Translation of %(within)s

[arielvb]

While reviewing the Spanish translations, I noticed multiple strings that contain %(within)s; display the %(within)s in English to the user.

I'll focus just on confirm and reset expired messages, which use two strings from the configuration to obtain the value of %(within)s:

    "CONFIRM_EMAIL_WITHIN": "5 days",
    "RESET_PASSWORD_WITHIN": "1 days",

These strings are used for token max_age and to create flash messages to inform the user. For example, the user will receive a message like:

"You did not reset your password within %(within)s. " where %(within)s will be "5 days" or "1 days"

Notice the incorrect plural for "1 day"

Since "within" isn't translated, users will receive a mix of English and non-English:

"[localized message] 5 days"

Translation of "within" on messages

These two configuration values are used to render the message on flask_security/views.py:597 and to obtain the token max_age (flask_security/utils.py:855).

They could be marked for translation like other config values with _(), and kept non-localized. They can also be translated before calling get_message.

This will work for the default values, but not for custom application values, so it's not ideal.

For the pluralization error

The configuration values ending with _WITHIN are used to generate a timedelta (which expects the arguments days, seconds, microseconds, milliseconds, minutes, hours, and weeks), see utils.get_within_delta.

I don't think milliseconds and microseconds will ever be used, but right now they are supported

Thus, singular cannot be used to specify _WITHIN values.

Conclusion

To translate these periods properly, a solution like naturaldelta from humanize package would be needed.

Another option will be to remove the delta time from the messages and use a default like:

"You did not reset your password within the allowed time."

Both are breaking changes adding a new dependency (unless naturaldelta is borrowed) or removing a placeholder from a configuration string.

What do you think would be the best solution?

BTW: sorry for the long description

[jwag956]

Thanks for your detailed report - some of these have been like that since the beginning days of Flask-Security. I think having the placeholders in the message is important for some languages that need to reorder sentence structure. I wasn't familiar with humanize - that seems like a great solution - probably add it as part of the 'babel' extra install packages.
I can look into integrating that in the next few weeks.

[arielvb]

It’s not urgent, I’ve been using Flask-Security for a while and only noticed this today. For now, I’ve fixed it in my app by replacing the default messages with new ones that don’t include the placeholder, and it worked.

I did something like this:

 app.config["SECURITY_MSG_PASSWORD_RESET_EXPIRED"] = (
        lazy_gettext(
            "You did not reset your password within the allowed time."
        ),
        "error",
    )

For the 6 messages that have a %(within)s placeholder: PASSWORD_RESET_EXPIRED, CONFIRMATION_EXPIRED, LOGIN_EXPIRED, WEBAUTHN_EXPIRED, CHANGE_EMAIL_EXPIRED and US_SETUP_EXPIRED.
And I can translate it for the languages that I need; so I have a workaround for now.