Move access permissions to access module

2026-07-10 23:27:48 +02:00
parent a7c486788e
commit e32841077c
13 changed files with 1319 additions and 170 deletions
--- a/webui/src/api/admin.ts
+++ b/webui/src/api/admin.ts
@@ -92,6 +92,8 @@ export type UserAdminItem = {
  last_login_at?: string | null;
  groups: GroupSummary[];
  roles: RoleSummary[];
+  function_assignment_ids: string[];
+  function_delegation_ids: string[];
  effective_scopes: string[];
  is_owner: boolean;
  is_last_active_owner: boolean;
@@ -99,6 +101,63 @@ export type UserAdminItem = {
  updated_at: string;
 };

+export type AccessRoleSourceType = "direct_role" | "group_role" | "legacy_function_role" | "idm_function_role" | "system_role";
+
+export type AccessRoleSourceItem = {
+  source_type: AccessRoleSourceType;
+  role_id: string;
+  role_slug: string;
+  role_name: string;
+  permissions: string[];
+  tenant_id?: string | null;
+  group_id?: string | null;
+  group_name?: string | null;
+  function_assignment_id?: string | null;
+  function_id?: string | null;
+  function_name?: string | null;
+  organization_unit_id?: string | null;
+  organization_unit_name?: string | null;
+  identity_id?: string | null;
+  account_id?: string | null;
+  source_module?: string | null;
+  assignment_source?: string | null;
+  applies_to_subunits: boolean;
+  delegated_from_assignment_id?: string | null;
+  delegation_id?: string | null;
+  acting_for_account_id?: string | null;
+};
+
+export type AccessScopeExplanationItem = {
+  scope: string;
+  sources: AccessRoleSourceItem[];
+};
+
+export type FunctionFactExplanationItem = {
+  source_module: string;
+  assignment_id: string;
+  tenant_id: string;
+  identity_id?: string | null;
+  account_id?: string | null;
+  function_id: string;
+  function_name?: string | null;
+  organization_unit_id: string;
+  organization_unit_name?: string | null;
+  applies_to_subunits: boolean;
+  assignment_source: string;
+  status: string;
+  delegated_from_assignment_id?: string | null;
+  acting_for_account_id?: string | null;
+  role_ids: string[];
+  role_names: string[];
+};
+
+export type UserAccessExplanationResponse = {
+  user: UserAdminItem;
+  role_sources: AccessRoleSourceItem[];
+  scopes: AccessScopeExplanationItem[];
+  function_facts: FunctionFactExplanationItem[];
+};
+
 export type SystemAccountItem = {
  account_id: string;
  email: string;
@@ -400,6 +459,10 @@ export function updateUser(settings: ApiSettings, userId: string, payload: Parti
  return apiFetch(settings, `/api/v1/admin/users/${userId}`, { method: "PATCH", body: JSON.stringify(payload) });
 }

+export function fetchUserAccessExplanation(settings: ApiSettings, userId: string): Promise<UserAccessExplanationResponse> {
+  return apiFetch(settings, `/api/v1/admin/users/${userId}/access-explanation`);
+}
+
 export async function fetchGroups(settings: ApiSettings): Promise<GroupSummary[]> {
  const response = await apiFetch<{ groups: GroupSummary[] }>(settings, "/api/v1/admin/groups");
  return response.groups;
--- a/webui/src/features/admin/UsersPanel.tsx
+++ b/webui/src/features/admin/UsersPanel.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useMemo, useRef, useState } from "react";
-import { Pencil, Plus, Search, Trash2 } from "lucide-react";
+import { KeyRound, Pencil, Plus, Search, Trash2 } from "lucide-react";
 import type { ApiSettings, AuthInfo } from "@govoplan/core-webui";
-import { createUser, fetchGroupsDelta, fetchRolesDelta, fetchUsersDelta, updateUser, type GroupSummary, type RoleSummary, type UserAdminItem } from "../../api/admin";
+import { createUser, fetchGroupsDelta, fetchRolesDelta, fetchUserAccessExplanation, fetchUsersDelta, updateUser, type AccessRoleSourceItem, type FunctionFactExplanationItem, type GroupSummary, type RoleSummary, type UserAccessExplanationResponse, type UserAdminItem } from "../../api/admin";
 import { Button } from "@govoplan/core-webui";
 import { DataGrid, type DataGridColumn } from "@govoplan/core-webui";
 import { Dialog } from "@govoplan/core-webui";
@@ -42,6 +42,9 @@ export default function UsersPanel({ settings, auth, canCreate, canUpdate, canSu
  const { getDeltaWatermark, setDeltaWatermark, resetDeltaWatermark } = useDeltaWatermarks();
  const [editing, setEditing] = useState<UserAdminItem | "new" | null>(null);
  const [viewing, setViewing] = useState<UserAdminItem | null>(null);
+  const [explaining, setExplaining] = useState<UserAdminItem | null>(null);
+  const [accessExplanation, setAccessExplanation] = useState<UserAccessExplanationResponse | null>(null);
+  const [accessExplanationLoading, setAccessExplanationLoading] = useState(false);
  const [deactivating, setDeactivating] = useState<UserAdminItem | null>(null);
  const [draft, setDraft] = useState(emptyDraft);
  const [savedDraftKey, setSavedDraftKey] = useState(draftKey(emptyDraft));
@@ -161,6 +164,21 @@ export default function UsersPanel({ settings, auth, canCreate, canUpdate, canSu
    {setBusy(false);}
  }

+  async function openAccessExplanation(user: UserAdminItem) {
+    setExplaining(user);
+    setAccessExplanation(null);
+    setAccessExplanationLoading(true);
+    setError("");
+    try {
+      setAccessExplanation(await fetchUserAccessExplanation(settings, user.id));
+    } catch (err) {
+      setError(adminErrorMessage(err));
+      setExplaining(null);
+    } finally {
+      setAccessExplanationLoading(false);
+    }
+  }
+
  const columns = useMemo<DataGridColumn<UserAdminItem>[]>(() => [
  { id: "user", header: "i18n:govoplan-access.user.9f8a2389", width: "minmax(230px, 1fr)", minWidth: 210, resizable: true, sticky: "start", sortable: true, filterable: true, value: (row) => `${row.display_name || ""} ${row.email}`, render: (row) => <div><strong>{row.display_name || row.email}</strong><div className="muted small-note">{row.email}</div></div> },
  { id: "groups", header: "i18n:govoplan-access.groups.ae9629f4", width: 210, minWidth: 150, maxWidth: 420, resizable: true, sortable: true, filterable: true, value: (row) => joinLabels(row.groups) },
@@ -168,12 +186,13 @@ export default function UsersPanel({ settings, auth, canCreate, canUpdate, canSu
  { id: "scope_count", header: "i18n:govoplan-access.permissions.d06d5557", width: 110, resizable: false, sortable: true, filterable: true, filterType: "integer", value: (row) => hasTenantWildcard(row.effective_scopes) ? 999 : row.effective_scopes.length, render: (row) => hasTenantWildcard(row.effective_scopes) ? "i18n:govoplan-access.all.6a720856" : String(row.effective_scopes.length) },
  { id: "status", header: "i18n:govoplan-access.status.bae7d5be", width: 120, resizable: false, sortable: true, filterable: true, value: (row) => row.is_active && row.account_is_active ? "active" : "inactive", render: (row) => <StatusBadge status={row.is_active && row.account_is_active ? "active" : "inactive"} /> },
  { id: "last_login", header: "i18n:govoplan-access.last_login.43dab84f", width: 180, minWidth: 150, resizable: true, sortable: true, value: (row) => row.last_login_at || "", render: (row) => formatDateTime(row.last_login_at) },
-  { id: "actions", header: "i18n:govoplan-access.actions.c3cd636a", width: 150, sticky: "end", resizable: false, align: "right", render: (row) => <div className="admin-icon-actions">
+  { id: "actions", header: "i18n:govoplan-access.actions.c3cd636a", width: 190, sticky: "end", resizable: false, align: "right", render: (row) => <div className="admin-icon-actions">
      <AdminIconButton label={i18nMessage("i18n:govoplan-access.inspect_value.9d5d1071", { value0: row.email })} icon={<Search />} onClick={() => setViewing(row)} />
+      <AdminIconButton label={i18nMessage("i18n:govoplan-access.explain_access_for_value.3af96e47", { value0: row.email })} icon={<KeyRound />} onClick={() => void openAccessExplanation(row)} />
      <AdminIconButton label={i18nMessage("i18n:govoplan-access.edit_value.fad75899", { value0: row.email })} icon={<Pencil />} onClick={() => openEdit(row)} disabled={!(canUpdate || canSuspend || canManageGroups || canAssignRoles)} />
      <AdminIconButton label={i18nMessage("i18n:govoplan-access.deactivate_value.a276a667", { value0: row.email })} icon={<Trash2 />} variant="danger" onClick={() => setDeactivating(row)} disabled={!canSuspend || !row.is_active || row.is_last_active_owner} />
    </div> }],
-  [canAssignRoles, canManageGroups, canSuspend, canUpdate]);
+  [canAssignRoles, canManageGroups, canSuspend, canUpdate, settings]);

  return (
    <>
@@ -215,6 +234,48 @@ export default function UsersPanel({ settings, auth, canCreate, canUpdate, canSu
        </dl>}
      </Dialog>

+      <Dialog open={Boolean(explaining)} title="i18n:govoplan-access.access_explanation.75ee7f62" onClose={() => { if (!accessExplanationLoading) { setExplaining(null); setAccessExplanation(null); } }} className="admin-dialog admin-dialog-wide" footer={<Button onClick={() => { setExplaining(null); setAccessExplanation(null); }} disabled={accessExplanationLoading}>i18n:govoplan-access.close.bbfa773e</Button>}>
+        {accessExplanationLoading && <p className="muted small-note">i18n:govoplan-access.loading_access_explanation.04a7c934</p>}
+        {accessExplanation && <>
+          <dl className="admin-details-grid">
+            <div><dt>i18n:govoplan-access.user.9f8a2389</dt><dd>{accessExplanation.user.display_name || accessExplanation.user.email}</dd></div>
+            <div><dt>i18n:govoplan-access.account.85dfa32c</dt><dd>{accessExplanation.user.account_id}</dd></div>
+            <div><dt>i18n:govoplan-access.role_sources.6f42a672</dt><dd>{accessExplanation.role_sources.length}</dd></div>
+            <div><dt>i18n:govoplan-access.function_facts.848b32cc</dt><dd>{accessExplanation.function_facts.length}</dd></div>
+          </dl>
+          <h3>i18n:govoplan-access.role_sources.6f42a672</h3>
+          {accessExplanation.role_sources.length ? <div className="admin-assignment-grid">
+            {accessExplanation.role_sources.map((source) => <div key={sourceKey(source)}>
+              <strong>{source.role_name}</strong>
+              <div className="muted small-note">
+                <span>{sourceTypeLabel(source)}</span>
+                {source.group_name && <> - <span>i18n:govoplan-access.group.171a0606</span>: {source.group_name}</>}
+                {(source.function_name || source.function_id) && <> - <span>i18n:govoplan-access.function_fact.4f7435e4</span>: {source.function_name || source.function_id}</>}
+                {(source.organization_unit_name || source.organization_unit_id) && <> - <span>i18n:govoplan-access.organization_unit.9832b383</span>: {source.organization_unit_name || source.organization_unit_id}</>}
+              </div>
+              <AccessExplanationLinks organizationHref={organizationHrefForSource(source)} idmHref={idmHrefForSource(source)} />
+              <div className="admin-scope-list">{source.permissions.map((scope) => <code key={scope}>{scope}</code>)}</div>
+            </div>)}
+          </div> : <p className="muted small-note">i18n:govoplan-access.no_role_sources_found.91013aa5</p>}
+          <h3>i18n:govoplan-access.function_facts.848b32cc</h3>
+          {accessExplanation.function_facts.length ? <dl className="admin-details-grid">
+            {accessExplanation.function_facts.map((fact) => <div key={fact.assignment_id}>
+              <dt>{fact.function_name || fact.function_id}</dt>
+              <dd>
+                <span>i18n:govoplan-access.organization_unit.9832b383</span>: {fact.organization_unit_name || fact.organization_unit_id}<br />
+                <span>i18n:govoplan-access.assignment_source.5fac1f72</span>: {fact.assignment_source}<br />
+                <span>i18n:govoplan-access.mapped_roles.504d9ff9</span>: {factRoles(fact)}
+                <AccessExplanationLinks organizationHref={organizationHrefForFact(fact)} idmHref={idmHrefForFact(fact)} />
+              </dd>
+            </div>)}
+          </dl> : <p className="muted small-note">i18n:govoplan-access.no_function_facts_found.b2ecee17</p>}
+          <h3>i18n:govoplan-access.effective_permissions.17c0fe8a</h3>
+          <div className="admin-scope-list">
+            {accessExplanation.scopes.map((scope) => <code key={scope.scope} title={scope.sources.map((source) => source.role_name).join(", ")}>{scope.scope}</code>)}
+          </div>
+        </>}
+      </Dialog>
+
      <Dialog open={Boolean(temporaryPassword)} title="i18n:govoplan-access.temporary_password.62d60628" onClose={() => setTemporaryPassword(null)} className="admin-dialog" footer={<Button variant="primary" onClick={() => setTemporaryPassword(null)}>i18n:govoplan-access.i_have_recorded_it.7522da18</Button>}>
        {temporaryPassword && <><p>i18n:govoplan-access.this_is_shown_once_for.b0f0f526 <strong>{temporaryPassword.email}</strong>.</p><code className="admin-secret">{temporaryPassword.password}</code><p className="muted small-note">i18n:govoplan-access.transmit_it_through_a_separate_secure_channel.ab892c7b</p></>}
      </Dialog>
@@ -241,3 +302,83 @@ function sortTenantRoles(left: RoleSummary, right: RoleSummary): number {
  if (builtinDelta !== 0) return builtinDelta;
  return left.name.localeCompare(right.name);
 }
+
+function sourceKey(source: AccessRoleSourceItem): string {
+  return [
+    source.source_type,
+    source.role_id,
+    source.group_id || "",
+    source.function_assignment_id || "",
+    source.function_id || ""
+  ].join(":");
+}
+
+function AccessExplanationLinks({ organizationHref, idmHref }: { organizationHref: string | null; idmHref: string | null }) {
+  if (!organizationHref && !idmHref) return null;
+  return (
+    <div className="muted small-note">
+      {organizationHref && <a href={organizationHref} title="i18n:govoplan-access.open_organizations">i18n:govoplan-access.open_organizations</a>}
+      {organizationHref && idmHref && <span> | </span>}
+      {idmHref && <a href={idmHref} title="i18n:govoplan-access.open_idm_assignment">i18n:govoplan-access.open_idm_assignment</a>}
+    </div>
+  );
+}
+
+function organizationHrefForSource(source: AccessRoleSourceItem): string | null {
+  return organizationHref(source.function_id, source.organization_unit_id);
+}
+
+function organizationHrefForFact(fact: FunctionFactExplanationItem): string | null {
+  return organizationHref(fact.function_id, fact.organization_unit_id);
+}
+
+function organizationHref(functionId?: string | null, unitId?: string | null): string | null {
+  const params = new URLSearchParams();
+  if (functionId) {
+    params.set("section", "functions");
+    params.set("function_id", functionId);
+    if (unitId) params.set("unit_id", unitId);
+  } else if (unitId) {
+    params.set("section", "units");
+    params.set("unit_id", unitId);
+  }
+  const query = params.toString();
+  return query ? `/organizations?${query}` : null;
+}
+
+function idmHrefForSource(source: AccessRoleSourceItem): string | null {
+  return idmHref(source.function_assignment_id, source.function_id);
+}
+
+function idmHrefForFact(fact: FunctionFactExplanationItem): string | null {
+  return idmHref(fact.assignment_id, fact.function_id);
+}
+
+function idmHref(assignmentId?: string | null, functionId?: string | null): string | null {
+  const params = new URLSearchParams();
+  if (assignmentId) params.set("assignment_id", assignmentId);
+  if (functionId) params.set("function_id", functionId);
+  const query = params.toString();
+  return query ? `/idm?${query}` : null;
+}
+
+function sourceTypeLabel(source: AccessRoleSourceItem): string {
+  switch (source.source_type) {
+    case "direct_role":
+      return "i18n:govoplan-access.direct_role_source.bf3e6a27";
+    case "group_role":
+      return "i18n:govoplan-access.group_role_source.0aa38904";
+    case "legacy_function_role":
+      return "i18n:govoplan-access.legacy_function_role_source.36f81c6b";
+    case "idm_function_role":
+      return "i18n:govoplan-access.idm_function_role_source.14a231fe";
+    case "system_role":
+      return "i18n:govoplan-access.system_role_source.c6e83223";
+    default:
+      return source.source_type;
+  }
+}
+
+function factRoles(fact: FunctionFactExplanationItem): string {
+  return fact.role_names.length ? fact.role_names.join(", ") : "i18n:govoplan-access.no_mapped_roles.986bfb44";
+}
--- a/webui/src/i18n/generatedTranslations.ts
+++ b/webui/src/i18n/generatedTranslations.ts
@@ -4,6 +4,7 @@ export const generatedTranslations: PlatformTranslations = {
  "en": {
    "i18n:govoplan-access.a_role_may_contain_only_permissions_held_by_the_.a7ee5e45": "A role may contain only permissions held by the administrator defining it. The protected system:* wildcard is reserved for System owner.",
    "i18n:govoplan-access.access_updated_for_value.87f22245": "Access updated for {value0}.",
+    "i18n:govoplan-access.access_explanation.75ee7f62": "Access explanation",
    "i18n:govoplan-access.access.2f81a22d": "Access",
    "i18n:govoplan-access.account_assignments.f5a91f2a": "Account assignments",
    "i18n:govoplan-access.account_status.8dd86c6d": "Account status",
@@ -39,6 +40,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.assignable.a88debc5": "Assignable",
    "i18n:govoplan-access.assigned_scopes.c7b09b12": "Assigned scopes",
    "i18n:govoplan-access.assignments.057d58c7": "Assignments",
+    "i18n:govoplan-access.assignment_source.5fac1f72": "Assignment source",
    "i18n:govoplan-access.audit_event_details.3749b52d": "Audit event details",
    "i18n:govoplan-access.audit.fa1703dd": "Audit",
    "i18n:govoplan-access.available.ce372771": ", available",
@@ -87,6 +89,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.delete_value.4d18989e": "Delete {value0}",
    "i18n:govoplan-access.denied.63b16bd4": "Denied",
    "i18n:govoplan-access.description.55f8ebc8": "Description",
+    "i18n:govoplan-access.direct_role_source.bf3e6a27": "Direct role",
    "i18n:govoplan-access.direct_roles.c4db7156": "Direct roles",
    "i18n:govoplan-access.display_name.c7874aaa": "Display name",
    "i18n:govoplan-access.dry_run.485a3d15": "Dry run",
@@ -102,12 +105,14 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.email.84add5b2": "Email",
    "i18n:govoplan-access.expires.a99be3da": "Expires",
    "i18n:govoplan-access.expiry.ba8f571e": "Expiry",
+    "i18n:govoplan-access.explain_access_for_value.3af96e47": "Explain access for {value0}",
    "i18n:govoplan-access.explicit_allow_is_unavailable_for.8d05fd4a": "Explicit allow is unavailable for",
    "i18n:govoplan-access.explicitly_deny.17ad945a": "Explicitly deny",
    "i18n:govoplan-access.file_connections.1e362326": "File connections",
    "i18n:govoplan-access.files_module_unavailable.0ee90db1": "Files module unavailable",
    "i18n:govoplan-access.files.6ce6c512": "Files",
    "i18n:govoplan-access.function_fact.4f7435e4": "Function fact",
+    "i18n:govoplan-access.function_facts.848b32cc": "Function facts",
    "i18n:govoplan-access.function_id.e5e08937": "Function ID",
    "i18n:govoplan-access.function_role_mapping_created.7a25eb5a": "Function role mapping created.",
    "i18n:govoplan-access.function_role_mapping_deleted.fb180786": "Function role mapping deleted.",
@@ -130,6 +135,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.group_profiles.74568838": "Group profiles",
    "i18n:govoplan-access.group_retention_policy.ad941c0b": "Group retention policy",
    "i18n:govoplan-access.group_retention.57cdcdaa": "Group retention",
+    "i18n:govoplan-access.group_role_source.0aa38904": "Group role",
    "i18n:govoplan-access.group_templates": "Group templates",
    "i18n:govoplan-access.group_roles_and_direct_roles_are_combined_the_ba.a43c2f16": "Group roles and direct roles are combined. The backend refuses a change that would leave an active tenant without an operational owner.",
    "i18n:govoplan-access.group_scoped_file_server_connections_and_credent.f32a51bc": "Group-scoped file server connections and credential policy limits in the active tenant.",
@@ -144,6 +150,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.groups.07551586": "groups,",
    "i18n:govoplan-access.groups.ae9629f4": "Groups",
    "i18n:govoplan-access.i_have_recorded_it.7522da18": "I have recorded it",
+    "i18n:govoplan-access.idm_function_role_source.14a231fe": "IDM function role",
    "i18n:govoplan-access.inactive.09af574c": "Inactive",
    "i18n:govoplan-access.inherit_follows_the_current_system_setting_expli.60d4d868": "Inherit follows the current system setting. Explicit deny narrows access; explicit allow is valid only while the system setting allows it.",
    "i18n:govoplan-access.inherit_system_setting.7f125156": "Inherit system setting",
@@ -161,12 +168,15 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.last_login.43dab84f": "Last login",
    "i18n:govoplan-access.last_used.f1109d3d": "Last used",
    "i18n:govoplan-access.leave_empty_to_generate.e58222d8": "Leave empty to generate",
+    "i18n:govoplan-access.legacy_function_role_source.36f81c6b": "Legacy function role",
    "i18n:govoplan-access.locale.8970f0e6": "Locale",
+    "i18n:govoplan-access.loading_access_explanation.04a7c934": "Loading access explanation...",
    "i18n:govoplan-access.mail_module_unavailable.b4e95104": "Mail module unavailable",
    "i18n:govoplan-access.mail_servers.d627326a": "Mail servers",
    "i18n:govoplan-access.maintenance.94de303b": "Maintenance",
    "i18n:govoplan-access.manage_memberships_groups_and_direct_roles_in_th.25af86bb": "Manage memberships, groups and direct roles in the active tenant. Global account status and cross-tenant membership are managed under System → Users.",
    "i18n:govoplan-access.management.63cecca6": "Management",
+    "i18n:govoplan-access.mapped_roles.504d9ff9": "Mapped roles",
    "i18n:govoplan-access.members.1cb449c1": "Members",
    "i18n:govoplan-access.membership_status.b77fc732": "Membership status",
    "i18n:govoplan-access.membership.53bc9670": "Membership",
@@ -177,10 +187,13 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.no_assignable_roles_exist.a4c268c2": "No assignable roles exist.",
    "i18n:govoplan-access.no_expiry.39d436aa": "No expiry",
    "i18n:govoplan-access.no_function_role_mappings_found.f735ff54": "No function role mappings found.",
+    "i18n:govoplan-access.no_function_facts_found.b2ecee17": "No function facts found.",
    "i18n:govoplan-access.no_global_accounts_found.29d96a9e": "No global accounts found.",
    "i18n:govoplan-access.no_groups_exist_yet.9cd029f6": "No groups exist yet.",
    "i18n:govoplan-access.no_groups_found.627ca913": "No groups found.",
+    "i18n:govoplan-access.no_mapped_roles.986bfb44": "No mapped roles",
    "i18n:govoplan-access.no_roles_found.70f7c0c9": "No roles found.",
+    "i18n:govoplan-access.no_role_sources_found.91013aa5": "No role sources found.",
    "i18n:govoplan-access.no_system_roles_found.051cf727": "No system roles found.",
    "i18n:govoplan-access.no_tenant_users_exist.96b4a88a": "No tenant users exist.",
    "i18n:govoplan-access.no_tenant_users_found.74bb615f": "No tenant users found.",
@@ -189,6 +202,9 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.none.6eef6648": "None",
    "i18n:govoplan-access.object.2883f191": "Object",
    "i18n:govoplan-access.objects.72a83add": "Objects",
+    "i18n:govoplan-access.organization_unit.9832b383": "Organization unit",
+    "i18n:govoplan-access.open_idm_assignment": "Open IDM assignment",
+    "i18n:govoplan-access.open_organizations": "Open Organizations",
    "i18n:govoplan-access.owner.89ff3122": "Owner",
    "i18n:govoplan-access.packages.0a999012": "Packages",
    "i18n:govoplan-access.permissions.d06d5557": "Permissions",
@@ -210,6 +226,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.revoke_value.34640d6a": "Revoke {value0}",
    "i18n:govoplan-access.revoked.85f17ac0": "Revoked",
    "i18n:govoplan-access.role_details.a16b5d9f": "Role details",
+    "i18n:govoplan-access.role_sources.6f42a672": "Role sources",
    "i18n:govoplan-access.role_value_created.2a964899": "Role {value0} created.",
    "i18n:govoplan-access.role_value_deleted.3bd819cf": "Role {value0} deleted.",
    "i18n:govoplan-access.role_value_updated.ec386eb0": "Role {value0} updated.",
@@ -258,6 +275,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.system_role_value_updated.3a3f8862": "System role {value0} updated.",
    "i18n:govoplan-access.system_role.91762640": "System role",
    "i18n:govoplan-access.system_roles.a9461aa6": "System roles",
+    "i18n:govoplan-access.system_role_source.c6e83223": "System role",
    "i18n:govoplan-access.system.29d43743": "SYSTEM",
    "i18n:govoplan-access.system.bc0792d8": "System",
    "i18n:govoplan-access.temporary_password.62d60628": "Temporary password",
@@ -334,6 +352,7 @@ export const generatedTranslations: PlatformTranslations = {
  "de": {
    "i18n:govoplan-access.a_role_may_contain_only_permissions_held_by_the_.a7ee5e45": "A role may contain only permissions held by the administrator defining it. The protected system:* wildcard is reserved for System owner.",
    "i18n:govoplan-access.access_updated_for_value.87f22245": "Access updated for {value0}.",
+    "i18n:govoplan-access.access_explanation.75ee7f62": "Zugriffserklaerung",
    "i18n:govoplan-access.access.2f81a22d": "Zugriff",
    "i18n:govoplan-access.account_assignments.f5a91f2a": "Account assignments",
    "i18n:govoplan-access.account_status.8dd86c6d": "Account status",
@@ -369,6 +388,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.assignable.a88debc5": "Zuweisbar",
    "i18n:govoplan-access.assigned_scopes.c7b09b12": "Assigned scopes",
    "i18n:govoplan-access.assignments.057d58c7": "Zuweisungen",
+    "i18n:govoplan-access.assignment_source.5fac1f72": "Zuweisungsquelle",
    "i18n:govoplan-access.audit_event_details.3749b52d": "Audit event details",
    "i18n:govoplan-access.audit.fa1703dd": "Audit",
    "i18n:govoplan-access.available.ce372771": ", available",
@@ -417,6 +437,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.delete_value.4d18989e": "Delete {value0}",
    "i18n:govoplan-access.denied.63b16bd4": "Denied",
    "i18n:govoplan-access.description.55f8ebc8": "Beschreibung",
+    "i18n:govoplan-access.direct_role_source.bf3e6a27": "Direkte Rolle",
    "i18n:govoplan-access.direct_roles.c4db7156": "Direkte Rollen",
    "i18n:govoplan-access.display_name.c7874aaa": "Anzeigename",
    "i18n:govoplan-access.dry_run.485a3d15": "Trockenlauf",
@@ -432,12 +453,14 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.email.84add5b2": "E-Mail",
    "i18n:govoplan-access.expires.a99be3da": "Expires",
    "i18n:govoplan-access.expiry.ba8f571e": "Expiry",
+    "i18n:govoplan-access.explain_access_for_value.3af96e47": "Zugriff fuer {value0} erklaeren",
    "i18n:govoplan-access.explicit_allow_is_unavailable_for.8d05fd4a": "Explicit allow is unavailable for",
    "i18n:govoplan-access.explicitly_deny.17ad945a": "Explicitly deny",
    "i18n:govoplan-access.file_connections.1e362326": "Dateiverbindungen",
    "i18n:govoplan-access.files_module_unavailable.0ee90db1": "Dateimodul nicht verfügbar",
    "i18n:govoplan-access.files.6ce6c512": "Dateien",
    "i18n:govoplan-access.function_fact.4f7435e4": "Funktionsfakt",
+    "i18n:govoplan-access.function_facts.848b32cc": "Funktionsfakten",
    "i18n:govoplan-access.function_id.e5e08937": "Funktions-ID",
    "i18n:govoplan-access.function_role_mapping_created.7a25eb5a": "Funktions-Rollenzuordnung erstellt.",
    "i18n:govoplan-access.function_role_mapping_deleted.fb180786": "Funktions-Rollenzuordnung gelöscht.",
@@ -460,6 +483,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.group_profiles.74568838": "Group profiles",
    "i18n:govoplan-access.group_retention_policy.ad941c0b": "Group retention policy",
    "i18n:govoplan-access.group_retention.57cdcdaa": "Gruppenaufbewahrung",
+    "i18n:govoplan-access.group_role_source.0aa38904": "Gruppenrolle",
    "i18n:govoplan-access.group_templates": "Gruppenvorlagen",
    "i18n:govoplan-access.group_roles_and_direct_roles_are_combined_the_ba.a43c2f16": "Group roles and direct roles are combined. The backend refuses a change that would leave an active tenant without an operational owner.",
    "i18n:govoplan-access.group_scoped_file_server_connections_and_credent.f32a51bc": "Group-scoped file server connections and credential policy limits in the active tenant.",
@@ -474,6 +498,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.groups.07551586": "groups,",
    "i18n:govoplan-access.groups.ae9629f4": "Gruppen",
    "i18n:govoplan-access.i_have_recorded_it.7522da18": "Ich habe es notiert",
+    "i18n:govoplan-access.idm_function_role_source.14a231fe": "IDM-Funktionsrolle",
    "i18n:govoplan-access.inactive.09af574c": "Inaktiv",
    "i18n:govoplan-access.inherit_follows_the_current_system_setting_expli.60d4d868": "Inherit follows the current system setting. Explicit deny narrows access; explicit allow is valid only while the system setting allows it.",
    "i18n:govoplan-access.inherit_system_setting.7f125156": "Inherit system setting",
@@ -491,12 +516,15 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.last_login.43dab84f": "Letzte Anmeldung",
    "i18n:govoplan-access.last_used.f1109d3d": "Last used",
    "i18n:govoplan-access.leave_empty_to_generate.e58222d8": "Leer lassen zum Generieren",
+    "i18n:govoplan-access.legacy_function_role_source.36f81c6b": "Alte Funktionsrolle",
    "i18n:govoplan-access.locale.8970f0e6": "Locale",
+    "i18n:govoplan-access.loading_access_explanation.04a7c934": "Zugriffserklaerung wird geladen...",
    "i18n:govoplan-access.mail_module_unavailable.b4e95104": "Mail module unavailable",
    "i18n:govoplan-access.mail_servers.d627326a": "Mail servers",
    "i18n:govoplan-access.maintenance.94de303b": "Wartung",
    "i18n:govoplan-access.manage_memberships_groups_and_direct_roles_in_th.25af86bb": "Manage memberships, groups and direct roles in the active tenant. Global account status and cross-tenant membership are managed under System → Users.",
    "i18n:govoplan-access.management.63cecca6": "Management",
+    "i18n:govoplan-access.mapped_roles.504d9ff9": "Zugeordnete Rollen",
    "i18n:govoplan-access.members.1cb449c1": "Members",
    "i18n:govoplan-access.membership_status.b77fc732": "Mitgliedschaftsstatus",
    "i18n:govoplan-access.membership.53bc9670": "Mitgliedschaft",
@@ -507,10 +535,13 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.no_assignable_roles_exist.a4c268c2": "Es gibt keine zuweisbaren Rollen.",
    "i18n:govoplan-access.no_expiry.39d436aa": "No expiry",
    "i18n:govoplan-access.no_function_role_mappings_found.f735ff54": "Keine Funktions-Rollenzuordnungen gefunden.",
+    "i18n:govoplan-access.no_function_facts_found.b2ecee17": "Keine Funktionsfakten gefunden.",
    "i18n:govoplan-access.no_global_accounts_found.29d96a9e": "No global accounts found.",
    "i18n:govoplan-access.no_groups_exist_yet.9cd029f6": "Es gibt noch keine Gruppen.",
    "i18n:govoplan-access.no_groups_found.627ca913": "No groups found.",
+    "i18n:govoplan-access.no_mapped_roles.986bfb44": "Keine zugeordneten Rollen",
    "i18n:govoplan-access.no_roles_found.70f7c0c9": "Keine Rollen gefunden.",
+    "i18n:govoplan-access.no_role_sources_found.91013aa5": "Keine Rollenquellen gefunden.",
    "i18n:govoplan-access.no_system_roles_found.051cf727": "No system roles found.",
    "i18n:govoplan-access.no_tenant_users_exist.96b4a88a": "No tenant users exist.",
    "i18n:govoplan-access.no_tenant_users_found.74bb615f": "Keine Mandantenbenutzer gefunden.",
@@ -519,6 +550,9 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.none.6eef6648": "Keine",
    "i18n:govoplan-access.object.2883f191": "Object",
    "i18n:govoplan-access.objects.72a83add": "Objects",
+    "i18n:govoplan-access.organization_unit.9832b383": "Organisationseinheit",
+    "i18n:govoplan-access.open_idm_assignment": "IDM-Zuordnung oeffnen",
+    "i18n:govoplan-access.open_organizations": "Organisationen oeffnen",
    "i18n:govoplan-access.owner.89ff3122": "Eigentümer",
    "i18n:govoplan-access.packages.0a999012": "Pakete",
    "i18n:govoplan-access.permissions.d06d5557": "Berechtigungen",
@@ -540,6 +574,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.revoke_value.34640d6a": "Revoke {value0}",
    "i18n:govoplan-access.revoked.85f17ac0": "Revoked",
    "i18n:govoplan-access.role_details.a16b5d9f": "Rollendetails",
+    "i18n:govoplan-access.role_sources.6f42a672": "Rollenquellen",
    "i18n:govoplan-access.role_value_created.2a964899": "Role {value0} created.",
    "i18n:govoplan-access.role_value_deleted.3bd819cf": "Role {value0} deleted.",
    "i18n:govoplan-access.role_value_updated.ec386eb0": "Role {value0} updated.",
@@ -588,6 +623,7 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-access.system_role_value_updated.3a3f8862": "System role {value0} updated.",
    "i18n:govoplan-access.system_role.91762640": "System role",
    "i18n:govoplan-access.system_roles.a9461aa6": "System roles",
+    "i18n:govoplan-access.system_role_source.c6e83223": "Systemrolle",
    "i18n:govoplan-access.system.29d43743": "SYSTEM",
    "i18n:govoplan-access.system.bc0792d8": "System",
    "i18n:govoplan-access.temporary_password.62d60628": "Temporäres Passwort",