mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-11-05 16:16:49 +00:00
feat: sign in to the desktop app in your browser, with your password manager
The desktop login page gets "Sign in with your browser…" as its main button. On an instance it opens the instance's real login page in the system browser, with a PKCE challenge. The page checks the password or runs SSO, parks the sign-in under a one-time code, asks once, and sends the code to the app's loopback listener. This browser gets no session out of it, and the app's own page redeems the code, so SameSite=Strict is fine. Standalone runs the mail server's OAuth against the listener, with a page from main for a server with no OAuth at all. - `/api/auth/desktop-handoff/park` and `redeem`, and `sso/complete` parks tokens the same way for a loopback target - `auth.claim()`: the calls are taken once per document, in the first render, in `WindowControlsHost` - `BrowserSignIn` policy, default on, with its ADMX and samples - strings in all 30 languages, and the old button's are gone `runDesktopBrowserSignIn`'s tests changed because the code no longer goes through the callback page's address: it's redeemed where it arrives.
This commit is contained in:
Linus Rath
@@ -1,8 +1,6 @@
|
||||
"use client";
|
||||
|
||||
import { Suspense, useEffect, useRef, useState } from "react";
|
||||
import { IS_DESKTOP_BUILD } from "@/lib/desktop/flag";
|
||||
import { DESKTOP_CLIENT_ID_KEY, DESKTOP_REDIRECT_URI_KEY } from "@/lib/desktop/browser-sign-in";
|
||||
import { useRouter, useSearchParams } from "next/navigation";
|
||||
import { useTranslations } from "next-intl";
|
||||
import { useAuthStore } from "@/stores/auth-store";
|
||||
@@ -12,7 +10,7 @@ import { LITE_OAUTH_AVAILABLE, getLiteOAuthRedirectUri } from "@/lib/auth/lite-o
|
||||
import { AlertCircle } from "@/components/icons";
|
||||
import { Button } from "@/components/ui/button";
|
||||
import { useParams } from "next/navigation";
|
||||
import { buildMobileHandoffUrl, mobileHandoffTarget } from "@/lib/auth/mobile-handoff";
|
||||
import { buildMobileHandoffUrl, desktopHandoffTarget, handoffTarget } from "@/lib/auth/mobile-handoff";
|
||||
import { confirmMobileHandoffCodeUrl } from "@/lib/auth/mobile-handoff-client";
|
||||
import { MobileHandoffConsent } from "@/components/auth/mobile-handoff-consent";
|
||||
import { MailSkeleton } from "@/components/boot-skeleton/mail-skeleton";
|
||||
@@ -32,6 +30,7 @@ function OAuthCallbackInner() {
|
||||
url: string | null;
|
||||
resolveUrl?: () => Promise<string | null>;
|
||||
username: string;
|
||||
desktop?: boolean;
|
||||
} | null>(null);
|
||||
// The authorization code is single-use. React's development double effect
|
||||
// ran this twice: the second pass no longer saw the pairing re-auth flag
|
||||
@@ -118,12 +117,9 @@ function OAuthCallbackInner() {
|
||||
const prefix = getPathPrefix(params.locale as string);
|
||||
// Lite on Stalwart registers one locale-free URI (lib/auth/lite-oauth.ts);
|
||||
// the entry document brought us here from it.
|
||||
// The desktop app's browser sign-in redirected to its loopback listener
|
||||
// (lib/desktop/browser-sign-in.ts), which this page's origin can't tell.
|
||||
const desktopRedirectUri = IS_DESKTOP_BUILD ? sessionStorage.getItem(DESKTOP_REDIRECT_URI_KEY) : null;
|
||||
const redirectUri = desktopRedirectUri ?? (LITE_OAUTH_AVAILABLE
|
||||
const redirectUri = LITE_OAUTH_AVAILABLE
|
||||
? getLiteOAuthRedirectUri()
|
||||
: `${window.location.origin}${prefix}/${params.locale}/auth/callback`);
|
||||
: `${window.location.origin}${prefix}/${params.locale}/auth/callback`;
|
||||
|
||||
loginWithOAuth(serverUrl, code, codeVerifier, redirectUri, serverId)
|
||||
.then((success) => {
|
||||
@@ -133,10 +129,6 @@ function OAuthCallbackInner() {
|
||||
sessionStorage.removeItem("oauth_server_url");
|
||||
sessionStorage.removeItem("oauth_server_id");
|
||||
sessionStorage.removeItem("oauth_add_account_mode");
|
||||
if (IS_DESKTOP_BUILD) {
|
||||
sessionStorage.removeItem(DESKTOP_REDIRECT_URI_KEY);
|
||||
sessionStorage.removeItem(DESKTOP_CLIENT_ID_KEY);
|
||||
}
|
||||
let redirectTo = `${prefix}/${params.locale}`;
|
||||
try {
|
||||
const saved = sessionStorage.getItem('redirect_after_login');
|
||||
@@ -160,7 +152,7 @@ function OAuthCallbackInner() {
|
||||
let mobileRedirectUri = "";
|
||||
let mobileState: string | null = null;
|
||||
try {
|
||||
mobileRedirectUri = mobileHandoffTarget(sessionStorage.getItem("mobile_redirect_uri"));
|
||||
mobileRedirectUri = handoffTarget(sessionStorage.getItem("mobile_redirect_uri"));
|
||||
mobileState = sessionStorage.getItem("mobile_state");
|
||||
} catch { /* sessionStorage may be unavailable */ }
|
||||
|
||||
@@ -200,6 +192,7 @@ function OAuthCallbackInner() {
|
||||
code: handoffCode,
|
||||
state: handoffState,
|
||||
}),
|
||||
desktop: Boolean(desktopHandoffTarget(mobileRedirectUri)),
|
||||
username: typeof data.server_url === "string" ? data.server_url : "",
|
||||
});
|
||||
return;
|
||||
@@ -275,6 +268,7 @@ function OAuthCallbackInner() {
|
||||
url={pendingHandoff.url}
|
||||
resolveUrl={pendingHandoff.resolveUrl ?? null}
|
||||
username={pendingHandoff.username}
|
||||
desktop={pendingHandoff.desktop}
|
||||
onError={() => {
|
||||
setPendingHandoff(null);
|
||||
setError("token_exchange_failed");
|
||||
|
||||
@@ -6,9 +6,11 @@ import { EMPTY_POLICY_LAYERS, resolvePolicies } from '@/lib/desktop/policy-schem
|
||||
|
||||
// The device's OS policy on the two ways into SSO: nothing starts towards a refused server.
|
||||
|
||||
const params = vi.hoisted(() => ({ value: null as URLSearchParams | null }));
|
||||
|
||||
vi.mock('next/navigation', () => ({
|
||||
useParams: () => ({ locale: 'en' }),
|
||||
useSearchParams: () => new URLSearchParams(),
|
||||
useSearchParams: () => params.value ?? new URLSearchParams(),
|
||||
useRouter: () => ({ push: vi.fn(), replace: vi.fn(), prefetch: vi.fn() }),
|
||||
usePathname: () => '/login',
|
||||
}));
|
||||
@@ -56,6 +58,7 @@ let fetched: string[];
|
||||
|
||||
beforeEach(() => {
|
||||
configOverrides.value = {};
|
||||
params.value = null;
|
||||
fetched = [];
|
||||
sessionStorage.clear();
|
||||
vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL) => {
|
||||
@@ -110,3 +113,141 @@ describe('automatic SSO', () => {
|
||||
await waitFor(() => expect(startedSso()).toBe(true), { timeout: 10000 });
|
||||
}, 30_000);
|
||||
});
|
||||
|
||||
describe('sign-in with the browser, in the app', () => {
|
||||
const REDIRECT = 'http://127.0.0.1:51234/bulwark-desktop/callback';
|
||||
|
||||
function appBridge(options: { servers?: string[]; browserSignIn?: boolean; complete?: () => unknown } = {}) {
|
||||
const forced: Record<string, unknown> = {};
|
||||
if (options.servers) forced.AllowedJmapServers = options.servers;
|
||||
if (options.browserSignIn !== undefined) forced.BrowserSignIn = options.browserSignIn;
|
||||
const snapshot = resolvePolicies({ ...EMPTY_POLICY_LAYERS, forcedMachine: forced });
|
||||
const controls = {
|
||||
begin: vi.fn(async () => ({ ok: true, flowId: 'f1', redirectUri: REDIRECT, state: 'main-state' })),
|
||||
complete: vi.fn(async () => (options.complete ? options.complete() : { ok: false, error: 'cancelled' })),
|
||||
cancel: vi.fn(),
|
||||
};
|
||||
window.bulwarkDesktop = {
|
||||
version: 1,
|
||||
platform: 'win32',
|
||||
mode: 'instance',
|
||||
auth: { claim: () => controls },
|
||||
policy: { get: () => snapshot, onChange: () => () => {} },
|
||||
} as unknown as BulwarkDesktopBridge;
|
||||
return controls;
|
||||
}
|
||||
|
||||
const browserButton = () => screen.findByTestId('desktop-browser-sign-in', {}, { timeout: 10000 });
|
||||
|
||||
it('stays the other choice next to the form', async () => {
|
||||
configOverrides.value = { oauthEnabled: false, oauthOnly: false };
|
||||
appBridge();
|
||||
render(<LoginPage />);
|
||||
expect((await browserButton()).textContent).toContain('button');
|
||||
expect(document.getElementById('username')).not.toBeNull();
|
||||
expect(document.getElementById('password')).not.toBeNull();
|
||||
}, 30_000);
|
||||
|
||||
it('is the main way in on an OAuth-only instance, with no form', async () => {
|
||||
appBridge();
|
||||
render(<LoginPage />);
|
||||
await browserButton();
|
||||
expect(document.getElementById('password')).toBeNull();
|
||||
expect(await ssoButton()).toBeInTheDocument();
|
||||
}, 30_000);
|
||||
|
||||
it('is gone when a policy says so, and the form stays', async () => {
|
||||
configOverrides.value = { oauthEnabled: false, oauthOnly: false };
|
||||
appBridge({ browserSignIn: false });
|
||||
render(<LoginPage />);
|
||||
await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
|
||||
expect(screen.queryByTestId('desktop-browser-sign-in')).toBeNull();
|
||||
}, 30_000);
|
||||
|
||||
it('is not there in a browser', async () => {
|
||||
configOverrides.value = { oauthEnabled: false, oauthOnly: false };
|
||||
render(<LoginPage />);
|
||||
await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
|
||||
expect(screen.queryByTestId('desktop-browser-sign-in')).toBeNull();
|
||||
}, 30_000);
|
||||
|
||||
it('starts nothing towards a server off the list, and says why', async () => {
|
||||
const controls = appBridge({ servers: ['https://other.example.org'] });
|
||||
render(<LoginPage />);
|
||||
fireEvent.click(await browserButton());
|
||||
expect(await screen.findByText('server_refused')).toBeInTheDocument();
|
||||
expect(controls.begin).not.toHaveBeenCalled();
|
||||
}, 30_000);
|
||||
|
||||
it('a flow that ran out says so, and the button comes back', async () => {
|
||||
const controls = appBridge({ complete: () => ({ ok: false, error: 'timeout' }) });
|
||||
render(<LoginPage />);
|
||||
fireEvent.click(await browserButton());
|
||||
expect(await screen.findByText('timed_out')).toBeInTheDocument();
|
||||
expect(controls.complete).toHaveBeenCalledOnce();
|
||||
expect(await browserButton()).not.toBeDisabled();
|
||||
}, 30_000);
|
||||
|
||||
it('asks the instance with the device\'s list, and a refusal is the policy\'s notice', async () => {
|
||||
appBridge({ servers: ['https://mail.example.org'], complete: () => ({ ok: true, code: 'c'.repeat(64), state: 'main-state' }) });
|
||||
vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
|
||||
const url = String(input);
|
||||
fetched.push(url);
|
||||
if (url.includes('/api/auth/oauth/metadata')) return new Response(JSON.stringify(METADATA), { status: 200 });
|
||||
if (url.includes('/api/auth/desktop-handoff/redeem')) {
|
||||
expect(JSON.parse(String(init?.body))).toMatchObject({ allowed_servers: ['https://mail.example.org'] });
|
||||
return new Response(JSON.stringify({ error: 'blocked_by_policy' }), { status: 403 });
|
||||
}
|
||||
return new Response('{}', { status: 200 });
|
||||
}));
|
||||
render(<LoginPage />);
|
||||
fireEvent.click(await browserButton());
|
||||
expect(await screen.findByText('server_refused')).toBeInTheDocument();
|
||||
expect(fetched.some((url) => url.includes('/api/auth/desktop-handoff/redeem'))).toBe(true);
|
||||
}, 30_000);
|
||||
});
|
||||
|
||||
describe('the page the app opens in the browser', () => {
|
||||
const CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
|
||||
const search = (entries: Record<string, string>) => new URLSearchParams(entries);
|
||||
|
||||
it('parks the password and leaves this browser signed out, after asking', async () => {
|
||||
configOverrides.value = { oauthEnabled: false, oauthOnly: false };
|
||||
params.value = search({ mobile_redirect_uri: 'http://127.0.0.1:51234/bulwark-desktop/callback', mobile_state: 's', mobile_code_challenge: CHALLENGE });
|
||||
const bodies: Record<string, unknown>[] = [];
|
||||
vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
|
||||
const url = String(input);
|
||||
fetched.push(url);
|
||||
if (url.includes('/api/auth/desktop-handoff/park')) {
|
||||
bodies.push(JSON.parse(String(init?.body)));
|
||||
return new Response(JSON.stringify({ code: 'a'.repeat(64) }), { status: 200 });
|
||||
}
|
||||
return new Response('{}', { status: 200 });
|
||||
}));
|
||||
render(<LoginPage />);
|
||||
await screen.findByTestId('desktop-handoff-banner', {}, { timeout: 10000 });
|
||||
fireEvent.change(document.getElementById('username')!, { target: { value: 'a@example.org' } });
|
||||
fireEvent.change(document.getElementById('password')!, { target: { value: 'secret' } });
|
||||
fireEvent.submit(document.getElementById('password')!.closest('form')!);
|
||||
expect(await screen.findByText('consent_title')).toBeInTheDocument();
|
||||
expect(bodies[0]).toMatchObject({ code_challenge: CHALLENGE, state: 's', username: 'a@example.org', password: 'secret' });
|
||||
// No session anywhere: nothing went to the routes a browser sign-in writes cookies from.
|
||||
expect(fetched.some((url) => /api\/auth\/(session|verify|token)/.test(url))).toBe(false);
|
||||
}, 30_000);
|
||||
|
||||
it('ignores a loopback target with no challenge, and is the ordinary page', async () => {
|
||||
configOverrides.value = { oauthEnabled: false, oauthOnly: false };
|
||||
params.value = search({ mobile_redirect_uri: 'http://127.0.0.1:51234/bulwark-desktop/callback', mobile_state: 's' });
|
||||
render(<LoginPage />);
|
||||
await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
|
||||
expect(screen.queryByTestId('desktop-handoff-banner')).toBeNull();
|
||||
}, 30_000);
|
||||
|
||||
it('ignores a target that is not this computer', async () => {
|
||||
configOverrides.value = { oauthEnabled: false, oauthOnly: false };
|
||||
params.value = search({ mobile_redirect_uri: 'http://evil.example:51234/bulwark-desktop/callback', mobile_state: 's', mobile_code_challenge: CHALLENGE });
|
||||
render(<LoginPage />);
|
||||
await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
|
||||
expect(screen.queryByTestId('desktop-handoff-banner')).toBeNull();
|
||||
}, 30_000);
|
||||
});
|
||||
|
||||
@@ -6,7 +6,7 @@ import { IS_DESKTOP_BUILD } from "@/lib/desktop/flag";
|
||||
import { forgetDesktopServer, getDesktopBridge } from "@/lib/desktop/bridge";
|
||||
import { customServerAllowedByDesktopPolicy, jmapServerAllowedByDesktopPolicy, useDesktopPolicy } from "@/lib/desktop/policy";
|
||||
import { accountRefusedByDesktopPolicy } from "@/lib/desktop/refused-accounts";
|
||||
import { browserSignInAvailable, runDesktopBrowserSignIn } from "@/lib/desktop/browser-sign-in";
|
||||
import { browserSignInAvailable, cancelBrowserSignIn, runDesktopBrowserSignIn, runInstanceBrowserSignIn, type DesktopBrowserSignInOutcome } from "@/lib/desktop/browser-sign-in";
|
||||
import { useRouter } from "@/i18n/navigation";
|
||||
import { useParams, useSearchParams } from "next/navigation";
|
||||
import { useTranslations } from "next-intl";
|
||||
@@ -43,8 +43,8 @@ import {
|
||||
} from "@/lib/auth/lite-oauth";
|
||||
import { toAsciiDomain } from "@/lib/idn";
|
||||
import { usePrefetchMailView } from "@/hooks/use-prefetch-mail-view";
|
||||
import { buildMobileHandoffUrl, mobileCodeChallenge, mobileHandoffTarget, signedInLoginAction } from "@/lib/auth/mobile-handoff";
|
||||
import { requestMobileHandoffCodeUrl } from "@/lib/auth/mobile-handoff-client";
|
||||
import { buildMobileHandoffUrl, desktopHandoffTarget, mobileCodeChallenge, mobileHandoffTarget, signedInLoginAction } from "@/lib/auth/mobile-handoff";
|
||||
import { confirmMobileHandoffCodeUrl, parkDesktopSignIn, requestMobileHandoffCodeUrl } from "@/lib/auth/mobile-handoff-client";
|
||||
import { MobileHandoffConsent } from "@/components/auth/mobile-handoff-consent";
|
||||
import { HelpLinks } from "@/components/layout/help-links";
|
||||
import { LoginSkeleton } from "@/components/boot-skeleton/login-skeleton";
|
||||
@@ -194,11 +194,14 @@ function LoginPageContent() {
|
||||
const router = useRouter();
|
||||
const t = useTranslations("login");
|
||||
const tDesktop = useTranslations("desktop_sign_in");
|
||||
const tBrowser = useTranslations("desktop_browser_sign_in");
|
||||
const tDesktopPolicy = useTranslations("desktop_policy");
|
||||
const desktopPolicy = useDesktopPolicy();
|
||||
// Only the desktop build sets these; a browser never shows them.
|
||||
const [desktopNotice, setDesktopNotice] = useState<string | null>(null);
|
||||
const [desktopWaiting, setDesktopWaiting] = useState(false);
|
||||
// Leaving the page ends a sign-in it's waiting for: the verifier goes with it.
|
||||
useEffect(() => () => cancelBrowserSignIn(), []);
|
||||
const tSessionLimits = useTranslations("session_limits");
|
||||
const tOffline = useTranslations("offline");
|
||||
const tOfflineWipe = useTranslations("offlineWipe");
|
||||
@@ -230,9 +233,15 @@ function LoginPageContent() {
|
||||
// server to park the sign-in on and keeps handing over in the fragment.
|
||||
const rawMobileCodeChallenge = IS_LITE ? "" : searchParams.get("mobile_code_challenge") ?? "";
|
||||
const mobileChallenge = mobileCodeChallenge(rawMobileCodeChallenge);
|
||||
const mobileRedirectUri = rawMobileCodeChallenge && !mobileChallenge
|
||||
// The desktop app's loopback listener is the other target, only ever with a code and a
|
||||
// state, and the desktop build itself has no hand-off routes (lib/desktop/blocked-routes.ts).
|
||||
const desktopTarget = !IS_DESKTOP_BUILD && mobileChallenge && rawMobileState
|
||||
? desktopHandoffTarget(searchParams.get("mobile_redirect_uri"))
|
||||
: "";
|
||||
const isDesktopHandoff = Boolean(desktopTarget);
|
||||
const mobileRedirectUri = desktopTarget || (rawMobileCodeChallenge && !mobileChallenge
|
||||
? ""
|
||||
: mobileHandoffTarget(searchParams.get("mobile_redirect_uri"));
|
||||
: mobileHandoffTarget(searchParams.get("mobile_redirect_uri")));
|
||||
const mobileState = mobileRedirectUri ? rawMobileState : "";
|
||||
const isMobileHandoff = Boolean(mobileRedirectUri);
|
||||
const [pendingHandoff, setPendingHandoff] = useState<{
|
||||
@@ -392,7 +401,8 @@ function LoginPageContent() {
|
||||
const canRememberSession = rememberMeEnabled && (!IS_LITE || liteTokenLoginSupported !== false);
|
||||
// Sign-ins are remembered without asking unless the admin offers the box
|
||||
// (LOGIN_SHOW_REMEMBER_ME).
|
||||
const showRememberMe = canRememberSession && loginShowRememberMe;
|
||||
// Not in the browser the desktop app opened: nothing stays in this browser to remember.
|
||||
const showRememberMe = canRememberSession && loginShowRememberMe && !isDesktopHandoff;
|
||||
const persistSession = canRememberSession && (!loginShowRememberMe || rememberMe);
|
||||
// A provider sign-in follows the box whenever it is shown, the automatic
|
||||
// one included (it starts unticked), and is remembered otherwise. Lite
|
||||
@@ -679,7 +689,8 @@ function LoginPageContent() {
|
||||
locale: params.locale,
|
||||
server_id: selectedServer?.id,
|
||||
remember: persistProviderSession,
|
||||
...(freshLoginRequired() ? { fresh_login: true } : {}),
|
||||
// In the browser the desktop app opened, its word counts: the flag is in the app.
|
||||
...(freshLoginRequired() || (isDesktopHandoff && searchParams.get("fresh_login") === "1") ? { fresh_login: true } : {}),
|
||||
...(isMobileHandoff
|
||||
? {
|
||||
mobile_redirect_uri: mobileRedirectUri,
|
||||
@@ -692,6 +703,8 @@ function LoginPageContent() {
|
||||
|
||||
if (!res.ok) {
|
||||
setOauthLoading(false);
|
||||
// The app is waiting on this tab, so it can't just stay quiet here.
|
||||
if (isDesktopHandoff) setHandoffError("server_error");
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -713,7 +726,7 @@ function LoginPageContent() {
|
||||
} catch {
|
||||
setOauthLoading(false);
|
||||
}
|
||||
}, [params.locale, selectedServer?.id, serverUrl, desktopPolicy, tDesktopPolicy, persistProviderSession, isMobileHandoff, mobileRedirectUri, mobileState, mobileChallenge]);
|
||||
}, [params.locale, selectedServer?.id, serverUrl, desktopPolicy, tDesktopPolicy, persistProviderSession, isMobileHandoff, isDesktopHandoff, searchParams, mobileRedirectUri, mobileState, mobileChallenge]);
|
||||
|
||||
useEffect(() => {
|
||||
// After signing out, show the login page rather than signing straight
|
||||
@@ -1041,38 +1054,88 @@ function LoginPageContent() {
|
||||
window.location.href = authUrl.toString();
|
||||
};
|
||||
|
||||
/** The desktop build: the server's own sign-in page in the system browser. */
|
||||
// Spelled out, not IS_DESKTOP_BUILD: only this form keeps the route out of other
|
||||
// builds' bundles, which Lite's check on API strings relies on.
|
||||
const handleDesktopBrowserSignIn = async () => {
|
||||
/** What the user sees when a browser sign-in ends without one. Cancelling says nothing. */
|
||||
const showBrowserSignInOutcome = (outcome: DesktopBrowserSignInOutcome) => {
|
||||
setDesktopWaiting(false);
|
||||
if (outcome.kind === "policy") setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
|
||||
else if (outcome.kind === "declined") setDesktopNotice(tDesktop("server_declined"));
|
||||
else if (outcome.kind === "invalid") setDesktopNotice(tDesktop("server_invalid"));
|
||||
else if (outcome.kind === "timeout") setDesktopNotice(tBrowser("timed_out"));
|
||||
else if (outcome.kind === "no_browser") setDesktopNotice(tBrowser("no_browser"));
|
||||
else if (outcome.kind === "failed") setDesktopNotice(tBrowser("failed"));
|
||||
};
|
||||
|
||||
/** The server's or the instance's own sign-in page in the system browser. */
|
||||
const handleBrowserSignIn = async () => {
|
||||
setDesktopNotice(null);
|
||||
setDesktopPolicyNotice(null);
|
||||
// Spelled out, not IS_DESKTOP_BUILD: only this form keeps the route out of other
|
||||
// builds' bundles, which Lite's check on API strings relies on.
|
||||
if (process.env.NEXT_PUBLIC_BULWARK_DESKTOP === '1') {
|
||||
const target = jmapEndpoint.trim();
|
||||
if (!target) {
|
||||
setDesktopNotice(tDesktop("server_needed"));
|
||||
return;
|
||||
}
|
||||
setDesktopNotice(null);
|
||||
if (!jmapServerAllowedByDesktopPolicy(target, desktopPolicy)) {
|
||||
setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
|
||||
return;
|
||||
}
|
||||
setDesktopWaiting(true);
|
||||
const prefix = getPathPrefix(params.locale as string);
|
||||
const outcome = await runDesktopBrowserSignIn({
|
||||
serverUrl: target,
|
||||
callbackPath: `${prefix}/${params.locale}/auth/callback`,
|
||||
slot: useAccountStore.getState().getNextCookieSlot(),
|
||||
remember: persistProviderSession,
|
||||
addAccount: isAddAccountMode,
|
||||
fresh: freshLoginRequired(),
|
||||
redeem: (server, code, verifier, redirectUri) => useAuthStore.getState().loginWithOAuth(server, code, verifier, redirectUri),
|
||||
tryPassword: async ({ username, password, totp }) => {
|
||||
if (await useAuthStore.getState().login(target, username, password, totp, persistSession)) {
|
||||
if (!rememberMeEnabled || persistSession) saveUsername(username);
|
||||
return { ok: true };
|
||||
}
|
||||
const failed = useAuthStore.getState().error;
|
||||
return { ok: false, error: failed === "invalid_credentials" || failed === "totp_required" ? failed : "other" };
|
||||
},
|
||||
});
|
||||
if (outcome.kind === "callback") {
|
||||
window.location.href = outcome.callbackUrl;
|
||||
if (outcome.kind === "signed-in") {
|
||||
setDesktopWaiting(false);
|
||||
router.push('/');
|
||||
return;
|
||||
}
|
||||
setDesktopWaiting(false);
|
||||
forgetDesktopServer(target, "failed");
|
||||
if (outcome.kind === "unavailable") setDesktopNotice(tDesktop("browser_unavailable"));
|
||||
else if (outcome.kind === "declined") setDesktopNotice(tDesktop("server_declined"));
|
||||
else if (outcome.kind === "failed") setDesktopNotice(tDesktop("browser_failed"));
|
||||
showBrowserSignInOutcome(outcome);
|
||||
return;
|
||||
}
|
||||
// A server the device's OS policy refuses, where it's known up front. With a list of
|
||||
// servers the browser picks, and the redeem below is what checks.
|
||||
if (!hasServerList && serverUrl && !jmapServerAllowedByDesktopPolicy(serverUrl, desktopPolicy)) {
|
||||
setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
|
||||
return;
|
||||
}
|
||||
setDesktopWaiting(true);
|
||||
const outcome = await runInstanceBrowserSignIn({
|
||||
base: `${window.location.origin}${getPathPrefix(params.locale as string)}`,
|
||||
locale: params.locale as string,
|
||||
fresh: freshLoginRequired(),
|
||||
});
|
||||
if (outcome.kind !== "code") {
|
||||
showBrowserSignInOutcome(outcome);
|
||||
return;
|
||||
}
|
||||
const redeemed = await useAuthStore.getState().loginWithDesktopHandoff(outcome.code, outcome.verifier, {
|
||||
remember: persistProviderSession,
|
||||
rememberPassword: persistSession,
|
||||
allowedServers: desktopPolicy.AllowedJmapServers.value,
|
||||
});
|
||||
setDesktopWaiting(false);
|
||||
if (redeemed === "ok") router.push('/');
|
||||
else if (redeemed === "blocked") setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
|
||||
else setDesktopNotice(tBrowser("failed"));
|
||||
};
|
||||
|
||||
const browserSignInShown = browserSignInAvailable();
|
||||
|
||||
const handleSubmit = async (e: React.FormEvent) => {
|
||||
e.preventDefault();
|
||||
|
||||
@@ -1080,6 +1143,38 @@ function LoginPageContent() {
|
||||
// when the admin hasn't configured a server list.
|
||||
const effectiveServerUrl = selectedServer?.url
|
||||
|| (allowCustomJmapEndpoint ? jmapEndpoint : serverUrl);
|
||||
// The desktop app opened this page in the user's browser. The password is checked and
|
||||
// parked for the app, and this browser gets no session of its own out of it.
|
||||
if (isDesktopHandoff) {
|
||||
useAuthStore.setState({ isLoading: true, error: null });
|
||||
setHandoffError(null);
|
||||
const prefix = getPathPrefix(params.locale as string);
|
||||
const parked = await parkDesktopSignIn({
|
||||
challenge: mobileChallenge,
|
||||
state: mobileState,
|
||||
serverUrl: effectiveServerUrl,
|
||||
serverId: selectedServer?.id,
|
||||
username: formData.username,
|
||||
password: formData.password,
|
||||
totp: totpCode || undefined,
|
||||
redirectUri: `${window.location.origin}${prefix}/${params.locale}/auth/callback`,
|
||||
});
|
||||
if ("error" in parked) {
|
||||
useAuthStore.setState({
|
||||
isLoading: false,
|
||||
error: parked.error === "invalid_credentials" || parked.error === "totp_required" ? parked.error : "server_error",
|
||||
});
|
||||
return;
|
||||
}
|
||||
useAuthStore.setState({ isLoading: false });
|
||||
const { code } = parked;
|
||||
setPendingHandoff({
|
||||
url: null,
|
||||
resolveUrl: () => confirmMobileHandoffCodeUrl({ target: mobileRedirectUri, code, state: mobileState }),
|
||||
username: formData.username,
|
||||
});
|
||||
return;
|
||||
}
|
||||
// The device's OS policy, also on an instance: nothing is sent to a server it refuses.
|
||||
setDesktopPolicyNotice(null);
|
||||
if (!jmapServerAllowedByDesktopPolicy(effectiveServerUrl, desktopPolicy)) {
|
||||
@@ -1193,6 +1288,53 @@ function LoginPageContent() {
|
||||
// has to pick which one SSO targets before the button starts the flow, since
|
||||
// the selection drives OAuth discovery and the server_id sent to the callback
|
||||
// (issue #799).
|
||||
// In the app: the main way in, above the form, which stays as the other choice.
|
||||
const browserSignInOption = browserSignInShown && (
|
||||
<div className="space-y-3">
|
||||
<Button
|
||||
type="button"
|
||||
className="w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
|
||||
onClick={handleBrowserSignIn}
|
||||
disabled={desktopWaiting || isLoading}
|
||||
data-testid="desktop-browser-sign-in"
|
||||
>
|
||||
{desktopWaiting ? <Loader2 className="w-4 h-4 animate-spin me-2" /> : <LogIn className="w-4 h-4 me-2" />}
|
||||
{desktopWaiting ? tBrowser("waiting") : tBrowser("button")}
|
||||
</Button>
|
||||
{desktopWaiting && (
|
||||
<p role="status" data-testid="desktop-browser-waiting" className="text-center text-xs text-muted-foreground leading-relaxed">
|
||||
{tBrowser("waiting_hint")}{" "}
|
||||
<button
|
||||
type="button"
|
||||
className="underline hover:text-foreground"
|
||||
data-testid="desktop-browser-cancel"
|
||||
onClick={() => {
|
||||
cancelBrowserSignIn();
|
||||
setDesktopWaiting(false);
|
||||
}}
|
||||
>
|
||||
{tBrowser("cancel")}
|
||||
</button>
|
||||
</p>
|
||||
)}
|
||||
<div className="relative py-1">
|
||||
<div className="absolute inset-0 flex items-center">
|
||||
<span className="w-full border-t border-border/60" />
|
||||
</div>
|
||||
<div className="relative flex justify-center text-xs">
|
||||
<span className="bg-background/80 px-3 text-muted-foreground">{tBrowser("or_here")}</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
|
||||
// The desktop app's sign-in, in the browser: says what this page is for.
|
||||
const desktopHandoffBanner = isDesktopHandoff && (
|
||||
<p data-testid="desktop-handoff-banner" className="mb-4 text-center text-sm text-muted-foreground leading-relaxed">
|
||||
{tBrowser("handoff_banner")}
|
||||
</p>
|
||||
);
|
||||
|
||||
const desktopPolicyAlert = desktopPolicyNotice && (
|
||||
<p role="alert" data-testid="desktop-policy-notice" className="mt-2 text-sm text-warning leading-relaxed">
|
||||
{desktopPolicyNotice}
|
||||
@@ -1426,9 +1568,11 @@ function LoginPageContent() {
|
||||
url={pendingHandoff?.url ?? null}
|
||||
resolveUrl={pendingHandoff?.resolveUrl ?? null}
|
||||
username={pendingHandoff?.username ?? ""}
|
||||
desktop={isDesktopHandoff}
|
||||
onCancel={() => {
|
||||
setPendingHandoff(null);
|
||||
router.push('/');
|
||||
// The app's sign-in stays open here, to try again or to leave.
|
||||
if (!isDesktopHandoff) router.push('/');
|
||||
}}
|
||||
onError={() => {
|
||||
setPendingHandoff(null);
|
||||
@@ -1598,6 +1742,8 @@ function LoginPageContent() {
|
||||
</div>
|
||||
)}
|
||||
|
||||
{desktopHandoffBanner}
|
||||
|
||||
{/* Dev Mode: One-click login */}
|
||||
{devMode ? (
|
||||
<div className="space-y-4">
|
||||
@@ -1629,10 +1775,14 @@ function LoginPageContent() {
|
||||
{serverPicker}
|
||||
{desktopPolicyAlert}
|
||||
{oauthMetadata && showRememberMe && rememberMeBox}
|
||||
{browserSignInOption}
|
||||
{oauthMetadata ? (
|
||||
<Button
|
||||
type="button"
|
||||
className="w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
|
||||
variant={browserSignInShown ? "outline" : undefined}
|
||||
className={browserSignInShown
|
||||
? "w-full h-11 font-medium text-[0.9375rem] rounded-xl border-border/60 hover:bg-muted/50"
|
||||
: "w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"}
|
||||
onClick={() => handleOAuthLogin()}
|
||||
disabled={oauthLoading}
|
||||
>
|
||||
@@ -1663,6 +1813,11 @@ function LoginPageContent() {
|
||||
// Where the sign-in button goes once the provider answers.
|
||||
<Block className="w-full h-11 rounded-xl" />
|
||||
)}
|
||||
{desktopNotice && (
|
||||
<p role="alert" data-testid="desktop-notice" className="mt-2 text-sm text-warning leading-relaxed">
|
||||
{desktopNotice}
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
) : (
|
||||
/* Login Form */
|
||||
@@ -1690,6 +1845,8 @@ function LoginPageContent() {
|
||||
</div>
|
||||
)}
|
||||
|
||||
{browserSignInOption}
|
||||
|
||||
{/* Username field. The access token names the account, so
|
||||
token sign-in has none. */}
|
||||
<div className={cn("space-y-1.5", signInWithToken && "hidden")}>
|
||||
@@ -1897,7 +2054,10 @@ function LoginPageContent() {
|
||||
|
||||
<Button
|
||||
type="submit"
|
||||
className="w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
|
||||
variant={browserSignInShown ? "outline" : undefined}
|
||||
className={browserSignInShown
|
||||
? "w-full h-11 font-medium text-[0.9375rem] rounded-xl border-border/60 hover:bg-muted/50"
|
||||
: "w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"}
|
||||
disabled={isLoading || (liteSsoRequired && oauthLoading)}
|
||||
>
|
||||
{isLoading || (liteSsoRequired && oauthLoading) ? (
|
||||
@@ -1944,21 +2104,8 @@ function LoginPageContent() {
|
||||
</>
|
||||
)}
|
||||
|
||||
{process.env.NEXT_PUBLIC_BULWARK_DESKTOP === "1" && !hasServerList && browserSignInAvailable() && (
|
||||
<Button
|
||||
type="button"
|
||||
variant="outline"
|
||||
className="mt-3 w-full h-11 font-medium text-[0.9375rem] rounded-xl border-border/60 hover:bg-muted/50"
|
||||
onClick={handleDesktopBrowserSignIn}
|
||||
disabled={desktopWaiting || isLoading}
|
||||
data-testid="desktop-browser-sign-in"
|
||||
>
|
||||
{desktopWaiting ? <Loader2 className="w-4 h-4 animate-spin me-2" /> : <LogIn className="w-4 h-4 me-2" />}
|
||||
{desktopWaiting ? tDesktop("browser_waiting") : tDesktop("browser_button")}
|
||||
</Button>
|
||||
)}
|
||||
{desktopPolicyAlert}
|
||||
{IS_DESKTOP_BUILD && desktopNotice && (
|
||||
{desktopNotice && (
|
||||
<p role="alert" data-testid="desktop-notice" className="mt-2 text-sm text-warning leading-relaxed">
|
||||
{desktopNotice}
|
||||
</p>
|
||||
|
||||
@@ -0,0 +1,161 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { logger } from '@/lib/logger';
|
||||
import { configManager } from '@/lib/admin/config-manager';
|
||||
import { findServerById, findServerByUrl, parseJmapServers, resolveTrustedJmapUrl } from '@/lib/admin/jmap-servers';
|
||||
import { loginClientAddress } from '@/lib/auth/client-address';
|
||||
import { isHandoffCodeChallenge, reserveHandoffCreate, stashHandoff } from '@/lib/auth/handoff-store';
|
||||
import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
|
||||
import { stalwartPasswordLogin } from '@/lib/auth/stalwart-password-login';
|
||||
import { LOGIN_BUDGET_RETRY_AFTER_SECONDS, reserveLoginAttempt } from '@/lib/auth/verify-budget';
|
||||
import { JmapAuthVerificationError, verifyJmapAuth } from '@/lib/auth/verify-jmap-auth';
|
||||
import { IS_DESKTOP_BUILD } from '@/lib/desktop/flag';
|
||||
import { readFileEnv } from '@/lib/read-file-env';
|
||||
import { DEFAULT_CLIENT_ID } from '@/lib/oauth/token-exchange';
|
||||
import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
|
||||
import { isPublicHttpUrl } from '@/lib/security/url-guard';
|
||||
|
||||
// The desktop app's "Sign in with your browser", on the browser's side. The app opened
|
||||
// this instance's login page with a PKCE challenge. The page posts the password here
|
||||
// instead of signing the browser in: the user came to sign the app in, and a session
|
||||
// left in their default browser is something they didn't ask for. So nothing here
|
||||
// writes a cookie. The password is checked against the mail server and parked, and the
|
||||
// page takes the code to the app's loopback listener once the user has confirmed.
|
||||
//
|
||||
// With a two-factor code the code is spent here, so what's parked is the tokens it gets,
|
||||
// not the password: the app could never present that code a second time.
|
||||
|
||||
const NO_STORE = { 'Cache-Control': 'no-store' };
|
||||
|
||||
function bounded(value: unknown, max: number): value is string {
|
||||
return typeof value === 'string' && value.length > 0 && value.length <= max;
|
||||
}
|
||||
|
||||
function answer(error: string, status: number) {
|
||||
return NextResponse.json({ error }, { status, headers: NO_STORE });
|
||||
}
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
if (IS_DESKTOP_BUILD) return answer('Not found', 404);
|
||||
const crossOrigin = rejectCrossOriginRequest(request);
|
||||
if (crossOrigin) return crossOrigin;
|
||||
try {
|
||||
const body = await request.json().catch(() => null);
|
||||
const challenge = body?.code_challenge;
|
||||
const state = typeof body?.state === 'string' ? body.state : '';
|
||||
const totp = typeof body?.totp === 'string' && body.totp ? body.totp : undefined;
|
||||
const requestedServerId = typeof body?.server_id === 'string' && body.server_id ? body.server_id : null;
|
||||
if (
|
||||
!isHandoffCodeChallenge(challenge)
|
||||
|| !state
|
||||
|| state.length > 512
|
||||
|| !bounded(body?.server_url, 2048)
|
||||
|| !bounded(body?.username, 512)
|
||||
|| !bounded(body?.password, 4096)
|
||||
|| (totp !== undefined && totp.length > 16)
|
||||
) {
|
||||
return answer('invalid_request', 400);
|
||||
}
|
||||
|
||||
await configManager.ensureLoaded();
|
||||
if (configManager.get<boolean>('oauthEnabled', false) && configManager.get<boolean>('oauthOnly', false)) {
|
||||
return answer('oauth_only', 403);
|
||||
}
|
||||
|
||||
// The same pinning as the sign-in routes.
|
||||
const serverUrl: string = body.server_url;
|
||||
// This route is the browser's. It has no business with the device's policy.
|
||||
const configured =
|
||||
configManager.get<string>('jmapServerUrl', '') || process.env.JMAP_SERVER_URL || process.env.NEXT_PUBLIC_JMAP_SERVER_URL || '';
|
||||
const list = parseJmapServers(configManager.get<unknown>('jmapServers', []));
|
||||
const allowCustom = configManager.get<boolean>('allowCustomJmapEndpoint', false);
|
||||
const entry = findServerById(list, requestedServerId) || findServerByUrl(list, serverUrl);
|
||||
// What's checked is what's parked: the app signs in to this one, whatever the body said.
|
||||
let resolved: string;
|
||||
let trusted = true;
|
||||
if (entry) {
|
||||
resolved = entry.url;
|
||||
} else {
|
||||
const pinned = resolveTrustedJmapUrl(serverUrl, configured, list);
|
||||
if (pinned) {
|
||||
resolved = pinned;
|
||||
} else if (allowCustom && (await isPublicHttpUrl(serverUrl))) {
|
||||
resolved = serverUrl;
|
||||
trusted = false;
|
||||
} else {
|
||||
return answer('invalid_server_url', 400);
|
||||
}
|
||||
}
|
||||
const upstream = resolved.replace(/\/+$/, '');
|
||||
|
||||
const clientIp = loginClientAddress(request, upstream);
|
||||
const refund = await reserveLoginAttempt(clientIp);
|
||||
if (!refund) {
|
||||
return NextResponse.json(
|
||||
{ error: 'too_many_attempts' },
|
||||
{ status: 429, headers: { ...NO_STORE, 'Retry-After': String(LOGIN_BUDGET_RETRY_AFTER_SECONDS) } },
|
||||
);
|
||||
}
|
||||
|
||||
let parked: Parameters<typeof stashHandoff>[0];
|
||||
if (totp) {
|
||||
const configuredClientId =
|
||||
entry?.oauth?.clientId || configManager.get<string>('oauthClientId', '') || process.env.OAUTH_CLIENT_ID;
|
||||
const clientSecret =
|
||||
entry?.oauth?.clientSecret
|
||||
|| configManager.get<string>('oauthClientSecret', '')
|
||||
|| process.env.OAUTH_CLIENT_SECRET
|
||||
|| readFileEnv(process.env.OAUTH_CLIENT_SECRET_FILE)
|
||||
|| '';
|
||||
const redirectUri = typeof body?.redirect_uri === 'string' && /^https?:\/\//.test(body.redirect_uri) ? body.redirect_uri : upstream;
|
||||
const result = await stalwartPasswordLogin({
|
||||
serverUrl: upstream,
|
||||
username: body.username,
|
||||
password: body.password,
|
||||
totp,
|
||||
clientId: configuredClientId || DEFAULT_CLIENT_ID,
|
||||
clientSecret,
|
||||
redirectUri,
|
||||
trusted,
|
||||
clientIp,
|
||||
registerUnknownClient: !configuredClientId,
|
||||
});
|
||||
if (result.ok || result.error !== 'invalid_credentials') await refund();
|
||||
if (!result.ok) {
|
||||
if (result.error === 'invalid_credentials') return answer('invalid_credentials', 401);
|
||||
if (result.error === 'totp_required') return answer('totp_required', 401);
|
||||
return answer('login_failed', 502);
|
||||
}
|
||||
parked = {
|
||||
flow: 'desktop-tokens',
|
||||
server_url: resolved,
|
||||
server_id: entry?.id ?? null,
|
||||
access_token: result.tokens.access_token,
|
||||
refresh_token: result.tokens.refresh_token,
|
||||
expires_in: result.tokens.expires_in ?? 3600,
|
||||
signed_in_at: Date.now(),
|
||||
};
|
||||
} else {
|
||||
try {
|
||||
await verifyJmapAuth(upstream, `Basic ${Buffer.from(`${body.username}:${body.password}`).toString('base64')}`, { trusted, clientIp });
|
||||
await refund();
|
||||
} catch (error) {
|
||||
const status = error instanceof JmapAuthVerificationError ? error.upstreamStatus : undefined;
|
||||
if (status === 401) return answer('invalid_credentials', 401);
|
||||
await refund();
|
||||
// Stalwart: the right password on an account with a second factor.
|
||||
if (status === 402) return answer('totp_required', 401);
|
||||
return answer('login_failed', 502);
|
||||
}
|
||||
parked = { flow: 'desktop-password', server_url: resolved, server_id: entry?.id ?? null, username: body.username, password: body.password };
|
||||
}
|
||||
|
||||
if (!(await reserveHandoffCreate(clientIp))) return answer('too_many_requests', 429);
|
||||
const code = await stashHandoff(parked, { challenge, state, awaitConfirm: true });
|
||||
logger.info('Desktop hand-off parked', { flow: parked.flow });
|
||||
return NextResponse.json({ code }, { headers: NO_STORE });
|
||||
} catch (error) {
|
||||
if (isStoreUnavailable(error)) return storeUnavailableResponse(NO_STORE);
|
||||
logger.error('Desktop hand-off park error', { error: error instanceof Error ? error.message : 'Unknown error' });
|
||||
return answer('Internal server error', 500);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,104 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { cookies } from 'next/headers';
|
||||
import { logger } from '@/lib/logger';
|
||||
import { MAX_ACCOUNT_SLOTS } from '@/lib/account-utils';
|
||||
import { loginClientAddress } from '@/lib/auth/client-address';
|
||||
import { isHandoffCode, isHandoffCodeVerifier, redeemHandoff, reserveHandoffRedeem } from '@/lib/auth/handoff-store';
|
||||
import { writeSignInStamp } from '@/lib/auth/session-age';
|
||||
import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
|
||||
import type { BudgetRefund } from '@/lib/auth/verify-budget';
|
||||
import { IS_DESKTOP_BUILD } from '@/lib/desktop/flag';
|
||||
import { jmapServerAllowed } from '@/lib/desktop/policy-schema';
|
||||
import { getCookieOptions, getSignInCookieOptions } from '@/lib/oauth/cookie-config';
|
||||
import { storeIdToken } from '@/lib/oauth/end-session';
|
||||
import { refreshTokenCookieName, refreshTokenServerCookieName } from '@/lib/oauth/tokens';
|
||||
import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
|
||||
|
||||
// The desktop app's side of "Sign in with your browser", on an instance. The app's own
|
||||
// page posts the code its loopback listener received, with the PKCE verifier behind the
|
||||
// challenge it opened the browser with. Same origin as the page, so an instance's cookies
|
||||
// set here work under SameSite=Strict. Every attempt spends the code.
|
||||
//
|
||||
// The device's own list of servers is the page's to send: only it knows the OS policy,
|
||||
// and the browser the user signed in with knows nothing of it. A refused server gets
|
||||
// nothing written.
|
||||
|
||||
const NO_STORE = { 'Cache-Control': 'no-store' };
|
||||
|
||||
function answer(error: string, status: number, extra: Record<string, unknown> = {}) {
|
||||
return NextResponse.json({ error, ...extra }, { status, headers: NO_STORE });
|
||||
}
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
if (IS_DESKTOP_BUILD) return answer('Not found', 404);
|
||||
const crossOrigin = rejectCrossOriginRequest(request);
|
||||
if (crossOrigin) return crossOrigin;
|
||||
let refund: BudgetRefund | null = null;
|
||||
try {
|
||||
refund = await reserveHandoffRedeem(loginClientAddress(request));
|
||||
if (!refund) return answer('too_many_requests', 429);
|
||||
|
||||
const body = await request.json().catch(() => null);
|
||||
const code = body?.code;
|
||||
const verifier = body?.code_verifier;
|
||||
if (!isHandoffCode(code)) return answer('invalid_request', 400);
|
||||
if (!isHandoffCodeVerifier(verifier)) {
|
||||
await redeemHandoff(code, '');
|
||||
return answer('invalid_verifier', 400);
|
||||
}
|
||||
const slot = typeof body?.slot === 'number' && Number.isInteger(body.slot) && body.slot >= 0 && body.slot < MAX_ACCOUNT_SLOTS ? body.slot : 0;
|
||||
const remember = body?.remember !== false;
|
||||
const allowedServers = Array.isArray(body?.allowed_servers) ? (body.allowed_servers as string[]) : null;
|
||||
|
||||
const result = await redeemHandoff(code, verifier);
|
||||
if (!result.ok) {
|
||||
logger.warn('Desktop hand-off redeem refused', { reason: result.reason });
|
||||
return answer(result.reason === 'verifier_mismatch' ? 'invalid_verifier' : `${result.reason}_code`, 400);
|
||||
}
|
||||
const parked = result.bundle;
|
||||
// A code the mobile path parked isn't one of ours.
|
||||
if (parked.flow !== 'desktop-password' && parked.flow !== 'desktop-tokens') return answer('invalid_code', 400);
|
||||
if (!jmapServerAllowed(allowedServers, parked.server_url)) return answer('blocked_by_policy', 403, { code: 'blocked_by_policy' });
|
||||
|
||||
await refund();
|
||||
logger.info('Desktop hand-off redeemed', { flow: parked.flow });
|
||||
|
||||
if (parked.flow === 'desktop-password') {
|
||||
// Down the app's normal login path, from the page, like a typed password.
|
||||
return NextResponse.json(
|
||||
{ flow: 'password', server_url: parked.server_url, username: parked.username, password: parked.password },
|
||||
{ headers: NO_STORE },
|
||||
);
|
||||
}
|
||||
|
||||
const cookieStore = await cookies();
|
||||
if (parked.refresh_token) {
|
||||
const options = getSignInCookieOptions(remember);
|
||||
cookieStore.set(refreshTokenCookieName(slot), parked.refresh_token, options);
|
||||
writeSignInStamp(cookieStore, slot, { signedInAt: parked.signed_in_at, refreshToken: parked.refresh_token }, options);
|
||||
}
|
||||
const serverCookie = refreshTokenServerCookieName(slot);
|
||||
if (parked.server_id) cookieStore.set(serverCookie, parked.server_id, getCookieOptions());
|
||||
else cookieStore.delete(serverCookie);
|
||||
storeIdToken(cookieStore, slot, parked.id_token, request.nextUrl.basePath, [parked.refresh_token, parked.server_id], remember);
|
||||
|
||||
return NextResponse.json(
|
||||
{
|
||||
flow: 'tokens',
|
||||
server_url: parked.server_url,
|
||||
access_token: parked.access_token,
|
||||
expires_in: parked.expires_in,
|
||||
signed_in_at: parked.signed_in_at,
|
||||
remember,
|
||||
},
|
||||
{ headers: NO_STORE },
|
||||
);
|
||||
} catch (error) {
|
||||
if (isStoreUnavailable(error)) {
|
||||
if (refund) await refund();
|
||||
return storeUnavailableResponse(NO_STORE);
|
||||
}
|
||||
logger.error('Desktop hand-off redeem error', { error: error instanceof Error ? error.message : 'Unknown error' });
|
||||
return answer('Internal server error', 500);
|
||||
}
|
||||
}
|
||||
@@ -10,6 +10,8 @@ import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
|
||||
/** The client id on a server that won't register one: 0.16 accepts any id. */
|
||||
const FALLBACK_CLIENT_ID = 'bulwark-desktop';
|
||||
const REGISTERED_REDIRECT = 'http://127.0.0.1/bulwark-desktop/callback';
|
||||
/** Only tried when the server says no to loopback. Neither Stalwart line takes this one. */
|
||||
const SCHEME_REDIRECT = 'bulwark://sign-in/callback';
|
||||
const REGISTER_TIMEOUT_MS = 5000;
|
||||
|
||||
function isLoopbackRedirect(value: unknown): boolean {
|
||||
@@ -27,29 +29,42 @@ function isLoopbackRedirect(value: unknown): boolean {
|
||||
* ids are stateless, so the same metadata gives the same id and nothing is
|
||||
* stored. It accepts a loopback redirect and ignores the port when matching.
|
||||
*/
|
||||
async function registerClient(base: string, scope: string): Promise<string> {
|
||||
async function postRegistration(endpoint: string, redirectUri: string, scope: string): Promise<Response> {
|
||||
return fetch(endpoint, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
client_name: 'Bulwark',
|
||||
redirect_uris: [redirectUri],
|
||||
token_endpoint_auth_method: 'none',
|
||||
grant_types: ['authorization_code', 'refresh_token'],
|
||||
response_types: ['code'],
|
||||
scope,
|
||||
}),
|
||||
redirect: 'error',
|
||||
signal: AbortSignal.timeout(REGISTER_TIMEOUT_MS),
|
||||
});
|
||||
}
|
||||
|
||||
async function clientIdOf(response: Response): Promise<string | null> {
|
||||
const body = (await response.json().catch(() => null)) as { client_id?: unknown } | null;
|
||||
return typeof body?.client_id === 'string' && body.client_id ? body.client_id : null;
|
||||
}
|
||||
|
||||
async function registerClient(endpoint: string, scope: string): Promise<{ clientId: string; useScheme: boolean }> {
|
||||
try {
|
||||
const response = await fetch(`${base}/auth/register`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
client_name: 'Bulwark',
|
||||
redirect_uris: [REGISTERED_REDIRECT],
|
||||
token_endpoint_auth_method: 'none',
|
||||
grant_types: ['authorization_code', 'refresh_token'],
|
||||
response_types: ['code'],
|
||||
scope,
|
||||
}),
|
||||
redirect: 'error',
|
||||
signal: AbortSignal.timeout(REGISTER_TIMEOUT_MS),
|
||||
});
|
||||
if (!response.ok) return FALLBACK_CLIENT_ID;
|
||||
const body = (await response.json()) as { client_id?: unknown };
|
||||
return typeof body.client_id === 'string' && body.client_id ? body.client_id : FALLBACK_CLIENT_ID;
|
||||
const response = await postRegistration(endpoint, REGISTERED_REDIRECT, scope);
|
||||
if (response.ok) return { clientId: (await clientIdOf(response)) ?? FALLBACK_CLIENT_ID, useScheme: false };
|
||||
const refusal = (await response.json().catch(() => null)) as { error?: unknown } | null;
|
||||
if (refusal?.error === 'invalid_redirect_uri') {
|
||||
const second = await postRegistration(endpoint, SCHEME_REDIRECT, scope);
|
||||
const clientId = second.ok ? await clientIdOf(second) : null;
|
||||
if (clientId) return { clientId, useScheme: true };
|
||||
}
|
||||
} catch (error) {
|
||||
logger.warn('Desktop OAuth: client registration failed', { error: error instanceof Error ? error.message : String(error) });
|
||||
return FALLBACK_CLIENT_ID;
|
||||
}
|
||||
return { clientId: FALLBACK_CLIENT_ID, useScheme: false };
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -74,10 +89,17 @@ export async function POST(request: NextRequest) {
|
||||
if (!metadata) return NextResponse.json({ error: 'no_oauth' }, { status: 404 });
|
||||
|
||||
const scope = withProviderDataScopes(DEFAULT_OAUTH_SCOPES, metadata.scopes_supported);
|
||||
// RFC 8414 says where. Without it, Stalwart's path: 0.16's documents don't always name it.
|
||||
const validate = getDiscoveryValidator(upstream.serverUrl);
|
||||
const named = metadata.registration_endpoint;
|
||||
const endpoint = named && (!validate || (await validate(named))) ? named : `${upstream.serverUrl}/auth/register`;
|
||||
const { clientId, useScheme } = await registerClient(endpoint, scope);
|
||||
return NextResponse.json({
|
||||
authorization_endpoint: metadata.authorization_endpoint,
|
||||
client_id: await registerClient(upstream.serverUrl, scope),
|
||||
client_id: clientId,
|
||||
scope,
|
||||
issuer: metadata.issuer,
|
||||
...(useScheme ? { use_scheme: true } : {}),
|
||||
});
|
||||
} catch (error) {
|
||||
logger.error('Desktop OAuth discovery failed', { error: error instanceof Error ? error.message : 'Unknown error' });
|
||||
|
||||
@@ -53,6 +53,11 @@ export async function POST(request: NextRequest) {
|
||||
return NextResponse.json({ error }, { status: 400, headers: NO_STORE });
|
||||
}
|
||||
|
||||
// The desktop app's sign-in has its own redeem, which writes cookies from these fields.
|
||||
if (result.bundle.flow === 'desktop-password' || result.bundle.flow === 'desktop-tokens') {
|
||||
return NextResponse.json({ error: 'invalid_code' }, { status: 400, headers: NO_STORE });
|
||||
}
|
||||
|
||||
await refund();
|
||||
logger.info('Mobile hand-off redeemed', { flow: result.bundle.flow });
|
||||
return NextResponse.json({ ...result.bundle, state: result.state }, { headers: NO_STORE });
|
||||
|
||||
@@ -10,6 +10,7 @@ import {
|
||||
} from '@/lib/oauth/token-exchange';
|
||||
import { buildRedeemBundle } from '@/lib/auth/pair-bundle';
|
||||
import { isHandoffCodeChallenge, stashHandoff } from '@/lib/auth/handoff-store';
|
||||
import { desktopHandoffTarget } from '@/lib/auth/mobile-handoff';
|
||||
import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
|
||||
import { refreshTokenCookieName, refreshTokenServerCookieName } from '@/lib/oauth/tokens';
|
||||
import { getCookieOptions, getSignInCookieOptions } from '@/lib/oauth/cookie-config';
|
||||
@@ -149,6 +150,28 @@ export async function POST(request: NextRequest) {
|
||||
// builds refuse a provider on another host, so those renew through
|
||||
// this webmail - the same bundle a paired phone gets.
|
||||
const { clientId, serverUrl } = getRequiredConfig(pendingServerId);
|
||||
if (mobileRedirectUri && desktopHandoffTarget(mobileRedirectUri)) {
|
||||
// The desktop app on this instance: its redeem writes its own cookies, the way
|
||||
// the code below would have for this browser. sso/start made sure of a challenge.
|
||||
if (!mobileCodeChallenge) throw new Error('desktop hand-off without a challenge');
|
||||
const handoffCode = await stashHandoff({
|
||||
flow: 'desktop-tokens',
|
||||
server_url: serverUrl,
|
||||
server_id: pendingServerId,
|
||||
access_token: tokens.access_token,
|
||||
refresh_token: tokens.refresh_token,
|
||||
id_token: tokens.id_token,
|
||||
expires_in: tokens.expires_in ?? 3600,
|
||||
signed_in_at: signedInAt,
|
||||
}, { challenge: mobileCodeChallenge, state: mobileState ?? '', awaitConfirm: true });
|
||||
logger.info('Desktop hand-off parked', { flow: 'desktop-tokens' });
|
||||
return NextResponse.json({
|
||||
mobile_handoff_code: handoffCode,
|
||||
server_url: serverUrl,
|
||||
mobile_redirect_uri: mobileRedirectUri,
|
||||
mobile_state: mobileState,
|
||||
});
|
||||
}
|
||||
const bundle = buildRedeemBundle({
|
||||
flow: 'oauth',
|
||||
serverUrl,
|
||||
|
||||
@@ -12,7 +12,7 @@ import { getCookieOptions } from '@/lib/oauth/cookie-config';
|
||||
import { hasSessionSecret } from '@/lib/auth/session-secret';
|
||||
import { configManager } from '@/lib/admin/config-manager';
|
||||
import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
|
||||
import { isMobileCodeChallenge, mobileHandoffTarget } from '@/lib/auth/mobile-handoff';
|
||||
import { desktopHandoffTarget, isMobileCodeChallenge, mobileHandoffTarget } from '@/lib/auth/mobile-handoff';
|
||||
|
||||
const SSO_PENDING_COOKIE = 'sso_pending';
|
||||
const SSO_PENDING_MAX_AGE = 300; // 5 minutes
|
||||
@@ -73,9 +73,14 @@ export async function POST(request: NextRequest) {
|
||||
: null;
|
||||
const mobileState =
|
||||
typeof rawMobileState === 'string' && rawMobileState ? rawMobileState : null;
|
||||
if (mobileRedirectUri && !mobileHandoffTarget(mobileRedirectUri)) {
|
||||
if (mobileRedirectUri && !mobileHandoffTarget(mobileRedirectUri) && !desktopHandoffTarget(mobileRedirectUri)) {
|
||||
return NextResponse.json({ error: 'Invalid mobile_redirect_uri' }, { status: 400 });
|
||||
}
|
||||
// The desktop app's listener only ever gets a code. Without a challenge there'd be
|
||||
// tokens in the answer, on the way to a link.
|
||||
if (mobileRedirectUri && desktopHandoffTarget(mobileRedirectUri) && !isMobileCodeChallenge(rawMobileCodeChallenge)) {
|
||||
return NextResponse.json({ error: 'Invalid mobile_code_challenge' }, { status: 400 });
|
||||
}
|
||||
// An app build that sends a PKCE challenge gets a one-time code instead
|
||||
// of the tokens (lib/auth/handoff-store.ts). A malformed one is refused
|
||||
// rather than ignored, which would hand the tokens over in the link.
|
||||
|
||||
@@ -19,6 +19,8 @@ interface MobileHandoffConsentProps {
|
||||
onCancel: () => void;
|
||||
/** `resolveUrl` returned null: nothing was handed over. */
|
||||
onError?: () => void;
|
||||
/** The desktop app on this computer, not the phone's app. */
|
||||
desktop?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -29,8 +31,9 @@ interface MobileHandoffConsentProps {
|
||||
* `bulwarkmobile` scheme on the device receives whatever is handed over
|
||||
* (lib/auth/mobile-handoff.ts). Nothing leaves without this confirmation.
|
||||
*/
|
||||
export function MobileHandoffConsent({ url, resolveUrl, username, onCancel, onError }: MobileHandoffConsentProps) {
|
||||
export function MobileHandoffConsent({ url, resolveUrl, username, onCancel, onError, desktop }: MobileHandoffConsentProps) {
|
||||
const t = useTranslations("login");
|
||||
const tDesktop = useTranslations("desktop_browser_sign_in");
|
||||
// The dialog closes itself right after confirming; while the code is being
|
||||
// made live, that close must not count as declining.
|
||||
const resolving = useRef(false);
|
||||
@@ -51,16 +54,18 @@ export function MobileHandoffConsent({ url, resolveUrl, username, onCancel, onEr
|
||||
return;
|
||||
}
|
||||
window.location.replace(resolved);
|
||||
onCancel();
|
||||
// A custom scheme leaves this page where it is. The desktop app's listener is
|
||||
// a page of its own, and going anywhere now could overtake it.
|
||||
if (!desktop) onCancel();
|
||||
});
|
||||
return;
|
||||
}
|
||||
if (url) window.location.replace(url);
|
||||
}}
|
||||
title={t("mobile_handoff.title")}
|
||||
message={t("mobile_handoff.description", { username })}
|
||||
confirmText={t("mobile_handoff.confirm")}
|
||||
cancelText={t("mobile_handoff.cancel")}
|
||||
title={desktop ? tDesktop("consent_title") : t("mobile_handoff.title")}
|
||||
message={desktop ? tDesktop("consent_description", { username }) : t("mobile_handoff.description", { username })}
|
||||
confirmText={desktop ? tDesktop("consent_confirm") : t("mobile_handoff.confirm")}
|
||||
cancelText={desktop ? tDesktop("consent_cancel") : t("mobile_handoff.cancel")}
|
||||
/>
|
||||
);
|
||||
}
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
import { useEffect, useState } from "react";
|
||||
import { applyControlsArea, watchTitlebarArea, watchWindowRows, type TitlebarArea } from "@/lib/window-controls-overlay";
|
||||
import { claimBrowserSignIn } from "@/lib/desktop/browser-sign-in";
|
||||
|
||||
/**
|
||||
* The window's controls over the app, with no title bar row: see
|
||||
@@ -10,6 +11,9 @@ import { applyControlsArea, watchTitlebarArea, watchWindowRows, type TitlebarAre
|
||||
* (admin, setup) get it too; there are no messages up there.
|
||||
*/
|
||||
export function WindowControlsHost() {
|
||||
// In the first render of every page, before any frame exists: a frame can reach the
|
||||
// bridge, and whoever comes after this gets nothing.
|
||||
if (typeof window !== "undefined") claimBrowserSignIn();
|
||||
const [area, setArea] = useState<TitlebarArea | null>(null);
|
||||
|
||||
useEffect(() => watchTitlebarArea((next) => {
|
||||
|
||||
@@ -209,6 +209,18 @@
|
||||
<list id="KeystoreAllowedOrigins_Value" valuePrefix=""/>
|
||||
</elements>
|
||||
</policy>
|
||||
<policy name="BrowserSignIn" class="Both" displayName="$(string.BrowserSignIn)" explainText="$(string.BrowserSignIn_Explain)" key="Software\Policies\Bulwark\Desktop" valueName="BrowserSignIn">
|
||||
<parentCategory ref="Bulwark_Desktop_signIn"/>
|
||||
<supportedOn ref="SUPPORTED_Bulwark_Desktop"/>
|
||||
<enabledValue><decimal value="1"/></enabledValue>
|
||||
<disabledValue><decimal value="0"/></disabledValue>
|
||||
</policy>
|
||||
<policy name="BrowserSignIn_Recommended" class="Both" displayName="$(string.BrowserSignIn)" explainText="$(string.BrowserSignIn_Explain)" key="Software\Policies\Bulwark\Desktop\Recommended" valueName="BrowserSignIn">
|
||||
<parentCategory ref="Bulwark_Desktop_Recommended"/>
|
||||
<supportedOn ref="SUPPORTED_Bulwark_Desktop"/>
|
||||
<enabledValue><decimal value="1"/></enabledValue>
|
||||
<disabledValue><decimal value="0"/></disabledValue>
|
||||
</policy>
|
||||
<policy name="WipeOfflineData" class="Both" displayName="$(string.WipeOfflineData)" explainText="$(string.WipeOfflineData_Explain)" presentation="$(presentation.WipeOfflineData)" key="Software\Policies\Bulwark\Desktop">
|
||||
<parentCategory ref="Bulwark_Desktop_security"/>
|
||||
<supportedOn ref="SUPPORTED_Bulwark_Desktop"/>
|
||||
|
||||
@@ -56,6 +56,8 @@
|
||||
<string id="AutoSelectCertificateForUrls_Explain">Eine JSON-Regel pro Zeile, im Format von Chrome: {"pattern":"https://[*.]example.com","filter":{"ISSUER":{"CN":"Example CA"}}}. Die App wählt dann für diese Website das passende Zertifikat ohne Rückfrage.</string>
|
||||
<string id="KeystoreAllowedOrigins">Websites, die den Zertifikatspeicher des Systems verwenden dürfen</string>
|
||||
<string id="KeystoreAllowedOrigins_Explain">Die Bulwark-Server, nach https-Adresse, deren Plugins mit den Zertifikaten im Speicher des Betriebssystems signieren und entschlüsseln dürfen, ohne dass der Benutzer für jede Website gefragt wird. Eine pro Zeile.</string>
|
||||
<string id="BrowserSignIn">Anmeldung über den Browser anbieten</string>
|
||||
<string id="BrowserSignIn_Explain">Wenn aktiviert oder nicht konfiguriert, bietet die Anmeldeseite „Mit Ihrem Browser anmelden“ an, damit Benutzer dort ihren Passwort-Manager, Passkeys und Ihr Single Sign-on verwenden können. Wenn deaktiviert, fehlt die Schaltfläche und die App lehnt den Vorgang ab. Das Formular in der App bleibt, sofern der Server nicht nur OAuth erlaubt.</string>
|
||||
<string id="WipeOfflineData">Auf dem Gerät behaltene E-Mails löschen</string>
|
||||
<string id="WipeOfflineData_Explain">Setzen Sie dies auf einen neuen Wert, etwa das heutige Datum, um alles zu löschen, was die App für alle Server und Konten auf dem Gerät behält: E-Mails, Schlüssel und Anmeldungen, Benutzer melden sich also neu an. Jeder Wert löscht einmal: Die App merkt sich, welche sie schon ausgeführt hat, ein Wert kann also stehen bleiben. Verwenden Sie einen neuen Wert, um erneut zu löschen.</string>
|
||||
</stringTable>
|
||||
|
||||
@@ -56,6 +56,8 @@
|
||||
<string id="AutoSelectCertificateForUrls_Explain">One JSON rule per line, in the format Chrome uses: {"pattern":"https://[*.]example.com","filter":{"ISSUER":{"CN":"Example CA"}}}. The app then picks the matching certificate for that site without asking.</string>
|
||||
<string id="KeystoreAllowedOrigins">Sites that may use the system certificate store</string>
|
||||
<string id="KeystoreAllowedOrigins_Explain">The Bulwark servers, by https address, whose plugins may sign and decrypt with the certificates in the operating system's store, without the user being asked for each site. One per line.</string>
|
||||
<string id="BrowserSignIn">Offer sign-in through the browser</string>
|
||||
<string id="BrowserSignIn_Explain">When enabled or not configured, the login page offers "Sign in with your browser", so people can use their password manager, passkeys and your single sign-on there. When disabled, the button is gone and the app refuses the flow. The form in the app stays, unless the server only allows OAuth.</string>
|
||||
<string id="WipeOfflineData">Delete mail kept on the device</string>
|
||||
<string id="WipeOfflineData_Explain">Set this to a new value, such as today's date, to delete everything the app keeps on the device for every server and account: mail, keys, and sign-ins, so people sign in again. Each value deletes once: the app remembers the ones it has acted on, so it stays safe to leave a value in place. Use a new value to delete again.</string>
|
||||
</stringTable>
|
||||
|
||||
@@ -61,6 +61,8 @@
|
||||
<array>
|
||||
<string>https://mail.example.com</string>
|
||||
</array>
|
||||
<key>BrowserSignIn</key>
|
||||
<true/>
|
||||
<key>Recommended</key>
|
||||
<dict>
|
||||
<key>UpdateChannel</key>
|
||||
|
||||
@@ -25,6 +25,7 @@
|
||||
"KeystoreAllowedOrigins": [
|
||||
"https://mail.example.com"
|
||||
],
|
||||
"BrowserSignIn": true,
|
||||
"Recommended": {
|
||||
"UpdateChannel": "stable"
|
||||
}
|
||||
|
||||
@@ -0,0 +1,322 @@
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
|
||||
import { createHash } from 'crypto';
|
||||
import { NextRequest } from 'next/server';
|
||||
|
||||
/**
|
||||
* The desktop app's sign-in on an instance: what the browser parks, and what the app's
|
||||
* own page gets for the code. The real store and routes, with the mail server faked.
|
||||
*/
|
||||
|
||||
const cookieJar = vi.hoisted(() => new Map<string, { value: string; options?: Record<string, unknown> }>());
|
||||
vi.mock('next/headers', () => ({
|
||||
cookies: async () => ({
|
||||
get: (name: string) => (cookieJar.has(name) ? { name, value: cookieJar.get(name)!.value } : undefined),
|
||||
set: (name: string, value: string, options?: Record<string, unknown>) => {
|
||||
cookieJar.set(name, { value, options });
|
||||
},
|
||||
delete: (name: string) => {
|
||||
cookieJar.delete(name);
|
||||
},
|
||||
getAll: () => [...cookieJar.entries()].map(([name, { value }]) => ({ name, value })),
|
||||
}),
|
||||
}));
|
||||
|
||||
const config = vi.hoisted(() => ({ values: {} as Record<string, unknown> }));
|
||||
vi.mock('@/lib/admin/config-manager', () => ({
|
||||
configManager: {
|
||||
ensureLoaded: async () => {},
|
||||
get: (key: string, fallback: unknown) => (key in config.values ? config.values[key] : fallback),
|
||||
},
|
||||
}));
|
||||
|
||||
const verifyJmapAuth = vi.hoisted(() => vi.fn());
|
||||
vi.mock('@/lib/auth/verify-jmap-auth', async (original) => ({
|
||||
...(await original<object>()),
|
||||
verifyJmapAuth,
|
||||
}));
|
||||
|
||||
const stalwartPasswordLogin = vi.hoisted(() => vi.fn());
|
||||
vi.mock('@/lib/auth/stalwart-password-login', async (original) => ({
|
||||
...(await original<object>()),
|
||||
stalwartPasswordLogin,
|
||||
}));
|
||||
|
||||
const reserveLoginAttempt = vi.hoisted(() => vi.fn());
|
||||
vi.mock('@/lib/auth/verify-budget', async (original) => ({
|
||||
...(await original<object>()),
|
||||
reserveLoginAttempt,
|
||||
}));
|
||||
|
||||
vi.mock('@/lib/logger', () => ({ logger: { warn: vi.fn(), error: vi.fn(), debug: vi.fn(), info: vi.fn() } }));
|
||||
|
||||
// This file parks more sign-ins than one client may in a quarter of an hour.
|
||||
vi.mock('@/lib/auth/handoff-store', async (original) => ({
|
||||
...(await original<object>()),
|
||||
reserveHandoffCreate: async () => true,
|
||||
reserveHandoffRedeem: async () => async () => {},
|
||||
}));
|
||||
|
||||
const { POST: park } = await import('@/app/api/auth/desktop-handoff/park/route');
|
||||
const { POST: redeem } = await import('@/app/api/auth/desktop-handoff/redeem/route');
|
||||
const { POST: mobileRedeem } = await import('@/app/api/auth/handoff/redeem/route');
|
||||
const { JmapAuthVerificationError } = await import('@/lib/auth/verify-jmap-auth');
|
||||
const { confirmHandoff, resetHandoffStoreForTests, stashHandoff } = await import('@/lib/auth/handoff-store');
|
||||
const { desktopHandoffTarget, mobileHandoffTarget } = await import('@/lib/auth/mobile-handoff');
|
||||
const { isDesktopBlockedRoute } = await import('@/lib/desktop/blocked-routes');
|
||||
|
||||
const ORIGIN = 'https://bulwark.example';
|
||||
const VERIFIER = 'v'.repeat(64);
|
||||
const CHALLENGE = createHash('sha256').update(VERIFIER, 'ascii').digest('base64url');
|
||||
const SERVER = 'https://mail.example';
|
||||
|
||||
function post(path: string, body: unknown, origin = ORIGIN) {
|
||||
return new NextRequest(`${ORIGIN}${path}`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json', Origin: origin, Host: 'bulwark.example' },
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
}
|
||||
|
||||
const parkBody = (extra: Record<string, unknown> = {}) => ({
|
||||
code_challenge: CHALLENGE,
|
||||
state: 'state-1',
|
||||
server_url: SERVER,
|
||||
username: 'a@example.org',
|
||||
password: 'secret',
|
||||
...extra,
|
||||
});
|
||||
|
||||
async function parkedCode(extra: Record<string, unknown> = {}): Promise<string> {
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody(extra)));
|
||||
expect(answer.status).toBe(200);
|
||||
const { code } = (await answer.json()) as { code: string };
|
||||
// What the page does when the user confirms.
|
||||
expect(await confirmHandoff(code)).toBe(true);
|
||||
return code;
|
||||
}
|
||||
|
||||
const redeemBody = (code: string, extra: Record<string, unknown> = {}) => ({ code, code_verifier: VERIFIER, slot: 1, remember: true, allowed_servers: null, ...extra });
|
||||
|
||||
beforeEach(() => {
|
||||
cookieJar.clear();
|
||||
resetHandoffStoreForTests();
|
||||
config.values = { jmapServerUrl: SERVER };
|
||||
verifyJmapAuth.mockReset();
|
||||
verifyJmapAuth.mockResolvedValue(undefined);
|
||||
stalwartPasswordLogin.mockReset();
|
||||
reserveLoginAttempt.mockReset();
|
||||
reserveLoginAttempt.mockResolvedValue(async () => {});
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
describe('the target', () => {
|
||||
it('is only ever this computer on the one path', () => {
|
||||
expect(desktopHandoffTarget('http://127.0.0.1:51234/bulwark-desktop/callback')).toBe('http://127.0.0.1:51234/bulwark-desktop/callback');
|
||||
for (const bad of [
|
||||
'http://127.0.0.1/bulwark-desktop/callback',
|
||||
'http://127.0.0.1:99999/bulwark-desktop/callback',
|
||||
'http://localhost:51234/bulwark-desktop/callback',
|
||||
'https://127.0.0.1:51234/bulwark-desktop/callback',
|
||||
'http://127.0.0.1:51234/other',
|
||||
'http://127.0.0.1:51234/bulwark-desktop/callback?x=1',
|
||||
'http://127.0.0.1@evil.example:51234/bulwark-desktop/callback',
|
||||
'http://evil.example/bulwark-desktop/callback',
|
||||
'bulwarkmobile://auth/callback',
|
||||
null,
|
||||
]) {
|
||||
expect(desktopHandoffTarget(bad), String(bad)).toBe('');
|
||||
}
|
||||
});
|
||||
|
||||
it('leaves the phone\'s rule as it was', () => {
|
||||
expect(mobileHandoffTarget('http://127.0.0.1:51234/bulwark-desktop/callback')).toBe('');
|
||||
});
|
||||
|
||||
it('the embedded build has none of these routes', () => {
|
||||
expect(isDesktopBlockedRoute('/api/auth/desktop-handoff/park')).toBe(true);
|
||||
expect(isDesktopBlockedRoute('/api/auth/desktop-handoff/redeem')).toBe(true);
|
||||
expect(isDesktopBlockedRoute('/api/auth/desktop-oauth')).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parking a sign-in, in the browser', () => {
|
||||
it('leaves this browser with no session', async () => {
|
||||
await parkedCode();
|
||||
expect([...cookieJar.keys()]).toEqual([]);
|
||||
});
|
||||
|
||||
it('refuses another origin', async () => {
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody(), 'https://evil.example'));
|
||||
expect(answer.status).toBe(403);
|
||||
expect(verifyJmapAuth).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it.each([
|
||||
['no challenge', { code_challenge: '' }],
|
||||
['a bad challenge', { code_challenge: 'short' }],
|
||||
['no state', { state: '' }],
|
||||
['no password', { password: '' }],
|
||||
])('refuses %s', async (_name, extra) => {
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody(extra)));
|
||||
expect(answer.status).toBe(400);
|
||||
expect(verifyJmapAuth).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('holds no password on an OAuth-only instance', async () => {
|
||||
config.values = { jmapServerUrl: SERVER, oauthEnabled: true, oauthOnly: true };
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody()));
|
||||
expect(answer.status).toBe(403);
|
||||
expect(verifyJmapAuth).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('a wrong password parks nothing and says so', async () => {
|
||||
verifyJmapAuth.mockRejectedValue(new JmapAuthVerificationError('no', 401, 401));
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody()));
|
||||
expect(answer.status).toBe(401);
|
||||
expect(await answer.json()).toEqual({ error: 'invalid_credentials' });
|
||||
});
|
||||
|
||||
it('asks for the second factor when the server answers 402', async () => {
|
||||
verifyJmapAuth.mockRejectedValue(new JmapAuthVerificationError('no', 401, 402));
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody()));
|
||||
expect(await answer.json()).toEqual({ error: 'totp_required' });
|
||||
});
|
||||
|
||||
it('over the login budget, nothing reaches the mail server', async () => {
|
||||
reserveLoginAttempt.mockResolvedValue(null);
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody()));
|
||||
expect(answer.status).toBe(429);
|
||||
expect(verifyJmapAuth).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('what was checked is what is parked: the body can\'t name another server for the app', async () => {
|
||||
config.values = { jmapServerUrl: SERVER, jmapServers: [{ id: 'two', url: 'https://two.example', name: 'Two' }] };
|
||||
const code = await parkedCode({ server_id: 'two', server_url: 'https://evil.example' });
|
||||
expect(verifyJmapAuth.mock.calls[0][0]).toBe('https://two.example');
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(await answer.json()).toMatchObject({ server_url: 'https://two.example' });
|
||||
});
|
||||
|
||||
it('never goes to a server the instance does not know', async () => {
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody({ server_url: 'https://evil.example' })));
|
||||
expect(answer.status).toBe(400);
|
||||
expect(verifyJmapAuth).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('a code is not live until the user confirms', async () => {
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody()));
|
||||
const { code } = (await answer.json()) as { code: string };
|
||||
const redeemed = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(redeemed.status).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe('redeeming, in the app', () => {
|
||||
it('a password goes to the page, once, and no cookie is written for it', async () => {
|
||||
const code = await parkedCode();
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(answer.status).toBe(200);
|
||||
expect(answer.headers.get('Cache-Control')).toBe('no-store');
|
||||
expect(await answer.json()).toEqual({ flow: 'password', server_url: SERVER, username: 'a@example.org', password: 'secret' });
|
||||
expect([...cookieJar.keys()]).toEqual([]);
|
||||
|
||||
const again = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(again.status).toBe(400);
|
||||
expect(await again.json()).toEqual({ error: 'invalid_code' });
|
||||
});
|
||||
|
||||
it('a wrong verifier gets nothing, and spends the code', async () => {
|
||||
const code = await parkedCode();
|
||||
const wrong = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code, { code_verifier: 'w'.repeat(64) })));
|
||||
expect(wrong.status).toBe(400);
|
||||
expect(await wrong.json()).toEqual({ error: 'invalid_verifier' });
|
||||
const right = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(right.status).toBe(400);
|
||||
});
|
||||
|
||||
it('a late code is told so', async () => {
|
||||
const code = await parkedCode();
|
||||
const now = Date.now();
|
||||
vi.spyOn(Date, 'now').mockReturnValue(now + 61_000);
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(answer.status).toBe(400);
|
||||
expect(await answer.json()).toEqual({ error: 'expired_code' });
|
||||
});
|
||||
|
||||
it('a two-factor sign-in parks tokens, not the password, and the app gets its own cookie', async () => {
|
||||
stalwartPasswordLogin.mockResolvedValue({
|
||||
ok: true,
|
||||
tokens: { access_token: 'access', refresh_token: 'refresh', expires_in: 3600 },
|
||||
tokenEndpoint: `${SERVER}/auth/token`,
|
||||
clientId: 'x',
|
||||
});
|
||||
const code = await parkedCode({ totp: '123456' });
|
||||
expect(stalwartPasswordLogin.mock.calls[0][0]).toMatchObject({ serverUrl: SERVER, totp: '123456', trusted: true });
|
||||
expect(verifyJmapAuth).not.toHaveBeenCalled();
|
||||
expect([...cookieJar.keys()]).toEqual([]);
|
||||
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
const body = await answer.json();
|
||||
expect(body).toMatchObject({ flow: 'tokens', server_url: SERVER, access_token: 'access', remember: true });
|
||||
expect(JSON.stringify(body)).not.toContain('refresh');
|
||||
expect(JSON.stringify(body)).not.toContain('secret');
|
||||
expect(cookieJar.get('jmap_rt_1')?.value).toBe('refresh');
|
||||
expect(cookieJar.get('jmap_rt_1')?.options).toMatchObject({ httpOnly: true });
|
||||
});
|
||||
|
||||
it('keeps the instance\'s strict cookies strict', async () => {
|
||||
config.values = { jmapServerUrl: SERVER, cookieSameSite: 'strict' };
|
||||
stalwartPasswordLogin.mockResolvedValue({ ok: true, tokens: { access_token: 'a', refresh_token: 'r', expires_in: 60 }, tokenEndpoint: 't', clientId: 'x' });
|
||||
const code = await parkedCode({ totp: '123456' });
|
||||
await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(cookieJar.get('jmap_rt_1')?.options).toMatchObject({ sameSite: 'strict' });
|
||||
});
|
||||
|
||||
it('a wrong code from the server\'s side parks nothing', async () => {
|
||||
stalwartPasswordLogin.mockResolvedValue({ ok: false, error: 'invalid_credentials' });
|
||||
const answer = await park(post('/api/auth/desktop-handoff/park', parkBody({ totp: '000000' })));
|
||||
expect(answer.status).toBe(401);
|
||||
});
|
||||
|
||||
it('a server off the device\'s list gets nothing written, and the code is gone', async () => {
|
||||
stalwartPasswordLogin.mockResolvedValue({ ok: true, tokens: { access_token: 'a', refresh_token: 'r', expires_in: 60 }, tokenEndpoint: 't', clientId: 'x' });
|
||||
const code = await parkedCode({ totp: '123456' });
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code, { allowed_servers: ['https://other.example'] })));
|
||||
expect(answer.status).toBe(403);
|
||||
expect(await answer.json()).toMatchObject({ code: 'blocked_by_policy' });
|
||||
expect([...cookieJar.keys()]).toEqual([]);
|
||||
const again = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(again.status).toBe(400);
|
||||
});
|
||||
|
||||
it('a list that names the server lets it through', async () => {
|
||||
const code = await parkedCode();
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code, { allowed_servers: [SERVER] })));
|
||||
expect(answer.status).toBe(200);
|
||||
});
|
||||
|
||||
it('refuses another origin', async () => {
|
||||
const code = await parkedCode();
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code), 'https://evil.example'));
|
||||
expect(answer.status).toBe(403);
|
||||
});
|
||||
});
|
||||
|
||||
describe('the two kinds of code stay apart', () => {
|
||||
it('the phone\'s redeem gives away nothing of a desktop sign-in', async () => {
|
||||
const code = await parkedCode();
|
||||
const answer = await mobileRedeem(post('/api/auth/handoff/redeem', { code, code_verifier: VERIFIER }));
|
||||
expect(answer.status).toBe(400);
|
||||
expect(JSON.stringify(await answer.json())).not.toContain('secret');
|
||||
});
|
||||
|
||||
it('the desktop redeem takes no phone code', async () => {
|
||||
const code = await stashHandoff({ flow: 'password', server_url: SERVER, username: 'a', password: 'secret' }, { challenge: CHALLENGE, state: 's' });
|
||||
const answer = await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code)));
|
||||
expect(answer.status).toBe(400);
|
||||
expect(JSON.stringify(await answer.json())).not.toContain('secret');
|
||||
});
|
||||
});
|
||||
@@ -224,3 +224,46 @@ describe('sso/complete mobile hand-off while the shared store is down (#1066)',
|
||||
expect(JSON.stringify(res.body)).not.toMatch(/"at"|"rt"|mobile_handoff_code/);
|
||||
});
|
||||
});
|
||||
|
||||
describe('/api/auth/sso/complete for the desktop app', () => {
|
||||
const VERIFIER = 'x'.repeat(50);
|
||||
const CHALLENGE = createHash('sha256').update(VERIFIER).digest('base64url');
|
||||
const LISTENER = 'http://127.0.0.1:51234/bulwark-desktop/callback';
|
||||
|
||||
it('parks the tokens under a code, writes nothing in this browser, and only a confirmed code redeems', async () => {
|
||||
exchangeCodeForTokens.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', id_token: 'idt', expires_in: 3600 });
|
||||
pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE });
|
||||
const res = await complete();
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body).toEqual({
|
||||
mobile_handoff_code: expect.stringMatching(/^[0-9a-f]{64}$/),
|
||||
server_url: 'https://mail.example.org',
|
||||
mobile_redirect_uri: LISTENER,
|
||||
mobile_state: 'd-1',
|
||||
});
|
||||
expect(JSON.stringify(res.body)).not.toMatch(/"at"|"rt"|idt/);
|
||||
expect(jar.has('jmap_rt')).toBe(false);
|
||||
expect(jar.has('sso_pending')).toBe(false);
|
||||
|
||||
expect((await redeemHandoff(res.body.mobile_handoff_code, VERIFIER)).ok).toBe(false);
|
||||
});
|
||||
|
||||
it('hands the refresh token itself to the app, which writes its own cookie', async () => {
|
||||
exchangeCodeForTokens.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', id_token: 'idt', expires_in: 3600 });
|
||||
pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE, server_id: 'second' });
|
||||
const res = await complete();
|
||||
expect(await confirmHandoff(res.body.mobile_handoff_code)).toBe(true);
|
||||
expect(await redeemHandoff(res.body.mobile_handoff_code, VERIFIER)).toMatchObject({
|
||||
ok: true,
|
||||
state: 'd-1',
|
||||
bundle: { flow: 'desktop-tokens', server_id: 'second', access_token: 'at', refresh_token: 'rt', id_token: 'idt' },
|
||||
});
|
||||
});
|
||||
|
||||
it('fails rather than hands over tokens if a pending cookie has no challenge', async () => {
|
||||
pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1' });
|
||||
const res = await complete();
|
||||
expect(res.status).toBe(401);
|
||||
expect(JSON.stringify(res.body)).not.toMatch(/"at"|"rt"/);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -196,3 +196,36 @@ describe('sso start for the mobile app', () => {
|
||||
expect(encrypted.last).not.toHaveProperty('mobile_code_challenge');
|
||||
});
|
||||
});
|
||||
|
||||
describe('sso start for the desktop app', () => {
|
||||
const CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
|
||||
const LISTENER = 'http://127.0.0.1:51234/bulwark-desktop/callback';
|
||||
const desktop = (extra: Record<string, unknown> = {}) => callRoute({
|
||||
redirect_uri: 'https://mail.example.com/auth/callback',
|
||||
mobile_redirect_uri: LISTENER,
|
||||
mobile_state: 'd-1',
|
||||
...extra,
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
encrypted.last = null;
|
||||
});
|
||||
|
||||
it('keeps the loopback target and its challenge for the complete route', async () => {
|
||||
const { status } = await desktop({ mobile_code_challenge: CHALLENGE });
|
||||
expect(status).toBe(200);
|
||||
expect(encrypted.last).toMatchObject({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE });
|
||||
});
|
||||
|
||||
it('refuses it without a challenge: tokens would come back for a link', async () => {
|
||||
const { status } = await desktop();
|
||||
expect(status).toBe(400);
|
||||
expect(encrypted.last).toBeNull();
|
||||
});
|
||||
|
||||
it.each(['http://127.0.0.1:51234/other', 'http://localhost:51234/bulwark-desktop/callback', 'http://evil.example/bulwark-desktop/callback'])('refuses %s as a target', async (target) => {
|
||||
const { status } = await desktop({ mobile_code_challenge: CHALLENGE, mobile_redirect_uri: target });
|
||||
expect(status).toBe(400);
|
||||
expect(encrypted.last).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -59,9 +59,29 @@ export function isHandoffCode(value: unknown): value is string {
|
||||
return typeof value === 'string' && CODE_RE.test(value);
|
||||
}
|
||||
|
||||
/**
|
||||
* What the desktop app's sign-in parks (app/api/auth/desktop-handoff). The app's redeem
|
||||
* writes its own cookies from this, so these fields never go to anyone else: the mobile
|
||||
* redeem route refuses them.
|
||||
*/
|
||||
export type DesktopHandoffBundle =
|
||||
| { flow: 'desktop-password'; server_url: string; server_id: string | null; username: string; password: string }
|
||||
| {
|
||||
flow: 'desktop-tokens';
|
||||
server_url: string;
|
||||
server_id: string | null;
|
||||
access_token: string;
|
||||
refresh_token?: string;
|
||||
id_token?: string;
|
||||
expires_in: number;
|
||||
signed_in_at: number;
|
||||
};
|
||||
|
||||
export type ParkedHandoff = RedeemBundle | DesktopHandoffBundle;
|
||||
|
||||
interface HandoffRecord {
|
||||
/** Null once redeemed (or tried) or expired. */
|
||||
bundle: RedeemBundle | null;
|
||||
bundle: ParkedHandoff | null;
|
||||
state: string;
|
||||
challenge: string;
|
||||
/** Whether the user confirmed the hand-off; only confirmed codes redeem. */
|
||||
@@ -72,7 +92,7 @@ interface HandoffRecord {
|
||||
}
|
||||
|
||||
export type HandoffRedeemResult =
|
||||
| { ok: true; bundle: RedeemBundle; state: string }
|
||||
| { ok: true; bundle: ParkedHandoff; state: string }
|
||||
| { ok: false; reason: 'invalid' | 'expired' | 'verifier_mismatch' };
|
||||
|
||||
const STORE_KEY = '__bulwarkMobileHandoffStore';
|
||||
@@ -98,7 +118,7 @@ function s256(verifier: string): string {
|
||||
}
|
||||
|
||||
function newRecord(
|
||||
bundle: RedeemBundle,
|
||||
bundle: ParkedHandoff,
|
||||
options: { challenge: string; state: string; awaitConfirm?: boolean },
|
||||
now: number,
|
||||
): HandoffRecord {
|
||||
@@ -121,7 +141,7 @@ function confirmed(record: HandoffRecord, now: number): HandoffRecord {
|
||||
}
|
||||
|
||||
/** What a redeem attempt of `record` (spent by the attempt) gets. */
|
||||
function redeemOutcome(record: HandoffRecord, bundle: RedeemBundle | null, verifier: string, now: number): HandoffRedeemResult {
|
||||
function redeemOutcome(record: HandoffRecord, bundle: ParkedHandoff | null, verifier: string, now: number): HandoffRedeemResult {
|
||||
if (!bundle) return { ok: false, reason: record.expiresAt <= now ? 'expired' : 'invalid' };
|
||||
if (!record.confirmed) return { ok: false, reason: 'invalid' };
|
||||
const expected = Buffer.from(record.challenge, 'ascii');
|
||||
@@ -129,7 +149,7 @@ function redeemOutcome(record: HandoffRecord, bundle: RedeemBundle | null, verif
|
||||
if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
|
||||
return { ok: false, reason: 'verifier_mismatch' };
|
||||
}
|
||||
if (bundle.flow === 'oauth' && typeof bundle.expires_in === 'number') {
|
||||
if ((bundle.flow === 'oauth' || bundle.flow === 'desktop-tokens') && typeof bundle.expires_in === 'number') {
|
||||
const elapsed = Math.floor((now - record.issuedAt) / 1000);
|
||||
return { ok: true, bundle: { ...bundle, expires_in: Math.max(0, bundle.expires_in - elapsed) }, state: record.state };
|
||||
}
|
||||
@@ -161,7 +181,7 @@ const ttl = (record: HandoffRecord, now: number) => Math.max(record.forgetAt - n
|
||||
* `awaitConfirm` the code only becomes redeemable through confirmHandoff.
|
||||
*/
|
||||
export async function stashHandoff(
|
||||
bundle: RedeemBundle,
|
||||
bundle: ParkedHandoff,
|
||||
options: { challenge: string; state: string; awaitConfirm?: boolean },
|
||||
now = Date.now(),
|
||||
): Promise<string> {
|
||||
|
||||
@@ -28,6 +28,43 @@ export async function requestMobileHandoffCodeUrl(opts: {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The desktop app's sign-in on this page: checks the password against the mail server and
|
||||
* parks it (/api/auth/desktop-handoff/park). This browser gets no session out of it.
|
||||
*/
|
||||
export async function parkDesktopSignIn(opts: {
|
||||
challenge: string;
|
||||
state: string;
|
||||
serverUrl: string;
|
||||
serverId?: string;
|
||||
username: string;
|
||||
password: string;
|
||||
totp?: string;
|
||||
redirectUri: string;
|
||||
}): Promise<{ code: string } | { error: string }> {
|
||||
try {
|
||||
const res = await apiFetch('/api/auth/desktop-handoff/park', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
code_challenge: opts.challenge,
|
||||
state: opts.state,
|
||||
server_url: opts.serverUrl,
|
||||
server_id: opts.serverId,
|
||||
username: opts.username,
|
||||
password: opts.password,
|
||||
totp: opts.totp,
|
||||
redirect_uri: opts.redirectUri,
|
||||
}),
|
||||
});
|
||||
const data = (await res.json().catch(() => null)) as { code?: unknown; error?: unknown } | null;
|
||||
if (res.ok && typeof data?.code === 'string' && data.code) return { code: data.code };
|
||||
return { error: typeof data?.error === 'string' ? data.error : 'login_failed' };
|
||||
} catch {
|
||||
return { error: 'network_error' };
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Confirm an SSO hand-off the server parked (/api/auth/handoff/confirm) and
|
||||
* return the app link with its code. Null when the code is gone (it waited
|
||||
|
||||
@@ -27,6 +27,26 @@ export function mobileHandoffTarget(raw: string | null | undefined): string {
|
||||
: '';
|
||||
}
|
||||
|
||||
/**
|
||||
* The desktop app's loopback listener (RFC 8252), the other kind of target. Only ever
|
||||
* with a code: unlike the phone's link, it has no older builds that take the sign-in in a
|
||||
* fragment, so without a valid challenge this isn't a hand-off at all. The code goes
|
||||
* nowhere but this computer, whichever port a link names, and it's worthless without the
|
||||
* verifier behind the challenge.
|
||||
*/
|
||||
const DESKTOP_TARGET = /^http:\/\/127\.0\.0\.1:([1-9][0-9]{3,4})\/bulwark-desktop\/callback$/;
|
||||
|
||||
export function desktopHandoffTarget(raw: string | null | undefined): string {
|
||||
if (typeof raw !== 'string') return '';
|
||||
const match = DESKTOP_TARGET.exec(raw.trim());
|
||||
return match && Number(match[1]) <= 65535 ? match[0] : '';
|
||||
}
|
||||
|
||||
/** Either kind of target, as the callback page reads it back. */
|
||||
export function handoffTarget(raw: string | null | undefined): string {
|
||||
return mobileHandoffTarget(raw) || desktopHandoffTarget(raw);
|
||||
}
|
||||
|
||||
/** The URL the browser hands to the app: the target plus the fragment. */
|
||||
export function buildMobileHandoffUrl(target: string, fragment: Record<string, string>): string {
|
||||
return `${target}#${new URLSearchParams(fragment).toString()}`;
|
||||
|
||||
@@ -144,79 +144,212 @@ describe('JMAPClient on an approved http server', () => {
|
||||
});
|
||||
|
||||
describe('runDesktopBrowserSignIn', () => {
|
||||
const ENDPOINTS = { authorization_endpoint: 'https://mail.example/authorize', client_id: 'registered-client', scope: 'openid email' };
|
||||
const ENDPOINTS = { authorization_endpoint: 'https://mail.example/authorize', client_id: 'registered-client', scope: 'openid email', issuer: 'https://mail.example' };
|
||||
const REDIRECT = 'http://127.0.0.1:51234/bulwark-desktop/callback';
|
||||
|
||||
function authBridge(result: unknown) {
|
||||
const completeBrowserSignIn = vi.fn(async (_flowId: string, url: string) => (
|
||||
typeof result === 'function' ? (result as (u: string) => unknown)(url) : result
|
||||
));
|
||||
const bridge = {
|
||||
version: 1,
|
||||
platform: 'win32',
|
||||
servers: { prepare: vi.fn(async () => ({ ok: true, approved: false })), noteSession: vi.fn() },
|
||||
auth: {
|
||||
beginBrowserSignIn: vi.fn(async () => ({ flowId: 'f1', redirectUri: 'http://127.0.0.1:51234/bulwark-desktop/callback' })),
|
||||
completeBrowserSignIn,
|
||||
cancelBrowserSignIn: vi.fn(),
|
||||
},
|
||||
} as unknown as BulwarkDesktopBridge;
|
||||
setBridge(bridge);
|
||||
return bridge;
|
||||
const controls = {
|
||||
begin: vi.fn(async (): Promise<unknown> => ({ ok: true, flowId: 'f1', redirectUri: REDIRECT, state: 'main-state' })),
|
||||
complete: vi.fn(async (_flowId: string, url: string) => (
|
||||
typeof result === 'function' ? (result as (u: string) => unknown)(url) : result
|
||||
)),
|
||||
useScheme: vi.fn(async () => 'bulwark://sign-in/callback'),
|
||||
cancel: vi.fn(),
|
||||
beginPassword: vi.fn(async (): Promise<unknown> => ({ ok: true, host: 'mail.example' })),
|
||||
nextPassword: vi.fn(async (): Promise<unknown> => ({ ok: false, error: 'timeout' })),
|
||||
answerPassword: vi.fn(),
|
||||
outcome: vi.fn(async (): Promise<unknown> => ({ ok: true, code: '', state: 'main-state' })),
|
||||
};
|
||||
setBridge({ version: 1, platform: 'win32', auth: { claim: () => controls } } as unknown as BulwarkDesktopBridge);
|
||||
return controls;
|
||||
}
|
||||
|
||||
const options = { serverUrl: 'https://mail.example', callbackPath: '/en/auth/callback', slot: 1, remember: true, addAccount: false };
|
||||
const redeem = vi.fn(async () => true);
|
||||
const tryPassword = vi.fn(async (): Promise<{ ok: true } | { ok: false; error: 'invalid_credentials' | 'totp_required' | 'other' }> => ({ ok: true }));
|
||||
const options = { serverUrl: 'https://mail.example', slot: 1, remember: true, addAccount: false, fresh: false, redeem, tryPassword };
|
||||
|
||||
beforeEach(() => {
|
||||
redeem.mockClear();
|
||||
tryPassword.mockClear();
|
||||
vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify(ENDPOINTS), { status: 200 })));
|
||||
});
|
||||
|
||||
it('runs PKCE with the loopback redirect and parks what the callback page needs', async () => {
|
||||
it('runs PKCE with state from main and the loopback redirect, and redeems here, with nothing in an address', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
let authorize = new URL('https://x');
|
||||
authBridge((url: string) => {
|
||||
authorize = new URL(url);
|
||||
return { ok: true, code: 'the-code', state: authorize.searchParams.get('state') };
|
||||
return { ok: true, code: 'the-code', state: 'main-state' };
|
||||
});
|
||||
let readBack = {};
|
||||
redeem.mockImplementationOnce(async () => {
|
||||
readBack = { client: sessionStorage.getItem('oauth_client_id'), slot: sessionStorage.getItem('oauth_cookie_slot'), remember: sessionStorage.getItem('oauth_remember') };
|
||||
return true;
|
||||
});
|
||||
const outcome = await runDesktopBrowserSignIn(options);
|
||||
expect(outcome.kind).toBe('callback');
|
||||
expect(outcome).toEqual({ kind: 'signed-in' });
|
||||
expect(authorize.origin + authorize.pathname).toBe('https://mail.example/authorize');
|
||||
expect(authorize.searchParams.get('client_id')).toBe('registered-client');
|
||||
expect(authorize.searchParams.get('redirect_uri')).toBe('http://127.0.0.1:51234/bulwark-desktop/callback');
|
||||
expect(authorize.searchParams.get('redirect_uri')).toBe(REDIRECT);
|
||||
expect(authorize.searchParams.get('state')).toBe('main-state');
|
||||
expect(authorize.searchParams.get('code_challenge_method')).toBe('S256');
|
||||
expect(authorize.searchParams.get('code_challenge')).toBeTruthy();
|
||||
expect(sessionStorage.getItem('oauth_redirect_uri')).toBe('http://127.0.0.1:51234/bulwark-desktop/callback');
|
||||
expect(sessionStorage.getItem('oauth_client_id')).toBe('registered-client');
|
||||
expect(sessionStorage.getItem('oauth_server_url')).toBe('https://mail.example');
|
||||
expect(sessionStorage.getItem('oauth_cookie_slot')).toBe('1');
|
||||
expect(sessionStorage.getItem('oauth_code_verifier')).toBeTruthy();
|
||||
});
|
||||
|
||||
it('rejects an answer with another state', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
authBridge({ ok: true, code: 'c', state: 'forged' });
|
||||
const outcome = await runDesktopBrowserSignIn(options);
|
||||
expect(outcome).toEqual({ kind: 'failed', error: 'state_mismatch' });
|
||||
expect(readBack).toEqual({ client: 'registered-client', slot: '1', remember: 'true' });
|
||||
const [server, code, verifier, redirect] = redeem.mock.calls[0] as unknown as string[];
|
||||
expect([server, code, redirect]).toEqual(['https://mail.example', 'the-code', REDIRECT]);
|
||||
// The verifier behind the challenge, kept in this function and nowhere else.
|
||||
expect(verifier.length).toBeGreaterThanOrEqual(43);
|
||||
expect(authorize.toString()).not.toContain(verifier);
|
||||
expect(sessionStorage.getItem('oauth_code_verifier')).toBeNull();
|
||||
expect(sessionStorage.getItem('oauth_client_id')).toBeNull();
|
||||
});
|
||||
|
||||
it('sends nothing to a server the user declined', async () => {
|
||||
it('refuses an answer another issuer signed', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
const bridge = authBridge({ ok: false, error: 'cancelled' });
|
||||
bridge.servers!.prepare = vi.fn(async () => ({ ok: false as const, reason: 'declined' as const }));
|
||||
const outcome = await runDesktopBrowserSignIn(options);
|
||||
expect(outcome.kind).toBe('declined');
|
||||
expect(bridge.auth!.beginBrowserSignIn).not.toHaveBeenCalled();
|
||||
authBridge({ ok: true, code: 'c', state: 'main-state', iss: 'https://evil.example' });
|
||||
expect(await runDesktopBrowserSignIn(options)).toEqual({ kind: 'failed', error: 'issuer_mismatch' });
|
||||
expect(redeem).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('asks the provider for a new login when the app says one is due', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
let authorize = new URL('https://x');
|
||||
authBridge((url: string) => {
|
||||
authorize = new URL(url);
|
||||
return { ok: false, error: 'cancelled' };
|
||||
});
|
||||
await runDesktopBrowserSignIn({ ...options, fresh: true });
|
||||
expect(authorize.searchParams.get('prompt')).toBe('login');
|
||||
});
|
||||
|
||||
it.each(['declined', 'policy', 'invalid'])('takes the no from main: %s, and nothing is asked of the server', async (error) => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
const controls = authBridge({ ok: false, error: 'cancelled' });
|
||||
controls.begin.mockResolvedValueOnce({ ok: false, error });
|
||||
expect((await runDesktopBrowserSignIn(options)).kind).toBe(error);
|
||||
expect(controls.complete).not.toHaveBeenCalled();
|
||||
expect(fetch).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('says so when the server has no OAuth, and closes the listener', async () => {
|
||||
it('a timeout is its own answer, so the page can say try again', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
vi.stubGlobal('fetch', vi.fn(async () => new Response('{}', { status: 404 })));
|
||||
const bridge = authBridge({ ok: true });
|
||||
const outcome = await runDesktopBrowserSignIn(options);
|
||||
expect(outcome.kind).toBe('unavailable');
|
||||
expect(bridge.auth!.cancelBrowserSignIn).toHaveBeenCalledWith('f1');
|
||||
expect(bridge.auth!.completeBrowserSignIn).not.toHaveBeenCalled();
|
||||
authBridge({ ok: false, error: 'timeout' });
|
||||
expect((await runDesktopBrowserSignIn(options)).kind).toBe('timeout');
|
||||
});
|
||||
|
||||
it('a discovery outage is a failure, not the password page', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
vi.stubGlobal('fetch', vi.fn(async () => new Response('{}', { status: 503 })));
|
||||
const controls = authBridge({ ok: true });
|
||||
expect((await runDesktopBrowserSignIn(options)).kind).toBe('failed');
|
||||
expect(controls.cancel).toHaveBeenCalledWith('f1');
|
||||
expect(controls.beginPassword).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('a server with no OAuth gets the page main serves, and each post goes through the login of the app', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ error: 'no_oauth' }), { status: 404 })));
|
||||
const controls = authBridge({ ok: true });
|
||||
controls.nextPassword
|
||||
.mockResolvedValueOnce({ ok: true, username: 'a', password: 'wrong' })
|
||||
.mockResolvedValueOnce({ ok: true, username: 'a', password: 'right', totp: '123456' });
|
||||
tryPassword.mockResolvedValueOnce({ ok: false, error: 'invalid_credentials' }).mockResolvedValueOnce({ ok: true });
|
||||
expect(await runDesktopBrowserSignIn(options)).toEqual({ kind: 'signed-in' });
|
||||
expect(controls.complete).not.toHaveBeenCalled();
|
||||
expect(tryPassword.mock.calls.map((call) => (call as unknown[])[0])).toEqual([
|
||||
{ ok: true, username: 'a', password: 'wrong' },
|
||||
{ ok: true, username: 'a', password: 'right', totp: '123456' },
|
||||
]);
|
||||
expect(controls.answerPassword.mock.calls).toEqual([
|
||||
['f1', { ok: false, error: 'invalid_credentials' }],
|
||||
['f1', { ok: true }],
|
||||
]);
|
||||
});
|
||||
|
||||
it('a server that refuses loopback goes by the scheme', async () => {
|
||||
const { runDesktopBrowserSignIn } = await import('../browser-sign-in');
|
||||
vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ ...ENDPOINTS, use_scheme: true }), { status: 200 })));
|
||||
let authorize = new URL('https://x');
|
||||
const controls = authBridge((url: string) => {
|
||||
authorize = new URL(url);
|
||||
return { ok: true, code: 'c', state: 'main-state' };
|
||||
});
|
||||
await runDesktopBrowserSignIn(options);
|
||||
expect(controls.useScheme).toHaveBeenCalledWith('f1');
|
||||
expect(authorize.searchParams.get('redirect_uri')).toBe('bulwark://sign-in/callback');
|
||||
expect((redeem.mock.calls[0] as unknown as string[])[3]).toBe('bulwark://sign-in/callback');
|
||||
});
|
||||
});
|
||||
|
||||
describe('runInstanceBrowserSignIn', () => {
|
||||
const REDIRECT = 'http://127.0.0.1:51234/bulwark-desktop/callback';
|
||||
|
||||
function bridgeWith(complete: (flowId: string, url: string) => unknown) {
|
||||
const controls = {
|
||||
begin: vi.fn(async () => ({ ok: true, flowId: 'f1', redirectUri: REDIRECT, state: 'main-state' })),
|
||||
complete: vi.fn(async (flowId: string, url: string) => complete(flowId, url)),
|
||||
cancel: vi.fn(),
|
||||
};
|
||||
setBridge({ version: 1, platform: 'win32', auth: { claim: () => controls } } as unknown as BulwarkDesktopBridge);
|
||||
return controls;
|
||||
}
|
||||
|
||||
it('opens the login page of the instance with no secret in the address, and hands back the verifier', async () => {
|
||||
const { runInstanceBrowserSignIn } = await import('../browser-sign-in');
|
||||
let opened = new URL('https://x');
|
||||
bridgeWith((_flow, url) => {
|
||||
opened = new URL(url);
|
||||
return { ok: true, code: 'the-code', state: 'main-state' };
|
||||
});
|
||||
const outcome = await runInstanceBrowserSignIn({ base: 'https://bulwark.example/mail', locale: 'de', fresh: false });
|
||||
expect(opened.origin + opened.pathname).toBe('https://bulwark.example/mail/de/login');
|
||||
expect(opened.searchParams.get('mobile_redirect_uri')).toBe(REDIRECT);
|
||||
expect(opened.searchParams.get('mobile_state')).toBe('main-state');
|
||||
expect(opened.searchParams.get('mobile_code_challenge')).toMatch(/^[A-Za-z0-9_-]{43}$/);
|
||||
expect(opened.searchParams.has('fresh_login')).toBe(false);
|
||||
if (outcome.kind !== 'code') throw new Error(outcome.kind);
|
||||
expect(outcome.code).toBe('the-code');
|
||||
expect(opened.toString()).not.toContain(outcome.verifier);
|
||||
const challenge = Buffer.from(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(outcome.verifier))).toString('base64url');
|
||||
expect(opened.searchParams.get('mobile_code_challenge')).toBe(challenge);
|
||||
});
|
||||
|
||||
it('passes on that a new login is due, and takes a timeout as a timeout', async () => {
|
||||
const { runInstanceBrowserSignIn } = await import('../browser-sign-in');
|
||||
let opened = new URL('https://x');
|
||||
bridgeWith((_flow, url) => {
|
||||
opened = new URL(url);
|
||||
return { ok: false, error: 'timeout' };
|
||||
});
|
||||
expect((await runInstanceBrowserSignIn({ base: 'https://b.example', locale: 'en', fresh: true })).kind).toBe('timeout');
|
||||
expect(opened.searchParams.get('fresh_login')).toBe('1');
|
||||
});
|
||||
});
|
||||
|
||||
describe('who gets the sign-in calls', () => {
|
||||
it('claims them once per bridge, whatever asks after that', async () => {
|
||||
const { claimBrowserSignIn } = await import('../browser-sign-in');
|
||||
const controls = {};
|
||||
const claim = vi.fn(() => controls);
|
||||
setBridge({ version: 1, platform: 'win32', auth: { claim } } as unknown as BulwarkDesktopBridge);
|
||||
expect(claimBrowserSignIn()).toBe(controls);
|
||||
expect(claimBrowserSignIn()).toBe(controls);
|
||||
expect(claim).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it('offers nothing in a browser, under an older shell, or with the policy off', async () => {
|
||||
const { browserSignInAvailable } = await import('../browser-sign-in');
|
||||
setBridge(undefined);
|
||||
expect(browserSignInAvailable()).toBe(false);
|
||||
setBridge({ version: 1, platform: 'win32' } as unknown as BulwarkDesktopBridge);
|
||||
expect(browserSignInAvailable()).toBe(false);
|
||||
const claim = () => ({});
|
||||
setBridge({ version: 1, platform: 'win32', auth: { claim } } as unknown as BulwarkDesktopBridge);
|
||||
expect(browserSignInAvailable()).toBe(true);
|
||||
const { EMPTY_POLICY_LAYERS, resolvePolicies } = await import('../policy-schema');
|
||||
const snapshot = resolvePolicies({ ...EMPTY_POLICY_LAYERS, forcedMachine: { BrowserSignIn: false } });
|
||||
setBridge({ version: 1, platform: 'win32', auth: { claim }, policy: { get: () => snapshot, onChange: () => () => {} } } as unknown as BulwarkDesktopBridge);
|
||||
expect(browserSignInAvailable()).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
@@ -0,0 +1,119 @@
|
||||
// @vitest-environment node
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
|
||||
import { NextRequest } from 'next/server';
|
||||
|
||||
/**
|
||||
* What the desktop app asks before it sends someone to a server's own sign-in page: the
|
||||
* authorize endpoint and a client id, and which redirect that server will take.
|
||||
*/
|
||||
|
||||
vi.mock('@/lib/logger', () => ({ logger: { warn: vi.fn(), error: vi.fn(), debug: vi.fn(), info: vi.fn() } }));
|
||||
vi.mock('@/lib/admin/config-manager', () => ({
|
||||
configManager: { ensureLoaded: async () => {}, get: (key: string, fallback: unknown) => (key === 'allowCustomJmapEndpoint' ? true : fallback) },
|
||||
}));
|
||||
vi.mock('@/lib/oauth/custom-upstream', () => ({
|
||||
resolveCustomUpstream: async (serverUrl: string, clientId: string) => (serverUrl.startsWith('https://') ? { serverUrl, clientId, trusted: false } : null),
|
||||
}));
|
||||
const discoverOAuth = vi.hoisted(() => vi.fn());
|
||||
vi.mock('@/lib/oauth/discovery', () => ({ discoverOAuth }));
|
||||
vi.mock('@/lib/oauth/token-exchange', () => ({ getDiscoveryValidator: () => undefined }));
|
||||
|
||||
const SERVER = 'https://mail.example';
|
||||
const REDIRECT = 'http://127.0.0.1:51234/bulwark-desktop/callback';
|
||||
const METADATA = { issuer: SERVER, authorization_endpoint: `${SERVER}/login`, token_endpoint: `${SERVER}/auth/token` };
|
||||
|
||||
let registrations: { url: string; redirect: string }[];
|
||||
let answer: (redirect: string) => Response;
|
||||
|
||||
function post(body: unknown) {
|
||||
return new NextRequest(`https://app.bulwark.localhost/api/auth/desktop-oauth`, {
|
||||
method: 'POST',
|
||||
headers: { 'content-type': 'application/json', 'sec-fetch-site': 'same-origin' },
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
}
|
||||
|
||||
async function route() {
|
||||
vi.stubEnv('NEXT_PUBLIC_BULWARK_DESKTOP', '1');
|
||||
vi.resetModules();
|
||||
return (await import('@/app/api/auth/desktop-oauth/route')).POST;
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
registrations = [];
|
||||
discoverOAuth.mockReset().mockResolvedValue(METADATA);
|
||||
answer = () => new Response(JSON.stringify({ client_id: 'swc1.abc' }), { status: 201 });
|
||||
vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
|
||||
const redirect = (JSON.parse(String(init?.body)) as { redirect_uris: string[] }).redirect_uris[0];
|
||||
registrations.push({ url: String(input), redirect });
|
||||
return answer(redirect);
|
||||
}));
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllEnvs();
|
||||
vi.unstubAllGlobals();
|
||||
});
|
||||
|
||||
describe('/api/auth/desktop-oauth', () => {
|
||||
it('registers the loopback redirect, with no port: servers ignore the port', async () => {
|
||||
const POST = await route();
|
||||
const res = await POST(post({ serverUrl: SERVER, redirectUri: REDIRECT }));
|
||||
expect(await res.json()).toMatchObject({ authorization_endpoint: `${SERVER}/login`, client_id: 'swc1.abc', issuer: SERVER });
|
||||
expect(registrations).toEqual([{ url: `${SERVER}/auth/register`, redirect: 'http://127.0.0.1/bulwark-desktop/callback' }]);
|
||||
});
|
||||
|
||||
it('uses the registration endpoint the server names', async () => {
|
||||
discoverOAuth.mockResolvedValue({ ...METADATA, registration_endpoint: `${SERVER}/oauth/clients` });
|
||||
const POST = await route();
|
||||
await POST(post({ serverUrl: SERVER, redirectUri: REDIRECT }));
|
||||
expect(registrations[0].url).toBe(`${SERVER}/oauth/clients`);
|
||||
});
|
||||
|
||||
it('says so when a server has no OAuth', async () => {
|
||||
discoverOAuth.mockResolvedValue(null);
|
||||
const POST = await route();
|
||||
const res = await POST(post({ serverUrl: SERVER, redirectUri: REDIRECT }));
|
||||
expect(res.status).toBe(404);
|
||||
expect(await res.json()).toEqual({ error: 'no_oauth' });
|
||||
});
|
||||
|
||||
it('a discovery outage is not the same answer', async () => {
|
||||
discoverOAuth.mockRejectedValue(new Error('down'));
|
||||
const POST = await route();
|
||||
expect((await POST(post({ serverUrl: SERVER, redirectUri: REDIRECT }))).status).toBe(503);
|
||||
});
|
||||
|
||||
it('with registration off, sends the fixed id and the loopback redirect', async () => {
|
||||
answer = () => new Response('{}', { status: 401 });
|
||||
const POST = await route();
|
||||
const body = await (await POST(post({ serverUrl: SERVER, redirectUri: REDIRECT }))).json();
|
||||
expect(body.client_id).toBe('bulwark-desktop');
|
||||
expect(body.use_scheme).toBeUndefined();
|
||||
expect(registrations).toHaveLength(1);
|
||||
});
|
||||
|
||||
it('takes the scheme only from a server that refuses loopback by name and accepts the scheme', async () => {
|
||||
answer = (redirect) => (redirect.startsWith('bulwark:')
|
||||
? new Response(JSON.stringify({ client_id: 'schemed' }), { status: 201 })
|
||||
: new Response(JSON.stringify({ error: 'invalid_redirect_uri' }), { status: 400 }));
|
||||
const POST = await route();
|
||||
const body = await (await POST(post({ serverUrl: SERVER, redirectUri: REDIRECT }))).json();
|
||||
expect(body).toMatchObject({ client_id: 'schemed', use_scheme: true });
|
||||
expect(registrations.map((r) => r.redirect)).toEqual(['http://127.0.0.1/bulwark-desktop/callback', 'bulwark://sign-in/callback']);
|
||||
});
|
||||
|
||||
it('stays on loopback when the server refuses both', async () => {
|
||||
answer = () => new Response(JSON.stringify({ error: 'invalid_redirect_uri' }), { status: 400 });
|
||||
const POST = await route();
|
||||
const body = await (await POST(post({ serverUrl: SERVER, redirectUri: REDIRECT }))).json();
|
||||
expect(body.client_id).toBe('bulwark-desktop');
|
||||
expect(body.use_scheme).toBeUndefined();
|
||||
});
|
||||
|
||||
it.each(['http://localhost:51234/bulwark-desktop/callback', 'https://evil.example/bulwark-desktop/callback', 'bulwark://sign-in/callback'])('refuses %s as the redirect', async (redirectUri) => {
|
||||
const POST = await route();
|
||||
expect((await POST(post({ serverUrl: SERVER, redirectUri }))).status).toBe(400);
|
||||
expect(registrations).toEqual([]);
|
||||
});
|
||||
});
|
||||
@@ -30,7 +30,7 @@ describe('the schema', () => {
|
||||
'InstanceUrl', 'AllowStandalone', 'AllowedJmapServers', 'AllowInsecureInstance', 'UpdateChannel', 'AutoUpdate',
|
||||
'PluginsMode', 'PluginAllowlist', 'OfflineEnabled', 'AppLockRequired', 'AppLockTimeoutMinutes', 'TelemetryAllowed',
|
||||
'CrashReportsAllowed', 'QuickComposeShortcut', 'AuthServerAllowlist', 'AuthNegotiateDelegateAllowlist',
|
||||
'AutoSelectCertificateForUrls', 'KeystoreAllowedOrigins', 'WipeOfflineData',
|
||||
'AutoSelectCertificateForUrls', 'KeystoreAllowedOrigins', 'BrowserSignIn', 'WipeOfflineData',
|
||||
]);
|
||||
for (const key of POLICY_KEYS) {
|
||||
const { title, description } = POLICY_SCHEMA[key];
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
* hand-off both hand out `https://app.bulwark.localhost`, which nothing else
|
||||
* can reach, and the app has no use for impersonation. proxy.ts answers 404.
|
||||
*/
|
||||
const BLOCKED = /^\/api\/auth\/(pair|handoff|impersonate)(\/|$)/;
|
||||
const BLOCKED = /^\/api\/auth\/(pair|handoff|desktop-handoff|impersonate)(\/|$)/;
|
||||
|
||||
export function isDesktopBlockedRoute(pathname: string): boolean {
|
||||
return BLOCKED.test(pathname);
|
||||
|
||||
+151
-48
@@ -1,104 +1,207 @@
|
||||
/**
|
||||
* Sign-in through the system browser in the desktop build, for any Stalwart.
|
||||
* "Sign in with your browser" in the desktop app, so a password manager, passkeys and an
|
||||
* organisation's sign-in all work where they live.
|
||||
*
|
||||
* A window on app.bulwark.localhost can't be a redirect target: Stalwart 1.0
|
||||
* refuses it for a public client, and identity providers won't embed. So the
|
||||
* Electron main process listens on http://127.0.0.1:<port> for one redirect and
|
||||
* hands the code back. The rest is the regular PKCE flow: the same
|
||||
* sessionStorage keys, then the callback page, which reads the stored redirect
|
||||
* URI because it can't be rebuilt from this page's origin.
|
||||
* Standalone: RFC 8252. The mail server's own authorize page in the system browser, with
|
||||
* the redirect going to a listener in the Electron main process, and this page redeeming
|
||||
* the code with the PKCE verifier it kept. A server with no OAuth at all gets a small page
|
||||
* main serves on a stable loopback port, and what's posted there comes down the app's
|
||||
* normal login path here.
|
||||
*
|
||||
* Google and Entra can't work here. Their clients are registered by whoever
|
||||
* owns them, and in standalone mode nobody does. Those need an instance.
|
||||
* Instance: the instance's real login page at its real origin, so saved passwords match.
|
||||
* It parks the sign-in on the instance and sends a one-time code to the same kind of
|
||||
* listener (lib/auth/mobile-handoff.ts). The page redeems it with the verifier.
|
||||
*
|
||||
* The calls are taken once per document, in the first render (claimBrowserSignIn, from
|
||||
* WindowControlsHost): a same-origin frame can reach the bridge, and main can't tell.
|
||||
*
|
||||
* Google and Entra can't work in standalone. Their clients are registered by whoever owns
|
||||
* them, and there nobody does. Those need an instance.
|
||||
*/
|
||||
|
||||
import { apiFetch } from '@/lib/browser-navigation';
|
||||
import { generateCodeChallenge, generateCodeVerifier, generateState } from '@/lib/oauth/pkce';
|
||||
import { IS_LITE } from '@/lib/lite';
|
||||
import { generateCodeChallenge, generateCodeVerifier } from '@/lib/oauth/pkce';
|
||||
import { getDesktopBridge } from './bridge';
|
||||
import { desktopPolicyValue } from './policy';
|
||||
import type { DesktopBrowserSignInControls, DesktopPasswordSignInAnswer, DesktopPasswordSignInAttempt } from './types';
|
||||
|
||||
export const DESKTOP_REDIRECT_URI_KEY = 'oauth_redirect_uri';
|
||||
export const DESKTOP_CLIENT_ID_KEY = 'oauth_client_id';
|
||||
|
||||
export type DesktopBrowserSignInOutcome =
|
||||
| { kind: 'callback'; callbackUrl: string }
|
||||
| { kind: 'unavailable' }
|
||||
| { kind: 'signed-in' }
|
||||
/** Instance mode: what to redeem. */
|
||||
| { kind: 'code'; code: string; verifier: string }
|
||||
| { kind: 'declined' }
|
||||
| { kind: 'invalid' }
|
||||
| { kind: 'policy' }
|
||||
| { kind: 'cancelled' }
|
||||
| { kind: 'timeout' }
|
||||
| { kind: 'no_browser' }
|
||||
| { kind: 'failed'; error: string };
|
||||
|
||||
interface DesktopOAuthAnswer {
|
||||
authorization_endpoint: string;
|
||||
client_id: string;
|
||||
scope: string;
|
||||
issuer?: string;
|
||||
use_scheme?: boolean;
|
||||
}
|
||||
|
||||
let controls: DesktopBrowserSignInControls | null = null;
|
||||
let claimedFrom: unknown;
|
||||
let currentFlow: string | null = null;
|
||||
|
||||
/** Before any frame exists. Whoever comes after this gets nothing from the preload. */
|
||||
export function claimBrowserSignIn(): DesktopBrowserSignInControls | null {
|
||||
const bridge = getDesktopBridge();
|
||||
if (claimedFrom !== bridge) {
|
||||
claimedFrom = bridge;
|
||||
controls = bridge?.auth?.claim?.() ?? null;
|
||||
}
|
||||
return controls;
|
||||
}
|
||||
|
||||
/** Whether this page offers it. In a browser there's no bridge, and Lite has no server to park on. */
|
||||
export function browserSignInAvailable(): boolean {
|
||||
return !!getDesktopBridge()?.auth;
|
||||
return !IS_LITE && !!claimBrowserSignIn() && desktopPolicyValue('BrowserSignIn') === true;
|
||||
}
|
||||
|
||||
/** The Cancel button, and leaving the page. */
|
||||
export function cancelBrowserSignIn(): void {
|
||||
if (currentFlow) controls?.cancel(currentFlow);
|
||||
currentFlow = null;
|
||||
}
|
||||
|
||||
function failure(error: string): DesktopBrowserSignInOutcome {
|
||||
if (error === 'cancelled') return { kind: 'cancelled' };
|
||||
if (error === 'timeout') return { kind: 'timeout' };
|
||||
if (error === 'no_browser') return { kind: 'no_browser' };
|
||||
if (error === 'policy') return { kind: 'policy' };
|
||||
if (error === 'declined') return { kind: 'declined' };
|
||||
if (error === 'invalid') return { kind: 'invalid' };
|
||||
return { kind: 'failed', error };
|
||||
}
|
||||
|
||||
/** Instance mode. The caller redeems the code (loginWithDesktopHandoff in the auth store). */
|
||||
export async function runInstanceBrowserSignIn(options: { base: string; locale: string; fresh: boolean }): Promise<DesktopBrowserSignInOutcome> {
|
||||
const auth = claimBrowserSignIn();
|
||||
if (!auth) return { kind: 'failed', error: 'unavailable' };
|
||||
const begun = await auth.begin({ kind: 'instance' });
|
||||
if (!begun.ok) return failure(begun.error);
|
||||
currentFlow = begun.flowId;
|
||||
try {
|
||||
const verifier = generateCodeVerifier();
|
||||
const url = new URL(`${options.base}/${options.locale}/login`);
|
||||
url.searchParams.set('mobile_redirect_uri', begun.redirectUri);
|
||||
url.searchParams.set('mobile_state', begun.state);
|
||||
url.searchParams.set('mobile_code_challenge', await generateCodeChallenge(verifier));
|
||||
if (options.fresh) url.searchParams.set('fresh_login', '1');
|
||||
const result = await auth.complete(begun.flowId, url.toString());
|
||||
if (!result.ok) return failure(result.error);
|
||||
return { kind: 'code', code: result.code, verifier };
|
||||
} catch (error) {
|
||||
auth.cancel(begun.flowId);
|
||||
return { kind: 'failed', error: error instanceof Error ? error.name : 'error' };
|
||||
} finally {
|
||||
currentFlow = null;
|
||||
}
|
||||
}
|
||||
|
||||
/** The page main serves: each post goes through the app's own login, until one works. */
|
||||
async function runPasswordPage(
|
||||
auth: DesktopBrowserSignInControls,
|
||||
flowId: string,
|
||||
tryPassword: (attempt: Extract<DesktopPasswordSignInAttempt, { ok: true }>) => Promise<DesktopPasswordSignInAnswer>,
|
||||
): Promise<DesktopBrowserSignInOutcome> {
|
||||
const started = await auth.beginPassword(flowId);
|
||||
if (!started.ok) return failure(started.error);
|
||||
for (;;) {
|
||||
const attempt = await auth.nextPassword(flowId);
|
||||
if (!attempt.ok) return attempt.error === 'done' ? { kind: 'signed-in' } : failure(attempt.error);
|
||||
const answer = await tryPassword(attempt);
|
||||
auth.answerPassword(flowId, answer);
|
||||
if (answer.ok) {
|
||||
const ended = await auth.outcome(flowId);
|
||||
return ended.ok ? { kind: 'signed-in' } : failure(ended.error);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Standalone. Only referenced from behind the desktop build's flag, so no other bundle holds the route. */
|
||||
export async function runDesktopBrowserSignIn(options: {
|
||||
serverUrl: string;
|
||||
callbackPath: string;
|
||||
slot: number;
|
||||
remember: boolean;
|
||||
addAccount: boolean;
|
||||
fresh: boolean;
|
||||
/** Redeems the code: loginWithOAuth in the auth store. */
|
||||
redeem: (serverUrl: string, code: string, verifier: string, redirectUri: string) => Promise<boolean>;
|
||||
tryPassword: (attempt: Extract<DesktopPasswordSignInAttempt, { ok: true }>) => Promise<DesktopPasswordSignInAnswer>;
|
||||
}): Promise<DesktopBrowserSignInOutcome> {
|
||||
const bridge = getDesktopBridge();
|
||||
if (!bridge?.auth) return { kind: 'unavailable' };
|
||||
const { serverUrl, callbackPath, slot, remember, addAccount } = options;
|
||||
const auth = claimBrowserSignIn();
|
||||
if (!auth) return { kind: 'failed', error: 'unavailable' };
|
||||
const { serverUrl, slot, remember, addAccount, fresh, redeem, tryPassword } = options;
|
||||
|
||||
const prepared = await bridge.servers?.prepare(serverUrl);
|
||||
if (prepared && !prepared.ok) return { kind: 'declined' };
|
||||
|
||||
const { flowId, redirectUri } = await bridge.auth.beginBrowserSignIn();
|
||||
const begun = await auth.begin({ kind: 'oauth', serverUrl });
|
||||
if (!begun.ok) return failure(begun.error);
|
||||
const { flowId } = begun;
|
||||
currentFlow = flowId;
|
||||
try {
|
||||
const res = await apiFetch('/api/auth/desktop-oauth', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ serverUrl, redirectUri }),
|
||||
body: JSON.stringify({ serverUrl, redirectUri: begun.redirectUri }),
|
||||
});
|
||||
if (res.status === 404) {
|
||||
const body = (await res.json().catch(() => null)) as { error?: string } | null;
|
||||
if (body?.error === 'no_oauth') return await runPasswordPage(auth, flowId, tryPassword);
|
||||
}
|
||||
if (!res.ok) {
|
||||
bridge.auth.cancelBrowserSignIn(flowId);
|
||||
return { kind: 'unavailable' };
|
||||
auth.cancel(flowId);
|
||||
return { kind: 'failed', error: 'discovery' };
|
||||
}
|
||||
const answer = (await res.json()) as DesktopOAuthAnswer;
|
||||
let redirectUri = begun.redirectUri;
|
||||
if (answer.use_scheme) {
|
||||
const scheme = await auth.useScheme(flowId);
|
||||
if (!scheme) {
|
||||
auth.cancel(flowId);
|
||||
return { kind: 'failed', error: 'scheme' };
|
||||
}
|
||||
redirectUri = scheme;
|
||||
}
|
||||
|
||||
const verifier = generateCodeVerifier();
|
||||
const challenge = await generateCodeChallenge(verifier);
|
||||
const state = generateState();
|
||||
|
||||
const authorizeUrl = new URL(answer.authorization_endpoint);
|
||||
authorizeUrl.searchParams.set('response_type', 'code');
|
||||
authorizeUrl.searchParams.set('client_id', answer.client_id);
|
||||
authorizeUrl.searchParams.set('redirect_uri', redirectUri);
|
||||
authorizeUrl.searchParams.set('scope', answer.scope);
|
||||
authorizeUrl.searchParams.set('state', state);
|
||||
authorizeUrl.searchParams.set('code_challenge', challenge);
|
||||
authorizeUrl.searchParams.set('state', begun.state);
|
||||
authorizeUrl.searchParams.set('code_challenge', await generateCodeChallenge(verifier));
|
||||
authorizeUrl.searchParams.set('code_challenge_method', 'S256');
|
||||
if (addAccount) authorizeUrl.searchParams.set('prompt', 'select_account');
|
||||
if (fresh) authorizeUrl.searchParams.set('prompt', 'login');
|
||||
|
||||
const result = await bridge.auth.completeBrowserSignIn(flowId, authorizeUrl.toString());
|
||||
if (!result.ok) {
|
||||
return result.error === 'cancelled' ? { kind: 'cancelled' } : { kind: 'failed', error: result.error };
|
||||
}
|
||||
if (result.state !== state) return { kind: 'failed', error: 'state_mismatch' };
|
||||
const result = await auth.complete(flowId, authorizeUrl.toString());
|
||||
if (!result.ok) return failure(result.error);
|
||||
// RFC 9207: the answer names who issued it. Main has already checked the state.
|
||||
if (result.iss && answer.issuer && result.iss !== answer.issuer) return { kind: 'failed', error: 'issuer_mismatch' };
|
||||
|
||||
// What the callback page expects from a same-window flow, plus the two
|
||||
// values only this flow has.
|
||||
sessionStorage.setItem('oauth_code_verifier', verifier);
|
||||
sessionStorage.setItem('oauth_state', state);
|
||||
sessionStorage.setItem('oauth_server_url', serverUrl);
|
||||
sessionStorage.removeItem('oauth_server_id');
|
||||
// What the auth store's exchange reads. The code never goes near an address bar.
|
||||
sessionStorage.setItem('oauth_remember', String(remember));
|
||||
sessionStorage.setItem('oauth_cookie_slot', String(slot));
|
||||
sessionStorage.setItem(DESKTOP_REDIRECT_URI_KEY, redirectUri);
|
||||
sessionStorage.setItem(DESKTOP_CLIENT_ID_KEY, answer.client_id);
|
||||
if (addAccount) sessionStorage.setItem('oauth_add_account_mode', 'true');
|
||||
|
||||
const query = new URLSearchParams({ code: result.code, state: result.state });
|
||||
return { kind: 'callback', callbackUrl: `${callbackPath}?${query}` };
|
||||
try {
|
||||
return (await redeem(serverUrl, result.code, verifier, redirectUri)) ? { kind: 'signed-in' } : { kind: 'failed', error: 'exchange' };
|
||||
} finally {
|
||||
sessionStorage.removeItem(DESKTOP_CLIENT_ID_KEY);
|
||||
}
|
||||
} catch (error) {
|
||||
bridge.auth.cancelBrowserSignIn(flowId);
|
||||
return { kind: 'failed', error: error instanceof Error ? error.message : String(error) };
|
||||
auth.cancel(flowId);
|
||||
return { kind: 'failed', error: error instanceof Error ? error.name : 'error' };
|
||||
} finally {
|
||||
currentFlow = null;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -42,6 +42,18 @@ export function noteComposerLanguage(key: string, language: string | null): void
|
||||
export function shellLabels(t: (key: string, values?: Record<string, string>) => string): Record<string, string> {
|
||||
return {
|
||||
...updateLabels(t),
|
||||
signInDone: t('desktop_browser_sign_in.page_done'),
|
||||
signInFailed: t('desktop_browser_sign_in.page_failed'),
|
||||
signInLinkUsed: t('desktop_browser_sign_in.page_link_used'),
|
||||
signInPageTitle: t('desktop_browser_sign_in.page_title', { server: '{server}' }),
|
||||
signInPageIntro: t('desktop_browser_sign_in.page_intro', { server: '{server}' }),
|
||||
signInUsername: t('desktop_browser_sign_in.page_username'),
|
||||
signInPassword: t('desktop_browser_sign_in.page_password'),
|
||||
signInCode: t('desktop_browser_sign_in.page_code'),
|
||||
signInSubmit: t('desktop_browser_sign_in.page_submit'),
|
||||
signInWrongPassword: t('desktop_browser_sign_in.page_wrong_password'),
|
||||
signInCodeNeeded: t('desktop_browser_sign_in.page_code_needed'),
|
||||
signInNoAnswer: t('desktop_browser_sign_in.page_no_answer'),
|
||||
menuFile: t('desktopUi.menu.file'),
|
||||
menuEdit: t('desktopUi.menu.edit'),
|
||||
menuView: t('desktopUi.menu.view'),
|
||||
|
||||
@@ -76,6 +76,7 @@ export interface PolicyValues {
|
||||
AuthNegotiateDelegateAllowlist: string | null;
|
||||
AutoSelectCertificateForUrls: CertificateRule[];
|
||||
KeystoreAllowedOrigins: string[];
|
||||
BrowserSignIn: boolean;
|
||||
WipeOfflineData: string | null;
|
||||
}
|
||||
|
||||
@@ -384,6 +385,18 @@ export const POLICY_SCHEMA: Record<PolicyKey, PolicyDefinition> = {
|
||||
de: 'Die Bulwark-Server, nach https-Adresse, deren Plugins mit den Zertifikaten im Speicher des Betriebssystems signieren und entschlüsseln dürfen, ohne dass der Benutzer für jede Website gefragt wird. Eine pro Zeile.',
|
||||
},
|
||||
},
|
||||
BrowserSignIn: {
|
||||
category: 'signIn',
|
||||
type: 'boolean',
|
||||
default: true,
|
||||
onInvalid: false,
|
||||
sample: true,
|
||||
title: { en: 'Offer sign-in through the browser', de: 'Anmeldung über den Browser anbieten' },
|
||||
description: {
|
||||
en: 'When enabled or not configured, the login page offers "Sign in with your browser", so people can use their password manager, passkeys and your single sign-on there. When disabled, the button is gone and the app refuses the flow. The form in the app stays, unless the server only allows OAuth.',
|
||||
de: 'Wenn aktiviert oder nicht konfiguriert, bietet die Anmeldeseite „Mit Ihrem Browser anmelden“ an, damit Benutzer dort ihren Passwort-Manager, Passkeys und Ihr Single Sign-on verwenden können. Wenn deaktiviert, fehlt die Schaltfläche und die App lehnt den Vorgang ab. Das Formular in der App bleibt, sofern der Server nicht nur OAuth erlaubt.',
|
||||
},
|
||||
},
|
||||
WipeOfflineData: {
|
||||
category: 'security',
|
||||
type: 'string',
|
||||
@@ -828,6 +841,7 @@ export const POLICY_CONSUMERS: Record<PolicyKey, PolicyConsumer> = {
|
||||
QuickComposeShortcut: { pendingConsumer: 'step 7, quick compose' },
|
||||
AutoSelectCertificateForUrls: { pendingConsumer: 'step 7, client certificates' },
|
||||
KeystoreAllowedOrigins: { repo: 'shell', file: 'src/main/features/policies.ts' },
|
||||
BrowserSignIn: { repo: 'shell', file: 'src/main/features/browser-sign-in.ts' },
|
||||
};
|
||||
|
||||
/** The part the embedded server enforces. Sent to it by message. */
|
||||
|
||||
+37
-7
@@ -188,16 +188,46 @@ export interface DesktopLifecycleBridge {
|
||||
onFlushRequest: (handler: () => Promise<DesktopFlushAnswer | unknown>) => () => void;
|
||||
}
|
||||
|
||||
export type DesktopBrowserSignInResult =
|
||||
| { ok: true; code: string; state: string }
|
||||
/** Standalone: a mail server's own OAuth. Instance: the instance's own login page. */
|
||||
export type DesktopBrowserSignInRequest = { kind: 'oauth'; serverUrl: string } | { kind: 'instance' };
|
||||
|
||||
export type DesktopBrowserSignInBegin =
|
||||
| { ok: true; flowId: string; redirectUri: string; state: string }
|
||||
| { ok: false; error: string };
|
||||
|
||||
export type DesktopBrowserSignInResult =
|
||||
| { ok: true; code: string; state: string; iss?: string }
|
||||
| { ok: false; error: string };
|
||||
|
||||
export type DesktopPasswordSignInStart = { ok: true; host: string } | { ok: false; error: string };
|
||||
|
||||
export type DesktopPasswordSignInAttempt =
|
||||
| { ok: true; username: string; password: string; totp?: string }
|
||||
| { ok: false; error: string };
|
||||
|
||||
export type DesktopPasswordSignInAnswer =
|
||||
| { ok: true }
|
||||
| { ok: false; error: 'invalid_credentials' | 'totp_required' | 'other' };
|
||||
|
||||
/** Sign-in through the system browser. See lib/desktop/browser-sign-in.ts. */
|
||||
export interface DesktopBrowserSignInControls {
|
||||
/** A short-lived loopback listener for one sign-in. Only from a click. */
|
||||
begin: (request: DesktopBrowserSignInRequest) => Promise<DesktopBrowserSignInBegin>;
|
||||
/** Opens the system browser on `url` and waits for the redirect. */
|
||||
complete: (flowId: string, url: string) => Promise<DesktopBrowserSignInResult>;
|
||||
/** The server refused loopback and took the `bulwark:` scheme. */
|
||||
useScheme: (flowId: string) => Promise<string | null>;
|
||||
cancel: (flowId: string) => void;
|
||||
/** The server has no OAuth: a page main serves on a stable loopback port. */
|
||||
beginPassword: (flowId: string) => Promise<DesktopPasswordSignInStart>;
|
||||
nextPassword: (flowId: string) => Promise<DesktopPasswordSignInAttempt>;
|
||||
answerPassword: (flowId: string, answer: DesktopPasswordSignInAnswer) => void;
|
||||
outcome: (flowId: string) => Promise<DesktopBrowserSignInResult>;
|
||||
}
|
||||
|
||||
export interface DesktopAuthBridge {
|
||||
/** Starts a short-lived loopback listener for one sign-in. */
|
||||
beginBrowserSignIn: () => Promise<{ flowId: string; redirectUri: string }>;
|
||||
/** Opens the system browser on `authorizeUrl` and waits for the redirect. */
|
||||
completeBrowserSignIn: (flowId: string, authorizeUrl: string) => Promise<DesktopBrowserSignInResult>;
|
||||
cancelBrowserSignIn: (flowId: string) => void;
|
||||
/** Once per document, in the first render: a same-origin frame can reach this bridge. */
|
||||
claim: () => DesktopBrowserSignInControls | null;
|
||||
}
|
||||
|
||||
export type DesktopPluginInstallResult =
|
||||
|
||||
@@ -5,6 +5,7 @@ export interface OAuthMetadata {
|
||||
revocation_endpoint?: string;
|
||||
end_session_endpoint?: string;
|
||||
scopes_supported?: string[];
|
||||
registration_endpoint?: string;
|
||||
}
|
||||
|
||||
// Validates that a discovered endpoint URL is safe to follow. Server-side
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "محاولات كثيرة جدًا. حاول بعد {count, plural, zero {# دقيقة} one {دقيقة واحدة} two {دقيقتين} few {# دقائق} many {# دقيقة} other {# دقيقة}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "سجّل الدخول باستخدام المتصفح",
|
||||
"browser_waiting": "أكمل تسجيل الدخول في المتصفح",
|
||||
"browser_unavailable": "لا يتيح هذا الخادم تسجيل الدخول عبر المتصفح. استخدم كلمة المرور بدلًا من ذلك.",
|
||||
"browser_failed": "لم ينجح تسجيل الدخول عبر المتصفح. حاول مرة أخرى.",
|
||||
"server_needed": "أدخل عنوان الخادم أولًا.",
|
||||
"server_declined": "لم تسمح بهذا الخادم، لذا لم يُرسل إليه أي شيء.",
|
||||
"server_invalid": "عنوان الخادم هذا غير صالح."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "تسجيل الدخول عبر المتصفح…",
|
||||
"waiting": "في انتظار المتصفح…",
|
||||
"waiting_hint": "أكمل تسجيل الدخول هناك. يعمل مدير كلمات المرور لديك في المتصفح.",
|
||||
"cancel": "إلغاء",
|
||||
"or_here": "أو سجّل الدخول هنا",
|
||||
"timed_out": "استغرق تسجيل الدخول في المتصفح وقتًا طويلًا. حاول مرة أخرى.",
|
||||
"no_browser": "تعذر على Bulwark فتح المتصفح. حاول مرة أخرى أو سجّل الدخول هنا.",
|
||||
"failed": "تعذر تسجيل الدخول عبر المتصفح. حاول مرة أخرى.",
|
||||
"handoff_banner": "أنت تسجّل الدخول إلى تطبيق Bulwark على هذا الكمبيوتر. يبقى هذا المتصفح خارج Bulwark.",
|
||||
"consent_title": "هل تريد تسجيل الدخول إلى تطبيق Bulwark؟",
|
||||
"consent_description": "سيذهب تسجيل دخول {username} إلى تطبيق Bulwark على هذا الكمبيوتر. تابع فقط إذا بدأت ذلك من التطبيق.",
|
||||
"consent_confirm": "تسجيل الدخول إلى التطبيق",
|
||||
"consent_cancel": "ليس الآن",
|
||||
"page_done": "يمكنك إغلاق علامة التبويب هذه والعودة إلى Bulwark.",
|
||||
"page_failed": "تعذر تسجيل الدخول. عد إلى Bulwark وحاول مرة أخرى.",
|
||||
"page_link_used": "يعمل هذا الرابط مرة واحدة فقط. عد إلى Bulwark وابدأ من جديد.",
|
||||
"page_title": "تسجيل الدخول إلى {server}",
|
||||
"page_intro": "هذه الصفحة من تطبيق Bulwark على هذا الكمبيوتر. تذهب كلمة مرورك إلى {server} فقط.",
|
||||
"page_username": "عنوان البريد الإلكتروني أو اسم المستخدم",
|
||||
"page_password": "كلمة المرور",
|
||||
"page_code": "رمز المصادقة الثنائية",
|
||||
"page_submit": "تسجيل الدخول",
|
||||
"page_wrong_password": "لم يقبل الخادم اسم المستخدم وكلمة المرور هذين.",
|
||||
"page_code_needed": "يحتاج هذا الحساب أيضًا إلى رمز المصادقة الثنائية. أدخل كلمة المرور مرة أخرى والرمز.",
|
||||
"page_no_answer": "تعذر على Bulwark تسجيل الدخول. تحقق من إمكانية الوصول إلى الخادم وحاول مرة أخرى."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "التحديثات",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Massa intents. Torneu-ho a provar d'aquí a {count, plural, one {# minut} other {# minuts}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Inicia la sessió amb el navegador",
|
||||
"browser_waiting": "Acaba d'iniciar la sessió al navegador",
|
||||
"browser_unavailable": "Aquest servidor no permet iniciar la sessió amb el navegador. Fes servir la contrasenya.",
|
||||
"browser_failed": "No s'ha pogut iniciar la sessió amb el navegador. Torna-ho a provar.",
|
||||
"server_needed": "Primer escriu l'adreça del servidor.",
|
||||
"server_declined": "No has permès aquest servidor, així que no s'hi ha enviat res.",
|
||||
"server_invalid": "Aquesta adreça de servidor no és vàlida."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Inicia la sessió amb el navegador…",
|
||||
"waiting": "S’està esperant el navegador…",
|
||||
"waiting_hint": "Acaba d’iniciar la sessió allà. El teu gestor de contrasenyes funciona al navegador.",
|
||||
"cancel": "Cancel·la",
|
||||
"or_here": "o inicia la sessió aquí",
|
||||
"timed_out": "L’inici de sessió al navegador ha trigat massa. Torna-ho a provar.",
|
||||
"no_browser": "Bulwark no ha pogut obrir el navegador. Torna-ho a provar o inicia la sessió aquí.",
|
||||
"failed": "No s’ha pogut iniciar la sessió a través del navegador. Torna-ho a provar.",
|
||||
"handoff_banner": "Estàs iniciant la sessió a l’aplicació Bulwark d’aquest ordinador. Aquest navegador continua sense sessió a Bulwark.",
|
||||
"consent_title": "Vols iniciar la sessió a l’aplicació Bulwark?",
|
||||
"consent_description": "L’inici de sessió de {username} va a l’aplicació Bulwark d’aquest ordinador. Continua només si ho has començat des de l’aplicació.",
|
||||
"consent_confirm": "Inicia la sessió a l’aplicació",
|
||||
"consent_cancel": "Ara no",
|
||||
"page_done": "Pots tancar aquesta pestanya i tornar a Bulwark.",
|
||||
"page_failed": "No s’ha pogut iniciar la sessió. Torna a Bulwark i torna-ho a provar.",
|
||||
"page_link_used": "Aquest enllaç només funciona una vegada. Torna a Bulwark i comença de nou.",
|
||||
"page_title": "Inicia la sessió a {server}",
|
||||
"page_intro": "Aquesta pàgina ve de l’aplicació Bulwark d’aquest ordinador. La teva contrasenya va a {server} i enlloc més.",
|
||||
"page_username": "Adreça electrònica o nom d’usuari",
|
||||
"page_password": "Contrasenya",
|
||||
"page_code": "Codi de dos factors",
|
||||
"page_submit": "Inicia la sessió",
|
||||
"page_wrong_password": "El servidor no ha acceptat aquest nom d’usuari i aquesta contrasenya.",
|
||||
"page_code_needed": "Aquest compte també necessita un codi de dos factors. Torna a escriure la contrasenya i el codi.",
|
||||
"page_no_answer": "Bulwark no ha pogut iniciar la sessió. Comprova que el servidor sigui accessible i torna-ho a provar."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Actualitzacions",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Příliš mnoho pokusů. Zkuste to za {count, plural, one {# minutu} few {# minuty} many {# minuty} other {# minut}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Přihlásit se v prohlížeči",
|
||||
"browser_waiting": "Dokončete přihlášení v prohlížeči",
|
||||
"browser_unavailable": "Tento server přihlášení přes prohlížeč nenabízí. Použijte heslo.",
|
||||
"browser_failed": "Přihlášení přes prohlížeč se nezdařilo. Zkuste to znovu.",
|
||||
"server_needed": "Nejdřív zadejte adresu serveru.",
|
||||
"server_declined": "Tento server jste nepovolili, proto se na něj nic neodeslalo.",
|
||||
"server_invalid": "Tato adresa serveru není platná."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Přihlásit se v prohlížeči…",
|
||||
"waiting": "Čekání na prohlížeč…",
|
||||
"waiting_hint": "Dokončete přihlášení tam. Váš správce hesel funguje v prohlížeči.",
|
||||
"cancel": "Zrušit",
|
||||
"or_here": "nebo se přihlaste zde",
|
||||
"timed_out": "Přihlášení v prohlížeči trvalo příliš dlouho. Zkuste to znovu.",
|
||||
"no_browser": "Bulwark nemohl otevřít prohlížeč. Zkuste to znovu nebo se přihlaste zde.",
|
||||
"failed": "Přihlášení přes prohlížeč se nezdařilo. Zkuste to znovu.",
|
||||
"handoff_banner": "Přihlašujete se do aplikace Bulwark v tomto počítači. Tento prohlížeč zůstane z Bulwarku odhlášený.",
|
||||
"consent_title": "Přihlásit se do aplikace Bulwark?",
|
||||
"consent_description": "Vaše přihlášení pro {username} půjde do aplikace Bulwark v tomto počítači. Pokračujte jen tehdy, pokud jste to spustili z aplikace.",
|
||||
"consent_confirm": "Přihlásit se do aplikace",
|
||||
"consent_cancel": "Teď ne",
|
||||
"page_done": "Tuto kartu můžete zavřít a vrátit se do Bulwarku.",
|
||||
"page_failed": "Přihlášení se nezdařilo. Vraťte se do Bulwarku a zkuste to znovu.",
|
||||
"page_link_used": "Tento odkaz funguje jen jednou. Vraťte se do Bulwarku a začněte znovu.",
|
||||
"page_title": "Přihlásit se k {server}",
|
||||
"page_intro": "Tato stránka pochází z aplikace Bulwark v tomto počítači. Vaše heslo jde na {server} a nikam jinam.",
|
||||
"page_username": "E-mailová adresa nebo uživatelské jméno",
|
||||
"page_password": "Heslo",
|
||||
"page_code": "Dvoufázový kód",
|
||||
"page_submit": "Přihlásit se",
|
||||
"page_wrong_password": "Server toto uživatelské jméno a heslo nepřijal.",
|
||||
"page_code_needed": "Tento účet potřebuje také dvoufázový kód. Zadejte znovu heslo a kód.",
|
||||
"page_no_answer": "Bulwark se nemohl přihlásit. Zkontrolujte, zda je server dostupný, a zkuste to znovu."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Aktualizace",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "For mange forsøg. Prøv igen om {count, plural, one {# minut} other {# minutter}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Log ind med din browser",
|
||||
"browser_waiting": "Gør login færdigt i din browser",
|
||||
"browser_unavailable": "Denne server tilbyder ikke login via browser. Brug din adgangskode i stedet.",
|
||||
"browser_failed": "Login via browseren lykkedes ikke. Prøv igen.",
|
||||
"server_needed": "Angiv først serverens adresse.",
|
||||
"server_declined": "Du tillod ikke denne server, så der blev ikke sendt noget til den.",
|
||||
"server_invalid": "Denne serveradresse er ikke gyldig."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Log ind med din browser…",
|
||||
"waiting": "Venter på din browser…",
|
||||
"waiting_hint": "Afslut login der. Din adgangskodeadministrator virker i din browser.",
|
||||
"cancel": "Annuller",
|
||||
"or_here": "eller log ind her",
|
||||
"timed_out": "Login i browseren tog for lang tid. Prøv igen.",
|
||||
"no_browser": "Bulwark kunne ikke åbne din browser. Prøv igen, eller log ind her.",
|
||||
"failed": "Login via din browser lykkedes ikke. Prøv igen.",
|
||||
"handoff_banner": "Du logger ind i Bulwark-appen på denne computer. Denne browser forbliver logget ud af Bulwark.",
|
||||
"consent_title": "Log ind i Bulwark-appen?",
|
||||
"consent_description": "Dit login for {username} går til Bulwark-appen på denne computer. Fortsæt kun, hvis du startede dette fra appen.",
|
||||
"consent_confirm": "Log ind i appen",
|
||||
"consent_cancel": "Ikke nu",
|
||||
"page_done": "Du kan lukke denne fane og gå tilbage til Bulwark.",
|
||||
"page_failed": "Login lykkedes ikke. Gå tilbage til Bulwark, og prøv igen.",
|
||||
"page_link_used": "Dette link virker kun én gang. Gå tilbage til Bulwark, og start forfra.",
|
||||
"page_title": "Log ind på {server}",
|
||||
"page_intro": "Denne side kommer fra Bulwark-appen på denne computer. Din adgangskode går til {server} og ingen andre steder.",
|
||||
"page_username": "E-mailadresse eller brugernavn",
|
||||
"page_password": "Adgangskode",
|
||||
"page_code": "Tofaktorkode",
|
||||
"page_submit": "Log ind",
|
||||
"page_wrong_password": "Serveren accepterede ikke dette brugernavn og denne adgangskode.",
|
||||
"page_code_needed": "Denne konto skal også bruge en tofaktorkode. Indtast din adgangskode igen og koden.",
|
||||
"page_no_answer": "Bulwark kunne ikke logge ind. Tjek, at serveren kan nås, og prøv igen."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Opdateringer",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Zu viele Versuche. Versuchen Sie es in {count, plural, one {# Minute} other {# Minuten}} noch einmal."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Mit dem Browser anmelden",
|
||||
"browser_waiting": "Schließen Sie die Anmeldung im Browser ab",
|
||||
"browser_unavailable": "Dieser Server bietet keine Anmeldung über den Browser an. Verwenden Sie stattdessen Ihr Passwort.",
|
||||
"browser_failed": "Die Anmeldung über den Browser hat nicht geklappt. Versuchen Sie es noch einmal.",
|
||||
"server_needed": "Geben Sie zuerst die Adresse Ihres Servers ein.",
|
||||
"server_declined": "Sie haben diesen Server nicht zugelassen, daher wurde nichts an ihn gesendet.",
|
||||
"server_invalid": "Diese Serveradresse ist ungültig."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Mit Ihrem Browser anmelden…",
|
||||
"waiting": "Warten auf Ihren Browser…",
|
||||
"waiting_hint": "Schließen Sie die Anmeldung dort ab. Ihr Passwort-Manager funktioniert in Ihrem Browser.",
|
||||
"cancel": "Abbrechen",
|
||||
"or_here": "oder hier anmelden",
|
||||
"timed_out": "Die Anmeldung im Browser hat zu lange gedauert. Versuchen Sie es noch einmal.",
|
||||
"no_browser": "Bulwark konnte Ihren Browser nicht öffnen. Versuchen Sie es noch einmal oder melden Sie sich hier an.",
|
||||
"failed": "Die Anmeldung über Ihren Browser hat nicht geklappt. Versuchen Sie es noch einmal.",
|
||||
"handoff_banner": "Sie melden sich bei der Bulwark-App auf diesem Computer an. Dieser Browser bleibt bei Bulwark abgemeldet.",
|
||||
"consent_title": "Bei der Bulwark-App anmelden?",
|
||||
"consent_description": "Ihre Anmeldung für {username} geht an die Bulwark-App auf diesem Computer. Fahren Sie nur fort, wenn Sie dies aus der App gestartet haben.",
|
||||
"consent_confirm": "Bei der App anmelden",
|
||||
"consent_cancel": "Jetzt nicht",
|
||||
"page_done": "Sie können diesen Tab schließen und zu Bulwark zurückkehren.",
|
||||
"page_failed": "Die Anmeldung hat nicht geklappt. Gehen Sie zurück zu Bulwark und versuchen Sie es noch einmal.",
|
||||
"page_link_used": "Dieser Link funktioniert nur einmal. Gehen Sie zurück zu Bulwark und beginnen Sie neu.",
|
||||
"page_title": "Bei {server} anmelden",
|
||||
"page_intro": "Diese Seite kommt von der Bulwark-App auf diesem Computer. Ihr Passwort geht an {server} und sonst nirgendwohin.",
|
||||
"page_username": "E-Mail-Adresse oder Benutzername",
|
||||
"page_password": "Passwort",
|
||||
"page_code": "Zwei-Faktor-Code",
|
||||
"page_submit": "Anmelden",
|
||||
"page_wrong_password": "Der Server hat diesen Benutzernamen und dieses Passwort nicht akzeptiert.",
|
||||
"page_code_needed": "Dieses Konto braucht außerdem einen Zwei-Faktor-Code. Geben Sie Ihr Passwort noch einmal und den Code ein.",
|
||||
"page_no_answer": "Bulwark konnte sich nicht anmelden. Prüfen Sie, ob der Server erreichbar ist, und versuchen Sie es noch einmal."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Updates",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Too many tries. Try again in {count, plural, one {# minute} other {# minutes}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Sign in with your browser",
|
||||
"browser_waiting": "Finish signing in in your browser",
|
||||
"browser_unavailable": "This server doesn't offer sign-in through a browser. Use your password instead.",
|
||||
"browser_failed": "Signing in through your browser didn't work. Try again.",
|
||||
"server_needed": "Enter your server's address first.",
|
||||
"server_declined": "You didn't allow this server, so nothing was sent to it.",
|
||||
"server_invalid": "This server address isn't valid."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Sign in with your browser…",
|
||||
"waiting": "Waiting for your browser…",
|
||||
"waiting_hint": "Finish signing in there. Your password manager works in your browser.",
|
||||
"cancel": "Cancel",
|
||||
"or_here": "or sign in here",
|
||||
"timed_out": "The browser sign-in took too long. Try again.",
|
||||
"no_browser": "Bulwark could not open your browser. Try again, or sign in here.",
|
||||
"failed": "Signing in through your browser did not work. Try again.",
|
||||
"handoff_banner": "You are signing in to the Bulwark app on this computer. This browser stays signed out of Bulwark.",
|
||||
"consent_title": "Sign in to the Bulwark app?",
|
||||
"consent_description": "Your sign-in for {username} goes to the Bulwark app on this computer. Continue only if you started this from the app.",
|
||||
"consent_confirm": "Sign in to the app",
|
||||
"consent_cancel": "Not now",
|
||||
"page_done": "You can close this tab and go back to Bulwark.",
|
||||
"page_failed": "Signing in did not work. Go back to Bulwark and try again.",
|
||||
"page_link_used": "This link only works once. Go back to Bulwark and start again.",
|
||||
"page_title": "Sign in to {server}",
|
||||
"page_intro": "This page comes from the Bulwark app on this computer. Your password goes to {server} and nowhere else.",
|
||||
"page_username": "Email address or username",
|
||||
"page_password": "Password",
|
||||
"page_code": "Two-factor code",
|
||||
"page_submit": "Sign in",
|
||||
"page_wrong_password": "The server did not accept this username and password.",
|
||||
"page_code_needed": "This account also needs a two-factor code. Enter your password again and the code.",
|
||||
"page_no_answer": "Bulwark could not sign in. Check that the server is reachable and try again."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Updates",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Demasiados intentos. Inténtelo de nuevo en {count, plural, one {# minuto} other {# minutos}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Iniciar sesión con el navegador",
|
||||
"browser_waiting": "Termina de iniciar sesión en el navegador",
|
||||
"browser_unavailable": "Este servidor no permite iniciar sesión con el navegador. Usa tu contraseña.",
|
||||
"browser_failed": "No se pudo iniciar sesión con el navegador. Inténtalo de nuevo.",
|
||||
"server_needed": "Primero escribe la dirección del servidor.",
|
||||
"server_declined": "No permitiste este servidor, así que no se le envió nada.",
|
||||
"server_invalid": "Esta dirección de servidor no es válida."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Iniciar sesión con tu navegador…",
|
||||
"waiting": "Esperando a tu navegador…",
|
||||
"waiting_hint": "Termina de iniciar sesión allí. Tu gestor de contraseñas funciona en tu navegador.",
|
||||
"cancel": "Cancelar",
|
||||
"or_here": "o inicia sesión aquí",
|
||||
"timed_out": "El inicio de sesión en el navegador tardó demasiado. Inténtalo de nuevo.",
|
||||
"no_browser": "Bulwark no pudo abrir tu navegador. Inténtalo de nuevo o inicia sesión aquí.",
|
||||
"failed": "No se pudo iniciar sesión a través de tu navegador. Inténtalo de nuevo.",
|
||||
"handoff_banner": "Estás iniciando sesión en la aplicación Bulwark de este ordenador. Este navegador sigue sin sesión en Bulwark.",
|
||||
"consent_title": "¿Iniciar sesión en la aplicación Bulwark?",
|
||||
"consent_description": "Tu inicio de sesión de {username} va a la aplicación Bulwark de este ordenador. Continúa solo si lo iniciaste desde la aplicación.",
|
||||
"consent_confirm": "Iniciar sesión en la aplicación",
|
||||
"consent_cancel": "Ahora no",
|
||||
"page_done": "Puedes cerrar esta pestaña y volver a Bulwark.",
|
||||
"page_failed": "No se pudo iniciar sesión. Vuelve a Bulwark e inténtalo de nuevo.",
|
||||
"page_link_used": "Este enlace solo funciona una vez. Vuelve a Bulwark y empieza de nuevo.",
|
||||
"page_title": "Iniciar sesión en {server}",
|
||||
"page_intro": "Esta página viene de la aplicación Bulwark de este ordenador. Tu contraseña va a {server} y a ningún otro sitio.",
|
||||
"page_username": "Correo electrónico o nombre de usuario",
|
||||
"page_password": "Contraseña",
|
||||
"page_code": "Código de dos factores",
|
||||
"page_submit": "Iniciar sesión",
|
||||
"page_wrong_password": "El servidor no aceptó este nombre de usuario y esta contraseña.",
|
||||
"page_code_needed": "Esta cuenta también necesita un código de dos factores. Escribe de nuevo tu contraseña y el código.",
|
||||
"page_no_answer": "Bulwark no pudo iniciar sesión. Comprueba que el servidor esté accesible e inténtalo de nuevo."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Actualizaciones",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Liiga palju katseid. Proovige uuesti {count, plural, one {# minuti} other {# minuti}} pärast."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Logi sisse brauseriga",
|
||||
"browser_waiting": "Lõpeta sisselogimine brauseris",
|
||||
"browser_unavailable": "See server ei paku brauseri kaudu sisselogimist. Kasuta parooli.",
|
||||
"browser_failed": "Brauseri kaudu sisselogimine ei õnnestunud. Proovi uuesti.",
|
||||
"server_needed": "Sisesta kõigepealt serveri aadress.",
|
||||
"server_declined": "Sa ei lubanud seda serverit, nii et sellele ei saadetud midagi.",
|
||||
"server_invalid": "See serveri aadress ei kehti."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Logi sisse brauseriga…",
|
||||
"waiting": "Ootan brauserit…",
|
||||
"waiting_hint": "Lõpeta sisselogimine seal. Sinu paroolihaldur töötab brauseris.",
|
||||
"cancel": "Tühista",
|
||||
"or_here": "või logi sisse siin",
|
||||
"timed_out": "Sisselogimine brauseris võttis liiga kaua aega. Proovi uuesti.",
|
||||
"no_browser": "Bulwark ei saanud brauserit avada. Proovi uuesti või logi sisse siin.",
|
||||
"failed": "Sisselogimine brauseri kaudu ei õnnestunud. Proovi uuesti.",
|
||||
"handoff_banner": "Logid sisse selle arvuti Bulwarki rakendusse. See brauser jääb Bulwarkist välja logituks.",
|
||||
"consent_title": "Kas logida sisse Bulwarki rakendusse?",
|
||||
"consent_description": "Konto {username} sisselogimine läheb selle arvuti Bulwarki rakendusele. Jätka ainult siis, kui alustasid seda rakendusest.",
|
||||
"consent_confirm": "Logi rakendusse sisse",
|
||||
"consent_cancel": "Mitte praegu",
|
||||
"page_done": "Võid selle vahelehe sulgeda ja Bulwarki naasta.",
|
||||
"page_failed": "Sisselogimine ei õnnestunud. Mine tagasi Bulwarki ja proovi uuesti.",
|
||||
"page_link_used": "See link töötab ainult üks kord. Mine tagasi Bulwarki ja alusta uuesti.",
|
||||
"page_title": "Logi sisse serverisse {server}",
|
||||
"page_intro": "See leht tuleb selle arvuti Bulwarki rakendusest. Sinu parool läheb serverisse {server} ja mitte kuhugi mujale.",
|
||||
"page_username": "E-posti aadress või kasutajanimi",
|
||||
"page_password": "Parool",
|
||||
"page_code": "Kaheastmelise kinnituse kood",
|
||||
"page_submit": "Logi sisse",
|
||||
"page_wrong_password": "Server ei aktsepteerinud seda kasutajanime ja parooli.",
|
||||
"page_code_needed": "See konto vajab ka kaheastmelise kinnituse koodi. Sisesta parool uuesti ja kood.",
|
||||
"page_no_answer": "Bulwark ei saanud sisse logida. Kontrolli, kas server on kättesaadav, ja proovi uuesti."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Uuendused",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "تلاشهای زیاد. {count, plural, one {# دقیقه} other {# دقیقه}} دیگر دوباره تلاش کنید."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "ورود با مرورگر",
|
||||
"browser_waiting": "ورود را در مرورگر کامل کنید",
|
||||
"browser_unavailable": "این سرور ورود از طریق مرورگر را ارائه نمیدهد. از گذرواژه خود استفاده کنید.",
|
||||
"browser_failed": "ورود از طریق مرورگر انجام نشد. دوباره تلاش کنید.",
|
||||
"server_needed": "ابتدا نشانی سرور را وارد کنید.",
|
||||
"server_declined": "شما این سرور را مجاز نکردید، پس چیزی به آن فرستاده نشد.",
|
||||
"server_invalid": "این نشانی سرور معتبر نیست."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "ورود با مرورگر…",
|
||||
"waiting": "در انتظار مرورگر…",
|
||||
"waiting_hint": "ورود را همانجا کامل کنید. مدیر گذرواژه شما در مرورگر کار میکند.",
|
||||
"cancel": "لغو",
|
||||
"or_here": "یا اینجا وارد شوید",
|
||||
"timed_out": "ورود در مرورگر بیش از حد طول کشید. دوباره تلاش کنید.",
|
||||
"no_browser": "Bulwark نتوانست مرورگر را باز کند. دوباره تلاش کنید یا اینجا وارد شوید.",
|
||||
"failed": "ورود از طریق مرورگر انجام نشد. دوباره تلاش کنید.",
|
||||
"handoff_banner": "شما در حال ورود به برنامه Bulwark روی این رایانه هستید. این مرورگر همچنان از Bulwark خارج میماند.",
|
||||
"consent_title": "به برنامه Bulwark وارد میشوید؟",
|
||||
"consent_description": "ورود {username} به برنامه Bulwark روی این رایانه میرود. فقط اگر این کار را از برنامه شروع کردهاید ادامه دهید.",
|
||||
"consent_confirm": "ورود به برنامه",
|
||||
"consent_cancel": "اکنون نه",
|
||||
"page_done": "میتوانید این زبانه را ببندید و به Bulwark برگردید.",
|
||||
"page_failed": "ورود انجام نشد. به Bulwark برگردید و دوباره تلاش کنید.",
|
||||
"page_link_used": "این پیوند فقط یک بار کار میکند. به Bulwark برگردید و از نو شروع کنید.",
|
||||
"page_title": "ورود به {server}",
|
||||
"page_intro": "این صفحه از برنامه Bulwark روی این رایانه میآید. گذرواژه شما فقط به {server} میرود.",
|
||||
"page_username": "نشانی ایمیل یا نام کاربری",
|
||||
"page_password": "گذرواژه",
|
||||
"page_code": "کد دومرحلهای",
|
||||
"page_submit": "ورود",
|
||||
"page_wrong_password": "سرور این نام کاربری و گذرواژه را نپذیرفت.",
|
||||
"page_code_needed": "این حساب به کد دومرحلهای هم نیاز دارد. گذرواژه و کد را دوباره وارد کنید.",
|
||||
"page_no_answer": "Bulwark نتوانست وارد شود. بررسی کنید که سرور در دسترس باشد و دوباره تلاش کنید."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "بهروزرسانیها",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Trop d'essais. Réessayez dans {count, plural, one {# minute} other {# minutes}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Se connecter avec le navigateur",
|
||||
"browser_waiting": "Terminez la connexion dans votre navigateur",
|
||||
"browser_unavailable": "Ce serveur ne propose pas la connexion par navigateur. Utilisez votre mot de passe.",
|
||||
"browser_failed": "La connexion par navigateur a échoué. Réessayez.",
|
||||
"server_needed": "Saisissez d'abord l'adresse du serveur.",
|
||||
"server_declined": "Vous n'avez pas autorisé ce serveur, donc rien ne lui a été envoyé.",
|
||||
"server_invalid": "Cette adresse de serveur n'est pas valide."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Se connecter avec votre navigateur…",
|
||||
"waiting": "En attente de votre navigateur…",
|
||||
"waiting_hint": "Terminez la connexion là-bas. Votre gestionnaire de mots de passe fonctionne dans votre navigateur.",
|
||||
"cancel": "Annuler",
|
||||
"or_here": "ou se connecter ici",
|
||||
"timed_out": "La connexion dans le navigateur a pris trop de temps. Réessayez.",
|
||||
"no_browser": "Bulwark n’a pas pu ouvrir votre navigateur. Réessayez ou connectez-vous ici.",
|
||||
"failed": "La connexion via votre navigateur n’a pas fonctionné. Réessayez.",
|
||||
"handoff_banner": "Vous vous connectez à l’application Bulwark sur cet ordinateur. Ce navigateur reste déconnecté de Bulwark.",
|
||||
"consent_title": "Se connecter à l’application Bulwark ?",
|
||||
"consent_description": "Votre connexion pour {username} va à l’application Bulwark sur cet ordinateur. Continuez seulement si vous avez lancé cela depuis l’application.",
|
||||
"consent_confirm": "Se connecter à l’application",
|
||||
"consent_cancel": "Pas maintenant",
|
||||
"page_done": "Vous pouvez fermer cet onglet et revenir à Bulwark.",
|
||||
"page_failed": "La connexion n’a pas fonctionné. Revenez à Bulwark et réessayez.",
|
||||
"page_link_used": "Ce lien ne fonctionne qu’une fois. Revenez à Bulwark et recommencez.",
|
||||
"page_title": "Se connecter à {server}",
|
||||
"page_intro": "Cette page vient de l’application Bulwark sur cet ordinateur. Votre mot de passe va à {server} et nulle part ailleurs.",
|
||||
"page_username": "Adresse e-mail ou nom d’utilisateur",
|
||||
"page_password": "Mot de passe",
|
||||
"page_code": "Code à deux facteurs",
|
||||
"page_submit": "Se connecter",
|
||||
"page_wrong_password": "Le serveur n’a pas accepté ce nom d’utilisateur et ce mot de passe.",
|
||||
"page_code_needed": "Ce compte demande aussi un code à deux facteurs. Saisissez à nouveau votre mot de passe et le code.",
|
||||
"page_no_answer": "Bulwark n’a pas pu se connecter. Vérifiez que le serveur est joignable et réessayez."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Mises à jour",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6874,14 +6874,37 @@
|
||||
"blocked_minutes": "יותר מדי ניסיונות. נסו שוב בעוד {count, plural, one {דקה אחת} two {שתי דקות} other {# דקות}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "כניסה באמצעות הדפדפן",
|
||||
"browser_waiting": "יש להשלים את הכניסה בדפדפן",
|
||||
"browser_unavailable": "השרת הזה לא מאפשר כניסה דרך דפדפן. יש להשתמש בסיסמה.",
|
||||
"browser_failed": "הכניסה דרך הדפדפן לא הצליחה. כדאי לנסות שוב.",
|
||||
"server_needed": "קודם צריך להזין את כתובת השרת.",
|
||||
"server_declined": "לא אישרת את השרת הזה, לכן לא נשלח אליו דבר.",
|
||||
"server_invalid": "כתובת השרת הזו לא תקינה."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "התחברות דרך הדפדפן…",
|
||||
"waiting": "ממתין לדפדפן…",
|
||||
"waiting_hint": "סיימו את ההתחברות שם. מנהל הסיסמאות שלכם פועל בדפדפן.",
|
||||
"cancel": "ביטול",
|
||||
"or_here": "או התחברו כאן",
|
||||
"timed_out": "ההתחברות בדפדפן נמשכה זמן רב מדי. נסו שוב.",
|
||||
"no_browser": "Bulwark לא הצליח לפתוח את הדפדפן. נסו שוב או התחברו כאן.",
|
||||
"failed": "ההתחברות דרך הדפדפן לא הצליחה. נסו שוב.",
|
||||
"handoff_banner": "אתם מתחברים לאפליקציית Bulwark במחשב זה. הדפדפן הזה נשאר מנותק מ-Bulwark.",
|
||||
"consent_title": "להתחבר לאפליקציית Bulwark?",
|
||||
"consent_description": "ההתחברות של {username} תועבר לאפליקציית Bulwark במחשב זה. המשיכו רק אם התחלתם זאת מהאפליקציה.",
|
||||
"consent_confirm": "התחברות לאפליקציה",
|
||||
"consent_cancel": "לא עכשיו",
|
||||
"page_done": "אפשר לסגור את הכרטיסייה הזו ולחזור ל-Bulwark.",
|
||||
"page_failed": "ההתחברות לא הצליחה. חזרו ל-Bulwark ונסו שוב.",
|
||||
"page_link_used": "הקישור הזה עובד פעם אחת בלבד. חזרו ל-Bulwark והתחילו מחדש.",
|
||||
"page_title": "התחברות אל {server}",
|
||||
"page_intro": "הדף הזה מגיע מאפליקציית Bulwark במחשב זה. הסיסמה שלכם נשלחת אל {server} בלבד.",
|
||||
"page_username": "כתובת דוא״ל או שם משתמש",
|
||||
"page_password": "סיסמה",
|
||||
"page_code": "קוד אימות דו-שלבי",
|
||||
"page_submit": "התחברות",
|
||||
"page_wrong_password": "השרת לא קיבל את שם המשתמש והסיסמה האלה.",
|
||||
"page_code_needed": "החשבון הזה צריך גם קוד אימות דו-שלבי. הזינו שוב את הסיסמה ואת הקוד.",
|
||||
"page_no_answer": "Bulwark לא הצליח להתחבר. בדקו שהשרת זמין ונסו שוב."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "עדכונים",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Túl sok próbálkozás. Próbálja újra {count, plural, one {# perc} other {# perc}} múlva."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Bejelentkezés böngészővel",
|
||||
"browser_waiting": "Fejezze be a bejelentkezést a böngészőben",
|
||||
"browser_unavailable": "Ez a szerver nem kínál böngészős bejelentkezést. Használja a jelszavát.",
|
||||
"browser_failed": "A böngészős bejelentkezés nem sikerült. Próbálja újra.",
|
||||
"server_needed": "Először adja meg a szerver címét.",
|
||||
"server_declined": "Nem engedélyezte ezt a szervert, ezért semmit sem küldtünk neki.",
|
||||
"server_invalid": "Ez a szervercím nem érvényes."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Bejelentkezés a böngészővel…",
|
||||
"waiting": "Várakozás a böngészőre…",
|
||||
"waiting_hint": "Fejezze be ott a bejelentkezést. A jelszókezelője a böngészőben működik.",
|
||||
"cancel": "Mégse",
|
||||
"or_here": "vagy jelentkezzen be itt",
|
||||
"timed_out": "A böngészős bejelentkezés túl sokáig tartott. Próbálja újra.",
|
||||
"no_browser": "A Bulwark nem tudta megnyitni a böngészőt. Próbálja újra, vagy jelentkezzen be itt.",
|
||||
"failed": "A böngészőn keresztüli bejelentkezés nem sikerült. Próbálja újra.",
|
||||
"handoff_banner": "A számítógépen lévő Bulwark alkalmazásba jelentkezik be. Ez a böngésző kijelentkezve marad a Bulwarkból.",
|
||||
"consent_title": "Bejelentkezik a Bulwark alkalmazásba?",
|
||||
"consent_description": "A(z) {username} bejelentkezése a számítógépen lévő Bulwark alkalmazáshoz kerül. Csak akkor folytassa, ha az alkalmazásból indította.",
|
||||
"consent_confirm": "Bejelentkezés az alkalmazásba",
|
||||
"consent_cancel": "Most nem",
|
||||
"page_done": "Bezárhatja ezt a lapot, és visszatérhet a Bulwarkhoz.",
|
||||
"page_failed": "A bejelentkezés nem sikerült. Térjen vissza a Bulwarkhoz, és próbálja újra.",
|
||||
"page_link_used": "Ez a hivatkozás csak egyszer működik. Térjen vissza a Bulwarkhoz, és kezdje újra.",
|
||||
"page_title": "Bejelentkezés ide: {server}",
|
||||
"page_intro": "Ez az oldal a számítógépen lévő Bulwark alkalmazástól származik. A jelszava a(z) {server} szerverre kerül, és sehova máshova.",
|
||||
"page_username": "E-mail-cím vagy felhasználónév",
|
||||
"page_password": "Jelszó",
|
||||
"page_code": "Kétfaktoros kód",
|
||||
"page_submit": "Bejelentkezés",
|
||||
"page_wrong_password": "A szerver nem fogadta el ezt a felhasználónevet és jelszót.",
|
||||
"page_code_needed": "Ehhez a fiókhoz kétfaktoros kód is kell. Adja meg újra a jelszavát és a kódot.",
|
||||
"page_no_answer": "A Bulwark nem tudott bejelentkezni. Ellenőrizze, hogy a szerver elérhető-e, és próbálja újra."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Frissítések",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Troppi tentativi. Riprova tra {count, plural, one {# minuto} other {# minuti}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Accedi con il browser",
|
||||
"browser_waiting": "Completa l'accesso nel browser",
|
||||
"browser_unavailable": "Questo server non offre l'accesso tramite browser. Usa la password.",
|
||||
"browser_failed": "L'accesso tramite browser non è riuscito. Riprova.",
|
||||
"server_needed": "Inserisci prima l'indirizzo del server.",
|
||||
"server_declined": "Non hai autorizzato questo server, quindi non gli è stato inviato nulla.",
|
||||
"server_invalid": "Questo indirizzo del server non è valido."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Accedi con il browser…",
|
||||
"waiting": "In attesa del browser…",
|
||||
"waiting_hint": "Completa l’accesso lì. Il tuo gestore di password funziona nel browser.",
|
||||
"cancel": "Annulla",
|
||||
"or_here": "oppure accedi qui",
|
||||
"timed_out": "L’accesso nel browser ha richiesto troppo tempo. Riprova.",
|
||||
"no_browser": "Bulwark non è riuscito ad aprire il browser. Riprova o accedi qui.",
|
||||
"failed": "L’accesso tramite il browser non è riuscito. Riprova.",
|
||||
"handoff_banner": "Stai accedendo all’app Bulwark su questo computer. Questo browser resta disconnesso da Bulwark.",
|
||||
"consent_title": "Accedere all’app Bulwark?",
|
||||
"consent_description": "Il tuo accesso per {username} va all’app Bulwark su questo computer. Continua solo se lo hai avviato dall’app.",
|
||||
"consent_confirm": "Accedi all’app",
|
||||
"consent_cancel": "Non ora",
|
||||
"page_done": "Puoi chiudere questa scheda e tornare a Bulwark.",
|
||||
"page_failed": "L’accesso non è riuscito. Torna a Bulwark e riprova.",
|
||||
"page_link_used": "Questo link funziona una sola volta. Torna a Bulwark e ricomincia.",
|
||||
"page_title": "Accedi a {server}",
|
||||
"page_intro": "Questa pagina viene dall’app Bulwark su questo computer. La tua password va a {server} e da nessun’altra parte.",
|
||||
"page_username": "Indirizzo e-mail o nome utente",
|
||||
"page_password": "Password",
|
||||
"page_code": "Codice a due fattori",
|
||||
"page_submit": "Accedi",
|
||||
"page_wrong_password": "Il server non ha accettato questo nome utente e questa password.",
|
||||
"page_code_needed": "Questo account richiede anche un codice a due fattori. Inserisci di nuovo la password e il codice.",
|
||||
"page_no_answer": "Bulwark non è riuscito ad accedere. Verifica che il server sia raggiungibile e riprova."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Aggiornamenti",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "試行回数が多すぎます。{count, plural, other {# 分}}後にもう一度お試しください。"
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "ブラウザでサインイン",
|
||||
"browser_waiting": "ブラウザでサインインを完了してください",
|
||||
"browser_unavailable": "このサーバーはブラウザでのサインインに対応していません。パスワードを使用してください。",
|
||||
"browser_failed": "ブラウザでのサインインに失敗しました。もう一度お試しください。",
|
||||
"server_needed": "先にサーバーのアドレスを入力してください。",
|
||||
"server_declined": "このサーバーを許可しなかったため、何も送信していません。",
|
||||
"server_invalid": "このサーバーアドレスは正しくありません。"
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "ブラウザーでサインイン…",
|
||||
"waiting": "ブラウザーを待っています…",
|
||||
"waiting_hint": "ブラウザーでサインインを完了してください。パスワードマネージャーはブラウザーで使えます。",
|
||||
"cancel": "キャンセル",
|
||||
"or_here": "またはここでサインイン",
|
||||
"timed_out": "ブラウザーでのサインインに時間がかかりすぎました。もう一度お試しください。",
|
||||
"no_browser": "Bulwark はブラウザーを開けませんでした。もう一度試すか、ここでサインインしてください。",
|
||||
"failed": "ブラウザー経由でサインインできませんでした。もう一度お試しください。",
|
||||
"handoff_banner": "このコンピューターの Bulwark アプリにサインインしています。このブラウザーは Bulwark にサインインしません。",
|
||||
"consent_title": "Bulwark アプリにサインインしますか?",
|
||||
"consent_description": "{username} のサインインは、このコンピューターの Bulwark アプリに渡されます。アプリから始めた場合のみ続行してください。",
|
||||
"consent_confirm": "アプリにサインイン",
|
||||
"consent_cancel": "今はしない",
|
||||
"page_done": "このタブを閉じて Bulwark に戻れます。",
|
||||
"page_failed": "サインインできませんでした。Bulwark に戻ってもう一度お試しください。",
|
||||
"page_link_used": "このリンクは 1 回しか使えません。Bulwark に戻ってやり直してください。",
|
||||
"page_title": "{server} にサインイン",
|
||||
"page_intro": "このページは、このコンピューターの Bulwark アプリが表示しています。パスワードは {server} にだけ送られます。",
|
||||
"page_username": "メールアドレスまたはユーザー名",
|
||||
"page_password": "パスワード",
|
||||
"page_code": "2 要素認証コード",
|
||||
"page_submit": "サインイン",
|
||||
"page_wrong_password": "サーバーはこのユーザー名とパスワードを受け付けませんでした。",
|
||||
"page_code_needed": "このアカウントには 2 要素認証コードも必要です。パスワードをもう一度入力し、コードも入力してください。",
|
||||
"page_no_answer": "Bulwark はサインインできませんでした。サーバーに接続できるか確認して、もう一度お試しください。"
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "アップデート",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "시도 횟수가 너무 많습니다. {count, plural, other {#분}} 후에 다시 시도하세요."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "브라우저로 로그인",
|
||||
"browser_waiting": "브라우저에서 로그인을 마치세요",
|
||||
"browser_unavailable": "이 서버는 브라우저 로그인을 지원하지 않습니다. 비밀번호를 사용하세요.",
|
||||
"browser_failed": "브라우저 로그인에 실패했습니다. 다시 시도하세요.",
|
||||
"server_needed": "먼저 서버 주소를 입력하세요.",
|
||||
"server_declined": "이 서버를 허용하지 않아 아무것도 보내지 않았습니다.",
|
||||
"server_invalid": "이 서버 주소는 올바르지 않습니다."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "브라우저로 로그인…",
|
||||
"waiting": "브라우저를 기다리는 중…",
|
||||
"waiting_hint": "브라우저에서 로그인을 마치세요. 비밀번호 관리자는 브라우저에서 사용할 수 있습니다.",
|
||||
"cancel": "취소",
|
||||
"or_here": "또는 여기에서 로그인",
|
||||
"timed_out": "브라우저 로그인이 너무 오래 걸렸습니다. 다시 시도하세요.",
|
||||
"no_browser": "Bulwark에서 브라우저를 열 수 없습니다. 다시 시도하거나 여기에서 로그인하세요.",
|
||||
"failed": "브라우저를 통한 로그인에 실패했습니다. 다시 시도하세요.",
|
||||
"handoff_banner": "이 컴퓨터의 Bulwark 앱에 로그인하고 있습니다. 이 브라우저는 Bulwark에 로그인되지 않습니다.",
|
||||
"consent_title": "Bulwark 앱에 로그인할까요?",
|
||||
"consent_description": "{username}의 로그인 정보가 이 컴퓨터의 Bulwark 앱으로 전달됩니다. 앱에서 시작한 경우에만 계속하세요.",
|
||||
"consent_confirm": "앱에 로그인",
|
||||
"consent_cancel": "나중에",
|
||||
"page_done": "이 탭을 닫고 Bulwark로 돌아가도 됩니다.",
|
||||
"page_failed": "로그인에 실패했습니다. Bulwark로 돌아가서 다시 시도하세요.",
|
||||
"page_link_used": "이 링크는 한 번만 작동합니다. Bulwark로 돌아가서 다시 시작하세요.",
|
||||
"page_title": "{server}에 로그인",
|
||||
"page_intro": "이 페이지는 이 컴퓨터의 Bulwark 앱에서 제공합니다. 비밀번호는 {server}로만 전송됩니다.",
|
||||
"page_username": "이메일 주소 또는 사용자 이름",
|
||||
"page_password": "비밀번호",
|
||||
"page_code": "2단계 인증 코드",
|
||||
"page_submit": "로그인",
|
||||
"page_wrong_password": "서버가 이 사용자 이름과 비밀번호를 받아들이지 않았습니다.",
|
||||
"page_code_needed": "이 계정에는 2단계 인증 코드도 필요합니다. 비밀번호와 코드를 다시 입력하세요.",
|
||||
"page_no_answer": "Bulwark에서 로그인할 수 없습니다. 서버에 연결할 수 있는지 확인하고 다시 시도하세요."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "업데이트",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Pārāk daudz mēģinājumu. Mēģiniet vēlreiz pēc {count, plural, zero {# minūtēm} one {# minūtes} other {# minūtēm}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Pierakstīties ar pārlūku",
|
||||
"browser_waiting": "Pabeidziet pierakstīšanos pārlūkā",
|
||||
"browser_unavailable": "Šis serveris nepiedāvā pierakstīšanos ar pārlūku. Izmantojiet paroli.",
|
||||
"browser_failed": "Pierakstīšanās ar pārlūku neizdevās. Mēģiniet vēlreiz.",
|
||||
"server_needed": "Vispirms ievadiet servera adresi.",
|
||||
"server_declined": "Jūs neatļāvāt šo serveri, tāpēc tam nekas netika nosūtīts.",
|
||||
"server_invalid": "Šī servera adrese nav derīga."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Pieteikties ar pārlūku…",
|
||||
"waiting": "Gaida pārlūku…",
|
||||
"waiting_hint": "Pabeidziet pieteikšanos tur. Jūsu paroļu pārvaldnieks darbojas pārlūkā.",
|
||||
"cancel": "Atcelt",
|
||||
"or_here": "vai piesakieties šeit",
|
||||
"timed_out": "Pieteikšanās pārlūkā aizņēma pārāk ilgu laiku. Mēģiniet vēlreiz.",
|
||||
"no_browser": "Bulwark nevarēja atvērt pārlūku. Mēģiniet vēlreiz vai piesakieties šeit.",
|
||||
"failed": "Pieteikšanās caur pārlūku neizdevās. Mēģiniet vēlreiz.",
|
||||
"handoff_banner": "Jūs piesakāties Bulwark lietotnē šajā datorā. Šis pārlūks paliek izrakstīts no Bulwark.",
|
||||
"consent_title": "Pieteikties Bulwark lietotnē?",
|
||||
"consent_description": "Jūsu pieteikšanās kontam {username} tiek nodota Bulwark lietotnei šajā datorā. Turpiniet tikai tad, ja to sākāt no lietotnes.",
|
||||
"consent_confirm": "Pieteikties lietotnē",
|
||||
"consent_cancel": "Ne tagad",
|
||||
"page_done": "Varat aizvērt šo cilni un atgriezties Bulwark.",
|
||||
"page_failed": "Pieteikšanās neizdevās. Atgriezieties Bulwark un mēģiniet vēlreiz.",
|
||||
"page_link_used": "Šī saite darbojas tikai vienreiz. Atgriezieties Bulwark un sāciet no jauna.",
|
||||
"page_title": "Pieteikties serverī {server}",
|
||||
"page_intro": "Šī lapa nāk no Bulwark lietotnes šajā datorā. Jūsu parole nonāk serverī {server} un nekur citur.",
|
||||
"page_username": "E-pasta adrese vai lietotājvārds",
|
||||
"page_password": "Parole",
|
||||
"page_code": "Divu faktoru kods",
|
||||
"page_submit": "Pieteikties",
|
||||
"page_wrong_password": "Serveris nepieņēma šo lietotājvārdu un paroli.",
|
||||
"page_code_needed": "Šim kontam vajag arī divu faktoru kodu. Ievadiet paroli vēlreiz un kodu.",
|
||||
"page_no_answer": "Bulwark nevarēja pieteikties. Pārbaudiet, vai serveris ir sasniedzams, un mēģiniet vēlreiz."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Atjauninājumi",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Хэт олон оролдлого. {count, plural, one {# минутын} other {# минутын}} дараа дахин оролдоно уу."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Хөтчөөр нэвтрэх",
|
||||
"browser_waiting": "Нэвтрэлтээ хөтөч дээр дуусгана уу",
|
||||
"browser_unavailable": "Энэ сервер хөтчөөр нэвтрэх боломжгүй. Нууц үгээ ашиглана уу.",
|
||||
"browser_failed": "Хөтчөөр нэвтэрч чадсангүй. Дахин оролдоно уу.",
|
||||
"server_needed": "Эхлээд серверийн хаягаа оруулна уу.",
|
||||
"server_declined": "Та энэ серверийг зөвшөөрөөгүй тул юу ч илгээгээгүй.",
|
||||
"server_invalid": "Энэ серверийн хаяг буруу байна."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Хөтчөөрөө нэвтрэх…",
|
||||
"waiting": "Хөтчийг хүлээж байна…",
|
||||
"waiting_hint": "Тэнд нэвтрэлтээ дуусгана уу. Таны нууц үгийн менежер хөтөч дээр ажиллана.",
|
||||
"cancel": "Цуцлах",
|
||||
"or_here": "эсвэл энд нэвтэрнэ үү",
|
||||
"timed_out": "Хөтчөөр нэвтрэх хэт удаан үргэлжилсэн. Дахин оролдоно уу.",
|
||||
"no_browser": "Bulwark хөтчийг нээж чадсангүй. Дахин оролдох эсвэл энд нэвтэрнэ үү.",
|
||||
"failed": "Хөтчөөр нэвтэрч чадсангүй. Дахин оролдоно уу.",
|
||||
"handoff_banner": "Та энэ компьютер дээрх Bulwark апп руу нэвтэрч байна. Энэ хөтөч Bulwark-д нэвтрэхгүй хэвээр үлдэнэ.",
|
||||
"consent_title": "Bulwark апп руу нэвтрэх үү?",
|
||||
"consent_description": "{username}-ийн нэвтрэлт энэ компьютер дээрх Bulwark апп руу очно. Зөвхөн аппаас эхлүүлсэн бол үргэлжлүүлнэ үү.",
|
||||
"consent_confirm": "Апп руу нэвтрэх",
|
||||
"consent_cancel": "Одоо биш",
|
||||
"page_done": "Энэ табыг хааж Bulwark руу буцаж болно.",
|
||||
"page_failed": "Нэвтэрч чадсангүй. Bulwark руу буцаж дахин оролдоно уу.",
|
||||
"page_link_used": "Энэ холбоос зөвхөн нэг удаа ажиллана. Bulwark руу буцаж дахин эхэлнэ үү.",
|
||||
"page_title": "{server} руу нэвтрэх",
|
||||
"page_intro": "Энэ хуудас энэ компьютер дээрх Bulwark апп-аас ирсэн. Таны нууц үг зөвхөн {server} руу очно.",
|
||||
"page_username": "Имэйл хаяг эсвэл хэрэглэгчийн нэр",
|
||||
"page_password": "Нууц үг",
|
||||
"page_code": "Хоёр шатлалт код",
|
||||
"page_submit": "Нэвтрэх",
|
||||
"page_wrong_password": "Сервер энэ хэрэглэгчийн нэр, нууц үгийг хүлээн авсангүй.",
|
||||
"page_code_needed": "Энэ бүртгэлд хоёр шатлалт код бас хэрэгтэй. Нууц үг болон кодоо дахин оруулна уу.",
|
||||
"page_no_answer": "Bulwark нэвтэрч чадсангүй. Сервер холбогдох боломжтой эсэхийг шалгаад дахин оролдоно уу."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Шинэчлэлт",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "For mange forsøk. Prøv igjen om {count, plural, one {# minutt} other {# minutter}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Logg på med nettleseren",
|
||||
"browser_waiting": "Fullfør påloggingen i nettleseren",
|
||||
"browser_unavailable": "Denne serveren tilbyr ikke pålogging via nettleser. Bruk passordet ditt.",
|
||||
"browser_failed": "Pålogging via nettleseren mislyktes. Prøv igjen.",
|
||||
"server_needed": "Skriv inn serveradressen først.",
|
||||
"server_declined": "Du tillot ikke denne serveren, så ingenting ble sendt til den.",
|
||||
"server_invalid": "Denne serveradressen er ikke gyldig."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Logg inn med nettleseren…",
|
||||
"waiting": "Venter på nettleseren…",
|
||||
"waiting_hint": "Fullfør innloggingen der. Passordbehandleren din virker i nettleseren.",
|
||||
"cancel": "Avbryt",
|
||||
"or_here": "eller logg inn her",
|
||||
"timed_out": "Innloggingen i nettleseren tok for lang tid. Prøv igjen.",
|
||||
"no_browser": "Bulwark kunne ikke åpne nettleseren. Prøv igjen, eller logg inn her.",
|
||||
"failed": "Innlogging via nettleseren virket ikke. Prøv igjen.",
|
||||
"handoff_banner": "Du logger inn i Bulwark-appen på denne datamaskinen. Denne nettleseren forblir logget ut av Bulwark.",
|
||||
"consent_title": "Logge inn i Bulwark-appen?",
|
||||
"consent_description": "Innloggingen din for {username} går til Bulwark-appen på denne datamaskinen. Fortsett bare hvis du startet dette fra appen.",
|
||||
"consent_confirm": "Logg inn i appen",
|
||||
"consent_cancel": "Ikke nå",
|
||||
"page_done": "Du kan lukke denne fanen og gå tilbake til Bulwark.",
|
||||
"page_failed": "Innloggingen virket ikke. Gå tilbake til Bulwark og prøv igjen.",
|
||||
"page_link_used": "Denne lenken virker bare én gang. Gå tilbake til Bulwark og start på nytt.",
|
||||
"page_title": "Logg inn på {server}",
|
||||
"page_intro": "Denne siden kommer fra Bulwark-appen på denne datamaskinen. Passordet ditt går til {server} og ingen andre steder.",
|
||||
"page_username": "E-postadresse eller brukernavn",
|
||||
"page_password": "Passord",
|
||||
"page_code": "Tofaktorkode",
|
||||
"page_submit": "Logg inn",
|
||||
"page_wrong_password": "Serveren godtok ikke dette brukernavnet og passordet.",
|
||||
"page_code_needed": "Denne kontoen trenger også en tofaktorkode. Skriv inn passordet på nytt og koden.",
|
||||
"page_no_answer": "Bulwark kunne ikke logge inn. Sjekk at serveren kan nås, og prøv igjen."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Oppdateringer",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Te veel pogingen. Probeer het over {count, plural, one {# minuut} other {# minuten}} opnieuw."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Inloggen met je browser",
|
||||
"browser_waiting": "Rond het inloggen af in je browser",
|
||||
"browser_unavailable": "Deze server biedt geen inloggen via een browser. Gebruik je wachtwoord.",
|
||||
"browser_failed": "Inloggen via de browser is niet gelukt. Probeer het opnieuw.",
|
||||
"server_needed": "Vul eerst het adres van de server in.",
|
||||
"server_declined": "Je hebt deze server niet toegestaan, dus er is niets naartoe gestuurd.",
|
||||
"server_invalid": "Dit serveradres is niet geldig."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Inloggen met je browser…",
|
||||
"waiting": "Wachten op je browser…",
|
||||
"waiting_hint": "Rond het inloggen daar af. Je wachtwoordbeheerder werkt in je browser.",
|
||||
"cancel": "Annuleren",
|
||||
"or_here": "of log hier in",
|
||||
"timed_out": "Inloggen in de browser duurde te lang. Probeer het opnieuw.",
|
||||
"no_browser": "Bulwark kon je browser niet openen. Probeer het opnieuw of log hier in.",
|
||||
"failed": "Inloggen via je browser is niet gelukt. Probeer het opnieuw.",
|
||||
"handoff_banner": "Je logt in bij de Bulwark-app op deze computer. Deze browser blijft uitgelogd bij Bulwark.",
|
||||
"consent_title": "Inloggen bij de Bulwark-app?",
|
||||
"consent_description": "Je aanmelding voor {username} gaat naar de Bulwark-app op deze computer. Ga alleen verder als je dit vanuit de app hebt gestart.",
|
||||
"consent_confirm": "Inloggen bij de app",
|
||||
"consent_cancel": "Niet nu",
|
||||
"page_done": "Je kunt dit tabblad sluiten en teruggaan naar Bulwark.",
|
||||
"page_failed": "Inloggen is niet gelukt. Ga terug naar Bulwark en probeer het opnieuw.",
|
||||
"page_link_used": "Deze link werkt maar één keer. Ga terug naar Bulwark en begin opnieuw.",
|
||||
"page_title": "Inloggen bij {server}",
|
||||
"page_intro": "Deze pagina komt van de Bulwark-app op deze computer. Je wachtwoord gaat naar {server} en nergens anders heen.",
|
||||
"page_username": "E-mailadres of gebruikersnaam",
|
||||
"page_password": "Wachtwoord",
|
||||
"page_code": "Tweefactorcode",
|
||||
"page_submit": "Inloggen",
|
||||
"page_wrong_password": "De server heeft deze gebruikersnaam en dit wachtwoord niet geaccepteerd.",
|
||||
"page_code_needed": "Dit account heeft ook een tweefactorcode nodig. Voer je wachtwoord opnieuw in en de code.",
|
||||
"page_no_answer": "Bulwark kon niet inloggen. Controleer of de server bereikbaar is en probeer het opnieuw."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Updates",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Zbyt wiele prób. Spróbuj za {count, plural, one {# minutę} few {# minuty} many {# minut} other {# minuty}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Zaloguj się w przeglądarce",
|
||||
"browser_waiting": "Dokończ logowanie w przeglądarce",
|
||||
"browser_unavailable": "Ten serwer nie oferuje logowania przez przeglądarkę. Użyj hasła.",
|
||||
"browser_failed": "Logowanie przez przeglądarkę nie powiodło się. Spróbuj ponownie.",
|
||||
"server_needed": "Najpierw wpisz adres serwera.",
|
||||
"server_declined": "Ten serwer nie został dozwolony, więc nic do niego nie wysłano.",
|
||||
"server_invalid": "Ten adres serwera jest nieprawidłowy."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Zaloguj się w przeglądarce…",
|
||||
"waiting": "Czekanie na przeglądarkę…",
|
||||
"waiting_hint": "Dokończ logowanie w przeglądarce. Działa tam Twój menedżer haseł.",
|
||||
"cancel": "Anuluj",
|
||||
"or_here": "lub zaloguj się tutaj",
|
||||
"timed_out": "Logowanie w przeglądarce trwało zbyt długo. Spróbuj ponownie.",
|
||||
"no_browser": "Bulwark nie może otworzyć przeglądarki. Spróbuj ponownie lub zaloguj się tutaj.",
|
||||
"failed": "Logowanie przez przeglądarkę nie powiodło się. Spróbuj ponownie.",
|
||||
"handoff_banner": "Logujesz się w aplikacji Bulwark na tym komputerze. Ta przeglądarka pozostaje wylogowana z Bulwark.",
|
||||
"consent_title": "Zalogować się w aplikacji Bulwark?",
|
||||
"consent_description": "Twoje logowanie dla {username} trafi do aplikacji Bulwark na tym komputerze. Kontynuuj tylko wtedy, gdy rozpoczęto je w aplikacji.",
|
||||
"consent_confirm": "Zaloguj się w aplikacji",
|
||||
"consent_cancel": "Nie teraz",
|
||||
"page_done": "Możesz zamknąć tę kartę i wrócić do Bulwark.",
|
||||
"page_failed": "Logowanie nie powiodło się. Wróć do Bulwark i spróbuj ponownie.",
|
||||
"page_link_used": "Ten link działa tylko raz. Wróć do Bulwark i zacznij od nowa.",
|
||||
"page_title": "Zaloguj się na {server}",
|
||||
"page_intro": "Ta strona pochodzi z aplikacji Bulwark na tym komputerze. Twoje hasło trafia na {server} i nigdzie indziej.",
|
||||
"page_username": "Adres e-mail lub nazwa użytkownika",
|
||||
"page_password": "Hasło",
|
||||
"page_code": "Kod dwuskładnikowy",
|
||||
"page_submit": "Zaloguj się",
|
||||
"page_wrong_password": "Serwer nie przyjął tej nazwy użytkownika i hasła.",
|
||||
"page_code_needed": "To konto wymaga też kodu dwuskładnikowego. Wpisz ponownie hasło i kod.",
|
||||
"page_no_answer": "Bulwark nie może się zalogować. Sprawdź, czy serwer jest dostępny, i spróbuj ponownie."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Aktualizacje",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Demasiadas tentativas. Tente novamente daqui a {count, plural, one {# minuto} other {# minutos}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Entrar com o navegador",
|
||||
"browser_waiting": "Termine de entrar no navegador",
|
||||
"browser_unavailable": "Este servidor não oferece entrada pelo navegador. Use sua senha.",
|
||||
"browser_failed": "Não foi possível entrar pelo navegador. Tente novamente.",
|
||||
"server_needed": "Digite primeiro o endereço do servidor.",
|
||||
"server_declined": "Você não permitiu este servidor, então nada foi enviado a ele.",
|
||||
"server_invalid": "Este endereço de servidor não é válido."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Entrar com o navegador…",
|
||||
"waiting": "A aguardar o navegador…",
|
||||
"waiting_hint": "Termine de entrar por lá. O seu gestor de palavras-passe funciona no navegador.",
|
||||
"cancel": "Cancelar",
|
||||
"or_here": "ou entre aqui",
|
||||
"timed_out": "A entrada no navegador demorou demasiado. Tente novamente.",
|
||||
"no_browser": "O Bulwark não conseguiu abrir o navegador. Tente novamente ou entre aqui.",
|
||||
"failed": "Não foi possível entrar através do navegador. Tente novamente.",
|
||||
"handoff_banner": "Está a entrar na aplicação Bulwark neste computador. Este navegador continua sem sessão no Bulwark.",
|
||||
"consent_title": "Entrar na aplicação Bulwark?",
|
||||
"consent_description": "A sua sessão de {username} vai para a aplicação Bulwark neste computador. Continue só se tiver iniciado isto na aplicação.",
|
||||
"consent_confirm": "Entrar na aplicação",
|
||||
"consent_cancel": "Agora não",
|
||||
"page_done": "Pode fechar este separador e voltar ao Bulwark.",
|
||||
"page_failed": "Não foi possível entrar. Volte ao Bulwark e tente novamente.",
|
||||
"page_link_used": "Esta ligação só funciona uma vez. Volte ao Bulwark e comece de novo.",
|
||||
"page_title": "Entrar em {server}",
|
||||
"page_intro": "Esta página vem da aplicação Bulwark neste computador. A sua palavra-passe vai para {server} e para mais lado nenhum.",
|
||||
"page_username": "Endereço de e-mail ou nome de utilizador",
|
||||
"page_password": "Palavra-passe",
|
||||
"page_code": "Código de dois fatores",
|
||||
"page_submit": "Entrar",
|
||||
"page_wrong_password": "O servidor não aceitou este nome de utilizador e esta palavra-passe.",
|
||||
"page_code_needed": "Esta conta também precisa de um código de dois fatores. Introduza novamente a palavra-passe e o código.",
|
||||
"page_no_answer": "O Bulwark não conseguiu entrar. Verifique se o servidor está acessível e tente novamente."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Atualizações",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Prea multe încercări. Încercați din nou peste {count, plural, one {# minut} few {# minute} other {# de minute}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Conectează-te cu browserul",
|
||||
"browser_waiting": "Finalizează conectarea în browser",
|
||||
"browser_unavailable": "Acest server nu oferă conectare prin browser. Folosește parola.",
|
||||
"browser_failed": "Conectarea prin browser nu a reușit. Încearcă din nou.",
|
||||
"server_needed": "Introdu mai întâi adresa serverului.",
|
||||
"server_declined": "Nu ai permis acest server, așa că nu i s-a trimis nimic.",
|
||||
"server_invalid": "Această adresă de server nu este validă."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Conectați-vă cu browserul…",
|
||||
"waiting": "Se așteaptă browserul…",
|
||||
"waiting_hint": "Terminați conectarea acolo. Managerul de parole funcționează în browser.",
|
||||
"cancel": "Anulați",
|
||||
"or_here": "sau conectați-vă aici",
|
||||
"timed_out": "Conectarea în browser a durat prea mult. Încercați din nou.",
|
||||
"no_browser": "Bulwark nu a putut deschide browserul. Încercați din nou sau conectați-vă aici.",
|
||||
"failed": "Conectarea prin browser nu a reușit. Încercați din nou.",
|
||||
"handoff_banner": "Vă conectați la aplicația Bulwark de pe acest computer. Acest browser rămâne deconectat de la Bulwark.",
|
||||
"consent_title": "Vă conectați la aplicația Bulwark?",
|
||||
"consent_description": "Conectarea pentru {username} merge la aplicația Bulwark de pe acest computer. Continuați doar dacă ați pornit acest lucru din aplicație.",
|
||||
"consent_confirm": "Conectați-vă la aplicație",
|
||||
"consent_cancel": "Nu acum",
|
||||
"page_done": "Puteți închide această filă și reveni la Bulwark.",
|
||||
"page_failed": "Conectarea nu a reușit. Reveniți la Bulwark și încercați din nou.",
|
||||
"page_link_used": "Acest link funcționează o singură dată. Reveniți la Bulwark și începeți din nou.",
|
||||
"page_title": "Conectați-vă la {server}",
|
||||
"page_intro": "Această pagină vine de la aplicația Bulwark de pe acest computer. Parola merge la {server} și nicăieri altundeva.",
|
||||
"page_username": "Adresă de e-mail sau nume de utilizator",
|
||||
"page_password": "Parolă",
|
||||
"page_code": "Cod cu doi factori",
|
||||
"page_submit": "Conectați-vă",
|
||||
"page_wrong_password": "Serverul nu a acceptat acest nume de utilizator și această parolă.",
|
||||
"page_code_needed": "Acest cont are nevoie și de un cod cu doi factori. Introduceți din nou parola și codul.",
|
||||
"page_no_answer": "Bulwark nu s-a putut conecta. Verificați dacă serverul este accesibil și încercați din nou."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Actualizări",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Слишком много попыток. Повторите через {count, plural, one {# минуту} few {# минуты} many {# минут} other {# минуты}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Войти через браузер",
|
||||
"browser_waiting": "Завершите вход в браузере",
|
||||
"browser_unavailable": "Этот сервер не поддерживает вход через браузер. Используйте пароль.",
|
||||
"browser_failed": "Не удалось войти через браузер. Попробуйте ещё раз.",
|
||||
"server_needed": "Сначала введите адрес сервера.",
|
||||
"server_declined": "Вы не разрешили этот сервер, поэтому ему ничего не отправлено.",
|
||||
"server_invalid": "Этот адрес сервера недействителен."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Войти через браузер…",
|
||||
"waiting": "Ожидание браузера…",
|
||||
"waiting_hint": "Завершите вход там. Ваш менеджер паролей работает в браузере.",
|
||||
"cancel": "Отмена",
|
||||
"or_here": "или войдите здесь",
|
||||
"timed_out": "Вход через браузер занял слишком много времени. Попробуйте ещё раз.",
|
||||
"no_browser": "Bulwark не смог открыть браузер. Попробуйте ещё раз или войдите здесь.",
|
||||
"failed": "Не удалось войти через браузер. Попробуйте ещё раз.",
|
||||
"handoff_banner": "Вы входите в приложение Bulwark на этом компьютере. В этом браузере вход в Bulwark не выполняется.",
|
||||
"consent_title": "Войти в приложение Bulwark?",
|
||||
"consent_description": "Ваш вход для {username} будет передан приложению Bulwark на этом компьютере. Продолжайте, только если начали это из приложения.",
|
||||
"consent_confirm": "Войти в приложение",
|
||||
"consent_cancel": "Не сейчас",
|
||||
"page_done": "Можно закрыть эту вкладку и вернуться в Bulwark.",
|
||||
"page_failed": "Не удалось войти. Вернитесь в Bulwark и попробуйте ещё раз.",
|
||||
"page_link_used": "Эта ссылка работает только один раз. Вернитесь в Bulwark и начните заново.",
|
||||
"page_title": "Вход на {server}",
|
||||
"page_intro": "Эта страница открыта приложением Bulwark на этом компьютере. Ваш пароль уходит на {server} и больше никуда.",
|
||||
"page_username": "Адрес эл. почты или имя пользователя",
|
||||
"page_password": "Пароль",
|
||||
"page_code": "Двухфакторный код",
|
||||
"page_submit": "Войти",
|
||||
"page_wrong_password": "Сервер не принял это имя пользователя и пароль.",
|
||||
"page_code_needed": "Для этой учётной записи также нужен двухфакторный код. Введите пароль ещё раз и код.",
|
||||
"page_no_answer": "Bulwark не смог войти. Проверьте, доступен ли сервер, и попробуйте ещё раз."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Обновления",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Príliš veľa pokusov. Skúste to o {count, plural, one {# minútu} few {# minúty} many {# minúty} other {# minút}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Prihlásiť sa v prehliadači",
|
||||
"browser_waiting": "Dokončite prihlásenie v prehliadači",
|
||||
"browser_unavailable": "Tento server neponúka prihlásenie cez prehliadač. Použite heslo.",
|
||||
"browser_failed": "Prihlásenie cez prehliadač sa nepodarilo. Skúste to znova.",
|
||||
"server_needed": "Najprv zadajte adresu servera.",
|
||||
"server_declined": "Tento server ste nepovolili, preto sa naň nič neodoslalo.",
|
||||
"server_invalid": "Táto adresa servera nie je platná."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Prihlásiť sa v prehliadači…",
|
||||
"waiting": "Čaká sa na prehliadač…",
|
||||
"waiting_hint": "Dokončite prihlásenie tam. Váš správca hesiel funguje v prehliadači.",
|
||||
"cancel": "Zrušiť",
|
||||
"or_here": "alebo sa prihláste tu",
|
||||
"timed_out": "Prihlásenie v prehliadači trvalo príliš dlho. Skúste to znova.",
|
||||
"no_browser": "Bulwark nemohol otvoriť prehliadač. Skúste to znova alebo sa prihláste tu.",
|
||||
"failed": "Prihlásenie cez prehliadač sa nepodarilo. Skúste to znova.",
|
||||
"handoff_banner": "Prihlasujete sa do aplikácie Bulwark v tomto počítači. Tento prehliadač zostane z Bulwarku odhlásený.",
|
||||
"consent_title": "Prihlásiť sa do aplikácie Bulwark?",
|
||||
"consent_description": "Vaše prihlásenie pre {username} pôjde do aplikácie Bulwark v tomto počítači. Pokračujte, len ak ste to spustili z aplikácie.",
|
||||
"consent_confirm": "Prihlásiť sa do aplikácie",
|
||||
"consent_cancel": "Teraz nie",
|
||||
"page_done": "Túto kartu môžete zavrieť a vrátiť sa do Bulwarku.",
|
||||
"page_failed": "Prihlásenie sa nepodarilo. Vráťte sa do Bulwarku a skúste to znova.",
|
||||
"page_link_used": "Tento odkaz funguje len raz. Vráťte sa do Bulwarku a začnite znova.",
|
||||
"page_title": "Prihlásiť sa na {server}",
|
||||
"page_intro": "Táto stránka pochádza z aplikácie Bulwark v tomto počítači. Vaše heslo ide na {server} a nikam inam.",
|
||||
"page_username": "E-mailová adresa alebo používateľské meno",
|
||||
"page_password": "Heslo",
|
||||
"page_code": "Dvojfaktorový kód",
|
||||
"page_submit": "Prihlásiť sa",
|
||||
"page_wrong_password": "Server toto používateľské meno a heslo neprijal.",
|
||||
"page_code_needed": "Tento účet potrebuje aj dvojfaktorový kód. Zadajte znova heslo a kód.",
|
||||
"page_no_answer": "Bulwark sa nemohol prihlásiť. Skontrolujte, či je server dostupný, a skúste to znova."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Aktualizácie",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6881,14 +6881,37 @@
|
||||
"blocked_minutes": "ลองหลายครั้งเกินไป ลองอีกครั้งใน {count, plural, other {# นาที}}"
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "ลงชื่อเข้าใช้ด้วยเบราว์เซอร์",
|
||||
"browser_waiting": "ลงชื่อเข้าใช้ให้เสร็จในเบราว์เซอร์",
|
||||
"browser_unavailable": "เซิร์ฟเวอร์นี้ไม่รองรับการลงชื่อเข้าใช้ผ่านเบราว์เซอร์ โปรดใช้รหัสผ่าน",
|
||||
"browser_failed": "ลงชื่อเข้าใช้ผ่านเบราว์เซอร์ไม่สำเร็จ โปรดลองอีกครั้ง",
|
||||
"server_needed": "ป้อนที่อยู่เซิร์ฟเวอร์ก่อน",
|
||||
"server_declined": "คุณไม่ได้อนุญาตเซิร์ฟเวอร์นี้ จึงไม่มีการส่งข้อมูลใดไป",
|
||||
"server_invalid": "ที่อยู่เซิร์ฟเวอร์นี้ไม่ถูกต้อง"
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "ลงชื่อเข้าใช้ด้วยเบราว์เซอร์…",
|
||||
"waiting": "กำลังรอเบราว์เซอร์…",
|
||||
"waiting_hint": "ลงชื่อเข้าใช้ให้เสร็จในเบราว์เซอร์ ตัวจัดการรหัสผ่านของคุณใช้งานได้ที่นั่น",
|
||||
"cancel": "ยกเลิก",
|
||||
"or_here": "หรือลงชื่อเข้าใช้ที่นี่",
|
||||
"timed_out": "การลงชื่อเข้าใช้ในเบราว์เซอร์ใช้เวลานานเกินไป ลองอีกครั้ง",
|
||||
"no_browser": "Bulwark เปิดเบราว์เซอร์ไม่ได้ ลองอีกครั้งหรือลงชื่อเข้าใช้ที่นี่",
|
||||
"failed": "ลงชื่อเข้าใช้ผ่านเบราว์เซอร์ไม่สำเร็จ ลองอีกครั้ง",
|
||||
"handoff_banner": "คุณกำลังลงชื่อเข้าใช้แอป Bulwark บนคอมพิวเตอร์เครื่องนี้ เบราว์เซอร์นี้จะยังไม่ได้ลงชื่อเข้าใช้ Bulwark",
|
||||
"consent_title": "ลงชื่อเข้าใช้แอป Bulwark หรือไม่",
|
||||
"consent_description": "การลงชื่อเข้าใช้ของ {username} จะส่งไปยังแอป Bulwark บนคอมพิวเตอร์เครื่องนี้ ดำเนินการต่อเฉพาะเมื่อคุณเริ่มจากแอปเท่านั้น",
|
||||
"consent_confirm": "ลงชื่อเข้าใช้แอป",
|
||||
"consent_cancel": "ไม่ใช่ตอนนี้",
|
||||
"page_done": "คุณปิดแท็บนี้และกลับไปที่ Bulwark ได้",
|
||||
"page_failed": "ลงชื่อเข้าใช้ไม่สำเร็จ กลับไปที่ Bulwark แล้วลองอีกครั้ง",
|
||||
"page_link_used": "ลิงก์นี้ใช้ได้ครั้งเดียว กลับไปที่ Bulwark แล้วเริ่มใหม่",
|
||||
"page_title": "ลงชื่อเข้าใช้ {server}",
|
||||
"page_intro": "หน้านี้มาจากแอป Bulwark บนคอมพิวเตอร์เครื่องนี้ รหัสผ่านของคุณจะส่งไปที่ {server} เท่านั้น",
|
||||
"page_username": "ที่อยู่อีเมลหรือชื่อผู้ใช้",
|
||||
"page_password": "รหัสผ่าน",
|
||||
"page_code": "รหัสสองปัจจัย",
|
||||
"page_submit": "ลงชื่อเข้าใช้",
|
||||
"page_wrong_password": "เซิร์ฟเวอร์ไม่ยอมรับชื่อผู้ใช้และรหัสผ่านนี้",
|
||||
"page_code_needed": "บัญชีนี้ต้องใช้รหัสสองปัจจัยด้วย ป้อนรหัสผ่านอีกครั้งพร้อมรหัส",
|
||||
"page_no_answer": "Bulwark ลงชื่อเข้าใช้ไม่ได้ ตรวจสอบว่าเข้าถึงเซิร์ฟเวอร์ได้แล้วลองอีกครั้ง"
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "การอัปเดต",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Çok fazla deneme. {count, plural, one {# dakika} other {# dakika}} sonra yeniden deneyin."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Tarayıcıyla oturum aç",
|
||||
"browser_waiting": "Oturum açmayı tarayıcınızda tamamlayın",
|
||||
"browser_unavailable": "Bu sunucu tarayıcıyla oturum açmayı desteklemiyor. Parolanızı kullanın.",
|
||||
"browser_failed": "Tarayıcıyla oturum açılamadı. Yeniden deneyin.",
|
||||
"server_needed": "Önce sunucu adresini girin.",
|
||||
"server_declined": "Bu sunucuya izin vermediniz, bu yüzden ona hiçbir şey gönderilmedi.",
|
||||
"server_invalid": "Bu sunucu adresi geçerli değil."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Tarayıcınızla oturum açın…",
|
||||
"waiting": "Tarayıcınız bekleniyor…",
|
||||
"waiting_hint": "Oturum açmayı orada tamamlayın. Parola yöneticiniz tarayıcınızda çalışır.",
|
||||
"cancel": "İptal",
|
||||
"or_here": "veya burada oturum açın",
|
||||
"timed_out": "Tarayıcıda oturum açma çok uzun sürdü. Yeniden deneyin.",
|
||||
"no_browser": "Bulwark tarayıcınızı açamadı. Yeniden deneyin veya burada oturum açın.",
|
||||
"failed": "Tarayıcınız üzerinden oturum açılamadı. Yeniden deneyin.",
|
||||
"handoff_banner": "Bu bilgisayardaki Bulwark uygulamasında oturum açıyorsunuz. Bu tarayıcı Bulwark’ta oturum kapalı kalır.",
|
||||
"consent_title": "Bulwark uygulamasında oturum açılsın mı?",
|
||||
"consent_description": "{username} için oturum açma bilginiz bu bilgisayardaki Bulwark uygulamasına gider. Yalnızca bunu uygulamadan başlattıysanız devam edin.",
|
||||
"consent_confirm": "Uygulamada oturum aç",
|
||||
"consent_cancel": "Şimdi değil",
|
||||
"page_done": "Bu sekmeyi kapatıp Bulwark’a dönebilirsiniz.",
|
||||
"page_failed": "Oturum açılamadı. Bulwark’a dönün ve yeniden deneyin.",
|
||||
"page_link_used": "Bu bağlantı yalnızca bir kez çalışır. Bulwark’a dönün ve yeniden başlayın.",
|
||||
"page_title": "{server} için oturum açın",
|
||||
"page_intro": "Bu sayfa bu bilgisayardaki Bulwark uygulamasından geliyor. Parolanız {server} sunucusuna gider, başka hiçbir yere gitmez.",
|
||||
"page_username": "E-posta adresi veya kullanıcı adı",
|
||||
"page_password": "Parola",
|
||||
"page_code": "İki aşamalı kod",
|
||||
"page_submit": "Oturum aç",
|
||||
"page_wrong_password": "Sunucu bu kullanıcı adını ve parolayı kabul etmedi.",
|
||||
"page_code_needed": "Bu hesap ayrıca iki aşamalı kod istiyor. Parolanızı ve kodu yeniden girin.",
|
||||
"page_no_answer": "Bulwark oturum açamadı. Sunucunun erişilebilir olduğunu denetleyin ve yeniden deneyin."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Güncellemeler",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "Забагато спроб. Повторіть через {count, plural, one {# хвилину} few {# хвилини} many {# хвилин} other {# хвилини}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Увійти через браузер",
|
||||
"browser_waiting": "Завершіть вхід у браузері",
|
||||
"browser_unavailable": "Цей сервер не підтримує вхід через браузер. Використайте пароль.",
|
||||
"browser_failed": "Не вдалося увійти через браузер. Спробуйте ще раз.",
|
||||
"server_needed": "Спочатку введіть адресу сервера.",
|
||||
"server_declined": "Ви не дозволили цей сервер, тому йому нічого не надіслано.",
|
||||
"server_invalid": "Ця адреса сервера недійсна."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Увійти через браузер…",
|
||||
"waiting": "Очікування браузера…",
|
||||
"waiting_hint": "Завершіть вхід там. Ваш менеджер паролів працює в браузері.",
|
||||
"cancel": "Скасувати",
|
||||
"or_here": "або увійдіть тут",
|
||||
"timed_out": "Вхід через браузер тривав надто довго. Спробуйте ще раз.",
|
||||
"no_browser": "Bulwark не зміг відкрити браузер. Спробуйте ще раз або увійдіть тут.",
|
||||
"failed": "Не вдалося увійти через браузер. Спробуйте ще раз.",
|
||||
"handoff_banner": "Ви входите в застосунок Bulwark на цьому комп’ютері. У цьому браузері вхід у Bulwark не виконується.",
|
||||
"consent_title": "Увійти в застосунок Bulwark?",
|
||||
"consent_description": "Ваш вхід для {username} буде передано застосунку Bulwark на цьому комп’ютері. Продовжуйте, лише якщо почали це із застосунку.",
|
||||
"consent_confirm": "Увійти в застосунок",
|
||||
"consent_cancel": "Не зараз",
|
||||
"page_done": "Можна закрити цю вкладку й повернутися до Bulwark.",
|
||||
"page_failed": "Не вдалося увійти. Поверніться до Bulwark і спробуйте ще раз.",
|
||||
"page_link_used": "Це посилання працює лише один раз. Поверніться до Bulwark і почніть знову.",
|
||||
"page_title": "Вхід на {server}",
|
||||
"page_intro": "Цю сторінку відкрив застосунок Bulwark на цьому комп’ютері. Ваш пароль іде на {server} і більше нікуди.",
|
||||
"page_username": "Адреса ел. пошти або ім’я користувача",
|
||||
"page_password": "Пароль",
|
||||
"page_code": "Двофакторний код",
|
||||
"page_submit": "Увійти",
|
||||
"page_wrong_password": "Сервер не прийняв це ім’я користувача й пароль.",
|
||||
"page_code_needed": "Для цього облікового запису також потрібен двофакторний код. Введіть пароль ще раз і код.",
|
||||
"page_no_answer": "Bulwark не зміг увійти. Перевірте, чи доступний сервер, і спробуйте ще раз."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Оновлення",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6885,14 +6885,37 @@
|
||||
"blocked_minutes": "Quá nhiều lần thử. Hãy thử lại sau {count, plural, other {# phút}}."
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "Đăng nhập bằng trình duyệt",
|
||||
"browser_waiting": "Hoàn tất đăng nhập trong trình duyệt",
|
||||
"browser_unavailable": "Máy chủ này không hỗ trợ đăng nhập qua trình duyệt. Hãy dùng mật khẩu.",
|
||||
"browser_failed": "Không thể đăng nhập qua trình duyệt. Hãy thử lại.",
|
||||
"server_needed": "Trước tiên hãy nhập địa chỉ máy chủ.",
|
||||
"server_declined": "Bạn không cho phép máy chủ này nên không có gì được gửi đến đó.",
|
||||
"server_invalid": "Địa chỉ máy chủ này không hợp lệ."
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "Đăng nhập bằng trình duyệt…",
|
||||
"waiting": "Đang chờ trình duyệt…",
|
||||
"waiting_hint": "Hãy hoàn tất đăng nhập ở đó. Trình quản lý mật khẩu của bạn hoạt động trong trình duyệt.",
|
||||
"cancel": "Hủy",
|
||||
"or_here": "hoặc đăng nhập tại đây",
|
||||
"timed_out": "Đăng nhập trong trình duyệt mất quá nhiều thời gian. Hãy thử lại.",
|
||||
"no_browser": "Bulwark không thể mở trình duyệt. Hãy thử lại hoặc đăng nhập tại đây.",
|
||||
"failed": "Không đăng nhập được qua trình duyệt. Hãy thử lại.",
|
||||
"handoff_banner": "Bạn đang đăng nhập vào ứng dụng Bulwark trên máy tính này. Trình duyệt này vẫn chưa đăng nhập Bulwark.",
|
||||
"consent_title": "Đăng nhập vào ứng dụng Bulwark?",
|
||||
"consent_description": "Thông tin đăng nhập của {username} sẽ được chuyển đến ứng dụng Bulwark trên máy tính này. Chỉ tiếp tục nếu bạn bắt đầu việc này từ ứng dụng.",
|
||||
"consent_confirm": "Đăng nhập vào ứng dụng",
|
||||
"consent_cancel": "Để sau",
|
||||
"page_done": "Bạn có thể đóng tab này và quay lại Bulwark.",
|
||||
"page_failed": "Không đăng nhập được. Hãy quay lại Bulwark và thử lại.",
|
||||
"page_link_used": "Liên kết này chỉ dùng được một lần. Hãy quay lại Bulwark và bắt đầu lại.",
|
||||
"page_title": "Đăng nhập vào {server}",
|
||||
"page_intro": "Trang này đến từ ứng dụng Bulwark trên máy tính này. Mật khẩu của bạn chỉ được gửi đến {server}.",
|
||||
"page_username": "Địa chỉ email hoặc tên người dùng",
|
||||
"page_password": "Mật khẩu",
|
||||
"page_code": "Mã hai yếu tố",
|
||||
"page_submit": "Đăng nhập",
|
||||
"page_wrong_password": "Máy chủ không chấp nhận tên người dùng và mật khẩu này.",
|
||||
"page_code_needed": "Tài khoản này cũng cần mã hai yếu tố. Hãy nhập lại mật khẩu và mã.",
|
||||
"page_no_answer": "Bulwark không thể đăng nhập. Hãy kiểm tra xem máy chủ có truy cập được không rồi thử lại."
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "Cập nhật",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "嘗試次數過多。請在 {count, plural, other {# 分鐘}}後再試。"
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "使用瀏覽器登入",
|
||||
"browser_waiting": "請在瀏覽器中完成登入",
|
||||
"browser_unavailable": "此伺服器不支援透過瀏覽器登入。請使用密碼。",
|
||||
"browser_failed": "無法透過瀏覽器登入。請再試一次。",
|
||||
"server_needed": "請先輸入伺服器位址。",
|
||||
"server_declined": "你沒有允許此伺服器,因此沒有傳送任何內容給它。",
|
||||
"server_invalid": "此伺服器位址無效。"
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "使用瀏覽器登入…",
|
||||
"waiting": "正在等候瀏覽器…",
|
||||
"waiting_hint": "請在瀏覽器中完成登入。你的密碼管理工具可以在瀏覽器中使用。",
|
||||
"cancel": "取消",
|
||||
"or_here": "或在此登入",
|
||||
"timed_out": "瀏覽器登入耗時過長。請再試一次。",
|
||||
"no_browser": "Bulwark 無法開啟瀏覽器。請再試一次,或在此登入。",
|
||||
"failed": "透過瀏覽器登入失敗。請再試一次。",
|
||||
"handoff_banner": "你正在登入這台電腦上的 Bulwark 應用程式。此瀏覽器不會登入 Bulwark。",
|
||||
"consent_title": "要登入 Bulwark 應用程式嗎?",
|
||||
"consent_description": "{username} 的登入資訊將交給這台電腦上的 Bulwark 應用程式。只有從應用程式發起時才繼續。",
|
||||
"consent_confirm": "登入應用程式",
|
||||
"consent_cancel": "暫不",
|
||||
"page_done": "你可以關閉此分頁並返回 Bulwark。",
|
||||
"page_failed": "登入失敗。請返回 Bulwark 並再試一次。",
|
||||
"page_link_used": "此連結只能使用一次。請返回 Bulwark 重新開始。",
|
||||
"page_title": "登入 {server}",
|
||||
"page_intro": "此頁面來自這台電腦上的 Bulwark 應用程式。你的密碼只會傳送到 {server}。",
|
||||
"page_username": "電子郵件地址或使用者名稱",
|
||||
"page_password": "密碼",
|
||||
"page_code": "雙重驗證碼",
|
||||
"page_submit": "登入",
|
||||
"page_wrong_password": "伺服器不接受此使用者名稱和密碼。",
|
||||
"page_code_needed": "此帳戶還需要雙重驗證碼。請重新輸入密碼和驗證碼。",
|
||||
"page_no_answer": "Bulwark 無法登入。請檢查伺服器是否可連線,然後再試一次。"
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "更新",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
+27
-4
@@ -6873,14 +6873,37 @@
|
||||
"blocked_minutes": "尝试次数过多。请在 {count, plural, other {# 分钟}}后重试。"
|
||||
},
|
||||
"desktop_sign_in": {
|
||||
"browser_button": "使用浏览器登录",
|
||||
"browser_waiting": "请在浏览器中完成登录",
|
||||
"browser_unavailable": "此服务器不支持通过浏览器登录。请使用密码。",
|
||||
"browser_failed": "无法通过浏览器登录。请重试。",
|
||||
"server_needed": "请先输入服务器地址。",
|
||||
"server_declined": "你没有允许此服务器,因此没有向它发送任何内容。",
|
||||
"server_invalid": "此服务器地址无效。"
|
||||
},
|
||||
"desktop_browser_sign_in": {
|
||||
"button": "使用浏览器登录…",
|
||||
"waiting": "正在等待浏览器…",
|
||||
"waiting_hint": "请在浏览器中完成登录。你的密码管理器可以在浏览器中使用。",
|
||||
"cancel": "取消",
|
||||
"or_here": "或在此登录",
|
||||
"timed_out": "浏览器登录用时过长。请重试。",
|
||||
"no_browser": "Bulwark 无法打开浏览器。请重试,或在此登录。",
|
||||
"failed": "通过浏览器登录失败。请重试。",
|
||||
"handoff_banner": "你正在登录这台电脑上的 Bulwark 应用。此浏览器不会登录 Bulwark。",
|
||||
"consent_title": "要登录 Bulwark 应用吗?",
|
||||
"consent_description": "{username} 的登录信息将交给这台电脑上的 Bulwark 应用。只有从应用中发起时才继续。",
|
||||
"consent_confirm": "登录应用",
|
||||
"consent_cancel": "暂不",
|
||||
"page_done": "你可以关闭此标签页并返回 Bulwark。",
|
||||
"page_failed": "登录失败。请返回 Bulwark 并重试。",
|
||||
"page_link_used": "此链接只能使用一次。请返回 Bulwark 重新开始。",
|
||||
"page_title": "登录 {server}",
|
||||
"page_intro": "此页面来自这台电脑上的 Bulwark 应用。你的密码只会发送到 {server}。",
|
||||
"page_username": "电子邮件地址或用户名",
|
||||
"page_password": "密码",
|
||||
"page_code": "双重验证代码",
|
||||
"page_submit": "登录",
|
||||
"page_wrong_password": "服务器不接受此用户名和密码。",
|
||||
"page_code_needed": "此账户还需要双重验证代码。请重新输入密码和代码。",
|
||||
"page_no_answer": "Bulwark 无法登录。请检查服务器是否可访问,然后重试。"
|
||||
},
|
||||
"desktop_updates": {
|
||||
"title": "更新",
|
||||
"version_label": "Bulwark {version}",
|
||||
|
||||
@@ -118,6 +118,9 @@ export const LITE_API_STRING_ALLOWLIST = [
|
||||
// the fragment.
|
||||
"/api/auth/handoff/create",
|
||||
"/api/auth/handoff/confirm",
|
||||
// The desktop app's sign-in on an instance: no bridge in a browser, and IS_LITE guards.
|
||||
"/api/auth/desktop-handoff/park",
|
||||
"/api/auth/desktop-handoff/redeem",
|
||||
"/api/auth/totp-token-exchange",
|
||||
"/api/auth/session",
|
||||
"/api/auth/verify",
|
||||
|
||||
+137
-82
@@ -109,6 +109,11 @@ interface AuthState {
|
||||
loginWithToken: (serverUrl: string, token: string, rememberMe?: boolean) => Promise<boolean>;
|
||||
loginWithOAuth: (serverUrl: string, code: string, codeVerifier: string, redirectUri: string, serverId?: string) => Promise<boolean>;
|
||||
loginWithServerSso: (code: string, state: string) => Promise<boolean>;
|
||||
/**
|
||||
* The desktop app on an instance: the one-time code from its browser sign-in, with the
|
||||
* verifier it kept. `blocked` is the device's own list of servers saying no.
|
||||
*/
|
||||
loginWithDesktopHandoff: (code: string, verifier: string, options: { remember: boolean; rememberPassword: boolean; allowedServers: string[] | null }) => Promise<'ok' | 'blocked' | 'failed'>;
|
||||
loginDemo: () => Promise<boolean>;
|
||||
/**
|
||||
* Obtain a usable access token for `accountId`, or the active account.
|
||||
@@ -1602,6 +1607,101 @@ function notifySignedIn(state: { activeAccountId: string | null; username: strin
|
||||
void authHooks.onLogin.emit({ accountId: state.activeAccountId, username: state.username ?? '' });
|
||||
}
|
||||
|
||||
/**
|
||||
* A provider's tokens are in, with the refresh token already in the slot's cookie: the
|
||||
* rest of a sign-in. Server-side SSO, and the desktop app's sign-in on an instance.
|
||||
*/
|
||||
async function adoptProviderSession(
|
||||
set: (state: Partial<AuthState>) => void,
|
||||
get: () => AuthState,
|
||||
session: { serverUrl: string; accessToken: string; expiresIn: number; remember: boolean | undefined; slot: number },
|
||||
): Promise<void> {
|
||||
const { serverUrl: ssoServerUrl, accessToken: access_token, expiresIn: expires_in, remember, slot } = session;
|
||||
const accountStore = useAccountStore.getState();
|
||||
let boundAccountId: string | undefined;
|
||||
const client = JMAPClient.withBearer(ssoServerUrl, access_token, '', () => get().refreshAccessToken({ accountId: boundAccountId }));
|
||||
await client.connect();
|
||||
|
||||
const jmapUsername = client.getUsername();
|
||||
const { identities, primaryIdentity } = loadIdentities(await client.getIdentities(), jmapUsername);
|
||||
// For SSO/OIDC, the JMAP session account name may be the
|
||||
// preferred_username claim rather than the real email address.
|
||||
// Prefer the email from the primary identity when available.
|
||||
const username = primaryIdentity?.email || jmapUsername;
|
||||
initializeFeatureStores(client);
|
||||
|
||||
const accountId = generateAccountId(username, ssoServerUrl);
|
||||
boundAccountId = accountId;
|
||||
|
||||
const prevAccountId = get().activeAccountId;
|
||||
if (prevAccountId && prevAccountId !== accountId) {
|
||||
snapshotAccount(prevAccountId);
|
||||
clearAllStores();
|
||||
}
|
||||
|
||||
holdClient(accountId, client);
|
||||
bindClientStatusHandlers(client, set, get, accountId);
|
||||
|
||||
accountStore.addAccount({
|
||||
label: primaryIdentity?.name || username,
|
||||
serverUrl: ssoServerUrl,
|
||||
username,
|
||||
authMode: 'oauth',
|
||||
rememberMe: remember !== false,
|
||||
displayName: primaryIdentity?.name || username,
|
||||
email: primaryIdentity?.email || username,
|
||||
lastLoginAt: Date.now(),
|
||||
isConnected: true,
|
||||
hasError: false,
|
||||
isDefault: accountStore.accounts.length === 0,
|
||||
});
|
||||
// The refresh-token cookie was written to `slot` by /api/auth/sso/complete.
|
||||
// Force the stored cookieSlot to match - see loginWithOAuth above for the
|
||||
// re-add and concurrent-tab cases this guards against.
|
||||
accountStore.updateAccount(accountId, { cookieSlot: slot, providerSession: true });
|
||||
accountStore.setActiveAccount(accountId);
|
||||
|
||||
await syncStalwartAuthContext(ssoServerUrl, username, client.getAuthHeader(), slot);
|
||||
void syncAccountDisplayName(accountId, client, primaryIdentity?.name);
|
||||
|
||||
set({
|
||||
isAuthenticated: true,
|
||||
isLoading: false,
|
||||
serverUrl: ssoServerUrl,
|
||||
username,
|
||||
client,
|
||||
...getClientRateLimitState(client),
|
||||
identities,
|
||||
primaryIdentity,
|
||||
authMode: 'oauth',
|
||||
accessToken: access_token,
|
||||
tokenExpiresAt: Date.now() + expires_in * 1000,
|
||||
connectionLost: false,
|
||||
error: null,
|
||||
activeAccountId: accountId,
|
||||
});
|
||||
|
||||
import('@/stores/email-store').then(({ useEmailStore }) => {
|
||||
useEmailStore.getState().prefetchInitialData(client).catch((err) => {
|
||||
debug.error('Initial data prefetch failed:', err);
|
||||
});
|
||||
}).catch(() => {});
|
||||
|
||||
scheduleRefresh(expires_in, () => get().refreshAccessToken({ accountId }), accountId);
|
||||
|
||||
notifyParent('sso:auth-success', { username });
|
||||
|
||||
fetchConfig().then(cfg => {
|
||||
if (!cfg.settingsSyncEnabled) return;
|
||||
useSettingsStore.getState().loadFromServer(username, ssoServerUrl).finally(() => {
|
||||
useSettingsStore.getState().enableSync(username, ssoServerUrl);
|
||||
applyPreferredIdentity(accountId);
|
||||
});
|
||||
}).catch(() => {});
|
||||
|
||||
notifySignedIn(get());
|
||||
}
|
||||
|
||||
function beforeLogoutHooks(accountId: string, options: SignOutCleanupOptions = {}): Promise<void> {
|
||||
return Promise.race([
|
||||
Promise.all([authHooks.onBeforeLogout.emit({ accountId }), runBeforeSignOut(accountId, options)]).then(() => {}),
|
||||
@@ -2268,88 +2368,7 @@ export const useAuthStore = create<AuthState>()(
|
||||
throw new Error('Server URL not configured');
|
||||
}
|
||||
|
||||
let boundAccountId: string | undefined;
|
||||
const client = JMAPClient.withBearer(ssoServerUrl, access_token, '', () => get().refreshAccessToken({ accountId: boundAccountId }));
|
||||
await client.connect();
|
||||
|
||||
const jmapUsername = client.getUsername();
|
||||
const { identities, primaryIdentity } = loadIdentities(await client.getIdentities(), jmapUsername);
|
||||
// For SSO/OIDC, the JMAP session account name may be the
|
||||
// preferred_username claim rather than the real email address.
|
||||
// Prefer the email from the primary identity when available.
|
||||
const username = primaryIdentity?.email || jmapUsername;
|
||||
initializeFeatureStores(client);
|
||||
|
||||
const accountId = generateAccountId(username, ssoServerUrl);
|
||||
boundAccountId = accountId;
|
||||
|
||||
const prevAccountId = get().activeAccountId;
|
||||
if (prevAccountId && prevAccountId !== accountId) {
|
||||
snapshotAccount(prevAccountId);
|
||||
clearAllStores();
|
||||
}
|
||||
|
||||
holdClient(accountId, client);
|
||||
bindClientStatusHandlers(client, set, get, accountId);
|
||||
|
||||
accountStore.addAccount({
|
||||
label: primaryIdentity?.name || username,
|
||||
serverUrl: ssoServerUrl,
|
||||
username,
|
||||
authMode: 'oauth',
|
||||
rememberMe: remember !== false,
|
||||
displayName: primaryIdentity?.name || username,
|
||||
email: primaryIdentity?.email || username,
|
||||
lastLoginAt: Date.now(),
|
||||
isConnected: true,
|
||||
hasError: false,
|
||||
isDefault: accountStore.accounts.length === 0,
|
||||
});
|
||||
// The refresh-token cookie was written to `slot` by /api/auth/sso/complete.
|
||||
// Force the stored cookieSlot to match - see loginWithOAuth above for the
|
||||
// re-add and concurrent-tab cases this guards against.
|
||||
accountStore.updateAccount(accountId, { cookieSlot: slot, providerSession: true });
|
||||
accountStore.setActiveAccount(accountId);
|
||||
|
||||
await syncStalwartAuthContext(ssoServerUrl, username, client.getAuthHeader(), slot);
|
||||
void syncAccountDisplayName(accountId, client, primaryIdentity?.name);
|
||||
|
||||
set({
|
||||
isAuthenticated: true,
|
||||
isLoading: false,
|
||||
serverUrl: ssoServerUrl,
|
||||
username,
|
||||
client,
|
||||
...getClientRateLimitState(client),
|
||||
identities,
|
||||
primaryIdentity,
|
||||
authMode: 'oauth',
|
||||
accessToken: access_token,
|
||||
tokenExpiresAt: Date.now() + expires_in * 1000,
|
||||
connectionLost: false,
|
||||
error: null,
|
||||
activeAccountId: accountId,
|
||||
});
|
||||
|
||||
import('@/stores/email-store').then(({ useEmailStore }) => {
|
||||
useEmailStore.getState().prefetchInitialData(client).catch((err) => {
|
||||
debug.error('Initial data prefetch failed:', err);
|
||||
});
|
||||
}).catch(() => {});
|
||||
|
||||
scheduleRefresh(expires_in, () => get().refreshAccessToken({ accountId }), accountId);
|
||||
|
||||
notifyParent('sso:auth-success', { username });
|
||||
|
||||
fetchConfig().then(cfg => {
|
||||
if (!cfg.settingsSyncEnabled) return;
|
||||
useSettingsStore.getState().loadFromServer(username, ssoServerUrl).finally(() => {
|
||||
useSettingsStore.getState().enableSync(username, ssoServerUrl);
|
||||
applyPreferredIdentity(accountId);
|
||||
});
|
||||
}).catch(() => {});
|
||||
|
||||
notifySignedIn(get());
|
||||
await adoptProviderSession(set, get, { serverUrl: ssoServerUrl, accessToken: access_token, expiresIn: expires_in, remember, slot });
|
||||
return true;
|
||||
} catch (error) {
|
||||
debug.error('Server SSO login error:', error);
|
||||
@@ -2367,6 +2386,42 @@ export const useAuthStore = create<AuthState>()(
|
||||
}
|
||||
},
|
||||
|
||||
loginWithDesktopHandoff: async (code, verifier, { remember, rememberPassword, allowedServers }) => {
|
||||
if (IS_LITE) return 'failed';
|
||||
set({ isLoading: true, error: null, isRateLimited: false, rateLimitUntil: null });
|
||||
try {
|
||||
const slot = useAccountStore.getState().getNextCookieSlot();
|
||||
const res = await apiFetch('/api/auth/desktop-handoff/redeem', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ code, code_verifier: verifier, slot, remember, allowed_servers: allowedServers }),
|
||||
}).then((answer) => noteSessionAnswer(answer, slot));
|
||||
if (!res.ok) {
|
||||
const refusal = (await res.json().catch(() => null)) as { error?: string } | null;
|
||||
set({ isLoading: false, error: null });
|
||||
return refusal?.error === 'blocked_by_policy' ? 'blocked' : 'failed';
|
||||
}
|
||||
const parked = await res.json();
|
||||
if (parked.flow === 'password') {
|
||||
// A password the browser checked a moment ago, down the same path as a typed one.
|
||||
return (await get().login(parked.server_url, parked.username, parked.password, undefined, rememberPassword)) ? 'ok' : 'failed';
|
||||
}
|
||||
await adoptProviderSession(set, get, { serverUrl: parked.server_url, accessToken: parked.access_token, expiresIn: parked.expires_in, remember: parked.remember, slot });
|
||||
return 'ok';
|
||||
} catch (error) {
|
||||
debug.error('Desktop hand-off login error:', error);
|
||||
set({
|
||||
isLoading: false,
|
||||
error: error instanceof Error ? error.message : 'generic',
|
||||
isAuthenticated: false,
|
||||
isRateLimited: false,
|
||||
rateLimitUntil: null,
|
||||
client: null,
|
||||
});
|
||||
return 'failed';
|
||||
}
|
||||
},
|
||||
|
||||
refreshAccessToken: async (options) => {
|
||||
// Every multi-account client and timer passes its own account: renewing
|
||||
// the active slot on a background account's behalf would hand that
|
||||
|
||||
Reference in New Issue
Block a user