iobroker.eos-admin 7.9.97 → 7.9.98

package/build/lib/web.js

@@ -713,22 +713,53 @@ class Web {
         }
         return { valid: true, password: value };
     }
+    getEosPasswordUserName(userId) {
+        const userName = String(userId || '').trim().replace(/^system\.user\./, '');
+        if (!/^[A-Za-z0-9_.@-]+$/.test(userName)) {
+            throw new Error('invalidPasswordTarget');
+        }
+        return userName;
+    }
     async setEosUserPassword(userId, password) {
-        // The authenticated route is strictly self-service: the target user comes from the current
-        // session and cannot be supplied by the browser. Use the trusted EOS service context for the
-        // actual password write so installer/end-user groups do not need global users.write rights.
+        // ioBroker's password API expects the account name, not the system.user.* object id.
+        const userName = this.getEosPasswordUserName(userId);
+        // The server-side Admin/Service context performs the controller password write, so managed
+        // Installer and End User accounts do not need global users.write rights in the browser.
         const options = { user: EOS_PASSWORD_SERVICE_USER };
         if (typeof this.adapter.setPasswordAsync === 'function') {
-            await this.adapter.setPasswordAsync(userId, password, options);
-            return;
+            await this.adapter.setPasswordAsync(userName, password, options);
         }
-        if (typeof this.adapter.setPassword === 'function') {
+        else if (typeof this.adapter.setPassword === 'function') {
             await new Promise((resolve, reject) => {
-                this.adapter.setPassword?.(userId, password, options, error => (error ? reject(error) : resolve()));
+                this.adapter.setPassword?.(userName, password, options, error => (error ? reject(error) : resolve()));
             });
+        }
+        else {
+            throw new Error('passwordApiUnavailable');
+        }
+        if (typeof this.adapter.checkPasswordAsync === 'function') {
+            const result = await this.adapter.checkPasswordAsync(userName, password, options);
+            const valid = Array.isArray(result) ? result[0] === true : result === true;
+            if (!valid) {
+                throw new Error('passwordVerificationFailed');
+            }
             return;
         }
-        throw new Error('passwordApiUnavailable');
+        const userObject = (await this.adapter.getForeignObjectAsync(userId));
+        if (!String(userObject?.common?.password || '').trim()) {
+            throw new Error('passwordWriteFailed');
+        }
+    }
+    async updateEosAccountMetadata(userId, updater) {
+        const userObject = (await this.adapter.getForeignObjectAsync(userId));
+        if (!userObject) {
+            throw new Error('userObjectUnavailableAfterPasswordChange');
+        }
+        const native = { ...(userObject.native || {}) };
+        const account = { ...(native.nexowattEosAccount || {}) };
+        native.nexowattEosAccount = account;
+        updater(native, account);
+        await this.adapter.extendForeignObjectAsync(userId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
     }
     async destroyEosRequestSessions(req) {
         const token = this.readAccessTokenFromRequest(req);
@@ -777,29 +808,24 @@ class Web {
             return;
         }
         await this.setEosUserPassword(access.userId, validation.password);
-        const userObject = (await this.adapter.getForeignObjectAsync(access.userId));
-        if (!userObject) {
-            throw new Error('userObjectUnavailableAfterPasswordChange');
-        }
-        const native = (userObject.native ||= {});
-        const account = (native.nexowattEosAccount ||= {});
         const now = new Date().toISOString();
-        account.passwordInitialized = true;
-        account.passwordInitializedAt = Date.now();
-        account.passwordInitializationVersion = 1;
-        account.passwordInitializedBy = 'self';
-        account.passwordSetupVersion = 1;
-        account.passwordSetAt = now;
-        account.firstLoginCompletedAt = now;
-        account.forcePasswordChange = false;
-        account.passwordlessFirstLoginAllowed = false;
-        native.nexowattPasswordChangeRequired = false;
-        native.eosPasswordChangeRequired = false;
-        native.nexowattFirstLoginPending = false;
-        native.eosFirstLoginRequired = false;
-        native.nexowattInitialPasswordApplied = false;
-        native.nexowattPasswordChangedAt = now;
-        await this.adapter.setForeignObjectAsync(access.userId, userObject);
+        await this.updateEosAccountMetadata(access.userId, (native, account) => {
+            account.passwordInitialized = true;
+            account.passwordInitializedAt = Date.now();
+            account.passwordInitializationVersion = 1;
+            account.passwordInitializedBy = 'self';
+            account.passwordSetupVersion = 1;
+            account.passwordSetAt = now;
+            account.firstLoginCompletedAt = now;
+            account.forcePasswordChange = false;
+            account.passwordlessFirstLoginAllowed = false;
+            native.nexowattPasswordChangeRequired = false;
+            native.eosPasswordChangeRequired = false;
+            native.nexowattFirstLoginPending = false;
+            native.eosFirstLoginRequired = false;
+            native.nexowattInitialPasswordApplied = false;
+            native.nexowattPasswordChangedAt = now;
+        });
         await this.destroyEosRequestSessions(req);
         for (const cookie of ['access_token', 'refresh_token', 'connect.sid']) {
             res.clearCookie(cookie);
@@ -1023,24 +1049,25 @@ class Web {
             return;
         }
         await this.setEosUserPassword(claim.userId, validation.password);
-        const user = (await this.adapter.getForeignObjectAsync(claim.userId));
-        if (!user) {
-            throw new Error('userObjectUnavailableAfterPasswordChange');
-        }
-        const native = (user.native ||= {});
-        const account = (native.nexowattEosAccount ||= {});
         const now = new Date().toISOString();
-        account.passwordInitialized = true;
-        account.passwordInitializedAt = Date.now();
-        account.passwordInitializationVersion = 1;
-        account.passwordInitializedBy = 'passwordless-first-activation';
-        account.passwordSetupVersion = 1;
-        account.passwordSetAt = now;
-        account.firstLoginCompletedAt = now;
-        account.forcePasswordChange = false;
-        account.passwordlessFirstLoginAllowed = false;
-        account.passwordlessClaimCompletedAt = now;
-        await this.adapter.setForeignObjectAsync(claim.userId, user);
+        await this.updateEosAccountMetadata(claim.userId, (native, account) => {
+            account.passwordInitialized = true;
+            account.passwordInitializedAt = Date.now();
+            account.passwordInitializationVersion = 1;
+            account.passwordInitializedBy = 'passwordless-first-activation';
+            account.passwordSetupVersion = 1;
+            account.passwordSetAt = now;
+            account.firstLoginCompletedAt = now;
+            account.forcePasswordChange = false;
+            account.passwordlessFirstLoginAllowed = false;
+            account.passwordlessClaimCompletedAt = now;
+            native.nexowattPasswordChangeRequired = false;
+            native.eosPasswordChangeRequired = false;
+            native.nexowattFirstLoginPending = false;
+            native.eosFirstLoginRequired = false;
+            native.nexowattInitialPasswordApplied = false;
+            native.nexowattPasswordChangedAt = now;
+        });
         this.invalidateEosPasswordClaimsForUser(claim.userId);
         res.clearCookie('nexowatt_eos_first_login', { path: '/nexowatt/account' });
         this.adapter.log.info(`EOS passwordless first activation completed for ${claim.userId}`);
@@ -1106,13 +1133,14 @@ class Web {
     async resetEosAccountPassword(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
         const access = await this.getEosRequestAccess(req);
-        if (!access.userId
-            || (access.role !== 'admin' && access.role !== 'installer')
-            || !this.isEosSameOriginWrite(req)
-            || req.headers['x-nexowatt-eos-account-reset'] !== '1') {
+        if (!access.userId || (access.role !== 'admin' && access.role !== 'installer')) {
             res.status(403).json({ error: 'permissionError' });
             return;
         }
+        if (!this.isEosSameOriginWrite(req) || req.headers['x-nexowatt-eos-account-reset'] !== '1') {
+            res.status(403).json({ error: 'invalidRequestOrigin' });
+            return;
+        }
         const targetUserId = this.normalizeEosUserId(req.body?.user);
         if (!targetUserId || targetUserId === 'system.user.admin' || targetUserId === access.userId) {
             res.status(400).json({ error: 'invalidTarget' });
@@ -1144,31 +1172,26 @@ class Web {
             return;
         }
         await this.setEosUserPassword(targetUserId, 'nexowatt');
-        const user = (await this.adapter.getForeignObjectAsync(targetUserId));
-        if (!user) {
-            throw new Error('userObjectUnavailableAfterPasswordReset');
-        }
-        const native = (user.native ||= {});
-        const account = (native.nexowattEosAccount ||= {});
         const now = new Date().toISOString();
-        account.passwordInitialized = false;
-        account.passwordSetupVersion = 0;
-        account.passwordInitializationVersion = 0;
-        account.forcePasswordChange = true;
-        account.passwordlessFirstLoginAllowed = false;
-        account.passwordResetAt = now;
-        account.passwordResetBy = access.userId;
-        account.passwordResetMode = 'initial-password';
-        native.nexowattPasswordChangeRequired = true;
-        native.eosPasswordChangeRequired = true;
-        native.nexowattFirstLoginPending = true;
-        native.eosFirstLoginRequired = true;
-        native.nexowattInitialPasswordApplied = true;
-        native.nexowattInitialPasswordVersion = 1;
-        native.nexowattStableInitialCredentialVersion = 1;
-        delete account.passwordSetAt;
-        delete account.firstLoginCompletedAt;
-        await this.adapter.setForeignObjectAsync(targetUserId, user);
+        await this.updateEosAccountMetadata(targetUserId, (native, account) => {
+            account.passwordInitialized = false;
+            account.passwordSetupVersion = 0;
+            account.passwordInitializationVersion = 0;
+            account.forcePasswordChange = true;
+            account.passwordlessFirstLoginAllowed = false;
+            account.passwordResetAt = now;
+            account.passwordResetBy = access.userId;
+            account.passwordResetMode = 'initial-password';
+            account.passwordSetAt = null;
+            account.firstLoginCompletedAt = null;
+            native.nexowattPasswordChangeRequired = true;
+            native.eosPasswordChangeRequired = true;
+            native.nexowattFirstLoginPending = true;
+            native.eosFirstLoginRequired = true;
+            native.nexowattInitialPasswordApplied = true;
+            native.nexowattInitialPasswordVersion = 1;
+            native.nexowattStableInitialCredentialVersion = 1;
+        });
         this.invalidateEosPasswordClaimsForUser(targetUserId);
         this.adapter.log.warn(`EOS account ${targetUserId} was reset to the mandatory initial-password flow by ${access.userId}`);
         res.status(200).json({
@@ -1245,14 +1268,24 @@ class Web {
         });
     }
     isEosSameOriginWrite(req) {
+        const fetchSite = String(req.headers['sec-fetch-site'] || '').trim().toLowerCase();
+        if (fetchSite === 'cross-site') {
+            return false;
+        }
         const origin = String(req.headers.origin || '').trim();
         if (!origin) {
             return true;
         }
-        const forwardedProto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim();
-        const protocol = forwardedProto || (this.settings.secure ? 'https' : 'http');
-        const host = String(req.headers.host || '').trim();
-        return !!host && origin === `${protocol}://${host}`;
+        try {
+            const originUrl = new URL(origin);
+            const directHost = String(req.headers.host || '').trim().toLowerCase();
+            const forwardedHost = String(req.headers['x-forwarded-host'] || '').split(',')[0].trim().toLowerCase();
+            const allowedHosts = new Set([directHost, forwardedHost].filter(Boolean));
+            return allowedHosts.has(originUrl.host.toLowerCase());
+        }
+        catch {
+            return false;
+        }
     }
     async saveEosBasicSettings(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');

package/build/main.js

@@ -1152,7 +1152,7 @@ class Admin extends adapter_core_1.Adapter {
         }
         if (String(user.common.password || '') === '') {
             const bootstrapSecret = `${(0, node_crypto_1.randomBytes)(48).toString('base64url')}!aA1`;
-            await this.setPasswordAsync(userId, bootstrapSecret, { user: ADMIN_OWNER_USER });
+            await this.setPasswordAsync(userId.replace(/^system\.user\./, ''), bootstrapSecret, { user: ADMIN_OWNER_USER });
             user = (await this.getForeignObjectAsync(userId));
             if (!user) {
                 return;

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.9.97",
+    "version": "7.9.98",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,6 +18,11 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
+      "7.9.98": {
+        "de": "Stable-Kandidat 7.9.98 ergänzt den vertikalen Cockpit-Scrollbereich, bereinigt die Login-Felder und korrigiert Passwort-Reset sowie persönliche Erstpasswortvergabe über die echte ioBroker-Passwort-API.",
+        "en": "Stable candidate 7.9.98 adds vertical cockpit scrolling, cleans up login fields and fixes password reset plus first personal password setup through the real ioBroker password API.",
+        "nl": "Stable-kandidaat 7.9.98 voegt verticaal scrollen in het cockpit toe, herstelt de loginvelden en corrigeert wachtwoordreset en het eerste persoonlijke wachtwoord via de echte ioBroker-wachtwoord-API."
+      },
       "7.9.95": {
         "de": "Stable 7.9.95 macht den Release-Ordner mergesicher: Die flache Update-ZIP kann direkt über einen bestehenden Arbeitsordner entpackt werden. Vor Paketprüfung und npm-Veröffentlichung werden package.json, io-package.json, beide Lockdateien, die Frontend-Version, Build-Informationen und der aktuelle Repository-Eintrag automatisch auf dieselbe Version gebracht. Dadurch wird insbesondere ein stehen gebliebenes io-package.json aus 7.9.92/7.9.94 automatisch repariert. Die Funktionen aus 7.9.94 bleiben unverändert.",
         "en": "Stable 7.9.95 makes the release folder merge-safe: the flat update ZIP can be extracted directly over an existing working directory. Before package validation and npm publishing, package.json, io-package.json, both lockfiles, the frontend version, build information and the current repository entry are synchronized automatically. In particular, a stale io-package.json from 7.9.92/7.9.94 is repaired automatically. Functional behavior from 7.9.94 remains unchanged.",
@@ -329,7 +334,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.97/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.98/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -340,7 +345,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.97/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.98/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -408,7 +413,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.97/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.98/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1117,5 +1122,5 @@
       }
     }
   },
-  "version": "7.9.97"
+  "version": "7.9.98"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin – stable sales release with orderly login, role-safe overview and live EMS diagnosis.",
-  "version": "7.9.97",
+  "description": "NexoWatt EOS Admin – stable sales candidate with scrollable cockpit, clean login and verified account password writes.",
+  "version": "7.9.98",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -118,19 +118,21 @@
     "tools/nexowatt-version-sync-selftest.cjs",
     "tools/nexowatt-merge-update-selftest.cjs",
     "tools/nexowatt-ems-overview-selftest.cjs",
-    "README_STABILITY_V7.9.97.md",
-    "RELEASE_NOTES_V7.9.97.md",
-    "PUBLISH_STABLE_V7.9.97.md",
-    "INSTALL_TEST_V7.9.97.md",
-    "RELEASE_ACCEPTANCE_V7.9.97.md",
-    "MERGE_UPDATE_README_V7.9.97.md",
+    "README_STABILITY_V7.9.98.md",
+    "RELEASE_NOTES_V7.9.98.md",
+    "PUBLISH_STABLE_V7.9.98.md",
+    "INSTALL_TEST_V7.9.98.md",
+    "RELEASE_ACCEPTANCE_V7.9.98.md",
+    "MERGE_UPDATE_README_V7.9.98.md",
     "README_EMS_OVERVIEW_MERGE.md",
     "RC73_EOS_ADMIN_MERGE_VALIDATION.md",
     "VALIDATION_EMS_OVERVIEW_MERGE.md",
     "NexoWatt_EOS_Admin_EMS_OVERVIEW_MERGE_VALIDATION.md",
     "tools/nexowatt-apply-ems-overview.cjs",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs",
-    "tools/nexowatt-stable-v97-selftest.cjs"
+    "tools/nexowatt-stable-v98-selftest.cjs",
+    "tools/nexowatt-password-write-selftest.cjs",
+    "tools/nexowatt-account-password-flow-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -165,7 +167,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && npm run check:eos-stable-v97 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v98 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -189,7 +191,7 @@
     "sync:eos-version": "node tools/nexowatt-sync-release-version.cjs",
     "test:eos-version-sync": "node tools/nexowatt-version-sync-selftest.cjs",
     "verify:eos-merge": "node tools/nexowatt-merge-update-selftest.cjs",
-    "check:eos-stable-v97": "node tools/nexowatt-stable-v97-selftest.cjs"
+    "check:eos-stable-v98": "node tools/nexowatt-stable-v98-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -200,7 +202,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.97"
+    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.98"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-account-management-selftest.cjs

@@ -1,60 +1,19 @@
 #!/usr/bin/env node
 'use strict';
-const fs = require('fs');
-const path = require('path');
-const root = path.resolve(__dirname, '..');
-const read = rel => fs.readFileSync(path.join(root, rel), 'utf8');
-const json = rel => JSON.parse(read(rel));
-let bad = false;
-const fail = msg => { console.error(`[NexoWatt EOS account management] ${msg}`); bad = true; };
-
-const mainSource = read('src/main.ts');
-const mainBuilt = read('build/main.js');
-const webSource = read('src/lib/web.ts');
-const webBuilt = read('build/lib/web.js');
-const sourceUi = read('src-admin/public/js/eos-account-management.js');
-const builtUi = read('adminWww/js/eos-account-management.js');
-const roleUi = read('adminWww/js/eos-role-ui.js');
-const css = read('adminWww/css/nexowatt-native-shell.css');
-const index = read('adminWww/index.html');
-const info = json('NEXOWATT_EOS_BUILD_INFO.json');
-const shellTag = String(info.shellCacheTag || info.shellCacheVersion);
-
-for (const code of [mainSource, mainBuilt]) {
-  for (const marker of [
-    'system.user.installer', 'system.user.guest', 'ensureEosDefaultRoleUsers', 'unknown random bootstrap secret',
-    'eosPasswordSetupRequired', 'personal password setup is required',
-  ]) if (!code.includes(marker)) fail(`main account marker missing: ${marker}`);
+const fs=require('fs');const path=require('path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const json=rel=>JSON.parse(read(rel));let bad=false;const fail=msg=>{console.error(`[NexoWatt EOS account management] ${msg}`);bad=true;};
+const mainSource=read('src/main.ts'),mainBuilt=read('build/main.js'),webSource=read('src/lib/web.ts'),webBuilt=read('build/lib/web.js'),sourceUi=read('src-admin/public/js/eos-account-management.js'),builtUi=read('adminWww/js/eos-account-management.js'),roleUi=read('adminWww/js/eos-role-ui.js'),css=read('adminWww/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),info=json('NEXOWATT_EOS_BUILD_INFO.json'),shellTag=String(info.shellCacheTag||info.shellCacheVersion);
+for(const code of [mainSource,mainBuilt])for(const marker of ['system.user.installer','system.user.guest','ensureEosDefaultRoleUsers','unknown random bootstrap secret','eosPasswordSetupRequired','personal password setup is required'])if(!code.includes(marker))fail(`main marker missing: ${marker}`);
+for(const code of [webSource,webBuilt]){
+ for(const marker of ['getEosManagedAccounts','sendEosAccountManagement','resetEosAccountPassword','/nexowatt/account/manage','/nexowatt/account/reset','x-nexowatt-eos-account-reset','canResetInstaller','canResetEndUser',"targetUserId === 'system.user.admin'",'targetUserId === access.userId',"access.role === 'installer' && explicitlyManagedRole !== 'enduser'",'passwordResetAt','passwordResetBy',"passwordResetMode = 'initial-password'","setEosUserPassword(targetUserId, 'nexowatt')",'passwordlessFirstLoginAllowed = false','initialPasswordRequired: true','accountDisabled','getEosPasswordUserName','setPasswordAsync(userName, password','checkPasswordAsync(userName, password','updateEosAccountMetadata','extendForeignObjectAsync','invalidRequestOrigin'])if(!code.includes(marker))fail(`web marker missing: ${marker}`);
+ if(!code.includes('const explicitInstaller = targetAccess.groups.some')||!code.includes('const explicitEndUser = targetAccess.groups.some'))fail('explicit managed-group guard missing');
+ const reset=code.slice(code.indexOf('resetEosAccountPassword'),code.indexOf('getEosHistoryInstances'));
+ if(reset.includes('setForeignObjectAsync(targetUserId'))fail('reset replaces the complete user object after password write');
 }
-for (const code of [webSource, webBuilt]) {
-  for (const marker of [
-    'getEosManagedAccounts', 'sendEosAccountManagement', 'resetEosAccountPassword',
-    '/nexowatt/account/manage', '/nexowatt/account/reset', 'x-nexowatt-eos-account-reset',
-    'canResetInstaller', 'canResetEndUser', "targetUserId === 'system.user.admin'", 'targetUserId === access.userId',
-    "access.role === 'installer' && explicitlyManagedRole !== 'enduser'",
-    'explicit member of a managed EOS installer/end-user group', 'passwordResetAt', 'passwordResetBy',
-    "passwordResetMode = 'initial-password'", "setEosUserPassword(targetUserId, 'nexowatt')", 'passwordlessFirstLoginAllowed = false', 'initialPasswordRequired: true', 'accountDisabled',
-  ]) if (!code.includes(marker)) fail(`web account marker missing: ${marker}`);
-  if (!code.includes('const explicitInstaller = targetAccess.groups.some')) fail('reset target is not restricted to explicit installer membership');
-  if (!code.includes('const explicitEndUser = targetAccess.groups.some')) fail('reset target is not restricted to explicit end-user membership');
-}
-
-for (const marker of [
-  'v91-account-management-under-access-rights', "['admin', 'installer']", 'nexowatt/account/manage',
-  'nexowatt/account/reset', 'X-NexoWatt-EOS-Account-Reset', 'data.canResetInstaller === true',
-  "account.role === 'enduser'", 'Admin/Service', 'Installateure', 'NEXOWATT_EOS_ACCOUNT_MANAGEMENT',
-  'ensureEntrySurface', "currentRoute() !== 'tab-users'", 'eos-account-management-entry',
-]) if (!sourceUi.includes(marker)) fail(`account UI marker missing: ${marker}`);
-if (sourceUi.includes("launcher.className = 'eos-account-management-launcher'")) fail('standalone account launcher is still created');
-if (sourceUi.includes('new MutationObserver')) fail('account management adds a second broad MutationObserver');
-if (sourceUi !== builtUi) fail('account management source/build drift');
-if (!roleUi.includes("route === 'tab-users'")) fail('installer cannot reach Zugänge & Rechte');
-if (roleUi.includes('NEXOWATT_EOS_ACCOUNT_MANAGEMENT.open')) fail('role overview opens account management outside Zugänge & Rechte');
-if (!index.includes(`eos-account-management.js?v=${shellTag}`)) fail('account management asset is not active with the current cache tag');
-for (const marker of [
-  '.eos-account-management-entry', '.eos-account-management-overlay', '.eos-account-management-dialog',
-  '.eos-account-row', '.eos-account-reset', 'html.eos-account-page-installer',
-]) if (!css.includes(marker)) fail(`account management CSS marker missing: ${marker}`);
-
-if (bad) process.exit(1);
-console.log('[NexoWatt EOS account management] OK');
+for(const marker of ['v98-account-management-real-password-write',"['admin', 'installer']",'nexowatt/account/manage','nexowatt/account/reset','X-NexoWatt-EOS-Account-Reset','data.canResetInstaller === true',"account.role === 'enduser'",'Startpasswort „nexowatt“','accountErrorText','invalidRequestOrigin','credentials: \'include\'','NEXOWATT_EOS_ACCOUNT_MANAGEMENT','ensureEntrySurface',"currentRoute() !== 'tab-users'",'eos-account-management-entry'])if(!sourceUi.includes(marker))fail(`account UI marker missing: ${marker}`);
+if(sourceUi.includes("launcher.className = 'eos-account-management-launcher'"))fail('standalone account launcher remains');
+if(sourceUi.includes('new MutationObserver'))fail('account management adds a second broad MutationObserver');
+if(sourceUi!==builtUi)fail('account UI source/build drift');
+if(!roleUi.includes("route === 'tab-users'"))fail('installer cannot reach access page');
+if(!index.includes(`eos-account-management.js?v=${shellTag}`))fail('account asset cache tag mismatch');
+for(const marker of ['.eos-account-management-entry','.eos-account-management-overlay','.eos-account-management-dialog','.eos-account-row','.eos-account-reset'])if(!css.includes(marker))fail(`account CSS missing: ${marker}`);
+if(bad)process.exit(1);console.log('[NexoWatt EOS account management] OK');