- Ya
- 4 Septemba 2026, 05:19 UTC
- Mwandishi
- Kamo
- Ahadi ya
- ecb69b2
check-i18n-keys.mjs reads literal t('...') calls, and the catalog builds its keys by interpolation — **************** and oauthClients.field.${labelKey} — so nothing was checking them. Add a provider or a field, forget the English, and a platform operator reads a raw key path off the card. Both sides of bring-your-own read this one catalog, so a missing field label is also a credential an organization can never be asked for. Also asserts the invariants the two screens rely on: unique provider codes, every provider carrying a client id, and no two fields writing the same target (which would silently overwrite each other on save). Verified non-vacuous by injecting a bad nameKey and a bad labelKey — both were caught and named.