iobroker.eos-admin 7.10.3 → 7.10.5

package/adminWww/css/nexowatt-native-shell.css

@@ -1184,12 +1184,23 @@ html.eos-login .eos-login-card-modern {
 /* Internal fallback services are never exposed outside Admin / Service. */
 html.eos-role-installer [data-instance^="admin."],
 html.eos-role-installer [data-instance^="backitup."],
+html.eos-role-installer [data-instance^="xterm."],
 html.eos-role-enduser [data-instance^="admin."],
 html.eos-role-enduser [data-instance^="backitup."],
+html.eos-role-enduser [data-instance^="xterm."],
 html.eos-role-installer [data-instance-id^="admin."],
 html.eos-role-installer [data-instance-id^="backitup."],
+html.eos-role-installer [data-instance-id^="xterm."],
 html.eos-role-enduser [data-instance-id^="admin."],
-html.eos-role-enduser [data-instance-id^="backitup."] { display: none !important; }
+html.eos-role-enduser [data-instance-id^="backitup."],
+html.eos-role-enduser [data-instance-id^="xterm."] { display: none !important; }
+
+html.eos-role-enduser #app-paper[data-eos-datapoints-readonly] [data-eos-object-writable="1"],
+html.eos-role-enduser #app-paper[data-eos-datapoints-readonly] [data-eos-enduser-write-blocked="1"] {
+    pointer-events: none !important;
+    cursor: default !important;
+    opacity: 0.62 !important;
+}
 
 
 

package/adminWww/index.html

@@ -8,7 +8,7 @@
         <meta http-equiv="Cache-Control" content="no-store, no-cache, must-revalidate" />
         <meta http-equiv="Pragma" content="no-cache" />
         <meta http-equiv="Expires" content="0" />
-          <script src="./js/eos-manual-write-policy.js?v=7101"></script>
+          <script src="./js/eos-manual-write-policy.js?v=7105"></script>
           <script type="module" src="./assets/hostInit-v84.js?v=84"></script>
         
         <meta charset="utf-8" />
@@ -36,8 +36,8 @@
             rel="stylesheet"
             href="css/leaflet.css"
         />
-        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7101" />
-        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7101" />
+        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7105" />
+        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7105" />
         <link rel="stylesheet" href="./css/eos-auto-update.css?v=7103" />
         <link
             rel="manifest"
@@ -160,22 +160,22 @@
         </script>
       <link rel="modulepreload" crossorigin href="./assets/preload-helper-BDBacUwf.js">
       <link rel="modulepreload" crossorigin href="./assets/iobroker_admin__mf_v__runtimeInit__mf_v__-g2X2zhAf.js">
-            <script defer src="./js/eos-role-bootstrap.js?v=7101" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
-            <script defer src="./js/eos-policy-client.js?v=7101"></script>
-            <script defer src="./js/eos-branding-sanitizer.js?v=7101"></script>
-            <script defer src="./js/nexowatt-native-shell.js?v=7101"></script>
-            <script defer src="./js/eos-native-security.js?v=7101"></script>
-            <script defer src="./js/eos-basic-settings.js?v=7101"></script>
-            <script defer src="./js/eos-role-ui.js?v=7101"></script>
-            <script defer src="./js/eos-ems-overview.js?v=7101"></script>
+            <script defer src="./js/eos-role-bootstrap.js?v=7105" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
+            <script defer src="./js/eos-policy-client.js?v=7105"></script>
+            <script defer src="./js/eos-branding-sanitizer.js?v=7105"></script>
+            <script defer src="./js/nexowatt-native-shell.js?v=7105"></script>
+            <script defer src="./js/eos-native-security.js?v=7105"></script>
+            <script defer src="./js/eos-basic-settings.js?v=7105"></script>
+            <script defer src="./js/eos-role-ui.js?v=7105"></script>
+            <script defer src="./js/eos-ems-overview.js?v=7105"></script>
             
             <script defer src="./js/eos-auto-update.js?v=7103"></script>
-            <script defer src="./js/eos-assistant.js?v=7101"></script>
+            <script defer src="./js/eos-assistant.js?v=7105"></script>
     </head>
     <body>
         <noscript>Für NexoWatt EOS muss JavaScript aktiviert sein.</noscript>
         <div id="root"></div>
-<script defer src="static/js/nexowatt-stable-login.js?v=7101"></script>
-<script defer src="static/js/nexowatt-stable-v7101.js?v=7101"></script>
+<script defer src="static/js/nexowatt-stable-login.js?v=7105"></script>
+<script defer src="static/js/nexowatt-stable-v7105.js?v=7105"></script>
 </body>
 </html>

package/adminWww/js/eos-role-bootstrap.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7101-standard-password-native-overview';
+    const VERSION = 'v7105-admin-authoritative-rbac';
     const script = document.currentScript || document.querySelector('script[src*="eos-role-bootstrap.js"]');
     const entry = script?.dataset?.eosEntry || '';
     let launched = false;
@@ -16,7 +16,7 @@
 
     const roleFromPolicy = policy => {
         const raw = normalize(policy?.role || policy?.eosRole || policy?.accessRole || '');
-        if (policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
+        if (policy?.user === 'system.user.admin' || policy?.userId === 'system.user.admin' || policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
         if (/nexowatt service|eos service|service admin|service administrator/.test(raw)) return 'admin';
         if (policy?.isInstaller || /installateur|installer|installation|inbetriebnahme|techniker|technician|integrator|partner/.test(raw)) return 'installer';
         return 'enduser';
@@ -25,11 +25,11 @@
     const isCustomerBackupTab = tab => /^(?:tab-)?(?:nexowatt-backup|eos-backup|nexowatt-sicherung)(?:-|$)/.test(normalize(tab));
     const isReleasedEndUserTab = tab => /^(?:tab-)?(?:nexowatt-ui|nexowatt-cockpit|eos-cockpit|eos-dashboard|kunden-cockpit|endkunden-cockpit|lovelace|jarvis|vis|iqontrol|material)(?:-|$)/.test(normalize(tab));
     const isOfficialReserveTab = tab => /^(?:tab-)?(?:admin|backitup)(?:-\d+)?$/.test(normalize(tab));
-    const isInstallerDenied = tab => /(?:tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|hosts|files|console|terminal|security)/.test(normalize(tab)) || isOfficialReserveTab(tab);
+    const isInstallerDenied = tab => /(?:tab-users|tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|users|hosts|files|console|terminal|security)/.test(normalize(tab)) || isOfficialReserveTab(tab);
     const isAllowed = (role, route) => route !== 'easy' && (role === 'admin'
         || (role === 'installer'
-            ? route === 'tab-intro' || route === 'tab-users' || isCustomerBackupTab(route) || !isInstallerDenied(route)
-            : route === 'tab-intro' || route === 'tab-enums' || isCustomerBackupTab(route) || isReleasedEndUserTab(route)));
+            ? route === 'tab-intro' || isCustomerBackupTab(route) || !isInstallerDenied(route)
+            : route === 'tab-intro' || route === 'tab-enums' || route === 'tab-objects' || isCustomerBackupTab(route) || isReleasedEndUserTab(route)));
     const defaultTab = () => 'tab-intro';
     const currentRoute = () => {
         const hash = decodeURIComponent(window.location.hash || '').toLowerCase();

package/adminWww/js/eos-role-ui.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7101-native-overview-standard-users';
+    const VERSION = 'v7105-admin-authoritative-rbac';
     window.NEXOWATT_EOS_ROLE_UI_VERSION = VERSION;
 
     const state = {
@@ -37,7 +37,7 @@
 
     const roleFromPolicy = policy => {
         const raw = normalize(policy?.role || policy?.eosRole || policy?.accessRole || '');
-        if (policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
+        if (policy?.user === 'system.user.admin' || policy?.userId === 'system.user.admin' || policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
         if (/nexowatt service|eos service|service admin|service administrator/.test(raw)) return 'admin';
         if (policy?.isInstaller || /installateur|installer|installation|inbetriebnahme|techniker|technician|integrator|partner/.test(raw)) return 'installer';
         return 'enduser';
@@ -47,10 +47,10 @@
     const isOfficialReserveTab = tab => isOfficialAdminTab(tab) || isOfficialBackupTab(tab);
     const isCustomerBackupTab = tab => /^tab-(?:nexowatt-backup|eos-backup|nexowatt-sicherung)(?:-\d+)?$/.test(normalize(tab));
     const endUserAllowedByText = value => /(eos cockpit|nexowatt ui|nexowatt cockpit|kunden cockpit|kundenbereich|endkundenbereich|visualisierung|visualisation|visu|dashboard|energie cockpit|energy cockpit|bedienung|smart home|smart-home|lovelace|jarvis|iqontrol|material)/.test(normalize(value));
-    const endUserDeniedByText = value => /(module|dienste|datenpunkte|objekte|systemlogs|logs|zugange|rechte|benutzer|users|gruppen|groups|system hosts|system-hosts|hosts|dateien|files|konsole|console|terminal|xterm|adapter|instances?|instanzen|geraetesuche|discovery|systemschutz|security)/.test(normalize(value));
+    const endUserDeniedByText = value => /(module|dienste|systemlogs|logs|zugange|rechte|benutzer|users|gruppen|groups|system hosts|system-hosts|hosts|dateien|files|konsole|console|terminal|xterm|adapter|instances?|instanzen|geraetesuche|discovery|systemschutz|security)/.test(normalize(value));
     const isEndUserTab = (tab, label = '') => {
         const clean = normalize(tab); const text = `${clean} ${normalize(label)}`;
-        if (clean === 'tab-intro' || clean === 'tab-enums' || isCustomerBackupTab(clean)) return true;
+        if (clean === 'tab-intro' || clean === 'tab-enums' || clean === 'tab-objects' || isCustomerBackupTab(clean)) return true;
         if (/^tab-(nexowatt-ui|nexowatt-cockpit|eos-cockpit|eos-dashboard|kunden-cockpit|endkunden-cockpit|lovelace|jarvis|vis|iqontrol|material)(?:-|$)/.test(clean)) return true;
         return !!clean && !endUserDeniedByText(text) && endUserAllowedByText(text);
     };
@@ -58,14 +58,14 @@
         const clean = normalize(tab); const text = `${clean} ${normalize(label)}`;
         if (isOfficialReserveTab(clean)) return true;
         if (isCustomerBackupTab(clean)) return false;
-        return /(?:tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|system-hosts|system hosts|hosts|dateien|files|konsole|console|terminal|xterm|systemschutz|security)/.test(text);
+        return /(?:tab-users|tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|users|benutzer|gruppen|groups|system-hosts|system hosts|hosts|dateien|files|konsole|console|terminal|xterm|systemschutz|security)/.test(text);
     };
     const isRouteAllowed = (role, route, label = '') => {
         if (route === 'easy') return false;
         if (role === 'admin') return true;
         if (isOfficialReserveTab(route)) return false;
-        if (role === 'installer') return route === 'tab-intro' || route === 'tab-users' || !isInstallerDenied(route, label);
-        if (role === 'enduser') return route === 'tab-users' || isEndUserTab(route, label);
+        if (role === 'installer') return route === 'tab-intro' || (route !== 'tab-users' && !isInstallerDenied(route, label));
+        if (role === 'enduser') return isEndUserTab(route, label);
         return false;
     };
     const defaultTab = () => 'tab-intro';
@@ -133,7 +133,7 @@
         return normalize(`${button?.getAttribute?.('aria-label') || ''} ${button?.getAttribute?.('title') || ''} ${testIds}`);
     };
     const isSystemSettingsButton = button => /buildicon|system settings|systemeinstellungen|systeeminstellingen/.test(toolbarButtonSignature(button));
-    const isExpertModeButton = button => /expert|experten/.test(toolbarButtonSignature(button));
+    const isExpertModeButton = button => button?.dataset?.eosExpertControl === '1' || /expert|experten/.test(toolbarButtonSignature(button));
     const markAdminOnlyToolbarControls = () => safe(() => {
         const toolbar = document.querySelector('.eos-top-toolbar,.MuiAppBar-root .MuiToolbar-root');
         if (!toolbar) return;
@@ -226,7 +226,6 @@
                 ['Datenpunkte', 'Messwerte prüfen und freigegebene Werte schreiben', 'tab-objects', 'datapoints'],
                 ['Struktur', 'Räume und Funktionen für Smart Home zuordnen', 'tab-enums', 'structure'],
                 ['Geräte', 'Geräteintegration und Inbetriebnahme öffnen', 'tab-devicemanager', 'devices'],
-                ['Zugänge & Rechte', 'Passwörter im nativen Benutzereditor verwalten', 'tab-users', 'rights'],
                 ['Basis-Einstellungen', 'Standort, Sprache und Anlagenparameter', 'basic-settings', 'settings'],
                 ...(backupTab ? [['NexoWatt Sicherung', 'Sicherung und Wiederherstellung des EOS-Systems', backupTab, 'backup']] : []),
                 ['EOS Cockpit', 'Energie-, Lade- und Gebäudesteuerung öffnen', uiTab, 'eos'],
@@ -234,6 +233,7 @@
         }
         return [
             ['EOS Cockpit', 'Energie, Laden und Gebäude bedienen', uiTab, 'eos'],
+            ['Datenpunkte', 'Messwerte und Zustände ausschließlich lesen', 'tab-objects', 'datapoints'],
             ['Smart Home', 'Räume, Funktionen und freigegebene Geräte zuordnen', 'tab-enums', 'structure'],
             ...(backupTab ? [['NexoWatt Sicherung', 'Eigene Sicherungen ausführen und wiederherstellen', backupTab, 'backup']] : []),
         ];
@@ -320,7 +320,7 @@
             'tr', '.MuiTableRow-root', '.MuiAccordion-root', '.MuiCard-root', '.MuiListItem-root',
             '[role="row"]', '[data-instance-row]', '[data-testid="adapter-card"]', '[data-testid="instance-card"]',
         ].join(',');
-        const reserveId = /^(?:system\.adapter\.)?(?:admin|backitup)\.\d+$/i;
+        const reserveId = /^(?:system\.adapter\.)?(?:admin|backitup|xterm)\.\d+$/i;
         const normalizeInstance = value => String(value || '').trim().replace(/^system\.adapter\./i, '');
         const identityValues = node => {
             if (!node) return [];
@@ -337,7 +337,7 @@
                 .replace(/nexowatt-backup\.\d+/gi, '')
                 .replace(/eos-backup\.\d+/gi, '')
                 .replace(/system\.adapter\.(?:eos-admin|nexowatt-backup|eos-backup)\.\d+/gi, '');
-            return /(?:^|[\s|,;])(?:system\.adapter\.)?(?:admin|backitup)\.\d+(?=$|[\s|,;])/i.test(text.trim());
+            return /(?:^|[\s|,;])(?:system\.adapter\.)?(?:admin|backitup|xterm)\.\d+(?=$|[\s|,;])/i.test(text.trim());
         };
         const rowIsReserve = row => identityValues(row).some(value => reserveId.test(value)) || rowTextContainsReserve(row);
         const setHidden = (row, hidden) => {
@@ -363,12 +363,12 @@
 
         paper.querySelectorAll(rowSelector).forEach(row => setHidden(row, rowIsReserve(row)));
         paper.querySelectorAll([
-            '[data-id^="system.adapter.admin"]','[data-id^="system.adapter.backitup"]',
-            '[data-instance^="admin."]','[data-instance^="backitup."]',
-            '[data-instance-id^="admin."]','[data-instance-id^="backitup."]',
-            '[data-name="admin"]','[data-name="backitup"]',
-            'a[href*="#tab-admin"]','a[href*="#tab-backitup"]',
-            'a[href*="system.adapter.admin"]','a[href*="system.adapter.backitup"]',
+            '[data-id^="system.adapter.admin"]','[data-id^="system.adapter.backitup"]','[data-id^="system.adapter.xterm"]',
+            '[data-instance^="admin."]','[data-instance^="backitup."]','[data-instance^="xterm."]',
+            '[data-instance-id^="admin."]','[data-instance-id^="backitup."]','[data-instance-id^="xterm."]',
+            '[data-name="admin"]','[data-name="backitup"]','[data-name="xterm"]',
+            'a[href*="#tab-admin"]','a[href*="#tab-backitup"]','a[href*="#tab-xterm"]',
+            'a[href*="system.adapter.admin"]','a[href*="system.adapter.backitup"]','a[href*="system.adapter.xterm"]',
         ].join(',')).forEach(node => setHidden(rowFor(node) || node, true));
 
         // Admin 7 table cells may have no metadata. Match only an exact visible instance ID and
@@ -429,6 +429,111 @@
         }
     });
 
+
+    const privilegedFrameObservers = new WeakMap();
+    const privilegedActionPattern = /^(?:ems apps?(?: offnen| öffnen)?|app center|app-center|appcenter|simulation|simulator|lizenz|license)$/;
+    const isPrivilegedAction = element => {
+        const signature = normalize(textOf(element));
+        const href = normalize(element?.getAttribute?.('href') || element?.href || element?.getAttribute?.('data-href') || '');
+        return privilegedActionPattern.test(signature)
+            || /(?:^|[\/#?&_.-])(?:appcenter|app-center|simulation|simulator|license|lizenz)(?:$|[\/#?&=_.-])/.test(href);
+    };
+    const setPrivilegedActionHidden = (element, hidden) => {
+        if (!element) return;
+        const target = element.closest?.('a,button,[role="button"],[role="tab"],.MuiButtonBase-root') || element;
+        if (hidden) {
+            target.dataset.eosPrivilegedActionHidden = '1';
+            target.classList.add('eos-role-hidden');
+            target.setAttribute('aria-hidden', 'true');
+            if ('disabled' in target) target.disabled = true;
+        } else if (target.dataset.eosPrivilegedActionHidden === '1') {
+            delete target.dataset.eosPrivilegedActionHidden;
+            target.classList.remove('eos-role-hidden');
+            target.removeAttribute('aria-hidden');
+            if ('disabled' in target) target.disabled = false;
+        }
+    };
+    const applyPrivilegedActionsInDocument = doc => safe(() => {
+        if (!doc?.documentElement) return;
+        const admin = state.role === 'admin';
+        doc.querySelectorAll('[data-eos-privileged-action-hidden="1"]').forEach(element => {
+            if (admin || !isPrivilegedAction(element)) setPrivilegedActionHidden(element, false);
+        });
+        for (const element of doc.querySelectorAll('a,button,[role="button"],[role="tab"],.MuiButtonBase-root')) {
+            if (isPrivilegedAction(element)) setPrivilegedActionHidden(element, !admin);
+        }
+        if (!doc.documentElement.dataset.eosPrivilegedClickGuard) {
+            doc.documentElement.dataset.eosPrivilegedClickGuard = '1';
+            doc.addEventListener('click', event => {
+                if (state.role === 'admin' || state.role === 'unknown') return;
+                const target = event.target?.closest?.('a,button,[role="button"],[role="tab"],.MuiButtonBase-root');
+                if (!target || !isPrivilegedAction(target)) return;
+                event.preventDefault();
+                event.stopImmediatePropagation();
+            }, true);
+        }
+        if (!privilegedFrameObservers.has(doc)) {
+            const observer = new MutationObserver(() => {
+                window.setTimeout(() => applyPrivilegedActionsInDocument(doc), 0);
+            });
+            observer.observe(doc.documentElement, { childList: true, subtree: true });
+            privilegedFrameObservers.set(doc, observer);
+        }
+    });
+    const applyPrivilegedIframePolicy = () => safe(() => {
+        applyPrivilegedActionsInDocument(document);
+        document.querySelectorAll('iframe').forEach(frame => {
+            const applyFrame = () => safe(() => applyPrivilegedActionsInDocument(frame.contentDocument));
+            if (frame.dataset.eosRoleFrameGuard !== '1') {
+                frame.dataset.eosRoleFrameGuard = '1';
+                frame.addEventListener('load', applyFrame);
+            }
+            applyFrame();
+        });
+    });
+    const scrubInheritedUiAdminSession = () => safe(() => {
+        if (state.role === 'admin' || state.role === 'unknown') return;
+        const user = String(state.policy?.user || state.policy?.userId || '').replace(/^system\.user\./, '') || state.role;
+        const key = `eosUiAdminSessionScrubbed:v7105:${user}:${state.role}`;
+        if (sessionStorage.getItem(key) === '1') return;
+        sessionStorage.setItem(key, '1');
+        const frame = document.createElement('iframe');
+        frame.hidden = true;
+        frame.tabIndex = -1;
+        frame.setAttribute('aria-hidden', 'true');
+        frame.src = `${window.location.protocol}//${window.location.hostname}:8188/logout?source=eos-admin&role=${encodeURIComponent(state.role)}&t=${Date.now()}`;
+        frame.addEventListener('load', () => window.setTimeout(() => frame.remove(), 1200), { once: true });
+        document.body?.appendChild(frame);
+        window.setTimeout(() => frame.remove(), 7000);
+    });
+    const applyEndUserDatapointPolicy = () => safe(() => {
+        const paper = appPaper();
+        if (!paper) return;
+        const readonly = state.role === 'enduser' && currentRoute() === 'tab-objects';
+        paper.toggleAttribute('data-eos-datapoints-readonly', readonly);
+        if (!readonly) return;
+        paper.querySelectorAll('[data-eos-object-writable="1"],button[title*="edit" i],button[title*="delete" i],button[aria-label*="edit" i],button[aria-label*="delete" i]').forEach(control => {
+            control.setAttribute('aria-disabled', 'true');
+            control.setAttribute('data-eos-enduser-write-blocked', '1');
+        });
+    });
+    const clearLegacyHeuristicRestrictionsForAdmin = () => safe(() => {
+        if (state.role !== 'admin') return;
+        document.querySelectorAll('[data-eos-role-hidden]').forEach(element => {
+            element.removeAttribute('data-eos-role-hidden');
+            element.removeAttribute('aria-hidden');
+            element.style.removeProperty('display');
+        });
+        document.querySelectorAll('[data-eos-readonly],[data-eos-enduser-write-blocked]').forEach(element => {
+            element.removeAttribute('data-eos-readonly');
+            element.removeAttribute('data-eos-enduser-write-blocked');
+            element.removeAttribute('aria-disabled');
+            element.style.removeProperty('pointer-events');
+            element.style.removeProperty('opacity');
+            if ('disabled' in element) element.disabled = false;
+        });
+    });
+
     const apply = () => {
         if (!state.policy || state.role === 'unknown') return;
         setRoleClasses(state.role);
@@ -436,10 +541,14 @@
         applyMenuPolicy();
         markAdminOnlyToolbarControls();
         applySensitiveDialogPolicy();
+        clearLegacyHeuristicRestrictionsForAdmin();
         redirectIfNeeded();
         ensureSafeOverview();
         filterNativeUsersPage();
         hideOfficialReserveSurfaces();
+        applyEndUserDatapointPolicy();
+        applyPrivilegedIframePolicy();
+        scrubInheritedUiAdminSession();
         ensureReserveObserver();
         suppressPermissionErrors();
         window.NEXOWATT_EOS_ACCOUNT_MANAGEMENT?.refreshEntry?.();
@@ -491,6 +600,10 @@
             if (state.role === 'installer') window.NEXOWATT_EOS_BASIC_SETTINGS?.open?.();
             return;
         }
+        if (state.role === 'enduser' && currentRoute() === 'tab-objects') {
+            const writeTarget = event.target?.closest?.('[data-eos-object-writable="1"],[data-eos-enduser-write-blocked="1"],button[title*="edit" i],button[title*="delete" i],button[aria-label*="edit" i],button[aria-label*="delete" i]');
+            if (writeTarget) { event.preventDefault(); event.stopImmediatePropagation(); return; }
+        }
         const target = event.target?.closest?.('[data-eos-admin-only-control="1"],[data-eos-system-settings-control="1"],[data-eos-role-tab],a[href*="#tab-"],a[href*="#/tab-"]');
         if (!target) return;
         if (target.matches('[data-eos-admin-only-control="1"]')) { event.preventDefault(); event.stopImmediatePropagation(); return; }

package/adminWww/js/nexowatt-native-shell.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7101-nexowatt-native-shell-native-overview';
+    const VERSION = 'v7105-nexowatt-native-shell-native-overview';
     const previous = window.NEXOWATT_NATIVE_SHELL;
     if (previous?.version === VERSION) return;
     previous?.destroy?.();

package/adminWww/static/js/{nexowatt-stable-v7101.js → nexowatt-stable-v7105.js}

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v7101-scroll-standard-password';
+    const VERSION = 'v7105-scroll-standard-password';
     const ensureScroll = () => {
         const root = document.documentElement;
         const paper = document.getElementById('app-paper');

package/build/main.js

@@ -1,4 +1,5 @@
 "use strict";
+
 /**
  *      Admin backend
  *
@@ -1267,14 +1268,9 @@ class Admin extends adapter_core_1.Adapter {
                 return deny(socketClient, command, callback, 'technical diagnostics are installer/service-only');
             }
             if (command === 'changePassword') {
-                const targetRaw = String(args[0] || '').trim();
-                const targetUser = targetRaw.startsWith('system.user.') ? targetRaw : `system.user.${targetRaw}`;
-                const selfUser = String(userId || '');
-                const allowed = role === 'installer'
-                    ? new Set([selfUser, 'system.user.installer', 'system.user.user', 'system.user.guest']).has(targetUser)
-                    : targetUser === selfUser;
-                if (!allowed) return deny(socketClient, command, callback, 'password target outside EOS role scope');
-                return true;
+                // Initial password activation has a separate, tightly scoped backend endpoint.
+                // The normal Admin socket password editor remains Service/Admin-only.
+                return deny(socketClient, command, callback, 'password administration is Service-only');
             }
             if (['addUser', 'delUser', 'addGroup', 'delGroup'].includes(command)) {
                 return deny(socketClient, command, callback, 'account administration is Service-only');
@@ -1295,9 +1291,16 @@ class Admin extends adapter_core_1.Adapter {
                     return deny(socketClient, command, callback, 'end users may only maintain Smart Home assignments');
                 }
             }
-            if (['setState', 'delState', 'createState'].includes(command)
-                && /^(?:admin|backitup)\.\d+(?:\.|$)/.test(objectId)) {
-                return deny(socketClient, command, callback, 'internal Service reserve is Admin/Service-only');
+            if (['setState', 'delState', 'createState'].includes(command)) {
+                if (role === 'enduser') {
+                    return deny(socketClient, command, callback, 'end-user datapoints are read-only in EOS Admin');
+                }
+                if (objectId === `${this.namespace}.info.uiTabsVisible`) {
+                    return deny(socketClient, command, callback, 'navigation layout is Service-only');
+                }
+                if (/^(?:admin|backitup|xterm)\.\d+(?:\.|$)/.test(objectId)) {
+                    return deny(socketClient, command, callback, 'internal Service reserve is Admin/Service-only');
+                }
             }
             return original(socketClient, command, callback, ...args);
         };

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.10.3",
+    "version": "7.10.5",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,10 +18,15 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
-      "7.10.3": {
-        "de": "Stable 7.10.3 verschiebt die Einstellung für automatische NexoWatt-Adapter-Updates vollständig in die Systemeinstellungen hinter dem Schraubenschlüssel. Auf Übersicht, Module und allen anderen Hauptseiten wird die Update-Karte nicht mehr eingeblendet. Die stabile Update-Logik und die Absturzkorrekturen aus 7.10.2 bleiben unverändert.",
-        "en": "Stable 7.10.3 moves the automatic NexoWatt adapter update control entirely into System Settings behind the wrench button. The update card is no longer shown on Overview, Modules or any other main page. Stable update behavior and the 7.10.2 crash fixes remain unchanged.",
-        "nl": "Stable 7.10.3 verplaatst de instelling voor automatische NexoWatt-adapterupdates volledig naar de systeeminstellingen achter de moersleutelknop. De updatekaart wordt niet meer weergegeven op Overzicht, Modules of andere hoofdpagina’s. De stabiele updatelogica en crashfixes uit 7.10.2 blijven ongewijzigd."
+      "7.10.5": {
+        "de": "Stable 7.10.5 stellt die vollständigen Administratorrechte wieder her und trennt die Rollen verbindlich über den authentifizierten Backend-Kontext. Admin darf Datenpunkte schreiben, den Expertenmodus in beide Richtungen schalten und sieht Admin-/XTerm-Kacheln. Endkunden sehen Datenpunkte ausschließlich lesend; App-Center, Lizenz, Simulation, Benutzerverwaltung, ioBroker Admin, XTerm und Expertenmodus bleiben für Installateur und Endkunde gesperrt. Navigationsänderungen werden neustartsicher im Adapter-State gespeichert; Sicherung erscheint nur bei aktiver Backup-Instanz.",
+        "en": "Stable 7.10.5 restores full administrator authority and binds roles exclusively to the authenticated backend context. Admin can write datapoints, toggle expert mode in both directions and sees the Admin/XTerm cards. End users can view datapoints read-only; App Center, License, Simulation, account management, ioBroker Admin, XTerm and expert mode remain blocked for Installer and End User. Navigation changes are stored restart-safely in an adapter state, and Backup is shown only for an enabled backup instance.",
+        "nl": "Stable 7.10.5 herstelt de volledige beheerdersrechten en bepaalt rollen uitsluitend via de geauthenticeerde backendcontext. Admin kan datapunten schrijven, de expertmodus in beide richtingen schakelen en ziet de Admin-/XTerm-kaarten. Eindgebruikers kunnen datapunten alleen lezen; App Center, Licentie, Simulatie, accountbeheer, ioBroker Admin, XTerm en expertmodus blijven geblokkeerd voor Installateur en Eindgebruiker. Navigatiewijzigingen worden herstartveilig in een adapterstatus opgeslagen en Back-up verschijnt alleen bij een ingeschakelde back-upinstantie."
+      },
+      "7.10.4": {
+        "de": "Stable 7.10.4 verschiebt die Einstellung für automatische NexoWatt-Adapter-Updates vollständig in die Systemeinstellungen hinter dem Schraubenschlüssel. Auf Übersicht, Module und allen anderen Hauptseiten wird die Update-Karte nicht mehr eingeblendet. Die stabile Update-Logik und die Absturzkorrekturen aus 7.10.2 bleiben unverändert.",
+        "en": "Stable 7.10.4 moves the automatic NexoWatt adapter update control entirely into System Settings behind the wrench button. The update card is no longer shown on Overview, Modules or any other main page. Stable update behavior and the 7.10.2 crash fixes remain unchanged.",
+        "nl": "Stable 7.10.4 verplaatst de instelling voor automatische NexoWatt-adapterupdates volledig naar de systeeminstellingen achter de moersleutelknop. De updatekaart wordt niet meer weergegeven op Overzicht, Modules of andere hoofdpagina’s. De stabiele updatelogica en crashfixes uit 7.10.2 blijven ongewijzigd."
       },
       "7.10.2": {
         "de": "Stable-Hotfix 7.10.2 beseitigt die EOS-Admin-Startschleife: Stable-Update-Status wird nicht mehr in die laufende Instanzkonfiguration geschrieben, der erste Abgleich startet verzögert und das Release prüft die vollständige Backend-Modulkette einschließlich eosRequestSecurity.",
@@ -349,7 +354,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.3/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.5/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -360,7 +365,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.3/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.5/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -428,7 +433,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.3/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.5/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1001,6 +1006,23 @@
         "def": ""
       },
       "native": {}
+    },
+    {
+      "_id": "info.uiTabsVisible",
+      "type": "state",
+      "common": {
+        "name": {
+          "en": "EOS navigation layout",
+          "de": "EOS-Navigationslayout",
+          "nl": "EOS-navigatielay-out"
+        },
+        "role": "json",
+        "type": "string",
+        "read": true,
+        "write": true,
+        "def": "[]"
+      },
+      "native": {}
     }
   ],
   "schemas": {
@@ -1188,5 +1210,5 @@
       }
     }
   },
-  "version": "7.10.3"
+  "version": "7.10.5"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
   "description": "NexoWatt EOS Admin – repaired stable baseline with restart-safe automatic updates, native account passwords and persistent cockpit scrolling.",
-  "version": "7.10.3",
+  "version": "7.10.5",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -133,13 +133,15 @@
     "NEXOWATT_EOS_PREBUILT_MANIFEST.json",
     "tools/nexowatt-prebuilt-release-selftest.cjs",
     "tools/nexowatt-stable-v7103-selftest.cjs",
-    "README_STABILITY_V7.10.3.md",
-    "RELEASE_NOTES_V7.10.3.md",
-    "PUBLISH_STABLE_V7.10.3.md",
-    "INSTALL_TEST_V7.10.3.md",
-    "RELEASE_ACCEPTANCE_V7.10.3.md",
-    "MERGE_UPDATE_README_V7.10.3.md",
-    "tools/nexowatt-auto-update-placement-selftest.cjs"
+    "README_STABILITY_V7.10.5.md",
+    "RELEASE_NOTES_V7.10.5.md",
+    "PUBLISH_STABLE_V7.10.5.md",
+    "INSTALL_TEST_V7.10.5.md",
+    "RELEASE_ACCEPTANCE_V7.10.5.md",
+    "MERGE_UPDATE_README_V7.10.5.md",
+    "tools/nexowatt-auto-update-placement-selftest.cjs",
+    "tools/nexowatt-role-security-selftest.cjs",
+    "SECURITY_ROLE_MATRIX_V7.10.5.md"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -174,7 +176,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs && node tools/nexowatt-role-security-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -202,7 +204,8 @@
     "check:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs",
     "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write",
     "check:eos-stable-v7103": "node tools/nexowatt-stable-v7103-selftest.cjs",
-    "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs"
+    "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs",
+    "check:eos-role-security": "node tools/nexowatt-role-security-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -213,7 +216,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.3"
+    "purpose": "accepted stable NexoWatt EOS admin-rights and RBAC correction 7.10.5"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-account-password-flow-selftest.cjs

@@ -6,10 +6,10 @@ for(const code of [source,built]){
  must(code.includes("EOS_STABLE_INITIAL_PASSWORD = 'nexowatt'"),'initial password constant missing');
  must(code.includes("if (created || !String(object.common?.password || '').trim())")||code.includes("if (created || !String(object.common?.password || '').trim())"),'password is not limited to new/passwordless accounts');
  for(const marker of ['nexowattPasswordChangeRequired: false','eosPasswordChangeRequired: false','nexowattFirstLoginPending: false','eosFirstLoginRequired: false','forcePasswordChange: false','standardPasswordMode: true']) must(code.includes(marker),`legacy first-login flag is not cleared: ${marker}`);
- must(code.includes("command === 'changePassword'")&&code.includes('password target outside EOS role scope'),'native password command role guard missing');
+ must(code.includes("command === 'changePassword'")&&code.includes('password administration is Service-only'),'native password command role guard missing');
 }
 must(io.native.eosRequireFirstLoginPassword===false&&io.native.eosRequireFirstLoginPasswordChange===false,'forced first-password defaults remain');
 must(!boot.includes('installIntegratedFirstLogin(base);')&&!boot.includes('showFirstLoginPassword(resolved, base);'),'forced password surface remains active');
 must(!index.includes('eos-account-management.js'),'custom reset runtime remains active');
-must(role.includes('filterNativeUsersPage')&&role.includes("route === 'tab-users'"),'role-scoped native Users page missing');
-console.log('[NexoWatt EOS standard password flow] OK (nexowatt only on creation, native password editor, no forced reset flow)');
+must(role.includes("route !== 'tab-users'")&&role.includes('filterNativeUsersPage'),'native Users page is not blocked for Installer/End User');
+console.log('[NexoWatt EOS standard password flow] OK (initial password on creation, Admin-only native password editor, no forced reset flow)');

package/tools/nexowatt-clean-legacy-runtime.cjs

@@ -23,6 +23,12 @@ const LEGACY_OVERLAYS = [
   'src-admin/public/js/eos-runtime-fixes.js',
   'src-admin/public/js/eos-hard-logout.js',
   'src-admin/public/css/eos-branding.css',
+  // Removed 7.10.4 role-security overlays. These files must be deleted when
+  // a complete repository ZIP is accidentally extracted over an older tree;
+  // otherwise the sealed-release check correctly rejects them as stale input.
+  'adminWww/nexowatt-role-security.js',
+  'src-admin/nexowatt-role-security.js',
+  'build/lib/eosRoleSecurity.js',
 ];
 
 const readJson = file => JSON.parse(fs.readFileSync(file, 'utf8'));