iobroker.eos-admin 7.9.93 → 7.9.95

package/adminWww/static/js/nexowatt-stable-login.js

@@ -0,0 +1,79 @@
+/* NexoWatt EOS stable runtime v94 */
+(() => {
+  'use strict';
+  const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
+  const ASSIST_TEXT = /EOS\s*Assist/i;
+  const PASSWORDLESS_TEXT = /Erstanmeldung\s+ohne\s+Passwort|first\s+sign-?in\s+without\s+password/i;
+  const isLogin = () => /(?:\?|&)login(?:[=&]|$)/i.test(location.search) || /\/login(?:[/?#]|$)/i.test(location.pathname + location.hash);
+  const visible = el => !!el && el.getClientRects().length > 0;
+  const findInput = kind => {
+    const inputs = [...document.querySelectorAll('input')].filter(visible);
+    if (kind === 'password') return inputs.find(i => i.type === 'password');
+    return inputs.find(i => i.type !== 'password' && /user|login|name/i.test(`${i.name} ${i.id} ${i.autocomplete} ${i.getAttribute('aria-label')||''}`)) || inputs.find(i => i.type !== 'password');
+  };
+  const findSubmit = () => [...document.querySelectorAll('button,input[type="submit"]')].find(el => visible(el) && (/anmelden|login|sign in/i.test((el.textContent||el.value||'').trim()) || el.type === 'submit'));
+  const commonAncestor = (a,b) => {
+    if (!a || !b) return null;
+    const parents = new Set(); let n=a;
+    while(n){parents.add(n);n=n.parentElement;}
+    n=b; while(n&&!parents.has(n))n=n.parentElement;
+    return n;
+  };
+  const markLogin = () => {
+    if (!isLogin()) return;
+    document.documentElement.classList.add('nw-eos-login-v94');
+    document.body?.classList.add('nw-eos-login-v94');
+    const u=findInput('user'), p=findInput('password'), submit=findSubmit();
+    if (u && p) {
+      let card=commonAncestor(u,p);
+      while(card && card.parentElement && card.querySelectorAll('input').length < 2) card=card.parentElement;
+      if (card) {
+        card.setAttribute('data-nw-login-card','true');
+        let outer=card.parentElement;
+        for(let i=0;i<3 && outer?.parentElement;i++){
+          if(outer.getBoundingClientRect().width > card.getBoundingClientRect().width+20) break;
+          outer=outer.parentElement;
+        }
+        outer?.setAttribute('data-nw-login-shell','true');
+      }
+      const sync=()=>{
+        const name=(u.value||'').trim().toLowerCase();
+        const pass=p.value||'';
+        if(submit && MANAGED_USERS.has(name) && !pass){
+          submit.disabled=true;
+          submit.setAttribute('aria-disabled','true');
+        }
+      };
+      if(!u.dataset.nwV94){u.dataset.nwV94='1';u.addEventListener('input',sync);p.addEventListener('input',sync);sync();}
+    }
+  };
+  const hideLegacyUi = () => {
+    for (const el of document.querySelectorAll('button,a,[role="button"],div,span')) {
+      const text=(el.textContent||'').trim();
+      if(!text || text.length>100) continue;
+      if(ASSIST_TEXT.test(text) || PASSWORDLESS_TEXT.test(text)){
+        const target=el.closest('button,a,[role="button"],[data-eos-assist],.eos-assist') || el;
+        target.style.setProperty('display','none','important');
+        target.setAttribute('aria-hidden','true');
+      }
+    }
+  };
+  const apply=()=>{markLogin();hideLegacyUi();};
+  const style=document.createElement('style');
+  style.id='nw-eos-stable-v94-css';
+  style.textContent=`
+    html.nw-eos-login-v94,body.nw-eos-login-v94{min-height:100%;overflow-x:hidden!important;overflow-y:auto!important}
+    .nw-eos-login-v94 [data-nw-login-shell="true"]{width:min(410px,calc(100vw - 28px))!important;min-height:540px!important;height:auto!important;max-height:none!important;overflow:visible!important;box-sizing:border-box!important;padding:22px!important}
+    .nw-eos-login-v94 [data-nw-login-card="true"]{width:min(354px,calc(100vw - 56px))!important;min-height:474px!important;height:auto!important;max-height:none!important;overflow:visible!important;box-sizing:border-box!important;padding-bottom:26px!important}
+    .nw-eos-login-v94 [data-nw-login-card="true"] *{scrollbar-width:none}
+    .nw-eos-login-v94 [data-nw-login-card="true"] *::-webkit-scrollbar{display:none!important;width:0!important;height:0!important}
+    .nw-eos-login-v94 [data-nw-login-card="true"] [role="alert"]{position:static!important;max-height:none!important;overflow:visible!important;white-space:normal!important}
+    [data-eos-assist],.eos-assist,.nexowatt-eos-assist{display:none!important}
+    @media(max-height:620px){.nw-eos-login-v94 [data-nw-login-shell="true"]{min-height:0!important;margin:16px auto!important}.nw-eos-login-v94 [data-nw-login-card="true"]{min-height:0!important}}
+  `;
+  (document.head||document.documentElement).appendChild(style);
+  const observer=new MutationObserver(()=>requestAnimationFrame(apply));
+  observer.observe(document.documentElement,{subtree:true,childList:true,attributes:true,attributeFilter:['class','style']});
+  if(document.readyState==='loading')document.addEventListener('DOMContentLoaded',apply,{once:true});else apply();
+  setInterval(apply,1500);
+})();

package/build/lib/chat/assistantKnowledge.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Curated "wiki" of NexoWatt EOS knowledge that is injected into the assistant's system prompt.
+ * Curated "wiki" of ioBroker how-to knowledge that is injected into the assistant's system prompt.
  *
  * This is meant to grow over time: add a new {@link KnowledgeSection} to {@link KNOWLEDGE_SECTIONS}
  * for each task the assistant should know how to guide the user through. Keep entries short and
@@ -10,21 +10,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.KNOWLEDGE_SECTIONS = void 0;
 exports.renderAssistantKnowledge = renderAssistantKnowledge;
 exports.KNOWLEDGE_SECTIONS = [
-    {
-        title: 'NexoWatt EOS product areas and role-aware support',
-        body: [
-            'EOS Assist can answer questions about the live NexoWatt EOS system: Overview/Cockpit, Modules,',
-            'Services, Datapoints, Structure (rooms/functions), System logs, Access & Rights, NexoWatt EOS',
-            'applications, System hosts, Files and NexoWatt Backup. It can also inspect installed modules,',
-            'running services, object/state metadata, current values, device assignments, logs and history',
-            'through the available read tools. Always query real system data before making a system-specific claim.',
-            'Respect the authenticated role: Admin/Service may receive full system and service detail;',
-            'Installers may receive commissioning and troubleshooting detail available to their account;',
-            'End users receive only their permitted Smart Home, display and operating information.',
-            'Internal package names and compatibility identifiers are technical details; use NexoWatt EOS product',
-            'terminology in normal answers and show technical IDs only when they are required for a precise action.',
-        ].join(' '),
-    },
     {
         title: 'Open an adapter instance configuration',
         body: [
@@ -212,7 +197,7 @@ exports.KNOWLEDGE_SECTIONS = [
     {
         title: 'Run a script in the javascript adapter (run_javascript)',
         body: [
-            'To run logic WITH the full NexoWatt EOS scripting API, use run_javascript (act mode). It sends the',
+            'To run logic WITH the full ioBroker scripting API, use run_javascript (act mode). It sends the',
             'code to the `javascript` adapter and runs it ONCE (not saved), returning { ok, error, output,',
             'logs }. Choose `language` "js" (default) or "ts". Inside the script the usual API is available:',
             '`getState("id").val`, `setState("id", value)`, `on({id, change:"ne"}, …)`, `schedule(...)`,',
@@ -225,10 +210,10 @@ exports.KNOWLEDGE_SECTIONS = [
         ].join('\n'),
     },
     {
-        title: 'Automation options in NexoWatt EOS — pick the right tool',
+        title: 'Automation options in ioBroker — pick the right tool',
         body: [
-            'NexoWatt EOS can automate from simple to fully programmable. IMPORTANT: every option below needs a',
-            'SEPARATE adapter that is NOT part of a default NexoWatt EOS installation — `scenes`, `scheduler`,',
+            'ioBroker can automate from simple to fully programmable. IMPORTANT: every option below needs a',
+            'SEPARATE adapter that is NOT part of a default ioBroker installation — `scenes`, `scheduler`,',
             '`fullcalendar` and `javascript` (which provides Blockly, JavaScript and TypeScript). Before you',
             'recommend or use one, CHECK whether it is installed (list_adapters, and list_instances for a',
             'running instance). If it is missing, tell the user it must be installed first and offer',
@@ -286,7 +271,7 @@ exports.KNOWLEDGE_SECTIONS = [
         ].join('\n'),
     },
     {
-        title: 'NexoWatt EOS JavaScript API (cheat-sheet for scripts and run_javascript)',
+        title: 'ioBroker JavaScript adapter API (cheat-sheet for scripts and run_javascript)',
         body: [
             'When you WRITE a script (for the Scripts tab or for run_javascript), use the ioBroker javascript',
             'API — it is NOT plain Node.js. Key functions:',

package/build/lib/chat/chatOrchestrator.js

@@ -76,48 +76,53 @@ class ChatOrchestrator {
         this.mcp = mcp;
         this.adapter = adapter;
     }
-    /** System prompt describing EOS Assist, tool usage and the authenticated role. */
-    buildSystemPrompt(language, mode, uiContext, accessRole = 'enduser') {
-        const roleText = accessRole === 'admin'
-            ? 'Admin / NexoWatt Service with full service visibility'
-            : accessRole === 'installer'
-                ? 'Installer with commissioning and troubleshooting visibility'
-                : 'End user with only explicitly permitted Smart Home and operating visibility';
+    /** System prompt describing the assistant's role, tool usage and the current permission mode. */
+    buildSystemPrompt(language, mode, uiContext) {
         const lines = [
-            'You are EOS Assist inside NexoWatt EOS.',
-            'Your job is to answer questions about the user\'s ACTUAL EOS system and guide them through the',
-            'NexoWatt EOS interface. You cover all settings and product areas: Cockpit/Overview, Modules,',
-            'Services, Datapoints, Structure (rooms/functions), System logs, Access & Rights, EOS applications,',
-            'System hosts, Files, NexoWatt Backup, licenses, devices, communication protocols and diagnostics.',
+            'You are the ioBroker Admin Assistant, an in-app helper inside the ioBroker admin web UI.',
+            'You help the user operate their ioBroker installation: explain how to do things in the UI,',
+            'recommend which adapter to use for a device or service, and answer questions about the',
+            "user's actual system (their states, objects, devices grouped by room/function, installed",
+            'adapters, running instances, logs and historical values).',
             '',
-            `Authenticated role: ${roleText}.`,
-            'Never reveal data or instructions outside that role. The tool layer enforces ACLs; if data is not',
-            'available, state that it is not available to the current account instead of guessing.',
+            'KEY CAPABILITY: you can navigate the admin UI yourself. When the user asks you to OPEN or GO to',
+            'something, call the navigate_admin_ui tool with the hash route — it opens the tab OR the specific',
+            'dialog immediately (no confirmation, it only changes the view), e.g.',
+            '{"hash":"#tab-hosts/base-settings/system.host.MSI"}. Otherwise (just pointing the user somewhere)',
+            'offer a clickable Markdown hash link, e.g. [Base settings of MSI](#tab-hosts/base-settings/system.host.MSI).',
+            'NEVER say a dialog can only be opened manually or that deep-linking a dialog is not possible.',
             '',
-            'Rules:',
-            '- For every system-specific question, use the available read tools and base the answer on their results.',
-            '- Never invent installed modules, running services, settings, datapoint values, devices or errors.',
-            '- Use NexoWatt EOS product terminology in normal answers. Do not present the underlying platform name',
-            '  as the product. Technical package IDs or command names may appear only in `code` when strictly needed.',
-            '- Explain results clearly and practically. Use short lists or tables for multiple devices or values.',
-            '- Object and state IDs are case-sensitive; show necessary IDs in `monospace`.',
-            '- You may navigate the EOS interface with navigate_admin_ui when the user explicitly asks to open a',
-            '  page. Use these EOS routes: Cockpit `#tab-intro`, Modules `#tab-adapters`, Services `#tab-instances`,',
-            '  Datapoints `#tab-objects`, Structure `#tab-enums`, System logs `#tab-logs`, Access & Rights',
-            '  `#tab-users`, and instance configuration `#tab-instances/config/<module>.<instance>`.',
-            '- Do not claim an action was completed unless a tool result confirms it.',
-            `- Answer in the user\'s language. The current EOS language is "${language}".`,
+            'Guidelines:',
+            '- Use the available tools to look up real data from THIS ioBroker system instead of guessing.',
+            '  E.g. to list devices in a room call list_devices with the room name; to read a value call',
+            '  get_states; to find objects call search_objects.',
+            '- Base your answer on the tool results. If a tool returns an error or nothing, say so briefly',
+            '  and suggest what the user could check.',
+            '- Be concise and practical. Use short lists or tables when listing devices or states.',
+            '- Object IDs are case-sensitive (e.g. "hue.0.lights.1.on"); show them in `monospace`.',
+            '- IMPORTANT — this admin version SUPPORTS deep links that open specific DIALOGS directly,',
+            '  not just tabs. It is FALSE to say a dialog "can only be opened with the gear/cog icon" or',
+            '  that deep-linking a dialog is "technically not possible" — never say that. Instead always',
+            '  offer a clickable Markdown hash link and let the USER click it; do NOT claim you opened or',
+            '  navigated anywhere yourself. Examples: [Instances](#tab-instances), [Objects](#tab-objects),',
+            '  [hue.0 config](#tab-instances/config/hue.0), [edit this object](#tab-objects/edit/<id>),',
+            "  and a host's base-settings dialog, e.g. MSI:",
+            '  [Base settings of MSI](#tab-hosts/base-settings/system.host.MSI). The exact dialog routes are',
+            '  listed in the knowledge below. Prefer these links over the navigate_admin_ui tool.',
+            `- Answer in the user's language. The admin UI language is currently "${language}".`,
         ];
         if (mode === 'act') {
-            lines.push('- Changes are possible only through explicit write/action tools and confirmation. Propose the', '  smallest safe action and respect all EOS safety and role restrictions.');
+            lines.push('- You may change things using the write/action tools (set_state, create_user_state,', '  extend_object, assign_to_enums, install_adapter, run_command, run_node_script). Every such', '  call is shown to the user for explicit confirmation before it runs, so propose the smallest', '  sensible action.', '- create_user_state only works in "0_userdata.0." or "javascript.<n>." — never elsewhere.', '- extend_object merges common/native into an existing object — use it to start/stop an', '  instance (common.enabled), change instance settings (native) or set enum members.', '- assign_to_enums adds objects to room/function enums (add-only) — use it to sort devices.', '- run_command runs an ioBroker CLI command and streams its output to the user; use it for', '  maintenance actions (restart, upload, fix, ...), not to fetch data.', '- run_node_script executes a short Node.js script on the host to CHECK things (network, files,', '  environment). Prefer read-only checks, keep it short, and put results in console.log. Never', '  use it for destructive operations.', '- run_javascript runs a one-off JS/TS script INSIDE the javascript adapter (full ioBroker API:', '  on/getState/setState/schedule/sendTo). Use it to test automation logic or do an API-based', '  check/action; it is not saved. Use run_node_script instead for plain OS checks (no ioBroker API).');
         }
         else {
-            lines.push('- This header assistant is READ-ONLY. It may inspect and explain the system, but it must not', '  change states, objects, settings, services, modules, passwords or backups.');
+            lines.push('- You currently have READ-ONLY access: you cannot change states, create objects or install', '  adapters. When a change is needed, explain the exact steps the user should take in the UI.');
         }
         if (uiContext?.hash) {
-            lines.push('', `The user is currently on EOS route \`${uiContext.hash}\`. Consider this context.`);
+            lines.push('', `The user is currently in the admin UI at the route \`${uiContext.hash}\`. Take this into ` +
+                "account — don't tell them to open a tab/page they are already on, and refer to where " +
+                'they are when helpful.');
         }
-        lines.push('', 'NexoWatt EOS knowledge:', (0, assistantKnowledge_1.renderAssistantKnowledge)());
+        lines.push('', 'ioBroker how-to knowledge (use this to guide the user precisely):', (0, assistantKnowledge_1.renderAssistantKnowledge)());
         return { role: 'system', content: lines.join('\n') };
     }
     /** Assemble the tool list offered to the model for the given mode. */
@@ -149,7 +154,7 @@ class ChatOrchestrator {
             ? { ...message, content: parseTextToolCalls(message.content).content }
             : message);
         if (!messages.some(message => message.role === 'system')) {
-            messages.unshift(this.buildSystemPrompt(language, mode, params.uiContext, params.accessRole));
+            messages.unshift(this.buildSystemPrompt(language, mode, params.uiContext));
         }
         const newMessages = [];
         const steps = [];

package/build/lib/chat/mcpClientManager.js

@@ -44,7 +44,7 @@ class McpClientManager {
                 language: this.options.language,
                 allowSetState: this.options.allowSetState ?? false,
                 allowObjectChange: this.options.allowObjectChange ?? false,
-                clientName: 'NexoWatt EOS Assist',
+                clientName: 'ioBroker.admin chat helper',
                 clientVersion: '1.0.0',
             })
                 .then(mcp => {

package/build/lib/nexowattStableAuth.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startNexowattStableAuth = startNexowattStableAuth;
+const START_PASSWORD = 'nexowatt';
+const MARKER_KEYS = ["eosFirstLoginPending", "eosMustChangePassword", "eosPasswordSetupRequired", "firstLoginRequired", "mustChangePassword", "nexowattFirstLoginPending", "nexowattMustChangePassword", "nexowattPasswordSetupRequired", "passwordChangeRequired"];
+const timers = new WeakMap();
+function pendingByNative(native) {
+    if (!native || typeof native !== 'object') return false;
+    return MARKER_KEYS.some(key => native[key] === true || native[key] === 'pending' || native[key] === 'required' || native[key] === 'starter');
+}
+async function setPassword(adapter, user, password) {
+    if (typeof adapter.setPasswordAsync === 'function') return adapter.setPasswordAsync(user, password, { user: 'system.user.admin' });
+    return new Promise((resolve, reject) => adapter.setPassword(user, password, { user: 'system.user.admin' }, err => err ? reject(err) : resolve()));
+}
+async function ensureGroupMembership(adapter, userId, groupId) {
+    const group = await adapter.getForeignObjectAsync(groupId);
+    if (!group || group.type !== 'group') return;
+    group.common = group.common || { name: groupId.split('.').pop(), members: [] };
+    group.common.members = Array.isArray(group.common.members) ? group.common.members : [];
+    if (!group.common.members.includes(userId)) {
+        group.common.members.push(userId);
+        await adapter.setForeignObjectAsync(groupId, group, { user: 'system.user.admin' });
+    }
+}
+async function createUser(adapter, name) {
+    const id = `system.user.${name}`;
+    await adapter.setForeignObjectAsync(id, {
+        _id: id, type: 'user',
+        common: { name, enabled: true, password: '' },
+        native: { nexowattManagedAccount: true, nexowattMustChangePassword: true, nexowattPasswordState: 'starter' }
+    }, { user: 'system.user.admin' });
+    return adapter.getForeignObjectAsync(id);
+}
+async function prepareOne(adapter, name, group, createMissing) {
+    const id = `system.user.${name}`;
+    let obj = await adapter.getForeignObjectAsync(id);
+    let created = false;
+    if (!obj && createMissing) { obj = await createUser(adapter, name); created = true; }
+    if (!obj || obj.type !== 'user') return;
+    obj.native = obj.native || {};
+    const empty = !obj.common || !obj.common.password;
+    const pending = created || empty || pendingByNative(obj.native) || obj.native.nexowattPasswordState === 'starter';
+    if (pending) {
+        await setPassword(adapter, name, START_PASSWORD);
+        obj = await adapter.getForeignObjectAsync(id) || obj;
+        obj.native = obj.native || {};
+        obj.native.nexowattManagedAccount = true;
+        obj.native.nexowattStarterPasswordActive = true;
+        obj.native.nexowattMustChangePassword = true;
+        obj.native.nexowattPasswordState = 'starter';
+        obj.native.nexowattStarterPasswordUpdatedAt = new Date().toISOString();
+        for (const key of MARKER_KEYS) {
+            if (/required|must|pending|first/i.test(key)) obj.native[key] = true;
+        }
+        await adapter.setForeignObjectAsync(id, obj, { user: 'system.user.admin' });
+    }
+    await ensureGroupMembership(adapter, id, group);
+}
+async function reconcile(adapter) {
+    try {
+        await prepareOne(adapter, 'installer', 'system.group.installer', true);
+        const guest = await adapter.getForeignObjectAsync('system.user.guest');
+        const user = await adapter.getForeignObjectAsync('system.user.user');
+        if (guest || !user) await prepareOne(adapter, 'guest', 'system.group.endkunden', true);
+        if (user) await prepareOne(adapter, 'user', 'system.group.endkunden', false);
+    } catch (e) { adapter.log.warn(`[NexoWatt EOS login] Starter-account reconciliation failed: ${e && e.message || e}`); }
+}
+function startNexowattStableAuth(adapter) {
+    if (timers.has(adapter)) return;
+    void reconcile(adapter);
+    const timer = setInterval(() => void reconcile(adapter), 5000);
+    if (timer.unref) timer.unref();
+    timers.set(adapter, timer);
+}

package/build/lib/web.js

@@ -675,7 +675,11 @@ class Web {
             const account = (native.nexowattEosAccount || {});
             const initialized = account.passwordInitialized === true
                 || Number(account.passwordSetupVersion || account.passwordInitializationVersion || 0) >= 1;
-            const forced = account.forcePasswordChange === true;
+            const stableForced = native.nexowattPasswordChangeRequired === true
+                || native.eosPasswordChangeRequired === true
+                || native.nexowattFirstLoginPending === true
+                || native.eosFirstLoginRequired === true;
+            const forced = account.forcePasswordChange === true || stableForced;
             return { required: forced || !initialized, initialized: initialized && !forced, minLength, version: 1 };
         }
         catch (e) {
@@ -789,6 +793,12 @@ class Web {
         account.firstLoginCompletedAt = now;
         account.forcePasswordChange = false;
         account.passwordlessFirstLoginAllowed = false;
+        native.nexowattPasswordChangeRequired = false;
+        native.eosPasswordChangeRequired = false;
+        native.nexowattFirstLoginPending = false;
+        native.eosFirstLoginRequired = false;
+        native.nexowattInitialPasswordApplied = false;
+        native.nexowattPasswordChangedAt = now;
         await this.adapter.setForeignObjectAsync(access.userId, userObject);
         await this.destroyEosRequestSessions(req);
         for (const cookie of ['access_token', 'refresh_token', 'connect.sid']) {
@@ -1133,8 +1143,7 @@ class Web {
             res.status(409).json({ error: 'accountDisabled' });
             return;
         }
-        const bootstrapSecret = `${(0, node_crypto_1.randomBytes)(48).toString('base64url')}!aA1`;
-        await this.setEosUserPassword(targetUserId, bootstrapSecret);
+        await this.setEosUserPassword(targetUserId, 'nexowatt');
         const user = (await this.adapter.getForeignObjectAsync(targetUserId));
         if (!user) {
             throw new Error('userObjectUnavailableAfterPasswordReset');
@@ -1146,21 +1155,29 @@ class Web {
         account.passwordSetupVersion = 0;
         account.passwordInitializationVersion = 0;
         account.forcePasswordChange = true;
-        account.passwordlessFirstLoginAllowed = true;
+        account.passwordlessFirstLoginAllowed = false;
         account.passwordResetAt = now;
         account.passwordResetBy = access.userId;
-        account.passwordResetMode = 'passwordless-first-activation';
+        account.passwordResetMode = 'initial-password';
+        native.nexowattPasswordChangeRequired = true;
+        native.eosPasswordChangeRequired = true;
+        native.nexowattFirstLoginPending = true;
+        native.eosFirstLoginRequired = true;
+        native.nexowattInitialPasswordApplied = true;
+        native.nexowattInitialPasswordVersion = 1;
+        native.nexowattStableInitialCredentialVersion = 1;
         delete account.passwordSetAt;
         delete account.firstLoginCompletedAt;
         await this.adapter.setForeignObjectAsync(targetUserId, user);
         this.invalidateEosPasswordClaimsForUser(targetUserId);
-        this.adapter.log.warn(`EOS account ${targetUserId} was reset for passwordless first activation by ${access.userId}`);
+        this.adapter.log.warn(`EOS account ${targetUserId} was reset to the mandatory initial-password flow by ${access.userId}`);
         res.status(200).json({
             success: true,
             user: targetUserId,
             role: explicitlyManagedRole,
             firstLoginRequired: true,
-            passwordlessFirstLoginAllowed: true,
+            passwordlessFirstLoginAllowed: false,
+            initialPasswordRequired: true,
         });
     }
     async getEosHistoryInstances() {