iobroker.eos-admin 7.9.35 → 7.9.37

package/adminWww/js/eos-hard-logout.js

@@ -1,165 +1,18 @@
 (function () {
     'use strict';
-
-    const LOG_PREFIX = '[NexoWatt EOS hard logout]';
-    const VERSION = '35';
-    const MIN_POLL_MS = 15_000;
-    const MAX_TIMER_MS = 2_147_000_000;
-    const MIN_TTL_SEC = 5;
-    const STORAGE_KEY = `nexowatt:eos:hardLogoutAt:${location.host}:root`;
-    let logoutTimer = null;
-    let pollTimer = null;
-    let logoutStarted = false;
-
-    function isLoginPage() {
-        const path = String(window.location.pathname || '').toLowerCase();
-        const search = String(window.location.search || '').toLowerCase();
-        return path.endsWith('/login') || path.includes('/login/') || search.includes('login');
-    }
-
-    function clearStoredTokens() {
-        const storages = [window.localStorage, window.sessionStorage, window._localStorage, window._sessionStorage]
-            .filter(Boolean)
-            .filter((storage, index, array) => array.indexOf(storage) === index);
-        const tokenKeyPattern = /(access[_-]?token|refresh[_-]?token|token[_-]?expires|expires[_-]?in|oauth|bearer|auth|connection)/i;
-        for (const storage of storages) {
-            try {
-                const keys = [];
-                for (let i = 0; i < storage.length; i++) {
-                    const key = storage.key(i);
-                    if (key && (tokenKeyPattern.test(key) || key === STORAGE_KEY)) {
-                        keys.push(key);
-                    }
-                }
-                keys.forEach(key => storage.removeItem(key));
-            } catch (e) {
-                // ignore blocked storage
-            }
-        }
-    }
-
-    function clearAuthCookies() {
-        const cookieNames = ['access_token', 'refresh_token', 'connect.sid', 'ioBroker.sid'];
-        const paths = ['/', window.location.pathname.replace(/\/[^/]*$/, '/') || '/'];
-        for (const name of cookieNames) {
-            for (const path of paths) {
-                document.cookie = `${name}=; Max-Age=0; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=${path}; SameSite=Lax`;
-            }
-        }
-    }
-
-    function readDeadline() {
-        try {
-            const value = Number(window.localStorage.getItem(STORAGE_KEY));
-            return Number.isFinite(value) && value > 0 ? value : 0;
-        } catch (e) {
-            return 0;
-        }
-    }
-
-    function writeDeadline(deadline) {
-        try {
-            window.localStorage.setItem(STORAGE_KEY, String(deadline));
-        } catch (e) {
-            // ignore blocked storage
-        }
-    }
-
-    function hardLogout(reason) {
-        if (logoutStarted || isLoginPage()) return;
-        logoutStarted = true;
-        try { console.warn(LOG_PREFIX, reason || 'session expired'); } catch (e) {}
-        if (logoutTimer) {
-            clearTimeout(logoutTimer);
-            logoutTimer = null;
-        }
-        if (pollTimer) {
-            clearInterval(pollTimer);
-            pollTimer = null;
-        }
-        clearStoredTokens();
-        clearAuthCookies();
-        const logoutUrl = new URL('logout', window.location.origin + '/');
-        logoutUrl.searchParams.set('hard', '1');
-        logoutUrl.searchParams.set('ts', String(Date.now()));
-        window.location.replace(logoutUrl.href);
-    }
-
-    function scheduleHardLogout(deadline) {
-        const ms = Math.min(Math.max(deadline - Date.now() + 250, 250), MAX_TIMER_MS);
-        if (logoutTimer) clearTimeout(logoutTimer);
-        logoutTimer = setTimeout(() => hardLogout('configured login timeout reached'), ms);
-    }
-
-    function applyServerExpiration(expireInSec) {
-        const seconds = Number(expireInSec);
-        if (!Number.isFinite(seconds)) return;
-        if (seconds <= 0) {
-            hardLogout('server reported expired session');
-            return;
-        }
-        if (seconds < MIN_TTL_SEC) return;
-
-        const now = Date.now();
-        const candidateDeadline = now + seconds * 1000;
-        const storedDeadline = readDeadline();
-
-        // Set the hard deadline once. If the server reports an earlier expiration later,
-        // tighten the deadline. Never extend it through refresh-token based renewal.
-        const deadline = !storedDeadline || candidateDeadline < storedDeadline - 5000 ? candidateDeadline : storedDeadline;
-        if (deadline !== storedDeadline) writeDeadline(deadline);
-
-        if (now >= deadline) {
-            hardLogout('stored hard deadline reached');
-        } else {
-            scheduleHardLogout(deadline);
-        }
-    }
-
-    async function checkSession() {
-        if (logoutStarted) return;
-        if (isLoginPage()) {
-            clearStoredTokens();
-            clearAuthCookies();
-            return;
-        }
-
-        const storedDeadline = readDeadline();
-        if (storedDeadline && Date.now() >= storedDeadline) {
-            hardLogout('stored hard deadline reached');
-            return;
-        }
-
-        try {
-            const response = await fetch('./session?hard=1&ts=' + Date.now(), {
-                credentials: 'include',
-                cache: 'no-store',
-                headers: { Accept: 'application/json' },
-            });
-            if (!response.ok) return;
-            const session = await response.json();
-            if (typeof session.expireInSec === 'number') {
-                applyServerExpiration(session.expireInSec);
-            }
-        } catch (e) {
-            // During update/restart the endpoint can be unavailable. Do not logout just because of a network error.
-        }
-    }
-
-    function start() {
-        checkSession();
-        pollTimer = setInterval(checkSession, MIN_POLL_MS);
-        window.addEventListener('focus', checkSession, { passive: true });
-        document.addEventListener('visibilitychange', () => {
-            if (!document.hidden) checkSession();
-        });
-    }
-
-    window.NEXOWATT_EOS_HARD_LOGOUT = { version: VERSION, checkSession, hardLogout, clearStoredTokens, clearAuthCookies };
-
-    if (document.readyState === 'loading') {
-        document.addEventListener('DOMContentLoaded', start, { once: true });
-    } else {
-        start();
-    }
+    // NexoWatt EOS v36: compatibility stub.
+    // The custom hard-logout timer was removed because it could expire sessions
+    // earlier than the configured admin TTL and broke native adapter dialogs.
+    // Session handling is now delegated to the same OAuth/session flow as the
+    // upstream ioBroker Admin.
+    const VERSION = '36';
+    function noop() {}
+    window.NEXOWATT_EOS_HARD_LOGOUT = {
+        version: VERSION,
+        checkSession: noop,
+        hardLogout: noop,
+        clearStoredTokens: noop,
+        clearAuthCookies: noop,
+        disabled: true,
+    };
 })();

package/adminWww/js/eos-runtime-fixes.js

@@ -0,0 +1,144 @@
+(() => {
+    'use strict';
+
+    window.NEXOWATT_EOS_RUNTIME_FIXES_VERSION = 'v37-notification-backitup-security-text-fix';
+
+    const MOJIBAKE_MAP = new Map(Object.entries({
+        'dürfen': 'dürfen', 'Dürfen': 'Dürfen',
+        'für': 'für', 'Für': 'Für',
+        'müssen': 'müssen', 'Müssen': 'Müssen',
+        'können': 'können', 'Können': 'Können',
+        'möglich': 'möglich', 'Möglich': 'Möglich',
+        'Löschen': 'Löschen', 'löschen': 'löschen',
+        'schützen': 'schützen', 'Schützen': 'Schützen',
+        'Schützt': 'Schützt', 'schützt': 'schützt',
+        'Geschützte': 'Geschützte', 'geschützte': 'geschützte',
+        'Geschützter': 'Geschützter', 'geschützter': 'geschützter',
+        'geschützten': 'geschützten', 'Geschützten': 'Geschützten',
+        'ausgewählte': 'ausgewählte', 'Ausgewählte': 'Ausgewählte',
+        'ändern': 'ändern', 'Ändern': 'Ändern',
+        'über': 'über', 'Ãœber': 'Über',
+        'Wähle': 'Wähle', 'wähle': 'wähle',
+        'öffnen': 'öffnen', 'Öffnen': 'Öffnen',
+        'schließen': 'schließen', 'Schließen': 'Schließen',
+        'Gerät': 'Gerät', 'gerät': 'gerät',
+        'Geräte': 'Geräte', 'geräte': 'geräte',
+        'Zugänge': 'Zugänge', 'zugänge': 'zugänge',
+        'Sicherheitsgründen': 'Sicherheitsgründen',
+        'Kompatibilitätsgründen': 'Kompatibilitätsgründen',
+        'Benachrichtigungen': 'Benachrichtigungen',
+        'ß': 'ß', 'Ä': 'Ä', 'Ö': 'Ö', 'Ãœ': 'Ü', 'ä': 'ä', 'ö': 'ö', 'ü': 'ü',
+        '–': '–', '—': '—', '„': '„', '“': '“', '”': '”', ' ': ' ', 'Â': ''
+    }));
+
+    const safe = fn => { try { return fn(); } catch { return undefined; } };
+
+    const repairText = value => {
+        let text = String(value || '');
+        if (!/[ÃÂâ]/.test(text)) return text;
+        for (const [from, to] of MOJIBAKE_MAP) {
+            if (text.includes(from)) text = text.split(from).join(to);
+        }
+        return text;
+    };
+
+    const skip = el => {
+        const tag = el?.tagName;
+        return tag === 'SCRIPT' || tag === 'STYLE' || tag === 'TEXTAREA' || tag === 'CODE' || tag === 'PRE';
+    };
+
+    const repairSecurityText = root => safe(() => {
+        const base = root && root.nodeType ? root : document.body || document.documentElement;
+        if (!base) return;
+        const walker = document.createTreeWalker(base, NodeFilter.SHOW_TEXT, {
+            acceptNode(node) {
+                return skip(node.parentElement) ? NodeFilter.FILTER_REJECT : NodeFilter.FILTER_ACCEPT;
+            }
+        });
+        let node;
+        while ((node = walker.nextNode())) {
+            const before = node.nodeValue || '';
+            const after = repairText(before);
+            if (after !== before) node.nodeValue = after;
+        }
+        const attrSelector = '[title],[aria-label],[placeholder],[value]';
+        const elements = base.nodeType === Node.ELEMENT_NODE && base.matches?.(attrSelector)
+            ? [base]
+            : Array.from(base.querySelectorAll?.(attrSelector) || []);
+        elements.forEach(el => {
+            if (skip(el)) return;
+            ['title', 'aria-label', 'placeholder', 'value'].forEach(attr => {
+                if (!el.hasAttribute?.(attr)) return;
+                const before = el.getAttribute(attr) || '';
+                const after = repairText(before);
+                if (after !== before) el.setAttribute(attr, after);
+            });
+        });
+    });
+
+    const isNotificationSurface = el => !!el?.closest?.([
+        '.MuiSnackbar-root',
+        '.MuiAlert-root',
+        '[role="alert"]',
+        '[role="status"]',
+        '.Toastify__toast',
+        '.eos-notification-safe'
+    ].join(','));
+
+    const isCloseControl = el => {
+        const label = `${el?.textContent || ''} ${el?.getAttribute?.('aria-label') || ''} ${el?.getAttribute?.('title') || ''}`.toLowerCase();
+        return /close|schlie(?:ß|ss)en|dismiss|ausblenden|ok|verstanden|x$/.test(label)
+            || !!el?.querySelector?.('svg[data-testid*="Close"], svg[data-testid*="Clear"], .material-icons');
+    };
+
+    const restoreCloseButton = button => safe(() => {
+        if (!button || !isCloseControl(button)) return;
+        button.classList.remove('eos-protected-delete-control', 'eos-security-hidden-delete', 'eos-hidden-logout', 'eos-native-logout-hidden');
+        button.removeAttribute('aria-disabled');
+        button.removeAttribute('data-eos-security-blocked');
+        if ('disabled' in button && button.disabled && !button.dataset.eosOriginalDisabled) button.disabled = false;
+        button.style.pointerEvents = 'auto';
+        button.style.visibility = 'visible';
+        button.style.opacity = '1';
+        if (button.style.display === 'none') button.style.display = '';
+    });
+
+    const repairNotifications = root => safe(() => {
+        const base = root && root.nodeType ? root : document;
+        const surfaces = Array.from(base.querySelectorAll?.([
+            '.MuiSnackbar-root',
+            '.MuiAlert-root',
+            '[role="alert"]',
+            '[role="status"]',
+            '.Toastify__toast'
+        ].join(',')) || []);
+        if (base.nodeType === Node.ELEMENT_NODE && isNotificationSurface(base)) surfaces.push(base);
+        surfaces.forEach(surface => {
+            surface.classList.add('eos-notification-safe');
+            surface.style.pointerEvents = 'auto';
+            surface.querySelectorAll('button,[role="button"],a,.MuiIconButton-root').forEach(restoreCloseButton);
+        });
+    });
+
+    const run = root => {
+        repairSecurityText(root);
+        repairNotifications(root);
+    };
+
+    const install = () => {
+        run(document.body || document.documentElement);
+        const observer = new MutationObserver(mutations => {
+            const roots = new Set();
+            for (const mutation of mutations) {
+                if (mutation.type === 'characterData') roots.add(mutation.target.parentElement || document.body);
+                mutation.addedNodes?.forEach(node => roots.add(node));
+            }
+            roots.forEach(root => run(root));
+        });
+        observer.observe(document.documentElement, { subtree: true, childList: true, characterData: true });
+        [250, 1000, 3000, 8000].forEach(ms => window.setTimeout(() => run(document.body || document.documentElement), ms));
+    };
+
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', install, { once: true });
+    else install();
+})();

package/adminWww/js/eos-security-ui.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v31-security-text-polish';
+    const VERSION = 'v37-security-text-polish';
     const LEGACY_ADMIN = 'admin';
     const LEGACY_ADMIN_INSTANCE = 'admin.0';
     const ASSET_BASE = (() => {
@@ -34,14 +34,24 @@
         let text = String(value || '');
         const map = new Map(Object.entries({
             'dürfen': 'dürfen', 'Dürfen': 'Dürfen', 'für': 'für', 'Für': 'Für',
-            'können': 'können', 'Können': 'Können', 'möglich': 'möglich', 'Möglich': 'Möglich',
-            'Löschen': 'Löschen', 'löschen': 'löschen', 'schützen': 'schützen', 'Schützen': 'Schützen',
-            'Schützt': 'Schützt', 'schützt': 'schützt', 'Geschützte': 'Geschützte', 'geschützte': 'geschützte',
+            'müssen': 'müssen', 'Müssen': 'Müssen', 'können': 'können', 'Können': 'Können',
+            'möglich': 'möglich', 'Möglich': 'Möglich', 'Löschen': 'Löschen', 'löschen': 'löschen',
+            'schützen': 'schützen', 'Schützen': 'Schützen', 'Schützt': 'Schützt', 'schützt': 'schützt',
+            'Geschützte': 'Geschützte', 'geschützte': 'geschützte', 'Geschützter': 'Geschützter',
             'ausgewählte': 'ausgewählte', 'Ausgewählte': 'Ausgewählte', 'ändern': 'ändern', 'Ändern': 'Ändern',
             'über': 'über', 'Ãœber': 'Über', 'Wähle': 'Wähle', 'wähle': 'wähle',
-            'ß': 'ß', 'Ä': 'Ä', 'Ö': 'Ö', 'Ãœ': 'Ü', 'ä': 'ä', 'ö': 'ö', 'ü': 'ü'
+            'öffnen': 'öffnen', 'Öffnen': 'Öffnen', 'schließen': 'schließen', 'Schließen': 'Schließen',
+            'Gerät': 'Gerät', 'Geräte': 'Geräte', 'Geräteliste': 'Geräteliste',
+            'ß': 'ß', 'Ä': 'Ä', 'Ö': 'Ö', 'Ãœ': 'Ü', 'ä': 'ä', 'ö': 'ö', 'ü': 'ü', 'Â': ''
         }));
         for (const [from, to] of map) if (text.includes(from)) text = text.split(from).join(to);
+        // Generic Latin1-as-UTF8 repair for labels injected by older bundles. Guard against false positives.
+        if (/[ÃÂ]/.test(text)) {
+            try {
+                const repaired = decodeURIComponent(escape(text));
+                if (/[äöüÄÖÜß]/.test(repaired) && !/[ÃÂ]/.test(repaired)) text = repaired;
+            } catch { /* keep mapped text */ }
+        }
         return text;
     };
     const normalizeFlat = value => normalize(value).toLowerCase().normalize('NFD').replace(/[\u0300-\u036f]/g, '');
@@ -220,16 +230,39 @@
     };
 
     const applyPolicyToDom = () => {
+        // Text repair is safe and must also run on adapter config pages.
+        replaceTextNodes();
         const admin = isAdminUser();
         document.documentElement.classList.toggle('eos-security-admin-user', admin);
         document.documentElement.classList.toggle('eos-security-non-admin-user', !admin);
         document.documentElement.classList.toggle('eos-security-nonadmin', !admin);
-        replaceTextNodes();
+        releaseNotificationControls();
+        if (isAdapterConfigSurface()) return;
         hideLegacyAdminPanels();
         hideProtectedDeleteControls();
         hideEosSecuritySettingsForNonAdmins();
     };
 
+    const isAdapterConfigSurface = () => document.documentElement.classList.contains('eos-adapter-config-surface') || /Instanzeinstellungen:|Instance settings:|Geräteliste|Gerät hinzufügen|Gerät bearbeiten/i.test(document.body?.textContent || '');
+
+    const releaseNotificationControls = () => {
+        // Never block notification/toast close actions. These controls are owned by
+        // the native Admin UI and must remain clickable regardless of EOS security rules.
+        document.querySelectorAll('.MuiSnackbar-root, .MuiAlert-root, .MuiSnackbarContent-root, [role="alert"], .Toastify__toast, .notistack-Snackbar').forEach(box => {
+            box.classList.add('eos-notification-safe');
+            box.style.pointerEvents = 'auto';
+            box.querySelectorAll('button, [role="button"], a, .MuiIconButton-root').forEach(control => {
+                control.classList.remove('eos-protected-delete-control', 'eos-security-hidden-delete');
+                control.removeAttribute('disabled');
+                control.removeAttribute('aria-disabled');
+                if ('disabled' in control) control.disabled = false;
+                control.style.pointerEvents = 'auto';
+                control.style.display = '';
+                control.style.visibility = '';
+            });
+        });
+    };
+
     const scheduleApply = () => {
         if (state.scheduled) return;
         state.scheduled = true;
@@ -267,7 +300,7 @@
 
     document.addEventListener('click', event => {
         const target = event.target?.closest?.('button,[role="button"],a,[role="menuitem"],.MuiMenuItem-root');
-        if (!target || isAdminUser()) return;
+        if (!target || isAdminUser() || isAdapterConfigSurface()) return;
         const label = normalizeFlat(`${target.textContent || ''} ${target.getAttribute?.('title') || ''} ${target.getAttribute?.('aria-label') || ''}`);
         if (/loschen|delete|remove|deinstall|uninstall/.test(label)) {
             target.classList.add('eos-security-hidden-delete');

package/build/i18n/de.json

@@ -25,9 +25,9 @@
   "Password is too short (min 6 chars)": "Das Passwort ist zu kurz (mindestens 6 Zeichen)",
   "Password repeat": "Passwort wiederholen",
   "Password successfully changed for \"%s\"": "Passwort für „%s“ erfolgreich geändert",
-  "Schützt ausgewählte Adapter für Installateur-/Endkundenbenutzer über Administrator-ACLs und EOS-UI-Regeln. dontDelete und nondeletable bleiben false, damit Updates weiter funktionieren.": "Schützt ausgewählte Adapter für Installateur- und Endkundenbenutzer über Administratorrechte und EOS-Regeln. dontDelete und nondeletable bleiben false, damit Updates weiter funktionieren.",
+  "Schützt ausgewählte Adapter in der EOS Oberfläche vor kritischen Aktionen durch Installateur- und Endkundenrollen. Adaptereigene Funktionen und Updates bleiben möglich.": "Schützt ausgewählte Adapter für Installateur- und Endkundenbenutzer über Administratorrechte und EOS-Regeln. dontDelete und nondeletable bleiben false, damit Updates weiter funktionieren.",
   "Set password": "Passwort festlegen",
-  "Setzt Administrator-ACLs auf die geschützte Adapterliste. Installateur-/Endkundenbenutzer können diese Adapter nicht stoppen, aktivieren oder löschen; Administratoren können sie weiterhin updaten und warten.": "Setzt Administratorrechte auf die geschützte Adapterliste. Installateur- und Endkundenbenutzer können diese Adapter nicht stoppen, aktivieren oder löschen. Administratoren können sie weiterhin updaten und warten.",
+  "Blendet kritische Aktionen für Installateur- und Endkundenrollen aus. Harte ACL-Sperren werden nicht auf Runtime-Adapter gesetzt, damit BackItUp und adaptereigene Konfigurationen stabil bleiben.": "Setzt Administratorrechte auf die geschützte Adapterliste. Installateur- und Endkundenbenutzer können diese Adapter nicht stoppen, aktivieren oder löschen. Administratoren können sie weiterhin updaten und warten.",
   "Sperr-Adresse des alten Admins": "Sperr-Adresse des alten Admins",
   "Sperr-Port des alten Admins": "Sperr-Port des alten Admins",
   "The password for user \"%s\" was successfully changed": "Das Passwort für den Benutzer „%s“ wurde erfolgreich geändert",

package/build/i18n/en.json

@@ -25,9 +25,9 @@
   "Password is too short (min 6 chars)": "Password is too short (min 6 chars)",
   "Password repeat": "Password repeat",
   "Password successfully changed for \"%s\"": "Password successfully changed for \"%s\"",
-  "Schützt ausgewählte Adapter für Installateur-/Endkundenbenutzer über Administrator-ACLs und EOS-UI-Regeln. dontDelete und nondeletable bleiben false, damit Updates weiter funktionieren.": "Protects selected adapters from installer/end-customer users via administrator ACLs and EOS UI rules. dontDelete and nondeletable remain false so updates keep working.",
+  "Schützt ausgewählte Adapter in der EOS Oberfläche vor kritischen Aktionen durch Installateur- und Endkundenrollen. Adaptereigene Funktionen und Updates bleiben möglich.": "Protects selected adapters from installer/end-customer users via administrator ACLs and EOS UI rules. dontDelete and nondeletable remain false so updates keep working.",
   "Set password": "Set password",
-  "Setzt Administrator-ACLs auf die geschützte Adapterliste. Installateur-/Endkundenbenutzer können diese Adapter nicht stoppen, aktivieren oder löschen; Administratoren können sie weiterhin updaten und warten.": "Applies administrator ACLs to the protected adapter list. Installer/end-customer users cannot stop, enable or delete these adapters; administrators can still update and maintain them.",
+  "Blendet kritische Aktionen für Installateur- und Endkundenrollen aus. Harte ACL-Sperren werden nicht auf Runtime-Adapter gesetzt, damit BackItUp und adaptereigene Konfigurationen stabil bleiben.": "Applies administrator ACLs to the protected adapter list. Installer/end-customer users cannot stop, enable or delete these adapters; administrators can still update and maintain them.",
   "Sperr-Adresse des alten Admins": "Legacy admin lock bind address",
   "Sperr-Port des alten Admins": "Legacy admin lock port",
   "The password for user \"%s\" was successfully changed": "The password for user \"%s\" was successfully changed",

package/build/lib/web.js

@@ -583,6 +583,16 @@ class Web {
             this.server.app.get('/version', (_req, res) => {
                 res.status(200).send(this.adapter.version);
             });
+            // v36: Repair stale/broken URLs generated by older EOS hard-logout builds.
+            this.server.app.use((req, res, next) => {
+                const requested = String(req.originalUrl || req.url || '');
+                if (/(?:%2f|%252f)(?:%23|%2523)|\/login\/|\/logout\/|hard=1/i.test(requested)
+                    && /index\.html|login|hard=1|origin=|%23|%2523/i.test(requested)) {
+                    res.redirect(this.LOGIN_PAGE);
+                    return;
+                }
+                next();
+            });
             // replace socket.io
             this.server.app.use((req, res, next) => {
                 const url = req.url.split('?')[0];
@@ -633,38 +643,12 @@ class Web {
                 this.server.app.use(cookieParser());
                 this.server.app.use(bodyParser.urlencoded({ extended: true }));
                 this.server.app.use(bodyParser.json());
-                // NexoWatt EOS: enforce the configured login timeout as a hard logout.
-                // We remove refresh tokens from OAuth responses so the admin client cannot silently extend sessions.
-                const eosHardLogout = false; // v35: keep OAuth refresh flow alive; hard timeout is enforced client-side by an absolute deadline.
-                if (eosHardLogout) {
-                    this.server.app.use('/oauth/token', (req, res, next) => {
-                        const grantType = String(req.body?.grant_type || '');
-                        if (req.method === 'POST' && grantType === 'refresh_token') {
-                            res.status(401).json({
-                                error: 'invalid_grant',
-                                error_description: 'EOS session expired. Please log in again.',
-                                eosHardLogout: true,
-                            });
-                            return;
-                        }
-                        const originalJson = res.json.bind(res);
-                        res.json = body => {
-                            if (body && typeof body === 'object' && body.access_token && body.expires_in) {
-                                const expiresIn = Math.max(1, Math.round(Number(body.expires_in) || Number(this.settings.ttl) || 3600));
-                                body.refresh_token = '';
-                                body.refresh_token_expires_in = expiresIn;
-                                body.eosHardLogout = true;
-                            }
-                            return originalJson(body);
-                        };
-                        next();
-                    });
-                }
+                // v36: OAuth/session handling intentionally follows upstream ioBroker Admin.
                 this.oauth2Model = (0, webserver_1.createOAuth2Server)(this.adapter, {
                     app: this.server.app,
                     secure: this.settings.secure,
                     accessLifetime: this.settings.ttl,
-                    refreshLifetime: this.settings.ttl,
+                    refreshLifetime: 60 * 60 * 24 * 7, // 1 week, same as upstream admin
                     noBasicAuth: this.settings.noBasicAuth,
                     loginPage: (req) => {
                         const isDev = req.url.includes('?dev');
@@ -676,44 +660,44 @@ class Web {
                     },
                 });
                 this.server.app.get('/session', (req, res) => {
-                    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-                    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-                    if (!this.settings.auth) {
-                        res.json({ expireInSec: Math.max(120, this.settings.ttl || 3600), hardLogout: true, auth: false });
-                        return;
-                    }
-                    const tokenValue = this.readAccessTokenFromRequest(req);
-                    if (!tokenValue) {
-                        res.json({ expireInSec: 0, hardLogout: true, error: 'Cannot find session token' });
-                        return;
-                    }
-                    const candidates = new Set();
-                    candidates.add(tokenValue);
-                    candidates.add(tokenValue.startsWith('a:') ? tokenValue : `a:${tokenValue}`);
-                    if (tokenValue.length > 1) candidates.add(`a:${tokenValue[1]}`);
-                    const ids = Array.from(candidates);
-                    const readNext = (index) => {
-                        const id = ids[index];
-                        if (!id) {
-                            res.json({ expireInSec: 0, hardLogout: true, error: 'Cannot find session' });
+                    // v36: Follow upstream admin semantics again. Do not run a second
+                    // EOS hard-logout timer here; the official OAuth/session handling
+                    // already uses the configured access lifetime.
+                    if (req.headers.cookie) {
+                        const cookies = req.headers.cookie.split(';').find(c => c.trim().startsWith('access_token='));
+                        let tokenCookie = cookies?.split('=')[1];
+                        if (!tokenCookie && req.headers.authorization?.startsWith('Bearer ')) {
+                            tokenCookie = req.headers.authorization.split(' ')[1];
+                        }
+                        else if (!tokenCookie && req.query?.token) {
+                            tokenCookie = req.query.token;
+                        }
+                        if (tokenCookie) {
+                            const candidates = new Set();
+                            candidates.add(tokenCookie.startsWith('a:') ? tokenCookie : `a:${tokenCookie}`);
+                            if (tokenCookie.length > 1)
+                                candidates.add(`a:${tokenCookie[1]}`);
+                            const ids = Array.from(candidates);
+                            const readNext = (index) => {
+                                const id = ids[index];
+                                if (!id) {
+                                    res.json({ expireInSec: 0 });
+                                    return;
+                                }
+                                void this.adapter.getSession(id, (token) => {
+                                    if (!token?.user) {
+                                        readNext(index + 1);
+                                    }
+                                    else {
+                                        res.json({ expireInSec: Math.round((token.aExp - Date.now()) / 1000) });
+                                    }
+                                });
+                            };
+                            readNext(0);
                             return;
                         }
-                        void this.adapter.getSession(id, (token) => {
-                            if (!token?.user) {
-                                readNext(index + 1);
-                                return;
-                            }
-                            const now = Date.now();
-                            const expirations = [Number(token.aExp), Number(token.rExp), Number(token.expire), Number(token.expires), Number(token.expiresAt)].filter(value => Number.isFinite(value) && value > 0);
-                            const expiresAt = expirations.length ? Math.min(...expirations) : now + (this.settings.ttl || 3600) * 1000;
-                            res.json({
-                                expireInSec: Math.max(0, Math.floor((expiresAt - now) / 1000)),
-                                hardLogout: true,
-                                user: token.user,
-                            });
-                        });
-                    };
-                    readNext(0);
+                    }
+                    res.json({ error: 'Cannot find session' });
                 });
                 this.server.app.get(/.*\/nexowatt\/security\/(?:context|session)$/, (req, res) => {
                     void this.sendEosSecuritySession(req, res).catch(e => {

package/build/main.js

@@ -737,7 +737,8 @@ class Admin extends adapter_core_1.Adapter {
         return this.config.eosHideLegacyAdminFromNonAdmins !== false && this.config.eosHideLegacyAdminForNonAdmins !== false && this.config.nexowattHideLegacyAdminForNonAdmins !== false;
     }
     shouldApplyAdminOnlyAclToProtectedAdapters() {
-        return this.config.eosApplyAdminOnlyAclToProtectedAdapters !== false;
+        const config = this.config;
+        return config.eosStrictProtectedAdapterAcl === true && this.config.eosApplyAdminOnlyAclToProtectedAdapters === true;
     }
     getAdminOnlyGroup() {
         const configuredGroups = normalizeAdminOnlyGroups(this.config.eosAdminOnlyGroups || this.config.eosSecurityAdminGroups);
@@ -837,8 +838,8 @@ class Admin extends adapter_core_1.Adapter {
             obj.common.nondeletable = false;
             changed = true;
         }
+        const targetAcl = this.getAdminOnlyAcl();
         if (options.adminOnlyAcl) {
-            const targetAcl = this.getAdminOnlyAcl();
             const acl = (obj.acl ||= {});
             if (acl.owner !== targetAcl.owner) {
                 acl.owner = targetAcl.owner;
@@ -853,6 +854,10 @@ class Admin extends adapter_core_1.Adapter {
                 changed = true;
             }
         }
+        else if (obj.acl && obj.acl.owner === targetAcl.owner && obj.acl.ownerGroup === targetAcl.ownerGroup && obj.acl.object === targetAcl.object) {
+            delete obj.acl;
+            changed = true;
+        }
         if (changed) {
             await this.setForeignObjectAsync(id, obj);
         }
@@ -863,7 +868,12 @@ class Admin extends adapter_core_1.Adapter {
             return;
         }
         const isEosAdmin = adapter === EOS_ADMIN_ADAPTER_NAME;
-        const adminOnlyAcl = isEosAdmin || this.shouldApplyAdminOnlyAclToProtectedAdapters();
+        const adminOnlyAcl = isEosAdmin || (this.shouldApplyAdminOnlyAclToProtectedAdapters() && adapter !== 'backitup');
+        // v37 BackItUp/runtime-adapter compatibility: keep default protection UI/role based.
+        // Do not rewrite common/ACL of runtime adapters unless explicitly configured.
+        if (!isEosAdmin && !adminOnlyAcl) {
+            return;
+        }
         let changed = await this.ensureObjectProtectionPolicy(`system.adapter.${adapter}`, {
             keepDontDelete: false,
             adminOnlyAcl,

package/docs/NEXOWATT_EOS_UI_V37_STABILITY_DE.md

@@ -0,0 +1,13 @@
+# NexoWatt EOS Admin v37
+
+## Fokus
+
+Diese Version stabilisiert drei produktive Bereiche:
+
+- Benachrichtigungsdialoge bleiben vollständig klickbar und können sauber geschlossen bzw. bestätigt werden.
+- BackItUp und andere Runtime-Adapter werden vom EOS-Sicherheitswächter standardmäßig nicht mehr über Objekt-/ACL-Umschreibungen verändert. Der Schutz läuft über EOS Rollen/UI.
+- EOS-Sicherheitstexte werden auch auf Adapter-Konfigurationsseiten gegen UTF-8/Latin1-Mojibake repariert.
+
+## Hinweise
+
+BackItUp-Fehler wie `cannot found source "undefined" for compress` kommen typischerweise aus der BackItUp-Quell-/Zielkonfiguration. v37 sorgt dafür, dass EOS Admin BackItUp nicht durch ACL/common-Änderungen beeinflusst. Die BackItUp-Konfiguration selbst muss weiterhin im BackItUp-Adapter geprüft werden.