iobroker.eos-admin 7.10.0 → 7.10.2

package/build/main.js

@@ -20,7 +20,6 @@ const socket_classes_1 = require("@iobroker/socket-classes");
 const ws_server_1 = require("@iobroker/ws-server");
 const translations_1 = require("./lib/translations");
 const web_1 = require("./lib/web");
-const eosPassword_1 = require("./lib/eosPassword");
 const checkLinuxPass_1 = require("./lib/checkLinuxPass");
 const plugin_docker_1 = require("@iobroker/plugin-docker");
 const objectFixes_1 = require("./lib/objectFixes");
@@ -197,43 +196,27 @@ async function ensureEosStableInitialAccounts(adapter) {
         let object = await adapter.getForeignObjectAsync(id);
         let created = false;
         if (!object) {
-            await adapter.setForeignObjectAsync(id, {
-                type: 'user',
-                common: { name: account.user, enabled: true, password: '' },
-                native: {},
-            }, { user: 'system.user.admin' });
+            await adapter.setForeignObjectAsync(id, { type: 'user', common: { name: account.user, enabled: true, password: '' }, native: {} }, { user: 'system.user.admin' });
             object = await adapter.getForeignObjectAsync(id);
             created = true;
         }
-        if (!object) {
-            adapter.log.error(`Cannot prepare EOS account ${account.user}`);
-            continue;
-        }
-        const eosNative = object.native || {};
-        const resetRequested = eosNative.nexowattResetRequested === true || eosNative.eosResetRequested === true;
-        const passwordMissing = !object.common?.password;
-        const pendingFirstLogin = eosNative.nexowattPasswordChangeRequired === true || eosNative.eosPasswordChangeRequired === true || eosNative.nexowattFirstLoginPending === true || eosNative.eosFirstLoginRequired === true;
-        const stableCredentialMissing = eosNative.nexowattStableInitialCredentialVersion !== 1;
-        if (created || passwordMissing || resetRequested || (pendingFirstLogin && stableCredentialMissing)) {
-            await (0, eosPassword_1.setEosUserPasswordWithVerification)(adapter, id, EOS_STABLE_INITIAL_PASSWORD, 'system.user.admin');
-            await adapter.extendForeignObjectAsync(id, {
-                native: {
-                    ...eosNative,
-                    nexowattManaged: true,
-                    nexowattRole: account.role,
-                    nexowattPasswordChangeRequired: true,
-                    eosPasswordChangeRequired: true,
-                    nexowattFirstLoginPending: true,
-                    eosFirstLoginRequired: true,
-                    nexowattInitialPasswordApplied: true,
-                    nexowattInitialPasswordVersion: 1,
-                        nexowattStableInitialCredentialVersion: 1,
-                    nexowattResetRequested: false,
-                    eosResetRequested: false,
-                },
-            }, { user: 'system.user.admin' });
-            adapter.log.info(`Prepared EOS ${account.role} account ${account.user} for mandatory first password change`);
+        if (!object) { adapter.log.error(`Cannot prepare EOS account ${account.user}`); continue; }
+        if (created || !String(object.common?.password || '').trim()) {
+            await adapter.setPasswordAsync(account.user, EOS_STABLE_INITIAL_PASSWORD, { user: 'system.user.admin' });
+            object = await adapter.getForeignObjectAsync(id);
         }
+        if (!object) continue;
+        const previous = object.native || {};
+        const previousAccount = previous.nexowattEosAccount || {};
+        await adapter.extendForeignObjectAsync(id, { native: {
+            ...previous, nexowattManaged: true, nexowattRole: account.role,
+            nexowattPasswordChangeRequired: false, eosPasswordChangeRequired: false,
+            nexowattFirstLoginPending: false, eosFirstLoginRequired: false,
+            nexowattResetRequested: false, eosResetRequested: false,
+            nexowattEosAccount: { ...previousAccount, passwordInitialized: true, passwordSetupVersion: 1,
+                passwordInitializationVersion: 1, forcePasswordChange: false,
+                passwordlessFirstLoginAllowed: false, standardPasswordMode: true },
+        } }, { user: 'system.user.admin' });
         await ensureEosStableGroupMembership(adapter, account.user, account.role);
     }
 }
@@ -964,7 +947,7 @@ class Admin extends adapter_core_1.Adapter {
                 object: { ...full },
                 state: { ...full },
                 file: { ...full },
-                users: { ...none },
+                users: { list: true, read: true, write: false, create: false, delete: false },
                 other: { execute: false, http: true, sendto: true },
             };
         }
@@ -972,7 +955,7 @@ class Admin extends adapter_core_1.Adapter {
             object: { list: true, read: true, write: true, create: true, delete: true },
             state: { list: true, read: true, write: true, create: false, delete: false },
             file: { list: true, read: true, write: false, create: false, delete: false },
-            users: { ...none },
+            users: { list: true, read: true, write: false, create: false, delete: false },
             other: { execute: false, http: true, sendto: true },
         };
     }
@@ -1119,10 +1102,10 @@ class Admin extends adapter_core_1.Adapter {
             },
             native: {
                 nexowattEosAccount: {
-                    passwordInitialized: false,
-                    passwordSetupVersion: 0,
-                    forcePasswordChange: true,
-                    passwordlessFirstLoginAllowed: true,
+                    passwordInitialized: true,
+                    passwordSetupVersion: 1,
+                    forcePasswordChange: false,
+                    passwordlessFirstLoginAllowed: false,
                     provisionedBy: 'NexoWatt EOS',
                     provisionedAt: new Date().toISOString(),
                 },
@@ -1153,7 +1136,7 @@ class Admin extends adapter_core_1.Adapter {
         }
         if (String(user.common.password || '') === '') {
             const bootstrapSecret = `${(0, node_crypto_1.randomBytes)(48).toString('base64url')}!aA1`;
-            await (0, eosPassword_1.setEosUserPasswordWithVerification)(this, userId, bootstrapSecret, ADMIN_OWNER_USER);
+            await this.setPasswordAsync(userId.replace(/^system\.user\./, ''), bootstrapSecret, { user: ADMIN_OWNER_USER });
             user = (await this.getForeignObjectAsync(userId));
             if (!user) {
                 return;
@@ -1198,11 +1181,9 @@ class Admin extends adapter_core_1.Adapter {
         const endUsers = ['system.user.guest', 'system.user.user', 'system.user.endkunde', 'system.user.kunde'];
         for (const userId of installerUsers) {
             await this.addUserToEosGroup(userId, installerGroup);
-            await this.prepareEosPasswordlessFirstLogin(userId);
         }
         for (const userId of endUsers) {
             await this.addUserToEosGroup(userId, endUserGroup);
-            await this.prepareEosPasswordlessFirstLogin(userId);
         }
     }
     async refreshEosRoleCache() {
@@ -1211,9 +1192,7 @@ class Admin extends adapter_core_1.Adapter {
         const priorities = { enduser: 1, installer: 2, admin: 3 };
         const assign = (userId, role) => {
             const current = next.get(userId);
-            if (!current || priorities[role] > priorities[current]) {
-                next.set(userId, role);
-            }
+            if (!current || priorities[role] > priorities[current]) next.set(userId, role);
         };
         for (const [roleName, groupIds] of [
             ['admin', this.getEosRoleGroupIds('service')],
@@ -1222,29 +1201,15 @@ class Admin extends adapter_core_1.Adapter {
             ['admin', ['system.group.administrator']],
         ]) {
             for (const groupId of groupIds) {
-                const group = (await this.getForeignObjectAsync(groupId));
-                for (const member of group?.common?.members || []) {
-                    assign(member, roleName);
-                }
+                const group = await this.getForeignObjectAsync(groupId);
+                for (const member of group?.common?.members || []) assign(member, roleName);
             }
         }
         this.eosRoleCache.clear();
         this.eosPasswordSetupRequired.clear();
-        for (const [userId, role] of next.entries()) {
-            this.eosRoleCache.set(userId, role);
-            if (role === 'admin') {
-                continue;
-            }
-            const user = (await this.getForeignObjectAsync(userId));
-            const native = (user?.native || {});
-            const account = (native.nexowattEosAccount || {});
-            const initialized = account.passwordInitialized === true
-                || Number(account.passwordSetupVersion || account.passwordInitializationVersion || 0) >= 1;
-            if (account.forcePasswordChange === true || !initialized) {
-                this.eosPasswordSetupRequired.add(userId);
-            }
-        }
+        for (const [userId, role] of next.entries()) this.eosRoleCache.set(userId, role);
     }
+
     getEosCachedRole(userId) {
         if (userId === 'system.user.admin') {
             return 'admin';
@@ -1279,9 +1244,6 @@ class Admin extends adapter_core_1.Adapter {
             if (role === 'admin') {
                 return original(socketClient, command, callback, ...args);
             }
-            if (userId && this.eosPasswordSetupRequired.has(userId)) {
-                return deny(socketClient, command, callback, 'personal password setup is required');
-            }
             if (command === 'cmdExec') {
                 if (role !== 'installer') {
                     return deny(socketClient, command, callback, 'raw command execution is Service-only');
@@ -1304,6 +1266,16 @@ class Admin extends adapter_core_1.Adapter {
             if (role === 'enduser' && ['readLogs', 'sendToHost'].includes(command)) {
                 return deny(socketClient, command, callback, 'technical diagnostics are installer/service-only');
             }
+            if (command === 'changePassword') {
+                const targetRaw = String(args[0] || '').trim();
+                const targetUser = targetRaw.startsWith('system.user.') ? targetRaw : `system.user.${targetRaw}`;
+                const selfUser = String(userId || '');
+                const allowed = role === 'installer'
+                    ? new Set([selfUser, 'system.user.installer', 'system.user.user', 'system.user.guest']).has(targetUser)
+                    : targetUser === selfUser;
+                if (!allowed) return deny(socketClient, command, callback, 'password target outside EOS role scope');
+                return true;
+            }
             if (['addUser', 'delUser', 'addGroup', 'delGroup'].includes(command)) {
                 return deny(socketClient, command, callback, 'account administration is Service-only');
             }

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.10.0",
+    "version": "7.10.2",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,6 +18,21 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
+      "7.10.2": {
+        "de": "Stable-Hotfix 7.10.2 beseitigt die EOS-Admin-Startschleife: Stable-Update-Status wird nicht mehr in die laufende Instanzkonfiguration geschrieben, der erste Abgleich startet verzögert und das Release prüft die vollständige Backend-Modulkette einschließlich eosRequestSecurity.",
+        "en": "Stable hotfix 7.10.2 removes the EOS Admin restart loop: stable-update status is no longer written to the running instance configuration, first reconciliation is delayed, and the release validates the complete backend module chain including eosRequestSecurity.",
+        "nl": "Stable-hotfix 7.10.2 verhelpt de EOS Admin-herstartlus: de status van stabiele updates wordt niet meer naar de configuratie van de actieve instantie geschreven, de eerste synchronisatie start vertraagd en de release controleert de volledige backendmoduleketen inclusief eosRequestSecurity."
+      },
+      "7.10.1": {
+        "de": "Stable-Kandidat 7.10.1 basiert wieder auf 7.9.98: native Passwortverwaltung ohne erzwungene Erstpasswortseite, dauerhafter Cockpit-Scrollbereich, Stift im unteren Kartenbereich und abschaltbare NexoWatt-Stable-Updates.",
+        "en": "Stable candidate 7.10.1 returns to the 7.9.98 baseline: native password management without forced first-password page, persistent cockpit scrolling, in-grid edit control and optional NexoWatt stable updates.",
+        "nl": "Stable-kandidaat 7.10.1 keert terug naar de 7.9.98-basis: native wachtwoordbeheer zonder verplichte eerste-wachtwoordpagina, blijvend cockpit-scrollen, bewerken in het onderste kaartgebied en uitschakelbare NexoWatt-stabiele updates."
+      },
+      "7.9.98": {
+        "de": "Stable-Kandidat 7.9.98 ergänzt den vertikalen Cockpit-Scrollbereich, bereinigt die Login-Felder und korrigiert Passwort-Reset sowie persönliche Erstpasswortvergabe über die echte ioBroker-Passwort-API.",
+        "en": "Stable candidate 7.9.98 adds vertical cockpit scrolling, cleans up login fields and fixes password reset plus first personal password setup through the real ioBroker password API.",
+        "nl": "Stable-kandidaat 7.9.98 voegt verticaal scrollen in het cockpit toe, herstelt de loginvelden en corrigeert wachtwoordreset en het eerste persoonlijke wachtwoord via de echte ioBroker-wachtwoord-API."
+      },
       "7.9.95": {
         "de": "Stable 7.9.95 macht den Release-Ordner mergesicher: Die flache Update-ZIP kann direkt über einen bestehenden Arbeitsordner entpackt werden. Vor Paketprüfung und npm-Veröffentlichung werden package.json, io-package.json, beide Lockdateien, die Frontend-Version, Build-Informationen und der aktuelle Repository-Eintrag automatisch auf dieselbe Version gebracht. Dadurch wird insbesondere ein stehen gebliebenes io-package.json aus 7.9.92/7.9.94 automatisch repariert. Die Funktionen aus 7.9.94 bleiben unverändert.",
         "en": "Stable 7.9.95 makes the release folder merge-safe: the flat update ZIP can be extracted directly over an existing working directory. Before package validation and npm publishing, package.json, io-package.json, both lockfiles, the frontend version, build information and the current repository entry are synchronized automatically. In particular, a stale io-package.json from 7.9.92/7.9.94 is repaired automatically. Functional behavior from 7.9.94 remains unchanged.",
@@ -329,7 +344,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.0/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.2/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -340,7 +355,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.0/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.2/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -408,7 +423,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.0/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.2/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -538,7 +553,7 @@
         "enabled": true
       }
     ],
-    "eosRequireFirstLoginPassword": true,
+    "eosRequireFirstLoginPassword": false,
     "eosFirstLoginPasswordMinLength": 10,
     "eosAutoAssignDefaultRoleUsers": true,
     "eosPasswordlessFirstLogin": false,
@@ -547,7 +562,7 @@
     "eosHideLegacyBackupFromNonAdmins": true,
     "nexowattHideLegacyBackupFromNonAdmins": true,
     "eosAllowPasswordlessFirstLogin": false,
-    "eosRequireFirstLoginPasswordChange": true,
+    "eosRequireFirstLoginPasswordChange": false,
     "eosAutoAssignStandardAccounts": true,
     "eosAssistEnabled": false,
     "eosNexoWattAutoUpdate": true
@@ -838,6 +853,56 @@
       },
       "native": {}
     },
+    {
+      "_id": "info.nexowattStableUpdatesEnabled",
+      "type": "state",
+      "common": {
+        "name": {
+          "en": "NexoWatt stable automatic updates enabled",
+          "de": "Automatische NexoWatt-Stable-Updates aktiviert",
+          "ru": "Автоматические стабильные обновления NexoWatt включены",
+          "pt": "Atualizações estáveis automáticas da NexoWatt ativadas",
+          "nl": "Automatische stabiele NexoWatt-updates ingeschakeld",
+          "fr": "Mises à jour stables automatiques NexoWatt activées",
+          "it": "Aggiornamenti stabili automatici NexoWatt abilitati",
+          "es": "Actualizaciones estables automáticas de NexoWatt activadas",
+          "pl": "Automatyczne stabilne aktualizacje NexoWatt włączone",
+          "uk": "Автоматичні стабільні оновлення NexoWatt увімкнено",
+          "zh-cn": "已启用 NexoWatt 稳定版自动更新"
+        },
+        "role": "switch.enable",
+        "type": "boolean",
+        "read": true,
+        "write": false,
+        "def": true
+      },
+      "native": {}
+    },
+    {
+      "_id": "info.nexowattStableUpdatesState",
+      "type": "state",
+      "common": {
+        "name": {
+          "en": "NexoWatt stable automatic update runtime state",
+          "de": "Laufzeitstatus der automatischen NexoWatt-Stable-Updates",
+          "ru": "Состояние автоматических стабильных обновлений NexoWatt",
+          "pt": "Estado das atualizações estáveis automáticas da NexoWatt",
+          "nl": "Runtime-status van automatische stabiele NexoWatt-updates",
+          "fr": "État des mises à jour stables automatiques NexoWatt",
+          "it": "Stato degli aggiornamenti stabili automatici NexoWatt",
+          "es": "Estado de las actualizaciones estables automáticas de NexoWatt",
+          "pl": "Stan automatycznych stabilnych aktualizacji NexoWatt",
+          "uk": "Стан автоматичних стабільних оновлень NexoWatt",
+          "zh-cn": "NexoWatt 稳定版自动更新运行状态"
+        },
+        "role": "json",
+        "type": "json",
+        "read": true,
+        "write": false,
+        "def": "{}"
+      },
+      "native": {}
+    },
     {
       "_id": "info.newsFeed",
       "type": "state",
@@ -1118,5 +1183,5 @@
       }
     }
   },
-  "version": "7.10.0"
+  "version": "7.10.2"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin – stable candidate with native NexoWatt auto updates, reliable account passwords, clean login and scrollable cockpit.",
-  "version": "7.10.0",
+  "description": "NexoWatt EOS Admin – repaired stable baseline with restart-safe automatic updates, native account passwords and persistent cockpit scrolling.",
+  "version": "7.10.2",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -118,27 +118,27 @@
     "tools/nexowatt-version-sync-selftest.cjs",
     "tools/nexowatt-merge-update-selftest.cjs",
     "tools/nexowatt-ems-overview-selftest.cjs",
-    "README_STABILITY_V7.10.0.md",
-    "RELEASE_NOTES_V7.10.0.md",
-    "PUBLISH_STABLE_V7.10.0.md",
-    "INSTALL_TEST_V7.10.0.md",
-    "RELEASE_ACCEPTANCE_V7.10.0.md",
-    "MERGE_UPDATE_README_V7.10.0.md",
     "README_EMS_OVERVIEW_MERGE.md",
     "RC73_EOS_ADMIN_MERGE_VALIDATION.md",
     "VALIDATION_EMS_OVERVIEW_MERGE.md",
     "NexoWatt_EOS_Admin_EMS_OVERVIEW_MERGE_VALIDATION.md",
     "tools/nexowatt-apply-ems-overview.cjs",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs",
-    "tools/nexowatt-stable-v7100-selftest.cjs",
     "tools/nexowatt-password-write-selftest.cjs",
-    "tools/nexowatt-request-security-selftest.cjs",
-    "tools/nexowatt-cache-update-selftest.cjs",
-    "src/lib/eosAutoUpdate.ts",
-    "build/lib/eosAutoUpdate.js",
-    "adminWww/js/eos-auto-update.js",
+    "tools/nexowatt-account-password-flow-selftest.cjs",
+    "tools/nexowatt-auto-update-selftest.cjs",
     "adminWww/css/eos-auto-update.css",
-    "tools/nexowatt-auto-update-selftest.cjs"
+    "adminWww/js/eos-auto-update.js",
+    "tools/nexowatt-backend-runtime-selftest.cjs",
+    "NEXOWATT_EOS_PREBUILT_MANIFEST.json",
+    "tools/nexowatt-prebuilt-release-selftest.cjs",
+    "tools/nexowatt-stable-v7102-selftest.cjs",
+    "README_STABILITY_V7.10.2.md",
+    "RELEASE_NOTES_V7.10.2.md",
+    "PUBLISH_STABLE_V7.10.2.md",
+    "INSTALL_TEST_V7.10.2.md",
+    "RELEASE_ACCEPTANCE_V7.10.2.md",
+    "MERGE_UPDATE_README_V7.10.2.md"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -149,8 +149,8 @@
     "test:integration": "mocha test/integration --exit && npm run test:gui && npm run test:rule && npm run test:unit",
     "test:rule": "mocha test/rule --exit",
     "test:gui": "mocha test/*.gui.js --exit",
-    "prepublishOnly": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
-    "build": "npm run build:frontend && npm run build:backend && npm run clean:eos-runtime",
+    "prepublishOnly": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
+    "build": "npm run build:frontend && npm run build:backend && npm run clean:eos-runtime && npm run seal:eos-prebuilt-release",
     "build:backend": "tsc -p tsconfig.build.json && tsx tasks.mts --backend-i18n",
     "build:frontend": "tsx tasks.mts",
     "clean": "rimraf src-admin/build",
@@ -173,12 +173,12 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-cache-update-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-request-security-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && npm run check:eos-stable-v7100 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7102 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
     "precheck:eos-stability": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
-    "prepack": "node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-clean-legacy-runtime.cjs --quiet",
+    "prepack": "node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-ensure-release-defaults.cjs && node tools/nexowatt-clean-legacy-runtime.cjs --quiet && node tools/nexowatt-prebuilt-release-selftest.cjs",
     "check:eos-esm": "node tools/nexowatt-esm-syntax-selftest.cjs",
     "check:eos-imports": "node tools/nexowatt-import-integrity-selftest.cjs",
     "check:eos-release": "npm run check:eos-package && npm run check:eos-stability && npm pack --dry-run",
@@ -197,11 +197,10 @@
     "sync:eos-version": "node tools/nexowatt-sync-release-version.cjs",
     "test:eos-version-sync": "node tools/nexowatt-version-sync-selftest.cjs",
     "verify:eos-merge": "node tools/nexowatt-merge-update-selftest.cjs",
-    "test:eos-password-write": "node tools/nexowatt-password-write-selftest.cjs",
-    "test:eos-request-security": "node tools/nexowatt-request-security-selftest.cjs",
-    "test:eos-cache-update": "node tools/nexowatt-cache-update-selftest.cjs",
-    "check:eos-auto-update": "node tools/nexowatt-auto-update-selftest.cjs",
-    "check:eos-stable-v7100": "node tools/nexowatt-stable-v7100-selftest.cjs"
+    "check:eos-backend-runtime": "node tools/nexowatt-backend-runtime-selftest.cjs",
+    "check:eos-stable-v7102": "node tools/nexowatt-stable-v7102-selftest.cjs",
+    "check:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs",
+    "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write"
   },
   "author": "NexoWatt",
   "private": false,
@@ -212,7 +211,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product release 7.10.0"
+    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.2"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-account-management-selftest.cjs

@@ -1,23 +1,19 @@
 #!/usr/bin/env node
 'use strict';
-const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const json=rel=>JSON.parse(read(rel));
-const fail=m=>{console.error(`[NexoWatt EOS account management] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
-const mainSource=read('src/main.ts'),mainBuilt=read('build/main.js'),webSource=read('src/lib/web.ts'),webBuilt=read('build/lib/web.js'),passwordSource=read('src/lib/eosPassword.ts');
-const sourceUi=read('src-admin/public/js/eos-account-management.js'),builtUi=read('adminWww/js/eos-account-management.js'),roleUi=read('adminWww/js/eos-role-ui.js'),css=read('adminWww/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),info=json('NEXOWATT_EOS_BUILD_INFO.json'),shellTag=String(info.shellCacheTag||info.shellCacheVersion);
-for(const code of [mainSource,mainBuilt])for(const marker of ['system.user.installer','system.user.guest','ensureEosDefaultRoleUsers','unknown random bootstrap secret','personal password setup is required'])must(code.includes(marker),`main marker missing: ${marker}`);
+const fs=require('fs');const path=require('path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const json=rel=>JSON.parse(read(rel));let bad=false;const fail=msg=>{console.error(`[NexoWatt EOS account management] ${msg}`);bad=true;};
+const mainSource=read('src/main.ts'),mainBuilt=read('build/main.js'),webSource=read('src/lib/web.ts'),webBuilt=read('build/lib/web.js'),sourceUi=read('src-admin/public/js/eos-account-management.js'),builtUi=read('adminWww/js/eos-account-management.js'),roleUi=read('adminWww/js/eos-role-ui.js'),css=read('adminWww/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),info=json('NEXOWATT_EOS_BUILD_INFO.json'),shellTag=String(info.shellCacheTag||info.shellCacheVersion);
+for(const code of [mainSource,mainBuilt])for(const marker of ['system.user.installer','system.user.guest','ensureEosDefaultRoleUsers','unknown random bootstrap secret','eosPasswordSetupRequired','personal password setup is required'])if(!code.includes(marker))fail(`main marker missing: ${marker}`);
 for(const code of [webSource,webBuilt]){
-  for(const marker of ['getEosManagedAccounts','sendEosAccountManagement','resetEosAccountPassword','/nexowatt/account/manage','/nexowatt/account/reset','x-nexowatt-eos-account-reset','canResetInstaller','canResetEndUser',"targetUserId === 'system.user.admin'",'targetUserId === access.userId','const managedAccounts = await this.getEosManagedAccounts(access.role)','const managedTarget = managedAccounts.find(account => account.id === targetUserId)',"managedTarget?.role === 'installer'","managedTarget?.role === 'enduser'",'passwordResetAt','passwordResetBy',"passwordResetMode = 'initial-password'","setEosUserPassword(targetUserId, 'nexowatt')",'passwordlessFirstLoginAllowed = false','initialPasswordRequired: true','accountDisabled','passwordMetadataNotPersisted']) must(code.includes(marker),`web marker missing: ${marker}`);
-  must(!code.includes('const explicitInstaller = targetAccess.groups.some'),'obsolete explicit installer re-classifier remains');
-  must(!code.includes('const explicitEndUser = targetAccess.groups.some'),'obsolete explicit end-user re-classifier remains');
-  must(!code.includes('setForeignObjectAsync(targetUserId, user)'),'reset still writes stale full user object');
+ for(const marker of ['getEosManagedAccounts','sendEosAccountManagement','resetEosAccountPassword','/nexowatt/account/manage','/nexowatt/account/reset','x-nexowatt-eos-account-reset','canResetInstaller','canResetEndUser',"targetUserId === 'system.user.admin'",'targetUserId === access.userId',"access.role === 'installer' && explicitlyManagedRole !== 'enduser'",'passwordResetAt','passwordResetBy',"passwordResetMode = 'initial-password'","setEosUserPassword(targetUserId, 'nexowatt')",'passwordlessFirstLoginAllowed = false','initialPasswordRequired: true','accountDisabled','getEosPasswordUserName','setPasswordAsync(userName, password','checkPasswordAsync(userName, password','updateEosAccountMetadata','extendForeignObjectAsync','invalidRequestOrigin'])if(!code.includes(marker))fail(`web marker missing: ${marker}`);
+ if(!code.includes('const explicitInstaller = targetAccess.groups.some')||!code.includes('const explicitEndUser = targetAccess.groups.some'))fail('explicit managed-group guard missing');
+ const reset=code.slice(code.indexOf('resetEosAccountPassword'),code.indexOf('getEosHistoryInstances'));
+ if(reset.includes('setForeignObjectAsync(targetUserId'))fail('reset replaces the complete user object after password write');
 }
-for(const marker of ['apiTarget: normalized.userId','apiTarget: normalized.userName','verifyAfterWrite','passwordNotPersisted','passwordVerificationFailed'])must(passwordSource.includes(marker),`password helper marker missing: ${marker}`);
-for(const marker of ["VERSION = 'v7100-account-management-password-write'","['admin', 'installer']",'nexowatt/account/manage','nexowatt/account/reset','X-NexoWatt-EOS-Account-Reset','data.canResetInstaller === true',"account.role === 'enduser'",'Admin/Service','Installateure','NEXOWATT_EOS_ACCOUNT_MANAGEMENT','ensureEntrySurface',"currentRoute() !== 'tab-users'",'eos-account-management-entry','Startpasswort „nexowatt“','passwordVerificationFailed'])must(sourceUi.includes(marker),`UI marker missing: ${marker}`);
-must(sourceUi===builtUi,'account management source/build drift');
-must(!sourceUi.includes("launcher.className = 'eos-account-management-launcher'"),'standalone account launcher remains');
-must(!sourceUi.includes('new MutationObserver'),'account management adds a broad observer');
-must(roleUi.includes("route === 'tab-users'"),'installer cannot reach Zugänge & Rechte');
-must(!roleUi.includes('NEXOWATT_EOS_ACCOUNT_MANAGEMENT.open'),'overview opens account management outside Zugänge & Rechte');
-must(index.includes(`eos-account-management.js?v=${shellTag}`),'account management cache tag stale');
-for(const marker of ['.eos-account-management-entry','.eos-account-management-overlay','.eos-account-management-dialog','.eos-account-row','.eos-account-reset','html.eos-account-page-installer'])must(css.includes(marker),`CSS marker missing: ${marker}`);
-console.log('[NexoWatt EOS account management] OK (managed-list authorization and real password reset)');
+for(const marker of ['v98-account-management-real-password-write',"['admin', 'installer']",'nexowatt/account/manage','nexowatt/account/reset','X-NexoWatt-EOS-Account-Reset','data.canResetInstaller === true',"account.role === 'enduser'",'Startpasswort „nexowatt“','accountErrorText','invalidRequestOrigin','credentials: \'include\'','NEXOWATT_EOS_ACCOUNT_MANAGEMENT','ensureEntrySurface',"currentRoute() !== 'tab-users'",'eos-account-management-entry'])if(!sourceUi.includes(marker))fail(`account UI marker missing: ${marker}`);
+if(sourceUi.includes("launcher.className = 'eos-account-management-launcher'"))fail('standalone account launcher remains');
+if(sourceUi.includes('new MutationObserver'))fail('account management adds a second broad MutationObserver');
+if(sourceUi!==builtUi)fail('account UI source/build drift');
+if(!roleUi.includes("route === 'tab-users'"))fail('installer cannot reach access page');
+if(!index.includes(`eos-account-management.js?v=${shellTag}`))fail('account asset cache tag mismatch');
+for(const marker of ['.eos-account-management-entry','.eos-account-management-overlay','.eos-account-management-dialog','.eos-account-row','.eos-account-reset'])if(!css.includes(marker))fail(`account CSS missing: ${marker}`);
+if(bad)process.exit(1);console.log('[NexoWatt EOS account management] OK');

package/tools/nexowatt-account-password-flow-selftest.cjs

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('node:fs'),path=require('node:path');const root=path.resolve(__dirname,'..');const read=r=>fs.readFileSync(path.join(root,r),'utf8');const fail=m=>{console.error('[NexoWatt EOS standard password flow] '+m);process.exit(1)};const must=(v,m)=>{if(!v)fail(m)};
+const source=read('src/main.ts'),built=read('build/main.js'),boot=read('adminWww/js/eos-role-bootstrap.js'),role=read('adminWww/js/eos-role-ui.js'),index=read('adminWww/index.html'),io=JSON.parse(read('io-package.json'));
+for(const code of [source,built]){
+ must(code.includes("EOS_STABLE_INITIAL_PASSWORD = 'nexowatt'"),'initial password constant missing');
+ must(code.includes("if (created || !String(object.common?.password || '').trim())")||code.includes("if (created || !String(object.common?.password || '').trim())"),'password is not limited to new/passwordless accounts');
+ for(const marker of ['nexowattPasswordChangeRequired: false','eosPasswordChangeRequired: false','nexowattFirstLoginPending: false','eosFirstLoginRequired: false','forcePasswordChange: false','standardPasswordMode: true']) must(code.includes(marker),`legacy first-login flag is not cleared: ${marker}`);
+ must(code.includes("command === 'changePassword'")&&code.includes('password target outside EOS role scope'),'native password command role guard missing');
+}
+must(io.native.eosRequireFirstLoginPassword===false&&io.native.eosRequireFirstLoginPasswordChange===false,'forced first-password defaults remain');
+must(!boot.includes('installIntegratedFirstLogin(base);')&&!boot.includes('showFirstLoginPassword(resolved, base);'),'forced password surface remains active');
+must(!index.includes('eos-account-management.js'),'custom reset runtime remains active');
+must(role.includes('filterNativeUsersPage')&&role.includes("route === 'tab-users'"),'role-scoped native Users page missing');
+console.log('[NexoWatt EOS standard password flow] OK (nexowatt only on creation, native password editor, no forced reset flow)');

package/tools/nexowatt-apply-ems-overview.cjs

@@ -52,7 +52,7 @@ if (!css.includes(cssMarker)) {
     overflow: hidden;
 }
 .eos-ems-overview-card * { box-sizing: border-box; }
-.eos-ems-overview-header { display:flex; align-items:flex-start; justify-content:flex-start; gap:20px; }
+.eos-ems-overview-header { display:flex; align-items:flex-start; justify-content:space-between; gap:20px; }
 .eos-ems-overview-header h2 { margin:5px 0 6px; font-size:clamp(1.2rem,2vw,1.65rem); color:#f5fbff; }
 .eos-ems-overview-header p { margin:0; max-width:760px; color:#9eb2c2; line-height:1.45; }
 .eos-ems-overview-eyebrow { color:#49e39e; font-size:.72rem; font-weight:900; letter-spacing:.13em; text-transform:uppercase; }
@@ -83,7 +83,9 @@ if (!css.includes(cssMarker)) {
 .eos-ems-overview-event time { color:#6f8799; font-size:.68rem; font-variant-numeric:tabular-nums; }
 .eos-ems-overview-event div { display:grid; gap:2px; min-width:0; }
 .eos-ems-overview-empty { color:#718797; font-size:.76rem; }
-.eos-ems-overview-footer { display:flex; justify-content:flex-start; gap:12px; margin-top:12px; color:#60798a; font-size:.67rem; }
+.eos-ems-overview-footer { display:flex; justify-content:space-between; gap:12px; margin-top:12px; color:#60798a; font-size:.67rem; }
+.eos-ems-overview-footer a { color:#5ee0c2; font-weight:800; text-decoration:none; }
+.eos-ems-overview-footer a:hover,.eos-ems-overview-footer a:focus-visible { color:#9af2dd; text-decoration:underline; }
 @media (max-width: 1100px) {
     .eos-ems-overview-card { flex-basis:100%; max-width:none; }
 }