iobroker.eos-admin 7.10.4 → 7.10.6

package/adminWww/css/nexowatt-native-shell.css

@@ -1184,12 +1184,23 @@ html.eos-login .eos-login-card-modern {
 /* Internal fallback services are never exposed outside Admin / Service. */
 html.eos-role-installer [data-instance^="admin."],
 html.eos-role-installer [data-instance^="backitup."],
+html.eos-role-installer [data-instance^="xterm."],
 html.eos-role-enduser [data-instance^="admin."],
 html.eos-role-enduser [data-instance^="backitup."],
+html.eos-role-enduser [data-instance^="xterm."],
 html.eos-role-installer [data-instance-id^="admin."],
 html.eos-role-installer [data-instance-id^="backitup."],
+html.eos-role-installer [data-instance-id^="xterm."],
 html.eos-role-enduser [data-instance-id^="admin."],
-html.eos-role-enduser [data-instance-id^="backitup."] { display: none !important; }
+html.eos-role-enduser [data-instance-id^="backitup."],
+html.eos-role-enduser [data-instance-id^="xterm."] { display: none !important; }
+
+html.eos-role-enduser #app-paper[data-eos-datapoints-readonly] [data-eos-object-writable="1"],
+html.eos-role-enduser #app-paper[data-eos-datapoints-readonly] [data-eos-enduser-write-blocked="1"] {
+    pointer-events: none !important;
+    cursor: default !important;
+    opacity: 0.62 !important;
+}
 
 
 

package/adminWww/index.html

@@ -8,7 +8,7 @@
         <meta http-equiv="Cache-Control" content="no-store, no-cache, must-revalidate" />
         <meta http-equiv="Pragma" content="no-cache" />
         <meta http-equiv="Expires" content="0" />
-          <script src="./js/eos-manual-write-policy.js?v=7101"></script>
+          <script src="./js/eos-manual-write-policy.js?v=7106"></script>
           <script type="module" src="./assets/hostInit-v84.js?v=84"></script>
         
         <meta charset="utf-8" />
@@ -36,8 +36,8 @@
             rel="stylesheet"
             href="css/leaflet.css"
         />
-        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7101" />
-        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7101" />
+        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7106" />
+        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7106" />
         <link rel="stylesheet" href="./css/eos-auto-update.css?v=7103" />
         <link
             rel="manifest"
@@ -160,23 +160,22 @@
         </script>
       <link rel="modulepreload" crossorigin href="./assets/preload-helper-BDBacUwf.js">
       <link rel="modulepreload" crossorigin href="./assets/iobroker_admin__mf_v__runtimeInit__mf_v__-g2X2zhAf.js">
-            <script defer src="./js/eos-role-bootstrap.js?v=7101" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
-            <script defer src="./js/eos-policy-client.js?v=7101"></script>
-            <script defer src="./js/eos-branding-sanitizer.js?v=7101"></script>
-            <script defer src="./js/nexowatt-native-shell.js?v=7101"></script>
-            <script defer src="./js/eos-native-security.js?v=7101"></script>
-            <script defer src="./js/eos-basic-settings.js?v=7101"></script>
-            <script defer src="./js/eos-role-ui.js?v=7101"></script>
-            <script defer src="./js/eos-ems-overview.js?v=7101"></script>
+            <script defer src="./js/eos-role-bootstrap.js?v=7106" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
+            <script defer src="./js/eos-policy-client.js?v=7106"></script>
+            <script defer src="./js/eos-branding-sanitizer.js?v=7106"></script>
+            <script defer src="./js/nexowatt-native-shell.js?v=7106"></script>
+            <script defer src="./js/eos-native-security.js?v=7106"></script>
+            <script defer src="./js/eos-basic-settings.js?v=7106"></script>
+            <script defer src="./js/eos-role-ui.js?v=7106"></script>
+            <script defer src="./js/eos-ems-overview.js?v=7106"></script>
             
             <script defer src="./js/eos-auto-update.js?v=7103"></script>
-            <script defer src="./js/eos-assistant.js?v=7101"></script>
+            <script defer src="./js/eos-assistant.js?v=7106"></script>
     </head>
     <body>
         <noscript>Für NexoWatt EOS muss JavaScript aktiviert sein.</noscript>
         <div id="root"></div>
-<script defer src="static/js/nexowatt-stable-login.js?v=7101"></script>
-<script defer src="static/js/nexowatt-stable-v7101.js?v=7101"></script>
-<script defer src="./nexowatt-role-security.js?v=7104"></script>
+<script defer src="static/js/nexowatt-stable-login.js?v=7106"></script>
+<script defer src="static/js/nexowatt-stable-v7106.js?v=7106"></script>
 </body>
 </html>

package/adminWww/js/eos-role-bootstrap.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7101-standard-password-native-overview';
+    const VERSION = 'v7106-admin-authoritative-rbac';
     const script = document.currentScript || document.querySelector('script[src*="eos-role-bootstrap.js"]');
     const entry = script?.dataset?.eosEntry || '';
     let launched = false;
@@ -16,7 +16,7 @@
 
     const roleFromPolicy = policy => {
         const raw = normalize(policy?.role || policy?.eosRole || policy?.accessRole || '');
-        if (policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
+        if (policy?.user === 'system.user.admin' || policy?.userId === 'system.user.admin' || policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
         if (/nexowatt service|eos service|service admin|service administrator/.test(raw)) return 'admin';
         if (policy?.isInstaller || /installateur|installer|installation|inbetriebnahme|techniker|technician|integrator|partner/.test(raw)) return 'installer';
         return 'enduser';
@@ -25,11 +25,11 @@
     const isCustomerBackupTab = tab => /^(?:tab-)?(?:nexowatt-backup|eos-backup|nexowatt-sicherung)(?:-|$)/.test(normalize(tab));
     const isReleasedEndUserTab = tab => /^(?:tab-)?(?:nexowatt-ui|nexowatt-cockpit|eos-cockpit|eos-dashboard|kunden-cockpit|endkunden-cockpit|lovelace|jarvis|vis|iqontrol|material)(?:-|$)/.test(normalize(tab));
     const isOfficialReserveTab = tab => /^(?:tab-)?(?:admin|backitup)(?:-\d+)?$/.test(normalize(tab));
-    const isInstallerDenied = tab => /(?:tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|hosts|files|console|terminal|security)/.test(normalize(tab)) || isOfficialReserveTab(tab);
+    const isInstallerDenied = tab => /(?:tab-users|tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|users|hosts|files|console|terminal|security)/.test(normalize(tab)) || isOfficialReserveTab(tab);
     const isAllowed = (role, route) => route !== 'easy' && (role === 'admin'
         || (role === 'installer'
-            ? route === 'tab-intro' || route === 'tab-users' || isCustomerBackupTab(route) || !isInstallerDenied(route)
-            : route === 'tab-intro' || route === 'tab-enums' || isCustomerBackupTab(route) || isReleasedEndUserTab(route)));
+            ? route === 'tab-intro' || isCustomerBackupTab(route) || !isInstallerDenied(route)
+            : route === 'tab-intro' || route === 'tab-enums' || route === 'tab-objects' || isCustomerBackupTab(route) || isReleasedEndUserTab(route)));
     const defaultTab = () => 'tab-intro';
     const currentRoute = () => {
         const hash = decodeURIComponent(window.location.hash || '').toLowerCase();

package/adminWww/js/eos-role-ui.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7101-native-overview-standard-users';
+    const VERSION = 'v7106-admin-authoritative-rbac';
     window.NEXOWATT_EOS_ROLE_UI_VERSION = VERSION;
 
     const state = {
@@ -15,10 +15,13 @@
         reserveObserver: null,
         reservePaper: null,
         reserveScheduled: false,
+        readonlySystemInfo: null,
+        readonlySystemInfoPromise: null,
     };
     const abort = new AbortController();
 
     const safe = fn => { try { return fn(); } catch (_) { return undefined; } };
+    const escapeHtml = value => String(value ?? '').replace(/[&<>"']/g, match => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[match] || match));
     const normalize = value => String(value || '')
         .toLowerCase().normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/ß/g, 'ss')
         .replace(/[^a-z0-9#/_:.-]+/g, ' ').trim();
@@ -37,7 +40,7 @@
 
     const roleFromPolicy = policy => {
         const raw = normalize(policy?.role || policy?.eosRole || policy?.accessRole || '');
-        if (policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
+        if (policy?.user === 'system.user.admin' || policy?.userId === 'system.user.admin' || policy?.isAdmin || policy?.isEosAdminGroup || policy?.isAdministrator || /^(?:admin|administrator)$/.test(raw)) return 'admin';
         if (/nexowatt service|eos service|service admin|service administrator/.test(raw)) return 'admin';
         if (policy?.isInstaller || /installateur|installer|installation|inbetriebnahme|techniker|technician|integrator|partner/.test(raw)) return 'installer';
         return 'enduser';
@@ -47,10 +50,10 @@
     const isOfficialReserveTab = tab => isOfficialAdminTab(tab) || isOfficialBackupTab(tab);
     const isCustomerBackupTab = tab => /^tab-(?:nexowatt-backup|eos-backup|nexowatt-sicherung)(?:-\d+)?$/.test(normalize(tab));
     const endUserAllowedByText = value => /(eos cockpit|nexowatt ui|nexowatt cockpit|kunden cockpit|kundenbereich|endkundenbereich|visualisierung|visualisation|visu|dashboard|energie cockpit|energy cockpit|bedienung|smart home|smart-home|lovelace|jarvis|iqontrol|material)/.test(normalize(value));
-    const endUserDeniedByText = value => /(module|dienste|datenpunkte|objekte|systemlogs|logs|zugange|rechte|benutzer|users|gruppen|groups|system hosts|system-hosts|hosts|dateien|files|konsole|console|terminal|xterm|adapter|instances?|instanzen|geraetesuche|discovery|systemschutz|security)/.test(normalize(value));
+    const endUserDeniedByText = value => /(module|dienste|systemlogs|logs|zugange|rechte|benutzer|users|gruppen|groups|system hosts|system-hosts|hosts|dateien|files|konsole|console|terminal|xterm|adapter|instances?|instanzen|geraetesuche|discovery|systemschutz|security)/.test(normalize(value));
     const isEndUserTab = (tab, label = '') => {
         const clean = normalize(tab); const text = `${clean} ${normalize(label)}`;
-        if (clean === 'tab-intro' || clean === 'tab-enums' || isCustomerBackupTab(clean)) return true;
+        if (clean === 'tab-intro' || clean === 'tab-enums' || clean === 'tab-objects' || isCustomerBackupTab(clean)) return true;
         if (/^tab-(nexowatt-ui|nexowatt-cockpit|eos-cockpit|eos-dashboard|kunden-cockpit|endkunden-cockpit|lovelace|jarvis|vis|iqontrol|material)(?:-|$)/.test(clean)) return true;
         return !!clean && !endUserDeniedByText(text) && endUserAllowedByText(text);
     };
@@ -58,14 +61,14 @@
         const clean = normalize(tab); const text = `${clean} ${normalize(label)}`;
         if (isOfficialReserveTab(clean)) return true;
         if (isCustomerBackupTab(clean)) return false;
-        return /(?:tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|system-hosts|system hosts|hosts|dateien|files|konsole|console|terminal|xterm|systemschutz|security)/.test(text);
+        return /(?:tab-users|tab-hosts|tab-files|tab-xterm|tab-xtrem|tab-system|users|benutzer|gruppen|groups|system-hosts|system hosts|hosts|dateien|files|konsole|console|terminal|xterm|systemschutz|security)/.test(text);
     };
     const isRouteAllowed = (role, route, label = '') => {
         if (route === 'easy') return false;
         if (role === 'admin') return true;
         if (isOfficialReserveTab(route)) return false;
-        if (role === 'installer') return route === 'tab-intro' || route === 'tab-users' || !isInstallerDenied(route, label);
-        if (role === 'enduser') return route === 'tab-users' || isEndUserTab(route, label);
+        if (role === 'installer') return route === 'tab-intro' || (route !== 'tab-users' && !isInstallerDenied(route, label));
+        if (role === 'enduser') return isEndUserTab(route, label);
         return false;
     };
     const defaultTab = () => 'tab-intro';
@@ -133,7 +136,7 @@
         return normalize(`${button?.getAttribute?.('aria-label') || ''} ${button?.getAttribute?.('title') || ''} ${testIds}`);
     };
     const isSystemSettingsButton = button => /buildicon|system settings|systemeinstellungen|systeeminstellingen/.test(toolbarButtonSignature(button));
-    const isExpertModeButton = button => /expert|experten/.test(toolbarButtonSignature(button));
+    const isExpertModeButton = button => button?.dataset?.eosExpertControl === '1' || /expert|experten/.test(toolbarButtonSignature(button));
     const markAdminOnlyToolbarControls = () => safe(() => {
         const toolbar = document.querySelector('.eos-top-toolbar,.MuiAppBar-root .MuiToolbar-root');
         if (!toolbar) return;
@@ -226,7 +229,6 @@
                 ['Datenpunkte', 'Messwerte prüfen und freigegebene Werte schreiben', 'tab-objects', 'datapoints'],
                 ['Struktur', 'Räume und Funktionen für Smart Home zuordnen', 'tab-enums', 'structure'],
                 ['Geräte', 'Geräteintegration und Inbetriebnahme öffnen', 'tab-devicemanager', 'devices'],
-                ['Zugänge & Rechte', 'Passwörter im nativen Benutzereditor verwalten', 'tab-users', 'rights'],
                 ['Basis-Einstellungen', 'Standort, Sprache und Anlagenparameter', 'basic-settings', 'settings'],
                 ...(backupTab ? [['NexoWatt Sicherung', 'Sicherung und Wiederherstellung des EOS-Systems', backupTab, 'backup']] : []),
                 ['EOS Cockpit', 'Energie-, Lade- und Gebäudesteuerung öffnen', uiTab, 'eos'],
@@ -234,6 +236,7 @@
         }
         return [
             ['EOS Cockpit', 'Energie, Laden und Gebäude bedienen', uiTab, 'eos'],
+            ['Datenpunkte', 'Messwerte und Zustände ausschließlich lesen', 'tab-objects', 'datapoints'],
             ['Smart Home', 'Räume, Funktionen und freigegebene Geräte zuordnen', 'tab-enums', 'structure'],
             ...(backupTab ? [['NexoWatt Sicherung', 'Eigene Sicherungen ausführen und wiederherstellen', backupTab, 'backup']] : []),
         ];
@@ -268,6 +271,55 @@
             role.setAttribute('data-nexowatt-overview-role', state.role);
         }
     };
+
+    const fetchReadonlySystemInfo = () => {
+        if (state.readonlySystemInfo) return Promise.resolve(state.readonlySystemInfo);
+        if (state.readonlySystemInfoPromise) return state.readonlySystemInfoPromise;
+        state.readonlySystemInfoPromise = fetch('/nexowatt/readonly/system-info', {
+            credentials: 'same-origin',
+            cache: 'no-store',
+            headers: { Accept: 'application/json' },
+        })
+            .then(response => (response.ok ? response.json() : null))
+            .then(data => {
+                state.readonlySystemInfo = data && typeof data === 'object' ? data : null;
+                return state.readonlySystemInfo;
+            })
+            .catch(() => null)
+            .finally(() => {
+                state.readonlySystemInfoPromise = null;
+                scheduleApply();
+            });
+        return state.readonlySystemInfoPromise;
+    };
+    const applyReadonlySystemInfoCard = () => safe(() => {
+        if (state.role !== 'enduser' || currentRoute() !== 'tab-intro') return;
+        const paper = appPaper();
+        if (!paper) return;
+        const title = Array.from(paper.querySelectorAll('h1,h2,h3,h4,h5,h6')).find(node => normalize(node.textContent || '') === 'nexowatt');
+        const card = title?.closest?.('.MuiCard-root');
+        if (!card || !/platform|ram|node\.js|npm/i.test(String(card.textContent || ''))) return;
+        Array.from(card.querySelectorAll('button')).forEach(button => {
+            if (/info/i.test(textOf(button))) {
+                button.classList.add('eos-role-hidden');
+                button.setAttribute('aria-hidden', 'true');
+                button.disabled = true;
+            }
+        });
+        if (!state.readonlySystemInfo && !state.readonlySystemInfoPromise) {
+            void fetchReadonlySystemInfo();
+            return;
+        }
+        const data = state.readonlySystemInfo;
+        const list = card.querySelector('ul');
+        if (!data || !list) return;
+        list.innerHTML = `
+            <li><span><span style="font-weight:600">Platform: </span>${escapeHtml(data.platform || '--')}</span></li>
+            <li><span><span style="font-weight:600">RAM: </span>${escapeHtml(Number.isFinite(Number(data.ramMb)) ? `${Math.round(Number(data.ramMb))} MB` : '--')}</span></li>
+            <li><span><span style="font-weight:600">Node.js: </span>${escapeHtml(data.nodejs || '--')}</span></li>
+            <li><span><span style="font-weight:600">NPM: </span>${escapeHtml(data.npm || '--')}</span></li>`;
+    });
+
     const hideIntroEditControls = () => {
         const paper = appPaper();
         if (!paper) return;
@@ -320,7 +372,7 @@
             'tr', '.MuiTableRow-root', '.MuiAccordion-root', '.MuiCard-root', '.MuiListItem-root',
             '[role="row"]', '[data-instance-row]', '[data-testid="adapter-card"]', '[data-testid="instance-card"]',
         ].join(',');
-        const reserveId = /^(?:system\.adapter\.)?(?:admin|backitup)\.\d+$/i;
+        const reserveId = /^(?:system\.adapter\.)?(?:admin|backitup|xterm)\.\d+$/i;
         const normalizeInstance = value => String(value || '').trim().replace(/^system\.adapter\./i, '');
         const identityValues = node => {
             if (!node) return [];
@@ -337,7 +389,7 @@
                 .replace(/nexowatt-backup\.\d+/gi, '')
                 .replace(/eos-backup\.\d+/gi, '')
                 .replace(/system\.adapter\.(?:eos-admin|nexowatt-backup|eos-backup)\.\d+/gi, '');
-            return /(?:^|[\s|,;])(?:system\.adapter\.)?(?:admin|backitup)\.\d+(?=$|[\s|,;])/i.test(text.trim());
+            return /(?:^|[\s|,;])(?:system\.adapter\.)?(?:admin|backitup|xterm)\.\d+(?=$|[\s|,;])/i.test(text.trim());
         };
         const rowIsReserve = row => identityValues(row).some(value => reserveId.test(value)) || rowTextContainsReserve(row);
         const setHidden = (row, hidden) => {
@@ -363,12 +415,12 @@
 
         paper.querySelectorAll(rowSelector).forEach(row => setHidden(row, rowIsReserve(row)));
         paper.querySelectorAll([
-            '[data-id^="system.adapter.admin"]','[data-id^="system.adapter.backitup"]',
-            '[data-instance^="admin."]','[data-instance^="backitup."]',
-            '[data-instance-id^="admin."]','[data-instance-id^="backitup."]',
-            '[data-name="admin"]','[data-name="backitup"]',
-            'a[href*="#tab-admin"]','a[href*="#tab-backitup"]',
-            'a[href*="system.adapter.admin"]','a[href*="system.adapter.backitup"]',
+            '[data-id^="system.adapter.admin"]','[data-id^="system.adapter.backitup"]','[data-id^="system.adapter.xterm"]',
+            '[data-instance^="admin."]','[data-instance^="backitup."]','[data-instance^="xterm."]',
+            '[data-instance-id^="admin."]','[data-instance-id^="backitup."]','[data-instance-id^="xterm."]',
+            '[data-name="admin"]','[data-name="backitup"]','[data-name="xterm"]',
+            'a[href*="#tab-admin"]','a[href*="#tab-backitup"]','a[href*="#tab-xterm"]',
+            'a[href*="system.adapter.admin"]','a[href*="system.adapter.backitup"]','a[href*="system.adapter.xterm"]',
         ].join(',')).forEach(node => setHidden(rowFor(node) || node, true));
 
         // Admin 7 table cells may have no metadata. Match only an exact visible instance ID and
@@ -429,6 +481,139 @@
         }
     });
 
+
+    const privilegedFrameObservers = new WeakMap();
+    const privilegedActionPattern = /^(?:ems apps?(?: offnen| öffnen)?|app center|app-center|appcenter|simulation|simulator|lizenz|license)$/;
+    const isPrivilegedAction = element => {
+        const signature = normalize(textOf(element));
+        const href = normalize(element?.getAttribute?.('href') || element?.href || element?.getAttribute?.('data-href') || '');
+        return privilegedActionPattern.test(signature)
+            || /(?:^|[\/#?&_.-])(?:appcenter|app-center|simulation|simulator|license|lizenz)(?:$|[\/#?&=_.-])/.test(href);
+    };
+    const setPrivilegedActionHidden = (element, hidden) => {
+        if (!element) return;
+        const target = element.closest?.('a,button,[role="button"],[role="tab"],.MuiButtonBase-root') || element;
+        if (hidden) {
+            target.dataset.eosPrivilegedActionHidden = '1';
+            target.classList.add('eos-role-hidden');
+            target.setAttribute('aria-hidden', 'true');
+            if ('disabled' in target) target.disabled = true;
+        } else if (target.dataset.eosPrivilegedActionHidden === '1') {
+            delete target.dataset.eosPrivilegedActionHidden;
+            target.classList.remove('eos-role-hidden');
+            target.removeAttribute('aria-hidden');
+            if ('disabled' in target) target.disabled = false;
+        }
+    };
+    const applyPrivilegedActionsInDocument = doc => safe(() => {
+        if (!doc?.documentElement) return;
+        const admin = state.role === 'admin';
+        doc.querySelectorAll('[data-eos-privileged-action-hidden="1"]').forEach(element => {
+            if (admin || !isPrivilegedAction(element)) setPrivilegedActionHidden(element, false);
+        });
+        for (const element of doc.querySelectorAll('a,button,[role="button"],[role="tab"],.MuiButtonBase-root')) {
+            if (isPrivilegedAction(element)) setPrivilegedActionHidden(element, !admin);
+        }
+        if (!doc.documentElement.dataset.eosPrivilegedClickGuard) {
+            doc.documentElement.dataset.eosPrivilegedClickGuard = '1';
+            doc.addEventListener('click', event => {
+                if (state.role === 'admin' || state.role === 'unknown') return;
+                const target = event.target?.closest?.('a,button,[role="button"],[role="tab"],.MuiButtonBase-root');
+                if (!target || !isPrivilegedAction(target)) return;
+                event.preventDefault();
+                event.stopImmediatePropagation();
+            }, true);
+        }
+        if (!privilegedFrameObservers.has(doc)) {
+            const observer = new MutationObserver(() => {
+                window.setTimeout(() => applyPrivilegedActionsInDocument(doc), 0);
+            });
+            observer.observe(doc.documentElement, { childList: true, subtree: true });
+            privilegedFrameObservers.set(doc, observer);
+        }
+    });
+    const applyPrivilegedIframePolicy = () => safe(() => {
+        applyPrivilegedActionsInDocument(document);
+        document.querySelectorAll('iframe').forEach(frame => {
+            const applyFrame = () => safe(() => applyPrivilegedActionsInDocument(frame.contentDocument));
+            if (frame.dataset.eosRoleFrameGuard !== '1') {
+                frame.dataset.eosRoleFrameGuard = '1';
+                frame.addEventListener('load', applyFrame);
+            }
+            applyFrame();
+        });
+    });
+    const scrubInheritedUiAdminSession = () => safe(() => {
+        if (state.role === 'admin' || state.role === 'unknown') return;
+        const user = String(state.policy?.user || state.policy?.userId || '').replace(/^system\.user\./, '') || state.role;
+        const key = `eosUiAdminSessionScrubbed:v7106:${user}:${state.role}`;
+        if (sessionStorage.getItem(key) === '1') return;
+        sessionStorage.setItem(key, '1');
+        const frame = document.createElement('iframe');
+        frame.hidden = true;
+        frame.tabIndex = -1;
+        frame.setAttribute('aria-hidden', 'true');
+        frame.src = `${window.location.protocol}//${window.location.hostname}:8188/logout?source=eos-admin&role=${encodeURIComponent(state.role)}&t=${Date.now()}`;
+        frame.addEventListener('load', () => window.setTimeout(() => frame.remove(), 1200), { once: true });
+        document.body?.appendChild(frame);
+        window.setTimeout(() => frame.remove(), 7000);
+    });
+    const applyEndUserDatapointPolicy = () => safe(() => {
+        const paper = appPaper();
+        if (!paper) return;
+        const readonly = state.role === 'enduser' && currentRoute() === 'tab-objects';
+        paper.toggleAttribute('data-eos-datapoints-readonly', readonly);
+        const clearControl = control => {
+            if (!control) return;
+            control.removeAttribute('aria-disabled');
+            control.removeAttribute('data-eos-enduser-write-blocked');
+            control.removeAttribute('data-eos-enduser-action-hidden');
+            control.classList.remove('eos-role-hidden');
+            control.removeAttribute('aria-hidden');
+            if ('disabled' in control) control.disabled = false;
+        };
+        paper.querySelectorAll('[data-eos-enduser-write-blocked="1"],[data-eos-enduser-action-hidden="1"]').forEach(clearControl);
+        if (!readonly) return;
+        const blockControl = control => {
+            if (!control) return;
+            control.setAttribute('aria-disabled', 'true');
+            control.setAttribute('data-eos-enduser-write-blocked', '1');
+        };
+        const hideControl = control => {
+            if (!control) return;
+            control.setAttribute('aria-disabled', 'true');
+            control.setAttribute('data-eos-enduser-action-hidden', '1');
+            control.classList.add('eos-role-hidden');
+            control.setAttribute('aria-hidden', 'true');
+            if ('disabled' in control) control.disabled = true;
+        };
+        paper.querySelectorAll('[data-eos-object-writable="1"]').forEach(blockControl);
+        paper.querySelectorAll([
+            'button[title*="edit" i]','button[title*="delete" i]','button[title*="remove" i]','button[title*="setting" i]','button[title*="einstell" i]',
+            'button[aria-label*="edit" i]','button[aria-label*="delete" i]','button[aria-label*="remove" i]','button[aria-label*="setting" i]','button[aria-label*="einstell" i]',
+            '[role="button"][title*="edit" i]','[role="button"][title*="delete" i]','[role="button"][title*="setting" i]',
+            '[role="button"][aria-label*="edit" i]','[role="button"][aria-label*="delete" i]','[role="button"][aria-label*="setting" i]'
+        ].join(',')).forEach(hideControl);
+        paper.querySelectorAll('svg[data-testid*="Edit"],svg[data-testid*="Delete"],svg[data-testid*="Settings"],svg[data-testid*="Tune"],svg[data-testid*="Build"]').forEach(icon => hideControl(icon.closest('button,[role="button"]')));
+    });
+    const clearLegacyHeuristicRestrictionsForAdmin = () => safe(() => {
+        if (state.role !== 'admin') return;
+        document.querySelectorAll('[data-eos-role-hidden]').forEach(element => {
+            element.removeAttribute('data-eos-role-hidden');
+            element.removeAttribute('aria-hidden');
+            element.style.removeProperty('display');
+        });
+        document.querySelectorAll('[data-eos-readonly],[data-eos-enduser-write-blocked],[data-eos-enduser-action-hidden]').forEach(element => {
+            element.removeAttribute('data-eos-readonly');
+            element.removeAttribute('data-eos-enduser-write-blocked');
+            element.removeAttribute('data-eos-enduser-action-hidden');
+            element.removeAttribute('aria-disabled');
+            element.style.removeProperty('pointer-events');
+            element.style.removeProperty('opacity');
+            if ('disabled' in element) element.disabled = false;
+        });
+    });
+
     const apply = () => {
         if (!state.policy || state.role === 'unknown') return;
         setRoleClasses(state.role);
@@ -436,10 +621,15 @@
         applyMenuPolicy();
         markAdminOnlyToolbarControls();
         applySensitiveDialogPolicy();
+        clearLegacyHeuristicRestrictionsForAdmin();
         redirectIfNeeded();
         ensureSafeOverview();
+        applyReadonlySystemInfoCard();
         filterNativeUsersPage();
         hideOfficialReserveSurfaces();
+        applyEndUserDatapointPolicy();
+        applyPrivilegedIframePolicy();
+        scrubInheritedUiAdminSession();
         ensureReserveObserver();
         suppressPermissionErrors();
         window.NEXOWATT_EOS_ACCOUNT_MANAGEMENT?.refreshEntry?.();
@@ -491,6 +681,10 @@
             if (state.role === 'installer') window.NEXOWATT_EOS_BASIC_SETTINGS?.open?.();
             return;
         }
+        if (state.role === 'enduser' && currentRoute() === 'tab-objects') {
+            const writeTarget = event.target?.closest?.('[data-eos-object-writable="1"],[data-eos-enduser-write-blocked="1"],button[title*="edit" i],button[title*="delete" i],button[aria-label*="edit" i],button[aria-label*="delete" i]');
+            if (writeTarget) { event.preventDefault(); event.stopImmediatePropagation(); return; }
+        }
         const target = event.target?.closest?.('[data-eos-admin-only-control="1"],[data-eos-system-settings-control="1"],[data-eos-role-tab],a[href*="#tab-"],a[href*="#/tab-"]');
         if (!target) return;
         if (target.matches('[data-eos-admin-only-control="1"]')) { event.preventDefault(); event.stopImmediatePropagation(); return; }

package/adminWww/js/nexowatt-native-shell.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7101-nexowatt-native-shell-native-overview';
+    const VERSION = 'v7106-nexowatt-native-shell-native-overview';
     const previous = window.NEXOWATT_NATIVE_SHELL;
     if (previous?.version === VERSION) return;
     previous?.destroy?.();

package/adminWww/static/js/{nexowatt-stable-v7101.js → nexowatt-stable-v7106.js}

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v7101-scroll-standard-password';
+    const VERSION = 'v7106-scroll-standard-password';
     const ensureScroll = () => {
         const root = document.documentElement;
         const paper = document.getElementById('app-paper');

package/build/lib/web.js

@@ -8,6 +8,7 @@ const node_util_1 = require("node:util");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_stream_1 = require("node:stream");
+const node_child_process_1 = require("node:child_process");
 const compression = require("compression");
 const mime_1 = require("mime");
 const node_zlib_1 = require("node:zlib");
@@ -1371,6 +1372,35 @@ class Web {
         this.adapter.log.info(`EOS installer basic settings updated by ${access.userId || 'unknown user'}`);
         await this.sendEosBasicSettings(req, res);
     }
+
+    getEosReadonlySystemInfo() {
+        let npm = '--';
+        try {
+            const binary = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+            npm = (0, node_child_process_1.execFileSync)(binary, ['-v'], { encoding: 'utf8', timeout: 1500 }).trim() || '--';
+        }
+        catch {
+            // ignore
+        }
+        return {
+            platform: process.platform || '--',
+            ramMb: Math.round((0, node_os_1.totalmem)() / 1024 / 1024),
+            nodejs: process.version || '--',
+            npm,
+            active: true,
+        };
+    }
+    async sendEosReadonlySystemInfo(req, res) {
+        const access = await this.getEosRequestAccess(req);
+        const authenticated = !this.settings.auth || !!access.userId;
+        if (!authenticated) {
+            res.status(401).json({ error: 'authenticationRequired' });
+            return;
+        }
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.status(200).json(this.getEosReadonlySystemInfo());
+    }
     async sendEosSecuritySession(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
@@ -1806,6 +1836,10 @@ class Web {
             this.server.app.get('/eos/security/status', sendSecuritySession);
             this.server.app.get('/nexowatt/security/session', sendSecuritySession);
             this.server.app.get('/nexowatt/security/context', sendSecuritySession);
+            this.server.app.get('/nexowatt/readonly/system-info', (req, res) => { void this.sendEosReadonlySystemInfo(req, res).catch(e => {
+                this.adapter.log.warn(`Cannot read EOS readonly system info: ${e instanceof Error ? e.message : e}`);
+                res.status(500).json({ error: 'readonlySystemInfoFailed' });
+            }); });
             this.server.app.get('/nexowatt/role-settings/basic', (req, res) => {
                 void this.sendEosBasicSettings(req, res).catch(e => {
                     this.adapter.log.warn(`Cannot read EOS basic settings: ${e instanceof Error ? e.message : e}`);

package/build/main.js

@@ -1,7 +1,5 @@
 "use strict";
 
-const eosRoleSecurity = require("./lib/eosRoleSecurity");
-eosRoleSecurity.installHttpGuard();
 /**
  *      Admin backend
  *
@@ -332,8 +330,6 @@ class Admin extends adapter_core_1.Adapter {
      * Is called when databases are connected and adapter received configuration.
      */
     onReady = async () => {
-        eosRoleSecurity.attachAdapter(this);
-        await eosRoleSecurity.enforceRoleAcls(this);
         const systemConfig = await this.getForeignObjectAsync('system.config');
         if (systemConfig) {
             systemConfig.native = systemConfig.native || {};
@@ -1272,14 +1268,9 @@ class Admin extends adapter_core_1.Adapter {
                 return deny(socketClient, command, callback, 'technical diagnostics are installer/service-only');
             }
             if (command === 'changePassword') {
-                const targetRaw = String(args[0] || '').trim();
-                const targetUser = targetRaw.startsWith('system.user.') ? targetRaw : `system.user.${targetRaw}`;
-                const selfUser = String(userId || '');
-                const allowed = role === 'installer'
-                    ? new Set([selfUser, 'system.user.installer', 'system.user.user', 'system.user.guest']).has(targetUser)
-                    : targetUser === selfUser;
-                if (!allowed) return deny(socketClient, command, callback, 'password target outside EOS role scope');
-                return true;
+                // Initial password activation has a separate, tightly scoped backend endpoint.
+                // The normal Admin socket password editor remains Service/Admin-only.
+                return deny(socketClient, command, callback, 'password administration is Service-only');
             }
             if (['addUser', 'delUser', 'addGroup', 'delGroup'].includes(command)) {
                 return deny(socketClient, command, callback, 'account administration is Service-only');
@@ -1300,9 +1291,16 @@ class Admin extends adapter_core_1.Adapter {
                     return deny(socketClient, command, callback, 'end users may only maintain Smart Home assignments');
                 }
             }
-            if (['setState', 'delState', 'createState'].includes(command)
-                && /^(?:admin|backitup)\.\d+(?:\.|$)/.test(objectId)) {
-                return deny(socketClient, command, callback, 'internal Service reserve is Admin/Service-only');
+            if (['setState', 'delState', 'createState'].includes(command)) {
+                if (role === 'enduser') {
+                    return deny(socketClient, command, callback, 'end-user datapoints are read-only in EOS Admin');
+                }
+                if (objectId === `${this.namespace}.info.uiTabsVisible`) {
+                    return deny(socketClient, command, callback, 'navigation layout is Service-only');
+                }
+                if (/^(?:admin|backitup|xterm)\.\d+(?:\.|$)/.test(objectId)) {
+                    return deny(socketClient, command, callback, 'internal Service reserve is Admin/Service-only');
+                }
             }
             return original(socketClient, command, callback, ...args);
         };