iobroker.eos-admin 7.10.6 → 7.10.8

package/tools/nexowatt-role-security-selftest.cjs

@@ -32,9 +32,9 @@ const cleanupSource = read('tools/nexowatt-clean-legacy-runtime.cjs');
 // visible header happened to contain "user". Only authenticated backend policy may define the role.
 for (const html of [index, sourceIndex]) {
     assert.doesNotMatch(html, /nexowatt-role-security\.js/i, 'legacy heuristic role guard is still loaded');
-    assert.match(html, /eos-role-bootstrap\.js\?v=7106/, 'authoritative role bootstrap cache tag is missing');
-    assert.match(html, /eos-policy-client\.js\?v=7106/, 'authoritative policy client cache tag is missing');
-    assert.match(html, /eos-role-ui\.js\?v=7106/, 'authoritative role UI cache tag is missing');
+    assert.match(html, /eos-role-bootstrap\.js\?v=7108/, 'authoritative role bootstrap cache tag is missing');
+    assert.match(html, /eos-policy-client\.js\?v=7108/, 'authoritative policy client cache tag is missing');
+    assert.match(html, /eos-role-ui\.js\?v=7108/, 'authoritative role UI cache tag is missing');
 }
 assert.equal(fs.existsSync(path.join(root, 'adminWww/nexowatt-role-security.js')), false, 'legacy runtime still exists');
 assert.equal(fs.existsSync(path.join(root, 'build/lib/eosRoleSecurity.js')), false, 'legacy backend heuristic still exists');
@@ -100,10 +100,23 @@ assert.match(introBundle, /_forceAdmin=_eosAdmin/);
 assert.doesNotMatch(introSource, /NEXOWATT_EOS_ACCESS_ROLE \|\| 'admin'/, 'Intro source must fail closed while role is unresolved');
 assert.doesNotMatch(introBundle, /NEXOWATT_EOS_ACCESS_ROLE\|\|"admin"/, 'Intro runtime must fail closed while role is unresolved');
 
-// App Center, License, Simulation and normal account administration are not available to Installer/End User.
+// Installer receives EMS App-Center access only. Simulation and License remain Admin-only;
+// End User remains blocked from all three actions and from inherited port-8188 sessions.
 for (const token of ['app center', 'app-center', 'appcenter', 'simulation', 'simulator', 'lizenz', 'license']) {
     assert.ok(roleUi.toLowerCase().includes(token), `role UI is missing protected action ${token}`);
 }
+for (const code of [roleUi, sourceRoleUi]) {
+    assert.match(code, /const privilegedActionKind = element =>/, 'privileged actions are not separated by capability');
+    assert.match(code, /if \(action === 'ems'\)/, 'EMS action branch is missing');
+    assert.match(code, /state\.role === 'installer' && state\.policy\?\.capabilities\?\.emsAppCenter !== false/, 'Installer EMS App-Center allowance is missing');
+    assert.match(code, /return state\.role === 'admin';/, 'Simulation and License must remain Admin-only');
+    assert.match(code, /if \(state\.role !== 'enduser'\) return;/, 'port 8188 session scrubbing must be End User-only');
+}
+for (const code of [webSource, webBuilt]) {
+    assert.match(code, /emsAppCenter: technical/, 'backend role capabilities do not grant Installer EMS access');
+    assert.match(code, /simulation: role === 'admin'/, 'Simulation capability must remain Admin-only');
+    assert.match(code, /licenseAdministration: role === 'admin'/, 'License capability must remain Admin-only');
+}
 assert.match(roleUi, /applyPrivilegedIframePolicy/);
 assert.match(roleUi, /:8188\/logout\?/);
 assert.match(roleUi, /route !== 'tab-users'/);
@@ -130,7 +143,7 @@ assert.ok((io.instanceObjects || []).some(object => object?._id === 'info.uiTabs
 assert.match(drawerSource, /backupAdapters\.has\(adapterName\) && instance\.enabled !== true/);
 assert.match(builtDrawer, /o\.has\(A\)&&d\.enabled!==!0/);
 
-// 7.10.6 End User cleanup: system information is read-only and object actions disappear only for End User.
+// 7.10.8 End User cleanup: system information is read-only and object actions disappear only for End User.
 for (const code of [webSource, webBuilt]) {
     assert.match(code, /nexowatt\/readonly\/system-info/, 'authenticated read-only system-info route is missing');
     assert.match(code, /authenticationRequired/, 'read-only system-info route must require an authenticated session');
@@ -146,4 +159,4 @@ for (const code of [roleUi, sourceRoleUi]) {
 }
 assert.match(sourceMain, /role === 'enduser' && \['readLogs', 'sendToHost'\]\.includes\(command\)/, 'End User technical diagnostics must remain denied');
 
-console.log('[NexoWatt EOS role security] OK (authoritative Admin rights, End User read-only datapoints, protected tools, restart-safe menu storage)');
+console.log('[NexoWatt EOS role security] OK (Admin full rights, Installer EMS App-Center access, End User read-only datapoints, protected Admin tools)');

package/tools/nexowatt-stable-v7103-selftest.cjs

@@ -31,7 +31,7 @@ const autoUi = read('adminWww/js/eos-auto-update.js');
 const autoCss = read('adminWww/css/eos-auto-update.css');
 const autoTag = String(info.autoUpdateCacheTag || info.autoUpdateCacheVersion || info.shellCacheTag || info.shellCacheVersion);
 
-must(pkg.version === '7.10.6' && io.version === '7.10.6' && io.common.version === '7.10.6' && info.version === '7.10.6', 'version drift');
+must(pkg.version === '7.10.8' && io.version === '7.10.8' && io.common.version === '7.10.8' && info.version === '7.10.8', 'version drift');
 must(io.native.eosRequireFirstLoginPassword === false && io.native.eosRequireFirstLoginPasswordChange === false, 'forced first password still enabled');
 must(!index.includes('eos-account-management.js'), 'custom reset UI still loaded');
 must(!boot.includes('installIntegratedFirstLogin(base);') && !boot.includes('showFirstLoginPassword(resolved, base);'), 'forced first-login UI still active');
@@ -49,7 +49,7 @@ must(!autoBackend.includes('extendForeignObjectAsync(this.instanceId'), 'runtime
 must(web.includes('this.nexowattStableUpdateManager?.stop();'), 'auto-update manager is not stopped with the web server');
 must(fs.existsSync(path.join(root, 'build/lib/eosRequestSecurity.js')), 'eosRequestSecurity runtime module missing');
 
-// 7.10.4 placement acceptance remains mandatory in 7.10.6: System Settings only.
+// 7.10.4 placement acceptance remains mandatory in 7.10.8: System Settings only.
 must(index.includes(`eos-auto-update.js?v=${autoTag}`), 'auto-update JavaScript cache key missing');
 must(index.includes(`eos-auto-update.css?v=${autoTag}`), 'auto-update CSS cache key missing');
 must(autoUi.includes('[role="dialog"][aria-labelledby="system-settings-dialog-title"]'), 'System Settings selector missing');

package/tools/nexowatt-user-area-selftest.cjs

@@ -13,7 +13,7 @@ const runtimeRole = read('adminWww/js/eos-role-ui.js');
 const sourceMain = read('src/main.ts');
 const builtMain = read('build/main.js');
 
-assert.equal(pkg.version, '7.10.6', 'release must use a new npm version');
+assert.equal(pkg.version, '7.10.8', 'release must use a new npm version');
 for (const web of [sourceWeb, builtWeb]) {
     assert.match(web, /nexowatt\/readonly\/system-info/, 'read-only system information endpoint missing');
     assert.match(web, /sendEosReadonlySystemInfo/, 'read-only system information handler missing');

package/tools/nexowatt-v7108-ui-foundation-selftest.cjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const root = path.resolve(__dirname, '..');
+const read = relative => fs.readFileSync(path.join(root, relative), 'utf8');
+const json = relative => JSON.parse(read(relative));
+
+const pkg = json('package.json');
+const sourceRole = read('src-admin/public/js/eos-role-ui.js');
+const runtimeRole = read('adminWww/js/eos-role-ui.js');
+const sourceBoot = read('src-admin/public/js/eos-role-bootstrap.js');
+const runtimeBoot = read('adminWww/js/eos-role-bootstrap.js');
+const sourceShell = read('src-admin/public/js/nexowatt-native-shell.js');
+const runtimeShell = read('adminWww/js/nexowatt-native-shell.js');
+const sourceCss = read('src-admin/public/css/nexowatt-native-shell.css');
+const runtimeCss = read('adminWww/css/nexowatt-native-shell.css');
+const drawer = read('src-admin/src/components/Drawer.tsx');
+const index = read('adminWww/index.html');
+
+assert.equal(pkg.version, '7.10.8', 'UI foundation release must use npm version 7.10.8');
+assert.equal(sourceRole, runtimeRole, 'role source/runtime drift');
+assert.equal(sourceBoot, runtimeBoot, 'bootstrap source/runtime drift');
+assert.equal(sourceShell, runtimeShell, 'shell source/runtime drift');
+assert.equal(sourceCss, runtimeCss, 'shell CSS source/runtime drift');
+
+for (const code of [sourceRole, runtimeRole]) {
+    assert.match(code, /const isGloballyHiddenTab = tab => normalize\(tab\) === 'tab-enums'/, 'global Structure hide missing');
+    assert.match(code, /if \(route === 'easy' \|\| isGloballyHiddenTab\(route\)\) return false;/, 'direct Structure route is not denied');
+    assert.match(code, /const isHeaderSystemSettingsButton = button =>/, 'header-only System Settings classifier missing');
+    assert.match(code, /clickedButton && isHeaderSystemSettingsButton\(clickedButton\)/, 'service-row wrench/arrow can still be intercepted');
+    assert.doesNotMatch(code, /clickedButton && isSystemSettingsButton\(clickedButton\)/, 'broad BuildIcon click interception remains');
+    assert.doesNotMatch(code, /\['Struktur'.*tab-enums/s, 'Structure remains in role action definitions');
+}
+for (const code of [sourceBoot, runtimeBoot]) {
+    assert.match(code, /!isGloballyHiddenTab\(route\)/, 'bootstrap does not deny Structure globally');
+    assert.doesNotMatch(code, /route === 'tab-enums'/, 'End User bootstrap still releases Structure');
+}
+for (const code of [sourceShell, runtimeShell]) {
+    assert.match(code, /Dienste & Instanzen/, 'modern Services surface missing');
+    assert.match(code, /Datenpunkte & Zustände/, 'modern Datapoints surface missing');
+    assert.match(code, /title: 'Systemlogs'/, 'modern System Logs surface missing');
+    assert.match(code, /ensureTechnicalSurface\(\)/, 'technical surface is not applied');
+    assert.match(code, /eos-log-row-error/, 'log severity decoration missing');
+}
+for (const css of [sourceCss, runtimeCss]) {
+    for (const marker of [
+        '.eos-technical-surface-header',
+        'html.eos-route-instances',
+        'html.eos-route-objects',
+        'html.eos-route-logs',
+        '.eos-log-row-error',
+    ]) assert.ok(css.includes(marker), `missing modern CSS marker ${marker}`);
+}
+assert.doesNotMatch(drawer, /'tab-users',\s*'tab-enums'/, 'Structure is still part of readyToUse');
+assert.match(drawer, /tab\.name !== 'tab-enums'/, 'Drawer does not hard-filter Structure');
+assert.match(index, /nexowatt-native-shell\.css\?v=7108/, '7.10.8 CSS cache key missing');
+assert.match(index, /eos-role-ui\.js\?v=7108/, '7.10.8 role cache key missing');
+assert.match(index, /nexowatt-stable-v7108\.js\?v=7108/, '7.10.8 stable runtime missing');
+
+console.log('[NexoWatt EOS v7108 UI foundation] OK (modern Services/Datapoints/Logs, Structure hidden, Installer service controls native)');

package/tools/nexowatt-validate-package.cjs

@@ -45,6 +45,8 @@ if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-version-sync-selftes
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-merge-update-selftest.cjs')) fail('merge update selftest is not part of check:eos-stability');
 if (pkg.scripts['check:eos-stable-v7103'] !== 'node tools/nexowatt-stable-v7103-selftest.cjs') fail('stable v7103 selftest script is missing or incorrect');
 if (pkg.scripts['test:eos-auto-update-placement'] !== 'node tools/nexowatt-auto-update-placement-selftest.cjs') fail('auto-update placement selftest script is missing or incorrect');
+if (pkg.scripts['test:eos-installer-ems'] !== 'node tools/nexowatt-installer-ems-selftest.cjs') fail('Installer EMS selftest script is missing or incorrect');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-installer-ems-selftest.cjs')) fail('Installer EMS selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-auto-update-placement-selftest.cjs')) fail('auto-update placement selftest is not part of check:eos-stability');
 if (pkg.scripts.prepublishOnly !== canonicalPrepublishOnly) fail('prepublishOnly must use the dependency-free direct-publish workflow');
 if (/\b(?:tsc|tsx)\b|build:(?:backend|frontend)|\bnpx\b|npm\s+(?:i|install|ci)\b/i.test(pkg.scripts.prepublishOnly || '')) fail('prepublishOnly must not require local development dependencies');
@@ -134,14 +136,14 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.10.6.md',
-  'RELEASE_NOTES_V7.10.6.md',
-  'PUBLISH_STABLE_V7.10.6.md',
-  'INSTALL_TEST_V7.10.6.md',
-  'RELEASE_ACCEPTANCE_V7.10.6.md',
+  'README_STABILITY_V7.10.7.md',
+  'RELEASE_NOTES_V7.10.7.md',
+  'PUBLISH_STABLE_V7.10.7.md',
+  'INSTALL_TEST_V7.10.7.md',
+  'RELEASE_ACCEPTANCE_V7.10.7.md',
   'MERGE_UPDATE.ps1',
   'MERGE_UPDATE.cmd',
-  'MERGE_UPDATE_README_V7.10.6.md',
+  'MERGE_UPDATE_README_V7.10.7.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -174,7 +176,7 @@ for (const file of [
   'tools/nexowatt-ui-overview-runtime-selftest.cjs',
   'adminWww/js/eos-ems-overview.js',
   'adminWww/css/eos-ems-overview.css',
-  'adminWww/static/js/nexowatt-stable-v7106.js',
+  'adminWww/static/js/nexowatt-stable-v7108.js',
   'src-admin/src/components/Intro/NexoWattEmsOverview.tsx',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',

package/INSTALL_TEST_V7.10.6.md

@@ -1,8 +0,0 @@
-# Installation test 7.10.6
-
-- Install/update EOS Admin 7.10.6 and verify port 8081 remains reachable.
-- Sign in as Admin: datapoints are writable; expert mode can be enabled and disabled; Admin and XTerm overview cards are visible.
-- Sign in as Installer: no expert head, ioBroker Admin, XTerm, App Center, License, Simulation or Users/Rights page.
-- Sign in as End User: Datapoints tab is visible but every write/edit/delete action is disabled; restricted tools are absent.
-- Toggle a navigation item with the pencil: EOS Admin must not restart and `system.config` must remain untouched.
-- Disable the backup adapter: its navigation item disappears; re-enable it and the item returns.

package/MERGE_UPDATE_README_V7.10.6.md

@@ -1,7 +0,0 @@
-# Merge/update note 7.10.6
-
-Always replace the previous repository with the complete 7.10.6 repository. Do not merge old `adminWww` bundles or deleted role-security files back into this release. In particular, `nexowatt-role-security.js` and `build/lib/eosRoleSecurity.js` are obsolete and must stay absent.
-
-After a merge, run the package, stability, role-security and publish dry-run checks before publishing.
-
-The 7.10.6 publish workflow now removes all three obsolete 7.10.4 role-security files automatically before sealing and packaging, including when the ZIP was extracted over an existing working directory.

package/PUBLISH_STABLE_V7.10.6.md

@@ -1,8 +0,0 @@
-# NPM publication 7.10.6
-
-1. Use a freshly extracted repository ZIP.
-2. Run `npm publish --dry-run`.
-3. Confirm version `7.10.6`, complete `build/` runtime and all active `adminWww/assets/*-v84.js` files.
-4. Publish with `npm publish` only after the dry run succeeds.
-
-No `npm install`, `npm ci`, `tsc` or `tsx` is required for the sealed prebuilt release.

package/README_STABILITY_V7.10.6.md

@@ -1,5 +0,0 @@
-# NexoWatt EOS Admin 7.10.6 – stability and RBAC baseline
-
-This release retains the validated 7.10.2–7.10.4 crash, package and update-placement fixes. Role decisions now come exclusively from the authenticated `/nexowatt/security/context` response. The removed heuristic must never be restored.
-
-Administrator is an unconditional full-rights path. End User datapoints are read-only in both frontend and backend. Menu edits are persisted in an adapter state and must never write `system.config`.

package/RELEASE_ACCEPTANCE_V7.10.6.md

@@ -1,11 +0,0 @@
-# Release Acceptance 7.10.6
-
-- [ ] Admin can write every normally writable datapoint.
-- [ ] Admin can enable and disable expert mode repeatedly.
-- [ ] Admin sees ioBroker Admin and XTerm overview cards.
-- [ ] Installer and End User never see expert mode, ioBroker Admin or XTerm.
-- [ ] App Center, License, Simulation and account administration are unavailable to Installer/End User.
-- [ ] End User sees Datapoints but cannot write, edit, create or delete.
-- [ ] Pencil navigation edits do not restart EOS Admin.
-- [ ] Backup navigation follows the enabled state of the backup instance.
-- [ ] `npm publish --dry-run` succeeds from a fresh extraction.

package/RELEASE_NOTES_V7.10.6.md

@@ -1,14 +0,0 @@
-# NexoWatt EOS Admin 7.10.6
-
-## Endkundenbereich
-
-- Die Datenpunktansicht bleibt für Endkunden lesbar, blendet aber Bearbeiten-, Löschen- und Einstellungsaktionen vollständig aus.
-- Schreibbefehle bleiben zusätzlich serverseitig gesperrt.
-- Die Systeminformationskarte erhält Plattform, RAM, Node.js und NPM über einen authentifizierten Nur-Lese-Endpunkt.
-- Der fehlerhafte Info-Dialog mit `permissionError` wird für Endkunden nicht mehr angeboten.
-- Administratorrechte und die bestehende Admin-Oberfläche bleiben unverändert und vollständig verfügbar.
-
-## Veröffentlichung
-
-- Neue npm-Version 7.10.6, da 7.10.5 bereits veröffentlicht wurde.
-- Release-Dateien, Cache-Tags, Repository-Eintrag und versiegeltes Prebuilt-Artefakt sind auf 7.10.6 synchronisiert.