connecter\"],\"wtxFp4\":[\"Fichier trop volumineux (max \",[\"max\"],\").\"],\"x6tjuK\":[\"Onglet par défaut\"],\"xEWkgZ\":[\"← Retour à toutes les recos\"],\"xPHtx0\":[\"Lancer la recherche\"],\"xVuNgt\":[\"+ Nouvelle collection\"],\"xc9O_u\":[\"Supprimer la reco\"],\"y1G_DI\":[\"Renommage impossible\"],\"y6sq5j\":[\"Abonné\"],\"yA_6BX\":[\"Tout voir →\"],\"yBBtRm\":[\"Suivez des utilisateurs pour voir leurs recos ici.\"],\"yByRxz\":[\"Cette semaine\"],\"yQ2kGp\":[\"Charger plus\"],\"y_0uwd\":[\"Hier\"],\"yxlcv5\":[\"Ne plus recevoir le récap mensuel ?\"],\"yz7wBu\":[\"Fermer\"],\"yzF66j\":[\"Lien\"],\"z0ROB3\":[\"Retirer le j'aime\"],\"z1uNN0\":[\"Aucun emoji trouvé.\"],\"zVuxvN\":[\"Actualisation…\"],\"zwBp5t\":[\"Privé\"]}"); \ No newline at end of file +/*eslint-disable*/export const messages=JSON.parse("{\"-K0AvT\":[\"Déconnecter\"],\"-K9EZb\":[\"Ajouter un e-mail…\"],\"-Ya-b9\":[\"Enregistrement échoué\"],\"-iDCtG\":[\"Vos paramètres\"],\"-siMqD\":[\"Journal\"],\"1CalO6\":[\"Style\"],\"1HfJWf\":[\"Rechercher des recos, utilisateurs, collections…\"],\"1QfxQT\":[\"Fermer\"],\"1YKhJ3\":[\"1 nouveau message\"],\"1njn7W\":[\"Clair\"],\"1utXA6\":[\"Recos\"],\"26iNma\":[\"Publier le commentaire\"],\"2DoBvq\":[\"Flux\"],\"2Hlmdt\":[\"Écrire une réponse…\"],\"2_DHgA\":[\"Identifiant d’URL\"],\"2nrsEn\":[\"message supprimé\"],\"2rwzb1\":[\"Vous ne vous êtes encore connecté à aucun autre gerbeur avec ce compte.\"],\"2wxgft\":[\"Renommer\"],\"2ygf_L\":[\"← Retour\"],\"32TndD\":[\"Bloquée\"],\"3KKSM4\":[\"privé\"],\"3QuNUr\":[\"Plusieurs personnes écrivent…\"],\"3SEwY1\":[\"Supprimer la catégorie \\\"\",[\"0\"],\"\\\" ? Cette action est irréversible.\"],\"3qkggm\":[\"Plein écran\"],\"3yfh3D\":[\"<0>\",[\"0\"],\" a suivi votre collection <1>\",[\"1\"],\"\"],\"48e2R8\":[\"Modifier l'e-mail\"],\"49voTZ\":[[\"label\"],\" (\",[\"count\"],\")\"],\"4B6w_o\":[\"Recommandé !\"],\"4GKuCs\":[\"Connexion échouée\"],\"4HH9iB\":[\"Aucun abonnement pour le moment.\"],\"4OjqAQ\":[\"Continuer l'édition\"],\"4RtQ1k\":[\"Ne plus suivre \",[\"targetUsername\"]],\"4c-qBx\":[\"Votre mot de passe a été modifié. Vous pouvez maintenant vous connecter.\"],\"4yj9xV\":[\"Les mises à jour en direct sont temporairement interrompues. Tentative de reconnexion…\"],\"5KHDCi\":[[\"0\"],\" et \",[\"1\"],\" sont en train d'écrire…\"],\"5NZ3tg\":[\"Désactivation…\"],\"5TviPn\":[\"Annuler la recherche\"],\"5cC8f2\":[\"Modifié le \",[\"0\"]],\"5oD9f_\":[\"Plus tôt\"],\"6C4kKS\":[\"Autres instances\"],\"6Qly-0\":[\"un commentaire\"],\"6YE0P6\":[\"Édition de \",[\"0\"]],\"6YtxFj\":[\"Nom\"],\"6_dCYd\":[\"Aperçu\"],\"6gRgw8\":[\"Réessayer\"],\"7PHCIN\":[\"Annuler la suppression\"],\"7PzzBU\":[\"Utilisateur\"],\"7d1a0d\":[\"Public\"],\"7noMWp\":[\"Rien de neuf cette semaine.\"],\"7sNhEz\":[\"Nom d'utilisateur\"],\"8-8abB\":[\"Déconnecté — reconnexion…\"],\"8F1i42\":[\"Page introuvable\"],\"8JplJJ\":[\"Désabonné\"],\"8Ug9jB\":[\"Connexe\"],\"8ZsakT\":[\"Mot de passe\"],\"8rPWOT\":[\"Connexion impossible\"],\"92o1-U\":[\"Suppression échouée\"],\"9BruTc\":[\"Pourquoi ?\"],\"9eEYEq\":[\"Ce lien de connexion est incomplet.\"],\"9l4qcT\":[\"Déposez un fichier de remplacement ici\"],\"9uI_rE\":[\"Annuler\"],\"A0y396\":[\"+ Inviter quelqu'un\"],\"A1taO8\":[\"Rechercher\"],\"AEfu-D\":[\"Dans les collections\"],\"AHZflp\":[\"Tribune\"],\"AQbgNR\":[\"Suivre \",[\"targetUsername\"]],\"AS7WoE\":[\"Repartir de zéro\"],\"ATGYL1\":[\"Adresse e-mail\"],\"AZctoV\":[[\"0\",\"plural\",{\"one\":[\"#\",\" commentaire\"],\"other\":[\"#\",\" commentaires\"]}]],\"Ade-6d\":[\"Mises à jour en direct indisponibles.\"],\"AeXO77\":[\"Compte\"],\"AhNP40\":[\"Position\"],\"AnRu_j\":[\"Annuler la réponse\"],\"AwUsnG\":[\"Instances\"],\"B4LeYP\":[\"Échec de la suppression (\",[\"0\"],\")\"],\"BjitBo\":[\"Télécharger \",[\"0\"]],\"BlpJ2G\":[\"Reprise de votre brouillon.\"],\"CI50ct\":[\"Voté\"],\"CJkEfx\":[\"Bloquer\"],\"C_qQE4\":[\"Déjà recommandé par \",[\"0\"],\" \",[\"1\"]],\"Cf_gxi\":[\"Ne plus recevoir le résumé hebdomadaire ?\"],\"Cj24wt\":[\"Inscription…\"],\"CnqayG\":[\"La mise à jour a échoué. Réessayez.\"],\"D8DRYV\":[\"Supprimer ce message ?\"],\"DI3NBO\":[\"Ouvrir sur \",[\"0\"]],\"DPfwMq\":[\"Terminé\"],\"DdeHXH\":[\"Supprimer cette reco ? Cette action est irréversible.\"],\"Dp1JhP\":[\"<0>\",[\"0\"],\" a voté pour <1>\",[\"1\"],\"\"],\"E417RG\":[\"Vous ne recevrez plus le résumé hebdomadaire. Vous pouvez le réactiver dans vos paramètres.\"],\"EBU6O6\":[\"Connexion perdue — ce message n'a peut-être pas été envoyé\"],\"ECiS12\":[\"Voir la reco →\"],\"ED8n0z\":[\"la tribune\"],\"EarrCe\":[\"Rechercher un emoji\"],\"Evcm2Z\":[\"Fermer sans publier ? Le fichier joint sera perdu — ce que vous avez écrit sera conservé.\"],\"EwVrWF\":[\"Le dump n'a pas pu être retiré. Réessayez.\"],\"ExR0Fr\":[\"L'URL est obligatoire.\"],\"F5Js1v\":[\"Ne plus suivre la collection\"],\"FdTlEG\":[\"Piste \",[\"0\"]],\"FgAxTj\":[\"Se déconnecter\"],\"Fxf4jq\":[\"Description (facultatif)\"],\"GCWCCo\":[\"Fermer le lecteur\"],\"GDvlUT\":[\"Rôle\"],\"GLukaH\":[\"Modérateur\"],\"GNSsCc\":[\"Impossible de créer la collection\"],\"GQ38dl\":[[\"unreadChatCount\"],\" messages non lus\"],\"GY6uSc\":[\"Suivant →\"],\"GbqhrN\":[[\"0\"],\"–\",[\"1\"],\" caractères : lettres, chiffres ou tirets bas\"],\"GptGxg\":[\"Changer le mot de passe\"],\"Gv5nA5\":[\"Format de réponse inattendu\"],\"H4MGkI\":[\"Agrandir le lecteur\"],\"H4o4sk\":[\"Personne pour le moment.\"],\"H8pzW-\":[\"Impossible de mettre à jour l'avatar\"],\"HTLDA4\":[\"Chargement…\"],\"H_PnT8\":[\"Insérer un emoji\"],\"I-x669\":[\"Invités\"],\"IF7RiR\":[\"Couverture\"],\"IO9KL_\":[\"Piste suivante\"],\"IZX7TO\":[\"Impossible de générer une invitation\"],\"IagCbF\":[\"URL\"],\"IgrLD_\":[\"Pause\"],\"IhK90M\":[\"Lettres, chiffres et tirets bas seulement\"],\"ImOQa9\":[\"Répondre\"],\"JJ-Bhk\":[\"Votre adresse e-mail\"],\"JLasL-\":[\"Désabonnement impossible\"],\"JRQitQ\":[\"Confirmer le nouveau mot de passe\"],\"JXr41k\":[\"<0>\",[\"0\"],\" a commenté sur <1>\",[\"1\"],\"\"],\"Jd58Fo\":[\"Tendances\"],\"Jf0PuK\":[\"Aller à la connexion\"],\"JlFcis\":[\"Envoyer\"],\"JrFTcr\":[\"Connexion…\"],\"K7tIrx\":[\"Catégorie\"],\"KDGWg5\":[\"Retirer de la collection\"],\"KDw4GX\":[\"Réessayer\"],\"KKZxBU\":[\"Envoi \",[\"0\"],\" %\"],\"K_F6pa\":[\"Enregistrement…\"],\"KtYF-t\":[\"Sons\"],\"L-rMC9\":[\"Réinitialiser par défaut\"],\"L7_rsx\":[\"Envoi de l'image…\"],\"MHrjPM\":[\"Titre\"],\"MKEPCY\":[\"Suivre\"],\"MTb2Ot\":[\"Aucun message pour l'instant. Dites bonjour !\"],\"MbkoRn\":[\"Ou rejoignez-nous avec votre compte d'un autre gerbeur\"],\"Mj6oCJ\":[[\"0\"],\" est en train d'écrire…\"],\"MrIc3x\":[\"Ou connectez-vous avec votre compte d'un autre gerbeur\"],\"N40H-G\":[\"Tout\"],\"N6j2JH\":[\"Modifier \",[\"0\"]],\"NUrY9o\":[\"Catégories\"],\"Nu4oKW\":[\"Description\"],\"O32mmL\":[\"Modifier la description\"],\"O3oNi5\":[\"E-mail\"],\"Oprv1v\":[\"Mot de passe (min. \",[\"0\"],\" caractères)\"],\"P5MuiB\":[\"Ajouter une image\"],\"PJTy3N\":[[\"totalUnread\",\"plural\",{\"one\":[\"#\",\" nouvelle\"],\"other\":[\"#\",\" nouvelles\"]}]],\"PN3pBl\":[\"Pas de réponse du serveur — ce message n'a peut-être pas été envoyé\"],\"PUe8Yk\":[\"Réduire le lecteur\"],\"PiH3UR\":[\"Copié !\"],\"Pn2B7_\":[\"Mot de passe actuel\"],\"Pwqkdw\":[\"Chargement…\"],\"Q4WUjR\":[\"Rechercher un emoji…\"],\"Q6n4F4\":[\"Actualiser les métadonnées\"],\"QGaQRo\":[\"Erreur lors de la mise à jour du rôle\"],\"QKsaQr\":[\"ou <0>parcourir les fichiers\"],\"QLtPBd\":[\"Aucune reco dans cette collection pour l'instant.\"],\"QctOgc\":[\"Impossible de joindre le serveur. Vérifiez votre connexion et réessayez.\"],\"R7SsBE\":[\"Couper le son\"],\"R9Khdg\":[\"Auto\"],\"RCcPrX\":[\"Supprimer cette collection ? Cette action est irréversible.\"],\"RLe7Vk\":[\"Vérification…\"],\"RTksSy\":[\"<0>\",[\"0\"],\" a commencé à vous suivre\"],\"RaKjrM\":[\"Impossible d'enregistrer la modification\"],\"RcUHRT\":[\"Suivi\"],\"RfwZxd\":[\"Réinitialiser le mot de passe\"],\"Rrp6-J\":[\"Se connecter pour aimer\"],\"RvVJBH\":[\"Actualisation du flux…\"],\"S1xV5B\":[[\"maxLength\"],\" caractères au maximum.\"],\"SBTElJ\":[\"Recherche…\"],\"SLaP1b\":[\"Compte d'ailleurs\"],\"SMaFdc\":[\"Se désabonner\"],\"Sad2tK\":[\"Envoi…\"],\"So7gCD\":[\"Collez un lien…\"],\"StovX6\":[\"Rien à voir, circulez.\"],\"Sxm8rQ\":[\"Utilisateurs\"],\"T8ejtZ\":[\"Ce commentaire n'a pas pu être supprimé. Réessayez.\"],\"T91vKp\":[\"Lecture\"],\"T9bjWt\":[\"<0>\",[\"0\"],\" a été ajouté à <1>\",[\"1\"],\"\"],\"TAkYGZ\":[\"Votre compte est sur \",[\"home\"],\" : connectez-vous aux autres instances depuis là-bas.\"],\"TAtbho\":[\"Chargement des messages…\"],\"TN382O\":[\"Lien invalide\"],\"ToADL_\":[\"<0>\",[\"name\"],\" (\",[\"host\"],\") demande à vous connecter avec votre compte d'ici, <1>@\",[\"username\"],\". Il recevra votre nom d'utilisateur, votre adresse e-mail et votre avatar.\"],\"Tv9vbB\":[\"Suivre la collection\"],\"Tz0i8g\":[\"Paramètres\"],\"U3pytU\":[\"Administrateur\"],\"UNMVei\":[\"Mot de passe oublié ?\"],\"UOV0wi\":[\"Connexion…\"],\"UOZith\":[\"Publication échouée\"],\"URAieT\":[\"Se connecter pour voter\"],\"V38P77\":[\"Seuls son auteur et les modérateurs peuvent modifier ce dump.\"],\"VCoEm-\":[\"Retour à la connexion\"],\"VKsaTi\":[\"En réponse à\"],\"VLAd8f\":[\"Max \",[\"limit\"]],\"V_e7nf\":[\"Définir un nouveau mot de passe\"],\"VnNJbN\":[\"De collections\"],\"VsMqsD\":[\"Son adresse, comme music.example\"],\"VskHIx\":[\"Supprimer la catégorie\"],\"VyTYmS\":[\"Changer l'avatar\"],\"W5A0Ly\":[\"Une erreur inattendue s'est produite.\"],\"W9FRBT\":[\"Aimer\"],\"WAcnnR\":[\"L'image n'a pas pu être envoyée.\"],\"WE_r9K\":[\"Échec de la création de la catégorie\"],\"WMw63e\":[\"Impossible de joindre cette instance\"],\"WfffrI\":[\"identifiant\"],\"WhimMi\":[\"Échec de la réinitialisation\"],\"WpXcBJ\":[\"Rien ici pour l'instant.\"],\"XHqhoS\":[\"Impossible de charger le chat.\"],\"XJVYo8\":[\"Pourquoi & où\"],\"XJy2oN\":[\"Connexion…\"],\"XWbTfu\":[\"utilisée \",[\"0\"]],\"Xan6QP\":[\"Nouvelle reco\"],\"XgRtUf\":[\"Impossible de changer le mot de passe\"],\"XnL-Eu\":[\"Aucun utilisateur ne correspond à « \",[\"q\"],\" ».\"],\"Xs2Lez\":[\"Ce lien de réinitialisation est absent ou malformé.\"],\"YK1Dhc\":[\"une publication\"],\"YWnSuq\":[\"Ce lien de désabonnement est absent ou mal formé.\"],\"YZxXK8\":[\"Fermer le sélecteur d'emoji\"],\"YcjhhX\":[\"Gestion utilisateur\"],\"Ye9RMF\":[\"<0>\",[\"0\"],\" a aimé votre commentaire sur <1>\",[\"1\"],\"\"],\"YpkCca\":[\"Pas encore de collections suivies.\"],\"Z5HWHd\":[\"Activés\"],\"ZBdbv9\":[\"Modifier le titre\"],\"ZCpU0u\":[\"Aucune collection ne correspond à « \",[\"q\"],\" ».\"],\"ZWxjuD\":[\"Certaines images n'ont pas pu être envoyées.\"],\"ZmD2o6\":[\"Créer et ajouter\"],\"_0oJwI\":[\"Approuver\"],\"_3O5R_\":[\"Échec de la demande\"],\"_DwR-n\":[\"Création…\"],\"_I1_HN\":[\"Minuscules, chiffres et tirets simples seulement\"],\"_R_sGB\":[\"Mot de passe modifié avec succès.\"],\"_aept4\":[\"Publier la réponse\"],\"_cF7Rs\":[\"Volume\"],\"_eZzBf\":[\"Se connecter ailleurs\"],\"_karOe\":[\"Hors ligne — message non envoyé\"],\"_nT6AE\":[\"Nouveau mot de passe\"],\"_t4W-i\":[\"De personnes\"],\"aAIQg2\":[\"Apparence\"],\"aDvLhk\":[\"Ajouter un commentaire…\"],\"az8lvo\":[\"Désactivés\"],\"b3Thhd\":[\"Envoi échoué\"],\"b8XMJ8\":[[\"visibleCount\",\"plural\",{\"one\":[\"#\",\" commentaire\"],\"other\":[\"#\",\" commentaires\"]}]],\"bQhwn-\":[\"Chargement de la collection…\"],\"b_1P1D\":[\"Renommage…\"],\"b_VouM\":[\"Votre compte est sur \",[\"home\"],\" : votre mot de passe, votre adresse e-mail, votre avatar et votre nom d'utilisateur se changent là-bas.\"],\"bzSI52\":[\"Abandonner\"],\"cILfnJ\":[\"Supprimer le fichier\"],\"cNu4my\":[[\"0\"],\" de plus en ligne : \",[\"restNames\"]],\"cYP9Sb\":[\"+ Collection\"],\"cbeBbZ\":[\"Au moins \",[\"0\"],\" caractères\"],\"cnGeoo\":[\"Supprimer\"],\"dAs22m\":[\"Remplacer le fichier\"],\"dEgA5A\":[\"Annuler\"],\"dMizp8\":[\"Nouvelle collection\"],\"dau1Pl\":[[\"unseenCount\"],\" nouveaux messages\"],\"digest.community\":[\"Communauté\"],\"digest.count.comments\":[[\"n\",\"plural\",{\"one\":[\"commentaire\"],\"other\":[\"commentaires\"]}]],\"digest.count.upvotes\":[[\"n\",\"plural\",{\"one\":[\"vote\"],\"other\":[\"votes\"]}]],\"digest.invitedBy\":[\"sur invitation de @\",[\"username\"]],\"digest.invitedByYou\":[\"sur votre invitation\"],\"digest.monthly\":[\"Récap mensuel\"],\"digest.monthly.off\":[\"Ne plus recevoir le récap mensuel\"],\"digest.newMembers\":[\"Nouveaux membres\"],\"digest.newPlaylists\":[\"Nouvelles collections publiques\"],\"digest.stat.chat\":[[\"n\",\"plural\",{\"one\":[\"message dans la tribune\"],\"other\":[\"messages dans la tribune\"]}]],\"digest.stat.dumps\":[[\"n\",\"plural\",{\"one\":[\"reco\"],\"other\":[\"recos\"]}]],\"digest.topMonth\":[\"Les plus votées du mois\"],\"digest.topWeek\":[\"Les plus votées de la semaine\"],\"digest.weekly\":[\"Résumé hebdomadaire\"],\"digest.weekly.off\":[\"Ne plus recevoir le résumé hebdomadaire\"],\"dqwCfR\":[\"Impossible de charger un aperçu pour ce lien — vérifiez-le, ou publiez-le tel quel et actualisez l'aperçu plus tard.\"],\"dznB-Y\":[\"Seules les images peuvent être déposées ici.\"],\"eFSqvc\":[\"Impossible de publier la réponse\"],\"eIEHHV\":[\"Changer la couleur de peau\"],\"eOfXq3\":[\"Un titre est requis.\"],\"ePK91l\":[\"Modifier\"],\"eaUTwS\":[\"Envoyer le lien de réinitialisation\"],\"ecUA8p\":[\"Aujourd'hui\"],\"ef9nPf\":[\"Chargement de la reco…\"],\"eloqXQ\":[\"Vous pouvez la publier quand même.\"],\"email.digest.addedTo\":[\"ajoutée à \",[\"playlist\"]],\"email.digest.andMore\":[\"et \",[\"n\"],\" de plus\"],\"email.digest.by\":[\"par @\",[\"username\"]],\"email.digest.chatWeek\":[[\"n\",\"plural\",{\"one\":[\"#\",\" message cette semaine\"],\"other\":[\"#\",\" messages cette semaine\"]}]],\"email.digest.communityPage\":[\"Tout voir sur la page de la communauté\"],\"email.digest.count.followers\":[[\"n\",\"plural\",{\"one\":[\"nouvel abonné\"],\"other\":[\"nouveaux abonnés\"]}]],\"email.digest.count.likes\":[[\"n\",\"plural\",{\"one\":[\"j'aime sur vos commentaires\"],\"other\":[\"j'aime sur vos commentaires\"]}]],\"email.digest.count.mentions\":[[\"n\",\"plural\",{\"one\":[\"mention\"],\"other\":[\"mentions\"]}]],\"email.digest.count.playlistFollows\":[[\"n\",\"plural\",{\"one\":[\"abonnement à vos collections\"],\"other\":[\"abonnements à vos collections\"]}]],\"email.digest.forYou\":[\"Pour vous\"],\"email.digest.hl.comment\":[[\"who\"],\" a commenté votre reco \",[\"target\"]],\"email.digest.hl.commentLike\":[[\"who\"],\" a aimé votre commentaire sur \",[\"target\"]],\"email.digest.hl.mentionComment\":[[\"who\"],\" vous a mentionné dans un commentaire sur \",[\"target\"]],\"email.digest.hl.mentionEveryone\":[[\"who\"],\" a mentionné tout le monde dans \",[\"target\"]],\"email.digest.hl.mentionIn\":[[\"who\"],\" vous a mentionné dans \",[\"target\"]],\"email.digest.hl.mentionPlaylist\":[[\"who\"],\" vous a mentionné dans la collection \",[\"target\"]],\"email.digest.hl.playlistFollow\":[[\"who\"],\" a suivi votre collection \",[\"target\"]],\"email.digest.hl.userFollow\":[[\"who\"],\" vous suit désormais\"],\"email.digest.inChat\":[\"Dans la tribune\"],\"email.digest.monthly.reason\":[\"Vous recevez ce récap mensuel car il est activé dans vos paramètres.\"],\"email.digest.monthly.subject\":[\"Le mois sur \",[\"site\"],\", \",[\"range\"]],\"email.digest.monthly.title\":[\"Le mois sur \",[\"site\"]],\"email.digest.more\":[[\"n\"],\" de plus dans votre fil Suivi\"],\"email.digest.network\":[\"De ceux que vous suivez\"],\"email.digest.openChat\":[\"Ouvrir la tribune\"],\"email.digest.playlistMeta\":[\"par @\",[\"username\"],\" · \",[\"n\",\"plural\",{\"one\":[\"#\",\" reco\"],\"other\":[\"#\",\" recos\"]}]],\"email.digest.pre.members\":[[\"n\",\"plural\",{\"one\":[\"#\",\" nouveau membre\"],\"other\":[\"#\",\" nouveaux membres\"]}]],\"email.digest.pre.network\":[[\"n\",\"plural\",{\"one\":[\"#\",\" nouvelle reco de ceux que vous suivez\"],\"other\":[\"#\",\" nouvelles recos de ceux que vous suivez\"]}]],\"email.digest.pre.playlists\":[[\"n\",\"plural\",{\"one\":[\"#\",\" nouvelle collection\"],\"other\":[\"#\",\" nouvelles collections\"]}]],\"email.digest.pre.topMonth\":[[\"n\",\"plural\",{\"one\":[\"la reco la plus votée du mois\"],\"other\":[\"les \",\"#\",\" recos les plus votées du mois\"]}]],\"email.digest.pre.topWeek\":[[\"n\",\"plural\",{\"one\":[\"la reco la plus votée de la semaine\"],\"other\":[\"les \",\"#\",\" recos les plus votées de la semaine\"]}]],\"email.digest.seeAll\":[[\"n\",\"plural\",{\"one\":[\"Voir la notification\"],\"other\":[\"Voir les \",\"#\",\" notifications\"]}]],\"email.digest.theChat\":[\"la tribune\"],\"email.digest.totals\":[[\"dumps\",\"plural\",{\"one\":[\"#\",\" reco\"],\"other\":[\"#\",\" recos\"]}],\", \",[\"upvotes\",\"plural\",{\"one\":[\"#\",\" vote\"],\"other\":[\"#\",\" votes\"]}],\" et \",[\"comments\",\"plural\",{\"one\":[\"#\",\" commentaire\"],\"other\":[\"#\",\" commentaires\"]}],\".\"],\"email.digest.upload\":[\"fichier\"],\"email.digest.weekly.reason\":[\"Vous recevez ce résumé hebdomadaire car il est activé dans vos paramètres.\"],\"email.digest.weekly.subject\":[\"Votre semaine sur \",[\"site\"],\", \",[\"range\"]],\"email.digest.weekly.title\":[\"Votre semaine, \",[\"username\"]],\"email.digest.yours\":[\"à vous\"],\"email.reset.body\":[\"Quelqu'un a demandé à réinitialiser le mot de passe de votre compte \",[\"site\"],\". Le bouton ci-dessous vous permet d'en choisir un nouveau. Il ne fonctionne qu'une fois, pendant \",[\"hours\",\"plural\",{\"one\":[\"#\",\" heure\"],\"other\":[\"#\",\" heures\"]}],\".\"],\"email.reset.button\":[\"Choisir un nouveau mot de passe\"],\"email.reset.fallback\":[\"Si le bouton ne fonctionne pas, collez ce lien dans votre navigateur :\"],\"email.reset.hi\":[\"Bonjour \",[\"username\"],\",\"],\"email.reset.ignore\":[\"Si vous n'êtes pas à l'origine de cette demande, ignorez cet e-mail. Votre mot de passe ne change pas.\"],\"email.reset.preheader\":[\"Le lien ne fonctionne qu'une fois, pendant \",[\"hours\",\"plural\",{\"one\":[\"#\",\" heure\"],\"other\":[\"#\",\" heures\"]}],\".\"],\"email.reset.reason\":[\"Vous recevez cet e-mail car une réinitialisation de mot de passe a été demandée pour cette adresse.\"],\"email.reset.subject\":[\"Réinitialisez votre mot de passe \",[\"site\"]],\"email.reset.title\":[\"Réinitialiser votre mot de passe\"],\"email.settings\":[\"Paramètres\"],\"email.welcome.body\":[\"# Bienvenue sur \",[\"site\"],\" !\\n\\nBonjour **\",[\"username\"],\"**,\\n\\nVotre compte a bien été créé. Bienvenue à bord !\"],\"email.welcome.button\":[\"Ouvrir \",[\"site\"]],\"email.welcome.digests\":[\"Chaque semaine, vous recevrez un résumé de ce qui s'est passé ici, et chaque mois un récap des recos les plus votées. Vous pouvez désactiver l'un ou l'autre dans vos paramètres.\"],\"email.welcome.preheader\":[\"Votre compte est prêt.\"],\"email.welcome.reason\":[\"Vous recevez cet e-mail car un compte \",[\"site\"],\" a été créé avec cette adresse.\"],\"email.welcome.subject\":[\"Bienvenue sur \",[\"site\"]],\"en9o7K\":[\"Impossible de publier le commentaire\"],\"etFQQS\":[\"Pourquoi on en voudrait ?\"],\"f3cEDO\":[\"Changer l'image\"],\"fC6mXb\":[\"Voter\"],\"fI-mNw\":[\"Collections\"],\"fgLNSM\":[\"S'inscrire\"],\"fn1ZQX\":[\"Se connecter à \",[\"name\"],\" ?\"],\"gANddk\":[\"Envoi…\"],\"gGx5tM\":[\"Modification\"],\"gIQQwD\":[\"Chargement échoué\"],\"gIpLuy\":[\"Il faut un lien\"],\"gL9KKi\":[\"Qui peut la voir\"],\"gLfZlz\":[\"Ajouter à la collection\"],\"gjJ-sb\":[\"Impossible de se connecter au serveur de mises à jour en direct. Les votes et les notifications pourraient ne pas se synchroniser avant la reconnexion.\"],\"goWEhR\":[\"Piste précédente\"],\"hBuUKa\":[\"Changer le mot de passe…\"],\"hD7w09\":[\"Vous avez tout lu, tout vu, tout bu.\"],\"hJSliC\":[\"<0>\",[\"0\"],\" a publié <1>\",[\"1\"],\"\"],\"hLAe-z\":[\"Retour à la page de connexion\"],\"hT8hgO\":[\"Rétablir le titre suggéré\"],\"hYgDIe\":[\"Créer\"],\"he3ygx\":[\"Copier\"],\"hpCc_Z\":[\"Fermer quand même\"],\"i7K_Te\":[\"Qui suis-je ?\"],\"iDNBZe\":[\"Notifications\"],\"iWpEwy\":[\"Accueil\"],\"ipYn7W\":[\"Si cette adresse est enregistrée, vous recevrez un lien de réinitialisation sous peu.\"],\"isRobC\":[\"Nouveau\"],\"jTGs8A\":[\"Ce site n'envoie pas d'e-mails, aucun résumé ne part donc.\"],\"jZNg18\":[\"Compte sur <0>\",[\"host\"],\"\"],\"jbernk\":[\"Chargement du profil…\"],\"jnrIbz\":[\"Voté (\",[\"0\"],\")\"],\"joEmfT\":[\"Serveur inaccessible\"],\"jrZTZl\":[\"Pas encore de recos. Soyez le premier !\"],\"k112DD\":[\"Charger les messages plus anciens\"],\"k36iJ-\":[\"Échec de l’enregistrement de la catégorie\"],\"k4b5_X\":[\"modifié\"],\"kLttbL\":[\"Inscription échouée\"],\"lUanmi\":[\"Vous serez notifié lorsque quelqu'un suit vos collections, vote pour vos recos ou publie du nouveau contenu.\"],\"lY5h1V\":[[\"0\",\"plural\",{\"one\":[\"#\",\" reco\"],\"other\":[\"#\",\" recos\"]}]],\"lcfvr_\":[\"Supprimer ce commentaire ?\"],\"lpIMne\":[\"Les mots de passe ne correspondent pas\"],\"m9Uf3I\":[\"Les utilisateurs d'une instance approuvée se connectent ici avec leur compte de là-bas. Ceux d'une instance bloquée ne le peuvent pas. Ceux de toute autre instance ont besoin d'une invitation.\"],\"mDJo8W\":[\"Recos (\",[\"0\"],\")\"],\"mb_Wju\":[\"Déposez un fichier ici, ou collez-en un\"],\"mt6O6E\":[\"C'est un mirage.\"],\"nbm5sI\":[\"Aucune reco ne correspond à « \",[\"q\"],\" ».\"],\"nrjqON\":[\"Vérification de l'invitation…\"],\"nucyoV\":[\"<0>\",[\"0\"],\" a mentionné tout le monde dans <1>\",[\"where\"],\"\"],\"nwtY4N\":[\"Une erreur est survenue\"],\"nx4kaN\":[\"Sauvegarde impossible\"],\"oTYvvN\":[[\"0\",\"plural\",{\"one\":[\"et \",\"#\",\" reco plus ancienne\"],\"other\":[\"et \",\"#\",\" recos plus anciennes\"]}]],\"oW3yYY\":[\"Ce mois-ci\"],\"ogtYkT\":[\"Mot de passe mis à jour\"],\"pCpd9p\":[\"<0>\",[\"0\"],\" vous a mentionné dans <1>\",[\"where\"],\"\"],\"pSheLH\":[\"Aucun invité pour le moment.\"],\"pd3FCq\":[\"Ce fichier dépasse \",[\"limit\"],\".\"],\"pvnfJD\":[\"Sombre\"],\"q018gJ\":[\"Impossible d'ajouter cette instance\"],\"qIMfNQ\":[\"Supprimer la collection\"],\"qItrqH\":[\"Vous ne recevrez plus le récap mensuel. Vous pouvez le réactiver dans vos paramètres.\"],\"qVdjD5\":[\"Approuvée\"],\"qbDAcy\":[\"Recommander\"],\"qgx_78\":[\"Suivez des collections publiques pour voir leurs recos ici.\"],\"qnUJBI\":[\"Le nouvel ordre n'a pas pu être enregistré. Réessayez.\"],\"qsqt0w\":[\"Lien d'invitation\"],\"qvFa8r\":[\"public\"],\"qvz_Pp\":[\"Reco\"],\"rCbqPX\":[\"Ce lien d'invitation est manquant, expiré ou déjà utilisé.\"],\"rDMzDU\":[\"Écrivez un message…\"],\"rg9pXu\":[\"Recherche échouée\"],\"rn6SBY\":[\"Rétablir le son\"],\"sEXJPi\":[\"Lien ou fichier\"],\"sGeXL3\":[\"Miniature\"],\"sQia9P\":[\"Se connecter\"],\"sTiqbm\":[\"invité par\"],\"sdP5Aa\":[\"[supprimé]\"],\"sgX7B-\":[\"Usage unique, valable 7 jours.\"],\"shHs8T\":[\"Saisissez une recherche.\"],\"smeBfS\":[\"Invitation invalide\"],\"tOHgQw\":[\"Continuer en tant que @\",[\"username\"]],\"teaneZ\":[\"image\"],\"tfDRzk\":[\"Enregistrer\"],\"tvmuQ0\":[\"Thème de couleur\"],\"tyiiHe\":[\"Rien de neuf ce mois-ci.\"],\"u1lDX2\":[\"Récupération de l'aperçu…\"],\"u8pttd\":[\"Le changer sur \",[\"home\"]],\"uACFmj\":[\"Se connecter avec \",[\"0\"]],\"uD0qXQ\":[\"Déposez un fichier ici\"],\"uISnsY\":[\"Suppression impossible\"],\"uMGUnV\":[\"Pas encore de collections.\"],\"ub1EEL\":[\"modifié \",[\"0\"]],\"uomLas\":[\"Ajouter une catégorie\"],\"v-Wp--\":[\"Ouvrir la source\"],\"v6Lbin\":[\"L'adresse d'une instance, comme music.example\"],\"vJBF1r\":[\"Publication…\"],\"vLhLLO\":[\"Notifications (\",[\"unreadNotificationCount\"],\" non lues)\"],\"vQMkHu\":[\"Retirer le vote\"],\"vuosjb\":[\"Menu utilisateur\"],\"w61W3L\":[\"Retirer \",[\"0\"]],\"wckWOP\":[\"Administration\"],\"wixIgH\":[\"Vous avez déjà un compte ? <0>Se connecter\"],\"wtxFp4\":[\"Fichier trop volumineux (max \",[\"max\"],\").\"],\"x6tjuK\":[\"Onglet par défaut\"],\"xEWkgZ\":[\"← Retour à toutes les recos\"],\"xGVfLh\":[\"Continuer\"],\"xPHtx0\":[\"Lancer la recherche\"],\"xVuNgt\":[\"+ Nouvelle collection\"],\"xc9O_u\":[\"Supprimer la reco\"],\"y1G_DI\":[\"Renommage impossible\"],\"y6sq5j\":[\"Abonné\"],\"yA_6BX\":[\"Tout voir →\"],\"yBBtRm\":[\"Suivez des utilisateurs pour voir leurs recos ici.\"],\"yByRxz\":[\"Cette semaine\"],\"yQ2kGp\":[\"Charger plus\"],\"y_0uwd\":[\"Hier\"],\"yxlcv5\":[\"Ne plus recevoir le récap mensuel ?\"],\"yz7wBu\":[\"Fermer\"],\"yzF66j\":[\"Lien\"],\"z0ROB3\":[\"Retirer le j'aime\"],\"z1uNN0\":[\"Aucun emoji trouvé.\"],\"zVuxvN\":[\"Actualisation…\"],\"zwBp5t\":[\"Privé\"]}"); \ No newline at end of file diff --git a/locales/fr.po b/locales/fr.po index dfebb83d..287c9dfc 100644 --- a/locales/fr.po +++ b/locales/fr.po @@ -51,7 +51,7 @@ msgstr "{0} de plus en ligne : {restNames}" #. placeholder {0}: VALIDATION.USERNAME_MIN #. placeholder {1}: VALIDATION.USERNAME_MAX -#: src/pages/UserRegister.tsx:145 +#: src/pages/UserRegister.tsx:147 msgid "{0}–{1} characters: letters, numbers, or underscores" msgstr "{0}–{1} caractères : lettres, chiffres ou tirets bas" @@ -280,6 +280,10 @@ msgstr "<0>{0} a voté pour <1>{1}" msgid "<0>{0} was added to <1>{1}" msgstr "<0>{0} a été ajouté à <1>{1}" +#: src/pages/Authorize.tsx:138 +msgid "<0>{name} ({host}) asks to sign you in with your account here, <1>@{username}. It will receive your username, your email address and your avatar." +msgstr "<0>{name} ({host}) demande à vous connecter avec votre compte d'ici, <1>@{username}. Il recevra votre nom d'utilisateur, votre adresse e-mail et votre avatar." + #: src/components/chat/ChatModal.tsx:778 msgid "1 new message" msgstr "1 nouveau message" @@ -296,10 +300,14 @@ msgstr "Il faut un lien" msgid "a post" msgstr "une publication" -#: src/pages/Settings.tsx:85 +#: src/pages/Settings.tsx:89 msgid "Account" msgstr "Compte" +#: src/components/profile/ProfileHeader.tsx:144 +msgid "Account on <0>{host}" +msgstr "Compte sur <0>{host}" + #: src/components/comment/CommentThread.tsx:102 msgid "Add a comment…" msgstr "Ajouter un commentaire…" @@ -309,7 +317,7 @@ msgstr "Ajouter un commentaire…" msgid "Add category" msgstr "Ajouter une catégorie" -#: src/components/profile/ProfileHeader.tsx:153 +#: src/components/profile/ProfileHeader.tsx:173 msgid "Add email…" msgstr "Ajouter un e-mail…" @@ -342,10 +350,14 @@ msgstr "Tout" msgid "Already dumped by {0} {1}" msgstr "Déjà recommandé par {0} {1}" -#: src/pages/UserRegister.tsx:175 +#: src/pages/UserRegister.tsx:179 msgid "Already have an account? <0>Log in" msgstr "Vous avez déjà un compte ? <0>Se connecter" +#: src/components/federation/PeerManager.tsx:149 +msgid "An instance's address, like music.example" +msgstr "L'adresse d'une instance, comme music.example" + #: src/utils/shared/api.ts:35 msgid "An unexpected error occurred." msgstr "Une erreur inattendue s'est produite." @@ -355,14 +367,14 @@ msgstr "Une erreur inattendue s'est produite." msgid "email.digest.andMore" msgstr "et {n} de plus" -#: src/pages/Settings.tsx:101 +#: src/pages/Settings.tsx:134 msgid "Appearance" msgstr "Apparence" #. placeholder {0}: VALIDATION.PASSWORD_MIN #: src/components/profile/ChangePasswordModal.tsx:101 #: src/pages/ResetPassword.tsx:124 -#: src/pages/UserRegister.tsx:164 +#: src/pages/UserRegister.tsx:166 msgid "At least {0} characters" msgstr "Au moins {0} caractères" @@ -370,7 +382,7 @@ msgstr "Au moins {0} caractères" msgid "At most {maxLength} characters." msgstr "{maxLength} caractères au maximum." -#: src/pages/Settings.tsx:46 +#: src/pages/Settings.tsx:48 msgid "Auto" msgstr "Auto" @@ -379,6 +391,18 @@ msgstr "Auto" msgid "Back to login" msgstr "Retour à la connexion" +#: src/pages/FederationCallback.tsx:66 +msgid "Back to the login page" +msgstr "Retour à la page de connexion" + +#: src/components/federation/PeerManager.tsx:163 +msgid "Block" +msgstr "Bloquer" + +#: src/components/federation/PeerManager.tsx:33 +msgid "Blocked" +msgstr "Bloquée" + #. js-lingui-explicit-id #: api/mail/digest.ts:225 msgid "email.digest.by" @@ -394,6 +418,11 @@ msgstr "par @{username} · {n, plural, one {# reco} other {# recos}}" msgid "Can't connect to the live updates server. Upvotes and notifications may not sync until it reconnects." msgstr "Impossible de se connecter au serveur de mises à jour en direct. Les votes et les notifications pourraient ne pas se synchroniser avant la reconnexion." +#: src/pages/Authorize.tsx:117 +#: src/pages/Authorize.tsx:145 +msgid "Can't sign in there" +msgstr "Connexion impossible" + #: src/components/category/CategoryManager.tsx:225 #: src/components/category/CategoryManager.tsx:226 #: src/components/chat/ChatEditBox.tsx:92 @@ -404,6 +433,7 @@ msgstr "Impossible de se connecter au serveur de mises à jour en direct. Les vo #: src/components/profile/DescriptionEditor.tsx:97 #: src/components/profile/EmailEditor.tsx:83 #: src/components/shared/ConfirmModal.tsx:63 +#: src/pages/Authorize.tsx:158 #: src/pages/Dump.tsx:445 #: src/pages/DumpEdit.tsx:565 msgid "Cancel" @@ -423,7 +453,7 @@ msgid "Cancel search" msgstr "Annuler la recherche" #: src/components/category/CategorySelect.tsx:33 -#: src/pages/Manage.tsx:30 +#: src/pages/Manage.tsx:36 msgid "Categories" msgstr "Catégories" @@ -431,7 +461,7 @@ msgstr "Catégories" msgid "Category" msgstr "Catégorie" -#: src/components/profile/ProfileHeader.tsx:95 +#: src/components/profile/ProfileHeader.tsx:102 msgid "Change avatar" msgstr "Changer l'avatar" @@ -439,12 +469,16 @@ msgstr "Changer l'avatar" msgid "Change image" msgstr "Changer l'image" +#: src/pages/Settings.tsx:101 +msgid "Change it on {home}" +msgstr "Le changer sur {home}" + #: src/components/profile/ChangePasswordModal.tsx:66 #: src/components/profile/ChangePasswordModal.tsx:120 msgid "Change password" msgstr "Changer le mot de passe" -#: src/pages/Settings.tsx:96 +#: src/pages/Settings.tsx:112 msgid "Change password…" msgstr "Changer le mot de passe…" @@ -464,10 +498,14 @@ msgstr "Tribune" msgid "Chat ({unreadChatCount} unread)" msgstr "{unreadChatCount} messages non lus" -#: src/pages/UserRegister.tsx:106 +#: src/pages/UserRegister.tsx:108 msgid "Checking invite…" msgstr "Vérification de l'invitation…" +#: src/components/federation/PeerManager.tsx:154 +msgid "Checking…" +msgstr "Vérification…" + #: src/components/profile/ChangePasswordModal.tsx:75 #: src/components/shared/Modal.tsx:76 msgid "Close" @@ -493,7 +531,7 @@ msgstr "Fermer sans publier ? Le fichier joint sera perdu — ce que vous avez msgid "Collapse player" msgstr "Réduire le lecteur" -#: src/pages/Settings.tsx:110 +#: src/pages/Settings.tsx:143 msgid "Color scheme" msgstr "Thème de couleur" @@ -507,10 +545,22 @@ msgstr "Communauté" msgid "Confirm new password" msgstr "Confirmer le nouveau mot de passe" +#: src/components/federation/FederatedSignIn.tsx:111 +msgid "Connecting…" +msgstr "Connexion…" + #: src/contexts/ws/WSProvider.tsx:757 msgid "Connection lost — this message may not have been sent" msgstr "Connexion perdue — ce message n'a peut-être pas été envoyé" +#: src/components/federation/FederatedSignIn.tsx:113 +msgid "Continue" +msgstr "Continuer" + +#: src/pages/Authorize.tsx:155 +msgid "Continue as @{username}" +msgstr "Continuer en tant que @{username}" + #: src/components/profile/ProfileOwnActions.tsx:99 msgid "Copied!" msgstr "Copié !" @@ -540,6 +590,10 @@ msgstr "Renommage impossible" msgid "Could not save" msgstr "Sauvegarde impossible" +#: src/components/federation/PeerManager.tsx:146 +msgid "Couldn't add that instance" +msgstr "Impossible d'ajouter cette instance" + #: src/components/dump/create/DumpCreateModal.tsx:607 msgid "Couldn't load a preview for this link — check it, or post it as-is and refresh the preview later." msgstr "Impossible de charger un aperçu pour ce lien — vérifiez-le, ou publiez-le tel quel et actualisez l'aperçu plus tard." @@ -548,6 +602,10 @@ msgstr "Impossible de charger un aperçu pour ce lien — vérifiez-le, ou publi msgid "Couldn't load the chat." msgstr "Impossible de charger le chat." +#: src/components/federation/FederatedSignIn.tsx:102 +msgid "Couldn't reach that instance" +msgstr "Impossible de joindre cette instance" + #: src/pages/Unsubscribe.tsx:116 msgid "Couldn't unsubscribe" msgstr "Désabonnement impossible" @@ -576,11 +634,11 @@ msgstr "Création…" msgid "Current password" msgstr "Mot de passe actuel" -#: src/pages/Settings.tsx:48 +#: src/pages/Settings.tsx:50 msgid "Dark" msgstr "Sombre" -#: src/pages/Settings.tsx:121 +#: src/pages/Settings.tsx:154 msgid "Default tab" msgstr "Onglet par défaut" @@ -655,6 +713,10 @@ msgstr "Description (facultatif)" msgid "Discard" msgstr "Abandonner" +#: src/components/federation/GrantList.tsx:84 +msgid "Disconnect" +msgstr "Déconnecter" + #: src/components/chat/ChatModal.tsx:743 msgid "Disconnected — reconnecting…" msgstr "Déconnecté — reconnexion…" @@ -730,7 +792,7 @@ msgstr "Modifier {0}" msgid "Edit description" msgstr "Modifier la description" -#: src/components/profile/ProfileHeader.tsx:151 +#: src/components/profile/ProfileHeader.tsx:171 msgid "Edit email" msgstr "Modifier l'e-mail" @@ -772,11 +834,11 @@ msgstr "Modification" msgid "Editing {0}" msgstr "Édition de {0}" -#: src/pages/Settings.tsx:145 +#: src/pages/Settings.tsx:178 msgid "Email" msgstr "E-mail" -#: src/pages/UserRegister.tsx:152 +#: src/pages/UserRegister.tsx:154 msgid "Email address" msgstr "Adresse e-mail" @@ -822,6 +884,8 @@ msgstr "Impossible de publier le commentaire" msgid "Failed to post reply" msgstr "Impossible de publier la réponse" +#: src/components/federation/GrantList.tsx:98 +#: src/components/federation/PeerManager.tsx:143 #: src/components/playlist/PlaylistEditForm.tsx:185 #: src/components/profile/DescriptionEditor.tsx:99 #: src/components/profile/EmailEditor.tsx:86 @@ -836,7 +900,7 @@ msgstr "Échec de l’enregistrement de la catégorie" msgid "Failed to save edit" msgstr "Impossible d'enregistrer la modification" -#: src/components/profile/ProfileHeader.tsx:162 +#: src/components/profile/ProfileHeader.tsx:182 msgid "Failed to update avatar" msgstr "Impossible de mettre à jour l'avatar" @@ -844,7 +908,7 @@ msgstr "Impossible de mettre à jour l'avatar" msgid "Failed to update role" msgstr "Erreur lors de la mise à jour du rôle" -#: src/pages/Settings.tsx:119 +#: src/pages/Settings.tsx:152 msgid "Feeds" msgstr "Flux" @@ -879,7 +943,7 @@ msgstr "Suivez des utilisateurs pour voir leurs recos ici." #: src/components/feed/FeedTabBar.tsx:43 #: src/components/profile/ProfileFollowTab.tsx:140 -#: src/pages/Settings.tsx:55 +#: src/pages/Settings.tsx:57 #: src/pages/UserPublicProfile.tsx:161 msgid "Followed" msgstr "Suivi" @@ -894,7 +958,7 @@ msgstr "Abonné" msgid "email.digest.forYou" msgstr "Pour vous" -#: src/pages/UserLogin.tsx:97 +#: src/pages/UserLogin.tsx:101 msgid "Forgot password?" msgstr "Mot de passe oublié ?" @@ -929,11 +993,11 @@ msgid "email.reset.hi" msgstr "Bonjour {username}," #: src/components/feed/FeedTabBar.tsx:39 -#: src/pages/Settings.tsx:52 +#: src/pages/Settings.tsx:54 msgid "Hot" msgstr "Tendances" -#: src/pages/UserLogin.tsx:136 +#: src/pages/UserLogin.tsx:142 msgid "If that address is registered you'll receive a reset link shortly." msgstr "Si cette adresse est enregistrée, vous recevrez un lien de réinitialisation sous peu." @@ -965,7 +1029,11 @@ msgstr "Dans la tribune" msgid "Insert emoji" msgstr "Insérer un emoji" -#: src/pages/UserRegister.tsx:117 +#: src/pages/Manage.tsx:43 +msgid "Instances" +msgstr "Instances" + +#: src/pages/UserRegister.tsx:119 msgid "Invalid invite" msgstr "Invitation invalide" @@ -979,7 +1047,7 @@ msgstr "Lien invalide" msgid "Invite link" msgstr "Lien d'invitation" -#: src/components/profile/ProfileHeader.tsx:116 +#: src/components/profile/ProfileHeader.tsx:126 msgid "invited by" msgstr "invité par" @@ -998,8 +1066,12 @@ msgstr "sur votre invitation" msgid "Invitees" msgstr "Invités" +#: src/components/federation/FederatedSignIn.tsx:105 +msgid "Its address, like music.example" +msgstr "Son adresse, comme music.example" + #: src/components/feed/FeedTabBar.tsx:41 -#: src/pages/Settings.tsx:54 +#: src/pages/Settings.tsx:56 msgid "Journal" msgstr "Journal" @@ -1007,11 +1079,16 @@ msgstr "Journal" msgid "Keep editing" msgstr "Continuer l'édition" +#. placeholder {0}: relativeTime(grant.lastUsedAt) +#: src/components/federation/GrantList.tsx:77 +msgid "last used {0}" +msgstr "utilisée {0}" + #: src/components/profile/UsernameField.tsx:59 msgid "Letters, numbers and underscores only" msgstr "Lettres, chiffres et tirets bas seulement" -#: src/pages/Settings.tsx:47 +#: src/pages/Settings.tsx:49 msgid "Light" msgstr "Clair" @@ -1068,17 +1145,20 @@ msgstr "Chargement du profil…" #: src/components/category/CategoryManager.tsx:60 #: src/components/chat/ChatModal.tsx:763 #: src/components/editor/EmojiPickerPopup.tsx:125 +#: src/components/federation/PeerManager.tsx:108 #: src/components/playlist/PlaylistMembershipPanel.tsx:45 #: src/components/shared/ListState.tsx:38 #: src/components/shared/LoadMoreButton.tsx:32 #: src/components/social/UserListPopover.tsx:151 +#: src/pages/Authorize.tsx:122 msgid "Loading…" msgstr "Chargement…" #: src/components/layout/AppHeader.tsx:208 -#: src/pages/UserLogin.tsx:41 -#: src/pages/UserLogin.tsx:67 -#: src/pages/UserLogin.tsx:86 +#: src/pages/FederationCallback.tsx:31 +#: src/pages/UserLogin.tsx:44 +#: src/pages/UserLogin.tsx:71 +#: src/pages/UserLogin.tsx:90 msgid "Log in" msgstr "Se connecter" @@ -1090,16 +1170,22 @@ msgstr "Se connecter pour aimer" msgid "Log in to vote" msgstr "Se connecter pour voter" -#: src/components/layout/UserMenu.tsx:126 +#. placeholder {0}: peer.name ?? peer.host +#: src/components/federation/FederatedSignIn.tsx:97 +msgid "Log in with {0}" +msgstr "Se connecter avec {0}" + +#: src/components/layout/UserMenu.tsx:127 #: src/pages/UserPublicProfile.tsx:131 msgid "Log out" msgstr "Se déconnecter" -#: src/pages/UserLogin.tsx:85 +#: src/pages/UserLogin.tsx:89 msgid "Logging in…" msgstr "Connexion…" -#: src/pages/UserLogin.tsx:72 +#: src/pages/FederationCallback.tsx:63 +#: src/pages/UserLogin.tsx:76 msgid "Login failed" msgstr "Connexion échouée" @@ -1107,9 +1193,9 @@ msgstr "Connexion échouée" msgid "Lowercase letters, numbers and single hyphens only" msgstr "Minuscules, chiffres et tirets simples seulement" -#: src/components/layout/UserMenu.tsx:113 -#: src/pages/Manage.tsx:24 -#: src/pages/Manage.tsx:29 +#: src/components/layout/UserMenu.tsx:114 +#: src/pages/Manage.tsx:27 +#: src/pages/Manage.tsx:34 #: src/pages/UserPublicProfile.tsx:164 msgid "Manage" msgstr "Administration" @@ -1138,7 +1224,7 @@ msgstr "Nom" #: src/components/chat/ChatModal.tsx:692 #: src/components/feed/FeedTabBar.tsx:40 -#: src/pages/Settings.tsx:53 +#: src/pages/Settings.tsx:55 msgid "New" msgstr "Nouveau" @@ -1231,6 +1317,10 @@ msgstr "Aucun utilisateur ne correspond à « {q} »." msgid "Not following anyone yet." msgstr "Aucun abonnement pour le moment." +#: src/pages/Authorize.tsx:103 +msgid "Not from here" +msgstr "Compte d'ailleurs" + #: src/pages/Community.tsx:127 msgid "Nothing happened this month." msgstr "Rien de neuf ce mois-ci." @@ -1248,7 +1338,7 @@ msgstr "Rien ici pour l'instant." #: src/components/layout/NotificationBell.tsx:57 #: src/pages/Notifications.tsx:387 #: src/pages/Notifications.tsx:505 -#: src/pages/Settings.tsx:130 +#: src/pages/Settings.tsx:163 msgid "Notifications" msgstr "Notifications" @@ -1256,11 +1346,11 @@ msgstr "Notifications" msgid "Notifications ({unreadNotificationCount} unread)" msgstr "Notifications ({unreadNotificationCount} non lues)" -#: src/pages/Settings.tsx:60 +#: src/pages/Settings.tsx:62 msgid "Off" msgstr "Désactivés" -#: src/pages/Settings.tsx:59 +#: src/pages/Settings.tsx:61 msgid "On" msgstr "Activés" @@ -1300,6 +1390,18 @@ msgstr "Ouvrir la tribune" msgid "or <0>browse files" msgstr "ou <0>parcourir les fichiers" +#: src/components/federation/FederatedSignIn.tsx:82 +msgid "Or join with your account on another gerbeur" +msgstr "Ou rejoignez-nous avec votre compte d'un autre gerbeur" + +#: src/components/federation/FederatedSignIn.tsx:83 +msgid "Or log in with your account on another gerbeur" +msgstr "Ou connectez-vous avec votre compte d'un autre gerbeur" + +#: src/pages/Settings.tsx:128 +msgid "Other instances" +msgstr "Autres instances" + #: src/pages/UserPublicProfile.tsx:157 msgid "Overview" msgstr "Aperçu" @@ -1308,13 +1410,14 @@ msgstr "Aperçu" msgid "Page not found" msgstr "Page introuvable" -#: src/pages/Settings.tsx:90 -#: src/pages/UserLogin.tsx:82 +#: src/pages/Settings.tsx:96 +#: src/pages/Settings.tsx:106 +#: src/pages/UserLogin.tsx:86 msgid "Password" msgstr "Mot de passe" #. placeholder {0}: VALIDATION.PASSWORD_MIN -#: src/pages/UserRegister.tsx:158 +#: src/pages/UserRegister.tsx:160 msgid "Password (min. {0} characters)" msgstr "Mot de passe (min. {0} caractères)" @@ -1416,17 +1519,17 @@ msgstr "Actualisation du flux…" msgid "Refreshing…" msgstr "Actualisation…" -#: src/pages/UserRegister.tsx:45 -#: src/pages/UserRegister.tsx:129 -#: src/pages/UserRegister.tsx:169 +#: src/pages/UserRegister.tsx:47 +#: src/pages/UserRegister.tsx:131 +#: src/pages/UserRegister.tsx:171 msgid "Register" msgstr "S'inscrire" -#: src/pages/UserRegister.tsx:168 +#: src/pages/UserRegister.tsx:170 msgid "Registering…" msgstr "Inscription…" -#: src/pages/UserRegister.tsx:134 +#: src/pages/UserRegister.tsx:136 msgid "Registration failed" msgstr "Inscription échouée" @@ -1434,6 +1537,12 @@ msgstr "Inscription échouée" msgid "Related" msgstr "Connexe" +#. placeholder {0}: peer.host +#: src/components/federation/PeerManager.tsx:133 +#: src/components/federation/PeerManager.tsx:134 +msgid "Remove {0}" +msgstr "Retirer {0}" + #: src/components/form/FileDropZone.tsx:139 msgid "Remove file" msgstr "Supprimer le fichier" @@ -1472,7 +1581,7 @@ msgstr "Répondre" msgid "Replying to" msgstr "En réponse à" -#: src/pages/UserLogin.tsx:148 +#: src/pages/UserLogin.tsx:154 msgid "Request failed" msgstr "Échec de la demande" @@ -1579,12 +1688,12 @@ msgstr "Position" msgid "Send" msgstr "Envoyer" -#: src/pages/UserLogin.tsx:157 +#: src/pages/UserLogin.tsx:163 msgid "Send reset link" msgstr "Envoyer le lien de réinitialisation" #: src/components/chat/PendingItem.tsx:104 -#: src/pages/UserLogin.tsx:156 +#: src/pages/UserLogin.tsx:162 msgid "Sending…" msgstr "Envoi…" @@ -1603,8 +1712,8 @@ msgid "email.settings" msgstr "Paramètres" #: src/components/layout/UserMenu.tsx:104 -#: src/pages/Settings.tsx:72 -#: src/pages/Settings.tsx:84 +#: src/pages/Settings.tsx:75 +#: src/pages/Settings.tsx:88 msgid "Settings" msgstr "Paramètres" @@ -1612,6 +1721,19 @@ msgstr "Paramètres" msgid "Several people are typing…" msgstr "Plusieurs personnes écrivent…" +#: src/pages/Authorize.tsx:37 +msgid "Sign in elsewhere" +msgstr "Se connecter ailleurs" + +#: src/pages/Authorize.tsx:135 +msgid "Sign in to {name}?" +msgstr "Se connecter à {name} ?" + +#: src/pages/Authorize.tsx:154 +#: src/pages/FederationCallback.tsx:73 +msgid "Signing you in…" +msgstr "Connexion…" + #: src/components/profile/ProfileOwnActions.tsx:102 msgid "Single use, valid for 7 days." msgstr "Usage unique, valable 7 jours." @@ -1636,7 +1758,7 @@ msgstr "Quelqu'un a demandé à réinitialiser le mot de passe de votre compte { msgid "Something went wrong" msgstr "Une erreur est survenue" -#: src/pages/Settings.tsx:132 +#: src/pages/Settings.tsx:165 msgid "Sounds" msgstr "Sons" @@ -1644,7 +1766,7 @@ msgstr "Sons" msgid "Start fresh" msgstr "Repartir de zéro" -#: src/pages/Settings.tsx:103 +#: src/pages/Settings.tsx:136 msgid "Style" msgstr "Style" @@ -1696,11 +1818,11 @@ msgstr "Le nouvel ordre n'a pas pu être enregistré. Réessayez." msgid "This comment couldn't be deleted. Try again." msgstr "Ce commentaire n'a pas pu être supprimé. Réessayez." -#: src/pages/UserRegister.tsx:118 +#: src/pages/UserRegister.tsx:120 msgid "This invite link is missing, expired, or already used." msgstr "Ce lien d'invitation est manquant, expiré ou déjà utilisé." -#: src/pages/UserLogin.tsx:104 +#: src/pages/UserLogin.tsx:110 msgid "This is a mirage." msgstr "C'est un mirage." @@ -1716,7 +1838,11 @@ msgstr "Rien à voir, circulez." msgid "This reset link is missing or malformed." msgstr "Ce lien de réinitialisation est absent ou malformé." -#: src/pages/Settings.tsx:168 +#: src/pages/FederationCallback.tsx:38 +msgid "This sign-in link is incomplete." +msgstr "Ce lien de connexion est incomplet." + +#: src/pages/Settings.tsx:201 msgid "This site doesn't send email, so no digest goes out." msgstr "Ce site n'envoie pas d'e-mails, aucun résumé ne part donc." @@ -1763,6 +1889,14 @@ msgstr "Les plus votées de la semaine" msgid "Track {0}" msgstr "Piste {0}" +#: src/components/federation/PeerManager.tsx:155 +msgid "Trust" +msgstr "Approuver" + +#: src/components/federation/PeerManager.tsx:32 +msgid "Trusted" +msgstr "Approuvée" + #: src/components/chat/ChatModal.tsx:668 msgid "Try again" msgstr "Réessayer" @@ -1826,7 +1960,7 @@ msgstr "Désabonné" msgid "email.digest.upload" msgstr "fichier" -#: src/components/profile/ProfileHeader.tsx:72 +#: src/components/profile/ProfileHeader.tsx:79 msgid "Upload failed" msgstr "Envoi échoué" @@ -1883,9 +2017,9 @@ msgstr "Menu utilisateur" #: src/components/profile/ProfileManageTab.tsx:61 #: src/components/profile/UsernameField.tsx:51 -#: src/pages/Settings.tsx:87 -#: src/pages/UserLogin.tsx:75 -#: src/pages/UserRegister.tsx:137 +#: src/pages/Settings.tsx:91 +#: src/pages/UserLogin.tsx:79 +#: src/pages/UserRegister.tsx:139 msgid "Username" msgstr "Nom d'utilisateur" @@ -1894,6 +2028,10 @@ msgstr "Nom d'utilisateur" msgid "Users" msgstr "Utilisateurs" +#: src/components/federation/PeerManager.tsx:169 +msgid "Users of a trusted instance sign in here with their account there. Those of a blocked one can't. Users of any other instance need an invite." +msgstr "Les utilisateurs d'une instance approuvée se connectent ici avec leur compte de là-bas. Ceux d'une instance bloquée ne le peuvent pas. Ceux de toute autre instance ont besoin d'une invitation." + #: src/components/profile/ProfileSection.tsx:43 msgid "View all →" msgstr "Tout voir →" @@ -1952,6 +2090,10 @@ msgstr "Hier" msgid "You can post it anyway." msgstr "Vous pouvez la publier quand même." +#: src/components/federation/GrantList.tsx:93 +msgid "You haven't signed in to another gerbeur with this account yet." +msgstr "Vous ne vous êtes encore connecté à aucun autre gerbeur avec ce compte." + #: src/pages/Unsubscribe.tsx:94 msgid "You won't get the monthly recap any more. You can turn it back on in your settings." msgstr "Vous ne recevrez plus le récap mensuel. Vous pouvez le réactiver dans vos paramètres." @@ -1997,7 +2139,15 @@ msgstr "Vous avez tout lu, tout vu, tout bu." msgid "email.welcome.preheader" msgstr "Votre compte est prêt." -#: src/pages/UserLogin.tsx:152 +#: src/pages/Authorize.tsx:104 +msgid "Your account lives on {home}: sign in to other instances from there." +msgstr "Votre compte est sur {home} : connectez-vous aux autres instances depuis là-bas." + +#: src/pages/Settings.tsx:119 +msgid "Your account lives on {home}: your password, email address, avatar and username change there." +msgstr "Votre compte est sur {home} : votre mot de passe, votre adresse e-mail, votre avatar et votre nom d'utilisateur se changent là-bas." + +#: src/pages/UserLogin.tsx:158 msgid "Your email address" msgstr "Votre adresse e-mail" diff --git a/shared/federation.ts b/shared/federation.ts new file mode 100644 index 00000000..00449894 --- /dev/null +++ b/shared/federation.ts @@ -0,0 +1,267 @@ +/** + * Types what crosses the wire for federated sign-in, by which a user signs in + * to one gerbeur instance with their account on another. + * + * The protocol is a subset of OpenID Connect, the authorization code flow + * with PKCE, with tokens signed by each instance's Ed25519 key. Between the + * instances, and between each instance and its client, travel: + * + * - each instance's metadata, served at `/.well-known/openid-configuration`; + * - the pages' requests to start and finish a sign-in, here + * (`/api/federation/*`) and on the home instance (`/api/oauth/*`); + * - the claims of an identity, and the events a home instance sends the + * instances its users signed in to; + * - the instances an admin trusts or blocks, and the instances a user let + * their account sign in to. + * + * In the code, the user's own instance is their home, playing the identity + * provider; the instance they sign in to is the client. + * + * @module + */ + +/** + * The version of the protocol below, which an instance announces in its + * {@link InstanceMetadata}. An instance refuses one announcing another. + */ +export const FEDERATION_VERSION = 1; + +/** + * Served by every instance at `/.well-known/openid-configuration` + * (`routes/well-known.ts`), and read by another before it trusts it, starts a + * sign-in on it or sends it an event. The names are OpenID Connect's, and the + * `gerbeur_` fields are this protocol's own. + */ +export interface InstanceMetadata { + /** The instance's public URL, an origin, which names it in every token. */ + issuer: string; + /** Its `/authorize` page, where a user lets another instance sign them in. */ + authorization_endpoint: string; + /** `POST /api/oauth/tokens`, which trades a code for an identity token. */ + token_endpoint: string; + /** `GET /.well-known/jwks.json`, its public keys. */ + jwks_uri: string; + response_types_supported: string[]; + grant_types_supported: string[]; + subject_types_supported: string[]; + id_token_signing_alg_values_supported: string[]; + code_challenge_methods_supported: string[]; + scopes_supported: string[]; + /** {@link FEDERATION_VERSION}. */ + gerbeur_federation: number; + /** The site's name, which a consent page and the peer list show. */ + gerbeur_site_name: string; + /** + * Where its home instance sends a user back once they consent, as a client: + * its `/federation/callback` page, on its frontend. + */ + gerbeur_redirect_uri: string; + /** `POST /api/federation/events`, where it receives a home's events. */ + gerbeur_events_endpoint: string; +} + +/** + * Checks whether `value` is an {@link InstanceMetadata} of this protocol's + * version, as `remote/gerbeur-instance.ts` must before reading one. + */ +export function isInstanceMetadata(value: unknown): value is InstanceMetadata { + if (!value || typeof value !== "object") return false; + const v = value as Record; + return typeof v.issuer === "string" && + typeof v.authorization_endpoint === "string" && + typeof v.token_endpoint === "string" && + typeof v.jwks_uri === "string" && + v.gerbeur_federation === FEDERATION_VERSION && + typeof v.gerbeur_site_name === "string" && + typeof v.gerbeur_redirect_uri === "string" && + typeof v.gerbeur_events_endpoint === "string"; +} + +/** + * Returns the origin of the instance `input` names, or null when it names + * none. Someone may type a bare host (`music.example`, taken as https), a URL, + * or a handle's host with its port (`localhost:8001`); a URL with a path names + * no instance. Whether plain http is allowed is the server's call. + */ +export function parseInstance(input: string): string | null { + const trimmed = input.trim().replace(/\/+$/, ""); + if (!trimmed) return null; + try { + const url = new URL( + /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`, + ); + if (url.protocol !== "https:" && url.protocol !== "http:") return null; + if (url.pathname !== "/" || url.search || url.hash) return null; + if (url.username || url.password) return null; + return url.origin; + } catch { + return null; + } +} + +/** + * Returns the host of the instance at `issuer`, with its port if it has one: + * the part after the `@` of its users' handles here (`alice@music.example`). + */ +export function instanceHost(issuer: string): string { + return new URL(issuer).host; +} + +/** + * What an admin decided about an instance. Users of a trusted one sign in + * here directly; those of a blocked one never do, and its users already here + * are signed out. An instance with neither is invite only: its users sign in + * here with an invite. + */ +export type PeerStatus = "trusted" | "blocked"; + +/** Every {@link PeerStatus}. */ +export const PEER_STATUSES: readonly PeerStatus[] = ["trusted", "blocked"]; + +/** Checks whether `value` is a {@link PeerStatus}. */ +export function isPeerStatus(value: unknown): value is PeerStatus { + return typeof value === "string" && + (PEER_STATUSES as readonly string[]).includes(value); +} + +/** + * Returned by `GET /api/federation/peers`: the login page offers each trusted + * one, and `/manage` lists them all. + */ +export interface FederationPeer { + issuer: string; + /** {@link instanceHost} of the issuer. */ + host: string; + /** The site's name, as its metadata gave it when it was added. */ + name: string | null; + status: PeerStatus; + createdAt: Date; +} + +/** Sent to `PUT /api/federation/peers` by `/manage`. */ +export interface SetPeerRequest { + /** As someone typed it, read with {@link parseInstance}. */ + instance: string; + status: PeerStatus; +} + +/** + * Sent to `POST /api/federation/logins` by the login page, or by the register + * page with the invite it was opened with. + */ +export interface FederationLoginRequest { + /** The user's home instance, read with {@link parseInstance}. */ + instance: string; + inviteToken?: string; +} + +/** + * Returned by `POST /api/federation/logins`: the home instance's `/authorize` + * page with the request in its query, which the client navigates to. + */ +export interface FederationLoginResponse { + authorizeUrl: string; +} + +/** + * Sent to `POST /api/federation/sessions` by the `/federation/callback` page, + * from the query the home instance sent the user back with. The answer is an + * `AuthResponse`, as a sign-in's. + */ +export interface FederationSessionRequest { + code: string; + state: string; +} + +/** + * Returned by `GET /api/oauth/clients?client_id=` to the `/authorize` page, + * which asks the user whether to sign in there. + */ +export interface OAuthClient { + clientId: string; + host: string; + name: string; + /** + * Whether the user already let it sign them in, in which case the page + * doesn't ask again. + */ + granted: boolean; +} + +/** + * Sent to `POST /api/oauth/codes` by the `/authorize` page once the user + * consents, from the query the client instance sent them with. + */ +export interface AuthorizeRequest { + clientId: string; + redirectUri: string; + state: string; + codeChallenge: string; + codeChallengeMethod: string; + nonce: string; +} + +/** + * Returned by `POST /api/oauth/codes`: the client's callback page with the + * code, where the `/authorize` page sends the user. + */ +export interface AuthorizeResponse { + redirectTo: string; +} + +/** + * Returned by `GET /api/me/grants` to the settings page: an instance the + * user let their account sign in to. + */ +export interface FederationGrant { + clientId: string; + host: string; + name: string | null; + grantedAt: Date; + lastUsedAt: Date; +} + +/** + * Carried by an identity token and by an `update` event: what a home instance + * tells another of a user. The names are OpenID Connect's. + */ +export interface IdentityClaims { + /** The user's name at home; the client calls them `@`. */ + preferred_username: string; + email: string; + /** Their avatar's URL at home, versioned; absent without one. */ + picture?: string; +} + +/** + * The payload of a signed event, which a home instance sends each instance a + * user signed in to (`POST /api/federation/events`): `update` when their name, + * email or avatar changed, `revoke` when their sessions there must end, after + * a password change or when they withdraw the grant. + */ +export type FederationEvent = + | { type: "update"; claims: IdentityClaims } + | { type: "revoke" }; + +/** + * Checks whether `value` is a {@link FederationEvent}, as the events endpoint + * must once the signature is verified. + */ +export function isFederationEvent(value: unknown): value is FederationEvent { + if (!value || typeof value !== "object") return false; + const v = value as Record; + if (v.type === "revoke") return true; + return v.type === "update" && isIdentityClaims(v.claims); +} + +/** + * Checks whether `value` carries the {@link IdentityClaims}, as a client must + * before creating or updating an account from them. + */ +export function isIdentityClaims(value: unknown): value is IdentityClaims { + if (!value || typeof value !== "object") return false; + const v = value as Record; + return typeof v.preferred_username === "string" && + typeof v.email === "string" && + (v.picture === undefined || typeof v.picture === "string"); +} diff --git a/shared/mention.ts b/shared/mention.ts index 5d87a1b3..db1a51d5 100644 --- a/shared/mention.ts +++ b/shared/mention.ts @@ -5,8 +5,11 @@ * @module */ +import { HANDLE_SOURCE } from "./validation.ts"; + /** - * Matches an @username, with the name as its first group. The `@` must not + * Matches an @handle, a local `@name` or a remote user's `@name@host` + * (`HANDLE_SOURCE`), with the handle as its first group. The `@` must not * follow a word character, so an email address mentions no one. Nor may it * follow `[` or `(`, which leaves out a Markdown link's text or URL starting * with `@`, and also a plain `(@name)`. The editor's suggestions match its @@ -14,7 +17,10 @@ * `Markdown` links mentions with a looser pattern of its own, on text already * parsed, where code and URLs are out of the way. */ -export const MENTION_RE: RegExp = /(? { + assertEquals(parseInstance("music.example"), "https://music.example"); + assertEquals(parseInstance(" Music.Example/ "), "https://music.example"); + assertEquals( + parseInstance("http://localhost:8001"), + "http://localhost:8001", + ); + assertEquals(parseInstance("localhost:8001"), "https://localhost:8001"); + assertEquals(parseInstance("https://music.example/path"), null); + assertEquals(parseInstance("ftp://music.example"), null); + assertEquals(parseInstance("https://u:p@music.example"), null); + assertEquals(parseInstance(""), null); + assertEquals(instanceHost("http://localhost:8001"), "localhost:8001"); +}); + +Deno.test("handles: a name, and a host for a user from another instance", () => { + assertEquals(splitHandle("bob"), { name: "bob" }); + assertEquals(splitHandle("alice@music.example"), { + name: "alice", + host: "music.example", + }); + for (const ok of ["bob", "alice@music.example", "c_1@localhost:8001"]) { + assertEquals(HANDLE_RE.test(ok), true, ok); + } + for (const bad of ["", "a@", "a@b.", "a b", "a@b@c", "a@-b"]) { + assertEquals(HANDLE_RE.test(bad), false, bad); + } +}); + +Deno.test("isFederationEvent: an update carries the claims", () => { + assertEquals(isFederationEvent({ type: "revoke" }), true); + assertEquals( + isFederationEvent({ + type: "update", + claims: { preferred_username: "a", email: "a@b.c" }, + }), + true, + ); + assertEquals(isFederationEvent({ type: "update" }), false); + assertEquals(isFederationEvent({ type: "delete" }), false); +}); diff --git a/shared/test/mention.test.ts b/shared/test/mention.test.ts new file mode 100644 index 00000000..cf3f3b42 --- /dev/null +++ b/shared/test/mention.test.ts @@ -0,0 +1,21 @@ +import { assertEquals } from "@std/assert"; +import { mentionedUsernames, mentionsEveryone } from "../mention.ts"; + +Deno.test("mentionedUsernames: local names and remote handles, once each", () => { + assertEquals( + mentionedUsernames( + "hi @Bob and @alice@Music.example. Also @carol@localhost:8001, @bob!", + ), + ["bob", "alice@music.example", "carol@localhost:8001"], + ); +}); + +Deno.test("mentionedUsernames: emails, code, links and URLs mention no one", () => { + assertEquals( + mentionedUsernames( + "mail bob@example.com, `@code`, [@x](https://a.example), https://a.example/@dan", + ), + [], + ); + assertEquals(mentionsEveryone("hey @everyone"), true); +}); diff --git a/shared/test/paths.test.ts b/shared/test/paths.test.ts index bfd29c44..75a1caa8 100644 --- a/shared/test/paths.test.ts +++ b/shared/test/paths.test.ts @@ -75,3 +75,23 @@ Deno.test("parsePagePath: what a path under a user names", () => { assertEquals(parsePagePath(other), null, other); } }); + +Deno.test("handles: a user from another instance is /@name@host", () => { + assertEquals(userPath("alice@music.example"), "/@alice@music.example"); + assertEquals( + dumpPath({ ownerUsername: "alice@localhost:8001", slug: "x" }), + "/@alice@localhost:8001/dumps/x", + ); + assertEquals(parsePagePath("/@alice@music.example/playlists/mix"), { + kind: "playlist", + username: "alice@music.example", + slug: "mix", + }); + assertEquals(parsePagePath("/@alice%40music.example"), { + kind: "user", + username: "alice@music.example", + rest: [], + }); + assertEquals(parsePagePath("/@alice@"), null); + assertEquals(parsePagePath("/@alice@-bad.example"), null); +}); diff --git a/shared/validation.ts b/shared/validation.ts index 8ad5aac3..12c2b68b 100644 --- a/shared/validation.ts +++ b/shared/validation.ts @@ -30,13 +30,51 @@ export const VALIDATION = { /** * Matches a valid username, made of letters, digits and underscores within the - * `VALIDATION` limits. Sign-up checks it on both sides. It uses the same `\w` - * that a mention's pattern reads a name with. + * `VALIDATION` limits. Sign-up and renaming check it on both sides. It uses the + * same `\w` that a handle's pattern ({@link HANDLE_SOURCE}) reads a name with; + * only a user from another instance has the `@host` part. */ export const USERNAME_RE: RegExp = new RegExp( `^[a-zA-Z0-9_]{${VALIDATION.USERNAME_MIN},${VALIDATION.USERNAME_MAX}}$`, ); +/** + * The pattern of an instance's host as a handle writes it: DNS labels, and a + * port for instances on one machine (`localhost:8001`). It ends on a letter or + * a digit, so the period that ends a sentence after a mention isn't taken in. + * {@link HANDLE_SOURCE} builds on it. + */ +export const HOST_SOURCE: string = + "[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)*(?::\\d{1,5})?"; + +/** + * The pattern of a handle, the name a user goes by on this instance: a local + * user's username, or `name@host` for a user whose account lives on another + * gerbeur (`federation-service.ts` stores it so in `users.username`). Paths, + * mentions and the profile links all read names by it, through + * {@link HANDLE_RE}, `MENTION_RE` (shared/mention.ts) and `parsePagePath` + * (shared/paths.ts). + */ +export const HANDLE_SOURCE: string = `\\w+(?:@${HOST_SOURCE})?`; + +/** Matches a whole handle ({@link HANDLE_SOURCE}). */ +export const HANDLE_RE: RegExp = new RegExp(`^${HANDLE_SOURCE}$`); + +/** Matches a whole host ({@link HOST_SOURCE}). */ +export const HOST_RE: RegExp = new RegExp(`^${HOST_SOURCE}$`); + +/** + * Returns the name and, for a user from another instance, the host of + * `handle`. `splitHandle("alice@music.example")` is + * `{ name: "alice", host: "music.example" }`; a local name has no host. + */ +export function splitHandle(handle: string): { name: string; host?: string } { + const at = handle.indexOf("@"); + return at < 0 + ? { name: handle } + : { name: handle.slice(0, at), host: handle.slice(at + 1) }; +} + /** * How often a dump's or a playlist's slug may change, counted from the aliases * the changes left: 3 times a day. Moderators are exempt. slug-service refuses diff --git a/src/App.css b/src/App.css index dea84a4e..c3329aea 100644 --- a/src/App.css +++ b/src/App.css @@ -2297,6 +2297,19 @@ body.has-player .chat-fab { font-weight: 600; } +/* The `@host` of a user whose account lives on another instance. */ +.profile-username-host { + font-weight: 400; + color: var(--color-text-muted); + overflow-wrap: anywhere; +} + +.profile-home { + font-size: var(--text-xs); + color: var(--color-text-muted); + margin: 0 0 0.4rem; +} + /* Role badge — elevated roles only (see RoleChip) */ .profile-role-chip { padding: 0.1rem 0.55rem; @@ -3317,6 +3330,53 @@ body.has-player .chat-fab { opacity: 0.85; } +/* Signing in with an account on another instance, under the login and + register forms, and the consent page that instance shows. */ +.auth-federated { + border-top: 1px solid var(--color-border-subtle); + padding-top: 1rem; + display: flex; + flex-direction: column; + gap: 0.75rem; +} + +.auth-federated-title { + margin: 0; + font-size: var(--text-sm); + text-align: center; + color: var(--color-text-muted); +} + +.auth-federated-peer { + display: flex; + align-items: baseline; + justify-content: center; + flex-wrap: wrap; + gap: 0.25rem 0.5rem; +} + +.auth-federated-host { + font-size: var(--text-xs); + opacity: 0.7; +} + +.auth-consent { + margin: 0; + line-height: 1.5; + overflow-wrap: anywhere; +} + +.auth-consent-actions { + display: flex; + flex-wrap: wrap; + gap: 0.5rem; +} + +.auth-consent-actions > * { + flex: 1 1 auto; + text-align: center; +} + /* ── Form pages (DumpCreate / DumpEdit) ── */ @keyframes page-enter { from { @@ -7271,6 +7331,46 @@ body.has-player .chat-fab { margin: 0.75rem 0 0; } +/* ── Instances (/manage, /settings) ─────────────────────────────────────── */ + +.peer-manager { + display: flex; + flex-direction: column; + gap: 1rem; +} + +.peer-name { + display: flex; + flex-direction: column; + min-width: 0; + overflow-wrap: anywhere; +} + +.peer-host { + font-weight: 400; + font-size: var(--text-xs); +} + +.peer-controls { + display: flex; + align-items: center; + flex-wrap: wrap; + gap: 0.5rem; +} + +.peer-add { + margin: 0; +} + +.peer-add-actions { + display: flex; + gap: 0.5rem; +} + +.peer-add-actions > * { + flex: 1; +} + /* ── Categories ─────────────────────────────────────────────────────────── */ .visually-hidden { diff --git a/src/App.tsx b/src/App.tsx index 1fa2ec15..a782d86f 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -9,12 +9,16 @@ * the create form on a shared link. * - `/search` and `/search/:searchTab` are the search results (`Search`). * - `/register` and `/login` sign up and sign in (`UserRegister`, - * `UserLogin`), signed out only. + * `UserLogin`), signed out only, `/login?next=` coming back to a page. + * - `/authorize` lets another gerbeur instance sign the user in with their + * account here (`Authorize`), and `/federation/callback` finishes a sign-in + * here with an account on another (`FederationCallback`). * - `/reset-password` sets a new password from an emailed link * (`ResetPassword`), and `/unsubscribe` turns off a digest from its emailed * link (`Unsubscribe`). * - `/notifications` (`Notifications`) and `/settings` (`Settings`), signed in - * only, and `/manage`, the site's tools, for `category:manage` (`Manage`). + * only, and `/manage`, the site's tools, for `category:manage` or + * `federation:manage` (`Manage`). * - `/community` and `/community/monthly`, the site's week and month * (`Community`), signed in only. * - `/@:username/*` is a user's (`UserRoutes`): their profile and its tabs, @@ -108,6 +112,14 @@ const ResetPassword = lazy(() => const Unsubscribe = lazy(() => import("./pages/Unsubscribe.tsx").then((m) => ({ default: m.Unsubscribe })) ); +const Authorize = lazy(() => + import("./pages/Authorize.tsx").then((m) => ({ default: m.Authorize })) +); +const FederationCallback = lazy(() => + import("./pages/FederationCallback.tsx").then((m) => ({ + default: m.FederationCallback, + })) +); const NotFound = lazy(() => import("./pages/NotFound.tsx").then((m) => ({ default: m.NotFound })) ); @@ -202,6 +214,11 @@ function AppRoutes() { } /> + } /> + } + /> } /> } /> { + node.children = unlinkHandles(node.children).flatMap((child) => { if (child.type !== "text" || !child.value?.includes("@")) { walk(child); return [child]; diff --git a/src/components/federation/FederatedSignIn.tsx b/src/components/federation/FederatedSignIn.tsx new file mode 100644 index 00000000..7e370e0e --- /dev/null +++ b/src/components/federation/FederatedSignIn.tsx @@ -0,0 +1,119 @@ +/** + * Renders the way in for users of another gerbeur instance, under the login + * form and, with the invite, under the register form. + * + * @module + */ + +import { useEffect, useState } from "react"; +import { t } from "@lingui/core/macro"; +import { Trans } from "@lingui/react/macro"; +import { FormProvider } from "react-hook-form"; + +import { API_URL } from "../../config/api.ts"; +import type { Wire } from "../../../shared/api.ts"; +import type { + FederationLoginRequest, + FederationLoginResponse, + FederationPeer, +} from "../../../shared/federation.ts"; +import { dataOr, expectOk } from "../../utils/shared/api.ts"; +import { deserializeFederationPeer } from "../../utils/shared/deserialize.ts"; +import { useApiForm } from "../../hooks/form/useApiForm.ts"; +import { FormError } from "../form/FormError.tsx"; +import { SubmitButton } from "../form/SubmitButton.tsx"; +import { TextField } from "../form/TextField.tsx"; + +/** Passed to {@link FederatedSignIn} by `UserLogin` and `UserRegister`. */ +export interface FederatedSignInProps { + /** + * The invite the register page was opened with, which lets a user of any + * instance join; the login page has none, and offers the trusted instances. + */ + inviteToken?: string; +} + +interface Values { + instance: string; +} + +/** + * Renders a button per trusted instance (`GET /api/federation/peers`) and a + * field for any other's address. Either starts the sign-in + * (`POST /api/federation/logins`) and leaves for that instance's `/authorize` + * page, which sends the user back to `/federation/callback`. + */ +export function FederatedSignIn( + { inviteToken }: FederatedSignInProps, +): React.JSX.Element { + const [peers, setPeers] = useState([]); + const form = useApiForm({ defaultValues: { instance: "" } }); + + useEffect(() => { + if (inviteToken) return; + const controller = new AbortController(); + fetch(`${API_URL}/api/federation/peers`, { signal: controller.signal }) + .then((res) => dataOr[]>(res, [])) + .then((list) => setPeers(list.map(deserializeFederationPeer))) + .catch(() => {}); + return () => controller.abort(); + }, [inviteToken]); + + const onSubmit = form.submit(async ({ instance }) => { + const { authorizeUrl } = await expectOk( + await fetch(`${API_URL}/api/federation/logins`, { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify( + { + instance: instance.trim(), + inviteToken, + } satisfies FederationLoginRequest, + ), + }), + ); + globalThis.location.assign(authorizeUrl); + }); + + return ( +
+

+ {inviteToken + ? Or join with your account on another gerbeur + : Or log in with your account on another gerbeur} +

+ + {peers.map((peer) => ( + + ))} +
+ + + name="instance" + placeholder={t`Its address, like music.example`} + autoComplete="url" + rules={{ required: true }} + /> + Connecting…} + > + Continue + + +
+
+ ); +} diff --git a/src/components/federation/GrantList.tsx b/src/components/federation/GrantList.tsx new file mode 100644 index 00000000..283d8694 --- /dev/null +++ b/src/components/federation/GrantList.tsx @@ -0,0 +1,101 @@ +/** + * Renders the other gerbeur instances the signed-in user let their account + * sign in to, on `/settings`. + * + * @module + */ + +import { useCallback, useEffect, useState } from "react"; +import { t } from "@lingui/core/macro"; +import { Trans } from "@lingui/react/macro"; + +import { API_URL } from "../../config/api.ts"; +import type { Wire } from "../../../shared/api.ts"; +import type { FederationGrant } from "../../../shared/federation.ts"; +import { useAuth } from "../../hooks/auth/useAuth.ts"; +import { expectOk, friendlyFetchError } from "../../utils/shared/api.ts"; +import { deserializeFederationGrant } from "../../utils/shared/deserialize.ts"; +import { relativeTime } from "../../utils/shared/relativeTime.ts"; +import { ErrorCard } from "../shared/ErrorCard.tsx"; +import { SettingRow } from "../profile/SettingRow.tsx"; + +/** + * Renders each instance (`GET /api/me/grants`), when it last signed the user + * in, and a button that withdraws it (`DELETE /api/me/grants/:host`), which + * signs them out there; signing in there again asks them again. + */ +export function GrantList(): React.JSX.Element { + const { authFetch } = useAuth(); + const [grants, setGrants] = useState(null); + const [error, setError] = useState(null); + + const fetchGrants = useCallback( + async () => + (await expectOk[]>( + await authFetch(`${API_URL}/api/me/grants`), + )).map(deserializeFederationGrant), + [authFetch], + ); + + useEffect(() => { + fetchGrants() + .then(setGrants) + .catch((err) => setError(friendlyFetchError(err))); + }, [fetchGrants]); + + const revoke = async (grant: FederationGrant) => { + setError(null); + try { + await expectOk( + await authFetch( + `${API_URL}/api/me/grants/${encodeURIComponent(grant.host)}`, + { method: "DELETE" }, + ), + ); + setGrants(await fetchGrants()); + } catch (err) { + setError(friendlyFetchError(err)); + } + }; + + return ( + <> + {grants && grants.length > 0 && ( +
+ {grants.map((grant) => ( + + {grant.name ?? grant.host} + {grant.host} + + } + > + + + last used {relativeTime(grant.lastUsedAt)} + + + + + ))} +
+ )} + {grants?.length === 0 && ( +

+ + You haven't signed in to another gerbeur with this account yet. + +

+ )} + {error && } + + ); +} diff --git a/src/components/federation/PeerManager.tsx b/src/components/federation/PeerManager.tsx new file mode 100644 index 00000000..6cb920b5 --- /dev/null +++ b/src/components/federation/PeerManager.tsx @@ -0,0 +1,177 @@ +/** + * Renders the list of the other gerbeur instances an admin trusts or blocks, + * on `/manage`, for those who hold `federation:manage`. + * + * @module + */ + +import { useCallback, useEffect, useState } from "react"; +import { t } from "@lingui/core/macro"; +import { Trans } from "@lingui/react/macro"; +import { FormProvider } from "react-hook-form"; + +import { API_URL } from "../../config/api.ts"; +import type { Wire } from "../../../shared/api.ts"; +import type { + FederationPeer, + PeerStatus, + SetPeerRequest, +} from "../../../shared/federation.ts"; +import { useAuth } from "../../hooks/auth/useAuth.ts"; +import { useApiForm } from "../../hooks/form/useApiForm.ts"; +import { expectOk, friendlyFetchError } from "../../utils/shared/api.ts"; +import { deserializeFederationPeer } from "../../utils/shared/deserialize.ts"; +import { FormError } from "../form/FormError.tsx"; +import { SubmitButton } from "../form/SubmitButton.tsx"; +import { TextField } from "../form/TextField.tsx"; +import { ErrorCard } from "../shared/ErrorCard.tsx"; +import { Segmented, type SegmentedOption } from "../shared/Segmented.tsx"; +import { SettingRow } from "../profile/SettingRow.tsx"; + +const STATUS_OPTIONS: SegmentedOption[] = [ + { value: "trusted", label: Trusted }, + { value: "blocked", label: Blocked }, +]; + +interface Values { + instance: string; +} + +/** + * Renders each listed instance with its status, which a click changes + * (`PUT /api/federation/peers`), and a button that takes it off the lists + * (`DELETE /api/federation/peers/:host`), then a field that adds one. The + * server checks that it answers as a gerbeur, and the permission again. + */ +export function PeerManager(): React.JSX.Element { + const { authFetch } = useAuth(); + const [peers, setPeers] = useState(null); + const [error, setError] = useState(null); + const form = useApiForm({ defaultValues: { instance: "" } }); + + const fetchPeers = useCallback( + async () => + (await expectOk[]>( + await authFetch(`${API_URL}/api/federation/peers`), + )).map(deserializeFederationPeer), + [authFetch], + ); + const load = async () => setPeers(await fetchPeers()); + + useEffect(() => { + fetchPeers() + .then(setPeers) + .catch((err) => setError(friendlyFetchError(err))); + }, [fetchPeers]); + + const save = async (instance: string, status: PeerStatus) => { + await expectOk>( + await authFetch(`${API_URL}/api/federation/peers`, { + method: "PUT", + body: JSON.stringify({ instance, status } satisfies SetPeerRequest), + }), + ); + await load(); + }; + + /** Runs a change from a row, whose failure shows above the form. */ + const change = async (run: () => Promise) => { + setError(null); + try { + await run(); + } catch (err) { + setError(friendlyFetchError(err)); + } + }; + + const remove = (peer: FederationPeer) => + change(async () => { + await expectOk( + await authFetch( + `${API_URL}/api/federation/peers/${encodeURIComponent(peer.host)}`, + { method: "DELETE" }, + ), + ); + await load(); + }); + + const add = (status: PeerStatus) => + form.submit(async ({ instance }) => { + await save(instance.trim(), status); + form.reset(); + }); + + return ( +
+ {peers === null && !error && ( +

+ Loading… +

+ )} + {peers && peers.length > 0 && ( +
+ {peers.map((peer) => ( + + {peer.name ?? peer.host} + {peer.host} + + } + > + + change(() => save(peer.issuer, status))} + /> + + + + ))} +
+ )} + {error && } + +
+ + + name="instance" + placeholder={t`An instance's address, like music.example`} + autoComplete="url" + rules={{ required: true }} + /> +
+ Checking…}> + Trust + + +
+ +
+

+ + Users of a trusted instance sign in here with their account there. + Those of a blocked one can't. Users of any other instance need an + invite. + +

+
+ ); +} diff --git a/src/components/layout/UserMenu.tsx b/src/components/layout/UserMenu.tsx index a5839e17..3bded325 100644 --- a/src/components/layout/UserMenu.tsx +++ b/src/components/layout/UserMenu.tsx @@ -26,8 +26,8 @@ export interface UserMenuProps { /** * Renders the signed-in user's avatar, which opens a menu with links to their * profile, their playlists, `/community` and `/settings`, to `/manage` for - * those who hold `category:manage`, and a Log out button. A click outside or - * Escape closes it. + * those who hold `category:manage` or `federation:manage`, and a Log out + * button. A click outside or Escape closes it. */ export function UserMenu({ user }: UserMenuProps): React.JSX.Element { const { i18n } = useLingui(); @@ -103,7 +103,8 @@ export function UserMenu({ user }: UserMenuProps): React.JSX.Element { > Settings - {can(user, "category:manage") && ( + {(can(user, "category:manage") || + can(user, "federation:manage")) && ( (null); const [emailEditing, setEmailEditing] = useState(false); const infoRef = useHeightTransition(emailEditing); + const { name, host } = splitHandle(user.username); + // A user from another instance changes their avatar and email there. + const editable = isOwnProfile && !host; const handleAvatarUpload = async (e: React.ChangeEvent) => { const file = e.target.files?.[0]; @@ -91,7 +98,7 @@ export function ProfileHeader( size={128} version={user.updatedAt?.getTime()} /> - {isOwnProfile && ( + {editable && (