Josep Piguillem
ec4f687ca8
Under the e-mail and password form, a button takes the redirect flow (Authorization Code + PKCE), so the password is only ever typed at the identity server. The routes for it were already there; the page had no way to reach them. A Pireon client allows one grant type and the panel's is a password client, so the redirect flow can use its own: PIREON_REDIRECT_CLIENT_ID and PIREON_REDIRECT_CLIENT_SECRET (the main client when they are empty). The button shows up once that client is set, or with PIREON_REDIRECT_LOGIN=true. Each session renews its token with the client that issued it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.5 KiB
PHP
29 lines
1.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
return [
|
|
'sign_in' => 'Sign in',
|
|
'sign_in_intro' => 'Sign in with your e-mail and password, or with your Pireon account.',
|
|
'continue_with_pireon' => 'Sign in with Pireon',
|
|
'signing_in' => 'Checking your credentials…',
|
|
'password_grant_disabled' => 'Password sign-in is switched off on this installation. Please tell an administrator.',
|
|
'server_unavailable' => 'The identity server is not responding. This is not about your credentials; please tell an administrator.',
|
|
'sign_out' => 'Sign out',
|
|
|
|
'denied' => 'Sign-in was not completed: :reason',
|
|
'inactive' => 'Your account is deactivated. Please contact an administrator.',
|
|
'pending_approval' => 'Your registration is still awaiting approval by an administrator.',
|
|
'no_permission' => 'Your account is not allowed into this panel. Ask an administrator to assign you a role.',
|
|
'cannot_grant_super_admin' => 'Only a super admin may grant the super admin role.',
|
|
|
|
'not_configured_title' => 'The OAuth client is not configured',
|
|
'not_configured_body' => 'Register this application at :server, then fill in PIREON_CLIENT_ID and PIREON_CLIENT_SECRET in your .env file.',
|
|
|
|
'account' => [
|
|
'remote_roles' => 'Roles on the identity server',
|
|
'remote_roles_hint' => 'Informational only: permissions for this application are managed here, not on the OAuth server.',
|
|
'managed_remotely' => 'This field is managed at :server and refreshed on every sign-in.',
|
|
],
|
|
];
|