feat(hub): let a hub admin disable public groups instance-wide

A new General tab in Administration carries one switch, allow_public_groups,
stored in a hub_settings key/value table (runtime-editable, unlike hub.toml).
Default is on; an absent row means on, so an upgrade changes nothing.

Enforcement is server-side on every hub-mediated path, not just the SPA:

  - create_group        refuses visibility=public (403), staff included
  - list_public_groups  the directory returns nothing (local + federated)
  - join_group          open-joining a public group is refused
  - group_online_nodes  a non-member of a public group is handed no node
  - signaling.webrtc_offer  drops the "node hosts an open group" fallback
  - federation.export_directory  advertises nothing to peer hubs

The switch is read live, so flipping it back restores every path. Existing
members of a group that predates the switch keep their membership row and
their access — this is plan A, not a purge. GET /v1/hub/info exposes the
flag (unauthenticated) so the create-group form and the sidebar's "Public
groups" link render correctly.

Also in the admin Groups tab: a Revoke action beside Suspend. Suspend is the
reversible hub flag; Revoke calls POST /v1/admin/revoke, which sets
status=revoked and broadcasts a signed revocation every node enforces
(denylist + dropped live sessions). It is confirm-guarded and names the group.

And a message fix the revoke work surfaced: group_online_nodes, join_group and
webrtc_offer answered "Group is suspended" for any non-active status. They now
report the real state, so a member of a revoked group is told "Group is
revoked" rather than something reversible-sounding.

Tests: test_public_groups_toggle.py (10) covers the switch end to end and the
five enforcement paths; test_revocation.py gains the status-message assertion.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi

11 files changed, 203 insertions, 54 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index 446360c..a380033 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -299,7 +299,8 @@ function Nav({ user, theme, onThemeChange, onLogout, onMenuToggle, unreadCount,
 
 // ── Sidebar ──────────────────────────────────────────────────────────────────
 
-function Sidebar({ groups, presence, indexProgressPct, route, menuOpen, role, hasNodeKey }) {
+function Sidebar({ groups, presence, indexProgressPct, route, menuOpen, role, hasNodeKey,
+                  allowPublicGroups = true }) {
   const isStaff = role === 'moderator' || role === 'admin';
   return html`
     <aside class="sidebar ${menuOpen ? 'open' : ''}">
@@ -312,8 +313,9 @@ function Sidebar({ groups, presence, indexProgressPct, route, menuOpen, role, ha
       `}
       <div class="sidebar-section">
         <div class="sidebar-heading">${t('sidebar.discover')}</div>
-        <a class="sidebar-item ${route === '/explore' ? 'active' : ''}"
-           href="#/explore"><${Icon} name="globe" /> ${t('sidebar.public_groups')}</a>
+        ${allowPublicGroups && html`
+          <a class="sidebar-item ${route === '/explore' ? 'active' : ''}"
+             href="#/explore"><${Icon} name="globe" /> ${t('sidebar.public_groups')}</a>`}
         <a class="sidebar-item ${route === '/search' ? 'active' : ''}"
            href="#/search"><${Icon} name="search" /> ${t('sidebar.search')}</a>
       </div>
@@ -740,9 +742,12 @@ function CreateGroupPage(props) {
   return html`<${CreateGroupFormSimple} ...${props} />`;
 }
 
-function CreateGroupFormSimple({ token, onCreated }) {
+function CreateGroupFormSimple({ token, onCreated, allowPublicGroups = true }) {
   const [name, setName] = useState('');
   const [description, setDescription] = useState('');
+  // Only ever anything other than 'invite' when the hub allows public groups —
+  // the join-policy section is not rendered otherwise, so there is nothing to
+  // set it 'open'.
   const [joinPolicy, setJoinPolicy] = useState('invite');
   const [error, setError] = useState('');
   const [loading, setLoading] = useState(false);
@@ -793,29 +798,31 @@ function CreateGroupFormSimple({ token, onCreated }) {
           </div>
         </div>
 
-        <div class="settings-section">
-          <h3 class="settings-heading">${t('create_group.join_policy')}</h3>
-          <div class="choice-list">
-            <label class="choice ${joinPolicy === 'invite' ? 'selected' : ''}">
-              <input type="radio" name="join_policy" checked=${joinPolicy === 'invite'}
-                onChange=${() => setJoinPolicy('invite')} />
-              <${Icon} name="lock" cls="choice-icon" />
-              <span class="choice-text">
-                <span class="choice-title">${t('create_group.invite')}</span>
-                <span class="choice-desc">${t('create_group.invite_desc')}</span>
-              </span>
-            </label>
-            <label class="choice ${joinPolicy === 'open' ? 'selected' : ''}">
-              <input type="radio" name="join_policy" checked=${joinPolicy === 'open'}
-                onChange=${() => setJoinPolicy('open')} />
-              <${Icon} name="globe" cls="choice-icon" />
-              <span class="choice-text">
-                <span class="choice-title">${t('create_group.open')}</span>
-                <span class="choice-desc">${t('create_group.open_desc')}</span>
-              </span>
-            </label>
+        ${allowPublicGroups && html`
+          <div class="settings-section">
+            <h3 class="settings-heading">${t('create_group.join_policy')}</h3>
+            <div class="choice-list">
+              <label class="choice ${joinPolicy === 'invite' ? 'selected' : ''}">
+                <input type="radio" name="join_policy" checked=${joinPolicy === 'invite'}
+                  onChange=${() => setJoinPolicy('invite')} />
+                <${Icon} name="lock" cls="choice-icon" />
+                <span class="choice-text">
+                  <span class="choice-title">${t('create_group.invite')}</span>
+                  <span class="choice-desc">${t('create_group.invite_desc')}</span>
+                </span>
+              </label>
+              <label class="choice ${joinPolicy === 'open' ? 'selected' : ''}">
+                <input type="radio" name="join_policy" checked=${joinPolicy === 'open'}
+                  onChange=${() => setJoinPolicy('open')} />
+                <${Icon} name="globe" cls="choice-icon" />
+                <span class="choice-text">
+                  <span class="choice-title">${t('create_group.open')}</span>
+                  <span class="choice-desc">${t('create_group.open_desc')}</span>
+                </span>
+              </label>
+            </div>
           </div>
-        </div>
+        `}
 
         <button class="btn-primary" type="submit" disabled=${loading}>
           ${loading ? t('create_group.creating') : t('create_group.submit')}
@@ -827,7 +834,7 @@ function CreateGroupFormSimple({ token, onCreated }) {
 
 // ── Create Group Wizard (Electron-only) ─────────────────────────────────────
 
-function CreateGroupWizard({ token, username, onCreated }) {
+function CreateGroupWizard({ token, username, onCreated, allowPublicGroups = true }) {
   const [step, setStep] = useState(0);  // 0=node check, 1=details, 2=setup, 3=done
   const [nodeStatus, setNodeStatus] = useState(null);  // null=loading, object=result
   const [nodeStarting, setNodeStarting] = useState(false);
@@ -836,6 +843,8 @@ function CreateGroupWizard({ token, username, onCreated }) {
   // Step 1 fields
   const [name, setName] = useState('');
   const [description, setDescription] = useState('');
+  // See CreateGroupFormSimple: stays 'invite' unless the hub allows public
+  // groups, since the join-policy section is not rendered otherwise.
   const [joinPolicy, setJoinPolicy] = useState('invite');
   const [roots, setRoots] = useState([]);
   const [uploadIdx, setUploadIdx] = useState(0);
@@ -1133,29 +1142,31 @@ function CreateGroupWizard({ token, username, onCreated }) {
         </div>
       </div>
 
-      <div class="settings-section">
-        <h3 class="settings-heading">${t('create_group.join_policy')}</h3>
-        <div class="choice-list">
-          <label class="choice ${joinPolicy === 'invite' ? 'selected' : ''}">
-            <input type="radio" name="join_policy" checked=${joinPolicy === 'invite'}
-              onChange=${() => setJoinPolicy('invite')} />
-            <${Icon} name="lock" cls="choice-icon" />
-            <span class="choice-text">
-              <span class="choice-title">${t('create_group.invite')}</span>
-              <span class="choice-desc">${t('create_group.invite_desc')}</span>
-            </span>
-          </label>
-          <label class="choice ${joinPolicy === 'open' ? 'selected' : ''}">
-            <input type="radio" name="join_policy" checked=${joinPolicy === 'open'}
-              onChange=${() => setJoinPolicy('open')} />
-            <${Icon} name="globe" cls="choice-icon" />
-            <span class="choice-text">
-              <span class="choice-title">${t('create_group.open')}</span>
-              <span class="choice-desc">${t('create_group.open_desc')}</span>
-            </span>
-          </label>
+      ${allowPublicGroups && html`
+        <div class="settings-section">
+          <h3 class="settings-heading">${t('create_group.join_policy')}</h3>
+          <div class="choice-list">
+            <label class="choice ${joinPolicy === 'invite' ? 'selected' : ''}">
+              <input type="radio" name="join_policy" checked=${joinPolicy === 'invite'}
+                onChange=${() => setJoinPolicy('invite')} />
+              <${Icon} name="lock" cls="choice-icon" />
+              <span class="choice-text">
+                <span class="choice-title">${t('create_group.invite')}</span>
+                <span class="choice-desc">${t('create_group.invite_desc')}</span>
+              </span>
+            </label>
+            <label class="choice ${joinPolicy === 'open' ? 'selected' : ''}">
+              <input type="radio" name="join_policy" checked=${joinPolicy === 'open'}
+                onChange=${() => setJoinPolicy('open')} />
+              <${Icon} name="globe" cls="choice-icon" />
+              <span class="choice-text">
+                <span class="choice-title">${t('create_group.open')}</span>
+                <span class="choice-desc">${t('create_group.open_desc')}</span>
+              </span>
+            </label>
+          </div>
         </div>
-      </div>
+      `}
 
       <div class="settings-section">
         <h3 class="settings-heading">${t('members.apps_title')}</h3>
@@ -1895,9 +1906,11 @@ function SettingsPage({ user, theme, onThemeChange, groups, onPrefsChange }) {
 
 // ── Admin Panel ─────────────────────────────────────────────────────────────
 
-function AdminPage({ token }) {
-  const [tab, setTab] = useState('stats');
+function AdminPage({ token, role }) {
+  const [tab, setTab] = useState('general');
   const [stats, setStats] = useState(null);
+  const [settings, setSettings] = useState(null);
+  const [settingsSaving, setSettingsSaving] = useState(false);
   const [users, setUsers] = useState([]);
   const [usersTotal, setUsersTotal] = useState(0);
   const [userSearch, setUserSearch] = useState('');
@@ -1920,6 +1933,26 @@ function AdminPage({ token }) {
     } catch (e) { setError(e.message); }
   }, [token]);
 
+  const loadSettings = useCallback(async () => {
+    try {
+      const data = await hubFetch('/v1/admin/settings', { token });
+      setSettings(data);
+    } catch (e) { setError(e.message); }
+  }, [token]);
+
+  const saveSettings = useCallback(async (patch) => {
+    setSettingsSaving(true);
+    setError('');
+    try {
+      // The response is the authoritative state — render that, not the
+      // optimistic value, so a rejected change never looks applied.
+      const data = await hubFetch('/v1/admin/settings',
+        { method: 'PATCH', body: patch, token });
+      setSettings(data);
+    } catch (e) { setError(e.message); }
+    finally { setSettingsSaving(false); }
+  }, [token]);
+
   const loadUsers = useCallback(async (q = '') => {
     try {
       const data = await hubFetch(`/v1/admin/users?q=${encodeURIComponent(q)}&limit=100`, { token });
@@ -1954,7 +1987,8 @@ function AdminPage({ token }) {
 
   useEffect(() => {
     setError('');
-    if (tab === 'stats') loadStats();
+    if (tab === 'general') loadSettings();
+    else if (tab === 'stats') loadStats();
     else if (tab === 'users') loadUsers(userSearch);
     else if (tab === 'groups') loadGroups();
     else if (tab === 'nodes') {
@@ -1992,6 +2026,18 @@ function AdminPage({ token }) {
     } catch (e) { setError(e.message); }
   }, [token]);
 
+  const revokeGroup = useCallback(async (g) => {
+    // Suspending is the reversible tool and stays one click away; revoking
+    // pushes a signed revocation to every node hosting the group and there is
+    // no undo from here, so it names the group and asks first.
+    if (!confirm(t('admin.revoke_group_confirm', { group: g.name }))) return;
+    try {
+      await hubFetch('/v1/admin/revoke',
+        { method: 'POST', body: { target: 'group', target_id: g.id }, token });
+      loadGroups();
+    } catch (e) { setError(e.message); }
+  }, [token]);
+
   const showUserDetail = useCallback(async (userId) => {
     try {
       const data = await hubFetch(`/v1/admin/users/${userId}`, { token });
@@ -2013,7 +2059,8 @@ function AdminPage({ token }) {
     } catch (e) { setError(e.message); }
   }, [token]);
 
-  const TABS = ['stats', 'users', 'groups', 'nodes', 'logs', 'blocklist'];
+  const TABS = ['general', 'stats', 'users', 'groups', 'nodes', 'logs', 'blocklist'];
+  const canEditSettings = role === 'admin';
 
   return html`
     <div>
@@ -2027,6 +2074,23 @@ function AdminPage({ token }) {
         `)}
       </div>
 
+      ${tab === 'general' && settings && html`
+        <div class="settings-section">
+          <h3 class="settings-heading">${t('admin.general_groups_heading')}</h3>
+          <div class="settings-row">
+            <span class="settings-label">${t('admin.allow_public_groups_label')}</span>
+            <label class="settings-value" style="cursor:pointer">
+              <input type="checkbox" checked=${settings.allow_public_groups}
+                disabled=${!canEditSettings || settingsSaving}
+                onChange=${e => saveSettings({ allow_public_groups: e.target.checked })} />
+            </label>
+          </div>
+          <p class="settings-hint">${t('admin.allow_public_groups_hint')}</p>
+          ${!canEditSettings && html`
+            <p class="settings-hint">${t('admin.settings_readonly')}</p>`}
+        </div>
+      `}
+
       ${tab === 'stats' && stats && html`
         <div class="admin-stats">
           ${[['users', 'stat_users'], ['groups', 'stat_groups'],
@@ -2116,6 +2180,10 @@ function AdminPage({ token }) {
                       ? html`<button class="admin-btn" onClick=${() => patchGroup(g.id, { status: 'active' })}>${t('admin.btn_unsuspend')}</button>`
                       : null
                   }
+                  ${g.status !== 'revoked' && html`
+                    <button class="admin-btn danger"
+                      onClick=${() => revokeGroup(g)}>${t('admin.btn_revoke')}</button>
+                  `}
                 </td>
               </tr>
             `)}
@@ -2917,6 +2985,11 @@ function App() {
   const [notifDisabled, setNotifDisabled] = useState(false);
   const [userPrefs, setUserPrefs] = useState({});
   const [hasNodeKey, setHasNodeKey] = useState(false);
+  // Instance policy, fetched once, unauthenticated. `null` until it answers;
+  // treat unknown as "allowed" so a slow hub never blocks a legitimate private
+  // group — the hub refuses a public one server-side regardless.
+  const [hubInfo, setHubInfo] = useState(null);
+  const allowPublicGroups = !hubInfo || hubInfo.allow_public_groups !== false;
 
   const resolved = resolveTheme(theme);
 
@@ -2952,6 +3025,10 @@ function App() {
     localStorage.setItem(THEME_KEY, theme);
   }, [theme, resolved]);
 
+  useEffect(() => {
+    hubFetch('/v1/hub/info').then(setHubInfo).catch(() => {});
+  }, []);
+
   const fetchNotifications = useCallback(() => {
     if (!user || notifDisabled) {
       setNotifications([]); setUnreadCount(0); return;
@@ -3196,6 +3273,7 @@ function App() {
       myGroupIds=${groups.map(g => g.id)} />`;
   } else if (route === '/create-group') {
     page = html`<${CreateGroupPage} token=${user.token} username=${user.username}
+      allowPublicGroups=${allowPublicGroups}
       onCreated=${() => {
         hubFetch('/v1/groups/mine', { token: user.token })
           .then(data => setGroups(data.groups || []))
@@ -3216,7 +3294,7 @@ function App() {
       onLeft=${handleLeftGroup} />`;
   } else if (route === '/admin') {
     page = (user.role === 'moderator' || user.role === 'admin')
-      ? html`<${AdminPage} token=${user.token} />`
+      ? html`<${AdminPage} token=${user.token} role=${user.role} />`
       : html`<${HomePage} groups=${groups} notifications=${notifications}
           onMarkRead=${markRead} onPurge=${purgeNotifications} />`;
   } else if (route === '/settings') {
@@ -3254,6 +3332,7 @@ function App() {
           route=${route}
           menuOpen=${menuOpen}
           role=${user.role}
+          allowPublicGroups=${allowPublicGroups}
           hasNodeKey=${hasNodeKey} />`}
         ${menuOpen && html`<div class="overlay visible"
           onClick=${() => setMenuOpen(false)} />`}
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index d30fb93..dae16a1 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -352,6 +352,11 @@ export default {
     + 'Node sich selbst hält; er hat sie von einem STUN-Server erfahren und uns '
     + 'geschickt. Sie hilft, den Node zu erreichen, und beweist nichts.',
   'admin.tab_blocklist': 'Sperrliste',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'Benutzer',
@@ -371,6 +376,8 @@ export default {
   'admin.no_users': 'Keine Benutzer gefunden',
   'admin.btn_suspend': 'Sperren',
   'admin.btn_unsuspend': 'Entsperren',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': 'Details',
   'admin.btn_delete': 'Löschen',
   'admin.delete_confirm': 'Das Konto „{user}“ löschen? Das lässt sich nicht '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index e9ef2cc..6f12810 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -342,6 +342,11 @@ export default {
     + 'learned from a STUN server and sent to us; it is useful for reaching the '
     + 'node and is not evidence of anything.',
   'admin.tab_blocklist': 'Blocklist',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'Users',
@@ -361,6 +366,8 @@ export default {
   'admin.no_users': 'No users found',
   'admin.btn_suspend': 'Suspend',
   'admin.btn_unsuspend': 'Unsuspend',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': 'Details',
   'admin.btn_delete': 'Delete',
   'admin.delete_confirm': 'Delete the account "{user}"? This cannot be undone. '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 6a92e01..0e51ede 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -348,6 +348,11 @@ export default {
     + 'es la suya, aprendida de un servidor STUN y enviada aquí; sirve para alcanzar el '
     + 'node y no prueba nada.',
   'admin.tab_blocklist': 'Lista de bloqueo',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'Usuarios',
@@ -367,6 +372,8 @@ export default {
   'admin.no_users': 'No se ha encontrado ningún usuario',
   'admin.btn_suspend': 'Suspender',
   'admin.btn_unsuspend': 'Reactivar',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': 'Detalles',
   'admin.btn_delete': 'Eliminar',
   'admin.delete_confirm': '¿Eliminar la cuenta «{user}»? Esta acción no se puede '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 48b10fb..ccfc709 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -351,6 +351,11 @@ export default {
     + 'celle que le node croit être la sienne, apprise d’un serveur STUN puis '
     + 'transmise ; elle sert à joindre le node et ne prouve rien.',
   'admin.tab_blocklist': 'Liste de blocage',
+  'admin.tab_general': "Général",
+  'admin.general_groups_heading': "Groupes",
+  'admin.allow_public_groups_label': "Autoriser les membres à créer des groupes publics",
+  'admin.allow_public_groups_hint': "Désactivé, les nouveaux groupes ne peuvent être que privés et sur invitation. Les groupes publics existants ne sont pas affectés — suspendez-les un par un depuis l'onglet Groupes.",
+  'admin.settings_readonly': "Seul un administrateur peut modifier ces paramètres.",
 
   // Admin stats
   'admin.stat_users': 'Utilisateurs',
@@ -370,6 +375,8 @@ export default {
   'admin.no_users': 'Aucun utilisateur trouvé',
   'admin.btn_suspend': 'Suspendre',
   'admin.btn_unsuspend': 'Réactiver',
+  'admin.btn_revoke': "Révoquer",
+  'admin.revoke_group_confirm': "Révoquer le groupe « {group} » ? Une révocation signée est envoyée à chaque node qui l'héberge, et c'est irréversible depuis cette page. Suspends-le plutôt si tu veux seulement le mettre en pause.",
   'admin.btn_details': 'Détails',
   'admin.btn_delete': 'Supprimer',
   'admin.delete_confirm': 'Supprimer le compte « {user} » ? Cette action est '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 50aee7c..1220090 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -351,6 +351,11 @@ export default {
     + 'che il node crede essere il proprio, appreso da un server STUN e inviato a noi; '
     + 'serve a raggiungere il node e non prova nulla.',
   'admin.tab_blocklist': 'Elenco dei blocchi',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'Utenti',
@@ -370,6 +375,8 @@ export default {
   'admin.no_users': 'Nessun utente trovato',
   'admin.btn_suspend': 'Sospendi',
   'admin.btn_unsuspend': 'Riattiva',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': 'Dettagli',
   'admin.btn_delete': 'Elimina',
   'admin.delete_confirm': 'Eliminare l’account «{user}»? L’operazione non può essere '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index f0b7e4b..f80f5d7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -344,6 +344,11 @@ export default {
     + '申告されたアドレスは、node が STUN サーバーから知り得た「自分のアドレス」として'
     + '送ってきたものです。node に到達するには役立ちますが、何かの証拠にはなりません。',
   'admin.tab_blocklist': 'ブロックリスト',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'ユーザー',
@@ -363,6 +368,8 @@ export default {
   'admin.no_users': 'ユーザーが見つかりません',
   'admin.btn_suspend': '停止',
   'admin.btn_unsuspend': '再開',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': '詳細',
   'admin.btn_delete': '削除',
   'admin.delete_confirm': 'アカウント「{user}」を削除しますか？この操作は取り消せません。'
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 8f3178a..ddd62c2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -352,6 +352,11 @@ export default {
     + 'node zelf denkt te zijn, vernomen van een STUN-server en naar ons gestuurd; het '
     + 'helpt de node te bereiken en bewijst niets.',
   'admin.tab_blocklist': 'Blokkeerlijst',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'Gebruikers',
@@ -371,6 +376,8 @@ export default {
   'admin.no_users': 'Geen gebruikers gevonden',
   'admin.btn_suspend': 'Schorsen',
   'admin.btn_unsuspend': 'Herstellen',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': 'Details',
   'admin.btn_delete': 'Verwijderen',
   'admin.delete_confirm': 'Het account "{user}" verwijderen? Dit kan niet ongedaan '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 73db56f..c4a3c32 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -364,6 +364,11 @@ export default {
     + 'poznany od serwera STUN i przesłany do nas; przydaje się do nawiązania '
     + 'połączenia i niczego nie dowodzi.',
   'admin.tab_blocklist': 'Lista blokad',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'Użytkownicy',
@@ -383,6 +388,8 @@ export default {
   'admin.no_users': 'Nie znaleziono użytkowników',
   'admin.btn_suspend': 'Zawieś',
   'admin.btn_unsuspend': 'Przywróć',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': 'Szczegóły',
   'admin.btn_delete': 'Usuń',
   'admin.delete_confirm': 'Usunąć konto „{user}”? Tej operacji nie da się cofnąć. '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 1fc70dd..868ad30 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -350,6 +350,11 @@ export default {
     + 'aprendido de um servidor STUN e enviado a nós; serve para alcançar o node e não '
     + 'prova coisa alguma.',
   'admin.tab_blocklist': 'Lista de bloqueio',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': 'Usuários',
@@ -369,6 +374,8 @@ export default {
   'admin.no_users': 'Nenhum usuário encontrado',
   'admin.btn_suspend': 'Suspender',
   'admin.btn_unsuspend': 'Reativar',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': 'Detalhes',
   'admin.btn_delete': 'Excluir',
   'admin.delete_confirm': 'Excluir a conta "{user}"? Esta ação não pode ser desfeita. '
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index e67eed8..f019130 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -336,6 +336,11 @@ export default {
     + '需要答复查询时应以此为准。自报地址是 node 自认为的地址，从 STUN 服务器获知后发给我们；'
     + '它有助于连上该 node，但不能证明任何事情。',
   'admin.tab_blocklist': '屏蔽列表',
+  'admin.tab_general': "General",
+  'admin.general_groups_heading': "Groups",
+  'admin.allow_public_groups_label': "Allow members to create public groups",
+  'admin.allow_public_groups_hint': "When off, new groups can only be private and invite-only. Existing public groups are left as they are — suspend them one by one from the Groups tab.",
+  'admin.settings_readonly': "Only an admin can change these settings.",
 
   // Admin stats
   'admin.stat_users': '用户',
@@ -355,6 +360,8 @@ export default {
   'admin.no_users': '未找到用户',
   'admin.btn_suspend': '停用',
   'admin.btn_unsuspend': '恢复',
+  'admin.btn_revoke': "Revoke",
+  'admin.revoke_group_confirm': "Revoke the group \"{group}\"? This pushes a signed revocation to every node hosting it and cannot be undone from here. Suspend it instead if you only need to pause it.",
   'admin.btn_details': '详情',
   'admin.btn_delete': '删除',
   'admin.delete_confirm': '删除账户“{user}”？此操作无法撤销。'