iobroker.eos-admin 7.10.2 → 7.10.4

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.10.2",
+    "version": "7.10.4",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,6 +18,11 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
+      "7.10.4": {
+        "de": "Stable 7.10.4 verschiebt die Einstellung für automatische NexoWatt-Adapter-Updates vollständig in die Systemeinstellungen hinter dem Schraubenschlüssel. Auf Übersicht, Module und allen anderen Hauptseiten wird die Update-Karte nicht mehr eingeblendet. Die stabile Update-Logik und die Absturzkorrekturen aus 7.10.2 bleiben unverändert.",
+        "en": "Stable 7.10.4 moves the automatic NexoWatt adapter update control entirely into System Settings behind the wrench button. The update card is no longer shown on Overview, Modules or any other main page. Stable update behavior and the 7.10.2 crash fixes remain unchanged.",
+        "nl": "Stable 7.10.4 verplaatst de instelling voor automatische NexoWatt-adapterupdates volledig naar de systeeminstellingen achter de moersleutelknop. De updatekaart wordt niet meer weergegeven op Overzicht, Modules of andere hoofdpagina’s. De stabiele updatelogica en crashfixes uit 7.10.2 blijven ongewijzigd."
+      },
       "7.10.2": {
         "de": "Stable-Hotfix 7.10.2 beseitigt die EOS-Admin-Startschleife: Stable-Update-Status wird nicht mehr in die laufende Instanzkonfiguration geschrieben, der erste Abgleich startet verzögert und das Release prüft die vollständige Backend-Modulkette einschließlich eosRequestSecurity.",
         "en": "Stable hotfix 7.10.2 removes the EOS Admin restart loop: stable-update status is no longer written to the running instance configuration, first reconciliation is delayed, and the release validates the complete backend module chain including eosRequestSecurity.",
@@ -344,7 +349,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.2/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.4/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -355,7 +360,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.2/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.4/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -423,7 +428,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.2/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.4/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1183,5 +1188,5 @@
       }
     }
   },
-  "version": "7.10.2"
+  "version": "7.10.4"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
   "description": "NexoWatt EOS Admin – repaired stable baseline with restart-safe automatic updates, native account passwords and persistent cockpit scrolling.",
-  "version": "7.10.2",
+  "version": "7.10.4",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -132,13 +132,16 @@
     "tools/nexowatt-backend-runtime-selftest.cjs",
     "NEXOWATT_EOS_PREBUILT_MANIFEST.json",
     "tools/nexowatt-prebuilt-release-selftest.cjs",
-    "tools/nexowatt-stable-v7102-selftest.cjs",
-    "README_STABILITY_V7.10.2.md",
-    "RELEASE_NOTES_V7.10.2.md",
-    "PUBLISH_STABLE_V7.10.2.md",
-    "INSTALL_TEST_V7.10.2.md",
-    "RELEASE_ACCEPTANCE_V7.10.2.md",
-    "MERGE_UPDATE_README_V7.10.2.md"
+    "tools/nexowatt-stable-v7103-selftest.cjs",
+    "README_STABILITY_V7.10.4.md",
+    "RELEASE_NOTES_V7.10.4.md",
+    "PUBLISH_STABLE_V7.10.4.md",
+    "INSTALL_TEST_V7.10.4.md",
+    "RELEASE_ACCEPTANCE_V7.10.4.md",
+    "MERGE_UPDATE_README_V7.10.4.md",
+    "tools/nexowatt-auto-update-placement-selftest.cjs",
+    "tools/nexowatt-role-security-selftest.cjs",
+    "src-admin/nexowatt-role-security.js"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -173,7 +176,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7102 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs && node tools/nexowatt-role-security-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -198,9 +201,11 @@
     "test:eos-version-sync": "node tools/nexowatt-version-sync-selftest.cjs",
     "verify:eos-merge": "node tools/nexowatt-merge-update-selftest.cjs",
     "check:eos-backend-runtime": "node tools/nexowatt-backend-runtime-selftest.cjs",
-    "check:eos-stable-v7102": "node tools/nexowatt-stable-v7102-selftest.cjs",
     "check:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs",
-    "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write"
+    "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write",
+    "check:eos-stable-v7103": "node tools/nexowatt-stable-v7103-selftest.cjs",
+    "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs",
+    "check:eos-role-security": "node tools/nexowatt-role-security-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -211,7 +216,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.2"
+    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.4"
   },
   "publisher": "NexoWatt"
 }

package/src-admin/README.md

@@ -0,0 +1,69 @@
+# NexoWatt EOS Admin Frontend Source
+
+Dieser Bereich enthält den Frontend-Quellcode der Administrationsoberfläche. Das sichtbare EOS-Branding wird über die fertigen Assets in `adminWww/` und die NexoWatt-spezifischen Branding-Dateien ergänzt.
+
+Die folgenden Komponentenhinweise stammen aus der technischen Frontend-Basis und bleiben für Entwicklung und Wartung erhalten.
+
+---
+
+# Components
+
+## DrawerItem
+
+![DrawerItem (light)](docs/images/components/DrawerItem_light.png)
+![DrawerItem (dark blue)](docs/images/components/DrawerItem_darkblue.png)
+![DrawerItem (dark)](docs/images/components/DrawerItem_dark.png)
+
+### Import
+
+```js
+import DrawerItem from './components/DrawerItem';
+```
+
+### Props
+
+| Name         | Default | Description                            |
+| ------------ | ------- | -------------------------------------- |
+| icon         |         | The icon on the left side              |
+| onClick      |         | Function that is called when clicking  |
+| selected     |         | Indicates whether the item is selected |
+| text         |         | Text to display                        |
+| badgeContent | 0       | Content of the badge                   |
+| badgeColor   | primary | Color of the badge                     |
+
+### Example
+
+```js
+<DrawerItem
+    text="Logs"
+    selected={false}
+    badgeContent={11}
+    badgeColor={'error'}
+/>
+```
+
+## IntroCard
+
+![IntroCard (light)](docs/images/components/IntroCard_light.png)
+![IntroCard (dark blue)](docs/images/components/IntroCard_darkblue.png)
+![IntroCard (dark)](docs/images/components/IntroCard_dark.png)
+
+### Import
+
+```js
+import IntroCard from './components/IntroCard';
+```
+
+### Props
+
+| Name             | Default | Description                                                                         |
+|------------------| ------- |-------------------------------------------------------------------------------------|
+| title            |         | The title of the card                                                               |
+| children         |         | The child elements                                                                  |
+| image            |         | The image to display on the left                                                    |
+| color            | #e2e2e2 | The color to display as the background of the image                                 |
+| action           |         | Link and text {link: 'https://example.com', text: 'example.com'}                    |
+| reveal           |         | Element or text that should be displayed in the reveal element using an info button |
+| enabled          |         | State of the card                                                                   |
+| edit             |         | Editing mode active                                                                 |
+| toggleActivation |         | Function for switching the status                                                   |

package/src-admin/nexowatt-role-security.js

@@ -0,0 +1,336 @@
+(() => {
+  "use strict";
+
+  const VERSION = "7.10.4";
+  const HIDDEN = "data-eos-role-hidden";
+  const READONLY = "data-eos-readonly";
+  const state = { role: "unknown", backupActive: null, user: "", appliedAt: 0 };
+
+  const adminOnlyTokens = [
+    "app-center", "app center", "appcenter", "lizenz", "license", "simulation", "simulator",
+    "expertenmodus", "expert mode", "xterm", "shell-konsole", "shell console", "zugänge & rechte",
+    "zugaenge & rechte", "access & rights", "user management", "benutzerverwaltung"
+  ];
+  const backupTokens = ["sicherung", "backup", "backitup"];
+  const dataPointTokens = ["datenpunkte", "datapoints", "objects", "objekte"];
+  const dangerousWriteTokens = [
+    "wert schreiben", "wert setzen", "schreiben", "write value", "set value", "setstate", "speichern",
+    "save", "anwenden", "apply", "löschen", "delete", "bearbeiten", "edit", "stift"
+  ];
+
+  const normalize = value => String(value == null ? "" : value).trim().toLowerCase();
+  const textOf = el => normalize([
+    el && el.textContent,
+    el && el.getAttribute && el.getAttribute("title"),
+    el && el.getAttribute && el.getAttribute("aria-label"),
+    el && el.getAttribute && el.getAttribute("data-testid"),
+    el && el.getAttribute && el.getAttribute("href"),
+    el && el.getAttribute && el.getAttribute("to"),
+    el && el.id,
+    el && el.className && typeof el.className === "string" ? el.className : ""
+  ].filter(Boolean).join(" "));
+
+  function classify(value) {
+    const text = normalize(value);
+    if (!text) return "unknown";
+    if (/^(?:system\.user\.)?admin(?:istrator)?$/.test(text) || /(?:^|[.:/_ -])admin(?:istrator)?(?:$|[.:/_ -])/.test(text)) return "admin";
+    if (/installer|installateur|inbetriebnahme/.test(text)) return "installer";
+    if (/endkunde|customer|smarthome|guest|gast|(?:^|\s)user(?:$|\s)/.test(text)) return "customer";
+    return "unknown";
+  }
+
+  function roleFromGlobals() {
+    const candidates = [
+      window.__NEXOWATT_ROLE__, window.__EOS_ROLE__, window.eosRole,
+      window.currentUser && window.currentUser.role,
+      window.user && window.user.role,
+      document.documentElement.getAttribute("data-role"),
+      document.body && document.body.getAttribute("data-role")
+    ];
+    for (const value of candidates) {
+      const role = classify(value);
+      if (role !== "unknown") return role;
+    }
+    return "unknown";
+  }
+
+  function roleFromStorage() {
+    const stores = [window.sessionStorage, window.localStorage];
+    const keys = ["eos.role", "eosRole", "role", "userRole", "nexowatt.role", "auth.role", "currentRole"];
+    for (const store of stores) {
+      try {
+        for (const key of keys) {
+          const role = classify(store.getItem(key));
+          if (role !== "unknown") return role;
+        }
+      } catch { /* storage can be disabled */ }
+    }
+    return "unknown";
+  }
+
+  function roleFromDom() {
+    const selectors = [
+      "[data-role]", "[data-user-role]", "[data-current-role]", "[aria-label*='Rolle' i]",
+      "[aria-label*='role' i]", "header", "nav", ".MuiAppBar-root"
+    ];
+    for (const selector of selectors) {
+      for (const el of document.querySelectorAll(selector)) {
+        const value = [
+          el.getAttribute && el.getAttribute("data-role"),
+          el.getAttribute && el.getAttribute("data-user-role"),
+          el.getAttribute && el.getAttribute("data-current-role"),
+          el.getAttribute && el.getAttribute("aria-label"),
+          el.textContent
+        ].filter(Boolean).join(" ");
+        const role = classify(value);
+        if (role !== "unknown") return role;
+      }
+    }
+    return "unknown";
+  }
+
+  function findDisplayedUser() {
+    const candidates = document.querySelectorAll("header *, nav *, .MuiAppBar-root *");
+    for (const el of candidates) {
+      const text = normalize(el.textContent);
+      if (!text || text.length > 80) continue;
+      if (/\b(admin|installer|user|guest|gast|endkunde)\b/.test(text)) return text;
+    }
+    return "";
+  }
+
+  async function fetchSecurityStatus() {
+    try {
+      const user = encodeURIComponent(findDisplayedUser());
+      const response = await fetch(`/api/nexowatt-eos/security/status?user=${user}&v=${VERSION}`, {
+        credentials: "same-origin", cache: "no-store", headers: { "Accept": "application/json" }
+      });
+      if (!response.ok) return null;
+      return await response.json();
+    } catch {
+      return null;
+    }
+  }
+
+  function isAdmin() { return state.role === "admin"; }
+  function isCustomer() { return state.role === "customer"; }
+
+  function hide(el, reason) {
+    if (!el || el === document.body || el === document.documentElement) return;
+    if (!el.hasAttribute(HIDDEN)) {
+      el.setAttribute(HIDDEN, reason || "restricted");
+      el.setAttribute("aria-hidden", "true");
+      el.style.setProperty("display", "none", "important");
+    }
+  }
+
+  function unhide(el) {
+    if (!el || !el.hasAttribute(HIDDEN)) return;
+    el.removeAttribute(HIDDEN);
+    el.removeAttribute("aria-hidden");
+    el.style.removeProperty("display");
+  }
+
+  function closestAction(el) {
+    return el && el.closest && el.closest("a,button,[role='button'],[role='tab'],li,.MuiButtonBase-root") || el;
+  }
+
+  function includesAny(text, tokens) {
+    return tokens.some(token => text.includes(token));
+  }
+
+  function applyNavigationPolicy() {
+    const actions = document.querySelectorAll("a,button,[role='button'],[role='tab'],li,.MuiButtonBase-root");
+    for (const raw of actions) {
+      const el = closestAction(raw);
+      const text = textOf(el);
+      if (!text) continue;
+
+      const adminOnly = includesAny(text, adminOnlyTokens) ||
+        (/\badmin\b/.test(text) && /(?:8081|adapter=admin|io.?broker)/.test(text));
+      const backup = includesAny(text, backupTokens);
+
+      if (!isAdmin() && adminOnly) hide(el, "admin-only");
+      else if (adminOnly) unhide(el);
+
+      if (backup && state.backupActive === false) hide(el, "backup-inactive");
+      else if (backup && state.backupActive === true && (isAdmin() || !adminOnly)) unhide(el);
+    }
+
+    if (!isAdmin()) {
+      for (const el of document.querySelectorAll("[data-testid*='expert' i],[class*='expert' i],[id*='expert' i],[title*='Experten' i],[aria-label*='Experten' i],[title*='Expert' i],[aria-label*='Expert' i]")) {
+        hide(closestAction(el), "admin-only-expert");
+      }
+    }
+  }
+
+  function isDataPointPage() {
+    const route = normalize(location.pathname + " " + location.hash + " " + document.title);
+    if (includesAny(route, dataPointTokens)) return true;
+    const selected = document.querySelector("[aria-selected='true'],.Mui-selected,.active");
+    return selected ? includesAny(textOf(selected), dataPointTokens) : false;
+  }
+
+  function makeDatapointsReadOnly() {
+    const root = document.querySelector("main") || document.body;
+    if (!isCustomer() || !isDataPointPage()) {
+      root && root.removeAttribute(READONLY);
+      return;
+    }
+    root.setAttribute(READONLY, "true");
+    for (const el of root.querySelectorAll("input,textarea,select,[contenteditable='true'],button,[role='button']")) {
+      const text = textOf(el);
+      const isSearch = /filter|suche|search|refresh|aktualisieren|reload|sort|spalte|column|zurück|back/.test(text) ||
+        /search/i.test(el.getAttribute && el.getAttribute("type") || "") ||
+        /filter|search/i.test(el.getAttribute && el.getAttribute("placeholder") || "");
+      const likelyWriter = includesAny(text, dangerousWriteTokens) ||
+        /value|wert|write|edit|save|delete|setstate|state-value/i.test(text) ||
+        (el.matches("input,textarea,select,[contenteditable='true']") && !isSearch);
+      if (likelyWriter && !isSearch) {
+        el.setAttribute("aria-disabled", "true");
+        el.setAttribute("tabindex", "-1");
+        if ("disabled" in el) el.disabled = true;
+        if (el.getAttribute("contenteditable") === "true") el.setAttribute("contenteditable", "false");
+        el.style.setProperty("pointer-events", "none", "important");
+        el.style.setProperty("opacity", "0.62", "important");
+      }
+    }
+  }
+
+  function currentRouteRestricted() {
+    const route = normalize(location.pathname + " " + location.search + " " + location.hash);
+    return includesAny(route, adminOnlyTokens);
+  }
+
+  function renderForbidden() {
+    if (document.getElementById("eos-role-forbidden")) return;
+    const overlay = document.createElement("div");
+    overlay.id = "eos-role-forbidden";
+    overlay.innerHTML = `<div class="eos-role-forbidden-card"><strong>Zugriff gesperrt</strong><span>App-Center, Lizenz, Simulation und Expertenmodus sind ausschließlich für Administratoren freigegeben.</span><button type="button">Zurück zum Cockpit</button></div>`;
+    overlay.querySelector("button").addEventListener("click", () => {
+      location.hash = "#/";
+      try { history.replaceState(null, "", location.pathname); } catch { /* ignore */ }
+      overlay.remove();
+    });
+    document.body.appendChild(overlay);
+  }
+
+  function guardCurrentRoute() {
+    if (!isAdmin() && currentRouteRestricted()) renderForbidden();
+    else document.getElementById("eos-role-forbidden")?.remove();
+  }
+
+  function clearExpertMode() {
+    if (isAdmin()) return;
+    const keys = ["expertMode", "expert-mode", "eos.expert", "eosExpertMode", "adminExpertMode"];
+    for (const store of [window.localStorage, window.sessionStorage]) {
+      try { keys.forEach(key => store.removeItem(key)); } catch { /* ignore */ }
+    }
+    window.__NEXOWATT_EXPERT_MODE__ = false;
+  }
+
+  function scrubPrivilegedUiSessions() {
+    if (isAdmin()) return;
+    const marker = "eos.nonAdminUiLogout.v7104";
+    try {
+      if (sessionStorage.getItem(marker)) return;
+      sessionStorage.setItem(marker, "1");
+    } catch { /* continue */ }
+    const protocol = location.protocol === "https:" ? "https:" : "http:";
+    const host = location.hostname;
+    for (const port of [8082, 8188]) {
+      const iframe = document.createElement("iframe");
+      iframe.hidden = true;
+      iframe.setAttribute("aria-hidden", "true");
+      iframe.src = `${protocol}//${host}:${port}/logout?source=eos-role-security&v=${VERSION}`;
+      document.body.appendChild(iframe);
+      setTimeout(() => iframe.remove(), 12000);
+    }
+  }
+
+  function apply() {
+    state.appliedAt = Date.now();
+    document.documentElement.setAttribute("data-eos-effective-role", state.role);
+    applyNavigationPolicy();
+    makeDatapointsReadOnly();
+    clearExpertMode();
+    guardCurrentRoute();
+  }
+
+  function installEventGuards() {
+    document.addEventListener("click", event => {
+      if (isAdmin()) return;
+      const action = closestAction(event.target);
+      const text = textOf(action);
+      if (includesAny(text, adminOnlyTokens) || (/\badmin\b/.test(text) && /(?:8081|adapter=admin|io.?broker)/.test(text))) {
+        event.preventDefault(); event.stopImmediatePropagation(); renderForbidden(); return;
+      }
+      if (isCustomer() && isDataPointPage() && includesAny(text, dangerousWriteTokens)) {
+        event.preventDefault(); event.stopImmediatePropagation(); return;
+      }
+    }, true);
+    document.addEventListener("submit", event => {
+      if (isCustomer() && isDataPointPage()) { event.preventDefault(); event.stopImmediatePropagation(); }
+    }, true);
+    for (const name of ["pushState", "replaceState"]) {
+      const original = history[name];
+      history[name] = function(...args) {
+        const result = original.apply(this, args);
+        queueMicrotask(apply);
+        return result;
+      };
+    }
+    addEventListener("hashchange", apply);
+    addEventListener("popstate", apply);
+  }
+
+  function injectStyles() {
+    if (document.getElementById("eos-role-security-style")) return;
+    const style = document.createElement("style");
+    style.id = "eos-role-security-style";
+    style.textContent = `
+      [${HIDDEN}] { display:none !important; }
+      #eos-role-forbidden { position:fixed; inset:0; z-index:2147483647; display:grid; place-items:center; padding:24px; background:rgba(1,17,28,.96); color:#eefaff; font-family:Arial,sans-serif; }
+      .eos-role-forbidden-card { width:min(620px,100%); display:grid; gap:18px; padding:30px; border:1px solid #16d49d; border-radius:18px; background:#072333; box-shadow:0 20px 80px rgba(0,0,0,.45); }
+      .eos-role-forbidden-card strong { color:#24e6ad; font-size:28px; }
+      .eos-role-forbidden-card span { line-height:1.55; }
+      .eos-role-forbidden-card button { justify-self:start; padding:10px 18px; border:1px solid #16d49d; border-radius:10px; color:#021911; background:#24e6ad; font-weight:700; cursor:pointer; }
+      [${READONLY}="true"]::before { content:"Nur-Lesezugriff für Endkunden"; position:sticky; top:0; z-index:10; display:block; margin:8px; padding:8px 12px; border:1px solid #1aa57d; border-radius:9px; background:#07342b; color:#cffff0; font:600 13px Arial,sans-serif; }
+    `;
+    document.head.appendChild(style);
+  }
+
+  async function init() {
+    injectStyles();
+    let role = roleFromGlobals();
+    if (role === "unknown") role = roleFromStorage();
+    if (role === "unknown") role = roleFromDom();
+    const status = await fetchSecurityStatus();
+    if (status) {
+      const serverRole = classify(status.role);
+      if (serverRole !== "unknown") role = serverRole;
+      if (typeof status.backupActive === "boolean") state.backupActive = status.backupActive;
+      state.user = status.user || "";
+    }
+    if (role === "unknown") role = "customer"; // least privilege until authenticated role is known
+    state.role = role;
+    try { sessionStorage.setItem("eos.role.effective", role); } catch { /* ignore */ }
+    installEventGuards();
+    apply();
+    scrubPrivilegedUiSessions();
+    const observer = new MutationObserver(() => {
+      clearTimeout(observer._timer);
+      observer._timer = setTimeout(apply, 40);
+    });
+    observer.observe(document.documentElement, { childList: true, subtree: true, attributes: true, attributeFilter: ["class", "aria-selected", "href"] });
+    setInterval(async () => {
+      const refreshed = await fetchSecurityStatus();
+      if (refreshed && typeof refreshed.backupActive === "boolean" && refreshed.backupActive !== state.backupActive) {
+        state.backupActive = refreshed.backupActive; apply();
+      }
+    }, 10000);
+  }
+
+  if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", init, { once: true });
+  else void init();
+})();

package/tools/nexowatt-auto-update-placement-selftest.cjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const root = path.resolve(__dirname, '..');
+const read = relative => fs.readFileSync(path.join(root, relative), 'utf8');
+const json = relative => JSON.parse(read(relative));
+const fail = message => {
+    console.error(`[NexoWatt EOS auto-update placement] ${message}`);
+    process.exit(1);
+};
+const must = (value, message) => value || fail(message);
+
+const sourceJs = read('src-admin/public/js/eos-auto-update.js');
+const builtJs = read('adminWww/js/eos-auto-update.js');
+const sourceCss = read('src-admin/public/css/eos-auto-update.css');
+const builtCss = read('adminWww/css/eos-auto-update.css');
+const index = read('adminWww/index.html');
+const info = json('NEXOWATT_EOS_BUILD_INFO.json');
+const cacheTag = String(info.autoUpdateCacheTag || info.autoUpdateCacheVersion || info.shellCacheTag || info.shellCacheVersion);
+
+must(sourceJs === builtJs, 'JavaScript source/build drift');
+must(sourceCss === builtCss, 'CSS source/build drift');
+must(sourceJs.includes("const VERSION = 'v7103-system-settings-only'"), 'v7103 placement marker missing');
+must(sourceJs.includes('[role="dialog"][aria-labelledby="system-settings-dialog-title"]'), 'System Settings dialog selector missing');
+must(sourceJs.includes("root.dataset.context = 'system-settings'"), 'System Settings context marker missing');
+must(sourceJs.includes("root.setAttribute('data-eos-system-settings-only', 'true')"), 'system-settings-only marker missing');
+must(sourceJs.includes('mount.content.insertBefore(root, mount.appBar.nextSibling)'), 'card is not inserted below the System Settings app bar');
+must(sourceJs.includes("location: 'system-settings'"), 'public UI location contract missing');
+
+for (const forbidden of [
+    'introActive',
+    'eos-native-overview-hero',
+    'eos-ems-overview-runtime',
+    "document.getElementById('app-paper')",
+]) {
+    must(!sourceJs.includes(forbidden), `global page placement remains active: ${forbidden}`);
+}
+
+must(index.includes(`eos-auto-update.js?v=${cacheTag}`), `auto-update JavaScript cache key ${cacheTag} missing`);
+must(index.includes(`eos-auto-update.css?v=${cacheTag}`), `auto-update CSS cache key ${cacheTag} missing`);
+must(sourceCss.includes('visible only inside the System Settings dialog'), 'CSS ownership comment missing');
+must(sourceCss.includes('[data-context="system-settings"]'), 'System Settings CSS scope marker missing');
+
+console.log('[NexoWatt EOS auto-update placement] OK (System Settings only; no Overview/Modules injection)');

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.10.2.md',
+    'MERGE_UPDATE_README_V7.10.4.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',

package/tools/nexowatt-role-security-selftest.cjs

@@ -0,0 +1,43 @@
+"use strict";
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const root = path.resolve(__dirname, "..");
+const securityFile = path.join(root, "build", "lib", "eosRoleSecurity.js");
+assert.ok(fs.existsSync(securityFile), "build/lib/eosRoleSecurity.js is missing");
+const security = require(securityFile);
+assert.equal(security.classifyRole("admin"), "admin");
+assert.equal(security.classifyRole("Administrator"), "admin");
+assert.equal(security.classifyRole("installer"), "installer");
+assert.equal(security.classifyRole("Gast / Endkunde"), "customer");
+assert.equal(security.isAdminOnlyPath("/#/app-center"), true);
+assert.equal(security.isAdminOnlyPath("/license"), true);
+assert.equal(security.isAdminOnlyPath("/simulation"), true);
+assert.equal(security.isAdminOnlyPath("/cockpit"), false);
+assert.equal(security.isRightsPath("/#/users-and-groups"), true);
+assert.equal(security.isRightsPath("/cockpit"), false);
+const htmlFiles = [];
+(function walk(dir) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || entry.name === ".git") continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) walk(full);
+    else if (entry.name === "index.html") htmlFiles.push(full);
+  }
+})(root);
+const runtimeHtml = htmlFiles.filter(file => /<script[^>]+(?:assets\/|src=)/i.test(fs.readFileSync(file, "utf8")));
+assert.ok(runtimeHtml.length > 0, "No runtime index.html was found");
+for (const file of runtimeHtml) {
+  const html = fs.readFileSync(file, "utf8");
+  assert.match(html, /nexowatt-role-security\.js\?v=7104/, `Role guard missing in ${path.relative(root, file)}`);
+  assert.ok(fs.existsSync(path.join(path.dirname(file), "nexowatt-role-security.js")), `Client guard missing next to ${path.relative(root, file)}`);
+}
+const main = fs.readFileSync(path.join(root, "build", "main.js"), "utf8");
+assert.match(main, /eosRoleSecurity/);
+assert.match(main, /installHttpGuard/);
+assert.match(main, /enforceRoleAcls/);
+const client = runtimeHtml.length ? fs.readFileSync(path.join(path.dirname(runtimeHtml[0]), "nexowatt-role-security.js"), "utf8") : "";
+for (const token of ["app-center", "lizenz", "simulation", "expertenmodus", "xterm", "Nur-Lesezugriff", "backupActive"]) {
+  assert.ok(client.toLowerCase().includes(token.toLowerCase()), `Client guard is missing ${token}`);
+}
+console.log("[NexoWatt EOS role security] OK");