iobroker.eos-admin 7.9.23 → 7.9.26

package/adminWww/css/eos-branding.css

@@ -2203,3 +2203,248 @@ html.eos-app .eos-hidden-logout * {
 .eos-hidden-nexowatt-repo-warning {
     display: none !important;
 }
+
+
+/* NexoWatt EOS security visibility */
+.eos-hidden-legacy-admin {
+    display: none !important;
+}
+
+.eos-hide-legacy-admin-active [data-id="admin"],
+.eos-hide-legacy-admin-active [data-id="admin.0"],
+.eos-hide-legacy-admin-active [data-name="admin"] {
+    display: none !important;
+}
+
+/* v25: role-aware EOS security UI guard */
+html.eos-security-nonadmin .eos-hidden-legacy-admin {
+    display: none !important;
+}
+
+html.eos-security-nonadmin .eos-protected-adapter-row .eos-protected-delete-control,
+html.eos-security-nonadmin .eos-protected-delete-control {
+    opacity: 0.28 !important;
+    pointer-events: none !important;
+    filter: grayscale(1) !important;
+}
+
+html.eos-security-nonadmin .eos-protected-delete-dialog .eos-protected-delete-control {
+    display: none !important;
+}
+
+html.eos-security-nonadmin .eos-security-admin-only-field {
+    display: none !important;
+}
+
+.eos-security-restricted-note {
+    margin: 10px 0 18px !important;
+    padding: 14px 16px !important;
+    border-radius: 16px !important;
+    border: 1px solid rgba(45, 255, 182, 0.26) !important;
+    background: rgba(4, 18, 28, 0.78) !important;
+    color: rgba(232, 255, 248, 0.95) !important;
+    box-shadow: 0 0 22px rgba(0, 229, 168, 0.13) !important;
+    display: flex !important;
+    flex-direction: column !important;
+    gap: 4px !important;
+}
+
+.eos-security-restricted-note strong {
+    color: #53ffd0 !important;
+    font-weight: 800 !important;
+}
+
+.eos-security-restricted-note span {
+    color: rgba(219, 246, 240, 0.78) !important;
+    font-size: 0.9rem !important;
+}
+
+
+/* NexoWatt EOS v25 security visibility guard */
+.eos-security-hidden,
+.eos-security-hidden-delete {
+    display: none !important;
+}
+.eos-security-protected-adapter {
+    position: relative;
+}
+.eos-security-protected-adapter::after {
+    content: 'EOS geschützt';
+    position: absolute;
+    right: 10px;
+    top: 10px;
+    z-index: 2;
+    font-size: 10px;
+    letter-spacing: .06em;
+    text-transform: uppercase;
+    padding: 3px 8px;
+    border-radius: 999px;
+    color: rgba(225, 255, 246, .88);
+    background: rgba(5, 22, 28, .72);
+    border: 1px solid rgba(55, 230, 180, .22);
+    pointer-events: none;
+}
+
+/* === NexoWatt EOS v26: Header identity polish =============================
+   Header-Logo links stärker sichtbar, leicht nach oben gesetzt und sauber vom
+   Text getrennt. Benutzername rechts wird kontrastreich/weiß dargestellt. */
+html.eos-app .eos-top-toolbar {
+    overflow: visible !important;
+}
+
+html.eos-app .eos-brand-badge {
+    grid-template-columns: 76px minmax(170px, 1fr) 12px !important;
+    min-width: 326px !important;
+    width: 326px !important;
+    height: 62px !important;
+    min-height: 62px !important;
+    padding: 3px 16px 3px 5px !important;
+    column-gap: 13px !important;
+    align-items: center !important;
+    transform: translateY(-2px) !important;
+    background:
+        radial-gradient(circle at 26px 31px, rgba(0, 255, 136, 0.30), transparent 35px),
+        linear-gradient(135deg, rgba(0, 255, 136, 0.18), rgba(0, 212, 255, 0.075) 58%, rgba(2, 9, 20, 0.45)) !important;
+    border-color: rgba(0, 255, 136, 0.55) !important;
+    box-shadow:
+        inset 0 1px 0 rgba(255, 255, 255, 0.10),
+        inset 0 0 24px rgba(0, 255, 136, 0.08),
+        0 10px 24px rgba(0, 0, 0, 0.28),
+        0 0 22px rgba(0, 255, 136, 0.18) !important;
+}
+
+html.eos-app .eos-brand-badge-mark {
+    width: 64px !important;
+    height: 64px !important;
+    min-width: 64px !important;
+    min-height: 64px !important;
+    margin-left: -1px !important;
+    transform: translateY(-3px) !important;
+    border-radius: 22px !important;
+    background:
+        radial-gradient(circle at 48% 46%, rgba(45, 255, 188, 0.20), rgba(0, 22, 22, 0.92) 63%, rgba(1, 9, 17, 0.98) 100%) !important;
+    border: 1px solid rgba(111, 255, 215, 0.76) !important;
+    box-shadow:
+        inset 0 0 22px rgba(0, 255, 136, 0.16),
+        0 0 0 1px rgba(255, 255, 255, 0.06),
+        0 0 20px rgba(0, 255, 136, 0.54),
+        0 0 38px rgba(0, 212, 255, 0.17) !important;
+}
+
+html.eos-app .eos-brand-badge-logo {
+    width: 57px !important;
+    height: 57px !important;
+    min-width: 57px !important;
+    min-height: 57px !important;
+    opacity: 1 !important;
+    transform: translateY(-1px) !important;
+    filter:
+        brightness(2.18)
+        contrast(1.16)
+        saturate(1.42)
+        drop-shadow(0 0 1px rgba(245, 255, 252, 0.92))
+        drop-shadow(0 0 10px rgba(0, 255, 136, 0.78))
+        drop-shadow(0 0 20px rgba(0, 212, 255, 0.24)) !important;
+}
+
+html.eos-app .eos-brand-badge-copy {
+    padding-left: 1px !important;
+    min-width: 0 !important;
+}
+
+html.eos-app .eos-brand-badge-copy strong {
+    color: #ffffff !important;
+    font-size: 14px !important;
+    line-height: 1.0 !important;
+    text-shadow: 0 1px 0 rgba(0,0,0,.45), 0 0 10px rgba(0,255,136,.18) !important;
+}
+
+html.eos-app .eos-brand-badge-copy small {
+    color: rgba(239, 255, 250, 0.88) !important;
+    font-size: 7.9px !important;
+    line-height: 1.08 !important;
+    text-shadow: 0 1px 0 rgba(0,0,0,.42) !important;
+}
+
+html.eos-app .eos-brand-led {
+    background: #18ff9a !important;
+    box-shadow: 0 0 12px rgba(0,255,136,.95), 0 0 24px rgba(0,212,255,.18) !important;
+}
+
+/* Right account/user area in the native app bar: keep names readable. */
+html.eos-app .MuiAppBar-root .MuiToolbar-root,
+html.eos-app .eos-top-toolbar {
+    color: #f4fbff !important;
+}
+
+html.eos-app .eos-top-toolbar > :not(.eos-brand-badge),
+html.eos-app .eos-top-toolbar > :not(.eos-brand-badge) *,
+html.eos-app .MuiAppBar-root .MuiToolbar-root .MuiTypography-root,
+html.eos-app .MuiAppBar-root .MuiToolbar-root a,
+html.eos-app .MuiAppBar-root .MuiToolbar-root button,
+html.eos-app .MuiAppBar-root .MuiToolbar-root span:not(.eos-brand-led):not(.eos-brand-badge-mark) {
+    color: #f4fbff !important;
+    text-shadow: 0 1px 0 rgba(0,0,0,.55), 0 0 9px rgba(0,255,136,.14) !important;
+}
+
+html.eos-app .MuiAppBar-root .MuiToolbar-root .MuiAvatar-root,
+html.eos-app .MuiAppBar-root .MuiToolbar-root img[alt*="admin" i],
+html.eos-app .MuiAppBar-root .MuiToolbar-root img[alt*="user" i] {
+    opacity: 1 !important;
+    filter: brightness(1.25) saturate(1.25) drop-shadow(0 0 10px rgba(0,255,136,.42)) !important;
+}
+
+@media (max-width: 1220px) {
+    html.eos-app .eos-brand-badge {
+        min-width: 80px !important;
+        width: 80px !important;
+        grid-template-columns: 1fr !important;
+        justify-items: center !important;
+        padding: 4px 7px !important;
+        transform: translateY(-1px) !important;
+    }
+
+    html.eos-app .eos-brand-badge-mark {
+        width: 64px !important;
+        height: 64px !important;
+        min-width: 64px !important;
+        min-height: 64px !important;
+    }
+
+    html.eos-app .eos-brand-badge-logo {
+        width: 57px !important;
+        height: 57px !important;
+        min-width: 57px !important;
+        min-height: 57px !important;
+    }
+
+    html.eos-app .eos-brand-badge-copy,
+    html.eos-app .eos-brand-led {
+        display: none !important;
+    }
+}
+
+@media (max-width: 720px) {
+    html.eos-app .eos-brand-badge {
+        min-width: 64px !important;
+        width: 64px !important;
+        height: 56px !important;
+        min-height: 56px !important;
+    }
+
+    html.eos-app .eos-brand-badge-mark {
+        width: 52px !important;
+        height: 52px !important;
+        min-width: 52px !important;
+        min-height: 52px !important;
+        transform: translateY(-1px) !important;
+    }
+
+    html.eos-app .eos-brand-badge-logo {
+        width: 47px !important;
+        height: 47px !important;
+        min-width: 47px !important;
+        min-height: 47px !important;
+    }
+}
+

package/adminWww/index.html

@@ -31,7 +31,7 @@
             rel="stylesheet"
             href="css/leaflet.css"
         />
-        <link rel="stylesheet" href="./css/eos-branding.css?v=23" />
+        <link rel="stylesheet" href="./css/eos-branding.css?v=26" />
         <link
             rel="manifest"
             href="manifest.json"
@@ -154,7 +154,8 @@
       <script type="module" crossorigin src="./assets/index-CQZugZ1z.js"></script>
       <link rel="modulepreload" crossorigin href="./assets/preload-helper-BDBacUwf.js">
       <link rel="modulepreload" crossorigin href="./assets/iobroker_admin__mf_v__runtimeInit__mf_v__-g2X2zhAf.js">
-            <script defer src="./js/eos-branding.js?v=23"></script>
+            <script defer src="./js/eos-branding.js?v=26"></script>
+            <script defer src="./js/eos-security-ui.js?v=26"></script>
     </head>
     <body>
         <noscript>You need to enable JavaScript to run this app.</noscript>

package/adminWww/js/eos-branding.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    window.NEXOWATT_EOS_UI_VERSION = 'v23-official-nexowatt-repo-warning-fix';
+    window.NEXOWATT_EOS_UI_VERSION = 'v26-header-identity-polish';
 
     const BRAND = 'NexoWatt EOS';
     const EOS_MEANING = 'Energy Operation System';
@@ -64,6 +64,14 @@
         scopePatchScheduled: false,
         pendingScopes: new Set(),
         lastFullPatch: 0,
+        securityPolicy: {
+            loaded: false,
+            isAdmin: false,
+            hideLegacyAdminForNonAdmins: true,
+            restrictProtectedAdapterControls: true,
+            protectedAdapters: ['eos-admin', 'backitup'],
+        },
+        securityFetchStarted: false,
     };
 
     const safe = fn => {
@@ -163,6 +171,214 @@
         };
     };
 
+    const normalizeIdentifier = value => String(value || '')
+        .toLowerCase()
+        .normalize('NFD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .replace(/^iobroker\./, '')
+        .replace(/^system\.adapter\./, '')
+        .replace(/\.\d+$/, '')
+        .replace(/[^a-z0-9_.-]+/g, ' ')
+        .trim();
+
+    const adapterPattern = adapter => {
+        const escaped = String(adapter || '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        return new RegExp(`(?:^|[^a-z0-9_-])${escaped}(?:$|[^a-z0-9_-])`, 'i');
+    };
+
+    const textOfElement = el => {
+        if (!el) return '';
+        const attrs = ['data-adapter-name', 'data-adapter', 'data-id', 'id', 'title', 'aria-label', 'alt', 'href', 'src'];
+        const values = [el.textContent || ''];
+        attrs.forEach(attr => {
+            if (el.getAttribute && el.hasAttribute(attr)) values.push(el.getAttribute(attr) || '');
+        });
+        return values.join(' ');
+    };
+
+    const securityEndpointUrls = () => [
+        new URL('nexowatt/security/context', ASSET_BASE).href,
+        new URL('nexowatt/security/session', ASSET_BASE).href,
+        new URL('eos/security/status', ASSET_BASE).href,
+    ];
+
+    const normalizeSecurityPolicy = policy => {
+        const protectedAdapters = new Set(['eos-admin', 'backitup']);
+        (Array.isArray(policy?.protectedAdapters) ? policy.protectedAdapters : []).forEach(item => {
+            const adapter = typeof item === 'string' ? normalizeIdentifier(item) : normalizeIdentifier(item?.adapter || item?.name);
+            if (adapter) protectedAdapters.add(adapter);
+        });
+        const isAdmin = !!(policy?.isAdmin || policy?.isAdminGroup || policy?.isEosAdminGroup || policy?.isAdministrator);
+        return {
+            loaded: true,
+            user: policy?.user || null,
+            groups: Array.isArray(policy?.groups) ? policy.groups : [],
+            isAdmin,
+            hideLegacyAdminForNonAdmins: policy?.hideLegacyAdminForNonAdmins !== false && policy?.hideLegacyAdminFromNonAdmins !== false,
+            restrictProtectedAdapterControls: policy?.restrictProtectedAdapterControls !== false,
+            protectedAdapters: [...protectedAdapters].sort(),
+        };
+    };
+
+    const applySecurityClasses = () => {
+        const policy = state.securityPolicy;
+        document.documentElement.classList.toggle('eos-security-loaded', !!policy.loaded);
+        document.documentElement.classList.toggle('eos-security-admin', !!policy.isAdmin);
+        document.documentElement.classList.toggle('eos-security-nonadmin', policy.loaded && !policy.isAdmin);
+    };
+
+    const fetchSecurityPolicy = async () => {
+        if (state.securityFetchStarted) return;
+        state.securityFetchStarted = true;
+        for (const url of securityEndpointUrls()) {
+            try {
+                const response = await fetch(url, { credentials: 'same-origin', cache: 'no-store' });
+                if (!response.ok) continue;
+                const json = await response.json();
+                if (!json || json.error) continue;
+                state.securityPolicy = normalizeSecurityPolicy(json);
+                applySecurityClasses();
+                scheduleFullPatch(0);
+                return;
+            } catch (e) {
+                // Security endpoint may be unavailable during login or old cache. Fallback below.
+            }
+        }
+        state.securityPolicy = normalizeSecurityPolicy({ isAdmin: false, protectedAdapters: ['eos-admin', 'backitup'] });
+        applySecurityClasses();
+        scheduleFullPatch(0);
+    };
+
+    const isAdminUser = () => !!state.securityPolicy?.isAdmin;
+
+    const isLegacyAdminContainer = el => {
+        const text = textOfElement(el);
+        if (/\badmin\.0\b/i.test(text) || /\bsystem\.adapter\.admin\.0\b/i.test(text)) return true;
+        const candidates = Array.from(el.querySelectorAll ? el.querySelectorAll('*') : []);
+        candidates.push(el);
+        return candidates.some(node => {
+            const value = textOfElement(node).trim();
+            return /^admin$/i.test(value) || /^iobroker\.admin$/i.test(value) || /^system\.adapter\.admin$/i.test(value);
+        });
+    };
+
+    const containerMentionsAdapter = (container, adapter) => {
+        if (!container || !adapter) return false;
+        const normalized = normalizeIdentifier(adapter);
+        if (!normalized) return false;
+        if (normalized === 'admin') return isLegacyAdminContainer(container);
+        const pattern = adapterPattern(normalized);
+        if (pattern.test(textOfElement(container))) return true;
+        return Array.from(container.querySelectorAll ? container.querySelectorAll('[title],[aria-label],[data-adapter-name],[data-adapter],[data-id]') : [])
+            .some(el => pattern.test(textOfElement(el)));
+    };
+
+    const getSecurityContainers = () => Array.from(document.querySelectorAll([
+        '#app-paper .MuiCard-root',
+        '#app-paper tr.MuiTableRow-root',
+        '#app-paper tr',
+        '#app-paper .MuiAccordion-root',
+        '#app-paper [role="row"]',
+        '#app-paper [role="treeitem"]',
+        '#app-paper .MuiDataGrid-row',
+        '#app-paper .MuiTreeItem-root',
+        '#app-paper .MuiFormControlLabel-root',
+        '#app-paper .MuiListItem-root',
+        '#app-paper .MuiListItemButton-root',
+    ].join(','))).filter(el => !el.closest('.MuiDialog-paper'));
+
+    const isDeleteControl = el => {
+        const text = normalize(el.textContent || el.getAttribute?.('title') || el.getAttribute?.('aria-label') || '');
+        const title = normalize(el.getAttribute?.('title') || el.closest?.('[title]')?.getAttribute('title') || '');
+        const svg = el.querySelector?.('svg[data-testid*="Delete"], svg[data-testid*="Remove"], svg[data-testid*="Clear"]');
+        return !!svg || /\b(delete|remove|uninstall|del|loschen|entfernen|deinstallieren)\b/.test(`${text} ${title}`);
+    };
+
+    const lockDeleteControls = container => {
+        Array.from(container.querySelectorAll('button, [role="button"], a')).forEach(control => {
+            if (!isDeleteControl(control)) return;
+            control.classList.add('eos-protected-delete-control');
+            control.setAttribute('aria-disabled', 'true');
+            control.setAttribute('title', 'Nur Administratoren dürfen geschützte EOS-Systemmodule löschen');
+            if ('disabled' in control) control.disabled = true;
+            control.addEventListener('click', event => {
+                event.preventDefault();
+                event.stopImmediatePropagation();
+            }, true);
+        });
+    };
+
+    const protectDeleteDialogs = () => {
+        if (isAdminUser() || state.securityPolicy.restrictProtectedAdapterControls === false) return;
+        const protectedAdapters = state.securityPolicy.protectedAdapters || [];
+        Array.from(document.querySelectorAll('.MuiDialog-paper, [role="dialog"]')).forEach(dialog => {
+            const text = textOfElement(dialog);
+            if (!/(delete|remove|loschen|entfernen|deinstallieren|del\s+)/i.test(text)) return;
+            const protectedHit = protectedAdapters.some(adapter => containerMentionsAdapter(dialog, adapter));
+            if (!protectedHit) return;
+            dialog.classList.add('eos-protected-delete-dialog');
+            Array.from(dialog.querySelectorAll('button')).forEach(button => {
+                const label = normalize(button.textContent || button.getAttribute('aria-label') || '');
+                if (/^(ok|ja|yes|delete|remove|loschen|entfernen|deinstallieren)$/.test(label)) {
+                    button.disabled = true;
+                    button.classList.add('eos-protected-delete-control');
+                }
+            });
+        });
+    };
+
+    const hideSecuritySettingsForNonAdmin = () => {
+        if (isAdminUser()) return;
+        Array.from(document.querySelectorAll('.MuiDialog-paper, [role="dialog"]')).forEach(dialog => {
+            const dialogText = textOfElement(dialog);
+            if (!/(eos security|nexowatt security|legacy admin|alter admin|protected adapters|geschutzte adapter|eos admin groups)/i.test(dialogText)) return;
+            dialog.classList.add('eos-security-settings-restricted');
+            const needles = /(eos security|nexowatt security|legacy admin|alter admin|protected adapters|geschutzte adapter|eos admin groups|lock legacy admin|hide legacy admin|restrict protected adapter)/i;
+            Array.from(dialog.querySelectorAll('label, legend, h2, h3, h4, .MuiTypography-root, .MuiFormLabel-root')).forEach(label => {
+                if (!needles.test(label.textContent || '')) return;
+                const row = label.closest('.MuiGrid2-root, .MuiGrid-root, .MuiFormControl-root, .MuiBox-root, .MuiPaper-root') || label.parentElement;
+                if (row && row !== dialog) row.classList.add('eos-security-admin-only-field');
+            });
+            if (!dialog.querySelector('.eos-security-restricted-note')) {
+                const note = document.createElement('div');
+                note.className = 'eos-security-restricted-note';
+                note.innerHTML = '<strong>EOS Systemschutz aktiv</strong><span>Diese Sicherheitseinstellungen sind nur für Administratoren sichtbar und änderbar.</span>';
+                const content = dialog.querySelector('.MuiDialogContent-root') || dialog;
+                content.insertBefore(note, content.firstElementChild || null);
+            }
+        });
+    };
+
+    const applySecurityUiGuard = () => safe(() => {
+        const policy = state.securityPolicy;
+        applySecurityClasses();
+        if (!policy.loaded) return;
+        if (isAdminUser()) {
+            document.querySelectorAll('.eos-hidden-legacy-admin, .eos-protected-adapter-row').forEach(el => {
+                el.classList.remove('eos-hidden-legacy-admin', 'eos-protected-adapter-row');
+                el.removeAttribute('aria-hidden');
+            });
+            return;
+        }
+
+        const containers = getSecurityContainers();
+        containers.forEach(container => {
+            if (policy.hideLegacyAdminForNonAdmins !== false && isLegacyAdminContainer(container)) {
+                container.classList.add('eos-hidden-legacy-admin');
+                container.setAttribute('aria-hidden', 'true');
+                return;
+            }
+            if (policy.restrictProtectedAdapterControls !== false) {
+                const protectedHit = (policy.protectedAdapters || []).some(adapter => adapter !== 'admin' && containerMentionsAdapter(container, adapter));
+                if (protectedHit) {
+                    container.classList.add('eos-protected-adapter-row');
+                    lockDeleteControls(container);
+                }
+            }
+        });
+        protectDeleteDialogs();
+        hideSecuritySettingsForNonAdmin();
+    });
 
     const isLoginView = () => safe(() => {
         const hasApp = !!document.getElementById('app-paper');
@@ -534,6 +750,7 @@
         ensureSettingsDialogClasses();
         hideNativeLogoutNav();
         hideOfficialNexoWattRepoWarning();
+        applySecurityUiGuard();
         patchTextNodes(document.body || document.documentElement);
         patchAttributes(document.body || document.documentElement);
     };
@@ -550,6 +767,7 @@
         ensureSettingsDialogClasses();
         hideNativeLogoutNav();
         hideOfficialNexoWattRepoWarning();
+        applySecurityUiGuard();
         for (const scope of scopes.slice(0, 80)) {
             if (!scope || !scope.isConnected) continue;
             patchTextNodes(scope);
@@ -605,11 +823,13 @@
     if (document.readyState === 'loading') {
         document.addEventListener('DOMContentLoaded', () => {
             fullPatch();
+            fetchSecurityPolicy();
             installObserver();
             [250, 1000, 2500, 5000].forEach(scheduleFullPatch);
         }, { once: true });
     } else {
         fullPatch();
+        fetchSecurityPolicy();
         installObserver();
         [250, 1000, 2500, 5000].forEach(scheduleFullPatch);
     }