iobroker.eos-admin 7.10.2 → 7.10.4

package/adminWww/nexowatt-role-security.js

@@ -0,0 +1,336 @@
+(() => {
+  "use strict";
+
+  const VERSION = "7.10.4";
+  const HIDDEN = "data-eos-role-hidden";
+  const READONLY = "data-eos-readonly";
+  const state = { role: "unknown", backupActive: null, user: "", appliedAt: 0 };
+
+  const adminOnlyTokens = [
+    "app-center", "app center", "appcenter", "lizenz", "license", "simulation", "simulator",
+    "expertenmodus", "expert mode", "xterm", "shell-konsole", "shell console", "zugänge & rechte",
+    "zugaenge & rechte", "access & rights", "user management", "benutzerverwaltung"
+  ];
+  const backupTokens = ["sicherung", "backup", "backitup"];
+  const dataPointTokens = ["datenpunkte", "datapoints", "objects", "objekte"];
+  const dangerousWriteTokens = [
+    "wert schreiben", "wert setzen", "schreiben", "write value", "set value", "setstate", "speichern",
+    "save", "anwenden", "apply", "löschen", "delete", "bearbeiten", "edit", "stift"
+  ];
+
+  const normalize = value => String(value == null ? "" : value).trim().toLowerCase();
+  const textOf = el => normalize([
+    el && el.textContent,
+    el && el.getAttribute && el.getAttribute("title"),
+    el && el.getAttribute && el.getAttribute("aria-label"),
+    el && el.getAttribute && el.getAttribute("data-testid"),
+    el && el.getAttribute && el.getAttribute("href"),
+    el && el.getAttribute && el.getAttribute("to"),
+    el && el.id,
+    el && el.className && typeof el.className === "string" ? el.className : ""
+  ].filter(Boolean).join(" "));
+
+  function classify(value) {
+    const text = normalize(value);
+    if (!text) return "unknown";
+    if (/^(?:system\.user\.)?admin(?:istrator)?$/.test(text) || /(?:^|[.:/_ -])admin(?:istrator)?(?:$|[.:/_ -])/.test(text)) return "admin";
+    if (/installer|installateur|inbetriebnahme/.test(text)) return "installer";
+    if (/endkunde|customer|smarthome|guest|gast|(?:^|\s)user(?:$|\s)/.test(text)) return "customer";
+    return "unknown";
+  }
+
+  function roleFromGlobals() {
+    const candidates = [
+      window.__NEXOWATT_ROLE__, window.__EOS_ROLE__, window.eosRole,
+      window.currentUser && window.currentUser.role,
+      window.user && window.user.role,
+      document.documentElement.getAttribute("data-role"),
+      document.body && document.body.getAttribute("data-role")
+    ];
+    for (const value of candidates) {
+      const role = classify(value);
+      if (role !== "unknown") return role;
+    }
+    return "unknown";
+  }
+
+  function roleFromStorage() {
+    const stores = [window.sessionStorage, window.localStorage];
+    const keys = ["eos.role", "eosRole", "role", "userRole", "nexowatt.role", "auth.role", "currentRole"];
+    for (const store of stores) {
+      try {
+        for (const key of keys) {
+          const role = classify(store.getItem(key));
+          if (role !== "unknown") return role;
+        }
+      } catch { /* storage can be disabled */ }
+    }
+    return "unknown";
+  }
+
+  function roleFromDom() {
+    const selectors = [
+      "[data-role]", "[data-user-role]", "[data-current-role]", "[aria-label*='Rolle' i]",
+      "[aria-label*='role' i]", "header", "nav", ".MuiAppBar-root"
+    ];
+    for (const selector of selectors) {
+      for (const el of document.querySelectorAll(selector)) {
+        const value = [
+          el.getAttribute && el.getAttribute("data-role"),
+          el.getAttribute && el.getAttribute("data-user-role"),
+          el.getAttribute && el.getAttribute("data-current-role"),
+          el.getAttribute && el.getAttribute("aria-label"),
+          el.textContent
+        ].filter(Boolean).join(" ");
+        const role = classify(value);
+        if (role !== "unknown") return role;
+      }
+    }
+    return "unknown";
+  }
+
+  function findDisplayedUser() {
+    const candidates = document.querySelectorAll("header *, nav *, .MuiAppBar-root *");
+    for (const el of candidates) {
+      const text = normalize(el.textContent);
+      if (!text || text.length > 80) continue;
+      if (/\b(admin|installer|user|guest|gast|endkunde)\b/.test(text)) return text;
+    }
+    return "";
+  }
+
+  async function fetchSecurityStatus() {
+    try {
+      const user = encodeURIComponent(findDisplayedUser());
+      const response = await fetch(`/api/nexowatt-eos/security/status?user=${user}&v=${VERSION}`, {
+        credentials: "same-origin", cache: "no-store", headers: { "Accept": "application/json" }
+      });
+      if (!response.ok) return null;
+      return await response.json();
+    } catch {
+      return null;
+    }
+  }
+
+  function isAdmin() { return state.role === "admin"; }
+  function isCustomer() { return state.role === "customer"; }
+
+  function hide(el, reason) {
+    if (!el || el === document.body || el === document.documentElement) return;
+    if (!el.hasAttribute(HIDDEN)) {
+      el.setAttribute(HIDDEN, reason || "restricted");
+      el.setAttribute("aria-hidden", "true");
+      el.style.setProperty("display", "none", "important");
+    }
+  }
+
+  function unhide(el) {
+    if (!el || !el.hasAttribute(HIDDEN)) return;
+    el.removeAttribute(HIDDEN);
+    el.removeAttribute("aria-hidden");
+    el.style.removeProperty("display");
+  }
+
+  function closestAction(el) {
+    return el && el.closest && el.closest("a,button,[role='button'],[role='tab'],li,.MuiButtonBase-root") || el;
+  }
+
+  function includesAny(text, tokens) {
+    return tokens.some(token => text.includes(token));
+  }
+
+  function applyNavigationPolicy() {
+    const actions = document.querySelectorAll("a,button,[role='button'],[role='tab'],li,.MuiButtonBase-root");
+    for (const raw of actions) {
+      const el = closestAction(raw);
+      const text = textOf(el);
+      if (!text) continue;
+
+      const adminOnly = includesAny(text, adminOnlyTokens) ||
+        (/\badmin\b/.test(text) && /(?:8081|adapter=admin|io.?broker)/.test(text));
+      const backup = includesAny(text, backupTokens);
+
+      if (!isAdmin() && adminOnly) hide(el, "admin-only");
+      else if (adminOnly) unhide(el);
+
+      if (backup && state.backupActive === false) hide(el, "backup-inactive");
+      else if (backup && state.backupActive === true && (isAdmin() || !adminOnly)) unhide(el);
+    }
+
+    if (!isAdmin()) {
+      for (const el of document.querySelectorAll("[data-testid*='expert' i],[class*='expert' i],[id*='expert' i],[title*='Experten' i],[aria-label*='Experten' i],[title*='Expert' i],[aria-label*='Expert' i]")) {
+        hide(closestAction(el), "admin-only-expert");
+      }
+    }
+  }
+
+  function isDataPointPage() {
+    const route = normalize(location.pathname + " " + location.hash + " " + document.title);
+    if (includesAny(route, dataPointTokens)) return true;
+    const selected = document.querySelector("[aria-selected='true'],.Mui-selected,.active");
+    return selected ? includesAny(textOf(selected), dataPointTokens) : false;
+  }
+
+  function makeDatapointsReadOnly() {
+    const root = document.querySelector("main") || document.body;
+    if (!isCustomer() || !isDataPointPage()) {
+      root && root.removeAttribute(READONLY);
+      return;
+    }
+    root.setAttribute(READONLY, "true");
+    for (const el of root.querySelectorAll("input,textarea,select,[contenteditable='true'],button,[role='button']")) {
+      const text = textOf(el);
+      const isSearch = /filter|suche|search|refresh|aktualisieren|reload|sort|spalte|column|zurück|back/.test(text) ||
+        /search/i.test(el.getAttribute && el.getAttribute("type") || "") ||
+        /filter|search/i.test(el.getAttribute && el.getAttribute("placeholder") || "");
+      const likelyWriter = includesAny(text, dangerousWriteTokens) ||
+        /value|wert|write|edit|save|delete|setstate|state-value/i.test(text) ||
+        (el.matches("input,textarea,select,[contenteditable='true']") && !isSearch);
+      if (likelyWriter && !isSearch) {
+        el.setAttribute("aria-disabled", "true");
+        el.setAttribute("tabindex", "-1");
+        if ("disabled" in el) el.disabled = true;
+        if (el.getAttribute("contenteditable") === "true") el.setAttribute("contenteditable", "false");
+        el.style.setProperty("pointer-events", "none", "important");
+        el.style.setProperty("opacity", "0.62", "important");
+      }
+    }
+  }
+
+  function currentRouteRestricted() {
+    const route = normalize(location.pathname + " " + location.search + " " + location.hash);
+    return includesAny(route, adminOnlyTokens);
+  }
+
+  function renderForbidden() {
+    if (document.getElementById("eos-role-forbidden")) return;
+    const overlay = document.createElement("div");
+    overlay.id = "eos-role-forbidden";
+    overlay.innerHTML = `<div class="eos-role-forbidden-card"><strong>Zugriff gesperrt</strong><span>App-Center, Lizenz, Simulation und Expertenmodus sind ausschließlich für Administratoren freigegeben.</span><button type="button">Zurück zum Cockpit</button></div>`;
+    overlay.querySelector("button").addEventListener("click", () => {
+      location.hash = "#/";
+      try { history.replaceState(null, "", location.pathname); } catch { /* ignore */ }
+      overlay.remove();
+    });
+    document.body.appendChild(overlay);
+  }
+
+  function guardCurrentRoute() {
+    if (!isAdmin() && currentRouteRestricted()) renderForbidden();
+    else document.getElementById("eos-role-forbidden")?.remove();
+  }
+
+  function clearExpertMode() {
+    if (isAdmin()) return;
+    const keys = ["expertMode", "expert-mode", "eos.expert", "eosExpertMode", "adminExpertMode"];
+    for (const store of [window.localStorage, window.sessionStorage]) {
+      try { keys.forEach(key => store.removeItem(key)); } catch { /* ignore */ }
+    }
+    window.__NEXOWATT_EXPERT_MODE__ = false;
+  }
+
+  function scrubPrivilegedUiSessions() {
+    if (isAdmin()) return;
+    const marker = "eos.nonAdminUiLogout.v7104";
+    try {
+      if (sessionStorage.getItem(marker)) return;
+      sessionStorage.setItem(marker, "1");
+    } catch { /* continue */ }
+    const protocol = location.protocol === "https:" ? "https:" : "http:";
+    const host = location.hostname;
+    for (const port of [8082, 8188]) {
+      const iframe = document.createElement("iframe");
+      iframe.hidden = true;
+      iframe.setAttribute("aria-hidden", "true");
+      iframe.src = `${protocol}//${host}:${port}/logout?source=eos-role-security&v=${VERSION}`;
+      document.body.appendChild(iframe);
+      setTimeout(() => iframe.remove(), 12000);
+    }
+  }
+
+  function apply() {
+    state.appliedAt = Date.now();
+    document.documentElement.setAttribute("data-eos-effective-role", state.role);
+    applyNavigationPolicy();
+    makeDatapointsReadOnly();
+    clearExpertMode();
+    guardCurrentRoute();
+  }
+
+  function installEventGuards() {
+    document.addEventListener("click", event => {
+      if (isAdmin()) return;
+      const action = closestAction(event.target);
+      const text = textOf(action);
+      if (includesAny(text, adminOnlyTokens) || (/\badmin\b/.test(text) && /(?:8081|adapter=admin|io.?broker)/.test(text))) {
+        event.preventDefault(); event.stopImmediatePropagation(); renderForbidden(); return;
+      }
+      if (isCustomer() && isDataPointPage() && includesAny(text, dangerousWriteTokens)) {
+        event.preventDefault(); event.stopImmediatePropagation(); return;
+      }
+    }, true);
+    document.addEventListener("submit", event => {
+      if (isCustomer() && isDataPointPage()) { event.preventDefault(); event.stopImmediatePropagation(); }
+    }, true);
+    for (const name of ["pushState", "replaceState"]) {
+      const original = history[name];
+      history[name] = function(...args) {
+        const result = original.apply(this, args);
+        queueMicrotask(apply);
+        return result;
+      };
+    }
+    addEventListener("hashchange", apply);
+    addEventListener("popstate", apply);
+  }
+
+  function injectStyles() {
+    if (document.getElementById("eos-role-security-style")) return;
+    const style = document.createElement("style");
+    style.id = "eos-role-security-style";
+    style.textContent = `
+      [${HIDDEN}] { display:none !important; }
+      #eos-role-forbidden { position:fixed; inset:0; z-index:2147483647; display:grid; place-items:center; padding:24px; background:rgba(1,17,28,.96); color:#eefaff; font-family:Arial,sans-serif; }
+      .eos-role-forbidden-card { width:min(620px,100%); display:grid; gap:18px; padding:30px; border:1px solid #16d49d; border-radius:18px; background:#072333; box-shadow:0 20px 80px rgba(0,0,0,.45); }
+      .eos-role-forbidden-card strong { color:#24e6ad; font-size:28px; }
+      .eos-role-forbidden-card span { line-height:1.55; }
+      .eos-role-forbidden-card button { justify-self:start; padding:10px 18px; border:1px solid #16d49d; border-radius:10px; color:#021911; background:#24e6ad; font-weight:700; cursor:pointer; }
+      [${READONLY}="true"]::before { content:"Nur-Lesezugriff für Endkunden"; position:sticky; top:0; z-index:10; display:block; margin:8px; padding:8px 12px; border:1px solid #1aa57d; border-radius:9px; background:#07342b; color:#cffff0; font:600 13px Arial,sans-serif; }
+    `;
+    document.head.appendChild(style);
+  }
+
+  async function init() {
+    injectStyles();
+    let role = roleFromGlobals();
+    if (role === "unknown") role = roleFromStorage();
+    if (role === "unknown") role = roleFromDom();
+    const status = await fetchSecurityStatus();
+    if (status) {
+      const serverRole = classify(status.role);
+      if (serverRole !== "unknown") role = serverRole;
+      if (typeof status.backupActive === "boolean") state.backupActive = status.backupActive;
+      state.user = status.user || "";
+    }
+    if (role === "unknown") role = "customer"; // least privilege until authenticated role is known
+    state.role = role;
+    try { sessionStorage.setItem("eos.role.effective", role); } catch { /* ignore */ }
+    installEventGuards();
+    apply();
+    scrubPrivilegedUiSessions();
+    const observer = new MutationObserver(() => {
+      clearTimeout(observer._timer);
+      observer._timer = setTimeout(apply, 40);
+    });
+    observer.observe(document.documentElement, { childList: true, subtree: true, attributes: true, attributeFilter: ["class", "aria-selected", "href"] });
+    setInterval(async () => {
+      const refreshed = await fetchSecurityStatus();
+      if (refreshed && typeof refreshed.backupActive === "boolean" && refreshed.backupActive !== state.backupActive) {
+        state.backupActive = refreshed.backupActive; apply();
+      }
+    }, 10000);
+  }
+
+  if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", init, { once: true });
+  else void init();
+})();

package/build/lib/eosRoleSecurity.js

@@ -0,0 +1,310 @@
+"use strict";
+
+/**
+ * NexoWatt EOS role security boundary.
+ *
+ * This module intentionally uses only Node.js core APIs so the prebuilt
+ * repository can be packed and published without a local node_modules folder.
+ */
+const http = require("node:http");
+const https = require("node:https");
+const { URL } = require("node:url");
+
+let adapterRef = null;
+let installed = false;
+let backupCache = { value: false, expires: 0 };
+
+const ADMIN_NAMES = new Set(["admin", "administrator", "system.user.admin"]);
+const INSTALLER_TOKENS = ["installer", "installateur", "inbetriebnahme"];
+const CUSTOMER_TOKENS = ["user", "guest", "gast", "endkunde", "customer", "smarthome"];
+
+const ADMIN_ONLY_PATHS = [
+  /(?:^|[\\/#?&_.-])app[\\s_.-]*center(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])lizenz(?:en)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])licen[cs]e(?:s)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])simulation(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])simulator(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])experten?(?:modus)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])expert(?:mode)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])xterm(?:$|[\\/#?&_.-])/i,
+];
+
+const RIGHTS_PATHS = [
+  /(?:^|[\\/#?&_.-])users?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])groups?(?:$|[\\/#?&_.-])/i,
+  /zug[aä]nge/i,
+  /rechte/i,
+  /permissions?/i,
+  /password/i,
+  /passwort/i,
+];
+
+function normalize(value) {
+  if (value === null || value === undefined) return "";
+  if (typeof value === "object") {
+    if (typeof value.name === "string") return value.name.trim().toLowerCase();
+    if (typeof value.user === "string") return value.user.trim().toLowerCase();
+    return "";
+  }
+  return String(value).trim().toLowerCase();
+}
+
+function classifyRole(value) {
+  const text = normalize(value);
+  if (!text) return "unknown";
+  if (ADMIN_NAMES.has(text) || /(?:^|[.:/_-])admin(?:istrator)?(?:$|[.:/_-])/.test(text)) return "admin";
+  if (INSTALLER_TOKENS.some(token => text.includes(token))) return "installer";
+  if (CUSTOMER_TOKENS.some(token => text === token || text.includes(token))) return "customer";
+  return "unknown";
+}
+
+function parseBasicUser(header) {
+  if (!header || !/^basic\s+/i.test(header)) return "";
+  try {
+    const decoded = Buffer.from(header.replace(/^basic\s+/i, ""), "base64").toString("utf8");
+    return decoded.split(":", 1)[0] || "";
+  } catch {
+    return "";
+  }
+}
+
+function parseCookieHeader(header) {
+  const out = Object.create(null);
+  String(header || "").split(";").forEach(part => {
+    const idx = part.indexOf("=");
+    if (idx <= 0) return;
+    const key = part.slice(0, idx).trim();
+    let value = part.slice(idx + 1).trim();
+    try { value = decodeURIComponent(value); } catch { /* ignore */ }
+    out[key] = value;
+  });
+  return out;
+}
+
+function extractIdentity(req) {
+  const candidates = [];
+  if (req) {
+    candidates.push(req.user, req.username, req.auth && req.auth.user, req.session && req.session.user,
+      req.session && req.session.username, req.session && req.session.passport && req.session.passport.user,
+      req.ioBrokerUser, req._user);
+    const headers = req.headers || {};
+    candidates.push(headers["x-iobroker-user"], headers["x-eos-user"], headers["x-authenticated-user"],
+      headers["x-forwarded-user"], parseBasicUser(headers.authorization));
+    const cookies = parseCookieHeader(headers.cookie);
+    for (const key of ["iobroker.user", "iobroker_user", "eos.user", "eosUser", "user", "username", "authUser"]) {
+      candidates.push(cookies[key]);
+    }
+    try {
+      const parsed = new URL(req.url || "/", "http://127.0.0.1");
+      candidates.push(parsed.searchParams.get("user"), parsed.searchParams.get("username"));
+    } catch { /* ignore */ }
+  }
+  for (const value of candidates) {
+    if (normalize(value)) return normalize(value);
+  }
+  return "";
+}
+
+function roleFromRequest(req) {
+  const explicitRole = normalize(req && req.headers && (req.headers["x-eos-role"] || req.headers["x-nexowatt-role"]));
+  const role = classifyRole(explicitRole);
+  if (role !== "unknown") return role;
+  return classifyRole(extractIdentity(req));
+}
+
+function isAdminOnlyPath(rawUrl) {
+  const value = String(rawUrl || "");
+  return ADMIN_ONLY_PATHS.some(pattern => pattern.test(value));
+}
+
+function isRightsPath(rawUrl) {
+  const value = String(rawUrl || "");
+  return RIGHTS_PATHS.some(pattern => pattern.test(value));
+}
+
+function isStateWriteRequest(req) {
+  const method = String(req && req.method || "GET").toUpperCase();
+  if (!["POST", "PUT", "PATCH", "DELETE"].includes(method)) return false;
+  const value = String(req && req.url || "");
+  return /(?:setstate|write|objects?\/|states?\/|sendto|command)/i.test(value);
+}
+
+function deny(res, message, statusCode = 403) {
+  if (!res || res.headersSent || res.writableEnded) return true;
+  const accepts = String((res.req && res.req.headers && res.req.headers.accept) || "");
+  const json = accepts.includes("application/json") || String(res.req && res.req.url || "").includes("/api/");
+  res.statusCode = statusCode;
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  if (json) {
+    res.setHeader("Content-Type", "application/json; charset=utf-8");
+    res.end(JSON.stringify({ ok: false, error: "forbidden", message }));
+  } else {
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    res.end(`<!doctype html><html lang="de"><meta charset="utf-8"><title>Zugriff gesperrt</title><style>body{margin:0;background:#031724;color:#eaf6ff;font:16px Arial,sans-serif;display:grid;place-items:center;min-height:100vh}.box{max-width:620px;padding:32px;border:1px solid #0dbb87;border-radius:18px;background:#071f2f}h1{margin-top:0;color:#24e6ad}</style><div class="box"><h1>Zugriff gesperrt</h1><p>${message}</p></div></html>`);
+  }
+  return true;
+}
+
+async function getBackupActive() {
+  const now = Date.now();
+  if (backupCache.expires > now) return backupCache.value;
+  let active = false;
+  const adapter = adapterRef;
+  if (adapter) {
+    try {
+      let rows = [];
+      if (typeof adapter.getObjectViewAsync === "function") {
+        const result = await adapter.getObjectViewAsync("system", "instance", { startkey: "system.adapter.", endkey: "system.adapter.\u9999" });
+        rows = result && Array.isArray(result.rows) ? result.rows : [];
+      } else if (typeof adapter.getObjectListAsync === "function") {
+        const result = await adapter.getObjectListAsync({ startkey: "system.adapter.", endkey: "system.adapter.\u9999" });
+        rows = result && Array.isArray(result.rows) ? result.rows : [];
+      }
+      active = rows.some(row => {
+        const obj = row && (row.value || row.doc);
+        const id = normalize(row && row.id || obj && obj._id);
+        return /system\.adapter\.(?:backitup|backup|nexowatt-backup|eos-backup)\./.test(id) && Boolean(obj && obj.common && obj.common.enabled);
+      });
+    } catch (error) {
+      if (adapter && adapter.log && typeof adapter.log.debug === "function") {
+        adapter.log.debug(`[role-security] Backup status could not be read: ${error && error.message || error}`);
+      }
+    }
+  }
+  backupCache = { value: active, expires: now + 5000 };
+  return active;
+}
+
+function attachAdapter(adapter) {
+  adapterRef = adapter || null;
+  backupCache.expires = 0;
+}
+
+function cloneAclSection(section) {
+  return section && typeof section === "object" ? { ...section } : {};
+}
+
+async function enforceRoleAcls(adapter = adapterRef) {
+  if (!adapter || typeof adapter.getForeignObjectAsync !== "function" || typeof adapter.setForeignObjectAsync !== "function") return;
+  const ids = ["system.group.endkunde"];
+  for (const id of ids) {
+    try {
+      const obj = await adapter.getForeignObjectAsync(id);
+      if (!obj || !obj.common) continue;
+      const acl = obj.common.acl && typeof obj.common.acl === "object" ? { ...obj.common.acl } : {};
+      const objectAcl = cloneAclSection(acl.object);
+      const stateAcl = cloneAclSection(acl.state);
+      const usersAcl = cloneAclSection(acl.users);
+      const fileAcl = cloneAclSection(acl.file);
+      const otherAcl = cloneAclSection(acl.other);
+      const before = JSON.stringify({ objectAcl, stateAcl, usersAcl, fileAcl, otherAcl });
+      Object.assign(objectAcl, { list: true, read: true, write: false, delete: false });
+      Object.assign(stateAcl, { list: true, read: true, write: false, delete: false, create: false });
+      Object.assign(usersAcl, { write: false, delete: false, create: false });
+      Object.assign(fileAcl, { list: true, read: true, write: false, delete: false, create: false });
+      Object.assign(otherAcl, { execute: false, sendto: false });
+      acl.object = objectAcl;
+      acl.state = stateAcl;
+      acl.users = usersAcl;
+      acl.file = fileAcl;
+      acl.other = otherAcl;
+      const after = JSON.stringify({ objectAcl, stateAcl, usersAcl, fileAcl, otherAcl });
+      if (before !== after) {
+        obj.common.acl = acl;
+        await adapter.setForeignObjectAsync(id, obj);
+        if (adapter.log && typeof adapter.log.info === "function") {
+          adapter.log.info("[role-security] End customer group enforced as read-only for objects and states");
+        }
+      }
+    } catch (error) {
+      if (adapter.log && typeof adapter.log.warn === "function") {
+        adapter.log.warn(`[role-security] ACL enforcement failed for ${id}: ${error && error.message || error}`);
+      }
+    }
+  }
+}
+
+async function handleStatus(req, res) {
+  const role = roleFromRequest(req);
+  const backupActive = await getBackupActive();
+  res.statusCode = 200;
+  res.setHeader("Content-Type", "application/json; charset=utf-8");
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.end(JSON.stringify({
+    ok: true,
+    role,
+    user: extractIdentity(req) || null,
+    backupActive,
+    capabilities: {
+      appCenter: role === "admin",
+      license: role === "admin",
+      simulation: role === "admin",
+      expertMode: role === "admin",
+      accessRights: role === "admin",
+      xterm: role === "admin",
+      ioBrokerAdmin: role === "admin",
+      writeDatapoints: role === "admin" || role === "installer",
+      readDatapoints: true,
+    },
+  }));
+}
+
+function wrapListener(listener) {
+  if (typeof listener !== "function") return listener;
+  return function guardedListener(req, res) {
+    try {
+      const url = String(req && req.url || "/");
+      if (/^\/api\/nexowatt-eos\/security\/(?:status|me)(?:[/?#]|$)/i.test(url)) {
+        void handleStatus(req, res);
+        return;
+      }
+      const role = roleFromRequest(req);
+      if (role !== "unknown" && role !== "admin" && (isAdminOnlyPath(url) || isRightsPath(url))) {
+        deny(res, "Diese Funktion ist ausschließlich für Administratoren freigegeben.");
+        return;
+      }
+      if (role === "customer" && isStateWriteRequest(req)) {
+        deny(res, "Endkunden besitzen für Datenpunkte ausschließlich Leserechte.");
+        return;
+      }
+    } catch {
+      // Fail closed only for positively identified restricted users. Other
+      // requests continue to the existing server so startup is never blocked.
+    }
+    return listener.apply(this, arguments);
+  };
+}
+
+function patchCreateServer(module) {
+  const original = module.createServer;
+  if (typeof original !== "function" || original.__nexowattRoleSecurity) return;
+  function secureCreateServer(...args) {
+    if (typeof args[0] === "function") args[0] = wrapListener(args[0]);
+    else if (typeof args[1] === "function") args[1] = wrapListener(args[1]);
+    return original.apply(this, args);
+  }
+  Object.defineProperty(secureCreateServer, "__nexowattRoleSecurity", { value: true });
+  module.createServer = secureCreateServer;
+}
+
+function installHttpGuard() {
+  if (installed) return;
+  installed = true;
+  patchCreateServer(http);
+  patchCreateServer(https);
+}
+
+module.exports = {
+  attachAdapter,
+  classifyRole,
+  enforceRoleAcls,
+  extractIdentity,
+  getBackupActive,
+  installHttpGuard,
+  isAdminOnlyPath,
+  isRightsPath,
+  roleFromRequest,
+  wrapListener,
+};

package/build/main.js

@@ -1,4 +1,7 @@
 "use strict";
+
+const eosRoleSecurity = require("./lib/eosRoleSecurity");
+eosRoleSecurity.installHttpGuard();
 /**
  *      Admin backend
  *
@@ -329,6 +332,8 @@ class Admin extends adapter_core_1.Adapter {
      * Is called when databases are connected and adapter received configuration.
      */
     onReady = async () => {
+        eosRoleSecurity.attachAdapter(this);
+        await eosRoleSecurity.enforceRoleAcls(this);
         const systemConfig = await this.getForeignObjectAsync('system.config');
         if (systemConfig) {
             systemConfig.native = systemConfig.native || {};