iobroker.eos-admin 7.10.0 → 7.10.2

package/adminWww/js/eos-account-management.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7100-account-management-password-write';
+    const VERSION = 'v98-account-management-real-password-write';
     const script = document.currentScript || document.querySelector('script[src*="eos-account-management.js"]');
     const base = new URL('../', script?.src || window.location.href);
     const abort = new AbortController();
@@ -19,11 +19,10 @@
             introInstaller: 'Du kannst Endkundenzugänge zurücksetzen. Admin- und Installateurzugänge bleiben NexoWatt Service vorbehalten.',
             loading: 'Zugänge werden geladen …', empty: 'Keine passenden Konten gefunden.', close: 'Schließen', refresh: 'Aktualisieren',
             installer: 'Installateur', enduser: 'Endkunde / Gast', active: 'Passwort aktiv', first: 'Erstanmeldung offen', disabled: 'Deaktiviert',
-            reset: 'Passwort zurücksetzen', resetting: 'Wird zurückgesetzt …', resetConfirm: name => `Soll der Zugang „${name}“ wirklich zurückgesetzt werden? Danach gilt einmalig das Startpasswort „nexowatt“ und anschließend muss ein persönliches Passwort vergeben werden.`,
-            resetDone: name => `Der Zugang „${name}“ wurde im EOS-Benutzerkonto auf „nexowatt“ zurückgesetzt. Nach der nächsten Anmeldung muss sofort ein persönliches Passwort vergeben werden.`,
-            resetFailed: 'Der Zugang konnte nicht zurückgesetzt werden.', lastSet: 'Letzte Passwortvergabe', lastReset: 'Letzter Reset', by: 'durch',
+            reset: 'Passwort zurücksetzen', resetting: 'Wird zurückgesetzt …', resetConfirm: name => `Soll der Zugang „${name}“ wirklich zurückgesetzt werden? Das bisherige Passwort wird ungültig. Danach gilt einmalig das Startpasswort „nexowatt“ und beim nächsten Login muss sofort ein persönliches Passwort vergeben werden.`,
+            resetDone: name => `Der Zugang „${name}“ ist zurückgesetzt. Einmalig mit dem Startpasswort „nexowatt“ anmelden und anschließend direkt ein persönliches Passwort festlegen.`,
+            resetFailed: 'Der Zugang konnte nicht zurückgesetzt werden.', permissionError: 'Für dieses Konto ist das Zurücksetzen nicht erlaubt.', originError: 'Die Sicherheitsprüfung der Anfrage ist fehlgeschlagen. Seite mit Strg+F5 neu laden.', disabledError: 'Das Konto ist deaktiviert und kann nicht zurückgesetzt werden.', notFoundError: 'Das Konto wurde nicht gefunden.', writeError: 'Das neue Startpasswort konnte nicht in das Benutzerkonto geschrieben werden.', lastSet: 'Letzte Passwortvergabe', lastReset: 'Letzter Reset', by: 'durch',
             security: 'Admin/Service darf Installateur und Endkunde zurücksetzen. Installateure dürfen ausschließlich Endkunden zurücksetzen.',
-            errors: { permissionError: 'Die Admin-/Installateurberechtigung konnte nicht bestätigt werden. Bitte neu anmelden.', invalidRequest: 'Die Sicherheitsbestätigung fehlt. Bitte die Seite neu laden.', invalidRequestOrigin: 'Die Sitzung oder Adresse hat sich geändert. Bitte die Seite neu laden.', invalidTarget: 'Dieses Konto darf nicht über EOS zurückgesetzt werden.', accountDisabled: 'Das Konto ist deaktiviert.', accountNotFound: 'Das Benutzerkonto wurde nicht gefunden.', passwordApiUnavailable: 'Die EOS-Passwortverwaltung ist nicht verfügbar.', passwordNotPersisted: 'Das Startpasswort wurde nicht gespeichert.', passwordVerificationFailed: 'Das Startpasswort wurde geschrieben, aber nicht als gültige Anmeldung bestätigt.', passwordMetadataNotPersisted: 'Der Erstanmeldungsstatus wurde nicht gespeichert.', accountResetFailed: 'Das Konto konnte serverseitig nicht zurückgesetzt werden.' },
         },
         en: {
             launcher: 'Accounts', titleAdmin: 'Accounts & roles', titleInstaller: 'End-user accounts',
@@ -31,11 +30,10 @@
             introInstaller: 'You may reset end-user accounts. Admin and installer accounts remain reserved for NexoWatt Service.',
             loading: 'Loading accounts …', empty: 'No matching accounts found.', close: 'Close', refresh: 'Refresh',
             installer: 'Installer', enduser: 'End user / Guest', active: 'Password active', first: 'First activation open', disabled: 'Disabled',
-            reset: 'Reset password', resetting: 'Resetting …', resetConfirm: name => `Reset account “${name}”? The one-time initial password will be “nexowatt”; a personal password must then be created immediately.`,
-            resetDone: name => `Account “${name}” was reset in the EOS user account to “nexowatt”. The next sign-in requires an immediate personal password change.`,
-            resetFailed: 'The account could not be reset.', lastSet: 'Last password setup', lastReset: 'Last reset', by: 'by',
+            reset: 'Reset password', resetting: 'Resetting …', resetConfirm: name => `Reset account “${name}”? The current password becomes invalid. Sign in once with the initial password “nexowatt”, then create a personal password immediately.`,
+            resetDone: name => `Account “${name}” was reset. Sign in once with “nexowatt” and then create a personal password.`,
+            resetFailed: 'The account could not be reset.', permissionError: 'Reset is not permitted for this account.', originError: 'The request security check failed. Reload the page with Ctrl+F5.', disabledError: 'The account is disabled and cannot be reset.', notFoundError: 'The account was not found.', writeError: 'The initial password could not be written to the user account.', lastSet: 'Last password setup', lastReset: 'Last reset', by: 'by',
             security: 'Admin/Service may reset installer and end-user accounts. Installers may reset end-user accounts only.',
-            errors: { permissionError: 'Admin/Installer permission could not be confirmed. Sign in again.', invalidRequest: 'The security confirmation is missing. Reload the page.', invalidRequestOrigin: 'The session or address changed. Reload the page.', invalidTarget: 'This account cannot be reset through EOS.', accountDisabled: 'The account is disabled.', accountNotFound: 'The user account was not found.', passwordApiUnavailable: 'The EOS password service is unavailable.', passwordNotPersisted: 'The initial password was not saved.', passwordVerificationFailed: 'The initial password was written but could not be verified.', passwordMetadataNotPersisted: 'The first-login status was not saved.', accountResetFailed: 'The account could not be reset on the server.' },
         },
         nl: {
             launcher: 'Toegangen', titleAdmin: 'Toegangen & rollen', titleInstaller: 'Eindgebruikerstoegangen',
@@ -43,15 +41,26 @@
             introInstaller: 'Je kunt eindgebruikersaccounts resetten. Admin- en installateurstoegang blijft voor NexoWatt Service.',
             loading: 'Toegangen worden geladen …', empty: 'Geen passende accounts gevonden.', close: 'Sluiten', refresh: 'Vernieuwen',
             installer: 'Installateur', enduser: 'Eindgebruiker / Guest', active: 'Wachtwoord actief', first: 'Eerste activering open', disabled: 'Uitgeschakeld',
-            reset: 'Wachtwoord resetten', resetting: 'Wordt gereset …', resetConfirm: name => `Account „${name}“ resetten? Eenmalig geldt het startwachtwoord „nexowatt“, waarna direct een persoonlijk wachtwoord moet worden ingesteld.`,
-            resetDone: name => `Account „${name}“ is in het EOS-gebruikersaccount teruggezet op „nexowatt“. Bij de volgende aanmelding moet direct een persoonlijk wachtwoord worden ingesteld.`,
-            resetFailed: 'Het account kon niet worden gereset.', lastSet: 'Laatste wachtwoordinstelling', lastReset: 'Laatste reset', by: 'door',
+            reset: 'Wachtwoord resetten', resetting: 'Wordt gereset …', resetConfirm: name => `Account „${name}“ resetten? Het huidige wachtwoord wordt ongeldig. Meld één keer aan met het startwachtwoord „nexowatt“ en stel daarna direct een persoonlijk wachtwoord in.`,
+            resetDone: name => `Account „${name}“ is gereset. Meld één keer aan met „nexowatt“ en stel daarna een persoonlijk wachtwoord in.`,
+            resetFailed: 'Het account kon niet worden gereset.', permissionError: 'Resetten is voor dit account niet toegestaan.', originError: 'De veiligheidscontrole van het verzoek is mislukt. Herlaad de pagina met Ctrl+F5.', disabledError: 'Het account is uitgeschakeld en kan niet worden gereset.', notFoundError: 'Het account werd niet gevonden.', writeError: 'Het startwachtwoord kon niet naar het gebruikersaccount worden geschreven.', lastSet: 'Laatste wachtwoordinstelling', lastReset: 'Laatste reset', by: 'door',
             security: 'Admin/service mag installateur- en eindgebruikersaccounts resetten. Installateurs alleen eindgebruikers.',
-            errors: { permissionError: 'De Admin-/Installateurrechten konden niet worden bevestigd. Meld opnieuw aan.', invalidRequest: 'De beveiligingsbevestiging ontbreekt. Herlaad de pagina.', invalidRequestOrigin: 'De sessie of het adres is gewijzigd. Herlaad de pagina.', invalidTarget: 'Dit account kan niet via EOS worden gereset.', accountDisabled: 'Het account is uitgeschakeld.', accountNotFound: 'Het gebruikersaccount is niet gevonden.', passwordApiUnavailable: 'De EOS-wachtwoordservice is niet beschikbaar.', passwordNotPersisted: 'Het startwachtwoord is niet opgeslagen.', passwordVerificationFailed: 'Het startwachtwoord is geschreven maar kon niet worden geverifieerd.', passwordMetadataNotPersisted: 'De eerste-aanmeldstatus is niet opgeslagen.', accountResetFailed: 'Het account kon server-side niet worden gereset.' },
         },
     };
     const t = () => i18n[language()];
-    const errorText = code => t().errors?.[String(code || '')] || String(code || t().resetFailed);
+    const accountErrorText = code => {
+        const text = t();
+        return ({
+            permissionError: text.permissionError,
+            invalidRequestOrigin: text.originError,
+            accountDisabled: text.disabledError,
+            accountNotFound: text.notFoundError,
+            passwordApiUnavailable: text.writeError,
+            passwordWriteFailed: text.writeError,
+            passwordVerificationFailed: text.writeError,
+            userObjectUnavailableAfterPasswordChange: text.writeError,
+        })[String(code || '')] || text.resetFailed;
+    };
     const roleFromPolicy = policy => {
         const raw = normalize(policy?.role || '');
         if (policy?.isAdmin || policy?.isEosAdminGroup || /admin|service/.test(raw)) return 'admin';
@@ -148,17 +157,17 @@
             reset.disabled = true; reset.textContent = t().resetting; setStatus('', '');
             try {
                 const response = await fetch(new URL('nexowatt/account/reset', base).href, {
-                    method: 'POST', credentials: 'same-origin', cache: 'no-store',
+                    method: 'POST', credentials: 'include', cache: 'no-store',
                     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'X-NexoWatt-EOS-Account-Reset': '1' },
                     body: JSON.stringify({ user: account.id }),
                 });
                 const payload = await response.json().catch(() => ({}));
-                if (!response.ok || payload.error) throw new Error(payload.error || t().resetFailed);
+                if (!response.ok || payload.error) throw new Error(accountErrorText(payload.error));
                 setStatus(t().resetDone(label), 'success');
                 await loadAccounts();
             } catch (error) {
                 reset.disabled = false; reset.textContent = t().reset;
-                setStatus(errorText(error?.message), 'error');
+                setStatus(error?.message || t().resetFailed, 'error');
             }
         });
         actions.appendChild(reset);
@@ -180,12 +189,12 @@
         if (!state.overlay) return;
         setStatus(t().loading, '');
         try {
-            const response = await fetch(new URL('nexowatt/account/manage', base).href, { credentials: 'same-origin', cache: 'no-store', headers: { Accept: 'application/json' } });
+            const response = await fetch(new URL('nexowatt/account/manage', base).href, { credentials: 'include', cache: 'no-store', headers: { Accept: 'application/json' } });
             const data = await response.json().catch(() => ({}));
             if (!response.ok || data.error) throw new Error(data.error || t().resetFailed);
             renderAccounts(data); setStatus('', '');
         } catch (error) {
-            setStatus(errorText(error?.message), 'error');
+            setStatus(error?.message || t().resetFailed, 'error');
         }
     };
 

package/adminWww/js/eos-assistant.js

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    // NexoWatt EOS stable 7.10.0: EOS Assist remains disabled until the
+    // NexoWatt EOS stable 7.9.97: EOS Assist remains disabled until the
     // read-only system assistant is rebuilt and accepted separately.
     window.NEXOWATT_EOS_ASSIST_DISABLED = true;
     document.documentElement.classList.add('eos-assist-disabled');

package/adminWww/js/eos-ems-overview.js

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v7100-nexowatt-ems-overview-runtime';
+    const VERSION = 'v98-nexowatt-ems-overview-runtime';
     const CONTRACT = 'nexowatt-ems-overview-v1';
     const ROOT_ID = 'eos-ems-overview-runtime';
     const POLL_MS = 5000;

package/adminWww/js/eos-role-bootstrap.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7100-first-login-password-persisted';
+    const VERSION = 'v7101-standard-password-native-overview';
     const script = document.currentScript || document.querySelector('script[src*="eos-role-bootstrap.js"]');
     const entry = script?.dataset?.eosEntry || '';
     let launched = false;
@@ -80,7 +80,6 @@
             required: 'Bitte beide Passwortfelder ausfüllen.', mismatch: 'Die Passwörter stimmen nicht überein.',
             length: min => `Das Passwort muss mindestens ${min} Zeichen lang sein.`, complexity: 'Groß-/Kleinbuchstabe, Zahl und Sonderzeichen sind erforderlich.',
             easy: 'Das Passwort ist zu leicht oder enthält den Kontonamen.', generic: 'Das Passwort konnte nicht gespeichert werden.', success: 'Passwort gespeichert. Die Anmeldung wird neu gestartet …',
-            backendErrors: { invalidRequest: 'Die Sicherheitsbestätigung fehlt. Bitte erneut anmelden.', invalidRequestOrigin: 'Die Sitzung oder aufgerufene Adresse hat sich geändert. Bitte erneut anmelden.', passwordApiUnavailable: 'Die ioBroker-Passwortverwaltung ist nicht verfügbar.', passwordNotPersisted: 'Das Passwort wurde vom ioBroker-Controller nicht gespeichert. Bitte Systemlog prüfen.', passwordVerificationFailed: 'Das neue Passwort wurde geschrieben, aber nicht als gültige Anmeldung bestätigt.', passwordMetadataNotPersisted: 'Das Passwort wurde gespeichert, aber der Erstanmeldungsstatus konnte nicht abgeschlossen werden.', passwordSetupFailed: 'Das Passwort konnte serverseitig nicht gespeichert werden. Bitte das EOS-Systemlog prüfen.', passwordSetupTokenExpired: 'Die sichere Passwortfreigabe ist abgelaufen. Bitte erneut anmelden.', passwordSetupTokenMismatch: 'Die Passwortfreigabe gehört nicht zu dieser Sitzung. Bitte erneut anmelden.' },
             securityTitle: 'Zugriff wird geprüft', securityIntro: 'Die sichere Anmeldung wird gerade geprüft. Die Oberfläche bleibt gesperrt, bis die Berechtigungen eindeutig geladen wurden.',
             securityRetry: 'Jetzt erneut prüfen', securityLogout: 'Zur Anmeldung', securityAuto: seconds => `Automatischer neuer Versuch in ${seconds} Sekunden …`,
             claimLauncher: 'Erstanmeldung', claimTitle: 'Konto erstmals aktivieren',
@@ -100,7 +99,6 @@
             required: 'Please complete both password fields.', mismatch: 'The passwords do not match.',
             length: min => `The password must contain at least ${min} characters.`, complexity: 'Upper/lower case, a number and a special character are required.',
             easy: 'The password is too easy or contains the account name.', generic: 'The password could not be saved.', success: 'Password saved. Restarting sign-in …',
-            backendErrors: { invalidRequest: 'The security confirmation is missing. Sign in again.', invalidRequestOrigin: 'The session or address changed. Sign in again.', passwordApiUnavailable: 'The ioBroker password service is unavailable.', passwordNotPersisted: 'The ioBroker controller did not persist the password. Check the system log.', passwordVerificationFailed: 'The new password was written but could not be verified as a valid login.', passwordMetadataNotPersisted: 'The password was saved, but the first-login status could not be completed.', passwordSetupFailed: 'The password could not be saved on the server. Check the EOS system log.', passwordSetupTokenExpired: 'The secure password setup ticket expired. Sign in again.', passwordSetupTokenMismatch: 'The password setup ticket does not belong to this session. Sign in again.' },
             securityTitle: 'Checking access', securityIntro: 'The secure sign-in is being verified. The interface stays locked until the permissions are loaded unambiguously.',
             securityRetry: 'Check again now', securityLogout: 'Return to sign-in', securityAuto: seconds => `Retrying automatically in ${seconds} seconds …`,
             claimLauncher: 'First sign-in', claimTitle: 'Activate account for the first time',
@@ -120,7 +118,6 @@
             required: 'Vul beide wachtwoordvelden in.', mismatch: 'De wachtwoorden zijn niet gelijk.',
             length: min => `Het wachtwoord moet minimaal ${min} tekens bevatten.`, complexity: 'Hoofdletter, kleine letter, cijfer en speciaal teken zijn verplicht.',
             easy: 'Het wachtwoord is te eenvoudig of bevat de accountnaam.', generic: 'Het wachtwoord kon niet worden opgeslagen.', success: 'Wachtwoord opgeslagen. De aanmelding wordt opnieuw gestart …',
-            backendErrors: { invalidRequest: 'De beveiligingsbevestiging ontbreekt. Meld opnieuw aan.', invalidRequestOrigin: 'De sessie of het adres is gewijzigd. Meld opnieuw aan.', passwordApiUnavailable: 'De ioBroker-wachtwoordservice is niet beschikbaar.', passwordNotPersisted: 'De ioBroker-controller heeft het wachtwoord niet opgeslagen. Controleer het systeemlogboek.', passwordVerificationFailed: 'Het nieuwe wachtwoord is geschreven maar kon niet als geldige aanmelding worden bevestigd.', passwordMetadataNotPersisted: 'Het wachtwoord is opgeslagen, maar de eerste-aanmeldstatus kon niet worden afgerond.', passwordSetupFailed: 'Het wachtwoord kon server-side niet worden opgeslagen. Controleer het EOS-systeemlogboek.', passwordSetupTokenExpired: 'De beveiligde wachtwoordtoestemming is verlopen. Meld opnieuw aan.', passwordSetupTokenMismatch: 'De wachtwoordtoestemming hoort niet bij deze sessie. Meld opnieuw aan.' },
             securityTitle: 'Toegang wordt gecontroleerd', securityIntro: 'De veilige aanmelding wordt gecontroleerd. De interface blijft vergrendeld totdat de rechten eenduidig zijn geladen.',
             securityRetry: 'Nu opnieuw controleren', securityLogout: 'Terug naar aanmelden', securityAuto: seconds => `Automatisch opnieuw proberen over ${seconds} seconden …`,
             claimLauncher: 'Eerste aanmelding', claimTitle: 'Account voor het eerst activeren',
@@ -133,32 +130,11 @@
         },
     };
 
-    const waitForPasswordSocket = async (timeoutMs = 10000) => {
-        const started = Date.now();
-        while (Date.now() - started < timeoutMs) {
-            const socket = window.NEXOWATT_EOS_ADMIN_SOCKET || window.NEXOWATT_EOS_SOCKET;
-            if (socket && typeof socket.changePassword === 'function') return socket;
-            await new Promise(resolve => window.setTimeout(resolve, 120));
-        }
-        return null;
-    };
-
-    const postWithTimeout = async (url, options, timeoutMs = 25000) => {
-        const controller = new AbortController();
-        const timer = window.setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            return await fetch(url, { ...options, signal: controller.signal });
-        } finally {
-            window.clearTimeout(timer);
-        }
-    };
-
     const showFirstLoginPassword = (policy, base) => {
         const t = translations[language()];
         const passwordSetup = policy?.passwordSetup || {};
         const minLength = Number(passwordSetup.minLength || 10);
         const userName = String(passwordSetup.userName || policy?.user || '').replace(/^system\.user\./, '') || 'user';
-        const setupToken = String(passwordSetup.setupToken || '');
         const endpoint = new URL('nexowatt/account/first-password', base).href;
         const logoutUrl = new URL('logout', base).href;
         window.NEXOWATT_EOS_PASSWORD_SETUP_ACTIVE = true;
@@ -215,49 +191,21 @@
             if (!/[a-z]/.test(password.value) || !/[A-Z]/.test(password.value) || !/\d/.test(password.value) || !/[^A-Za-z0-9]/.test(password.value)) return setStatus(t.complexity, 'error');
             submit.disabled = true; submit.textContent = t.saving; setStatus('', '');
             try {
-                const socket = await waitForPasswordSocket();
-                let passwordAlreadyWritten = false;
-                if (socket) {
-                    try {
-                        // Use the same native path as the working ioBroker user editor.
-                        await socket.changePassword(`system.user.${userName}`, password.value);
-                        passwordAlreadyWritten = true;
-                    } catch (socketError) {
-                        console.warn('[NexoWatt EOS] Native password write failed; using server fallback:', socketError);
-                    }
-                }
-                const response = await postWithTimeout(endpoint, {
-                    method: 'POST', credentials: 'same-origin', cache: 'no-store',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        Accept: 'application/json',
-                        'X-NexoWatt-EOS-First-Login': '1',
-                        ...(setupToken ? { 'X-NexoWatt-EOS-Password-Setup-Token': setupToken } : {}),
-                    },
-                    body: JSON.stringify({
-                        password: password.value,
-                        passwordRepeat: repeat.value,
-                        setupToken,
-                        passwordAlreadyWritten,
-                    }),
+                const response = await fetch(endpoint, {
+                    method: 'POST', credentials: 'include', cache: 'no-store',
+                    headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'X-NexoWatt-EOS-First-Login': '1' },
+                    body: JSON.stringify({ password: password.value, passwordRepeat: repeat.value }),
                 });
                 const data = await response.json().catch(() => ({}));
                 if (!response.ok || data.error) {
-                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy, ...(t.backendErrors || {}) };
+                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy, passwordSetupNotAllowed: t.generic, invalidRequestOrigin: t.generic, passwordApiUnavailable: t.generic, passwordWriteFailed: t.generic, passwordVerificationFailed: t.generic, userObjectUnavailableAfterPasswordChange: t.generic };
                     throw new Error(messages[data.error] || t.generic);
                 }
                 setStatus(t.success, 'success');
                 window.setTimeout(() => window.location.replace(logoutUrl), 650);
             } catch (error) {
                 submit.disabled = false; submit.textContent = t.submit;
-                const message = error?.name === 'AbortError'
-                    ? (language() === 'de'
-                        ? 'Das Speichern hat zu lange gedauert. Bitte erneut versuchen.'
-                        : language() === 'nl'
-                          ? 'Opslaan duurde te lang. Probeer opnieuw.'
-                          : 'Saving timed out. Please try again.')
-                    : error?.message || t.generic;
-                setStatus(message, 'error');
+                setStatus(error?.message || t.generic, 'error');
             }
         });
         window.setTimeout(() => password.focus(), 0);
@@ -317,13 +265,13 @@
             submit.disabled = true; submit.textContent = t.saving; setStatus('', '');
             try {
                 const response = await fetch(endpoint, {
-                    method: 'POST', credentials: 'same-origin', cache: 'no-store',
+                    method: 'POST', credentials: 'include', cache: 'no-store',
                     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'X-NexoWatt-EOS-Passwordless-Password': '1' },
                     body: JSON.stringify({ password: password.value, passwordRepeat: repeat.value }),
                 });
                 const data = await response.json().catch(() => ({}));
                 if (!response.ok || data.error) {
-                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy, claimExpired: t.claimExpired, ...(t.backendErrors || {}) };
+                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy, claimExpired: t.claimExpired };
                     throw new Error(messages[data.error] || t.generic);
                 }
                 overlay.querySelector('.eos-activation-steps span:nth-of-type(2)')?.classList.add('done');
@@ -367,17 +315,9 @@
         const loginElements = () => {
             const username = document.querySelector('input#username,input[name="username"]');
             const password = document.querySelector('input#password,input[name="password"]');
-            const form = username?.closest?.('form') || password?.closest?.('form');
-            const card = form?.closest?.('.MuiPaper-root')
-                || username?.closest?.('.MuiPaper-root')
-                || password?.closest?.('.MuiPaper-root')
-                || form
-                || username?.closest?.('main,section')
-                || password?.closest?.('main,section');
-            const submit = form?.querySelector?.('button[type="submit"]')
-                || card?.querySelector?.('button[type="submit"]')
-                || Array.from(card?.querySelectorAll?.('button') || []).find(button => /anmelden|login|sign in|aanmelden/.test(normalize(button.textContent || '')));
-            return { username, password, form, card, submit };
+            const card = username?.closest?.('.MuiPaper-root,form,main,section') || password?.closest?.('.MuiPaper-root,form,main,section');
+            const submit = card?.querySelector?.('button[type="submit"]') || Array.from(card?.querySelectorAll?.('button') || []).find(button => /anmelden|login|sign in|aanmelden/.test(normalize(button.textContent || '')));
+            return { username, password, card, submit };
         };
         const statusNode = card => card?.querySelector?.('.eos-login-first-status');
         const directChildWithin = (ancestor, node) => {
@@ -533,7 +473,7 @@
             setStatus(card, t.claimChecking, '');
             try {
                 const response = await fetch(new URL('nexowatt/account/passwordless-claim', base).href, {
-                    method: 'POST', credentials: 'same-origin', cache: 'no-store',
+                    method: 'POST', credentials: 'include', cache: 'no-store',
                     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'X-NexoWatt-EOS-Passwordless-Claim': '1' },
                     body: JSON.stringify({ user: account }),
                 });
@@ -560,7 +500,7 @@
             const { username, password, card, submit } = loginElements();
             if (!username || !password || !card) return;
             card.classList.add('eos-login-card-modern');
-            // v7100 normal-login first activation: do not add role buttons or a second panel.
+            // v98 compact normal-login first activation: do not add role buttons or a second panel.
             // The account is entered in the existing Loginname field; a blank password is accepted only
             // after the backend confirms that this exact managed account is eligible.
             card.querySelectorAll('.eos-login-role-selector').forEach(element => element.remove());
@@ -685,7 +625,6 @@
     const isLoginRequest = /(?:^|[?&])login(?:[=&]|$)/i.test(window.location.search || '');
     if (isLoginRequest) {
         launch();
-        installIntegratedFirstLogin(base);
         return;
     }
 
@@ -694,7 +633,7 @@
     const timeout = window.setTimeout(() => controller.abort(), 8000);
 
     window.NEXOWATT_EOS_BOOTSTRAP_READY = fetch(contextUrl, {
-        credentials: 'same-origin', cache: 'no-store', headers: { Accept: 'application/json' }, signal: controller.signal,
+        credentials: 'include', cache: 'no-store', headers: { Accept: 'application/json' }, signal: controller.signal,
     })
         .then(response => { if (!response.ok) throw new Error(`HTTP ${response.status}`); return response.json(); })
         .then(policy => {
@@ -710,10 +649,6 @@
             window.NEXOWATT_EOS_ACCESS_ROLE = role;
             try { window.sessionStorage.removeItem('NEXOWATT_EOS_SECURITY_RETRY_COUNT'); } catch (_) { /* ignore */ }
             lockExpertMode(role);
-            if (role !== 'admin' && (resolved.mustChangePassword || resolved.passwordSetup?.required)) {
-                showFirstLoginPassword(resolved, base);
-                return resolved;
-            }
             const route = currentRoute();
             if (!isAllowed(role, route)) navigate(defaultTab(role));
             launch();
@@ -727,6 +662,8 @@
         })
         .finally(() => window.clearTimeout(timeout));
 
+    window.NEXOWATT_EOS_STANDARD_PASSWORD_MODE = true;
+    document.documentElement.classList.remove('eos-first-login-active');
     window.NEXOWATT_EOS_ROLE_BOOTSTRAP = Object.freeze({
         version: VERSION, getRole: () => window.NEXOWATT_EOS_ACCESS_ROLE || 'unknown',
         getPolicy: () => window.NEXOWATT_EOS_BOOTSTRAP_POLICY || null, isAllowed, defaultTab,

package/adminWww/js/eos-role-ui.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7100-native-overview-ems-live-reserve-filter';
+    const VERSION = 'v7101-native-overview-standard-users';
     window.NEXOWATT_EOS_ROLE_UI_VERSION = VERSION;
 
     const state = {
@@ -65,7 +65,7 @@
         if (role === 'admin') return true;
         if (isOfficialReserveTab(route)) return false;
         if (role === 'installer') return route === 'tab-intro' || route === 'tab-users' || !isInstallerDenied(route, label);
-        if (role === 'enduser') return isEndUserTab(route, label);
+        if (role === 'enduser') return route === 'tab-users' || isEndUserTab(route, label);
         return false;
     };
     const defaultTab = () => 'tab-intro';
@@ -226,7 +226,7 @@
                 ['Datenpunkte', 'Messwerte prüfen und freigegebene Werte schreiben', 'tab-objects', 'datapoints'],
                 ['Struktur', 'Räume und Funktionen für Smart Home zuordnen', 'tab-enums', 'structure'],
                 ['Geräte', 'Geräteintegration und Inbetriebnahme öffnen', 'tab-devicemanager', 'devices'],
-                ['Zugänge & Rechte', 'Endkundenpasswörter sicher zurücksetzen', 'tab-users', 'rights'],
+                ['Zugänge & Rechte', 'Passwörter im nativen Benutzereditor verwalten', 'tab-users', 'rights'],
                 ['Basis-Einstellungen', 'Standort, Sprache und Anlagenparameter', 'basic-settings', 'settings'],
                 ...(backupTab ? [['NexoWatt Sicherung', 'Sicherung und Wiederherstellung des EOS-Systems', backupTab, 'backup']] : []),
                 ['EOS Cockpit', 'Energie-, Lade- und Gebäudesteuerung öffnen', uiTab, 'eos'],
@@ -277,8 +277,31 @@
             if (!admin) button.setAttribute('aria-hidden', 'true'); else button.removeAttribute('aria-hidden');
         });
     };
+    const filterNativeUsersPage = () => safe(() => {
+        if (currentRoute() !== 'tab-users' || state.role === 'admin') return;
+        const paper = appPaper(); if (!paper) return;
+        const policyUser = String(state.policy?.user || state.policy?.userId || window.NEXOWATT_EOS_BOOTSTRAP_POLICY?.user || '').replace(/^system\.user\./, '').toLowerCase();
+        const allowed = state.role === 'installer'
+            ? new Set(['installer', 'user', 'guest', policyUser].filter(Boolean))
+            : new Set([policyUser || (state.role === 'enduser' ? 'user' : '')].filter(Boolean));
+        paper.querySelectorAll('.MuiCard-root,[role="row"],li').forEach(row => {
+            const text = normalize(row.textContent || '');
+            const match = text.match(/system user ([a-z0-9_.@-]+)/) || text.match(/system\.user\.([a-z0-9_.@-]+)/);
+            if (!match) return;
+            row.classList.toggle('eos-role-hidden', !allowed.has(match[1]));
+        });
+        paper.querySelectorAll('button').forEach(button => {
+            const title = normalize(button.getAttribute('aria-label') || button.getAttribute('title') || button.textContent || '');
+            if (/add user|add group|delete|remove|benutzer hinzufugen|gruppe hinzufugen|loschen/.test(title)) {
+                button.classList.add('eos-role-hidden'); button.disabled = true;
+            }
+        });
+        paper.querySelectorAll('[data-eos-user-role-filter]').forEach(node => node.removeAttribute('data-eos-user-role-filter'));
+        paper.setAttribute('data-eos-user-role-filter', state.role);
+    });
+
     const ensureSafeOverview = () => safe(() => {
-        // 7.10.0: never cover the real Admin Intro with a second tile surface.
+        // 7.9.97: never cover the real Admin Intro with a second tile surface.
         // Installer and end-user use the native card component; security remains
         // enforced by route/instance filters and backend permissions.
         removeSafeOverview();
@@ -415,6 +438,7 @@
         applySensitiveDialogPolicy();
         redirectIfNeeded();
         ensureSafeOverview();
+        filterNativeUsersPage();
         hideOfficialReserveSurfaces();
         ensureReserveObserver();
         suppressPermissionErrors();

package/adminWww/js/nexowatt-native-shell.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7100-nexowatt-native-shell-native-overview';
+    const VERSION = 'v7101-nexowatt-native-shell-native-overview';
     const previous = window.NEXOWATT_NATIVE_SHELL;
     if (previous?.version === VERSION) return;
     previous?.destroy?.();

package/adminWww/static/js/nexowatt-stable-login.js

@@ -1,72 +1,45 @@
-/* NexoWatt EOS stable login runtime 7.10.0 */
+/* NexoWatt EOS stable runtime v98 */
 (() => {
-    'use strict';
-    const VERSION = 'v7100-clean-login';
-    const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
-    const ASSIST_TEXT = /EOS\s*Assist/i;
-    const PASSWORDLESS_TEXT = /Erstanmeldung\s+ohne\s+Passwort|first\s+sign-?in\s+without\s+password/i;
-    const isLogin = () => /(?:\?|&)login(?:[=&]|$)/i.test(location.search) || /\/login(?:[/?#]|$)/i.test(location.pathname + location.hash);
-    const visible = element => !!element && element.getClientRects().length > 0;
-    const findInput = kind => {
-        const inputs = [...document.querySelectorAll('input')].filter(visible);
-        if (kind === 'password') return inputs.find(input => input.type === 'password');
-        return inputs.find(input => input.type !== 'password' && /user|login|name/i.test(`${input.name} ${input.id} ${input.autocomplete} ${input.getAttribute('aria-label') || ''}`)) || inputs.find(input => input.type !== 'password');
-    };
-    const findSubmit = () => [...document.querySelectorAll('button,input[type="submit"]')].find(element => visible(element) && (/anmelden|login|sign in/i.test((element.textContent || element.value || '').trim()) || element.type === 'submit'));
-    const normalizeUser = value => String(value || '').trim().toLowerCase().replace(/^system\.user\./, '');
-    const normalizeGeometry = () => {
-        document.querySelectorAll('[data-nw-login-card],[data-nw-login-shell]').forEach(element => {
-            if (!element.classList.contains('MuiPaper-root') && !element.classList.contains('eos-login-card-modern')) {
-                element.removeAttribute('data-nw-login-card');
-                element.removeAttribute('data-nw-login-shell');
-            }
-        });
-        for (const input of [findInput('user'), findInput('password')].filter(Boolean)) {
-            const control = input.closest('.MuiFormControl-root');
-            const label = control?.querySelector('.MuiInputLabel-root');
-            if (control && label) {
-                const localized = String(label.textContent || input.getAttribute('aria-label') || '').trim();
-                if (localized) control.dataset.eosLoginLabel = localized;
-                label.classList.add('MuiInputLabel-shrink');
-                label.dataset.shrink = 'true';
-                label.removeAttribute('aria-hidden');
-            }
-        }
-    };
-    const sync = () => {
-        if (!isLogin() && !document.querySelector('input#username,input[name="username"]')) return;
-        document.documentElement.classList.add('nw-eos-login-v7100');
-        document.body?.classList.add('nw-eos-login-v7100');
-        normalizeGeometry();
-        const username = findInput('user');
-        const password = findInput('password');
-        const submit = findSubmit();
-        if (submit && MANAGED_USERS.has(normalizeUser(username?.value)) && !String(password?.value || '')) {
-            submit.disabled = true;
-            submit.setAttribute('aria-disabled', 'true');
-        }
-    };
-    const hideLegacyUi = () => {
-        for (const element of document.querySelectorAll('button,a,[role="button"],div,span')) {
-            const value = (element.textContent || '').trim();
-            if (!value || value.length > 100) continue;
-            if (ASSIST_TEXT.test(value) || PASSWORDLESS_TEXT.test(value)) {
-                const target = element.closest('button,a,[role="button"],[data-eos-assist],.eos-assist') || element;
-                target.style.setProperty('display', 'none', 'important');
-                target.setAttribute('aria-hidden', 'true');
-            }
-        }
-    };
-    const apply = () => { sync(); hideLegacyUi(); };
-    let scheduled = false;
-    const schedule = () => {
-        if (scheduled) return;
-        scheduled = true;
-        requestAnimationFrame(() => { scheduled = false; apply(); });
-    };
-    new MutationObserver(schedule).observe(document.documentElement, { subtree: true, childList: true });
-    document.addEventListener('input', schedule, true);
-    document.addEventListener('change', schedule, true);
-    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', apply, { once: true }); else apply();
-    window.NEXOWATT_EOS_STABLE_LOGIN = Object.freeze({ version: VERSION, refresh: apply });
+  'use strict';
+  const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
+  const ASSIST_TEXT = /EOS\s*Assist/i;
+  const PASSWORDLESS_TEXT = /Erstanmeldung\s+ohne\s+Passwort|first\s+sign-?in\s+without\s+password/i;
+  const isLogin = () => /(?:\?|&)login(?:[=&]|$)/i.test(location.search) || /\/login(?:[/?#]|$)/i.test(location.pathname + location.hash);
+  const visible = element => !!element && element.getClientRects().length > 0;
+  const findInput = kind => {
+    const inputs = [...document.querySelectorAll('input')].filter(visible);
+    if (kind === 'password') return inputs.find(input => input.type === 'password');
+    return inputs.find(input => input.type !== 'password' && /user|login|name/i.test(`${input.name} ${input.id} ${input.autocomplete} ${input.getAttribute('aria-label') || ''}`)) || inputs.find(input => input.type !== 'password');
+  };
+  const findSubmit = () => [...document.querySelectorAll('button,input[type="submit"]')].find(element => visible(element) && (/anmelden|login|sign in/i.test((element.textContent || element.value || '').trim()) || element.type === 'submit'));
+  const sync = () => {
+    if (!isLogin()) return;
+    document.documentElement.classList.add('nw-eos-login-v98');
+    document.body?.classList.add('nw-eos-login-v98');
+    const username = findInput('user');
+    const password = findInput('password');
+    const submit = findSubmit();
+    const account = String(username?.value || '').trim().toLowerCase().replace(/^system\.user\./, '');
+    if (submit && MANAGED_USERS.has(account) && !String(password?.value || '')) {
+      submit.disabled = true;
+      submit.setAttribute('aria-disabled', 'true');
+    }
+  };
+  const hideLegacyUi = () => {
+    for (const element of document.querySelectorAll('button,a,[role="button"],div,span')) {
+      const value = (element.textContent || '').trim();
+      if (!value || value.length > 100) continue;
+      if (ASSIST_TEXT.test(value) || PASSWORDLESS_TEXT.test(value)) {
+        const target = element.closest('button,a,[role="button"],[data-eos-assist],.eos-assist') || element;
+        target.style.setProperty('display', 'none', 'important');
+        target.setAttribute('aria-hidden', 'true');
+      }
+    }
+  };
+  const apply = () => { sync(); hideLegacyUi(); };
+  const observer = new MutationObserver(() => requestAnimationFrame(apply));
+  observer.observe(document.documentElement, { subtree: true, childList: true });
+  document.addEventListener('input', apply, true);
+  document.addEventListener('change', apply, true);
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', apply, { once: true }); else apply();
 })();

package/adminWww/static/js/nexowatt-stable-v7101.js

@@ -0,0 +1,27 @@
+(() => {
+    'use strict';
+    const VERSION = 'v7101-scroll-standard-password';
+    const ensureScroll = () => {
+        const root = document.documentElement;
+        const paper = document.getElementById('app-paper');
+        if (!paper || !root.classList.contains('eos-app') || !root.classList.contains('eos-route-intro')) return;
+        paper.dataset.nexowattScrollable = 'true';
+        paper.style.setProperty('overflow-x','hidden','important');
+        paper.style.setProperty('overflow-y','scroll','important');
+        paper.style.setProperty('height','calc(100dvh - var(--nx-content-top) - 12px)','important');
+        paper.style.setProperty('max-height','calc(100dvh - var(--nx-content-top) - 12px)','important');
+        paper.style.setProperty('min-height','0','important');
+    };
+    const apply = () => {
+        document.documentElement.classList.add('eos-assist-disabled');
+        document.documentElement.classList.remove('eos-first-login-active');
+        document.querySelectorAll('.eos-assist-root,.eos-assist-header-root,[data-eos-assist-root],.eos-passwordless-launcher,.eos-first-login-overlay')
+            .forEach(element => element.remove());
+        ensureScroll();
+    };
+    let scheduled=false;
+    const schedule=()=>{if(scheduled)return;scheduled=true;requestAnimationFrame(()=>{scheduled=false;apply();});};
+    const start=()=>{apply();new MutationObserver(schedule).observe(document.documentElement,{subtree:true,childList:true});window.addEventListener('hashchange',schedule);window.addEventListener('resize',schedule,{passive:true});};
+    document.readyState==='loading'?document.addEventListener('DOMContentLoaded',start,{once:true}):start();
+    window.NEXOWATT_EOS_STABLE_V7101=Object.freeze({version:VERSION,refresh:apply,ensureScroll});
+})();