iobroker.eos-admin 7.9.23 → 7.9.26

package/adminWww/js/eos-security-ui.js

@@ -0,0 +1,212 @@
+(() => {
+    'use strict';
+
+    const VERSION = 'v26-security-visibility-guard';
+    const LEGACY_ADMIN = 'admin';
+    const LEGACY_ADMIN_INSTANCE = 'admin.0';
+    const SECURITY_URL = '/nexowatt/security/session';
+
+    const state = {
+        loaded: false,
+        policy: {
+            isAdmin: false,
+            isEosAdminGroup: false,
+            isAdministrator: false,
+            hideLegacyAdminFromNonAdmins: true,
+            restrictProtectedAdapterControls: true,
+            protectedAdapters: ['eos-admin'],
+        },
+        scheduled: false,
+        observer: null,
+    };
+
+    const normalize = value => String(value || '').replace(/\s+/g, ' ').trim();
+    const normalizeAdapter = value => {
+        let adapter = String(value || '').trim().toLowerCase();
+        adapter = adapter.replace(/^system\.adapter\./, '').replace(/^iobroker\./, '').replace(/^@nexowatt\/iobroker\./, '').replace(/^@nexowatt\//, '');
+        adapter = adapter.replace(/\.\d+$/, '');
+        return /^[a-z0-9_-]+$/.test(adapter) ? adapter : '';
+    };
+
+    const isAdminUser = () => !!(state.policy?.isAdmin || state.policy?.isEosAdminGroup || state.policy?.isAdministrator);
+    const protectedAdapters = () => new Set((state.policy?.protectedAdapters || []).map(normalizeAdapter).filter(Boolean));
+
+    const isLegacyAdminId = value => {
+        const text = String(value || '').toLowerCase();
+        return text === LEGACY_ADMIN || text === LEGACY_ADMIN_INSTANCE || text === 'system.adapter.admin' || text === 'system.adapter.admin.0';
+    };
+
+    const isProtectedAdapter = value => {
+        const adapter = normalizeAdapter(value);
+        return !!adapter && protectedAdapters().has(adapter);
+    };
+
+    window.NEXOWATT_EOS_SECURITY = {
+        version: VERSION,
+        getPolicy: () => state.policy,
+        isAdminUser,
+        isProtectedAdapter,
+        shouldBlockAdapterDelete(adapterName) {
+            if (isAdminUser()) return false;
+            const adapter = normalizeAdapter(adapterName);
+            return adapter === LEGACY_ADMIN || isProtectedAdapter(adapter);
+        },
+        shouldBlockInstanceDelete(instanceIdOrAdapter) {
+            if (isAdminUser()) return false;
+            const raw = String(instanceIdOrAdapter || '').replace(/^system\.adapter\./, '');
+            const adapter = normalizeAdapter(raw);
+            return adapter === LEGACY_ADMIN || isProtectedAdapter(adapter);
+        },
+    };
+
+    const closestPanel = el => {
+        if (!el || !el.closest) return null;
+        return el.closest('.MuiCard-root, .MuiPaper-root, [role="row"], tr, .MuiListItem-root, .MuiBox-root');
+    };
+
+    const markHidden = el => {
+        if (!el || el.classList?.contains('eos-security-keep-visible')) return;
+        el.classList.add('eos-security-hidden');
+        el.setAttribute('aria-hidden', 'true');
+        el.style.display = 'none';
+    };
+
+    const elementHasLegacyAdminIcon = el => {
+        if (!el?.querySelectorAll) return false;
+        return Array.from(el.querySelectorAll('img,[src]')).some(img => {
+            const src = String(img.getAttribute('src') || '').toLowerCase();
+            return /(?:^|\/)adapter\/admin\//.test(src) || /(?:^|\/)admin\/(?:admin\.(?:png|svg)|admin\.svg)/.test(src);
+        });
+    };
+
+    const elementTextMatchesLegacyAdmin = el => {
+        const text = normalize(el?.textContent || '').toLowerCase();
+        if (!text) return false;
+        if (text.includes('eos-admin') || text.includes('eos admin')) return false;
+        return /\badmin\.0\b/.test(text) || /system\.adapter\.admin(?:\.0)?\b/.test(text) || /\biobroker\.admin\b/.test(text);
+    };
+
+    const hideLegacyAdminPanels = () => {
+        if (!state.policy?.hideLegacyAdminFromNonAdmins || isAdminUser()) return;
+        const candidates = new Set();
+        document.querySelectorAll('img,[src]').forEach(img => {
+            if (elementHasLegacyAdminIcon(img.parentElement || img)) candidates.add(closestPanel(img) || img);
+        });
+        document.querySelectorAll('.MuiCard-root, .MuiPaper-root, [role="row"], tr, .MuiListItem-root').forEach(el => {
+            if (elementHasLegacyAdminIcon(el) || elementTextMatchesLegacyAdmin(el)) candidates.add(el);
+        });
+        candidates.forEach(el => {
+            const text = normalize(el.textContent || '').toLowerCase();
+            if (text.includes('eos-admin') || text.includes('eos admin')) return;
+            markHidden(el);
+        });
+    };
+
+    const hideProtectedDeleteControls = () => {
+        if (!state.policy?.restrictProtectedAdapterControls || isAdminUser()) return;
+        const protectedSet = protectedAdapters();
+        if (!protectedSet.size) return;
+
+        document.querySelectorAll('.MuiCard-root, .MuiPaper-root, [role="row"], tr, .MuiListItem-root').forEach(panel => {
+            let adapter = '';
+            const icon = panel.querySelector('img[src*="/adapter/"], img[src*="adapter/"]');
+            const src = icon ? String(icon.getAttribute('src') || '') : '';
+            const match = src.match(/adapter\/([^\/]+)\//i);
+            if (match) adapter = normalizeAdapter(match[1]);
+            const text = normalize(panel.textContent || '').toLowerCase();
+            if (!adapter) {
+                for (const protectedName of protectedSet) {
+                    if (new RegExp(`\\b${protectedName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\.\\d+)?\\b`, 'i').test(text)) {
+                        adapter = protectedName;
+                        break;
+                    }
+                }
+            }
+            if (!adapter || !protectedSet.has(adapter)) return;
+            panel.classList.add('eos-security-protected-adapter');
+            panel.querySelectorAll('button,[role="button"],a').forEach(button => {
+                const label = normalize(`${button.textContent || ''} ${button.getAttribute('title') || ''} ${button.getAttribute('aria-label') || ''}`).toLowerCase();
+                if (/löschen|delete|remove|deinstall|uninstall/.test(label)) {
+                    button.classList.add('eos-security-hidden-delete');
+                    button.setAttribute('disabled', 'disabled');
+                    button.setAttribute('aria-disabled', 'true');
+                    button.style.display = 'none';
+                }
+            });
+        });
+
+        document.querySelectorAll('[role="menuitem"], .MuiMenuItem-root').forEach(item => {
+            const text = normalize(item.textContent || '').toLowerCase();
+            if (/löschen|delete|remove|deinstall|uninstall/.test(text)) {
+                // Context menus cannot always be mapped back to the originating card. For protected NexoWatt systems,
+                // deletion through pop-up menus is blocked by the command guard and visually hidden for non-admin users.
+                item.classList.add('eos-security-hidden-delete');
+                item.style.display = 'none';
+            }
+        });
+    };
+
+    const applyPolicyToDom = () => {
+        document.documentElement.classList.toggle('eos-security-admin-user', isAdminUser());
+        document.documentElement.classList.toggle('eos-security-non-admin-user', !isAdminUser());
+        hideLegacyAdminPanels();
+        hideProtectedDeleteControls();
+    };
+
+    const scheduleApply = () => {
+        if (state.scheduled) return;
+        state.scheduled = true;
+        const run = () => {
+            state.scheduled = false;
+            applyPolicyToDom();
+        };
+        if ('requestIdleCallback' in window) window.requestIdleCallback(run, { timeout: 600 });
+        else window.requestAnimationFrame(run);
+    };
+
+    const loadPolicy = async () => {
+        try {
+            const response = await fetch(SECURITY_URL, { credentials: 'same-origin', cache: 'no-store' });
+            const policy = await response.json();
+            state.policy = { ...state.policy, ...policy };
+            state.loaded = true;
+        } catch (e) {
+            state.loaded = false;
+            state.policy = { ...state.policy, isAdmin: false, isEosAdminGroup: false, isAdministrator: false };
+            console.warn('[NexoWatt EOS] Cannot read security policy, using safe non-admin UI mode:', e);
+        }
+        scheduleApply();
+    };
+
+    const installObserver = () => {
+        if (state.observer) return;
+        state.observer = new MutationObserver(() => scheduleApply());
+        state.observer.observe(document.documentElement, { childList: true, subtree: true });
+    };
+
+    document.addEventListener('click', event => {
+        const target = event.target?.closest?.('button,[role="button"],a,[role="menuitem"],.MuiMenuItem-root');
+        if (!target || isAdminUser()) return;
+        const label = normalize(`${target.textContent || ''} ${target.getAttribute?.('title') || ''} ${target.getAttribute?.('aria-label') || ''}`).toLowerCase();
+        if (/löschen|delete|remove|deinstall|uninstall/.test(label)) {
+            target.classList.add('eos-security-hidden-delete');
+            target.style.display = 'none';
+        }
+    }, true);
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', () => {
+            loadPolicy();
+            installObserver();
+            [300, 1000, 2500, 5000].forEach(ms => window.setTimeout(scheduleApply, ms));
+        }, { once: true });
+    } else {
+        loadPolicy();
+        installObserver();
+        [300, 1000, 2500, 5000].forEach(ms => window.setTimeout(scheduleApply, ms));
+    }
+    window.addEventListener('hashchange', () => {
+        loadPolicy();
+        scheduleApply();
+    });
+})();

package/build/lib/testPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"testPassword.js","sourceRoot":"./src/","sources":["lib/testPassword.ts"],"names":[],"mappings":";;AAAA,iDAAgD;AAChD,qDAA6E;AAC7E,6CAAuC;AAEvC,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,kDAAkD;AAClD,wEAAwE;AACxE,MAAM,aAAa,GAAG,IAAI,sBAAQ,CAAC;IAC/B,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;QACnC,IAAI,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,QAAQ,EAAE,CAAC;IACf,CAAC;CACJ,CAAC,CAAC;AAEH,mEAAmE;AACnE,IAAA,wCAAuB,GAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IACnC,IAAI,KAAK,EAAE,CAAC;QACR,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,qBAAqB;QACrB,MAAM,EAAE,GAAG,IAAA,+BAAe,EAAC;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,2BAA2B,KAAK,CAAC,KAAK,kBAAkB,EAAE,CAAC,QAAgB,EAAE,EAAE;YACvF,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YACD,EAAE,CAAC,QAAQ,CAAC,4BAA4B,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,cAAsB,EAAE,EAAE;gBAChF,UAAU,GAAG,KAAK,CAAC;gBACnB,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtE,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;oBAC9B,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;gBACD,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,IAAA,iCAAgB,EAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBACvE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,UAAU,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,UAAU,GAAG,IAAI,CAAC;IACtB,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"testPassword.js","sourceRoot":"./src/","sources":["lib/testPassword.ts"],"names":[],"mappings":";;AAAA,iDAAgD;AAChD,qDAA6E;AAC7E,6CAAuC;AAEvC,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,kDAAkD;AAClD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,IAAI,sBAAQ,CAAC;IAC/B,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;QACnC,IAAI,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,QAAQ,EAAE,CAAC;IACf,CAAC;CACJ,CAAC,CAAC;AAEH,mEAAmE;AACnE,IAAA,wCAAuB,GAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IACnC,IAAI,KAAK,EAAE,CAAC;QACR,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,qBAAqB;QACrB,MAAM,EAAE,GAAG,IAAA,+BAAe,EAAC;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,2BAA2B,KAAK,CAAC,KAAK,kBAAkB,EAAE,CAAC,QAAgB,EAAE,EAAE;YACvF,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YACD,EAAE,CAAC,QAAQ,CAAC,4BAA4B,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,cAAsB,EAAE,EAAE;gBAChF,UAAU,GAAG,KAAK,CAAC;gBACnB,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtE,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;oBAC9B,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;gBACD,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,IAAA,iCAAgB,EAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBACvE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,UAAU,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,UAAU,GAAG,IAAI,CAAC;IACtB,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/lib/web.js

@@ -341,6 +341,159 @@ class Web {
     resetIndexHtml() {
         this.indexHTML = '';
     }
+
+    normalizeEosGroupId(value) {
+        if (typeof value !== 'string') return null;
+        let group = value.trim();
+        if (!group) return null;
+        if (!group.startsWith('system.group.')) group = `system.group.${group.replace(/^group\./, '')}`;
+        return /^system\.group\.[a-z0-9_-]+$/i.test(group) ? group : null;
+    }
+    normalizeEosUserId(value) {
+        if (!value) return null;
+        let user;
+        if (typeof value === 'string') user = value;
+        else if (typeof value === 'object') {
+            const raw = value;
+            user = String(raw.id || raw._id || raw.user || raw.name || '');
+        }
+        else user = String(value);
+        user = user.trim();
+        if (!user) return null;
+        if (!user.startsWith('system.user.')) user = `system.user.${user.replace(/^user\./, '')}`;
+        return /^system\.user\.[a-z0-9_-]+$/i.test(user) ? user : null;
+    }
+    normalizeEosAdapterName(value) {
+        if (typeof value !== 'string') return null;
+        let adapter = value.trim().toLowerCase();
+        if (!adapter) return null;
+        adapter = adapter
+            .replace(/^system\.adapter\./, '')
+            .replace(/^iobroker\./, '')
+            .replace(/^@nexowatt\/iobroker\./, '')
+            .replace(/^@nexowatt\//, '')
+            .replace(/\.\d+$/, '');
+        return /^[a-z0-9_-]+$/.test(adapter) ? adapter : null;
+    }
+    getEosSecurityAdminGroups() {
+        const configured = this.settings.eosAdminOnlyGroups || this.settings.eosSecurityAdminGroups || this.settings.eosAdminOnlyGroup;
+        const groups = new Set();
+        const add = value => {
+            if (!value) return;
+            if (Array.isArray(value)) {
+                value.forEach(add);
+                return;
+            }
+            if (typeof value === 'object') {
+                if (value.enabled === false) return;
+                add(value.group || value.id || value.name);
+                return;
+            }
+            const group = this.normalizeEosGroupId(String(value));
+            if (group) groups.add(group);
+        };
+        add(configured);
+        groups.add('system.group.administrator');
+        return [...groups].sort();
+    }
+    getEosProtectedAdapterNames() {
+        const names = new Set(['eos-admin']);
+        const add = value => {
+            if (!value) return;
+            if (Array.isArray(value)) {
+                value.forEach(add);
+                return;
+            }
+            if (typeof value === 'object') {
+                if (value.enabled === false) return;
+                add(value.adapter || value.name);
+                return;
+            }
+            const adapter = this.normalizeEosAdapterName(String(value));
+            if (adapter) names.add(adapter);
+        };
+        if (this.settings.eosProtectAdapterDeletion !== false) add(this.settings.eosProtectedAdapters);
+        return [...names].sort();
+    }
+    async getEosGroupsForUser(userId) {
+        const groups = new Set();
+        try {
+            const result = await this.adapter.getObjectViewAsync('system', 'group', {
+                startkey: 'system.group.',
+                endkey: 'system.group.香',
+            });
+            for (const row of result.rows) {
+                const group = row.value || row.doc;
+                const members = Array.isArray(group?.common?.members) ? group.common.members : [];
+                if (members.includes(userId)) groups.add(row.id);
+            }
+        }
+        catch (e) {
+            this.adapter.log.debug(`Cannot resolve EOS security groups for ${userId}: ${e instanceof Error ? e.message : e}`);
+        }
+        return [...groups].sort();
+    }
+    readAccessTokenFromRequest(req) {
+        const cookieHeader = req.headers.cookie || '';
+        const accessCookie = cookieHeader
+            .split(';')
+            .map(cookie => cookie.trim())
+            .find(cookie => cookie.startsWith('access_token='));
+        let token = accessCookie ? accessCookie.split('=').slice(1).join('=') : '';
+        if (!token && req.headers.authorization?.startsWith('Bearer ')) token = req.headers.authorization.substring('Bearer '.length);
+        if (!token && req.query?.token) token = req.query.token;
+        if (!token) return null;
+        try {
+            return decodeURIComponent(token);
+        }
+        catch {
+            return token;
+        }
+    }
+    readSession(id) {
+        return new Promise(resolve => this.adapter.getSession(id, token => resolve(token)));
+    }
+    async readEosCurrentUser(req) {
+        const fromRequest = this.normalizeEosUserId(req.user);
+        if (fromRequest) return fromRequest;
+        if (!this.settings.auth) return this.normalizeEosUserId(this.settings.defaultUser) || 'system.user.admin';
+        const token = this.readAccessTokenFromRequest(req);
+        if (!token) return null;
+        const candidates = new Set();
+        candidates.add(token);
+        candidates.add(token.startsWith('a:') ? token : `a:${token}`);
+        if (token.length > 1) candidates.add(`a:${token[1]}`);
+        for (const id of candidates) {
+            const session = await this.readSession(id).catch(() => null);
+            const user = this.normalizeEosUserId(session?.user);
+            if (user) return user;
+        }
+        return null;
+    }
+    async sendEosSecuritySession(req, res) {
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        const userId = await this.readEosCurrentUser(req);
+        const groups = userId ? await this.getEosGroupsForUser(userId) : [];
+        const adminGroups = this.getEosSecurityAdminGroups();
+        const isAdministrator = userId === 'system.user.admin' || groups.includes('system.group.administrator');
+        const isEosAdminGroup = isAdministrator || groups.some(group => adminGroups.includes(group));
+        res.status(200).json({
+            user: userId,
+            groups,
+            adminGroups,
+            isAdministrator,
+            isEosAdminGroup,
+            isAdmin: isEosAdminGroup,
+            hideLegacyAdminForNonAdmins: this.settings.eosHideLegacyAdminForNonAdmins !== false && this.settings.eosHideLegacyAdminFromNonAdmins !== false,
+            hideLegacyAdminFromNonAdmins: this.settings.eosHideLegacyAdminForNonAdmins !== false && this.settings.eosHideLegacyAdminFromNonAdmins !== false,
+            restrictProtectedAdapterControls: this.settings.eosRestrictProtectedAdapterControls !== false && this.settings.eosApplyAdminOnlyAclToProtectedAdapters !== false,
+            legacyAdminAdapter: 'admin',
+            legacyAdminInstance: 'admin.0',
+            protectedAdapters: this.getEosProtectedAdapterNames(),
+        });
+    }
+
     /**
      * Initialize the server
      */
@@ -462,6 +615,24 @@ class Web {
                     }
                     res.json({ error: 'Cannot find session' });
                 });
+                this.server.app.get(/.*\/nexowatt\/security\/(?:context|session)$/, (req, res) => {
+                    void this.sendEosSecuritySession(req, res).catch(e => {
+                        this.adapter.log.warn(`Cannot create NexoWatt security context: ${e instanceof Error ? e.message : e}`);
+                        res.status(200).json({
+                            user: null,
+                            groups: [],
+                            adminGroups: ['system.group.administrator'],
+                            isAdministrator: false,
+                            isEosAdminGroup: false,
+                            isAdmin: false,
+                            hideLegacyAdminForNonAdmins: true,
+                            hideLegacyAdminFromNonAdmins: true,
+                            restrictProtectedAdapterControls: true,
+                            protectedAdapters: ['eos-admin'],
+                        });
+                    });
+                });
+
                 this.server.app.get('/logout', (req, res) => {
                     const isDev = req.url.includes('?dev');
                     let origin = req.url.split('origin=')[1];
@@ -536,6 +707,27 @@ class Web {
             else {
                 this.server.app.get('/logout', (_req, res) => res.redirect('/'));
             }
+            const sendSecuritySession = (req, res) => {
+                void this.sendEosSecuritySession(req, res).catch(e => {
+                    this.adapter.log.warn(`Cannot read EOS security session: ${e instanceof Error ? e.message : e}`);
+                    res.status(200).json({
+                        user: null,
+                        groups: [],
+                        adminGroups: ['system.group.administrator'],
+                        isAdministrator: false,
+                        isEosAdminGroup: false,
+                        isAdmin: false,
+                        hideLegacyAdminForNonAdmins: true,
+                        hideLegacyAdminFromNonAdmins: true,
+                        restrictProtectedAdapterControls: true,
+                        protectedAdapters: ['eos-admin'],
+                    });
+                });
+            };
+            this.server.app.get('/eos/security/status', sendSecuritySession);
+            this.server.app.get('/nexowatt/security/session', sendSecuritySession);
+            this.server.app.get('/nexowatt/security/context', sendSecuritySession);
+
             this.server.app.get('/iobroker_check.html', (_req, res) => {
                 res.status(200).send('ioBroker');
             });
@@ -1020,34 +1212,20 @@ class Web {
             }
             catch (err) {
                 this.adapter.log.error(`Cannot create web-server: ${err}`);
-                if (this.adapter.terminate) {
-                    this.adapter.terminate(adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
-                }
-                else {
-                    process.exit(adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
-                }
+                this.adapter.terminate(adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
                 return;
             }
             if (!this.server.server) {
                 this.adapter.log.error(`Cannot create web-server`);
-                if (this.adapter.terminate) {
-                    this.adapter.terminate(adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
-                }
-                else {
-                    process.exit(adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
-                }
+                this.adapter.terminate(adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
                 return;
             }
             this.server.server.__server = this.server;
         }
         else {
             this.adapter.log.error('port missing');
-            if (this.adapter.terminate) {
-                this.adapter.terminate('port missing', adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
-            }
-            else {
-                process.exit(adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
-            }
+            this.adapter.terminate('port missing', adapter_core_1.EXIT_CODES.ADAPTER_REQUESTED_TERMINATION);
+            return;
         }
         const systemConfig = await this.adapter.getForeignObjectAsync('system.config');
         this.systemConfig = systemConfig || {};