General and Security

Two screens of the Application plane. They hold what is true of the whole application, and writing to them takes the app admin capability (or root).

General

The two switches, then the working hours: a time zone and one line per day, each with its own window and a + to add a second one.

Two statements about what this installation is, and one access window.

Several organisations. Off, this gateway serves one organisation and never names it: its groups and members are administered right here, under Application. On, organisations get their own entry in the rail. Going down to a single organisation asks first, and counts what stops being served: nothing is deleted, and switching back brings the organisations and their access straight back.

Developer mode. On, accounts holding the dev capability get their tooling on the applications this gateway serves: the Developer menu in the user button, the UI test mode, the routes' API docs. Off, none of it is there at all, however many accounts carry the capability. Free in both editions.

This switch decides on a production gateway as anywhere else. It is stored, so a configuration export or a database restored from staging carries it along.

Working hours are the application-wide access window every organisation inherits unless it defines its own.

> Locales moved. A gateway-wide pool of languages used to live here, with

> each route unchecking the ones it did not support. It reads backwards: nobody

> knows what a gateway speaks, the applications behind it do. A route now

> declares what it is written in, under Routes > (a route) > Locales, and

> what this installation offers is the union of those - deploy a route that

> speaks Polish and the sign-in page offers Polish, retire it and the offer

> shrinks with it. Nothing to keep in step, and no screen to remember to widen.

Security

The policies every account lives under. One Save button at the bottom for the whole screen.

• Two-factor - require a second factor for everyone; organisations and members can override it. Beside it, a one-time code by e-mail as a fallback for an enrolled user who cannot reach their authenticator: it needs a mail relay and only shows for accounts that carry an address and have already set up an authenticator.
• Session TTL - how long a session lives before the user must sign in again.
• Passwords - what a new password must contain: length, and how many lowercase, uppercase, digits and special characters. Zero means the rule is not asked for, and a rule that is not asked for is not shown to users either. The screen previews exactly the list your users will read. If the kinds already need more characters than the length, it says the length will be raised on save.
• No reuse of the last N - previous passwords are kept as hashes and compared when a new one is chosen, the one in use included.
• Expires after (days) - checked at sign-in, not by a clock: an expired password sends the person to the change page rather than ending a session they are working in. A password whose age is unknown never expires.
• Temporary (hours) - how long a password an administrator issued works before its owner replaces it. Past that, signing in with it is refused. The dialog that shows the password says how long it works.
• Force a change for everyone (root) makes every local account change at its next sign-in, yours excepted. One account at a time is on Users.
• Rate limiting - failed sign-ins per address and account within a window, and wrong two-factor codes per account. Zero disables a limiter.
• Passkeys - let users register passkeys and sign in with them instead of the password and second factor.
• API tokens - let users mint personal access tokens from their profile, to call the API routes behind the gateway without a browser session. A token acts with the user's context at creation. These are the users' tokens, not the admin tokens.
• Trusted browsers - let users skip the two-factor challenge on a browser they mark as trusted, for a duration you choose.

Traps

• General saves on the button, its two switches do not. The organisation mode and developer mode take effect on the click; the working hours wait for Save.
• Languages are the applications', not the console's. The console is English only, and what the built-in pages offer comes from the routes.
• An empty password policy accepts anything, however short. The screen says so in as many words.
• Session TTL is on Security, not General: how long one stays signed in is a security policy, next to the second factor that gates the same session.