API tokens page: an English placeholder, and each token's scopes shown as raw keys #432

New issue

Closed

opened 2026-10-01 10:46:40 +00:00 by tiagoagueda · 1 comment

tiagoagueda commented

2026-10-01 10:46:40 +00:00

Owner

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the API token form and its page.

Checked again on 2026-10-01 against main at 0a5cad587: still present.

The API tokens page shows English whatever the interface language in two places. The name field's placeholder is a bare string, and each token in the list names its scopes by their wire keys (captures, read), although the checkboxes just above showed the same scopes as translated sentences. ApiToken.scope_labels exists to give those sentences and nothing on the page uses it.

Where: api/forms.py:23 (ApiTokenForm.name, attrs={"placeholder": "Firefox on the laptop"}, not wrapped in _()); templates/api/token_list.html:70 (· {{ token.scopes|join:", " }}); api/models.py:131-133 (ApiToken.scope_labels, used only by tests/test_api.py:48).
What happens: someone using Postulo in Portuguese opens Settings → API tokens. The name box suggests "Firefox on the laptop", and after creating a token its row reads captures, documents:read, read while the form above offered "Capture postings", "Download the files themselves" and "Read everything: …" in Portuguese.
Why it matters: the page breaks the promise that every user-facing string is translatable, and the keys mean nothing to someone who did not write a client.
Fix: wrap the placeholder in _(). In the list, render token.scope_labels rather than token.scopes. The labels are sentences that contain commas and colons themselves, so joining them with ", " would read as one run-on list; render each as its own item (a small list or one badge per scope), with the key beside it in <code> if a developer needs it.

Done when

A test in tests/test_api.py that renders the token list under a non-English language with a token holding read and captures finds the translated SCOPES labels and not the bare captures, read, and finds the placeholder among the catalogue's msgids (makemessages picks it up).

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the API token form and its page. Checked again on 2026-10-01 against `main` at `0a5cad587`: still present. The API tokens page shows English whatever the interface language in two places. The name field's placeholder is a bare string, and each token in the list names its scopes by their wire keys (`captures, read`), although the checkboxes just above showed the same scopes as translated sentences. `ApiToken.scope_labels` exists to give those sentences and nothing on the page uses it. - **Where:** `api/forms.py:23` (`ApiTokenForm.name`, `attrs={"placeholder": "Firefox on the laptop"}`, not wrapped in `_()`); `templates/api/token_list.html:70` (`· {{ token.scopes|join:", " }}`); `api/models.py:131-133` (`ApiToken.scope_labels`, used only by `tests/test_api.py:48`). - **What happens:** someone using Postulo in Portuguese opens Settings → API tokens. The name box suggests "Firefox on the laptop", and after creating a token its row reads `captures, documents:read, read` while the form above offered "Capture postings", "Download the files themselves" and "Read everything: …" in Portuguese. - **Why it matters:** the page breaks the promise that every user-facing string is translatable, and the keys mean nothing to someone who did not write a client. - **Fix:** wrap the placeholder in `_()`. In the list, render `token.scope_labels` rather than `token.scopes`. The labels are sentences that contain commas and colons themselves, so joining them with `", "` would read as one run-on list; render each as its own item (a small list or one badge per scope), with the key beside it in `<code>` if a developer needs it. ## Done when - A test in `tests/test_api.py` that renders the token list under a non-English language with a token holding `read` and `captures` finds the translated `SCOPES` labels and not the bare `captures, read`, and finds the placeholder among the catalogue's msgids (`makemessages` picks it up).

tiagoagueda added this to the 0.6.0 milestone

2026-10-01 10:46:40 +00:00

tiagoagueda added the

labels

2026-10-01 10:46:40 +00:00

tiagoagueda referenced this issue from a commit

2026-10-05 23:05:04 +00:00

Translate the API token name placeholder and list each scope as a sentence