iobroker.eos-admin 7.9.97 → 7.9.99

package/adminWww/js/eos-ems-overview.js

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v97-nexowatt-ems-overview-runtime';
+    const VERSION = 'v99-nexowatt-ems-overview-runtime';
     const CONTRACT = 'nexowatt-ems-overview-v1';
     const ROOT_ID = 'eos-ems-overview-runtime';
     const POLL_MS = 5000;
@@ -161,11 +161,10 @@
         if (tariff.available) tags.push({ label: `Tarif: ${text(tariff.state, 'aktiv')}${tariff.priceEurPerKwh != null ? ` · ${num(tariff.priceEurPerKwh).toFixed(3)} €/kWh` : ''}` });
         if (forecast.available) tags.push({ label: `Prognose: ${text(forecast.source, 'aktiv')}${forecast.fresh === false ? ' · veraltet' : ''}`, warning: forecast.fresh === false });
         if (ems.safetyActive || ems.safetyEmergencyStop || ems.safetyValid === false) tags.push({ label: 'EOS Safety aktiv', warning: true });
-        const detailsPort = Math.max(1, num(summary.details?.port, 8188)); const detailsPath = text(summary.details?.path, '/ems-apps.html?tab=status'); const detailsUrl = `${location.protocol}//${location.hostname}:${detailsPort}${detailsPath.startsWith('/') ? detailsPath : `/${detailsPath}`}`;
         const metrics = `<div class="eos-ems-overview-metric"><span>EMS-Budget</span><strong>${totalBudget > 0 ? esc(formatPower(totalBudget)) : 'nicht begrenzt'}</strong><small>Rest ${esc(formatPower(remaining))}</small></div><div class="eos-ems-overview-metric"><span>Lademanagement</span><strong>${esc(formatPower(charging.actualW))} / ${esc(formatPower(charging.targetW))}</strong><small>${num(charging.activeCount)} lädt · ${num(charging.waitingCount)} wartet</small></div>${storage.available ? `<div class="eos-ems-overview-metric"><span>Speicher ${esc(text(storage.topology))}</span><strong>${esc(formatPower(storage.actualW))} / ${esc(formatPower(storage.targetW))}</strong><small>${storage.socPct != null ? `SoC ${Math.round(num(storage.socPct))} %` : esc(text(storage.reason, 'aktiv'))}</small></div>` : `<div class="eos-ems-overview-metric"><span>PV-Budget</span><strong>${esc(formatPower(budget.pvBudgetW))}</strong><small>PV-Rest ${esc(formatPower(budget.remainingPvW))}</small></div>`}<div class="eos-ems-overview-metric"><span>Letzter Regeltick</span><strong>${esc(formatAge(ems.lastTickTs || data.updatedAt))}</strong><small>${isTechnical ? `Zyklus ${num(ems.cycleMs)} ms` : esc(text(ems.decision, 'EMS aktiv'))}</small></div>`;
         const decisionsHtml = decisions.length ? decisions.map(item => `<div class="eos-ems-overview-decision eos-ems-overview-decision--${severity(item.severity)}"><strong>${esc(text(item.title, 'EMS-Entscheidung'))}</strong><span>${esc(text(item.reason, 'Keine zusätzliche Begrenzung'))}</span>${isTechnical && item.details ? `<small>${esc(item.details)}</small>` : ''}</div>`).join('') : '<div class="eos-ems-overview-empty">Keine aktiven Regelentscheidungen. EOS arbeitet mit den aktuellen Messwerten.</div>';
         const eventsHtml = isTechnical ? (events.length ? events.map(item => `<div class="eos-ems-overview-event eos-ems-overview-event--${severity(item.severity)}"><time>${esc(formatClock(item.ts))}</time><div><strong>${esc(text(item.title, 'EMS'))}</strong><span>${esc(text(item.message || item.reason, 'Zustand aktualisiert'))}</span></div></div>`).join('') : '<div class="eos-ems-overview-empty">Noch keine Zustandsänderung im begrenzten Ereignispuffer.</div>') : `<div class="eos-ems-overview-decision eos-ems-overview-decision--info"><strong>${esc(text(summary.headline, 'EMS aktiv'))}</strong><span>${esc(text(summary.reason, 'EOS optimiert die Anlage innerhalb aller Sicherheitsgrenzen.'))}</span></div>`;
-        root.innerHTML = `<header class="eos-ems-overview-header"><div><span class="eos-ems-overview-eyebrow">NexoWatt EMS · Live-Diagnose</span><h2>${esc(stale ? 'EMS-Diagnose ist nicht aktuell' : text(summary.headline, 'EMS arbeitet normal'))}</h2><p>${esc(stale ? 'Adapter oder Diagnosewerte sind älter als 20 Sekunden. Die Werte werden als veraltet markiert.' : text(summary.reason, 'EMS arbeitet innerhalb aller aktiven Grenzen.'))}</p></div><div class="eos-ems-overview-state"><span class="eos-ems-overview-state-dot"></span><strong>${stale ? 'Offline / veraltet' : ({ok:'Normal',info:'Information',warning:'Begrenzt',error:'Störung'}[status])}</strong><small>${esc(data.instance)} · ${esc(formatAge(data.updatedAt))}</small></div></header><div class="eos-ems-overview-metrics">${metrics}</div>${totalBudget > 0 ? `<div class="eos-ems-overview-budget" title="${percent.toFixed(1)} % Restbudget"><span style="width:${percent}%"></span></div>` : ''}${tags.length ? `<div class="eos-ems-overview-tags">${tags.map(tag => `<span class="${tag.warning ? 'is-warning' : ''}">${esc(tag.label)}</span>`).join('')}</div>` : ''}<div class="eos-ems-overview-columns"><div class="eos-ems-overview-panel"><h3>Aktuelle Regelentscheidungen</h3>${decisionsHtml}</div><div class="eos-ems-overview-panel"><h3>${isTechnical ? 'Letzte EMS-Ereignisse' : 'Systemerklärung'}</h3>${eventsHtml}</div></div><footer class="eos-ems-overview-footer"><span>Diagnose ist rein lesend. Keine Kachel besitzt Schreibhoheit.</span><a href="${esc(detailsUrl)}" target="_blank" rel="noreferrer">Vollständige EMS-Diagnose öffnen ↗</a></footer>`;
+        root.innerHTML = `<header class="eos-ems-overview-header"><div><span class="eos-ems-overview-eyebrow">NexoWatt EMS · Live-Diagnose</span><h2>${esc(stale ? 'EMS-Diagnose ist nicht aktuell' : text(summary.headline, 'EMS arbeitet normal'))}</h2><p>${esc(stale ? 'Adapter oder Diagnosewerte sind älter als 20 Sekunden. Die Werte werden als veraltet markiert.' : text(summary.reason, 'EMS arbeitet innerhalb aller aktiven Grenzen.'))}</p></div><div class="eos-ems-overview-state"><span class="eos-ems-overview-state-dot"></span><strong>${stale ? 'Offline / veraltet' : ({ok:'Normal',info:'Information',warning:'Begrenzt',error:'Störung'}[status])}</strong><small>${esc(data.instance)} · ${esc(formatAge(data.updatedAt))}</small></div></header><div class="eos-ems-overview-metrics">${metrics}</div>${totalBudget > 0 ? `<div class="eos-ems-overview-budget" title="${percent.toFixed(1)} % Restbudget"><span style="width:${percent}%"></span></div>` : ''}${tags.length ? `<div class="eos-ems-overview-tags">${tags.map(tag => `<span class="${tag.warning ? 'is-warning' : ''}">${esc(tag.label)}</span>`).join('')}</div>` : ''}<div class="eos-ems-overview-columns"><div class="eos-ems-overview-panel"><h3>Aktuelle Regelentscheidungen</h3>${decisionsHtml}</div><div class="eos-ems-overview-panel"><h3>${isTechnical ? 'Letzte EMS-Ereignisse' : 'Systemerklärung'}</h3>${eventsHtml}</div></div><footer class="eos-ems-overview-footer"><span>Diagnose ist rein lesend. Keine Kachel besitzt Schreibhoheit.</span></footer>`;
     };
 
     const scheduleFastRetry = () => {

package/adminWww/js/eos-release-watch.js

@@ -0,0 +1,77 @@
+(() => {
+    'use strict';
+    const RELEASE = '7.9.99';
+    const RELEASE_KEY = 'nexowatt.eos.loadedRelease';
+    const RELOAD_KEY = 'nexowatt.eos.reloadTarget';
+    const CHECK_MS = 15000;
+    let refreshing = false;
+
+    const normalize = value => String(value || '').trim().replace(/^v/i, '');
+    const validRelease = value => /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(normalize(value));
+    const reloadUrl = version => {
+        const url = new URL(window.location.href);
+        url.searchParams.set('_eosRelease', normalize(version) || RELEASE);
+        url.searchParams.set('_eosReload', String(Date.now()));
+        return url.toString();
+    };
+    const purgeBrowserCaches = async () => {
+        const jobs = [];
+        try {
+            if ('caches' in window) {
+                jobs.push(caches.keys().then(keys => Promise.all(keys.map(key => caches.delete(key)))));
+            }
+        } catch (_) { /* Cache API is optional */ }
+        try {
+            if (navigator.serviceWorker?.getRegistrations) {
+                jobs.push(navigator.serviceWorker.getRegistrations().then(rows => Promise.all(rows.map(row => row.unregister()))));
+            }
+        } catch (_) { /* service workers may be unavailable */ }
+        await Promise.allSettled(jobs);
+    };
+    const reloadFor = async version => {
+        const target = normalize(version) || RELEASE;
+        if (refreshing || sessionStorage.getItem(RELOAD_KEY) === target) return;
+        refreshing = true;
+        sessionStorage.setItem(RELOAD_KEY, target);
+        document.documentElement.classList.add('eos-release-refreshing');
+        await purgeBrowserCaches();
+        window.location.replace(reloadUrl(target));
+    };
+    const checkServerVersion = async () => {
+        try {
+            const endpoint = new URL('./version', window.location.href);
+            endpoint.searchParams.set('_eosTs', String(Date.now()));
+            const response = await fetch(endpoint, {
+                cache: 'no-store',
+                credentials: 'same-origin',
+                headers: { 'Cache-Control': 'no-cache' },
+            });
+            if (!response.ok) return;
+            const serverVersion = normalize(await response.text());
+            if (validRelease(serverVersion) && serverVersion !== RELEASE) {
+                await reloadFor(serverVersion);
+            }
+        } catch (_) { /* adapter restart or temporary network interruption */ }
+    };
+
+    window.NEXOWATT_EOS_RELEASE = RELEASE;
+    const previous = normalize(localStorage.getItem(RELEASE_KEY));
+    localStorage.setItem(RELEASE_KEY, RELEASE);
+    const loadedFor = normalize(new URL(window.location.href).searchParams.get('_eosRelease'));
+    if (previous && previous !== RELEASE && loadedFor !== RELEASE) {
+        void reloadFor(RELEASE);
+    } else {
+        sessionStorage.removeItem(RELOAD_KEY);
+    }
+
+    window.addEventListener('focus', () => void checkServerVersion());
+    document.addEventListener('visibilitychange', () => {
+        if (document.visibilityState === 'visible') void checkServerVersion();
+    });
+    window.setInterval(() => void checkServerVersion(), CHECK_MS);
+    window.NEXOWATT_EOS_RELEASE_WATCH = Object.freeze({
+        release: RELEASE,
+        check: checkServerVersion,
+        purge: purgeBrowserCaches,
+    });
+})();

package/adminWww/js/eos-role-bootstrap.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v97-first-login-password-native-overview';
+    const VERSION = 'v99-first-login-password-persisted';
     const script = document.currentScript || document.querySelector('script[src*="eos-role-bootstrap.js"]');
     const entry = script?.dataset?.eosEntry || '';
     let launched = false;
@@ -80,6 +80,7 @@
             required: 'Bitte beide Passwortfelder ausfüllen.', mismatch: 'Die Passwörter stimmen nicht überein.',
             length: min => `Das Passwort muss mindestens ${min} Zeichen lang sein.`, complexity: 'Groß-/Kleinbuchstabe, Zahl und Sonderzeichen sind erforderlich.',
             easy: 'Das Passwort ist zu leicht oder enthält den Kontonamen.', generic: 'Das Passwort konnte nicht gespeichert werden.', success: 'Passwort gespeichert. Die Anmeldung wird neu gestartet …',
+            backendErrors: { invalidRequest: 'Die Sicherheitsbestätigung fehlt. Bitte erneut anmelden.', invalidRequestOrigin: 'Die Sitzung oder aufgerufene Adresse hat sich geändert. Bitte erneut anmelden.', passwordApiUnavailable: 'Die ioBroker-Passwortverwaltung ist nicht verfügbar.', passwordNotPersisted: 'Das Passwort wurde nicht im ioBroker-Benutzerkonto gespeichert.', passwordVerificationFailed: 'Das neue Passwort wurde geschrieben, aber nicht als gültige Anmeldung bestätigt.', passwordMetadataNotPersisted: 'Das Passwort wurde gespeichert, aber der Erstanmeldungsstatus konnte nicht abgeschlossen werden.', passwordSetupFailed: 'Das Passwort konnte serverseitig nicht gespeichert werden. Bitte das EOS-Systemlog prüfen.' },
             securityTitle: 'Zugriff wird geprüft', securityIntro: 'Die sichere Anmeldung wird gerade geprüft. Die Oberfläche bleibt gesperrt, bis die Berechtigungen eindeutig geladen wurden.',
             securityRetry: 'Jetzt erneut prüfen', securityLogout: 'Zur Anmeldung', securityAuto: seconds => `Automatischer neuer Versuch in ${seconds} Sekunden …`,
             claimLauncher: 'Erstanmeldung', claimTitle: 'Konto erstmals aktivieren',
@@ -99,6 +100,7 @@
             required: 'Please complete both password fields.', mismatch: 'The passwords do not match.',
             length: min => `The password must contain at least ${min} characters.`, complexity: 'Upper/lower case, a number and a special character are required.',
             easy: 'The password is too easy or contains the account name.', generic: 'The password could not be saved.', success: 'Password saved. Restarting sign-in …',
+            backendErrors: { invalidRequest: 'The security confirmation is missing. Sign in again.', invalidRequestOrigin: 'The session or address changed. Sign in again.', passwordApiUnavailable: 'The ioBroker password service is unavailable.', passwordNotPersisted: 'The password was not persisted in the ioBroker user account.', passwordVerificationFailed: 'The new password was written but could not be verified as a valid login.', passwordMetadataNotPersisted: 'The password was saved, but the first-login status could not be completed.', passwordSetupFailed: 'The password could not be saved on the server. Check the EOS system log.' },
             securityTitle: 'Checking access', securityIntro: 'The secure sign-in is being verified. The interface stays locked until the permissions are loaded unambiguously.',
             securityRetry: 'Check again now', securityLogout: 'Return to sign-in', securityAuto: seconds => `Retrying automatically in ${seconds} seconds …`,
             claimLauncher: 'First sign-in', claimTitle: 'Activate account for the first time',
@@ -118,6 +120,7 @@
             required: 'Vul beide wachtwoordvelden in.', mismatch: 'De wachtwoorden zijn niet gelijk.',
             length: min => `Het wachtwoord moet minimaal ${min} tekens bevatten.`, complexity: 'Hoofdletter, kleine letter, cijfer en speciaal teken zijn verplicht.',
             easy: 'Het wachtwoord is te eenvoudig of bevat de accountnaam.', generic: 'Het wachtwoord kon niet worden opgeslagen.', success: 'Wachtwoord opgeslagen. De aanmelding wordt opnieuw gestart …',
+            backendErrors: { invalidRequest: 'De beveiligingsbevestiging ontbreekt. Meld opnieuw aan.', invalidRequestOrigin: 'De sessie of het adres is gewijzigd. Meld opnieuw aan.', passwordApiUnavailable: 'De ioBroker-wachtwoordservice is niet beschikbaar.', passwordNotPersisted: 'Het wachtwoord is niet in het ioBroker-gebruikersaccount opgeslagen.', passwordVerificationFailed: 'Het nieuwe wachtwoord is geschreven maar kon niet als geldige aanmelding worden bevestigd.', passwordMetadataNotPersisted: 'Het wachtwoord is opgeslagen, maar de eerste-aanmeldstatus kon niet worden afgerond.', passwordSetupFailed: 'Het wachtwoord kon server-side niet worden opgeslagen. Controleer het EOS-systeemlogboek.' },
             securityTitle: 'Toegang wordt gecontroleerd', securityIntro: 'De veilige aanmelding wordt gecontroleerd. De interface blijft vergrendeld totdat de rechten eenduidig zijn geladen.',
             securityRetry: 'Nu opnieuw controleren', securityLogout: 'Terug naar aanmelden', securityAuto: seconds => `Automatisch opnieuw proberen over ${seconds} seconden …`,
             claimLauncher: 'Eerste aanmelding', claimTitle: 'Account voor het eerst activeren',
@@ -198,7 +201,7 @@
                 });
                 const data = await response.json().catch(() => ({}));
                 if (!response.ok || data.error) {
-                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy };
+                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy, ...(t.backendErrors || {}) };
                     throw new Error(messages[data.error] || t.generic);
                 }
                 setStatus(t.success, 'success');
@@ -271,7 +274,7 @@
                 });
                 const data = await response.json().catch(() => ({}));
                 if (!response.ok || data.error) {
-                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy, claimExpired: t.claimExpired };
+                    const messages = { passwordRequired: t.required, passwordMismatch: t.mismatch, passwordLength: t.length(minLength), passwordComplexity: t.complexity, passwordTooEasy: t.easy, claimExpired: t.claimExpired, ...(t.backendErrors || {}) };
                     throw new Error(messages[data.error] || t.generic);
                 }
                 overlay.querySelector('.eos-activation-steps span:nth-of-type(2)')?.classList.add('done');
@@ -500,7 +503,7 @@
             const { username, password, card, submit } = loginElements();
             if (!username || !password || !card) return;
             card.classList.add('eos-login-card-modern');
-            // v97 compact normal-login first activation: do not add role buttons or a second panel.
+            // v99 normal-login first activation: do not add role buttons or a second panel.
             // The account is entered in the existing Loginname field; a blank password is accepted only
             // after the backend confirms that this exact managed account is eligible.
             card.querySelectorAll('.eos-login-role-selector').forEach(element => element.remove());

package/adminWww/js/eos-role-ui.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v97-native-overview-ems-live-reserve-filter';
+    const VERSION = 'v99-native-overview-ems-live-reserve-filter';
     window.NEXOWATT_EOS_ROLE_UI_VERSION = VERSION;
 
     const state = {
@@ -278,7 +278,7 @@
         });
     };
     const ensureSafeOverview = () => safe(() => {
-        // 7.9.97: never cover the real Admin Intro with a second tile surface.
+        // 7.9.99: never cover the real Admin Intro with a second tile surface.
         // Installer and end-user use the native card component; security remains
         // enforced by route/instance filters and backend permissions.
         removeSafeOverview();

package/adminWww/js/nexowatt-native-shell.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v97-nexowatt-native-shell-native-overview';
+    const VERSION = 'v99-nexowatt-native-shell-native-overview';
     const previous = window.NEXOWATT_NATIVE_SHELL;
     if (previous?.version === VERSION) return;
     previous?.destroy?.();

package/adminWww/static/js/nexowatt-stable-login.js

@@ -1,4 +1,4 @@
-/* NexoWatt EOS stable runtime v97 */
+/* NexoWatt EOS stable runtime v99 */
 (() => {
   'use strict';
   const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
@@ -14,8 +14,8 @@
   const findSubmit = () => [...document.querySelectorAll('button,input[type="submit"]')].find(element => visible(element) && (/anmelden|login|sign in/i.test((element.textContent || element.value || '').trim()) || element.type === 'submit'));
   const sync = () => {
     if (!isLogin()) return;
-    document.documentElement.classList.add('nw-eos-login-v97');
-    document.body?.classList.add('nw-eos-login-v97');
+    document.documentElement.classList.add('nw-eos-login-v99');
+    document.body?.classList.add('nw-eos-login-v99');
     const username = findInput('user');
     const password = findInput('password');
     const submit = findSubmit();

package/adminWww/static/js/{nexowatt-stable-v97.js → nexowatt-stable-v99.js}

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v97-compact-login-ems-connection';
+    const VERSION = 'v99-compact-login-ems-connection';
     const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
     const normalizeUser = value => String(value || '').trim().toLowerCase().replace(/^system\.user\./, '');
     const apply = () => {
@@ -29,5 +29,5 @@
         document.addEventListener('change', schedule, true);
     };
     document.readyState === 'loading' ? document.addEventListener('DOMContentLoaded', start, { once: true }) : start();
-    window.NEXOWATT_EOS_STABLE_V97 = Object.freeze({ version: VERSION, refresh: apply });
+    window.NEXOWATT_EOS_STABLE_V99 = Object.freeze({ version: VERSION, refresh: apply });
 })();

package/build/lib/eosPassword.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeEosPasswordTarget = normalizeEosPasswordTarget;
+exports.setEosUserPasswordWithVerification = setEosUserPasswordWithVerification;
+function normalizeEosPasswordTarget(value) {
+    const raw = String(value || '').trim();
+    const userId = raw.startsWith('system.user.') ? raw : `system.user.${raw}`;
+    const userName = userId.replace(/^system\.user\./, '').trim();
+    if (!userName || userName.includes('.') || !/^system\.user\.[^.]+$/.test(userId)) {
+        throw new Error('invalidPasswordTarget');
+    }
+    return { userId, userName };
+}
+async function callPasswordApi(adapter, userName, password, serviceUser) {
+    const options = { user: serviceUser };
+    if (typeof adapter.setPasswordAsync === 'function') {
+        await adapter.setPasswordAsync(userName, password, options);
+        return;
+    }
+    if (typeof adapter.setPassword === 'function') {
+        await new Promise((resolve, reject) => {
+            adapter.setPassword?.(userName, password, options, error => (error ? reject(error) : resolve()));
+        });
+        return;
+    }
+    throw new Error('passwordApiUnavailable');
+}
+async function waitForPasswordHash(adapter, userId) {
+    for (let attempt = 0; attempt < 6; attempt++) {
+        const user = await adapter.getForeignObjectAsync(userId);
+        if (typeof user?.common?.password === 'string' && user.common.password.length > 0) {
+            return;
+        }
+        if (attempt < 5) {
+            await new Promise(resolve => setTimeout(resolve, 40 * (attempt + 1)));
+        }
+    }
+    throw new Error('passwordNotPersisted');
+}
+async function verifyCredential(adapter, userName, password, serviceUser) {
+    if (typeof adapter.checkPasswordAsync !== 'function') {
+        return;
+    }
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const result = await adapter.checkPasswordAsync(userName, password, { user: serviceUser });
+        const accepted = result === true || (Array.isArray(result) && result[0] === true);
+        if (accepted) {
+            return;
+        }
+        if (attempt < 4) {
+            await new Promise(resolve => setTimeout(resolve, 50 * (attempt + 1)));
+        }
+    }
+    throw new Error('passwordVerificationFailed');
+}
+async function setEosUserPasswordWithVerification(adapter, target, password, serviceUser = 'system.user.admin') {
+    const normalized = normalizeEosPasswordTarget(target);
+    await callPasswordApi(adapter, normalized.userName, password, serviceUser);
+    await waitForPasswordHash(adapter, normalized.userId);
+    await verifyCredential(adapter, normalized.userName, password, serviceUser);
+    return normalized;
+}

package/build/lib/eosRequestSecurity.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isEosSameOriginRequest = isEosSameOriginRequest;
+function isEosSameOriginRequest(headers) {
+    const origin = String(headers.origin || '').trim();
+    if (!origin) {
+        return true;
+    }
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return false;
+        }
+        const allowedHosts = new Set();
+        const addHost = value => {
+            const host = String(value || '').split(',')[0].trim().toLowerCase();
+            if (host)
+                allowedHosts.add(host);
+        };
+        addHost(headers.host);
+        addHost(headers['x-forwarded-host']);
+        if (!allowedHosts.size || !allowedHosts.has(parsed.host.toLowerCase())) {
+            return false;
+        }
+        const fetchSite = String(headers['sec-fetch-site'] || '').trim().toLowerCase();
+        return !fetchSite || fetchSite === 'same-origin' || fetchSite === 'same-site' || fetchSite === 'none';
+    }
+    catch {
+        return false;
+    }
+}