release-2.9.0 (#1532)

* fix(macos): skip single-instance lock in Mac App Store builds (#1454) fix(macos): skip single-instance lock in Mac App Store builds * Fix/backend optional sharp (#1455) Fix/backend optional sharp * feat: issue #1218 (#1218) https://github.com/Termix-SSH/Support/issues/1218 * feat: Add option to use saved global custom theme under Connection Defaults (#1209) https://github.com/Termix-SSH/Support/issues/1209 * feat: Add Fleet Sharing functionality to the UI (#1228) https://github.com/Termix-SSH/Support/issues/1228 * feat: Add a list view to the Docker management page (#1237) https://github.com/Termix-SSH/Support/issues/1237 * feat: issue #1264 (#1264) https://github.com/Termix-SSH/Support/issues/1264 * feat: 2FA With FortiToken (#1288) https://github.com/Termix-SSH/Support/issues/1288 * feat: Allow to disable showing paths to folders (#1274) https://github.com/Termix-SSH/Support/issues/1274 * feat: Sync Network Graph between Desktop and Remote Server (#1245) https://github.com/Termix-SSH/Support/issues/1245 * feat: Version Number on offline servers (#1291) https://github.com/Termix-SSH/Support/issues/1291 * feat: Support OrbStack Docker socket path on macOS / Fix "Docker is not installed" on mac... (#1302) https://github.com/Termix-SSH/Support/issues/1302 * feat: Sidebar host click should focus existing tab instead of opening a new connection (#1289) https://github.com/Termix-SSH/Support/issues/1289 * fix: Search in side bar shows overlapping hosts when grouped by tags (#1303) https://github.com/Termix-SSH/Support/issues/1303 * fix: I can't send a file on its own. (#1304) https://github.com/Termix-SSH/Support/issues/1304 * fix: sudo password not autofilling (#1248) https://github.com/Termix-SSH/Support/issues/1248 * fix: node-MainThread (#1300) https://github.com/Termix-SSH/Support/issues/1300 * fix: Tunnel authentication with shared credentials (#1295) https://github.com/Termix-SSH/Support/issues/1295 * fix: host key updates not syncing, metrics 404 race on first connect Host key writes never bumped updatedAt so sync never picked them up. Also retry the first metrics fetch briefly instead of failing right away. * chore: increment ver * feat: add category and icon fields to plugin manifest schema * ci(deps): bump the github-actions group with 2 updates (#1458) Bumps the github-actions group with 2 updates: [crowdin/github-action](https://github.com/crowdin/github-action) and [actions/github-script](https://github.com/actions/github-script). Updates `crowdin/github-action` from 2 to 3 - [Release notes](https://github.com/crowdin/github-action/releases) - [Commits](https://github.com/crowdin/github-action/compare/v2...v3) Updates `actions/github-script` from 7 to 9 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7...v9) --- updated-dependencies: - dependency-name: crowdin/github-action dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 13 updates (#1459) Bumps the dev-patch-updates group with 13 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.11.0` | `6.11.1` | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.1` | `6.7.2` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.9` | `6.43.12` | | [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` | | [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.5` | `14.6.7` | | [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2) | `1.15.5` | `1.15.6` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` | | [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.1` | `3.34.3` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.7` | | [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.2` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` | | [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.14` | Updates `@codemirror/commands` from 6.11.0 to 6.11.1 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@codemirror/search` from 6.7.1 to 6.7.2 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.9 to 6.43.12 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@testing-library/dom` from 10.4.1 to 10.4.2 - [Release notes](https://github.com/testing-library/dom-testing-library/releases) - [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/dom-testing-library/compare/v10.4.1...v10.4.2) Updates `@testing-library/react` from 16.3.2 to 16.3.3 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3) Updates `@testing-library/user-event` from 14.6.5 to 14.6.7 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/user-event/compare/v14.6.5...v14.6.7) Updates `@types/ssh2` from 1.15.5 to 1.15.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2) Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react) Updates `cytoscape` from 3.34.1 to 3.34.3 - [Release notes](https://github.com/cytoscape/cytoscape.js/releases) - [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.1...v3.34.3) Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.7 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.4...v0.5.7) Updates `i18next` from 26.4.0 to 26.4.2 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.4.0...v26.4.2) Updates `prettier` from 3.9.6 to 3.9.8 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.9.6...3.9.8) Updates `react-i18next` from 17.0.12 to 17.0.14 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/react-i18next/compare/v17.0.12...v17.0.14) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/search" dependency-version: 6.7.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/dom" dependency-version: 10.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/react" dependency-version: 16.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/user-event" dependency-version: 14.6.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@types/ssh2" dependency-version: 1.15.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: cytoscape dependency-version: 3.34.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: i18next dependency-version: 26.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: react-i18next dependency-version: 17.0.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-patch-updates group with 6 updates (#1461) Bumps the prod-patch-updates group with 6 updates: | Package | From | To | | --- | --- | --- | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.13` | | [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` | | [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` | | [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` | | [socks](https://github.com/JoshGlazebrook/socks) | `2.8.9` | `2.8.10` | | [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` | Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.13 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.13/packages/react-virtual) Updates `compression` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2) Updates `jose` from 6.2.9 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](https://github.com/panva/jose/compare/v6.2.9...v6.2.12) Updates `jszip` from 3.10.1 to 3.10.2 - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](https://github.com/Stuk/jszip/compare/v3.10.1...v3.10.2) Updates `socks` from 2.8.9 to 2.8.10 - [Release notes](https://github.com/JoshGlazebrook/socks/releases) - [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.9...2.8.10) Updates `undici` from 8.10.0 to 8.10.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2) --- updated-dependencies: - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: compression dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: jose dependency-version: 6.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: jszip dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: socks dependency-version: 2.8.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: undici dependency-version: 8.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add plugin worker protocol, bootstrap and plugin_storage table Worker-side ctx proxy plus the message envelope it talks over, and the per-plugin key/value table behind ctx.storage with migrations for all three dialects. Rows cascade with the plugin so uninstalling leaves nothing behind. * feat: add allowlisted host view for plugins An allowlist rather than a list of fields to strip. A blocklist rots: the moment a new secret-bearing column lands on SSHHost it starts leaking silently. With an allowlist a new field stays invisible to plugins until someone adds it here on purpose. * feat: add plugin loader with manifest validation and crash restart Validates an unpacked plugin, spawns a worker_threads worker and manages activate/deactivate/crash-restart with backoff, disabling after three tries. The crash counter clears only after a plugin stays up past a stability window, not on activation. Clearing it on activation let a plugin that activates cleanly and then dies restart forever, because every attempt looked like the first. loader.ts documents what the worker boundary does and does not buy you. Node's permission model is process-wide, not per-worker, so it cannot be enabled for plugin workers alone and is not claimed here. * feat: route internal events through a shared plugin event bus Formalises three ad-hoc publish paths that already existed: automation-events.ts, metrics/automation-bridge.ts and the hostSessionStatus singleton, now the host.session.status topic. Both invariants the old code relied on are preserved. Publishing stays fire-and-forget, so a failing subscriber cannot disturb a metrics poll or a host delete. The automations engine subscribes to the bus at scheduler start instead of being imported ad hoc, which keeps the edge one-directional: automations may import repositories, hosts modules must not import automations. * feat: add plugin ctx broker with permission gate and audit Every ctx call a plugin makes is checked against its granted capabilities, performed by the main thread, then audited. A capability must be both declared in the manifest and granted in the database, so widening a plugin's reach always needs a new manifest the user can see, never just a database row. Audit attribution is set by the broker, not the plugin. The plugin supplies only the details, so it cannot forge the actor. fix: stop plugin workers seeing plaintext credentials in error messages A failing ctx.ssh.connect handed the worker the raw error from deep in the SSH stack, which embeds the connect config. The worker received, in full: Authentication failed for root using password <SECRET> where <SECRET> was the host's real plaintext password. Any plugin with ssh.exec could read it by catching the error, defeating the whole point of the handle-based ssh API. Errors crossing the boundary are now sanitised. Only PluginFacingError and PluginPermissionError, both authored here, reach a plugin verbatim; anything else becomes a generic message and the real one goes to the log. This uses a marker class rather than matching on message text, because matching would start leaking again the moment an upstream error happened to contain a familiar phrase. Covered by credential-isolation.test.ts, which plants a sentinel in every secret-bearing field and asserts it appears in no message the worker ever receives. * feat: dispatch plugin HTTP routes and wire the runtime into startup ctx.http.route now registers a real router on the /plugin-api/:pluginId dispatcher, replacing its stub 404. A plugin never touches the Express req/res: it gets a plain summary and returns a plain object, so sockets and session cookies stay on this side of the boundary. Authorization and cookie headers are not forwarded. Plugins load last in the start-up sequence, after the server is fully wired, and are terminated before the database on shutdown so none can outlive it. A plugin that fails to load cannot stop the backend. fix: correct the nginx plugin-api location regex The pattern was ^/plugin-api/(/.*)?$, which needs a double slash and so never matched /plugin-api/<id>/<route>. Every other block in the file uses ^/prefix(/.*)?$. Left alone, plugin routes would work in dev and 404 only behind Docker. * fix: update stale SFTP transfer test for single file destination paths The test still asserted transferToHost was called with the destination directory "/srv". Commit 7727fa09 (#1304) deliberately changed a single file transfer to send the full destination path including the filename, so the correct expectation is "/srv/remote-1.txt". The code was right and the test was left behind. * feat: ship the ssh terminal as a first-party in-process plugin Adds a hardcoded process:transport-owner tier so the terminal can own its WebSocket server and ssh2 clients, which cannot cross the worker boundary. * feat: ship docker as a first-party in-process plugin Moves docker backend and frontend into plugins/docker/, alongside ssh-terminal. Adds a host editor tab seam, a dashboard card registry, and a build step to compile plugin backends into dist. * feat: ship host metrics as a first-party in-process plugin * fix: harden plugin auth and add per-request identity for ctx calls Require auth on /plugin-api, gate plugin enable/grant/revoke routes behind admin.plugins.manage, and thread the calling user through worker ctx.hosts/ctx.ssh calls instead of always using the install owner. Also adds the plugin permissions grant/revoke UI. * feat: ship the AI assistant as a first-party in-process plugin Moves src/backend/ai and its routes into plugins/ai, mounted through a small /ai dispatcher instead of its own port. Moves the ai-enabled and ai-private-endpoints settings routes out of user-settings-routes.ts into the plugin too, so it has no leftover core dependents. * fix: remove compiled plugin JS left behind in plugins/ after build copy-bundled-plugins.cjs compiled and rewrote plugin backend TS in place, copied it to dist/plugins, but never deleted the .js it had just emitted next to the .ts sources. Those files shadowed the real source for vitest/tsx and had import paths rewritten for the dist layout, so tests failed with "Cannot find module" once a local build had run. Affects docker, host-metrics and ai, not just this one. * feat: add a permission-gated backend service registry for plugins * feat: add a permission-gated UI action registry and action slots for plugins Moves the terminal toolbar's hardwired AI button into a slot the ssh-terminal plugin offers and the ai plugin fills, gated on ai.services.use. * feat: add cross-plugin secret references gated by the provider's RBAC permission * feat: move proxmox discovery/import/sync into a first-party plugin * feat: move remote desktop (RDP/VNC/Telnet) into a first-party plugin Relocates guacamole backend/frontend source and tests into plugins/remote-desktop, following the ssh-terminal/docker pattern. * feat: wire remote-desktop plugin into core and rename i18n keys Repoints core consumers (dispatcher, collab, session-sharing, tab utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/ telnet, widens hostCapability to accept an array, and renames the guacamole i18n namespace to remoteDesktop. * feat: move fleets into a first-party plugin * feat: move automations into a first-party plugin * feat: remove legacy alert rules, superseded by automations Alert rules already auto-migrate into automations on boot and the old engine stands down after. Deletes the rule/firing tables, routes, UI, and AI tools; keeps notification channels since automations still use them. Also fixes automations' notify step, which still called the deleted repository. * feat: move network topology into a first-party plugin * feat: move tailscale device discovery and settings into a plugin Adds plugins/tailscale/ with a devices sidebar tab, admin settings section, and re-auth dialog. Host Metrics tailscale manager card and SSH re-auth banner parsing stay in core. * feat: move workspaces into a first-party plugin * feat: move web endpoint into a first-party plugin * feat: collapse plugin runtime to one tier behind a plugin SDK * feat: make each plugin an npm workspace built by a termix-plugin CLI * feat: give plugins their own tables, migrations and sync entities * feat: serve plugin http and websockets from one mount instead of ports * feat: namespace plugin permissions and keep them valid when a plugin is off * feat: give plugins their own settings and one settings screen * feat: load plugin frontends at runtime and remove plugin ids from the shell * fix: mock the ai status fetch in its activate test * feat: add auth extension points and one ssh connect pipeline * feat: rebuild workspaces as the reference plugin * fix: gate second factors after SSO/LDAP behind an admin setting * feat: convert network-topology to a full plugin (B1) * feat: move snippets backend and tables into a plugin (B2) * feat: point core frontend snippets pickers at the plugin (B2) * feat: add the snippets plugin (B2) * feat: wire ai, automations, fleets and ssh-terminal to snippets (B2) * feat: finish the tailscale plugin, including SSH auth (B3) * feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4) * chore: update proxmox and host-metrics locale files for B5 * chore: regenerate drizzle migration journals for B5 * feat: add ctx.hosts create/update to the SDK, host-metrics drops proxmox * feat: move proxmox node stats and collectors into the proxmox plugin * feat: drop proxmox host columns, use plugin settings instead * feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4) * feat: convert file manager into a plugin * feat: convert ssh tunnels into a plugin * feat: finish the web-endpoint plugin, add ctx.desktop (B8) * feat: move the terminal fully into the ssh-terminal plugin (B9) * feat: convert tmux monitoring into a plugin (B10) * feat: convert serial console into the serial plugin * feat: move session sharing and collab rooms into a plugin (B12) * feat: turn session recording into a plugin (B13) * feat: finish the remote-desktop plugin (B14) * feat: finish the host-metrics plugin, move host status into core (B16) * feat: finish the docker plugin (B15) * feat: finish the automations plugin (B17) * feat: finish the ai plugin (B18) * feat: finish the homepage plugin, move service links and canvas out of core (B19) * feat: convert wake-on-lan into a plugin (B20) * feat: convert secret-sources into a plugin (B20) * feat: move totp and passkeys into plugins (C1) * feat: move sso and ldap logins into plugins (C2) * feat: move opkssh and warpgate into plugins (C3) * feat: move step-ca into a plugin (C4) * feat: move vault ssh signing into a plugin (C5) * feat: move termix identity into a plugin (C6) * feat: move acme certificate automation into a plugin (C7) * fix: finish 2.9.0 plugin moves and get every check green * chore: lock the plugin boundary and remove 2.9.0 leftovers * fix: harden the plugin runtime after the 2.9.0 security review * feat: add plugin packing, signing, pinned trust and tmxplug bundling * test: prove 2.8 to 2.9.0 upgrade is lossless and fix what it caught * fix: give bundled plugin backends a real require for CJS deps * feat: improve UI loading time and jitter * feat: show credential sharing inline in the sidebar like host sharing * feat: tailscale add host and copy ip, fix outbound fetch hang and plugin ESM warning * feat: unify alerts into one plugin, channels, rules and inbox * feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling * fix: set blacksmith builder cache-key to stop broken gha cache fallback * fix: link plugin-sdk workspace before npm ci in docker deps stage * fix: link every plugin workspace before npm ci in docker deps stage * fix(host-metrics): exclude image and firmware filesystems (#1469) * fix(host-metrics): exclude image and firmware filesystems * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(hosts): normalize imported jump host references (#1470) * fix(hosts): normalize imported jump host references * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(ci): build plugin SDK and repair MySQL settings migration (#1471) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): keep inline rename consistent (#1476) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): keep inline rename consistent * fix(dashboard): reuse translated host status labels (#1475) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(dashboard): reuse translated host status labels * docs(api): clarify local and remote version fields (#1474) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * docs(api): clarify local and remote version fields * fix(file-manager): preserve selected backgrounds on hover (#1473) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): preserve selection feedback on hover * test(ui): await dialog focus cleanup before teardown * fix(file-manager): restore Ctrl/Cmd+F file search (#1472) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): focus file search with Ctrl or Cmd F * fix: keep rounded-full circular in production builds * fix(file-manager): cancel uploads and stop remote writes (#1477) * fix(file-manager): cancel uploads and stop remote writes * test(css): exercise the configured PostCSS plugin chain * fix(file-manager): apply compact density to directory tree (#1478) * fix(file-manager): apply compact density to directory tree * test(css): exercise the configured PostCSS plugin chain * fix(file-manager): preserve font sizes in compact mode (#1480) * fix(file-manager): preserve font sizes in compact mode * test(css): exercise the configured PostCSS plugin chain * fix(file-manager): prioritize file names in narrow lists (#1483) * fix(file-manager): prioritize file names in narrow lists * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * test(remote-desktop): always mutate ciphertext in tamper test * fix(remote-desktop): probe the saved host guacd endpoint (#1481) * fix(remote-desktop): probe the saved host guacd endpoint * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * fix(homepage): check allowlisted private service reachability (#1479) * fix(homepage): check allowlisted private service reachability * test(css): exercise the configured PostCSS plugin chain * fix(remote-desktop): stop unsolicited clipboard read prompts (#1482) * fix(remote-desktop): read clipboard only on explicit paste * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * test(remote-desktop): always mutate ciphertext in tamper test * chore: simplify plugin readmes, changelogs and manifest descriptions * fix: keep plugins loaded after signing in from the login screen * fix(file-manager): accept OS file drops over existing rows (#1484) * fix(file-manager): accept OS file drops over existing rows * test(file-manager): target the file label in drop tests * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * test(remote-desktop): always mutate ciphertext in tamper test * fix(file-manager): pipeline SFTP download reads (#1485) * feat: add plugin sdk build to beta release * fix: make link-store secret check immune to random base64 matches * fix(ldap): preserve the directory-provided bind DN (#1486) * fix: compute beta changes across dev branches and move the beta tag * chore: untrack plugin sdk ARCHITECTURE.md * chore: remove references to plugin sdk ARCHITECTURE.md * feat: merge host editor terminal tabs into one owned by ssh-terminal * feat: add descriptions to plugin host enable toggles * fix(file-manager): show download progress in file viewers (#1487) * fix(electron): signal backend readiness over IPC (#1488) * fix(split-screen): allow layout creation without randomUUID (#1490) * fix(split-screen): allow layout creation without randomUUID * test(credentials): avoid flaky Ed25519 key generation * fix(sidebar): remeasure visible rows after density changes (#1489) * fix(sidebar): remeasure visible rows after density changes * test(credentials): avoid flaky Ed25519 key generation * feat(split-screen): redesign split screen with free-form panes and pane picker * feat(sidebar): add host click behavior setting, default to always opening a new tab * feat(snippets): redesign panel to match the host list * fix(session-recording): stop session logs panel from refetching in a loop * feat(snippets): bring back sharing, target hosts and drag reorder * feat(ssh-terminal): add toolbar position, start state, display and fade host settings * feat(ssh-terminal): add host setting to turn off password prompt auto-fill * fix(ai): stop streams getting cut off and keep tool steps across messages * feat: improve quick connect system using plugin api * fix: proxmox guest sync, startup snippet sync, drop dead cloudflare ssh transport * feat: move terminal settings, look and ssh tools into ssh-terminal plugin * feat: move snippets, keybinding actions and macros out of core into plugins * feat: store rdp, vnc and telnet logins in a generic per-protocol table * feat: type the plugin host record, move plugin strings out of core and add lint checks * feat: replace core homepage widget registry with generic extension points * feat: plugins only see their own host settings in the browser * feat: harden plugin api for separate repos, signed updates and generic external login * fix: keep plugin css below core utilities and version plugin assets by their css * fix: load and save plugin host settings in the editor and tighten settings row spacing * feat: redesign user host defaults system * fix(remote-desktop): release held keys on focus loss (#1498) * fix(session-sharing): replace local presentation after takeover (#1500) * fix(file-manager): refresh disk usage with directory listing (#1503) * fix(ssh-terminal): preserve input order during local echo reconciliation (#1505) * feat(remote-desktop): expose display zoom controls for RDP (#1514) * fix(file-manager): restore text selection and copying in Markdown previews (#1518) * fix(sidebar): keep compact host addresses visible (#1524) * fix(hosts): preserve plugin settings when reopening the editor (#1499) * fix(ssh-terminal): close owner sockets when presentations unmount (#1501) * fix(session-sharing): synchronize shared SSH terminal dimensions (#1502) * fix(session-sharing): show participant presence in member terminals (#1504) * fix(ai): sync provider configuration and keys across linked devices (#1506) * feat(ssh-terminal): add a duplicate tab action (#1510) * feat(file-manager): allow disabling move-to-trash confirmation (#1511) * feat(file-manager): default to the remote login directory (#1512) * feat(homepage): synchronize canvas layouts across devices (#1515) * fix(shortcuts): prevent accidental double-Shift palette activation (#1519) * feat(tmux-monitor): add a unified multi-host view (#1520) * fix(electron): allow explicit quit with active connections (#1522) * feat: reconnect all disconnected terminal tabs (#1523) * fix(hosts): preserve recording and sharing settings in the dev editor (#1509) * fix(database): preserve RDP domain during startup backfill (#1497) * feat(sidebar): add keyboard type-ahead search for hosts (#1516) * feat(automations): add per-host maintenance mode and recurring schedules (#1521) * feat(tmux): add a per-host mouse toggle and preserve remote configuration (#1513) * fix(session-sharing): use the linked server for desktop meetings and links (#1507) * fix(tunnels): support TOTP for client tunnels and jump hosts (#1508) * fix: type errors and lint failures from merged plugin prs * feat(installer): make the Windows desktop shortcut optional (#1517) * fix: ship the plugin sdk and serialport in desktop builds * fix: prefer ipv4 when resolving ssh host names (#1365) * fix: readable terminal selection with the light theme (#1319) * fix: build desktop session share links on the linked server (#1350) * fix: show meeting guests to members and hide the roster from guests (#1353) * fix: reliable file manager saves with sudo prompt and no base64 guessing (#1335) * fix: show disk usage for the mount being browsed (#1347) * fix: load the linux tray icon reliably and log tray failures (#1332) * fix: cover the gnome close path in the desktop quit test (#1332) * fix: prompt for jump host TOTP in terminal, file manager and metrics (#1312) * feat: optional auto reconnect for dropped ssh sessions (#1321) * feat: tighter compact host rows with inline tags (#1325) * feat: bring back the alert feed homepage widget * feat: pick target terminals for snippets again * feat: share button on connection tabs again * feat: recent servers list when linking the desktop app * feat: list the fixed app shortcuts in keyboard shortcuts * fix: translate hardcoded toasts and drop em dashes from ui text * fix: translate leftover hardcoded ui text * fix: toolbar files button opens at the shell directory again * fix: show the remote desktop note under connection origin again * chore: openapi docs for host metrics manager routes * chore: openapi docs for undocumented routes and fix two broken doc blocks * fix: declare terminal.listSessions use for snippet targets * revert: drop the alert feed widget, the notification center replaces it * feat: restore the alert feed homepage widget * fix: quick connect fills the host address from plugin auth editors like tailscale * fix: docker container logs use the base background color * chore: fix dependabot alerts and apply safe npm upgrades * fix: proxmox stats tab reads its switch from plugin host settings * fix: count plugin ssh logins toward host status and stop showing reachable as a warning * fix: hide the built-in source pill in the host editor * fix: host status shows online when the port answers and only warns on a failed login * fix: drop the top border on the split layout menu * fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default * fix: remote desktop auth method labels and notes for vnc and telnet * fix: add description to the web endpoint enable switch * fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release * feat: move telemetry out of core into a usage statistics plugin * fix: recent activity card no longer cuts off host names early * fix: remove duplicate top border on split screen menu * fix: redesign session log player controls, fix tooltip overlap and drop dot separators * fix: file manager and sftp text showing raw i18n keys * fix: onboarding rerunning for existing users after upgrading * fix: fleet detail buttons overflowing the sidebar * fix: session log player scrolling off screen horizontally * fix: network graph lag when adding hosts and on every render * fix: maintenance index name, shared host read only view and badge polling * fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag * chore: update release notes * fix: remote desktop tabs reconnecting on every tab switch * fix: build plugin sdk before linting in release workflow * chore: lint, format, and bump version to 2.9.0 * chore: skip crowdin pre-translate in release for now * chore: sync Crowdin translations for 2.9.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Koi <38512047+datlt4@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
2026-10-31 15:45:23 +00:00 · 2026-10-01 16:20:16 -05:00
1 parent 49fa488093
commit 3643e7af97
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Teken aan met SSO",
+  "loginWithProvider": "Teken aan met {{name}}",
+  "loading": "Laai tans...",
+  "permissions": {
+    "manage": {
+      "title": "Bestuur SSO-verskaffers",
+      "description": "Voeg die SSO-verskaffers by, verander en verwyder waarmee mense kan aanmeld."
+    }
+  },
+  "providers": {
+    "docsLink": "Bekyk dokumente",
+    "none": "Geen SSO-verskaffers gekonfigureer nie.",
+    "add": "Voeg Verskaffer by",
+    "edit": "Wysig Verskaffer",
+    "delete": "Vee Verskaffer uit",
+    "deleteConfirm": "Vee hierdie verskaffer uit? Geassosieerde gebruikers sal nie kan aanmeld nie.",
+    "name": "Vertoonnaam",
+    "namePlaceholder": "My SSO-verskaffer",
+    "nameRequired": "'n Vertoonnaam word vereis",
+    "type": "Verskaffertipe",
+    "enabled": "Geaktiveer",
+    "save": "Stoor Verskaffer",
+    "saving": "Stoor...",
+    "saved": "Gestoor",
+    "saveFailed": "Kon nie stoor nie",
+    "deleted": "Verwyder",
+    "deleteFailed": "Kon nie verwyder nie",
+    "loadFailed": "Kon nie SSO-verskaffers laai nie",
+    "cancel": "Kanselleer",
+    "copy": "Kopieer",
+    "copied": "Gekopieer",
+    "redirectUri": "Herlei URI",
+    "redirectUriDesc": "Registreer hierdie URL as die aanstuur- of terugbel-URL in jou identiteitsverskaffer.",
+    "legacyCallback": "Behou die ou aanstuur-URI",
+    "legacyCallbackDesc": "Hierdie verskaffer is voor Termix 2.9 opgestel en gebruik steeds die ou aanstuur-URI, wat steeds werk. Om na die nuwe een oor te skakel, voeg eers {{uri}} by jou identiteitsverskaffer, en skakel dit dan af.",
+    "authorizationUrl": "Magtigings-URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Kliënt-ID",
+    "clientSecret": "Kliëntgeheim",
+    "secretKeep": "'n Geheim is gestoor. Los dit leeg om dit te behou.",
+    "issuerUrl": "Uitreiker-URL",
+    "authUrl": "Magtigings-URL",
+    "tokenUrl": "Teken-URL",
+    "userIdentifier": "Gebruikersidentifiseerderpad",
+    "displayName": "Vertoonnaampad",
+    "scopes": "Omvangsgebiede",
+    "userinfoUrl": "Oorskryf Gebruikersinligting URL",
+    "groupClaim": "Groep Eis",
+    "groupClaimDesc": "Opsioneel. Die eispad wat die gebruiker se groepe bevat. Standaard is groepe, rolle, dan groep. Gebruik dit vir verskaffers met 'n persoonlike eis (bv. Zitadel).",
+    "allowedUsers": "Toegelate Gebruikers",
+    "allowedUsersDesc": "Een e-pos per reël. Los leeg om alles toe te laat.",
+    "adminGroup": "Admingroep",
+    "adminGroupDesc": "Gebruikers in hierdie groep kry administrasie. Los leeg om groepsinchronisasie te deaktiveer.",
+    "caCert": "Pasgemaakte CA-sertifikaat",
+    "caCertDesc": "Opsioneel. PEM-geënkodeerde CA-sertifikaat vir OIDC-verskaffers wat 'n private of selfgetekende CA gebruik. Los leeg om die stelselvertrouensberging te gebruik."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Meld outomaties aan met SSO",
+      "description": "Stuur besoekers direk na die eerste SSO-verskaffer in plaas daarvan om die aanmeldvorm te wys. Die OIDC_SILENT_LOGIN_DEFAULT omgewingveranderlike oorskryf dit."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "سجّل الدخول باستخدام تسجيل الدخول الموحد (SSO)",
+  "loginWithProvider": "تسجيل الدخول باستخدام {{name}}",
+  "loading": "جارٍ التحميل...",
+  "permissions": {
+    "manage": {
+      "title": "إدارة موفري تسجيل الدخول الموحد (SSO)",
+      "description": "أضف، غيّر، واحذف مزودي خدمة تسجيل الدخول الموحد (SSO) الذين يمكن للأشخاص تسجيل الدخول باستخدامهم."
+    }
+  },
+  "providers": {
+    "docsLink": "عرض المستندات",
+    "none": "لم يتم تكوين أي مزود SSO.",
+    "add": "إضافة مزود",
+    "edit": "تعديل المزود",
+    "delete": "حذف المزود",
+    "deleteConfirm": "حذف هذا المزود؟ لن يتمكن المستخدمون المرتبطون من تسجيل الدخول.",
+    "name": "اسم العرض",
+    "namePlaceholder": "موفر خدمة تسجيل الدخول الموحد الخاص بي",
+    "nameRequired": "اسم العرض مطلوب",
+    "type": "نوع المزود",
+    "enabled": "مُمكّن",
+    "save": "حفظ المزود",
+    "saving": "جارٍ الحفظ...",
+    "saved": "محفوظ",
+    "saveFailed": "فشل في الحفظ",
+    "deleted": "محذوف",
+    "deleteFailed": "فشل في الحذف",
+    "loadFailed": "فشل تحميل موفري تسجيل الدخول الموحد",
+    "cancel": "إلغاء",
+    "copy": "نسخ",
+    "copied": "تم النسخ",
+    "redirectUri": "عنوان إعادة التوجيه",
+    "redirectUriDesc": "قم بتسجيل عنوان URL هذا كعنوان URL لإعادة التوجيه أو عنوان URL للرد في موفر الهوية الخاص بك.",
+    "legacyCallback": "احتفظ بمعرف إعادة التوجيه القديم",
+    "legacyCallbackDesc": "تم إعداد هذا المزوّد قبل إصدار Termix 2.9، ولا يزال يستخدم عنوان إعادة التوجيه القديم، والذي يعمل بشكل سليم. للانتقال إلى العنوان الجديد، أضف {{uri}} إلى مزوّد الهوية الخاص بك أولاً، ثم عطّل هذا الخيار.",
+    "authorizationUrl": "رابط التفويض: {{url}}"
+  },
+  "fields": {
+    "clientId": "معرف العميل",
+    "clientSecret": "سر العميل",
+    "secretKeep": "تم حفظ السر. اترك هذا الحقل فارغاً للحفاظ عليه.",
+    "issuerUrl": "رابط المُصدر",
+    "authUrl": "رابط التفويض",
+    "tokenUrl": "رابط الرمز المميز",
+    "userIdentifier": "مسار معرّف المستخدم",
+    "displayName": "مسار اسم العرض",
+    "scopes": "النطاقات",
+    "userinfoUrl": "تجاوز رابط Userinfo",
+    "groupClaim": "مطالبة المجموعة",
+    "groupClaimDesc": "اختياري. مسار المطالبة الذي يحتوي على مجموعات المستخدم. القيمة الافتراضية هي groups، ثم roles، ثم group. استخدم هذا للموفّرين الذين لديهم مطالبة مخصصة (مثل Zitadel).",
+    "allowedUsers": "المستخدمون المسموح لهم",
+    "allowedUsersDesc": "بريد إلكتروني واحد في كل سطر. اتركه فارغًا للسماح للجميع.",
+    "adminGroup": "مجموعة المسؤولين",
+    "adminGroupDesc": "يُمنح المستخدمون في هذه المجموعة صلاحيات المسؤول. اتركه فارغًا لتعطيل مزامنة المجموعة.",
+    "caCert": "شهادة CA مخصصة",
+    "caCertDesc": "اختياري. شهادة CA بترميز PEM لموفّري OIDC الذين يستخدمون شهادة CA خاصة أو موقّعة ذاتيًا. اتركه فارغًا لاستخدام مخزن الثقة في النظام."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "تسجيل الدخول باستخدام تسجيل الدخول الموحد (SSO) تلقائيًا",
+      "description": "قم بتوجيه الزوار مباشرةً إلى أول مزود خدمة تسجيل دخول موحد (SSO) بدلاً من عرض نموذج تسجيل الدخول. يُمكن تجاوز هذا الإعداد باستخدام متغير البيئة OIDC_SILENT_LOGIN_DEFAULT."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Влизане с SSO",
+  "loginWithProvider": "Влезте с {{name}}",
+  "loading": "Зареждане...",
+  "permissions": {
+    "manage": {
+      "title": "Управление на доставчици на SSO",
+      "description": "Добавяне, промяна и премахване на доставчици на SSO, с които хората могат да влизат."
+    }
+  },
+  "providers": {
+    "docsLink": "Преглед на документи",
+    "none": "Няма конфигурирани доставчици на SSO.",
+    "add": "Добавяне на доставчик",
+    "edit": "Редактиране на доставчик",
+    "delete": "Изтриване на доставчик",
+    "deleteConfirm": "Да се изтрие ли този доставчик? Свързаните потребители няма да могат да влязат.",
+    "name": "Показвано име",
+    "namePlaceholder": "Моят доставчик на SSO",
+    "nameRequired": "Изисква се показвано име",
+    "type": "Тип доставчик",
+    "enabled": "Активирано",
+    "save": "Запазване на доставчика",
+    "saving": "Запазване...",
+    "saved": "Запазено",
+    "saveFailed": "Запазването не бе успешно",
+    "deleted": "Изтрито",
+    "deleteFailed": "Изтриването не бе успешно",
+    "loadFailed": "Зареждането на доставчиците на SSO не бе успешно",
+    "cancel": "Отказ",
+    "copy": "Копиране",
+    "copied": "Копирано",
+    "redirectUri": "URI адрес за пренасочване",
+    "redirectUriDesc": "Регистрирайте този URL адрес като URL адрес за пренасочване или обратно извикване във вашия доставчик на идентичност.",
+    "legacyCallback": "Запазете стария URI адрес за пренасочване",
+    "legacyCallbackDesc": "Този доставчик е настроен преди Termix 2.9 и все още използва стария URI за пренасочване, който продължава да работи. За да преминете към новия, първо добавете {{uri}} към вашия доставчик на идентичност, след което го изключете.",
+    "authorizationUrl": "URL адрес за оторизация: {{url}}"
+  },
+  "fields": {
+    "clientId": "Идентификационен номер на клиента",
+    "clientSecret": "Клиентска тайна",
+    "secretKeep": "Тайната е запазена. Оставете това празно, за да я запазите.",
+    "issuerUrl": "URL адрес на издателя",
+    "authUrl": "URL адрес за оторизация",
+    "tokenUrl": "URL адрес на токена",
+    "userIdentifier": "Път на потребителския идентификатор",
+    "displayName": "Път на показваното име",
+    "scopes": "Обхвати",
+    "userinfoUrl": "Замяна на URL адреса на потребителската информация",
+    "groupClaim": "Групово искане",
+    "groupClaimDesc": "Незадължително. Пътят на твърдението, който съдържа групите на потребителя. По подразбиране са групи, роли и след това група. Използвайте това за доставчици с персонализирано твърдение (напр. Zitadel).",
+    "allowedUsers": "Разрешени потребители",
+    "allowedUsersDesc": "По един имейл на ред. Оставете празно, за да разрешите всички.",
+    "adminGroup": "Административна група",
+    "adminGroupDesc": "Потребителите в тази група са с администраторски права. Оставете празно, за да деактивирате синхронизирането на групата.",
+    "caCert": "Персонализиран CA сертификат",
+    "caCertDesc": "Незадължително. PEM-кодиран CA сертификат за OIDC доставчици, използващи частен или самоподписан CA. Оставете празно, за да използвате хранилището за доверени сертификати на системата."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Влизане с SSO автоматично",
+      "description": "Изпращайте посетителите директно към първия SSO доставчик, вместо да показвате формата за вход. Променливата на средата OIDC_SILENT_LOGIN_DEFAULT отменя това."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Loading...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Saving...",
+    "saved": "Saved",
+    "saveFailed": "Failed to save",
+    "deleted": "Deleted",
+    "deleteFailed": "Failed to delete",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancel",
+    "copy": "Copy",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Inicia la sessió amb SSO",
+  "loginWithProvider": "Inicia la sessió amb {{name}}",
+  "loading": "S'està carregant...",
+  "permissions": {
+    "manage": {
+      "title": "Gestionar proveïdors d'SSO",
+      "description": "Afegiu, canvieu i elimineu els proveïdors d'SSO amb què els usuaris poden iniciar la sessió."
+    }
+  },
+  "providers": {
+    "docsLink": "Veure documents",
+    "none": "No hi ha cap proveïdor d'SSO configurat.",
+    "add": "Afegeix un proveïdor",
+    "edit": "Edita el proveïdor",
+    "delete": "Suprimeix el proveïdor",
+    "deleteConfirm": "Voleu suprimir aquest proveïdor? Els usuaris associats no podran iniciar la sessió.",
+    "name": "Nom de visualització",
+    "namePlaceholder": "El meu proveïdor d'SSO",
+    "nameRequired": "Cal un nom de visualització",
+    "type": "Tipus de proveïdor",
+    "enabled": "Activat",
+    "save": "Desa el proveïdor",
+    "saving": "Desant...",
+    "saved": "Desat",
+    "saveFailed": "No s'ha pogut desar",
+    "deleted": "Suprimit",
+    "deleteFailed": "No s'ha pogut suprimir",
+    "loadFailed": "No s'han pogut carregar els proveïdors d'SSO",
+    "cancel": "Cancel·la",
+    "copy": "Còpia",
+    "copied": "Copiat",
+    "redirectUri": "URI de redirecció",
+    "redirectUriDesc": "Registra aquesta URL com a URL de redirecció o de devolució de trucada al teu proveïdor d'identitat.",
+    "legacyCallback": "Mantingueu l'URI de redirecció antiga",
+    "legacyCallbackDesc": "Aquest proveïdor es va configurar abans de Termix 2.9 i encara utilitza l'URI de redirecció antic, que continua funcionant. Per canviar al nou, afegiu primer {{uri}} al vostre proveïdor d'identitat i després desactiveu-lo.",
+    "authorizationUrl": "URL d'autorització: {{url}}"
+  },
+  "fields": {
+    "clientId": "ID de client",
+    "clientSecret": "Secret del client",
+    "secretKeep": "S'ha desat un secret. Deixa aquest espai buit per conservar-lo.",
+    "issuerUrl": "URL de l'emissor",
+    "authUrl": "URL d'autorització",
+    "tokenUrl": "URL del testimoni",
+    "userIdentifier": "Ruta d'identificació d'usuari",
+    "displayName": "Camí del nom de visualització",
+    "scopes": "Àmbits",
+    "userinfoUrl": "Substitueix l'URL d'informació de l'usuari",
+    "groupClaim": "Reclamació de grup",
+    "groupClaimDesc": "Opcional. La ruta de reclamació que conté els grups de l'usuari. Per defecte, s'utilitzen grups, rols i, a continuació, grup. Feu servir això per a proveïdors amb una reclamació personalitzada (per exemple, Zitadel).",
+    "allowedUsers": "Usuaris permesos",
+    "allowedUsersDesc": "Un correu electrònic per línia. Deixeu-ho en blanc per permetre-ho tot.",
+    "adminGroup": "Grup d'administradors",
+    "adminGroupDesc": "Els usuaris d'aquest grup tenen dret d'administrador. Deixeu-ho en blanc per desactivar la sincronització del grup.",
+    "caCert": "Certificat CA personalitzat",
+    "caCertDesc": "Opcional. Certificat CA codificat amb PEM per a proveïdors OIDC que utilitzen una CA privada o autosignada. Deixeu-ho en blanc per utilitzar el magatzem de confiança del sistema."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Inicia la sessió amb SSO automàticament",
+      "description": "Envia els visitants directament al primer proveïdor d'SSO en comptes de mostrar el formulari d'inici de sessió. La variable d'entorn OIDC_SILENT_LOGIN_DEFAULT ho anul·la."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Přihlásit se pomocí SSO",
+  "loginWithProvider": "Přihlaste se pomocí {{name}}",
+  "loading": "Načítání...",
+  "permissions": {
+    "manage": {
+      "title": "Správa poskytovatelů jednotného přihlašování (SSO)",
+      "description": "Přidávat, měnit a odebírat poskytovatele SSO, přes které se lidé mohou přihlašovat."
+    }
+  },
+  "providers": {
+    "docsLink": "Zobrazit dokumenty",
+    "none": "Nejsou nakonfigurováni žádní poskytovatelé jednotného přihlašování (SSO).",
+    "add": "Přidat poskytovatele",
+    "edit": "Upravit poskytovatele",
+    "delete": "Smazat poskytovatele",
+    "deleteConfirm": "Smazat tohoto poskytovatele? Přidružení uživatelé se nebudou moci přihlásit.",
+    "name": "Zobrazovaný název",
+    "namePlaceholder": "Můj poskytovatel SSO",
+    "nameRequired": "Je vyžadováno zobrazované jméno",
+    "type": "Typ poskytovatele",
+    "enabled": "Povoleno",
+    "save": "Uložit poskytovatele",
+    "saving": "Ukládání…",
+    "saved": "Uloženo",
+    "saveFailed": "Uložení se nezdařilo",
+    "deleted": "Smazáno",
+    "deleteFailed": "Smazání se nezdařilo",
+    "loadFailed": "Načtení poskytovatelů SSO se nezdařilo",
+    "cancel": "Zrušit",
+    "copy": "Kopie",
+    "copied": "Zkopírováno",
+    "redirectUri": "URI přesměrování",
+    "redirectUriDesc": "Zaregistrujte tuto URL adresu jako URL adresu pro přesměrování nebo zpětné volání u svého poskytovatele identity.",
+    "legacyCallback": "Zachovat starý identifikátor URI přesměrování",
+    "legacyCallbackDesc": "Tento poskytovatel byl nastaven před verzí Termix 2.9 a stále používá starý URI pro přesměrování, který funguje. Chcete-li přejít na nového, nejprve přidejte do svého poskytovatele identity {{uri}} a poté tuto možnost vypněte.",
+    "authorizationUrl": "Autorizační URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "ID klienta",
+    "clientSecret": "Tajemství klienta",
+    "secretKeep": "Tajný kód je uložen. Pro jeho zachování nechte toto pole prázdné.",
+    "issuerUrl": "URL vydavatele",
+    "authUrl": "Autorizační URL",
+    "tokenUrl": "URL tokenu",
+    "userIdentifier": "Cesta k identifikátoru uživatele",
+    "displayName": "Cesta k zobrazovanému názvu",
+    "scopes": "Rozsahy",
+    "userinfoUrl": "Přepsat URL s uživatelskými informacemi",
+    "groupClaim": "Skupinový nárok",
+    "groupClaimDesc": "Volitelné. Cesta k deklaraci identity, která obsahuje skupiny uživatele. Výchozí nastavení je skupiny, role a poté skupina. Použijte pro poskytovatele s vlastní deklarací identity (např. Zitadel).",
+    "allowedUsers": "Povolení uživatelé",
+    "allowedUsersDesc": "Jeden e-mail na řádek. Pro povolení všech ponechte prázdné.",
+    "adminGroup": "Skupina administrátorů",
+    "adminGroupDesc": "Uživatelé v této skupině mají oprávnění k administraci. Pro deaktivaci synchronizace skupiny ponechte pole prázdné.",
+    "caCert": "Vlastní certifikát certifikační autority",
+    "caCertDesc": "Volitelné. Certifikát certifikační autority s kódováním PEM pro poskytovatele OIDC používající soukromou nebo samopodepsanou certifikační autoritu. Pro použití systémového úložiště důvěryhodných certifikátů ponechte pole prázdné."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Automatické přihlášení pomocí SSO",
+      "description": "Odesílejte návštěvníky přímo k prvnímu poskytovateli SSO namísto zobrazení přihlašovacího formuláře. Proměnná prostředí OIDC_SILENT_LOGIN_DEFAULT toto přepíše."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Log ind med SSO",
+  "loginWithProvider": "Log ind med {{name}}",
+  "loading": "Indlæser...",
+  "permissions": {
+    "manage": {
+      "title": "Administrer SSO-udbydere",
+      "description": "Tilføj, rediger og fjern de SSO-udbydere, som folk kan logge ind med."
+    }
+  },
+  "providers": {
+    "docsLink": "Se dokumenter",
+    "none": "Ingen SSO-udbydere er konfigureret.",
+    "add": "Tilføj udbyder",
+    "edit": "Rediger udbyder",
+    "delete": "Slet udbyder",
+    "deleteConfirm": "Vil du slette denne udbyder? Tilknyttede brugere vil ikke kunne logge ind.",
+    "name": "Vist navn",
+    "namePlaceholder": "Min SSO-udbyder",
+    "nameRequired": "Et visningsnavn er påkrævet",
+    "type": "Udbydertype",
+    "enabled": "Aktiveret",
+    "save": "Gem udbyder",
+    "saving": "Gemmer...",
+    "saved": "Gemt",
+    "saveFailed": "Kunne ikke gemme",
+    "deleted": "Slettet",
+    "deleteFailed": "Kunne ikke slette",
+    "loadFailed": "Kunne ikke indlæse SSO-udbydere",
+    "cancel": "Ophæve",
+    "copy": "Kopi",
+    "copied": "Kopieret",
+    "redirectUri": "Omdirigerings-URI",
+    "redirectUriDesc": "Registrer denne URL som omdirigerings- eller tilbagekalds-URL i din identitetsudbyder.",
+    "legacyCallback": "Behold den gamle omdirigerings-URI",
+    "legacyCallbackDesc": "Denne udbyder blev oprettet før Termix 2.9 og bruger stadig den gamle omdirigerings-URI, som fortsat fungerer. For at skifte til den nye skal du først tilføje {{uri}} i din identitetsudbyder og derefter slå dette fra.",
+    "authorizationUrl": "Autorisations-URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Klient-ID",
+    "clientSecret": "Klienthemmelighed",
+    "secretKeep": "En hemmelighed er gemt. Lad dette felt være tomt for at beholde den.",
+    "issuerUrl": "Udsteders URL",
+    "authUrl": "Autorisations-URL",
+    "tokenUrl": "Token-URL",
+    "userIdentifier": "Brugeridentifikatorsti",
+    "displayName": "Sti til visningsnavn",
+    "scopes": "Omfang",
+    "userinfoUrl": "Tilsidesæt brugerinfo-URL",
+    "groupClaim": "Gruppekrav",
+    "groupClaimDesc": "Valgfrit. Kravsstien, der indeholder brugerens grupper. Standardindstillingen er grupper, roller og derefter gruppe. Brug dette til udbydere med et brugerdefineret krav (f.eks. Zitadel).",
+    "allowedUsers": "Tilladte brugere",
+    "allowedUsersDesc": "Én e-mail pr. linje. Lad feltet stå tomt for at tillade alle.",
+    "adminGroup": "Admingruppe",
+    "adminGroupDesc": "Brugere i denne gruppe har administratorrettigheder. Lad feltet stå tomt for at deaktivere gruppesynkronisering.",
+    "caCert": "Brugerdefineret CA-certifikat",
+    "caCertDesc": "Valgfrit. PEM-kodet CA-certifikat til OIDC-udbydere, der bruger en privat eller selvsigneret CA. Lad feltet stå tomt for at bruge systemets tillidslager."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Log automatisk ind med SSO",
+      "description": "Send besøgende direkte til den første SSO-udbyder i stedet for at vise loginformularen. Miljøvariablen OIDC_SILENT_LOGIN_DEFAULT tilsidesætter dette."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Mit SSO anmelden",
+  "loginWithProvider": "Anmeldung mit {{name}}",
+  "loading": "Laden...",
+  "permissions": {
+    "manage": {
+      "title": "SSO-Anbieter verwalten",
+      "description": "Fügen Sie SSO-Anbieter hinzu, ändern oder entfernen Sie diese, mit denen sich Benutzer anmelden können."
+    }
+  },
+  "providers": {
+    "docsLink": "Dokumentation ansehen",
+    "none": "Keine SSO-Anbieter konfiguriert.",
+    "add": "Anbieter hinzufügen",
+    "edit": "Anbieter bearbeiten",
+    "delete": "Anbieter löschen",
+    "deleteConfirm": "Diesen Anbieter löschen? Zugehörige Benutzer können sich nicht mehr anmelden.",
+    "name": "Anzeigename",
+    "namePlaceholder": "Mein SSO-Anbieter",
+    "nameRequired": "Ein Anzeigename ist erforderlich.",
+    "type": "Anbietertyp",
+    "enabled": "Aktiviert",
+    "save": "Anbieter speichern",
+    "saving": "Wird gespeichert …",
+    "saved": "Gespeichert",
+    "saveFailed": "Speichern fehlgeschlagen",
+    "deleted": "Gelöscht",
+    "deleteFailed": "Löschen fehlgeschlagen",
+    "loadFailed": "SSO-Anbieter konnten nicht geladen werden",
+    "cancel": "Abbrechen",
+    "copy": "Kopieren",
+    "copied": "Kopiert",
+    "redirectUri": "Umleitungs-URI",
+    "redirectUriDesc": "Registrieren Sie diese URL als Weiterleitungs- oder Rückruf-URL bei Ihrem Identitätsanbieter.",
+    "legacyCallback": "Behalte die alte Umleitungs-URI bei.",
+    "legacyCallbackDesc": "Dieser Anbieter wurde vor Termix 2.9 eingerichtet und verwendet noch die alte Umleitungs-URI, die weiterhin funktioniert. Um zur neuen URI zu wechseln, fügen Sie zunächst {{uri}} in Ihrem Identitätsanbieter hinzu und deaktivieren Sie diese Option anschließend.",
+    "authorizationUrl": "Autorisierungs-URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client-ID",
+    "clientSecret": "Client-Secret",
+    "secretKeep": "Ein Geheimnis ist gewahrt. Lassen Sie dieses Feld leer, um es zu bewahren.",
+    "issuerUrl": "Issuer-URL",
+    "authUrl": "Autorisierungs-URL",
+    "tokenUrl": "Token-URL",
+    "userIdentifier": "Benutzerkennungspfad",
+    "displayName": "Anzeigename-Pfad",
+    "scopes": "Scopes",
+    "userinfoUrl": "Userinfo-URL überschreiben",
+    "groupClaim": "Gruppen-Claim",
+    "groupClaimDesc": "Optional. Der Claim-Pfad, der die Gruppen des Benutzers enthält. Standardmäßig groups, roles, dann group. Verwenden Sie dies für Anbieter mit einem benutzerdefinierten Claim (z. B. Zitadel).",
+    "allowedUsers": "Zugelassene Benutzer",
+    "allowedUsersDesc": "Eine E-Mail pro Zeile. Leer lassen, um alle zuzulassen.",
+    "adminGroup": "Admin-Gruppe",
+    "adminGroupDesc": "Benutzer in dieser Gruppe erhalten Admin-Berechtigungen. Leer lassen, um die Gruppensynchronisierung zu deaktivieren.",
+    "caCert": "Benutzerdefiniertes CA-Zertifikat",
+    "caCertDesc": "Optional. PEM-kodiertes CA-Zertifikat für OIDC-Anbieter, die eine private oder selbstsignierte Zertifizierungsstelle verwenden. Leer lassen, um den System-Vertrauensspeicher zu verwenden."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Automatische Anmeldung mit SSO",
+      "description": "Besucher werden direkt zum ersten SSO-Anbieter weitergeleitet, anstatt das Anmeldeformular anzuzeigen. Die Umgebungsvariable OIDC_SILENT_LOGIN_DEFAULT überschreibt dies."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Σύνδεση με SSO",
+  "loginWithProvider": "Σύνδεση με {{name}}",
+  "loading": "Φόρτωση...",
+  "permissions": {
+    "manage": {
+      "title": "Διαχείριση παρόχων SSO",
+      "description": "Προσθέστε, αλλάξτε και καταργήστε τους παρόχους SSO με τους οποίους μπορούν να συνδεθούν οι χρήστες."
+    }
+  },
+  "providers": {
+    "docsLink": "Προβολή εγγράφων",
+    "none": "Δεν έχουν ρυθμιστεί πάροχοι SSO.",
+    "add": "Προσθήκη παρόχου",
+    "edit": "Επεξεργασία παρόχου",
+    "delete": "Διαγραφή παρόχου",
+    "deleteConfirm": "Διαγραφή αυτού του παρόχου; Οι συνδεδεμένοι χρήστες δεν θα μπορούν να συνδεθούν.",
+    "name": "Εμφανιζόμενο όνομα",
+    "namePlaceholder": "Ο πάροχος SSO μου",
+    "nameRequired": "Απαιτείται εμφανιζόμενο όνομα",
+    "type": "Τύπος παρόχου",
+    "enabled": "Ενεργοποιημένο",
+    "save": "Αποθήκευση παρόχου",
+    "saving": "Οικονομία...",
+    "saved": "Αποθηκεύτηκε",
+    "saveFailed": "Η αποθήκευση απέτυχε",
+    "deleted": "Διαγράφηκε",
+    "deleteFailed": "Η διαγραφή απέτυχε",
+    "loadFailed": "Αποτυχία φόρτωσης παρόχων SSO",
+    "cancel": "Ματαίωση",
+    "copy": "Αντίγραφο",
+    "copied": "Αντιγράφηκε",
+    "redirectUri": "URI ανακατεύθυνσης",
+    "redirectUriDesc": "Καταχωρίστε αυτήν τη διεύθυνση URL ως διεύθυνση URL ανακατεύθυνσης ή επανάκλησης στον πάροχο ταυτότητάς σας.",
+    "legacyCallback": "Διατηρήστε το παλιό URI ανακατεύθυνσης",
+    "legacyCallbackDesc": "Αυτός ο πάροχος είχε ρυθμιστεί πριν από το Termix 2.9 και εξακολουθεί να χρησιμοποιεί το παλιό URI ανακατεύθυνσης, το οποίο συνεχίζει να λειτουργεί. Για να μεταβείτε στον νέο, προσθέστε πρώτα το {{uri}} στον πάροχο ταυτότητάς σας και, στη συνέχεια, απενεργοποιήστε αυτήν τη λειτουργία.",
+    "authorizationUrl": "URL εξουσιοδότησης: {{url}}"
+  },
+  "fields": {
+    "clientId": "Αναγνωριστικό πελάτη",
+    "clientSecret": "Μυστικό Πελάτη",
+    "secretKeep": "Ένα μυστικό αποθηκεύτηκε. Αφήστε το κενό για να το διατηρήσετε.",
+    "issuerUrl": "URL εκδότη",
+    "authUrl": "URL εξουσιοδότησης",
+    "tokenUrl": "URL διακριτικού",
+    "userIdentifier": "Διαδρομή αναγνωριστικού χρήστη",
+    "displayName": "Διαδρομή ονόματος εμφάνισης",
+    "scopes": "Πεδία",
+    "userinfoUrl": "Παράκαμψη URL πληροφοριών χρήστη",
+    "groupClaim": "Ομαδική αξίωση",
+    "groupClaimDesc": "Προαιρετικό. Η διαδρομή αξίωσης που περιέχει τις ομάδες του χρήστη. Η προεπιλεγμένη τιμή είναι ομάδες, ρόλοι και στη συνέχεια ομάδα. Χρησιμοποιήστε αυτήν τη διαδρομή για παρόχους με προσαρμοσμένη αξίωση (π.χ. Zitadel).",
+    "allowedUsers": "Επιτρεπόμενοι χρήστες",
+    "allowedUsersDesc": "Ένα email ανά γραμμή. Αφήστε το κενό για να επιτρέπονται όλα.",
+    "adminGroup": "Ομάδα Διαχειριστών",
+    "adminGroupDesc": "Οι χρήστες σε αυτήν την ομάδα έχουν παραχωρηθεί ως διαχειριστές. Αφήστε το κενό για να απενεργοποιήσετε τον συγχρονισμό ομάδας.",
+    "caCert": "Προσαρμοσμένο Πιστοποιητικό CA",
+    "caCertDesc": "Προαιρετικό. Πιστοποιητικό CA με κωδικοποίηση PEM για παρόχους OIDC που χρησιμοποιούν ιδιωτική ή αυτο-υπογεγραμμένη αρχή έκδοσης πιστοποιητικών. Αφήστε το κενό για να χρησιμοποιήσετε τον χώρο αποθήκευσης αξιοπιστίας του συστήματος."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Αυτόματη σύνδεση με SSO",
+      "description": "Στέλνει τους επισκέπτες απευθείας στον πρώτο πάροχο SSO αντί να εμφανίζει τη φόρμα σύνδεσης. Η μεταβλητή περιβάλλοντος OIDC_SILENT_LOGIN_DEFAULT παρακάμπτει αυτό."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Iniciar sesión con SSO",
+  "loginWithProvider": "Iniciar sesión con {{name}}",
+  "loading": "Cargando...",
+  "permissions": {
+    "manage": {
+      "title": "Gestionar proveedores de inicio de sesión único (SSO)",
+      "description": "Agregue, cambie y elimine los proveedores de inicio de sesión único (SSO) con los que las personas pueden iniciar sesión."
+    }
+  },
+  "providers": {
+    "docsLink": "Ver documentación",
+    "none": "No hay proveedores SSO configurados.",
+    "add": "Añadir proveedor",
+    "edit": "Editar proveedor",
+    "delete": "Eliminar proveedor",
+    "deleteConfirm": "¿Eliminar este proveedor? Los usuarios asociados no podrán iniciar sesión.",
+    "name": "Nombre para mostrar",
+    "namePlaceholder": "Mi proveedor de SSO",
+    "nameRequired": "Se requiere un nombre para mostrar.",
+    "type": "Tipo de proveedor",
+    "enabled": "Activado",
+    "save": "Guardar proveedor",
+    "saving": "Guardando...",
+    "saved": "Guardado",
+    "saveFailed": "Error al guardar",
+    "deleted": "Eliminado",
+    "deleteFailed": "Error al eliminar",
+    "loadFailed": "No se pudieron cargar los proveedores de SSO.",
+    "cancel": "Cancelar",
+    "copy": "Copiar",
+    "copied": "Copiado",
+    "redirectUri": "URI de redirección",
+    "redirectUriDesc": "Registra esta URL como URL de redireccionamiento o de devolución de llamada en tu proveedor de identidad.",
+    "legacyCallback": "Mantén la URI de redireccionamiento antigua.",
+    "legacyCallbackDesc": "Este proveedor se configuró antes de Termix 2.9 y aún utiliza la URI de redireccionamiento antigua, que sigue funcionando. Para cambiar a la nueva, primero añade {{uri}} a tu proveedor de identidad y luego desactiva esta opción.",
+    "authorizationUrl": "URL de autorización: {{url}}"
+  },
+  "fields": {
+    "clientId": "ID de cliente",
+    "clientSecret": "Secreto de cliente",
+    "secretKeep": "Un secreto está guardado. Deja esto en blanco para conservarlo.",
+    "issuerUrl": "URL del emisor",
+    "authUrl": "URL de autorización",
+    "tokenUrl": "URL del token",
+    "userIdentifier": "Ruta del identificador de usuario",
+    "displayName": "Ruta del nombre para mostrar",
+    "scopes": "Ámbitos",
+    "userinfoUrl": "Sobrescribir URL de Userinfo",
+    "groupClaim": "Claim de grupo",
+    "groupClaimDesc": "Opcional. La ruta del claim que contiene los grupos del usuario. Por defecto, se usan 'groups', 'roles' y luego 'group'. Úselo para proveedores con un claim personalizado (p. ej. Zitadel).",
+    "allowedUsers": "Usuarios permitidos",
+    "allowedUsersDesc": "Un correo electrónico por línea. Déjelo vacío para permitir todos.",
+    "adminGroup": "Grupo de administradores",
+    "adminGroupDesc": "Los usuarios de este grupo reciben permisos de administrador. Déjelo vacío para desactivar la sincronización de grupos.",
+    "caCert": "Certificado CA personalizado",
+    "caCertDesc": "Opcional. Certificado CA codificado en PEM para proveedores OIDC que utilicen una CA privada o autofirmada. Déjelo vacío para usar el almacén de confianza del sistema."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Inicia sesión automáticamente con SSO.",
+      "description": "En lugar de mostrar el formulario de inicio de sesión, redirige a los visitantes directamente al primer proveedor de SSO. La variable de entorno OIDC_SILENT_LOGIN_DEFAULT anula esta configuración."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Kirjaudu sisään kertakirjautumisella",
+  "loginWithProvider": "Kirjaudu sisään tunnuksella {{name}}",
+  "loading": "Ladataan...",
+  "permissions": {
+    "manage": {
+      "title": "Hallinnoi kertakirjautumispalveluntarjoajia",
+      "description": "Lisää, muuta ja poista kertakirjautumisen tarjoajia, joilla käyttäjät voivat kirjautua sisään."
+    }
+  },
+  "providers": {
+    "docsLink": "Näytä dokumentit",
+    "none": "SSO-palveluntarjoajia ei ole määritetty.",
+    "add": "Lisää palveluntarjoaja",
+    "edit": "Muokkaa palveluntarjoajaa",
+    "delete": "Poista palveluntarjoaja",
+    "deleteConfirm": "Poistetaanko tämä palveluntarjoaja? Liitännäiset käyttäjät eivät voi kirjautua sisään.",
+    "name": "Näyttönimi",
+    "namePlaceholder": "SSO-palveluntarjoajani",
+    "nameRequired": "Näyttönimi on pakollinen",
+    "type": "Palveluntarjoajan tyyppi",
+    "enabled": "Käytössä",
+    "save": "Tallenna palveluntarjoaja",
+    "saving": "Tallennetaan...",
+    "saved": "Tallennettu",
+    "saveFailed": "Tallennus epäonnistui",
+    "deleted": "Poistettu",
+    "deleteFailed": "Poistaminen epäonnistui",
+    "loadFailed": "SSO-palveluntarjoajien lataaminen epäonnistui",
+    "cancel": "Peruuttaa",
+    "copy": "Kopioida",
+    "copied": "Kopioitu",
+    "redirectUri": "Uudelleenohjauksen URI",
+    "redirectUriDesc": "Rekisteröi tämä URL-osoite uudelleenohjaus- tai takaisinkutsuosoitteeksi identiteetintarjoajassasi.",
+    "legacyCallback": "Säilytä vanha uudelleenohjaus-URI",
+    "legacyCallbackDesc": "Tämä palveluntarjoaja määritettiin ennen Termix 2.9:ää ja käyttää edelleen vanhaa uudelleenohjaus-URI:a, joka toimii edelleen. Siirry uuteen lisäämällä ensin {{uri}} identiteetintarjoajaasi ja poistamalla tämä sitten käytöstä.",
+    "authorizationUrl": "Valtuutus-URL-osoite: {{url}}"
+  },
+  "fields": {
+    "clientId": "Asiakastunnus",
+    "clientSecret": "Asiakkaan salaisuus",
+    "secretKeep": "Salaisuus on tallennettu. Jätä tämä tyhjäksi, jos haluat sen säilyvän.",
+    "issuerUrl": "Liikkeeseenlaskijan URL-osoite",
+    "authUrl": "Valtuutus-URL-osoite",
+    "tokenUrl": "Tunnuksen URL-osoite",
+    "userIdentifier": "Käyttäjätunnisteen polku",
+    "displayName": "Näyttönimen polku",
+    "scopes": "Laajuusalueet",
+    "userinfoUrl": "Käyttäjätietojen URL-osoitteen ohitus",
+    "groupClaim": "Ryhmävaatimus",
+    "groupClaimDesc": "Valinnainen. Vaatimuspolku, joka sisältää käyttäjän ryhmät. Oletusarvo on ryhmät, roolit ja lopuksi ryhmä. Käytä tätä palveluntarjoajille, joilla on mukautettu vaatimus (esim. Zitadel).",
+    "allowedUsers": "Sallitut käyttäjät",
+    "allowedUsersDesc": "Yksi sähköpostiosoite riviä kohden. Jätä tyhjäksi salliaksesi kaikki.",
+    "adminGroup": "Hallintaryhmä",
+    "adminGroupDesc": "Tämän ryhmän käyttäjille on myönnetty järjestelmänvalvojan oikeudet. Jätä tyhjäksi, jos haluat poistaa ryhmän synkronoinnin käytöstä.",
+    "caCert": "Mukautettu CA-varmenne",
+    "caCertDesc": "Valinnainen. PEM-koodattu CA-varmenne OIDC-palveluntarjoajille, jotka käyttävät yksityistä tai itse allekirjoitettua CA:ta. Jätä tyhjäksi, jos haluat käyttää järjestelmän luotettavuussäilöä."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Kirjaudu sisään automaattisesti kertakirjautumisella",
+      "description": "Ohjaa kävijät suoraan ensimmäiselle SSO-palveluntarjoajalle kirjautumislomakkeen näyttämisen sijaan. OIDC_SILENT_LOGIN_DEFAULT-ympäristömuuttuja korvaa tämän."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Se connecter avec l'authentification unique",
+  "loginWithProvider": "Se connecter avec {{name}}",
+  "loading": "Chargement...",
+  "permissions": {
+    "manage": {
+      "title": "Gérer les fournisseurs SSO",
+      "description": "Ajouter, modifier et supprimer les fournisseurs d'authentification unique (SSO) avec lesquels les utilisateurs peuvent se connecter."
+    }
+  },
+  "providers": {
+    "docsLink": "Voir la documentation",
+    "none": "Aucun fournisseur SSO configuré.",
+    "add": "Ajouter un fournisseur",
+    "edit": "Modifier le fournisseur",
+    "delete": "Supprimer le fournisseur",
+    "deleteConfirm": "Supprimer ce fournisseur ? Les utilisateurs associés ne pourront plus se connecter.",
+    "name": "Nom affiché",
+    "namePlaceholder": "Mon fournisseur SSO",
+    "nameRequired": "Un nom d'affichage est requis.",
+    "type": "Type de fournisseur",
+    "enabled": "Activé",
+    "save": "Enregistrer le fournisseur",
+    "saving": "Enregistrement…",
+    "saved": "Enregistré",
+    "saveFailed": "Échec de l'enregistrement",
+    "deleted": "Supprimé",
+    "deleteFailed": "Échec de la suppression",
+    "loadFailed": "Échec du chargement des fournisseurs SSO",
+    "cancel": "Annuler",
+    "copy": "Copier",
+    "copied": "Copié",
+    "redirectUri": "URI de redirection",
+    "redirectUriDesc": "Enregistrez cette URL comme URL de redirection ou de rappel auprès de votre fournisseur d'identité.",
+    "legacyCallback": "Conserver l'ancienne URI de redirection",
+    "legacyCallbackDesc": "Ce fournisseur a été configuré avant Termix 2.9 et utilise toujours l'ancienne URI de redirection, qui reste fonctionnelle. Pour passer à la nouvelle, ajoutez d'abord {{uri}} à votre fournisseur d'identité, puis désactivez-le.",
+    "authorizationUrl": "URL d'autorisation : {{url}}"
+  },
+  "fields": {
+    "clientId": "ID client",
+    "clientSecret": "Secret client",
+    "secretKeep": "Un secret est préservé. Laissez cet emplacement vide pour le conserver.",
+    "issuerUrl": "URL de l'émetteur",
+    "authUrl": "URL d'autorisation",
+    "tokenUrl": "URL du jeton",
+    "userIdentifier": "Chemin de l'identifiant utilisateur",
+    "displayName": "Chemin du nom affiché",
+    "scopes": "Scopes",
+    "userinfoUrl": "URL Userinfo personnalisée",
+    "groupClaim": "Revendication de groupe",
+    "groupClaimDesc": "Facultatif. Chemin de la revendication contenant les groupes de l'utilisateur. Par défaut : groups, roles, puis group. Utilisez ce champ pour les fournisseurs avec une revendication personnalisée (ex. Zitadel).",
+    "allowedUsers": "Utilisateurs autorisés",
+    "allowedUsersDesc": "Une adresse e-mail par ligne. Laissez vide pour autoriser tout le monde.",
+    "adminGroup": "Groupe administrateur",
+    "adminGroupDesc": "Les utilisateurs de ce groupe ont les droits administrateur. Laissez vide pour désactiver la synchronisation de groupe.",
+    "caCert": "Certificat CA personnalisé",
+    "caCertDesc": "Facultatif. Certificat CA au format PEM pour les fournisseurs OIDC utilisant une CA privée ou auto-signée. Laissez vide pour utiliser le magasin de confiance du système."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Connectez-vous automatiquement avec l'authentification unique (SSO).",
+      "description": "Dirigez les visiteurs directement vers le premier fournisseur d'authentification unique (SSO) au lieu d'afficher le formulaire de connexion. La variable d'environnement OIDC_SILENT_LOGIN_DEFAULT remplace ce comportement."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "כניסה באמצעות כניסה יחידה (SSO)",
+  "loginWithProvider": "התחברות באמצעות {{name}}",
+  "loading": "טְעִינָה...",
+  "permissions": {
+    "manage": {
+      "title": "ניהול ספקי SSO",
+      "description": "הוספה, שינוי והסרה של ספקי SSO שאנשים יכולים להתחבר איתם."
+    }
+  },
+  "providers": {
+    "docsLink": "הצג מסמכים",
+    "none": "לא הוגדרו ספקי SSO.",
+    "add": "הוסף ספק",
+    "edit": "עריכת ספק",
+    "delete": "מחיקת ספק",
+    "deleteConfirm": "למחוק ספק זה? משתמשים משויכים לא יוכלו להתחבר.",
+    "name": "שם תצוגה",
+    "namePlaceholder": "ספק ה-SSO שלי",
+    "nameRequired": "נדרש שם תצוגה",
+    "type": "סוג ספק",
+    "enabled": "מופעל",
+    "save": "שמור ספק",
+    "saving": "חִסָכוֹן...",
+    "saved": "נשמר",
+    "saveFailed": "השמירה נכשלה",
+    "deleted": "נמחק",
+    "deleteFailed": "המחיקה נכשלה",
+    "loadFailed": "נכשלה טעינת ספקי SSO",
+    "cancel": "לְבַטֵל",
+    "copy": "לְהַעְתִיק",
+    "copied": "מוּעֲתָק",
+    "redirectUri": "כתובת URL להפניה מחדש",
+    "redirectUriDesc": "רשום כתובת URL זו ככתובת URL להפניה או לקריאה חוזרת בספק הזהויות שלך.",
+    "legacyCallback": "שמור את כתובת ה-URI הישנה להפניה",
+    "legacyCallbackDesc": "ספק זה הוגדר לפני Termix 2.9 ועדיין משתמש ב-URI להפניה מחדש הישן, שממשיך לעבוד. כדי לעבור ל-URI החדש, הוסף תחילה {{uri}} לספק הזהויות שלך, ולאחר מכן כבה אפשרות זו.",
+    "authorizationUrl": "כתובת אתר לאימות: {{url}}"
+  },
+  "fields": {
+    "clientId": "מזהה לקוח",
+    "clientSecret": "סוד הלקוח",
+    "secretKeep": "סוד נשמר. השאר שדה זה ריק כדי לשמור אותו.",
+    "issuerUrl": "כתובת URL של המנפיק",
+    "authUrl": "כתובת אתר להרשאה",
+    "tokenUrl": "כתובת אתר של אסימון",
+    "userIdentifier": "נתיב מזהה המשתמש",
+    "displayName": "נתיב שם התצוגה",
+    "scopes": "טווחים",
+    "userinfoUrl": "עקיפת כתובת URL של פרטי משתמש",
+    "groupClaim": "תביעה קבוצתית",
+    "groupClaimDesc": "אופציונלי. נתיב התביעה המכיל את קבוצות המשתמש. ברירת המחדל היא קבוצות, תפקידים ולאחר מכן קבוצה. השתמש באפשרות זו עבור ספקים עם תביעה מותאמת אישית (למשל Zitadel).",
+    "allowedUsers": "משתמשים מורשים",
+    "allowedUsersDesc": "אימייל אחד בכל שורה. יש להשאיר ריק כדי לאפשר את כולם.",
+    "adminGroup": "קבוצת ניהול",
+    "adminGroupDesc": "למשתמשים בקבוצה זו יש הרשאה לניהול. יש להשאיר ריק כדי להשבית את סנכרון הקבוצה.",
+    "caCert": "תעודת CA מותאמת אישית",
+    "caCertDesc": "אופציונלי. אישור CA מקודד PEM עבור ספקי OIDC המשתמשים באישור CA פרטי או חתום עצמית. השאר ריק כדי להשתמש במאגר האמון של המערכת."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "כניסה אוטומטית באמצעות SSO",
+      "description": "שלח מבקרים ישירות לספק ה-SSO הראשון במקום להציג את טופס ההתחברות. משתנה הסביבה OIDC_SILENT_LOGIN_DEFAULT עוקף זאת."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "{{name}} से लॉगिन करें",
+  "loading": "लोड हो रहा है...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "दस्तावेज़ देखें",
+    "none": "कोई SSO प्रदाता कॉन्फ़िगर नहीं है।",
+    "add": "प्रदाता जोड़ें",
+    "edit": "प्रदाता संपादित करें",
+    "delete": "प्रदाता हटाएँ",
+    "deleteConfirm": "इस प्रदाता को हटाएँ? इससे जुड़े उपयोगकर्ता लॉगिन नहीं कर पाएंगे।",
+    "name": "प्रदर्शन नाम",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "प्रदाता प्रकार",
+    "enabled": "सक्षम",
+    "save": "प्रदाता सहेजें",
+    "saving": "सहेजा जा रहा है...",
+    "saved": "सहेजा गया",
+    "saveFailed": "सहेजने में विफल",
+    "deleted": "हटाया गया",
+    "deleteFailed": "हटाने में विफल",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "रद्द करें",
+    "copy": "कॉपी",
+    "copied": "कॉपी किया गया",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "क्लाइंट आईडी",
+    "clientSecret": "क्लाइंट सीक्रेट",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "जारीकर्ता URL",
+    "authUrl": "प्राधिकरण URL",
+    "tokenUrl": "टोकन URL",
+    "userIdentifier": "उपयोगकर्ता पहचानकर्ता पथ",
+    "displayName": "प्रदर्शन नाम पथ",
+    "scopes": "स्कोप",
+    "userinfoUrl": "Userinfo URL ओवरराइड करें",
+    "groupClaim": "समूह दावा",
+    "groupClaimDesc": "वैकल्पिक। वह दावा पथ जिसमें उपयोगकर्ता के समूह शामिल हैं। डिफ़ॉल्ट रूप से groups, roles, फिर group होता है। कस्टम दावे वाले प्रदाताओं के लिए इसका उपयोग करें (जैसे Zitadel)।",
+    "allowedUsers": "अनुमत उपयोगकर्ता",
+    "allowedUsersDesc": "प्रति पंक्ति एक ईमेल। सभी को अनुमति देने के लिए खाली छोड़ें।",
+    "adminGroup": "व्यवस्थापक समूह",
+    "adminGroupDesc": "इस समूह के उपयोगकर्ताओं को व्यवस्थापक अधिकार दिए जाते हैं। समूह सिंक अक्षम करने के लिए खाली छोड़ें।",
+    "caCert": "कस्टम CA प्रमाणपत्र",
+    "caCertDesc": "वैकल्पिक। निजी या स्व-हस्ताक्षरित CA का उपयोग करने वाले OIDC प्रदाताओं के लिए PEM-एन्कोडेड CA प्रमाणपत्र। सिस्टम ट्रस्ट स्टोर का उपयोग करने के लिए खाली छोड़ें।"
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Bejelentkezés egyszeri bejelentkezéssel",
+  "loginWithProvider": "Bejelentkezés {{name}} használatával",
+  "loading": "Terhelés...",
+  "permissions": {
+    "manage": {
+      "title": "SSO-szolgáltatók kezelése",
+      "description": "Hozzáadhatja, módosíthatja és eltávolíthatja azokat az SSO-szolgáltatókat, amelyekkel a felhasználók bejelentkezhetnek."
+    }
+  },
+  "providers": {
+    "docsLink": "Dokumentumok megtekintése",
+    "none": "Nincsenek konfigurálva SSO-szolgáltatók.",
+    "add": "Szolgáltató hozzáadása",
+    "edit": "Szolgáltató szerkesztése",
+    "delete": "Szolgáltató törlése",
+    "deleteConfirm": "Törli ezt a szolgáltatót? A társított felhasználók nem fognak tudni bejelentkezni.",
+    "name": "Megjelenített név",
+    "namePlaceholder": "Az SSO-szolgáltatóm",
+    "nameRequired": "Megjelenített név megadása kötelező",
+    "type": "Szolgáltató típusa",
+    "enabled": "Engedélyezve",
+    "save": "Szolgáltató mentése",
+    "saving": "Megtakarítás...",
+    "saved": "Mentett",
+    "saveFailed": "Nem sikerült menteni",
+    "deleted": "Törölt",
+    "deleteFailed": "Nem sikerült törölni",
+    "loadFailed": "Nem sikerült betölteni az SSO-szolgáltatókat",
+    "cancel": "Mégsem",
+    "copy": "Másolat",
+    "copied": "Másolva",
+    "redirectUri": "Átirányítási URI",
+    "redirectUriDesc": "Regisztrálja ezt az URL-címet átirányítási vagy visszahívási URL-címként az identitásszolgáltatójában.",
+    "legacyCallback": "Tartsa meg a régi átirányítási URI-t",
+    "legacyCallbackDesc": "Ez a szolgáltató a Termix 2.9 előtt lett beállítva, és továbbra is a régi átirányítási URI-t használja, amely továbbra is működik. Az újra való áttéréshez először add hozzá a {{uri}} karakterláncot az identitásszolgáltatódhoz, majd kapcsold ki ezt.",
+    "authorizationUrl": "Engedélyezési URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Ügyfél-azonosító",
+    "clientSecret": "Ügyféltitkos kód",
+    "secretKeep": "Egy titok elmentve. Hagyd ezt üresen, hogy megmaradjon.",
+    "issuerUrl": "Kibocsátó URL-címe",
+    "authUrl": "Engedélyezési URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "Felhasználói azonosító útvonala",
+    "displayName": "Megjelenített név útvonala",
+    "scopes": "Hatókör",
+    "userinfoUrl": "Felhasználói adatok URL-címének felülbírálása",
+    "groupClaim": "Csoportos követelés",
+    "groupClaimDesc": "Opcionális. A felhasználó csoportjait tartalmazó igénylési útvonal. Alapértelmezés szerint csoportok, szerepkörök, majd csoport. Ezt egyéni igényléssel rendelkező szolgáltatóknál használja (pl. Zitadel).",
+    "allowedUsers": "Engedélyezett felhasználók",
+    "allowedUsersDesc": "Egy e-mail cím soronként. Hagyja üresen, ha az összeset engedélyezi.",
+    "adminGroup": "Adminisztrátori csoport",
+    "adminGroupDesc": "A csoport felhasználói adminisztrátori jogosultsággal rendelkeznek. Hagyja üresen a csoport szinkronizálásának letiltásához.",
+    "caCert": "Egyéni CA tanúsítvány",
+    "caCertDesc": "Opcionális. PEM-kódolású CA-tanúsítvány OIDC-szolgáltatók számára, privát vagy önaláírt CA-t használva. Hagyja üresen a rendszer megbízható tárolójának használatához."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Automatikus bejelentkezés egyszeri bejelentkezéssel",
+      "description": "A látogatókat közvetlenül az első SSO-szolgáltatóhoz irányítsa a bejelentkezési űrlap megjelenítése helyett. Az OIDC_SILENT_LOGIN_DEFAULT környezeti változó felülírja ezt."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Loading...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Saving...",
+    "saved": "Saved",
+    "saveFailed": "Failed to save",
+    "deleted": "Deleted",
+    "deleteFailed": "Failed to delete",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancel",
+    "copy": "Copy",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Accedi con SSO",
+  "loginWithProvider": "Accedi con {{name}}",
+  "loading": "Caricamento...",
+  "permissions": {
+    "manage": {
+      "title": "Gestire i provider SSO",
+      "description": "Aggiungi, modifica e rimuovi i provider SSO con cui gli utenti possono accedere."
+    }
+  },
+  "providers": {
+    "docsLink": "Vedi documenti",
+    "none": "Nessun provider SSO configurato.",
+    "add": "Aggiungi provider",
+    "edit": "Modifica provider",
+    "delete": "Elimina provider",
+    "deleteConfirm": "Eliminare questo provider? Gli utenti associati non potranno più accedere.",
+    "name": "Nome visualizzato",
+    "namePlaceholder": "Il mio provider SSO",
+    "nameRequired": "È richiesto un nome visualizzato",
+    "type": "Tipo provider",
+    "enabled": "Abilitato",
+    "save": "Salva provider",
+    "saving": "Salvando...",
+    "saved": "Salvato",
+    "saveFailed": "Salvataggio non riuscito",
+    "deleted": "Eliminato",
+    "deleteFailed": "Eliminazione non riuscita",
+    "loadFailed": "Impossibile caricare i provider SSO",
+    "cancel": "Annulla",
+    "copy": "Copia",
+    "copied": "Copiato",
+    "redirectUri": "URI di reindirizzamento",
+    "redirectUriDesc": "Registra questo URL come URL di reindirizzamento o di callback nel tuo provider di identità.",
+    "legacyCallback": "Mantieni il vecchio URI di reindirizzamento",
+    "legacyCallbackDesc": "Questo provider è stato configurato prima di Termix 2.9 e utilizza ancora il vecchio URI di reindirizzamento, che continua a funzionare. Per passare a quello nuovo, aggiungi prima {{uri}} al tuo provider di identità, quindi disattiva questa opzione.",
+    "authorizationUrl": "URL di autorizzazione: {{url}}"
+  },
+  "fields": {
+    "clientId": "ID client",
+    "clientSecret": "Segreto client",
+    "secretKeep": "Un segreto è stato custodito. Lascia questo campo vuoto per mantenerlo.",
+    "issuerUrl": "URL dell'emittente",
+    "authUrl": "URL di autorizzazione",
+    "tokenUrl": "URL token",
+    "userIdentifier": "Percorso identificatore utente",
+    "displayName": "Percorso nome visualizzato",
+    "scopes": "Ambiti",
+    "userinfoUrl": "Sovrascrivi URL Userinfo",
+    "groupClaim": "Attributo gruppo",
+    "groupClaimDesc": "Opzionale. Il percorso dell'attributo contenente i gruppi dell'utente. Il valore predefinito è groups, roles, quindi group. Da utilizzare per provider con un attributo personalizzato (es. Zitadel).",
+    "allowedUsers": "Utenti consentiti",
+    "allowedUsersDesc": "Un'email per riga. Lascia vuoto per consentire a tutti.",
+    "adminGroup": "Gruppo amministratori",
+    "adminGroupDesc": "Gli utenti di questo gruppo ottengono i diritti di amministratore. Lascia vuoto per disabilitare la sincronizzazione dei gruppi.",
+    "caCert": "Certificato CA personalizzato",
+    "caCertDesc": "Opzionale. Certificato CA in formato PEM per provider OIDC che utilizzano una CA privata o autofirmata. Lascia vuoto per usare l'archivio dei certificati attendibili di sistema."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Accedi automaticamente con SSO",
+      "description": "Indirizza i visitatori direttamente al primo provider SSO anziché mostrare il modulo di accesso. La variabile d'ambiente OIDC_SILENT_LOGIN_DEFAULT sovrascrive questa impostazione."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "SSOでサインイン",
+  "loginWithProvider": "{{name}}でログイン",
+  "loading": "読み込み中...",
+  "permissions": {
+    "manage": {
+      "title": "SSOプロバイダーを管理する",
+      "description": "ユーザーがサインインに使用できるSSOプロバイダーを追加、変更、削除します。"
+    }
+  },
+  "providers": {
+    "docsLink": "ドキュメントを見る",
+    "none": "SSOプロバイダーが設定されていません。",
+    "add": "追加",
+    "edit": "編集",
+    "delete": "削除",
+    "deleteConfirm": "このプロバイダーを削除しますか？関連付けられているユーザーはログインできなくなります。",
+    "name": "表示名",
+    "namePlaceholder": "私のSSOプロバイダー",
+    "nameRequired": "表示名は必須です",
+    "type": "プロバイダータイプ",
+    "enabled": "有効",
+    "save": "保存",
+    "saving": "保存中...",
+    "saved": "保存しました",
+    "saveFailed": "保存に失敗しました",
+    "deleted": "削除しました",
+    "deleteFailed": "削除に失敗しました",
+    "loadFailed": "SSOプロバイダーの読み込みに失敗しました",
+    "cancel": "キャンセル",
+    "copy": "コピー",
+    "copied": "コピーしました",
+    "redirectUri": "リダイレクトURI",
+    "redirectUriDesc": "このURLを、ご利用のIDプロバイダーのリダイレクトURLまたはコールバックURLとして登録してください。",
+    "legacyCallback": "古いリダイレクトURIを保持する",
+    "legacyCallbackDesc": "このプロバイダはTermix 2.9より前に設定されたもので、古いリダイレクトURIがまだ使用されていますが、これは引き続き機能します。新しいURIに移行するには、まずIDプロバイダに {{uri}} を追加し、その後この設定を無効にしてください。",
+    "authorizationUrl": "認証URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "クライアントID",
+    "clientSecret": "クライアントシークレット",
+    "secretKeep": "秘密が守られました。秘密を守るには、この欄を空欄のままにしてください。",
+    "issuerUrl": "発行者URL",
+    "authUrl": "認証URL",
+    "tokenUrl": "トークンURL",
+    "userIdentifier": "ユーザー識別子パス",
+    "displayName": "表示名パス",
+    "scopes": "スコープ",
+    "userinfoUrl": "Userinfo URLの上書き",
+    "groupClaim": "グループクレーム",
+    "groupClaimDesc": "オプション。ユーザーのグループを含むクレームパス。デフォルトは groups, roles, group の順。カスタムクレームを使うプロバイダー用 (例: Zitadel)。",
+    "allowedUsers": "許可ユーザー",
+    "allowedUsersDesc": "1行に1つのメールアドレス。空の場合は全員許可。",
+    "adminGroup": "管理者グループ",
+    "adminGroupDesc": "このグループのユーザーは管理者権限が付与されます。空にするとグループ同期は無効です。",
+    "caCert": "カスタムCA証明書",
+    "caCertDesc": "オプション。プライベートまたは自己署名CAを使用するOIDCプロバイダー用のPEMエンコードCA証明書。空の場合はシステムの信頼ストアを使用。"
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "SSOで自動的にサインイン",
+      "description": "ログインフォームを表示せずに、訪問者を最初のSSOプロバイダーに直接誘導します。この設定は、環境変数OIDC_SILENT_LOGIN_DEFAULTで上書きされます。"
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "SSO로 로그인",
+  "loginWithProvider": "{{name}}으로 로그인",
+  "loading": "로딩 중...",
+  "permissions": {
+    "manage": {
+      "title": "SSO 제공업체 관리",
+      "description": "사용자가 로그인할 수 있는 SSO 제공업체를 추가, 변경 및 삭제할 수 있습니다."
+    }
+  },
+  "providers": {
+    "docsLink": "문서 보기",
+    "none": "설정된 SSO 제공자가 없습니다.",
+    "add": "제공자 추가",
+    "edit": "제공자 편집",
+    "delete": "제공자 삭제",
+    "deleteConfirm": "이 제공자를 삭제하시겠습니까? 연결된 사용자는 로그인할 수 없습니다.",
+    "name": "표시 이름",
+    "namePlaceholder": "내 SSO 제공업체",
+    "nameRequired": "표시 이름은 필수입니다.",
+    "type": "제공자 유형",
+    "enabled": "사용",
+    "save": "제공자 저장",
+    "saving": "저장 중...",
+    "saved": "저장됨",
+    "saveFailed": "저장 실패",
+    "deleted": "삭제됨",
+    "deleteFailed": "삭제 실패",
+    "loadFailed": "SSO 공급자를 로드하는 데 실패했습니다.",
+    "cancel": "취소",
+    "copy": "복사",
+    "copied": "복사됨",
+    "redirectUri": "리디렉션 URI",
+    "redirectUriDesc": "이 URL을 ID 공급자에서 리디렉션 또는 콜백 URL로 등록하세요.",
+    "legacyCallback": "기존 리디렉션 URI를 유지하세요",
+    "legacyCallbackDesc": "이 공급자는 Termix 2.9 이전에 설정되었으며 여전히 이전 리디렉션 URI를 사용하고 있지만 정상적으로 작동합니다. 새 URI로 전환하려면 먼저 ID 공급자에 {{uri}} 를 추가한 다음 이 기능을 비활성화하십시오.",
+    "authorizationUrl": "인증 URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "클라이언트 ID",
+    "clientSecret": "클라이언트 시크릿",
+    "secretKeep": "비밀이 저장되었습니다. 비밀을 지키려면 이 칸을 비워 두세요.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "인증 URL",
+    "tokenUrl": "토큰 URL",
+    "userIdentifier": "사용자 식별자 경로",
+    "displayName": "표시 이름 경로",
+    "scopes": "스코프",
+    "userinfoUrl": "Userinfo URL 재정의",
+    "groupClaim": "그룹 클레임",
+    "groupClaimDesc": "선택 사항입니다. 사용자 그룹이 포함된 클레임 경로입니다. 기본값은 groups, roles, group 순서로 검색됩니다. 사용자 정의 클레임이 있는 제공자(예: Zitadel)의 경우 이 값을 사용하세요.",
+    "allowedUsers": "허용 사용자",
+    "allowedUsersDesc": "한 줄에 이메일 하나씩 입력하세요. 비워두면 모두 허용됩니다.",
+    "adminGroup": "관리자 그룹",
+    "adminGroupDesc": "이 그룹의 사용자에게 관리자 권한이 부여됩니다. 비워두면 그룹 동기화가 비활성화됩니다.",
+    "caCert": "사용자 정의 CA 인증서",
+    "caCertDesc": "선택 사항입니다. 개인 또는 자체 서명 CA를 사용하는 OIDC 제공자를 위한 PEM 인코딩 CA 인증서입니다. 비워두면 시스템 신뢰 저장소가 사용됩니다."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "SSO로 자동 로그인",
+      "description": "방문자를 로그인 양식을 표시하는 대신 첫 번째 SSO 제공업체로 바로 보냅니다. OIDC_SILENT_LOGIN_DEFAULT 환경 변수는 이 설정을 재정의합니다."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Loading...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Saving...",
+    "saved": "Saved",
+    "saveFailed": "Failed to save",
+    "deleted": "Deleted",
+    "deleteFailed": "Failed to delete",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancel",
+    "copy": "Copy",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Laster...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Aktivert",
+    "save": "Save Provider",
+    "saving": "Lagrer...",
+    "saved": "Saved",
+    "saveFailed": "Kunne ikke lagre",
+    "deleted": "Deleted",
+    "deleteFailed": "Kunne ikke slette",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Avbryt",
+    "copy": "Kopier",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Klient-ID",
+    "clientSecret": "Klienthemmelighet",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Utsteder-URL",
+    "authUrl": "Autorisasjons-URL",
+    "tokenUrl": "Token-URL",
+    "userIdentifier": "Sti til brukeridentifikator",
+    "displayName": "Sti til visningsnavn",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Zaloguj się za pomocą {{name}}",
+  "loading": "Ładowanie...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "Zobacz dokumentację",
+    "none": "Nie skonfigurowano dostawców SSO.",
+    "add": "Dodaj dostawcę",
+    "edit": "Edytuj dostawcę",
+    "delete": "Usuń dostawcę",
+    "deleteConfirm": "Usunąć tego dostawcę? Powiązani użytkownicy nie będą mogli się zalogować.",
+    "name": "Nazwa wyświetlana",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Typ dostawcy",
+    "enabled": "Włączona",
+    "save": "Zapisz dostawcę",
+    "saving": "Zapisywanie...",
+    "saved": "Zapisano",
+    "saveFailed": "Nie udało się zapisać",
+    "deleted": "Usunięto",
+    "deleteFailed": "Nie udało się usunąć",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Anuluj",
+    "copy": "Kopiuj",
+    "copied": "Skopiowano",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Identyfikator klienta",
+    "clientSecret": "Sekret klienta",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Adres URL wystawcy",
+    "authUrl": "Adres URL autoryzacji",
+    "tokenUrl": "Adres URL tokena",
+    "userIdentifier": "Ścieżka identyfikatora użytkownika",
+    "displayName": "Ścieżka nazwy wyświetlanej",
+    "scopes": "Zakresy",
+    "userinfoUrl": "Zastąp adres URL informacji o użytkowniku",
+    "groupClaim": "Claim grupy",
+    "groupClaimDesc": "Opcjonalnie. Ścieżka claimu zawierającego grupy użytkownika. Domyślnie: groups, roles, potem group. Użyj tego dla dostawców z niestandardowym claimem (np. Zitadel).",
+    "allowedUsers": "Dozwoleni użytkownicy",
+    "allowedUsersDesc": "Jeden adres e-mail w każdym wierszu. Pozostaw puste, aby zezwolić na wszystkie.",
+    "adminGroup": "Grupa administratorów",
+    "adminGroupDesc": "Użytkownicy w tej grupie otrzymują uprawnienia administratora. Pozostaw puste, aby wyłączyć synchronizację grupy.",
+    "caCert": "Niestandardowy certyfikat CA",
+    "caCertDesc": "Opcjonalnie. Certyfikat CA w formacie PEM dla dostawców OIDC korzystających z prywatnego lub samopodpisanego CA. Pozostaw puste, aby użyć systemowego magazynu zaufanych certyfikatów."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Carregando...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "Documentação",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Salvando...",
+    "saved": "Salvo",
+    "saveFailed": "Falha ao salvar",
+    "deleted": "Apagado",
+    "deleteFailed": "Falha ao apagar",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancelar",
+    "copy": "Copiar",
+    "copied": "Copiado",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Iniciar sessão com {{name}}",
+  "loading": "A carregar...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "Ver docs",
+    "none": "Nenhum provedor de SSO configurado.",
+    "add": "Adicionar Provedor",
+    "edit": "Editar Provedor",
+    "delete": "Eliminar Provedor",
+    "deleteConfirm": "Eliminar este provedor? Os utilizadores associados não poderão iniciar sessão.",
+    "name": "Nome de exibição",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Tipo de Provedor",
+    "enabled": "Ativado",
+    "save": "Guardar Provedor",
+    "saving": "A guardar...",
+    "saved": "Guardado",
+    "saveFailed": "Falha ao guardar",
+    "deleted": "Eliminado",
+    "deleteFailed": "Falha ao eliminar",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancelar",
+    "copy": "Copiar",
+    "copied": "Copiado",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "ID do cliente",
+    "clientSecret": "Segredo do cliente",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "URL do emissor",
+    "authUrl": "URL de autorização",
+    "tokenUrl": "URL do token",
+    "userIdentifier": "Caminho do identificador do utilizador",
+    "displayName": "Caminho do nome de exibição",
+    "scopes": "Âmbitos",
+    "userinfoUrl": "Substituir URL do Userinfo",
+    "groupClaim": "Atributo de grupo",
+    "groupClaimDesc": "Opcional. O caminho do atributo que contém os grupos do utilizador. Predefinido para groups, roles e depois group. Utilize para fornecedores com um atributo personalizado (ex.: Zitadel).",
+    "allowedUsers": "Utilizadores permitidos",
+    "allowedUsersDesc": "Um email por linha. Deixe em branco para permitir todos.",
+    "adminGroup": "Grupo de administração",
+    "adminGroupDesc": "Os utilizadores neste grupo recebem privilégios de administrador. Deixe em branco para desativar a sincronização de grupos.",
+    "caCert": "Certificado CA personalizado",
+    "caCertDesc": "Opcional. Certificado CA codificado em PEM para fornecedores OIDC que utilizam uma CA privada ou autoassinada. Deixe em branco para utilizar o repositório de confiança do sistema."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Conectați-vă cu SSO",
+  "loginWithProvider": "Autentificare cu {{name}}",
+  "loading": "Încărcare...",
+  "permissions": {
+    "manage": {
+      "title": "Gestionați furnizorii SSO",
+      "description": "Adăugați, modificați și eliminați furnizorii SSO cu care utilizatorii se pot conecta."
+    }
+  },
+  "providers": {
+    "docsLink": "Vizualizați documentele",
+    "none": "Nu sunt configurați furnizori SSO.",
+    "add": "Adăugați furnizor",
+    "edit": "Editați furnizorul",
+    "delete": "Ștergeți furnizorul",
+    "deleteConfirm": "Ștergeți acest furnizor? Utilizatorii asociați nu se vor putea conecta.",
+    "name": "Numele de afișare",
+    "namePlaceholder": "Furnizorul meu SSO",
+    "nameRequired": "Este obligatoriu un nume afișat",
+    "type": "Tipul furnizorului",
+    "enabled": "Activat",
+    "save": "Salvați furnizorul",
+    "saving": "Economisire...",
+    "saved": "Salvat",
+    "saveFailed": "Salvarea nu a reușit",
+    "deleted": "Șters",
+    "deleteFailed": "Ștergerea nu a reușit",
+    "loadFailed": "Furnizorii SSO nu au putut fi încărcați.",
+    "cancel": "Anula",
+    "copy": "Copie",
+    "copied": "Copiat",
+    "redirectUri": "URI de redirecționare",
+    "redirectUriDesc": "Înregistrați această adresă URL ca adresă URL de redirecționare sau de apel invers în furnizorul dvs. de identitate.",
+    "legacyCallback": "Păstrați vechiul URI de redirecționare",
+    "legacyCallbackDesc": "Acest furnizor a fost configurat înainte de Termix 2.9 și folosește în continuare vechiul URI de redirecționare, care funcționează în continuare. Pentru a trece la cel nou, adăugați mai întâi {{uri}} în furnizorul de identitate, apoi dezactivați-l.",
+    "authorizationUrl": "URL de autorizare: {{url}}"
+  },
+  "fields": {
+    "clientId": "ID client",
+    "clientSecret": "Secretul clientului",
+    "secretKeep": "Un secret este salvat. Lăsați acest câmp gol pentru a-l păstra.",
+    "issuerUrl": "URL-ul emitentului",
+    "authUrl": "URL de autorizare",
+    "tokenUrl": "Adresa URL a jetonului",
+    "userIdentifier": "Calea de identificare a utilizatorului",
+    "displayName": "Calea numelui afișat",
+    "scopes": "Scopuri",
+    "userinfoUrl": "Suprascrieți adresa URL a informațiilor utilizatorului",
+    "groupClaim": "Revendicare de grup",
+    "groupClaimDesc": "Opțional. Calea de revendicare care conține grupurile utilizatorului. Implicit, se utilizează grupuri, roluri, apoi grup. Folosiți această opțiune pentru furnizorii cu o revendicare personalizată (de exemplu, Zitadel).",
+    "allowedUsers": "Utilizatori permiși",
+    "allowedUsersDesc": "Un e-mail pe rând. Lăsați necompletat pentru a permite accesul tuturor.",
+    "adminGroup": "Grup de administratori",
+    "adminGroupDesc": "Utilizatorii din acest grup au drepturi de administrator. Lăsați câmpul gol pentru a dezactiva sincronizarea grupului.",
+    "caCert": "Certificat CA personalizat",
+    "caCertDesc": "Opțional. Certificat CA codificat PEM pentru furnizorii OIDC care utilizează un CA privat sau autosemnat. Lăsați câmpul gol pentru a utiliza depozitul de încredere al sistemului."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Conectați-vă automat cu SSO",
+      "description": "Trimiteți vizitatorii direct către primul furnizor SSO în loc să afișați formularul de conectare. Variabila de mediu OIDC_SILENT_LOGIN_DEFAULT are prioritate față de această opțiune."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Войти через {{name}}",
+  "loading": "Загрузка...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "Документация",
+    "none": "Нет настроенных провайдеров SSO.",
+    "add": "Добавить провайдера",
+    "edit": "Редактировать провайдера",
+    "delete": "Удалить провайдера",
+    "deleteConfirm": "Удалить провайдера? Связанные пользователи не смогут войти.",
+    "name": "Отображаемое имя",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Тип провайдера",
+    "enabled": "Включено",
+    "save": "Сохранить провайдера",
+    "saving": "Сохранение…",
+    "saved": "Сохранено",
+    "saveFailed": "Не удалось сохранить",
+    "deleted": "Удалено",
+    "deleteFailed": "Не удалось удалить",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Отмена",
+    "copy": "Копировать",
+    "copied": "Скопировано",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "URL издателя",
+    "authUrl": "URL авторизации",
+    "tokenUrl": "URL токена",
+    "userIdentifier": "Путь к идентификатору пользователя",
+    "displayName": "Путь к отображаемому имени",
+    "scopes": "Области",
+    "userinfoUrl": "Переопределить URL Userinfo",
+    "groupClaim": "Утверждение группы",
+    "groupClaimDesc": "Необязательно. Путь к утверждению, содержащему группы пользователя. По умолчанию проверяются groups, roles, затем group. Используйте для провайдеров с настраиваемым утверждением (например, Zitadel).",
+    "allowedUsers": "Разрешенные пользователи",
+    "allowedUsersDesc": "По одному email на строку. Оставьте пустым, чтобы разрешить всем.",
+    "adminGroup": "Группа администраторов",
+    "adminGroupDesc": "Пользователи в этой группе получают права администратора. Оставьте пустым, чтобы отключить синхронизацию групп.",
+    "caCert": "Пользовательский сертификат ЦС",
+    "caCertDesc": "Необязательно. Сертификат ЦС в формате PEM для провайдеров OIDC, использующих частный или самоподписанный ЦС. Оставьте пустым, чтобы использовать системное хранилище доверенных сертификатов."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Loading...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Saving...",
+    "saved": "Saved",
+    "saveFailed": "Failed to save",
+    "deleted": "Deleted",
+    "deleteFailed": "Failed to delete",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancel",
+    "copy": "Copy",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Loading...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Saving...",
+    "saved": "Saved",
+    "saveFailed": "Failed to save",
+    "deleted": "Deleted",
+    "deleteFailed": "Failed to delete",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancel",
+    "copy": "Copy",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Loading...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Saving...",
+    "saved": "Saved",
+    "saveFailed": "Failed to save",
+    "deleted": "Deleted",
+    "deleteFailed": "Failed to delete",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancel",
+    "copy": "Copy",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "{{name}} ile giriş yap",
+  "loading": "Yükleniyor...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "Belgelere bak",
+    "none": "Hiçbir SSO sağlayıcısı yapılandırılmamış.",
+    "add": "Sağlayıcı Ekle",
+    "edit": "Sağlayıcıyı Düzenle",
+    "delete": "Sağlayıcıyı Sil",
+    "deleteConfirm": "Bu sağlayıcı silinsin mi? İlişkili kullanıcılar oturum açamaz.",
+    "name": "Görünen Ad",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Sağlayıcı Türü",
+    "enabled": "Etkin",
+    "save": "Sağlayıcıyı Kaydet",
+    "saving": "Kaydediliyor...",
+    "saved": "Kaydedildi",
+    "saveFailed": "Kaydedilemedi",
+    "deleted": "Silindi",
+    "deleteFailed": "Silinemedi",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "İptal",
+    "copy": "Kopyala",
+    "copied": "Kopyalandı",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "İstemci Kimliği",
+    "clientSecret": "İstemci Sırrı",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Sağlayıcı URL'si",
+    "authUrl": "Yetkilendirme URL'si",
+    "tokenUrl": "Belirteç URL'si",
+    "userIdentifier": "Kullanıcı Tanımlayıcı Yolu",
+    "displayName": "Görünen Ad Yolu",
+    "scopes": "Kapsamlar",
+    "userinfoUrl": "Userinfo URL'sini Geçersiz Kıl",
+    "groupClaim": "Grup Talebi",
+    "groupClaimDesc": "İsteğe bağlı. Kullanıcının gruplarını içeren talep yolu. Varsayılan olarak groups, roles, ardından group kullanılır. Özel talep kullanan sağlayıcılar için bunu kullanın (örn. Zitadel).",
+    "allowedUsers": "İzin Verilen Kullanıcılar",
+    "allowedUsersDesc": "Her satıra bir e-posta. Tümüne izin vermek için boş bırakın.",
+    "adminGroup": "Yönetici Grubu",
+    "adminGroupDesc": "Bu gruptaki kullanıcılara yönetici yetkisi verilir. Grup eşitlemeyi devre dışı bırakmak için boş bırakın.",
+    "caCert": "Özel CA Sertifikası",
+    "caCertDesc": "İsteğe bağlı. Özel veya kendinden imzalı CA kullanan OIDC sağlayıcıları için PEM kodlu CA sertifikası. Sistem güven deposunu kullanmak için boş bırakın."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Login with {{name}}",
+  "loading": "Loading...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "View docs",
+    "none": "No SSO providers configured.",
+    "add": "Add Provider",
+    "edit": "Edit Provider",
+    "delete": "Delete Provider",
+    "deleteConfirm": "Delete this provider? Associated users will be unable to login.",
+    "name": "Display Name",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Provider Type",
+    "enabled": "Enabled",
+    "save": "Save Provider",
+    "saving": "Saving...",
+    "saved": "Saved",
+    "saveFailed": "Failed to save",
+    "deleted": "Deleted",
+    "deleteFailed": "Failed to delete",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Cancel",
+    "copy": "Copy",
+    "copied": "Copied",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "Authorization URL",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "User Identifier Path",
+    "displayName": "Display Name Path",
+    "scopes": "Scopes",
+    "userinfoUrl": "Override Userinfo URL",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Optional. The claim path that contains the user's groups. Defaults to groups, roles, then group. Use this for providers with a custom claim (e.g. Zitadel).",
+    "allowedUsers": "Allowed Users",
+    "allowedUsersDesc": "One email per line. Leave empty to allow all.",
+    "adminGroup": "Admin Group",
+    "adminGroupDesc": "Users in this group are granted admin. Leave empty to disable group sync.",
+    "caCert": "Custom CA Certificate",
+    "caCertDesc": "Optional. PEM-encoded CA certificate for OIDC providers using a private or self-signed CA. Leave empty to use the system trust store."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "Đăng nhập bằng {{name}}",
+  "loading": "Đang tải...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "Xem tài liệu",
+    "none": "Chưa có nhà cung cấp SSO.",
+    "add": "Thêm nhà cung cấp",
+    "edit": "Chỉnh sửa nhà cung cấp",
+    "delete": "Xóa nhà cung cấp",
+    "deleteConfirm": "Xóa nhà cung cấp này? Người dùng liên kết sẽ không thể đăng nhập.",
+    "name": "Tên hiển thị",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "Loại nhà cung cấp",
+    "enabled": "Đã bật",
+    "save": "Lưu nhà cung cấp",
+    "saving": "Đang lưu...",
+    "saved": "Đã lưu",
+    "saveFailed": "Không thể lưu",
+    "deleted": "Đã xóa",
+    "deleteFailed": "Không thể xóa",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "Hủy",
+    "copy": "Sao chép",
+    "copied": "Đã sao chép",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "Client ID",
+    "clientSecret": "Client Secret",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "Issuer URL",
+    "authUrl": "URL ủy quyền",
+    "tokenUrl": "Token URL",
+    "userIdentifier": "Đường dẫn định danh người dùng",
+    "displayName": "Đường dẫn tên hiển thị",
+    "scopes": "Phạm vi",
+    "userinfoUrl": "Ghi đè URL Userinfo",
+    "groupClaim": "Group Claim",
+    "groupClaimDesc": "Tùy chọn. Đường dẫn claim chứa các nhóm của người dùng. Mặc định là groups, roles, rồi group. Sử dụng cho các nhà cung cấp có claim tùy chỉnh (ví dụ: Zitadel).",
+    "allowedUsers": "Người dùng được phép",
+    "allowedUsersDesc": "Mỗi email một dòng. Để trống để cho phép tất cả.",
+    "adminGroup": "Nhóm Admin",
+    "adminGroupDesc": "Người dùng trong nhóm này được cấp quyền admin. Để trống để tắt đồng bộ nhóm.",
+    "caCert": "Chứng chỉ CA tùy chỉnh",
+    "caCertDesc": "Tùy chọn. Chứng chỉ CA mã hóa PEM cho các nhà cung cấp OIDC sử dụng CA riêng hoặc tự ký. Để trống để sử dụng kho tin cậy hệ thống."
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "使用{{name}}登录",
+  "loading": "加载中...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "查看文档",
+    "none": "未配置 SSO 提供商。",
+    "add": "添加提供商",
+    "edit": "编辑提供商",
+    "delete": "删除提供商",
+    "deleteConfirm": "删除此提供商？关联用户将无法登录。",
+    "name": "显示名称",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "提供商类型",
+    "enabled": "已启用",
+    "save": "保存提供商",
+    "saving": "保存中...",
+    "saved": "已保存",
+    "saveFailed": "保存失败",
+    "deleted": "已删除",
+    "deleteFailed": "删除失败",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "取消",
+    "copy": "复制",
+    "copied": "已复制",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "客户端 ID",
+    "clientSecret": "客户端密钥",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "颁发者 URL",
+    "authUrl": "授权 URL",
+    "tokenUrl": "令牌 URL",
+    "userIdentifier": "用户标识符路径",
+    "displayName": "显示名称路径",
+    "scopes": "作用域",
+    "userinfoUrl": "覆盖 Userinfo URL",
+    "groupClaim": "组声明",
+    "groupClaimDesc": "可选。包含用户组的声明路径。默认依次使用 groups、roles、group。用于具有自定义声明的提供商（如 Zitadel）。",
+    "allowedUsers": "允许的用户",
+    "allowedUsersDesc": "每行一个邮箱。留空表示允许所有用户。",
+    "adminGroup": "管理员组",
+    "adminGroupDesc": "此组的用户将被授予管理员权限。留空可禁用组同步。",
+    "caCert": "自定义 CA 证书",
+    "caCertDesc": "可选。PEM 编码的 CA 证书，用于使用私有或自签名 CA 的 OIDC 提供商。留空则使用系统信任存储。"
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "loginWithSso": "Sign in with SSO",
+  "loginWithProvider": "使用 {{name}} 登入",
+  "loading": "載入中...",
+  "permissions": {
+    "manage": {
+      "title": "Manage SSO providers",
+      "description": "Add, change and remove the SSO providers people can sign in with."
+    }
+  },
+  "providers": {
+    "docsLink": "檢視文件",
+    "none": "尚未設定 SSO 提供者。",
+    "add": "新增提供者",
+    "edit": "編輯提供者",
+    "delete": "刪除提供者",
+    "deleteConfirm": "刪除此提供者？相關使用者將無法登入。",
+    "name": "顯示名稱",
+    "namePlaceholder": "My SSO provider",
+    "nameRequired": "A display name is required",
+    "type": "提供者類型",
+    "enabled": "已啟用",
+    "save": "儲存提供者",
+    "saving": "儲存中…",
+    "saved": "已儲存",
+    "saveFailed": "儲存失敗",
+    "deleted": "已刪除",
+    "deleteFailed": "刪除失敗",
+    "loadFailed": "Failed to load SSO providers",
+    "cancel": "取消",
+    "copy": "複製",
+    "copied": "已複製",
+    "redirectUri": "Redirect URI",
+    "redirectUriDesc": "Register this URL as the redirect or callback URL in your identity provider.",
+    "legacyCallback": "Keep the old redirect URI",
+    "legacyCallbackDesc": "This provider was set up before Termix 2.9 and still uses the old redirect URI, which keeps working. To move to the new one, add {{uri}} in your identity provider first, then turn this off.",
+    "authorizationUrl": "Authorization URL: {{url}}"
+  },
+  "fields": {
+    "clientId": "用戶端 ID",
+    "clientSecret": "用戶端密鑰",
+    "secretKeep": "A secret is saved. Leave this empty to keep it.",
+    "issuerUrl": "發行者 URL",
+    "authUrl": "授權 URL",
+    "tokenUrl": "權杖 URL",
+    "userIdentifier": "使用者識別碼路徑",
+    "displayName": "顯示名稱路徑",
+    "scopes": "範圍",
+    "userinfoUrl": "覆寫使用者資訊 URL",
+    "groupClaim": "群組宣告",
+    "groupClaimDesc": "選用。包含使用者群組的宣告路徑。預設為 groups、roles、group。用於自訂宣告的提供者（例如 Zitadel）。",
+    "allowedUsers": "允許的使用者",
+    "allowedUsersDesc": "每行一個電子郵件。留空以允許全部。",
+    "adminGroup": "管理員群組",
+    "adminGroupDesc": "此群組中的使用者將被授予管理員權限。留空以停用群組同步。",
+    "caCert": "自訂 CA 憑證",
+    "caCertDesc": "選用。PEM 編碼的 CA 憑證，用於使用私有或自簽 CA 的 OIDC 提供者。留空以使用系統信任儲存區。"
+  },
+  "settings": {
+    "silentLoginDefault": {
+      "label": "Sign in with SSO automatically",
+      "description": "Send visitors straight to the first SSO provider instead of showing the login form. The OIDC_SILENT_LOGIN_DEFAULT environment variable overrides this."
+    }
+  }
+}