iobroker.eos-admin 7.9.97 → 7.9.98

package/tools/nexowatt-account-password-flow-selftest.cjs

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+
+const root = path.resolve(__dirname, '..');
+const built = fs.readFileSync(path.join(root, 'build/lib/web.js'), 'utf8');
+const accountUi = fs.readFileSync(path.join(root, 'adminWww/js/eos-account-management.js'), 'utf8');
+const firstLoginUi = fs.readFileSync(path.join(root, 'adminWww/js/eos-role-bootstrap.js'), 'utf8');
+
+function methodSlice(startMarker, endMarker) {
+    const start = built.indexOf(startMarker);
+    const end = built.indexOf(endMarker, start + startMarker.length);
+    assert(start >= 0 && end > start, `method block not found: ${startMarker}`);
+    return built.slice(start, end);
+}
+
+const methods = [
+    methodSlice('    normalizeEosUserId(value) {', '    normalizeEosAdapterName(value) {'),
+    methodSlice('    async readEosCurrentUser(req) {', '    getEosConfiguredRoleGroups(...keys) {'),
+    methodSlice('    async getEosRequestAccess(req) {', '    getEosRoleCapabilities(role) {'),
+    methodSlice('    validateEosFirstLoginPassword(password, passwordRepeat, userId) {', '    getEosPasswordUserName(userId) {'),
+    methodSlice('    getEosPasswordUserName(userId) {', '    async destroyEosRequestSessions(req) {'),
+    methodSlice('    async saveEosFirstLoginPassword(req, res) {', '    isEosPasswordlessFirstLoginEnabled() {'),
+    methodSlice('    async resetEosAccountPassword(req, res) {', '    async getEosHistoryInstances() {'),
+    methodSlice('    isEosSameOriginWrite(req) {', '    async saveEosBasicSettings(req, res) {'),
+].join('\n');
+
+const sandbox = { module: { exports: null }, URL, Set, console, EOS_PASSWORD_SERVICE_USER: 'system.user.admin' };
+vm.runInNewContext(`module.exports = class Harness {\n${methods}\n}`, sandbox);
+const Harness = sandbox.module.exports;
+
+function responseMock() {
+    return {
+        statusCode: 200,
+        payload: null,
+        headers: {},
+        clearedCookies: [],
+        setHeader(name, value) { this.headers[String(name).toLowerCase()] = value; },
+        status(code) { this.statusCode = code; return this; },
+        json(value) { this.payload = value; return this; },
+        clearCookie(name) { this.clearedCookies.push(name); },
+    };
+}
+
+function requestMock(body = {}, headers = {}) {
+    return {
+        body,
+        headers: {
+            host: '192.168.10.124:8081',
+            origin: 'http://192.168.10.124:8081',
+            'sec-fetch-site': 'same-origin',
+            ...headers,
+        },
+        query: {},
+        socket: { remoteAddress: '192.168.10.50' },
+    };
+}
+
+async function resetScenario(requesterRole, targetRole, targetGroups) {
+    const harness = new Harness();
+    const writes = [];
+    const metadata = {};
+    harness.getEosRequestAccess = async () => ({ userId: requesterRole === 'admin' ? 'system.user.admin' : 'system.user.installer', role: requesterRole });
+    harness.normalizeEosUserId = value => String(value || '').startsWith('system.user.') ? String(value) : `system.user.${value}`;
+    harness.getEosAccessForUserId = async () => ({ role: targetRole, groups: targetGroups });
+    harness.getEosInstallerGroups = () => ['system.group.installer', 'system.group.installateur'];
+    harness.getEosEndUserGroups = () => ['system.group.endkunde', 'system.group.user'];
+    harness.adapter = {
+        setPasswordAsync: async (user, password) => writes.push([`system.user.${user}`, password]),
+        checkPasswordAsync: async (user, password) => [password === 'nexowatt', `system.user.${user}`],
+        getForeignObjectAsync: async id => ({ _id: id, common: { enabled: true, password: '$hash' }, native: { keep: true, nexowattEosAccount: {} } }),
+        extendForeignObjectAsync: async (id, patch) => {
+            metadata.id = id;
+            metadata.native = patch.native;
+        },
+        log: { warn: () => undefined, info: () => undefined },
+    };
+    harness.invalidateEosPasswordClaimsForUser = () => undefined;
+    const res = responseMock();
+    await harness.resetEosAccountPassword(
+        requestMock({ user: targetRole === 'installer' ? 'system.user.installer-target' : 'system.user.user' }, { 'x-nexowatt-eos-account-reset': '1' }),
+        res,
+    );
+    return { res, writes, metadata };
+}
+
+(async () => {
+    // Authenticated request identities are normalized to the real ioBroker user object id.
+    const accessHarness = new Harness();
+    accessHarness.getEosAccessForUserId = async userId => ({ userId, role: userId === 'system.user.admin' ? 'admin' : 'enduser' });
+    const directAdmin = await accessHarness.getEosRequestAccess({ user: 'admin' });
+    assert.equal(directAdmin.userId, 'system.user.admin');
+    assert.equal(directAdmin.role, 'admin');
+    const objectAdmin = await accessHarness.getEosRequestAccess({ user: { id: 'system.user.admin' } });
+    assert.equal(objectAdmin.userId, 'system.user.admin');
+    assert.equal(objectAdmin.role, 'admin');
+
+    // Admin/Service can reset an explicitly managed End User and Installer account.
+    const adminEndUser = await resetScenario('admin', 'enduser', ['system.group.endkunde']);
+    assert.equal(adminEndUser.res.statusCode, 200);
+    assert.deepEqual(adminEndUser.writes, [['system.user.user', 'nexowatt']]);
+    assert.equal(adminEndUser.metadata.native.nexowattEosAccount.forcePasswordChange, true);
+    assert.equal(adminEndUser.metadata.native.nexowattEosAccount.passwordResetMode, 'initial-password');
+    assert.equal(adminEndUser.metadata.native.nexowattPasswordChangeRequired, true);
+
+    const adminInstaller = await resetScenario('admin', 'installer', ['system.group.installer']);
+    assert.equal(adminInstaller.res.statusCode, 200);
+    assert.deepEqual(adminInstaller.writes, [['system.user.installer-target', 'nexowatt']]);
+
+    // Installer may never reset another installer account.
+    const installerDenied = await resetScenario('installer', 'installer', ['system.group.installer']);
+    assert.equal(installerDenied.res.statusCode, 403);
+    assert.equal(installerDenied.res.payload.error, 'permissionError');
+    assert.equal(installerDenied.writes.length, 0);
+
+    // First-login password save must write the real account and clear every force-change flag.
+    const harness = new Harness();
+    const passwordWrites = [];
+    let metadata;
+    let sessionsDestroyed = false;
+    harness.getEosRequestAccess = async () => ({ userId: 'system.user.user', role: 'enduser' });
+    harness.getEosFirstLoginPasswordState = async () => ({ required: true, initialized: false, minLength: 10, version: 1 });
+    harness.getEosFirstLoginPasswordMinLength = () => 10;
+    harness.destroyEosRequestSessions = async () => { sessionsDestroyed = true; };
+    harness.adapter = {
+        setPasswordAsync: async (user, password) => passwordWrites.push([`system.user.${user}`, password]),
+        checkPasswordAsync: async (user, password) => [password === 'NexoWatt2025!', `system.user.${user}`],
+        getForeignObjectAsync: async id => ({ _id: id, common: { enabled: true, password: '$hash' }, native: { nexowattEosAccount: {} } }),
+        extendForeignObjectAsync: async (id, patch) => { metadata = { id, native: patch.native }; },
+        log: { info: () => undefined },
+    };
+    const acceptedPassword = harness.validateEosFirstLoginPassword(
+        'NexoWatt2025!',
+        'NexoWatt2025!',
+        'system.user.user',
+    );
+    assert.equal(acceptedPassword.valid, true);
+    assert.equal(acceptedPassword.password, 'NexoWatt2025!');
+    const saveRes = responseMock();
+    await harness.saveEosFirstLoginPassword(
+        requestMock(
+            { password: 'NexoWatt2025!', passwordRepeat: 'NexoWatt2025!' },
+            { 'x-nexowatt-eos-first-login': '1' },
+        ),
+        saveRes,
+    );
+    assert.equal(saveRes.statusCode, 200);
+    assert.equal(saveRes.payload.success, true);
+    assert.equal(saveRes.payload.logoutRequired, true);
+    assert.deepEqual(passwordWrites, [['system.user.user', 'NexoWatt2025!']]);
+    assert.equal(metadata.native.nexowattEosAccount.passwordInitialized, true);
+    assert.equal(metadata.native.nexowattEosAccount.forcePasswordChange, false);
+    assert.equal(metadata.native.nexowattPasswordChangeRequired, false);
+    assert.equal(metadata.native.eosFirstLoginRequired, false);
+    assert.equal(sessionsDestroyed, true);
+    assert.deepEqual(saveRes.clearedCookies.sort(), ['access_token', 'connect.sid', 'refresh_token'].sort());
+
+    // Same-origin logic must support direct access and a reverse proxy without accepting cross-site writes.
+    const originHarness = new Harness();
+    assert.equal(originHarness.isEosSameOriginWrite(requestMock()), true);
+    assert.equal(originHarness.isEosSameOriginWrite(requestMock({}, {
+        host: '127.0.0.1:8081',
+        origin: 'https://eos.example.test',
+        'x-forwarded-host': 'eos.example.test',
+        'sec-fetch-site': 'same-origin',
+    })), true);
+    assert.equal(originHarness.isEosSameOriginWrite(requestMock({}, {
+        origin: 'https://attacker.example',
+        'sec-fetch-site': 'cross-site',
+    })), false);
+
+    // Browser writes must preserve the authenticated session cookie.
+    assert.match(accountUi, /nexowatt\/account\/reset/);
+    assert.match(accountUi, /method:\s*'POST',\s*credentials:\s*'include'/);
+    assert.match(firstLoginUi, /nexowatt\/account\/first-password/);
+    assert.match(firstLoginUi, /method:\s*'POST',\s*credentials:\s*'include'/);
+
+    console.log('[NexoWatt EOS account password flow] OK: Admin/Installer permissions, initial password reset, personal password save, session and origin checks verified.');
+})().catch(error => {
+    console.error(error && error.stack ? error.stack : error);
+    process.exit(1);
+});

package/tools/nexowatt-login-layout-selftest.cjs

@@ -2,13 +2,13 @@
 'use strict';
 const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');
 const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');let bad=false;const fail=msg=>{console.error(`[NexoWatt EOS login layout] ${msg}`);bad=true;};
-const css=read('adminWww/css/nexowatt-native-shell.css');const sourceCss=read('src-admin/public/css/nexowatt-native-shell.css');const login=read('src-admin/src/login/Login.tsx');const stableLogin=read('adminWww/static/js/nexowatt-stable-login.js');const stable=read('adminWww/static/js/nexowatt-stable-v97.js');const index=read('adminWww/index.html');const info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));
+const css=read('adminWww/css/nexowatt-native-shell.css');const sourceCss=read('src-admin/public/css/nexowatt-native-shell.css');const login=read('src-admin/src/login/Login.tsx');const stableLogin=read('adminWww/static/js/nexowatt-stable-login.js');const stable=read('adminWww/static/js/nexowatt-stable-v98.js');const index=read('adminWww/index.html');const info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));const bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js');
 if(css!==sourceCss)fail('login CSS source/build drift');
-for(const marker of ['outer frame is decorative only','orderly login, moderately enlarged','width: min(440px, calc(100vw - 20px)) !important','height: min(580px, calc(100dvh - 20px)) !important','width: min(380px, calc(100vw - 52px)) !important','min-height: 510px !important','height: auto !important','overflow: visible !important'])if(!css.includes(marker))fail(`login marker missing: ${marker}`);
-if(css.includes('width: min(520px, calc(100vw - 24px))')||css.includes('width: min(460px, calc(100vw - 56px))')||css.includes('min-height: 540px !important'))fail('oversized v96 login geometry remains');
-if(!css.includes('[data-nw-login-card="true"]:not(.MuiPaper-root)')||!css.includes('padding: 0 !important'))fail('stale nested-card neutralization missing');
-if(/data-nw-login-card|data-nw-login-shell|min-height:590px|width:min\(460px|createElement\(['"]style/.test(stableLogin))fail('stable-login runtime still mutates geometry');
-if(/width:min\(460px|min-height:540px|createElement\(['"]style/.test(stable))fail('stable v97 runtime injects geometry');
-if(!login.includes("minHeight: 510")||!login.includes("overflowY: 'visible'")||!login.includes("maxHeight: 'none'"))fail('native Login source does not match v97 contract');
-if(!index.includes(`nexowatt-native-shell.css?v=${info.shellCacheTag}`)||!index.includes('nexowatt-stable-v97.js?v=97'))fail('v97 login assets not active');
+for(const marker of ['NexoWatt EOS 7.9.98 – stable scrolling','html.eos-app body','overflow: hidden !important','overflow-y: auto !important','width: min(456px','width: min(400px','min-height: 0 !important','overflow: visible !important','.MuiInputLabel-root { display: none !important; }','.MuiOutlinedInput-input::placeholder','margin-top: 28px !important'])if(!css.includes(marker))fail(`login marker missing: ${marker}`);
+if(!login.includes("minHeight: 0")||!login.includes("maxWidth: 400")||!login.includes('placeholder={`${I18n.t(\'enterLogin\')} *`}')||!login.includes('placeholder={`${I18n.t(\'enterPassword\')} *`}'))fail('native Login source does not use clean v98 placeholders');
+if(!bootstrap.includes('placeholder:')||!bootstrap.includes('I18n.t("enterLogin")+" *"')||!bootstrap.includes('I18n.t("enterPassword")+" *"'))fail('productive login bundle does not use placeholders');
+if(/label:.*I18n\.t\("enterLogin"\)|label:.*I18n\.t\("enterPassword"\)/.test(bootstrap.slice(1335000,1340500)))fail('productive login bundle still uses floating labels');
+if(/data-nw-login-card|data-nw-login-shell|min-height:590px|width:min\(460px|createElement\(['"]style/.test(stableLogin))fail('stable-login runtime mutates geometry');
+if(/width:min\(460px|min-height:540px|createElement\(['"]style/.test(stable))fail('stable v98 runtime injects geometry');
+if(!index.includes(`nexowatt-native-shell.css?v=${info.shellCacheTag}`)||!index.includes('nexowatt-stable-v98.js?v=98'))fail('v98 login assets not active');
 if(bad)process.exit(1);console.log('[NexoWatt EOS login layout] OK');

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.9.97.md',
+    'MERGE_UPDATE_README_V7.9.98.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',

package/tools/nexowatt-modern-ui-selftest.cjs

@@ -19,7 +19,7 @@ for (const marker of [
   '--nx-shadow-soft', '--nx-shadow-float', 'backdrop-filter: blur', '#app-paper', '.MuiDialog-paper',
   '.MuiButton-root', '.MuiTableRow-root', ':focus-visible', 'border-radius: 24px', 'linear-gradient',
   '@media (max-width: 720px)', '.eos-activation-steps', '.eos-account-row:hover',
-  'main.MuiPaper-root::before', 'width: min(380px, calc(100vw - 52px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
+  'main.MuiPaper-root::before', 'width: min(400px, calc(100vw - 48px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
   '.eos-account-management-entry', 'pointer-events: auto !important', 'touch-action: manipulation', 'overflow: visible',
 ]) if (!css.includes(marker)) fail(`modern styling marker missing: ${marker}`);
 if (sourceCss !== css) fail('modern CSS source/build drift');
@@ -29,7 +29,7 @@ for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','e
 for (const marker of ['NexoWatt EOS', 'Zugänge & Rollen', 'Endkunden-Zugänge', 'ensureEntrySurface']) {
   if (!accountUi.includes(marker)) fail(`modern account surface missing label: ${marker}`);
 }
-for (const marker of ['installIntegratedFirstLogin','v97 compact normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
+for (const marker of ['installIntegratedFirstLogin','v98 compact normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
   if (!bootstrap.includes(marker)) fail(`integrated first-activation surface missing: ${marker}`);
 }
 if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('compact login still injects role buttons or a second panel');

package/tools/nexowatt-password-write-selftest.cjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const root = path.resolve(__dirname, '..');
+const built = fs.readFileSync(path.join(root, 'build/lib/web.js'), 'utf8');
+const source = fs.readFileSync(path.join(root, 'src/lib/web.ts'), 'utf8');
+const begin = built.indexOf('    getEosPasswordUserName(userId) {');
+const end = built.indexOf('    async destroyEosRequestSessions', begin);
+assert(begin >= 0 && end > begin, 'password methods not found in built backend');
+const methods = built.slice(begin, end);
+const sandbox = { module: { exports: null }, EOS_PASSWORD_SERVICE_USER: 'system.user.admin' };
+vm.runInNewContext(`module.exports = class Harness {\nconstructor(adapter){this.adapter=adapter;}\n${methods}\n}`, sandbox);
+const Harness = sandbox.module.exports;
+(async () => {
+  const calls = [];
+  const userObject = { _id: 'system.user.user', common: { password: '$2b$hash' }, native: { keep: true } };
+  const adapter = {
+    setPasswordAsync: async (user, password, options) => calls.push(['set', user, password, options]),
+    checkPasswordAsync: async (user, password, options) => { calls.push(['check', user, password, options]); return [true, `system.user.${user}`]; },
+    getForeignObjectAsync: async id => { calls.push(['get', id]); return JSON.parse(JSON.stringify(userObject)); },
+    extendForeignObjectAsync: async (id, patch, options) => calls.push(['extend', id, patch, options]),
+    setForeignObjectAsync: async () => { throw new Error('full user object replacement must not be used'); },
+  };
+  const harness = new Harness(adapter);
+  await harness.setEosUserPassword('system.user.user', 'NexoWatt2025!');
+  assert.deepEqual(calls[0].slice(0, 3), ['set', 'user', 'NexoWatt2025!']);
+  assert.deepEqual(calls[1].slice(0, 3), ['check', 'user', 'NexoWatt2025!']);
+  await harness.updateEosAccountMetadata('system.user.user', (native, account) => {
+    account.passwordInitialized = true;
+    native.nexowattPasswordChangeRequired = false;
+  });
+  const extend = calls.find(row => row[0] === 'extend');
+  assert(extend, 'native metadata was not extended');
+  assert.equal(extend[1], 'system.user.user');
+  assert.equal(extend[2].native.keep, true);
+  assert.equal(extend[2].native.nexowattEosAccount.passwordInitialized, true);
+  assert(!Object.prototype.hasOwnProperty.call(extend[2], 'common'), 'password/common must not be overwritten by metadata update');
+  for (const code of [source, built]) {
+    assert.match(code, /setPasswordAsync\(userName, password/);
+    assert.match(code, /checkPasswordAsync\(userName, password/);
+    assert.match(code, /extendForeignObjectAsync/);
+    assert.match(code, /passwordVerificationFailed/);
+  }
+  console.log('[NexoWatt EOS password write] OK: real account name, verified password API and metadata-only update');
+})().catch(error => { console.error(error.stack || error); process.exit(1); });

package/tools/nexowatt-runtime-cleanup-selftest.cjs

@@ -15,15 +15,15 @@ try {
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'static', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'adminWww', 'static', 'js'), { recursive: true });
-  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 97 }));
+  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 98 }));
 
   const keep = [
     'adminWww/assets/bootstrap-current-v82.js',
     'adminWww/assets/Objects-current-v82.js',
     'adminWww/remoteEntry-v82.js',
     'adminWww/remoteEntry.js',
-    'adminWww/static/js/nexowatt-stable-v97.js',
-    'src-admin/public/static/js/nexowatt-stable-v97.js',
+    'adminWww/static/js/nexowatt-stable-v98.js',
+    'src-admin/public/static/js/nexowatt-stable-v98.js',
     'adminWww/static/js/nexowatt-stable-login.js',
   ];
   const remove = [
@@ -34,7 +34,7 @@ try {
     'adminWww/js/eos-branding.js',
     'adminWww/css/eos-branding.css',
     'src-admin/public/js/eos-security-ui.js',
-    'adminWww/static/js/nexowatt-stable-v96.js',
+    'adminWww/static/js/nexowatt-stable-v97.js',
     'src-admin/public/static/js/nexowatt-stable-v95.js',
   ];
   for (const rel of [...keep, ...remove]) {
@@ -45,7 +45,7 @@ try {
 
   const result = cleanLegacyRuntime({ root: temp, quiet: true, silent: true });
   assert.strictEqual(result.activeRuntime, 82);
-  assert.strictEqual(result.activeShell, 97);
+  assert.strictEqual(result.activeShell, 98);
   assert.strictEqual(result.removed.length, remove.length);
   for (const rel of keep) assert.ok(fs.existsSync(path.join(temp, rel)), `current runtime removed: ${rel}`);
   for (const rel of remove) assert.ok(!fs.existsSync(path.join(temp, rel)), `legacy file remained: ${rel}`);

package/tools/nexowatt-stable-v98-selftest.cjs

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const must=(ok,msg)=>{if(!ok){console.error(`[NexoWatt EOS stable v98] ${msg}`);process.exit(1)}};
+const pkg=JSON.parse(read('package.json')),io=JSON.parse(read('io-package.json')),info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json')),css=read('adminWww/css/nexowatt-native-shell.css'),stable=read('adminWww/static/js/nexowatt-stable-v98.js'),login=read('adminWww/static/js/nexowatt-stable-login.js'),index=read('adminWww/index.html'),web=read('src/lib/web.ts'),built=read('build/lib/web.js'),account=read('adminWww/js/eos-account-management.js'),bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js'),ems=read('adminWww/js/eos-ems-overview.js');
+must(pkg.version==='7.9.98'&&io.version==='7.9.98'&&io.common.version==='7.9.98'&&info.version==='7.9.98','version drift');
+must(info.shellCacheVersion===98&&info.shellCacheTag==='98','shell cache not v98');
+must(css.includes('overflow-y: auto !important')&&css.includes('scrollbar-color: rgba(0, 229, 138'),'cockpit vertical scrollbar missing');
+must(css.includes('.MuiInputLabel-root { display: none !important; }')&&bootstrap.includes('I18n.t("enterLogin")+" *"'),'clean login field contract missing');
+must(stable.includes("VERSION = 'v98-scroll-login-password-write'")&&!login.includes('data-nw-login-card'),'stable runtime incorrect');
+must(index.includes('nexowatt-stable-v98.js?v=98')&&index.includes('nexowatt-native-shell.css?v=98'),'v98 assets not loaded');
+for(const code of [web,built])for(const marker of ['getEosPasswordUserName','setPasswordAsync(userName, password','checkPasswordAsync(userName, password','passwordVerificationFailed','updateEosAccountMetadata','extendForeignObjectAsync'])must(code.includes(marker),`password marker missing: ${marker}`);
+must(account.includes('Startpasswort „nexowatt“')&&account.includes('credentials: \'include\''),'reset UI does not describe/use stable initial password flow');
+must(ems.includes("REQUIRED_UI_VERSION = '0.8.198'")&&ems.includes('readUiAdapterInfo'),'working EMS diagnosis was lost');
+console.log('[NexoWatt EOS stable v98] OK');

package/tools/nexowatt-sync-release-version.cjs

@@ -19,6 +19,14 @@ function setValue(changes, label, object, key, value) {
     }
 }
 
+function setJsonValue(changes, label, object, key, value) {
+    const previous = object[key];
+    if (JSON.stringify(previous) !== JSON.stringify(value)) {
+        changes.push({ label, previous, value });
+        object[key] = value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+    }
+}
+
 function syncReleaseVersion(rootDir) {
     const root = path.resolve(rootDir);
     const packageFile = path.join(root, 'package.json');
@@ -62,7 +70,40 @@ function syncReleaseVersion(rootDir) {
             update(json) {
                 setValue(changes, 'package-lock.json version', json, 'version', version);
                 if (json.packages?.['']) {
-                    setValue(changes, 'package-lock.json packages[""] version', json.packages[''], 'version', version);
+                    const rootPackage = json.packages[''];
+                    setValue(changes, 'package-lock.json packages[""] version', rootPackage, 'version', version);
+                    // A merge archive can update package.json while leaving stale release scripts,
+                    // files and policy metadata in package-lock.json. npm reads the lock root during
+                    // packaging, so keep every release-critical root field canonical as well.
+                    for (const key of [
+                        'name',
+                        'description',
+                        'license',
+                        'author',
+                        'private',
+                        'engines',
+                        'main',
+                        'files',
+                        'scripts',
+                        'dependencies',
+                        'devDependencies',
+                        'overrides',
+                        'keywords',
+                        'publishConfig',
+                        'nexowattReleasePolicy',
+                        'publisher',
+                        'copyright',
+                    ]) {
+                        if (Object.prototype.hasOwnProperty.call(pkg, key)) {
+                            setJsonValue(
+                                changes,
+                                `package-lock.json packages[""] ${key}`,
+                                rootPackage,
+                                key,
+                                pkg[key],
+                            );
+                        }
+                    }
                 }
             },
         },

package/tools/nexowatt-ui-overview-runtime-selftest.cjs

@@ -5,7 +5,7 @@ const runtime=read('adminWww/js/eos-ems-overview.js');const source=read('src-adm
 if(runtime!==source)fail('runtime source/build drift');
 for(const marker of ['nexowatt-ems-overview-v1','nexowatt-ui.*.info.adminOverview.*','system.adapter.nexowatt-ui.*.alive','POLL_MS = 5000','STALE_MS = 20000',"REQUIRED_UI_VERSION = '0.8.198'",'getForeignStates','Keine Kachel besitzt Schreibhoheit','currentDecisions','§14a-Fallback','nexowatt-eos-admin-socket-ready','readUiAdapterInfo','socketFromReact'])if(!runtime.includes(marker))fail(`runtime marker missing: ${marker}`);
 for(const forbidden of ['setForeignState','setState(','sendToHost','writeFile','extendObject'])if(runtime.includes(forbidden))fail(`read-only runtime contains ${forbidden}`);
-for(const marker of ['eos-ems-overview.css?v=97','eos-ems-overview.js?v=97','nexowatt-stable-v97.js?v=97'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
+for(const marker of ['eos-ems-overview.css?v=98','eos-ems-overview.js?v=98','nexowatt-stable-v98.js?v=98'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
 if(!css.includes('#eos-ems-overview-runtime')||!css.includes('.eos-ems-overview-metrics')||!css.includes('startup and compatibility messages stay compact'))fail('EMS card CSS incomplete');
 if(role.includes('overview.innerHTML = `')||!role.includes('never cover the real Admin Intro'))fail('obsolete role overview still active');
 if(!shell.includes("label: 'Installateur'")||!shell.includes("label: 'Endkunde'")||!shell.includes('eosNativeReactOverview'))fail('native overview role bridge incomplete');

package/tools/nexowatt-validate-package.cjs

@@ -41,16 +41,23 @@ if (pkg.scripts['test:eos-version-sync'] !== 'node tools/nexowatt-version-sync-s
 if (pkg.scripts['verify:eos-merge'] !== 'node tools/nexowatt-merge-update-selftest.cjs') fail('merge update selftest script is missing or incorrect');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-version-sync-selftest.cjs')) fail('version sync selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-merge-update-selftest.cjs')) fail('merge update selftest is not part of check:eos-stability');
-if (pkg.scripts['check:eos-stable-v97'] !== 'node tools/nexowatt-stable-v97-selftest.cjs') fail('stable v97 selftest script is missing or incorrect');
+if (pkg.scripts['check:eos-stable-v98'] !== 'node tools/nexowatt-stable-v98-selftest.cjs') fail('stable v98 selftest script is missing or incorrect');
 if (!pkg.scripts.prepublishOnly?.startsWith('npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run check:eos-publish-channel')) fail('prepublishOnly must synchronize versions and normalize release defaults before the publish channel guard');
 if (pkg.scripts['precheck:eos-package'] !== 'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-package must synchronize versions, normalize release defaults and clean stale runtime files');
 if (pkg.scripts['precheck:eos-stability'] !== 'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-stability must synchronize versions, normalize release defaults and clean stale runtime files');
 if (pkg.scripts['test:eos-publish-channel'] !== 'node tools/nexowatt-publish-channel-selftest.cjs') fail('publish channel selftest script is missing');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-publish-channel-selftest.cjs')) fail('stability check must execute the publish channel selftest');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-release-defaults-selftest.cjs')) fail('stability check must execute the release-default selftest');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-password-write-selftest.cjs')) fail('password-write selftest is not part of check:eos-stability');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-password-flow-selftest.cjs')) fail('account-password flow selftest is not part of check:eos-stability');
 if (io.native?.auth !== true) fail('fresh sales installations must default to authenticated access');
 if (io.native?.eosHideLegacyBackupFromNonAdmins !== true) fail('internal BackItUp reserve must default to Admin/Service visibility');
 if (io.native?.nexowattHideLegacyBackupFromNonAdmins !== true) fail('NexoWatt backup visibility compatibility flag must default to true');
+for (const key of ['description', 'files', 'scripts', 'nexowattReleasePolicy']) {
+  if (JSON.stringify(pkgLock.packages?.['']?.[key]) !== JSON.stringify(pkg[key])) {
+    fail(`package-lock root ${key} must match package.json`);
+  }
+}
 for (const [label, value] of [
   ['io-package common.version', io.common?.version],
   ['io-package top-level version', io.version],
@@ -110,14 +117,14 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.9.97.md',
-  'RELEASE_NOTES_V7.9.97.md',
-  'PUBLISH_STABLE_V7.9.97.md',
-  'INSTALL_TEST_V7.9.97.md',
-  'RELEASE_ACCEPTANCE_V7.9.97.md',
+  'README_STABILITY_V7.9.98.md',
+  'RELEASE_NOTES_V7.9.98.md',
+  'PUBLISH_STABLE_V7.9.98.md',
+  'INSTALL_TEST_V7.9.98.md',
+  'RELEASE_ACCEPTANCE_V7.9.98.md',
   'MERGE_UPDATE.ps1',
   'MERGE_UPDATE.cmd',
-  'MERGE_UPDATE_README_V7.9.97.md',
+  'MERGE_UPDATE_README_V7.9.98.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -135,12 +142,14 @@ for (const file of [
   'tools/nexowatt-sync-release-version.cjs',
   'tools/nexowatt-version-sync-selftest.cjs',
   'tools/nexowatt-merge-update-selftest.cjs',
-  'tools/nexowatt-stable-v97-selftest.cjs',
+  'tools/nexowatt-stable-v98-selftest.cjs',
+  'tools/nexowatt-password-write-selftest.cjs',
+  'tools/nexowatt-account-password-flow-selftest.cjs',
   'tools/nexowatt-ems-overview-selftest.cjs',
   'tools/nexowatt-ui-overview-runtime-selftest.cjs',
   'adminWww/js/eos-ems-overview.js',
   'adminWww/css/eos-ems-overview.css',
-  'adminWww/static/js/nexowatt-stable-v97.js',
+  'adminWww/static/js/nexowatt-stable-v98.js',
   'src-admin/src/components/Intro/NexoWattEmsOverview.tsx',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',
@@ -183,7 +192,7 @@ if (!index.includes(`eos-account-management.js?v=${shellTag}`)) fail('account ma
 if (!index.includes(`eos-assistant.js?v=${shellTag}`)) fail('EOS Assist cache key mismatch');
 if (!index.includes(`eos-ems-overview.js?v=${shellTag}`)) fail('EMS overview cache key mismatch');
 if (!index.includes(`eos-ems-overview.css?v=${shellTag}`)) fail('EMS overview CSS cache key mismatch');
-if (!index.includes(`nexowatt-stable-v97.js?v=${shellTag}`)) fail('stable v97 cache key mismatch');
+if (!index.includes(`nexowatt-stable-v98.js?v=${shellTag}`)) fail('stable v98 cache key mismatch');
 if (index.indexOf(`eos-manual-write-policy.js?v=${shellTag}`) > index.indexOf(`hostInit-${runtime}.js?v=${runtimeNumber}`)) fail('manual-write policy must load before the React runtime');
 if (!index.includes('class="eos-native-shell"')) fail('native NexoWatt shell class missing');
 for (const legacy of ['eos-branding.js', 'eos-security-ui.js', 'eos-console-quiet.js', 'eos-objects-state-tools.js']) {
@@ -232,7 +241,7 @@ if (accountManagement.includes("launcher.className = 'eos-account-management-lau
 if (accountManagement.includes('new MutationObserver')) fail('account-management runtime adds a second broad DOM observer');
 if (read('src-admin/public/js/eos-account-management.js') !== accountManagement) fail('account-management source/build drift');
 const roleBootstrap = read('adminWww/js/eos-role-bootstrap.js');
-if (!roleBootstrap.includes('installIntegratedFirstLogin') || !roleBootstrap.includes('v97 compact normal-login first activation')) fail('compact integrated first-login is incomplete');
+if (!roleBootstrap.includes('installIntegratedFirstLogin') || !roleBootstrap.includes('v98 compact normal-login first activation')) fail('compact integrated first-login is incomplete');
 if (/data-eos-account=|selector\.innerHTML/.test(roleBootstrap)) fail('login role buttons must not enlarge the normal login card');
 if (!roleBootstrap.includes('nexowatt/account/passwordless-status') || !roleBootstrap.includes('eligibility.allowed')) fail('server-checked first-login eligibility is incomplete');
 if (roleBootstrap.includes('installPasswordlessFirstLoginLauncher')) fail('old first-login launcher remains active');

package/tools/nexowatt-version-sync-selftest.cjs

@@ -24,7 +24,19 @@ try {
     const currentPkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
     const version = currentPkg.version;
     writeJson('package.json', currentPkg);
-    writeJson('package-lock.json', { name: currentPkg.name, version: '7.9.92', packages: { '': { version: '7.9.92' } } });
+    writeJson('package-lock.json', {
+        name: currentPkg.name,
+        version: '7.9.92',
+        packages: {
+            '': {
+                version: '7.9.92',
+                description: 'stale description',
+                files: ['README_STABILITY_V7.9.92.md'],
+                scripts: { 'check:eos-stable-v92': 'node stale.js' },
+                nexowattReleasePolicy: { distTag: 'latest', purpose: 'stale 7.9.92 policy' },
+            },
+        },
+    });
     writeJson('io-package.json', {
         version: '7.9.92',
         common: {
@@ -75,6 +87,11 @@ try {
     ]) {
         if (actual !== version) fail(`${label} was not synchronized: ${actual}`);
     }
+    for (const key of ['description', 'files', 'scripts', 'nexowattReleasePolicy']) {
+        if (JSON.stringify(lock.packages[''][key]) !== JSON.stringify(currentPkg[key])) {
+            fail(`package-lock root ${key} was not synchronized`);
+        }
+    }
     if (io.common.meta !== `${expectedBase}/io-package.json`) fail('io-package URL was not synchronized');
     if (entry.meta !== `${expectedBase}/io-package.json`) fail('repository entry URL was not synchronized');
     if (!fs.existsSync(path.join(temp, build.repositoryEntry))) fail('current repository entry was not created');

package/INSTALL_TEST_V7.9.97.md

@@ -1,11 +0,0 @@
-# Installationstest 7.9.97
-
-```bash
-cd /opt/iobroker
-iobroker stop eos-admin.0
-npm install --no-save --omit=dev iobroker.eos-admin@7.9.97
-iobroker upload eos-admin
-iobroker restart eos-admin.0
-```
-
-Danach Browser mit `Strg + F5` vollständig neu laden. Für EMS-Livedaten muss `iobroker.nexowatt-ui` mindestens `0.8.198` installiert und gestartet sein.

package/MERGE_UPDATE_README_V7.9.97.md

@@ -1,5 +0,0 @@
-# NexoWatt EOS Admin 7.9.97 – Merge-Update
-
-Die flache Merge-ZIP direkt in den vorhandenen Repository-Ordner entpacken und anschließend `MERGE_UPDATE.cmd` ausführen.
-
-Enthalten sind alle Änderungen aus 7.9.96 einschließlich nativer Rollenübersicht, persönlicher Erstkennwortvergabe und EMS-Diagnose sowie die Korrekturen für Login-Geometrie und produktive AdminConnection.

package/PUBLISH_STABLE_V7.9.97.md

@@ -1,15 +0,0 @@
-# Stable-Veröffentlichung 7.9.97
-
-```powershell
-npm login
-npm whoami
-npm run check:eos-release
-npm publish --dry-run --tag latest
-npm publish --tag latest
-```
-
-Das geprüfte Tarball kann alternativ direkt veröffentlicht werden:
-
-```powershell
-npm publish .\iobroker.eos-admin-7.9.97.tgz --tag latest
-```

package/README_STABILITY_V7.9.97.md

@@ -1,18 +0,0 @@
-# NexoWatt EOS Admin 7.9.97 – Stable
-
-Diese Version behebt die sichtbaren Regressionen aus 7.9.96 und ist für den anschließenden Feldtest als Verkaufsfassung vorbereitet.
-
-## Korrigiert
-
-- Ordentliche NexoWatt-Anmeldekarte im bewährten Verhältnis, nur moderat größer.
-- Keine innere horizontale oder vertikale Scrollleiste – auch nicht bei „Falsches Passwort“ oder der persönlichen Erstanmeldung.
-- Keine doppelte Karten-Geometrie auf einem inneren Formular-/Grid-Container.
-- Native Übersicht für Admin, Installateur und Endkunde.
-- Read-only EMS-Live-Diagnose über die echte authentifizierte AdminConnection.
-- Konkrete Hinweise bei fehlendem UI-Adapter, zu alter UI-Version, fehlendem Diagnosevertrag oder fehlender Leseberechtigung.
-
-## Kompatibilität
-
-Für vollständige EMS-Livedaten wird `iobroker.nexowatt-ui` ab `0.8.198` benötigt. Der Diagnosevertrag liegt unter `nexowatt-ui.*.info.adminOverview.*` und besitzt keine Schreibhoheit.
-
-Erstkennwort `nexowatt`, verpflichtende persönliche Kennwortvergabe, Rollenmodell, geschützte EOS-Adapter, interne Notfallreserven und Standardport `8081` bleiben unverändert.

package/RELEASE_ACCEPTANCE_V7.9.97.md

@@ -1,11 +0,0 @@
-# Release-Abnahme 7.9.97
-
-- [ ] Login-Karte ist ordentlich proportioniert und nur moderat größer als vor 7.9.96.
-- [ ] Normale Anmeldung, falsches Passwort und persönliche Erstkennwortvergabe erzeugen keine innere Scrollleiste.
-- [ ] Erstkennwort `nexowatt` führt zur verpflichtenden persönlichen Kennwortvergabe.
-- [ ] Native Adapterkarten sind bei Admin, Installateur und Endkunde sichtbar, soweit die Rolle sie freigibt.
-- [ ] NexoWatt-UI-Karte ist in der Übersicht vorhanden.
-- [ ] EMS-Kachel zeigt nach Verbindungsaufbau Livewerte aus `nexowatt-ui.*.info.adminOverview.*`.
-- [ ] UI-Version unter `0.8.198` wird verständlich gemeldet.
-- [ ] Die EMS-Kachel enthält keinen Schreibpfad.
-- [ ] `npm run check:eos-release` und `npm publish --dry-run --tag latest` sind vollständig grün.

package/RELEASE_NOTES_V7.9.97.md

@@ -1,19 +0,0 @@
-# Release Notes 7.9.97
-
-## Anmeldung
-
-- Rückkehr zur bewährten kompakten Kartenstruktur.
-- Außenrahmen und Formular sind nur ungefähr sieben Prozent größer als der frühere stabile Stand.
-- Meldungen wachsen innerhalb der Karte, ohne Scrollleisten oder überlange Eingabefelder.
-- Laufzeitskripte verändern keine Breite, Höhe oder Padding der Karte mehr.
-
-## Übersicht und EMS
-
-- Admin, Installateur und Endkunde nutzen dieselbe native Intro-Kartenkomponente.
-- Die NexoWatt-UI-Karte bleibt für freigegebene Rollen sichtbar.
-- Die EMS-Live-Diagnose übernimmt die produktive EOS-Admin-Verbindung und liest ausschließlich `info.adminOverview.*`.
-- Mindestversion für den vollständigen Publisher: NexoWatt UI `0.8.198`.
-
-## Sicherheit
-
-Keine Änderung an Geräte-/Setpoint-Schreibwegen. Die Diagnose bleibt vollständig read-only.