iobroker.eos-admin 7.10.3 → 7.10.4

package/build/lib/eosRoleSecurity.js

@@ -0,0 +1,310 @@
+"use strict";
+
+/**
+ * NexoWatt EOS role security boundary.
+ *
+ * This module intentionally uses only Node.js core APIs so the prebuilt
+ * repository can be packed and published without a local node_modules folder.
+ */
+const http = require("node:http");
+const https = require("node:https");
+const { URL } = require("node:url");
+
+let adapterRef = null;
+let installed = false;
+let backupCache = { value: false, expires: 0 };
+
+const ADMIN_NAMES = new Set(["admin", "administrator", "system.user.admin"]);
+const INSTALLER_TOKENS = ["installer", "installateur", "inbetriebnahme"];
+const CUSTOMER_TOKENS = ["user", "guest", "gast", "endkunde", "customer", "smarthome"];
+
+const ADMIN_ONLY_PATHS = [
+  /(?:^|[\\/#?&_.-])app[\\s_.-]*center(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])lizenz(?:en)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])licen[cs]e(?:s)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])simulation(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])simulator(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])experten?(?:modus)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])expert(?:mode)?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])xterm(?:$|[\\/#?&_.-])/i,
+];
+
+const RIGHTS_PATHS = [
+  /(?:^|[\\/#?&_.-])users?(?:$|[\\/#?&_.-])/i,
+  /(?:^|[\\/#?&_.-])groups?(?:$|[\\/#?&_.-])/i,
+  /zug[aä]nge/i,
+  /rechte/i,
+  /permissions?/i,
+  /password/i,
+  /passwort/i,
+];
+
+function normalize(value) {
+  if (value === null || value === undefined) return "";
+  if (typeof value === "object") {
+    if (typeof value.name === "string") return value.name.trim().toLowerCase();
+    if (typeof value.user === "string") return value.user.trim().toLowerCase();
+    return "";
+  }
+  return String(value).trim().toLowerCase();
+}
+
+function classifyRole(value) {
+  const text = normalize(value);
+  if (!text) return "unknown";
+  if (ADMIN_NAMES.has(text) || /(?:^|[.:/_-])admin(?:istrator)?(?:$|[.:/_-])/.test(text)) return "admin";
+  if (INSTALLER_TOKENS.some(token => text.includes(token))) return "installer";
+  if (CUSTOMER_TOKENS.some(token => text === token || text.includes(token))) return "customer";
+  return "unknown";
+}
+
+function parseBasicUser(header) {
+  if (!header || !/^basic\s+/i.test(header)) return "";
+  try {
+    const decoded = Buffer.from(header.replace(/^basic\s+/i, ""), "base64").toString("utf8");
+    return decoded.split(":", 1)[0] || "";
+  } catch {
+    return "";
+  }
+}
+
+function parseCookieHeader(header) {
+  const out = Object.create(null);
+  String(header || "").split(";").forEach(part => {
+    const idx = part.indexOf("=");
+    if (idx <= 0) return;
+    const key = part.slice(0, idx).trim();
+    let value = part.slice(idx + 1).trim();
+    try { value = decodeURIComponent(value); } catch { /* ignore */ }
+    out[key] = value;
+  });
+  return out;
+}
+
+function extractIdentity(req) {
+  const candidates = [];
+  if (req) {
+    candidates.push(req.user, req.username, req.auth && req.auth.user, req.session && req.session.user,
+      req.session && req.session.username, req.session && req.session.passport && req.session.passport.user,
+      req.ioBrokerUser, req._user);
+    const headers = req.headers || {};
+    candidates.push(headers["x-iobroker-user"], headers["x-eos-user"], headers["x-authenticated-user"],
+      headers["x-forwarded-user"], parseBasicUser(headers.authorization));
+    const cookies = parseCookieHeader(headers.cookie);
+    for (const key of ["iobroker.user", "iobroker_user", "eos.user", "eosUser", "user", "username", "authUser"]) {
+      candidates.push(cookies[key]);
+    }
+    try {
+      const parsed = new URL(req.url || "/", "http://127.0.0.1");
+      candidates.push(parsed.searchParams.get("user"), parsed.searchParams.get("username"));
+    } catch { /* ignore */ }
+  }
+  for (const value of candidates) {
+    if (normalize(value)) return normalize(value);
+  }
+  return "";
+}
+
+function roleFromRequest(req) {
+  const explicitRole = normalize(req && req.headers && (req.headers["x-eos-role"] || req.headers["x-nexowatt-role"]));
+  const role = classifyRole(explicitRole);
+  if (role !== "unknown") return role;
+  return classifyRole(extractIdentity(req));
+}
+
+function isAdminOnlyPath(rawUrl) {
+  const value = String(rawUrl || "");
+  return ADMIN_ONLY_PATHS.some(pattern => pattern.test(value));
+}
+
+function isRightsPath(rawUrl) {
+  const value = String(rawUrl || "");
+  return RIGHTS_PATHS.some(pattern => pattern.test(value));
+}
+
+function isStateWriteRequest(req) {
+  const method = String(req && req.method || "GET").toUpperCase();
+  if (!["POST", "PUT", "PATCH", "DELETE"].includes(method)) return false;
+  const value = String(req && req.url || "");
+  return /(?:setstate|write|objects?\/|states?\/|sendto|command)/i.test(value);
+}
+
+function deny(res, message, statusCode = 403) {
+  if (!res || res.headersSent || res.writableEnded) return true;
+  const accepts = String((res.req && res.req.headers && res.req.headers.accept) || "");
+  const json = accepts.includes("application/json") || String(res.req && res.req.url || "").includes("/api/");
+  res.statusCode = statusCode;
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  if (json) {
+    res.setHeader("Content-Type", "application/json; charset=utf-8");
+    res.end(JSON.stringify({ ok: false, error: "forbidden", message }));
+  } else {
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    res.end(`<!doctype html><html lang="de"><meta charset="utf-8"><title>Zugriff gesperrt</title><style>body{margin:0;background:#031724;color:#eaf6ff;font:16px Arial,sans-serif;display:grid;place-items:center;min-height:100vh}.box{max-width:620px;padding:32px;border:1px solid #0dbb87;border-radius:18px;background:#071f2f}h1{margin-top:0;color:#24e6ad}</style><div class="box"><h1>Zugriff gesperrt</h1><p>${message}</p></div></html>`);
+  }
+  return true;
+}
+
+async function getBackupActive() {
+  const now = Date.now();
+  if (backupCache.expires > now) return backupCache.value;
+  let active = false;
+  const adapter = adapterRef;
+  if (adapter) {
+    try {
+      let rows = [];
+      if (typeof adapter.getObjectViewAsync === "function") {
+        const result = await adapter.getObjectViewAsync("system", "instance", { startkey: "system.adapter.", endkey: "system.adapter.\u9999" });
+        rows = result && Array.isArray(result.rows) ? result.rows : [];
+      } else if (typeof adapter.getObjectListAsync === "function") {
+        const result = await adapter.getObjectListAsync({ startkey: "system.adapter.", endkey: "system.adapter.\u9999" });
+        rows = result && Array.isArray(result.rows) ? result.rows : [];
+      }
+      active = rows.some(row => {
+        const obj = row && (row.value || row.doc);
+        const id = normalize(row && row.id || obj && obj._id);
+        return /system\.adapter\.(?:backitup|backup|nexowatt-backup|eos-backup)\./.test(id) && Boolean(obj && obj.common && obj.common.enabled);
+      });
+    } catch (error) {
+      if (adapter && adapter.log && typeof adapter.log.debug === "function") {
+        adapter.log.debug(`[role-security] Backup status could not be read: ${error && error.message || error}`);
+      }
+    }
+  }
+  backupCache = { value: active, expires: now + 5000 };
+  return active;
+}
+
+function attachAdapter(adapter) {
+  adapterRef = adapter || null;
+  backupCache.expires = 0;
+}
+
+function cloneAclSection(section) {
+  return section && typeof section === "object" ? { ...section } : {};
+}
+
+async function enforceRoleAcls(adapter = adapterRef) {
+  if (!adapter || typeof adapter.getForeignObjectAsync !== "function" || typeof adapter.setForeignObjectAsync !== "function") return;
+  const ids = ["system.group.endkunde"];
+  for (const id of ids) {
+    try {
+      const obj = await adapter.getForeignObjectAsync(id);
+      if (!obj || !obj.common) continue;
+      const acl = obj.common.acl && typeof obj.common.acl === "object" ? { ...obj.common.acl } : {};
+      const objectAcl = cloneAclSection(acl.object);
+      const stateAcl = cloneAclSection(acl.state);
+      const usersAcl = cloneAclSection(acl.users);
+      const fileAcl = cloneAclSection(acl.file);
+      const otherAcl = cloneAclSection(acl.other);
+      const before = JSON.stringify({ objectAcl, stateAcl, usersAcl, fileAcl, otherAcl });
+      Object.assign(objectAcl, { list: true, read: true, write: false, delete: false });
+      Object.assign(stateAcl, { list: true, read: true, write: false, delete: false, create: false });
+      Object.assign(usersAcl, { write: false, delete: false, create: false });
+      Object.assign(fileAcl, { list: true, read: true, write: false, delete: false, create: false });
+      Object.assign(otherAcl, { execute: false, sendto: false });
+      acl.object = objectAcl;
+      acl.state = stateAcl;
+      acl.users = usersAcl;
+      acl.file = fileAcl;
+      acl.other = otherAcl;
+      const after = JSON.stringify({ objectAcl, stateAcl, usersAcl, fileAcl, otherAcl });
+      if (before !== after) {
+        obj.common.acl = acl;
+        await adapter.setForeignObjectAsync(id, obj);
+        if (adapter.log && typeof adapter.log.info === "function") {
+          adapter.log.info("[role-security] End customer group enforced as read-only for objects and states");
+        }
+      }
+    } catch (error) {
+      if (adapter.log && typeof adapter.log.warn === "function") {
+        adapter.log.warn(`[role-security] ACL enforcement failed for ${id}: ${error && error.message || error}`);
+      }
+    }
+  }
+}
+
+async function handleStatus(req, res) {
+  const role = roleFromRequest(req);
+  const backupActive = await getBackupActive();
+  res.statusCode = 200;
+  res.setHeader("Content-Type", "application/json; charset=utf-8");
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.end(JSON.stringify({
+    ok: true,
+    role,
+    user: extractIdentity(req) || null,
+    backupActive,
+    capabilities: {
+      appCenter: role === "admin",
+      license: role === "admin",
+      simulation: role === "admin",
+      expertMode: role === "admin",
+      accessRights: role === "admin",
+      xterm: role === "admin",
+      ioBrokerAdmin: role === "admin",
+      writeDatapoints: role === "admin" || role === "installer",
+      readDatapoints: true,
+    },
+  }));
+}
+
+function wrapListener(listener) {
+  if (typeof listener !== "function") return listener;
+  return function guardedListener(req, res) {
+    try {
+      const url = String(req && req.url || "/");
+      if (/^\/api\/nexowatt-eos\/security\/(?:status|me)(?:[/?#]|$)/i.test(url)) {
+        void handleStatus(req, res);
+        return;
+      }
+      const role = roleFromRequest(req);
+      if (role !== "unknown" && role !== "admin" && (isAdminOnlyPath(url) || isRightsPath(url))) {
+        deny(res, "Diese Funktion ist ausschließlich für Administratoren freigegeben.");
+        return;
+      }
+      if (role === "customer" && isStateWriteRequest(req)) {
+        deny(res, "Endkunden besitzen für Datenpunkte ausschließlich Leserechte.");
+        return;
+      }
+    } catch {
+      // Fail closed only for positively identified restricted users. Other
+      // requests continue to the existing server so startup is never blocked.
+    }
+    return listener.apply(this, arguments);
+  };
+}
+
+function patchCreateServer(module) {
+  const original = module.createServer;
+  if (typeof original !== "function" || original.__nexowattRoleSecurity) return;
+  function secureCreateServer(...args) {
+    if (typeof args[0] === "function") args[0] = wrapListener(args[0]);
+    else if (typeof args[1] === "function") args[1] = wrapListener(args[1]);
+    return original.apply(this, args);
+  }
+  Object.defineProperty(secureCreateServer, "__nexowattRoleSecurity", { value: true });
+  module.createServer = secureCreateServer;
+}
+
+function installHttpGuard() {
+  if (installed) return;
+  installed = true;
+  patchCreateServer(http);
+  patchCreateServer(https);
+}
+
+module.exports = {
+  attachAdapter,
+  classifyRole,
+  enforceRoleAcls,
+  extractIdentity,
+  getBackupActive,
+  installHttpGuard,
+  isAdminOnlyPath,
+  isRightsPath,
+  roleFromRequest,
+  wrapListener,
+};

package/build/main.js

@@ -1,4 +1,7 @@
 "use strict";
+
+const eosRoleSecurity = require("./lib/eosRoleSecurity");
+eosRoleSecurity.installHttpGuard();
 /**
  *      Admin backend
  *
@@ -329,6 +332,8 @@ class Admin extends adapter_core_1.Adapter {
      * Is called when databases are connected and adapter received configuration.
      */
     onReady = async () => {
+        eosRoleSecurity.attachAdapter(this);
+        await eosRoleSecurity.enforceRoleAcls(this);
         const systemConfig = await this.getForeignObjectAsync('system.config');
         if (systemConfig) {
             systemConfig.native = systemConfig.native || {};

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.10.3",
+    "version": "7.10.4",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,10 +18,10 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
-      "7.10.3": {
-        "de": "Stable 7.10.3 verschiebt die Einstellung für automatische NexoWatt-Adapter-Updates vollständig in die Systemeinstellungen hinter dem Schraubenschlüssel. Auf Übersicht, Module und allen anderen Hauptseiten wird die Update-Karte nicht mehr eingeblendet. Die stabile Update-Logik und die Absturzkorrekturen aus 7.10.2 bleiben unverändert.",
-        "en": "Stable 7.10.3 moves the automatic NexoWatt adapter update control entirely into System Settings behind the wrench button. The update card is no longer shown on Overview, Modules or any other main page. Stable update behavior and the 7.10.2 crash fixes remain unchanged.",
-        "nl": "Stable 7.10.3 verplaatst de instelling voor automatische NexoWatt-adapterupdates volledig naar de systeeminstellingen achter de moersleutelknop. De updatekaart wordt niet meer weergegeven op Overzicht, Modules of andere hoofdpagina’s. De stabiele updatelogica en crashfixes uit 7.10.2 blijven ongewijzigd."
+      "7.10.4": {
+        "de": "Stable 7.10.4 verschiebt die Einstellung für automatische NexoWatt-Adapter-Updates vollständig in die Systemeinstellungen hinter dem Schraubenschlüssel. Auf Übersicht, Module und allen anderen Hauptseiten wird die Update-Karte nicht mehr eingeblendet. Die stabile Update-Logik und die Absturzkorrekturen aus 7.10.2 bleiben unverändert.",
+        "en": "Stable 7.10.4 moves the automatic NexoWatt adapter update control entirely into System Settings behind the wrench button. The update card is no longer shown on Overview, Modules or any other main page. Stable update behavior and the 7.10.2 crash fixes remain unchanged.",
+        "nl": "Stable 7.10.4 verplaatst de instelling voor automatische NexoWatt-adapterupdates volledig naar de systeeminstellingen achter de moersleutelknop. De updatekaart wordt niet meer weergegeven op Overzicht, Modules of andere hoofdpagina’s. De stabiele updatelogica en crashfixes uit 7.10.2 blijven ongewijzigd."
       },
       "7.10.2": {
         "de": "Stable-Hotfix 7.10.2 beseitigt die EOS-Admin-Startschleife: Stable-Update-Status wird nicht mehr in die laufende Instanzkonfiguration geschrieben, der erste Abgleich startet verzögert und das Release prüft die vollständige Backend-Modulkette einschließlich eosRequestSecurity.",
@@ -349,7 +349,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.3/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.4/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -360,7 +360,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.3/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.4/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -428,7 +428,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.3/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.4/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1188,5 +1188,5 @@
       }
     }
   },
-  "version": "7.10.3"
+  "version": "7.10.4"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
   "description": "NexoWatt EOS Admin – repaired stable baseline with restart-safe automatic updates, native account passwords and persistent cockpit scrolling.",
-  "version": "7.10.3",
+  "version": "7.10.4",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -133,13 +133,15 @@
     "NEXOWATT_EOS_PREBUILT_MANIFEST.json",
     "tools/nexowatt-prebuilt-release-selftest.cjs",
     "tools/nexowatt-stable-v7103-selftest.cjs",
-    "README_STABILITY_V7.10.3.md",
-    "RELEASE_NOTES_V7.10.3.md",
-    "PUBLISH_STABLE_V7.10.3.md",
-    "INSTALL_TEST_V7.10.3.md",
-    "RELEASE_ACCEPTANCE_V7.10.3.md",
-    "MERGE_UPDATE_README_V7.10.3.md",
-    "tools/nexowatt-auto-update-placement-selftest.cjs"
+    "README_STABILITY_V7.10.4.md",
+    "RELEASE_NOTES_V7.10.4.md",
+    "PUBLISH_STABLE_V7.10.4.md",
+    "INSTALL_TEST_V7.10.4.md",
+    "RELEASE_ACCEPTANCE_V7.10.4.md",
+    "MERGE_UPDATE_README_V7.10.4.md",
+    "tools/nexowatt-auto-update-placement-selftest.cjs",
+    "tools/nexowatt-role-security-selftest.cjs",
+    "src-admin/nexowatt-role-security.js"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -174,7 +176,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs && node tools/nexowatt-role-security-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -202,7 +204,8 @@
     "check:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs",
     "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write",
     "check:eos-stable-v7103": "node tools/nexowatt-stable-v7103-selftest.cjs",
-    "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs"
+    "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs",
+    "check:eos-role-security": "node tools/nexowatt-role-security-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -213,7 +216,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.3"
+    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.4"
   },
   "publisher": "NexoWatt"
 }

package/src-admin/README.md

@@ -0,0 +1,69 @@
+# NexoWatt EOS Admin Frontend Source
+
+Dieser Bereich enthält den Frontend-Quellcode der Administrationsoberfläche. Das sichtbare EOS-Branding wird über die fertigen Assets in `adminWww/` und die NexoWatt-spezifischen Branding-Dateien ergänzt.
+
+Die folgenden Komponentenhinweise stammen aus der technischen Frontend-Basis und bleiben für Entwicklung und Wartung erhalten.
+
+---
+
+# Components
+
+## DrawerItem
+
+![DrawerItem (light)](docs/images/components/DrawerItem_light.png)
+![DrawerItem (dark blue)](docs/images/components/DrawerItem_darkblue.png)
+![DrawerItem (dark)](docs/images/components/DrawerItem_dark.png)
+
+### Import
+
+```js
+import DrawerItem from './components/DrawerItem';
+```
+
+### Props
+
+| Name         | Default | Description                            |
+| ------------ | ------- | -------------------------------------- |
+| icon         |         | The icon on the left side              |
+| onClick      |         | Function that is called when clicking  |
+| selected     |         | Indicates whether the item is selected |
+| text         |         | Text to display                        |
+| badgeContent | 0       | Content of the badge                   |
+| badgeColor   | primary | Color of the badge                     |
+
+### Example
+
+```js
+<DrawerItem
+    text="Logs"
+    selected={false}
+    badgeContent={11}
+    badgeColor={'error'}
+/>
+```
+
+## IntroCard
+
+![IntroCard (light)](docs/images/components/IntroCard_light.png)
+![IntroCard (dark blue)](docs/images/components/IntroCard_darkblue.png)
+![IntroCard (dark)](docs/images/components/IntroCard_dark.png)
+
+### Import
+
+```js
+import IntroCard from './components/IntroCard';
+```
+
+### Props
+
+| Name             | Default | Description                                                                         |
+|------------------| ------- |-------------------------------------------------------------------------------------|
+| title            |         | The title of the card                                                               |
+| children         |         | The child elements                                                                  |
+| image            |         | The image to display on the left                                                    |
+| color            | #e2e2e2 | The color to display as the background of the image                                 |
+| action           |         | Link and text {link: 'https://example.com', text: 'example.com'}                    |
+| reveal           |         | Element or text that should be displayed in the reveal element using an info button |
+| enabled          |         | State of the card                                                                   |
+| edit             |         | Editing mode active                                                                 |
+| toggleActivation |         | Function for switching the status                                                   |