iobroker.eos-admin 7.9.97 → 7.9.99

package/build/lib/web.js

@@ -21,6 +21,8 @@ const session = require("express-session");
 const bodyParser = require("body-parser");
 const cookieParser = require("cookie-parser");
 const iobroker_mcp_1 = require("iobroker.mcp");
+const eosPassword_1 = require("./eosPassword");
+const eosRequestSecurity_1 = require("./eosRequestSecurity");
 let AdapterStore;
 /** Content of a socket-io file */
 let socketIoFile;
@@ -714,22 +716,9 @@ class Web {
         return { valid: true, password: value };
     }
     async setEosUserPassword(userId, password) {
-        // The authenticated route is strictly self-service: the target user comes from the current
-        // session and cannot be supplied by the browser. Use the trusted EOS service context for the
-        // actual password write so installer/end-user groups do not need global users.write rights.
-        const options = { user: EOS_PASSWORD_SERVICE_USER };
-        if (typeof this.adapter.setPasswordAsync === 'function') {
-            await this.adapter.setPasswordAsync(userId, password, options);
-            return;
-        }
-        if (typeof this.adapter.setPassword === 'function') {
-            await new Promise((resolve, reject) => {
-                this.adapter.setPassword?.(userId, password, options, error => (error ? reject(error) : resolve()));
-            });
-            return;
-        }
-        throw new Error('passwordApiUnavailable');
+        await (0, eosPassword_1.setEosUserPasswordWithVerification)(this.adapter, userId, password, EOS_PASSWORD_SERVICE_USER);
     }
+
     async destroyEosRequestSessions(req) {
         const token = this.readAccessTokenFromRequest(req);
         if (!token || typeof this.adapter.destroySession !== 'function') {
@@ -758,7 +747,11 @@ class Web {
             res.status(403).json({ error: 'passwordSetupNotAllowed' });
             return;
         }
-        if (!this.isEosSameOriginWrite(req) || req.headers['x-nexowatt-eos-first-login'] !== '1') {
+        if (req.headers['x-nexowatt-eos-first-login'] !== '1') {
+            res.status(403).json({ error: 'invalidRequest' });
+            return;
+        }
+        if (!this.isEosSameOriginWrite(req)) {
             res.status(403).json({ error: 'invalidRequestOrigin' });
             return;
         }
@@ -781,8 +774,8 @@ class Web {
         if (!userObject) {
             throw new Error('userObjectUnavailableAfterPasswordChange');
         }
-        const native = (userObject.native ||= {});
-        const account = (native.nexowattEosAccount ||= {});
+        const native = { ...(userObject.native || {}) };
+        const account = { ...(native.nexowattEosAccount || {}) };
         const now = new Date().toISOString();
         account.passwordInitialized = true;
         account.passwordInitializedAt = Date.now();
@@ -793,13 +786,18 @@ class Web {
         account.firstLoginCompletedAt = now;
         account.forcePasswordChange = false;
         account.passwordlessFirstLoginAllowed = false;
+        native.nexowattEosAccount = account;
         native.nexowattPasswordChangeRequired = false;
         native.eosPasswordChangeRequired = false;
         native.nexowattFirstLoginPending = false;
         native.eosFirstLoginRequired = false;
         native.nexowattInitialPasswordApplied = false;
         native.nexowattPasswordChangedAt = now;
-        await this.adapter.setForeignObjectAsync(access.userId, userObject);
+        await this.adapter.extendForeignObjectAsync(access.userId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
+        const persistedState = await this.getEosFirstLoginPasswordState(access.userId, access.role);
+        if (persistedState.required || !persistedState.initialized) {
+            throw new Error('passwordMetadataNotPersisted');
+        }
         await this.destroyEosRequestSessions(req);
         for (const cookie of ['access_token', 'refresh_token', 'connect.sid']) {
             res.clearCookie(cookie);
@@ -1027,8 +1025,8 @@ class Web {
         if (!user) {
             throw new Error('userObjectUnavailableAfterPasswordChange');
         }
-        const native = (user.native ||= {});
-        const account = (native.nexowattEosAccount ||= {});
+        const native = { ...(user.native || {}) };
+        const account = { ...(native.nexowattEosAccount || {}) };
         const now = new Date().toISOString();
         account.passwordInitialized = true;
         account.passwordInitializedAt = Date.now();
@@ -1040,7 +1038,12 @@ class Web {
         account.forcePasswordChange = false;
         account.passwordlessFirstLoginAllowed = false;
         account.passwordlessClaimCompletedAt = now;
-        await this.adapter.setForeignObjectAsync(claim.userId, user);
+        native.nexowattEosAccount = account;
+        native.nexowattPasswordChangeRequired = false;
+        native.eosPasswordChangeRequired = false;
+        native.nexowattFirstLoginPending = false;
+        native.eosFirstLoginRequired = false;
+        await this.adapter.extendForeignObjectAsync(claim.userId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
         this.invalidateEosPasswordClaimsForUser(claim.userId);
         res.clearCookie('nexowatt_eos_first_login', { path: '/nexowatt/account' });
         this.adapter.log.info(`EOS passwordless first activation completed for ${claim.userId}`);
@@ -1106,11 +1109,16 @@ class Web {
     async resetEosAccountPassword(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
         const access = await this.getEosRequestAccess(req);
-        if (!access.userId
-            || (access.role !== 'admin' && access.role !== 'installer')
-            || !this.isEosSameOriginWrite(req)
-            || req.headers['x-nexowatt-eos-account-reset'] !== '1') {
-            res.status(403).json({ error: 'permissionError' });
+        if (!access.userId || (access.role !== 'admin' && access.role !== 'installer')) {
+            res.status(403).json({ error: 'permissionError', role: access.role });
+            return;
+        }
+        if (req.headers['x-nexowatt-eos-account-reset'] !== '1') {
+            res.status(403).json({ error: 'invalidRequest' });
+            return;
+        }
+        if (!this.isEosSameOriginWrite(req)) {
+            res.status(403).json({ error: 'invalidRequestOrigin' });
             return;
         }
         const targetUserId = this.normalizeEosUserId(req.body?.user);
@@ -1118,19 +1126,12 @@ class Web {
             res.status(400).json({ error: 'invalidTarget' });
             return;
         }
-        const targetAccess = await this.getEosAccessForUserId(targetUserId);
-        const explicitInstaller = targetAccess.groups.some(group => this.getEosInstallerGroups().includes(group));
-        const explicitEndUser = targetAccess.groups.some(group => this.getEosEndUserGroups().includes(group));
-        const explicitlyManagedRole = explicitInstaller
-            ? 'installer'
-            : explicitEndUser
-                ? 'enduser'
-                : null;
-        if (targetAccess.role === 'admin'
-            || !explicitlyManagedRole
-            || (access.role === 'installer' && explicitlyManagedRole !== 'enduser')) {
-            // Never rely on the secure-default "enduser" classification for a password reset. The
-            // target must be an explicit member of a managed EOS installer/end-user group.
+        const managedAccounts = await this.getEosManagedAccounts(access.role);
+        const managedTarget = managedAccounts.find(account => account.id === targetUserId);
+        const explicitlyManagedRole = managedTarget?.role === 'installer' || managedTarget?.role === 'enduser'
+            ? managedTarget.role
+            : null;
+        if (!managedTarget || !explicitlyManagedRole) {
             res.status(403).json({ error: 'permissionError' });
             return;
         }
@@ -1148,8 +1149,8 @@ class Web {
         if (!user) {
             throw new Error('userObjectUnavailableAfterPasswordReset');
         }
-        const native = (user.native ||= {});
-        const account = (native.nexowattEosAccount ||= {});
+        const native = { ...(user.native || {}) };
+        const account = { ...(native.nexowattEosAccount || {}) };
         const now = new Date().toISOString();
         account.passwordInitialized = false;
         account.passwordSetupVersion = 0;
@@ -1159,6 +1160,7 @@ class Web {
         account.passwordResetAt = now;
         account.passwordResetBy = access.userId;
         account.passwordResetMode = 'initial-password';
+        native.nexowattEosAccount = account;
         native.nexowattPasswordChangeRequired = true;
         native.eosPasswordChangeRequired = true;
         native.nexowattFirstLoginPending = true;
@@ -1168,7 +1170,11 @@ class Web {
         native.nexowattStableInitialCredentialVersion = 1;
         delete account.passwordSetAt;
         delete account.firstLoginCompletedAt;
-        await this.adapter.setForeignObjectAsync(targetUserId, user);
+        await this.adapter.extendForeignObjectAsync(targetUserId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
+        const resetState = await this.getEosFirstLoginPasswordState(targetUserId, explicitlyManagedRole);
+        if (!resetState.required || resetState.initialized) {
+            throw new Error('passwordMetadataNotPersisted');
+        }
         this.invalidateEosPasswordClaimsForUser(targetUserId);
         this.adapter.log.warn(`EOS account ${targetUserId} was reset to the mandatory initial-password flow by ${access.userId}`);
         res.status(200).json({
@@ -1245,15 +1251,9 @@ class Web {
         });
     }
     isEosSameOriginWrite(req) {
-        const origin = String(req.headers.origin || '').trim();
-        if (!origin) {
-            return true;
-        }
-        const forwardedProto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim();
-        const protocol = forwardedProto || (this.settings.secure ? 'https' : 'http');
-        const host = String(req.headers.host || '').trim();
-        return !!host && origin === `${protocol}://${host}`;
+        return (0, eosRequestSecurity_1.isEosSameOriginRequest)(req.headers);
     }
+
     async saveEosBasicSettings(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
         const access = await this.getEosRequestAccess(req);
@@ -1484,6 +1484,9 @@ class Web {
                 next();
             });*/
             this.server.app.get('/version', (_req, res) => {
+                res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+                res.setHeader('Pragma', 'no-cache');
+                res.setHeader('Expires', '0');
                 res.status(200).send(this.adapter.version);
             });
             // v36: Repair stale/broken URLs generated by older EOS hard-logout builds.
@@ -1762,8 +1765,13 @@ class Web {
             });
             this.server.app.post('/nexowatt/account/first-password', (req, res) => {
                 void this.saveEosFirstLoginPassword(req, res).catch(e => {
-                    this.adapter.log.warn(`Cannot initialize EOS first-login password: ${e instanceof Error ? e.message : e}`);
-                    res.status(500).json({ error: 'passwordSetupFailed' });
+                    const detail = e instanceof Error ? e.message : String(e || '');
+                    this.adapter.log.warn(`Cannot initialize EOS first-login password: ${detail}`);
+                    const known = new Set([
+                        'passwordApiUnavailable', 'passwordNotPersisted', 'passwordVerificationFailed',
+                        'passwordMetadataNotPersisted', 'userObjectUnavailableAfterPasswordChange',
+                    ]);
+                    res.status(500).json({ error: known.has(detail) ? detail : 'passwordSetupFailed' });
                 });
             });
             this.server.app.get('/nexowatt/account/manage', (req, res) => {
@@ -1774,8 +1782,13 @@ class Web {
             });
             this.server.app.post('/nexowatt/account/reset', (req, res) => {
                 void this.resetEosAccountPassword(req, res).catch(e => {
-                    this.adapter.log.warn(`Cannot reset EOS account: ${e instanceof Error ? e.message : e}`);
-                    res.status(500).json({ error: 'accountResetFailed' });
+                    const detail = e instanceof Error ? e.message : String(e || '');
+                    this.adapter.log.warn(`Cannot reset EOS account: ${detail}`);
+                    const known = new Set([
+                        'passwordApiUnavailable', 'passwordNotPersisted', 'passwordVerificationFailed',
+                        'passwordMetadataNotPersisted', 'userObjectUnavailableAfterPasswordReset',
+                    ]);
+                    res.status(500).json({ error: known.has(detail) ? detail : 'accountResetFailed' });
                 });
             });
             this.server.app.get('/iobroker_check.html', (_req, res) => {
@@ -1902,7 +1915,29 @@ class Web {
                     res.status(404).send(get404Page(`File ${escapeHtml(fileName)} not found`));
                 }
             });
-            const appOptions = {};
+            const isEosCurrentAsset = (pathName) => pathName === '/'
+                || pathName === '/index.html'
+                || pathName === '/manifest.json'
+                || pathName === '/mf-manifest.json'
+                || pathName === '/version'
+                || /^\/(?:js|css)\/(?:eos-|nexowatt-)/.test(pathName)
+                || /^\/static\/js\/nexowatt-stable-v\d+\.js$/.test(pathName)
+                || /^\/remoteEntry(?:-v\d+)?\.js$/.test(pathName)
+                || /^\/assets\/(?:bootstrap|hostInit|Intro|index-CQZugZ1z|index-D2ymscJA|iobroker_admin__mf_v__runtimeInit__mf_v__)-[^/]+\.js$/.test(pathName);
+            const applyNoStoreHeaders = (res) => {
+                res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+                res.setHeader('Pragma', 'no-cache');
+                res.setHeader('Expires', '0');
+                res.setHeader('Surrogate-Control', 'no-store');
+            };
+            const appOptions = {
+                setHeaders: (res, filePath) => {
+                    const raw = filePath.startsWith(this.wwwDir) ? filePath.slice(this.wwwDir.length) : filePath;
+                    const relativePath = `/${raw.replace(/\\/g, '/').replace(/^\/+/, '')}`;
+                    if (isEosCurrentAsset(relativePath))
+                        applyNoStoreHeaders(res);
+                },
+            };
             if (this.settings.cache) {
                 appOptions.maxAge = 30_758_400_000;
             }
@@ -2000,31 +2035,24 @@ class Web {
                 this.server.app.get('/empty.html', (_req, res) => {
                     res.status(200).send('');
                 });
-                // Stability release: entrypoints and module-federation manifests must always
-                // revalidate. Hashed leaf assets remain cacheable through express.static.
+                // EOS entrypoints, overlays and patched module bundles must never be reused
+                // from a previous release. Hashed untouched leaf assets may remain cacheable.
                 this.server.app.use((req, res, next) => {
                     const pathName = req.path || req.url.split('?')[0];
-                    if (pathName === '/'
-                        || pathName === '/index.html'
-                        || pathName === '/mf-manifest.json'
-                        || /^\/remoteEntry(?:-v\d+)?\.js$/.test(pathName)
-                        || /^\/assets\/(?:hostInit|index-CQZugZ1z)-[^/]+\.js$/.test(pathName)) {
-                        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-                        res.setHeader('Pragma', 'no-cache');
-                        res.setHeader('Expires', '0');
-                    }
+                    if (isEosCurrentAsset(pathName))
+                        applyNoStoreHeaders(res);
                     next();
                 });
                 this.server.app.get('/index.html', async (_req, res) => {
-                    this.indexHTML ||= await this.prepareIndex('/index.html');
+                    this.indexHTML = await this.prepareIndex('/index.html');
                     res.header('Content-Type', 'text/html');
-                    res.header('Cache-Control', 'no-cache');
+                    applyNoStoreHeaders(res);
                     res.status(200).send(this.indexHTML);
                 });
                 this.server.app.get('/', async (_req, res) => {
-                    this.indexHTML ||= await this.prepareIndex('/index.html');
+                    this.indexHTML = await this.prepareIndex('/index.html');
                     res.header('Content-Type', 'text/html');
-                    res.header('Cache-Control', 'no-cache');
+                    applyNoStoreHeaders(res);
                     res.status(200).send(this.indexHTML);
                 });
                 this.server.app.use('/', express.static(this.wwwDir, appOptions));

package/build/main.js

@@ -20,6 +20,7 @@ const socket_classes_1 = require("@iobroker/socket-classes");
 const ws_server_1 = require("@iobroker/ws-server");
 const translations_1 = require("./lib/translations");
 const web_1 = require("./lib/web");
+const eosPassword_1 = require("./lib/eosPassword");
 const checkLinuxPass_1 = require("./lib/checkLinuxPass");
 const plugin_docker_1 = require("@iobroker/plugin-docker");
 const objectFixes_1 = require("./lib/objectFixes");
@@ -1152,7 +1153,7 @@ class Admin extends adapter_core_1.Adapter {
         }
         if (String(user.common.password || '') === '') {
             const bootstrapSecret = `${(0, node_crypto_1.randomBytes)(48).toString('base64url')}!aA1`;
-            await this.setPasswordAsync(userId, bootstrapSecret, { user: ADMIN_OWNER_USER });
+            await (0, eosPassword_1.setEosUserPasswordWithVerification)(this, userId, bootstrapSecret, ADMIN_OWNER_USER);
             user = (await this.getForeignObjectAsync(userId));
             if (!user) {
                 return;

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.9.97",
+    "version": "7.9.99",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -329,7 +329,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.97/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.99/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -340,7 +340,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.97/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.99/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -408,7 +408,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.97/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.99/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1117,5 +1117,5 @@
       }
     }
   },
-  "version": "7.9.97"
+  "version": "7.9.99"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin – stable sales release with orderly login, role-safe overview and live EMS diagnosis.",
-  "version": "7.9.97",
+  "description": "NexoWatt EOS Admin – stable candidate with truthful EMS overview, verified user passwords and deterministic browser updates.",
+  "version": "7.9.99",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -118,19 +118,22 @@
     "tools/nexowatt-version-sync-selftest.cjs",
     "tools/nexowatt-merge-update-selftest.cjs",
     "tools/nexowatt-ems-overview-selftest.cjs",
-    "README_STABILITY_V7.9.97.md",
-    "RELEASE_NOTES_V7.9.97.md",
-    "PUBLISH_STABLE_V7.9.97.md",
-    "INSTALL_TEST_V7.9.97.md",
-    "RELEASE_ACCEPTANCE_V7.9.97.md",
-    "MERGE_UPDATE_README_V7.9.97.md",
+    "README_STABILITY_V7.9.99.md",
+    "RELEASE_NOTES_V7.9.99.md",
+    "PUBLISH_STABLE_V7.9.99.md",
+    "INSTALL_TEST_V7.9.99.md",
+    "RELEASE_ACCEPTANCE_V7.9.99.md",
+    "MERGE_UPDATE_README_V7.9.99.md",
     "README_EMS_OVERVIEW_MERGE.md",
     "RC73_EOS_ADMIN_MERGE_VALIDATION.md",
     "VALIDATION_EMS_OVERVIEW_MERGE.md",
     "NexoWatt_EOS_Admin_EMS_OVERVIEW_MERGE_VALIDATION.md",
     "tools/nexowatt-apply-ems-overview.cjs",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs",
-    "tools/nexowatt-stable-v97-selftest.cjs"
+    "tools/nexowatt-stable-v99-selftest.cjs",
+    "tools/nexowatt-password-write-selftest.cjs",
+    "tools/nexowatt-request-security-selftest.cjs",
+    "tools/nexowatt-cache-update-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -165,7 +168,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && npm run check:eos-stable-v97 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-cache-update-selftest.cjs && node tools/nexowatt-request-security-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && npm run check:eos-stable-v99 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -189,7 +192,10 @@
     "sync:eos-version": "node tools/nexowatt-sync-release-version.cjs",
     "test:eos-version-sync": "node tools/nexowatt-version-sync-selftest.cjs",
     "verify:eos-merge": "node tools/nexowatt-merge-update-selftest.cjs",
-    "check:eos-stable-v97": "node tools/nexowatt-stable-v97-selftest.cjs"
+    "check:eos-stable-v99": "node tools/nexowatt-stable-v99-selftest.cjs",
+    "test:eos-password-write": "node tools/nexowatt-password-write-selftest.cjs",
+    "test:eos-request-security": "node tools/nexowatt-request-security-selftest.cjs",
+    "test:eos-cache-update": "node tools/nexowatt-cache-update-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -200,7 +206,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.97"
+    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.99"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-account-management-selftest.cjs

@@ -1,60 +1,23 @@
 #!/usr/bin/env node
 'use strict';
-const fs = require('fs');
-const path = require('path');
-const root = path.resolve(__dirname, '..');
-const read = rel => fs.readFileSync(path.join(root, rel), 'utf8');
-const json = rel => JSON.parse(read(rel));
-let bad = false;
-const fail = msg => { console.error(`[NexoWatt EOS account management] ${msg}`); bad = true; };
-
-const mainSource = read('src/main.ts');
-const mainBuilt = read('build/main.js');
-const webSource = read('src/lib/web.ts');
-const webBuilt = read('build/lib/web.js');
-const sourceUi = read('src-admin/public/js/eos-account-management.js');
-const builtUi = read('adminWww/js/eos-account-management.js');
-const roleUi = read('adminWww/js/eos-role-ui.js');
-const css = read('adminWww/css/nexowatt-native-shell.css');
-const index = read('adminWww/index.html');
-const info = json('NEXOWATT_EOS_BUILD_INFO.json');
-const shellTag = String(info.shellCacheTag || info.shellCacheVersion);
-
-for (const code of [mainSource, mainBuilt]) {
-  for (const marker of [
-    'system.user.installer', 'system.user.guest', 'ensureEosDefaultRoleUsers', 'unknown random bootstrap secret',
-    'eosPasswordSetupRequired', 'personal password setup is required',
-  ]) if (!code.includes(marker)) fail(`main account marker missing: ${marker}`);
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const json=rel=>JSON.parse(read(rel));
+const fail=m=>{console.error(`[NexoWatt EOS account management] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
+const mainSource=read('src/main.ts'),mainBuilt=read('build/main.js'),webSource=read('src/lib/web.ts'),webBuilt=read('build/lib/web.js'),passwordSource=read('src/lib/eosPassword.ts');
+const sourceUi=read('src-admin/public/js/eos-account-management.js'),builtUi=read('adminWww/js/eos-account-management.js'),roleUi=read('adminWww/js/eos-role-ui.js'),css=read('adminWww/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),info=json('NEXOWATT_EOS_BUILD_INFO.json'),shellTag=String(info.shellCacheTag||info.shellCacheVersion);
+for(const code of [mainSource,mainBuilt])for(const marker of ['system.user.installer','system.user.guest','ensureEosDefaultRoleUsers','unknown random bootstrap secret','personal password setup is required'])must(code.includes(marker),`main marker missing: ${marker}`);
+for(const code of [webSource,webBuilt]){
+  for(const marker of ['getEosManagedAccounts','sendEosAccountManagement','resetEosAccountPassword','/nexowatt/account/manage','/nexowatt/account/reset','x-nexowatt-eos-account-reset','canResetInstaller','canResetEndUser',"targetUserId === 'system.user.admin'",'targetUserId === access.userId','const managedAccounts = await this.getEosManagedAccounts(access.role)','const managedTarget = managedAccounts.find(account => account.id === targetUserId)',"managedTarget?.role === 'installer'","managedTarget?.role === 'enduser'",'passwordResetAt','passwordResetBy',"passwordResetMode = 'initial-password'","setEosUserPassword(targetUserId, 'nexowatt')",'passwordlessFirstLoginAllowed = false','initialPasswordRequired: true','accountDisabled','passwordMetadataNotPersisted']) must(code.includes(marker),`web marker missing: ${marker}`);
+  must(!code.includes('const explicitInstaller = targetAccess.groups.some'),'obsolete explicit installer re-classifier remains');
+  must(!code.includes('const explicitEndUser = targetAccess.groups.some'),'obsolete explicit end-user re-classifier remains');
+  must(!code.includes('setForeignObjectAsync(targetUserId, user)'),'reset still writes stale full user object');
 }
-for (const code of [webSource, webBuilt]) {
-  for (const marker of [
-    'getEosManagedAccounts', 'sendEosAccountManagement', 'resetEosAccountPassword',
-    '/nexowatt/account/manage', '/nexowatt/account/reset', 'x-nexowatt-eos-account-reset',
-    'canResetInstaller', 'canResetEndUser', "targetUserId === 'system.user.admin'", 'targetUserId === access.userId',
-    "access.role === 'installer' && explicitlyManagedRole !== 'enduser'",
-    'explicit member of a managed EOS installer/end-user group', 'passwordResetAt', 'passwordResetBy',
-    "passwordResetMode = 'initial-password'", "setEosUserPassword(targetUserId, 'nexowatt')", 'passwordlessFirstLoginAllowed = false', 'initialPasswordRequired: true', 'accountDisabled',
-  ]) if (!code.includes(marker)) fail(`web account marker missing: ${marker}`);
-  if (!code.includes('const explicitInstaller = targetAccess.groups.some')) fail('reset target is not restricted to explicit installer membership');
-  if (!code.includes('const explicitEndUser = targetAccess.groups.some')) fail('reset target is not restricted to explicit end-user membership');
-}
-
-for (const marker of [
-  'v91-account-management-under-access-rights', "['admin', 'installer']", 'nexowatt/account/manage',
-  'nexowatt/account/reset', 'X-NexoWatt-EOS-Account-Reset', 'data.canResetInstaller === true',
-  "account.role === 'enduser'", 'Admin/Service', 'Installateure', 'NEXOWATT_EOS_ACCOUNT_MANAGEMENT',
-  'ensureEntrySurface', "currentRoute() !== 'tab-users'", 'eos-account-management-entry',
-]) if (!sourceUi.includes(marker)) fail(`account UI marker missing: ${marker}`);
-if (sourceUi.includes("launcher.className = 'eos-account-management-launcher'")) fail('standalone account launcher is still created');
-if (sourceUi.includes('new MutationObserver')) fail('account management adds a second broad MutationObserver');
-if (sourceUi !== builtUi) fail('account management source/build drift');
-if (!roleUi.includes("route === 'tab-users'")) fail('installer cannot reach Zugänge & Rechte');
-if (roleUi.includes('NEXOWATT_EOS_ACCOUNT_MANAGEMENT.open')) fail('role overview opens account management outside Zugänge & Rechte');
-if (!index.includes(`eos-account-management.js?v=${shellTag}`)) fail('account management asset is not active with the current cache tag');
-for (const marker of [
-  '.eos-account-management-entry', '.eos-account-management-overlay', '.eos-account-management-dialog',
-  '.eos-account-row', '.eos-account-reset', 'html.eos-account-page-installer',
-]) if (!css.includes(marker)) fail(`account management CSS marker missing: ${marker}`);
-
-if (bad) process.exit(1);
-console.log('[NexoWatt EOS account management] OK');
+for(const marker of ['setPasswordAsync(userName','checkPasswordAsync(userName','passwordNotPersisted','passwordVerificationFailed'])must(passwordSource.includes(marker),`password helper marker missing: ${marker}`);
+for(const marker of ["VERSION = 'v99-account-management-password-write'","['admin', 'installer']",'nexowatt/account/manage','nexowatt/account/reset','X-NexoWatt-EOS-Account-Reset','data.canResetInstaller === true',"account.role === 'enduser'",'Admin/Service','Installateure','NEXOWATT_EOS_ACCOUNT_MANAGEMENT','ensureEntrySurface',"currentRoute() !== 'tab-users'",'eos-account-management-entry','Startpasswort „nexowatt“','passwordVerificationFailed'])must(sourceUi.includes(marker),`UI marker missing: ${marker}`);
+must(sourceUi===builtUi,'account management source/build drift');
+must(!sourceUi.includes("launcher.className = 'eos-account-management-launcher'"),'standalone account launcher remains');
+must(!sourceUi.includes('new MutationObserver'),'account management adds a broad observer');
+must(roleUi.includes("route === 'tab-users'"),'installer cannot reach Zugänge & Rechte');
+must(!roleUi.includes('NEXOWATT_EOS_ACCOUNT_MANAGEMENT.open'),'overview opens account management outside Zugänge & Rechte');
+must(index.includes(`eos-account-management.js?v=${shellTag}`),'account management cache tag stale');
+for(const marker of ['.eos-account-management-entry','.eos-account-management-overlay','.eos-account-management-dialog','.eos-account-row','.eos-account-reset','html.eos-account-page-installer'])must(css.includes(marker),`CSS marker missing: ${marker}`);
+console.log('[NexoWatt EOS account management] OK (managed-list authorization and real password reset)');

package/tools/nexowatt-apply-ems-overview.cjs

@@ -52,7 +52,7 @@ if (!css.includes(cssMarker)) {
     overflow: hidden;
 }
 .eos-ems-overview-card * { box-sizing: border-box; }
-.eos-ems-overview-header { display:flex; align-items:flex-start; justify-content:space-between; gap:20px; }
+.eos-ems-overview-header { display:flex; align-items:flex-start; justify-content:flex-start; gap:20px; }
 .eos-ems-overview-header h2 { margin:5px 0 6px; font-size:clamp(1.2rem,2vw,1.65rem); color:#f5fbff; }
 .eos-ems-overview-header p { margin:0; max-width:760px; color:#9eb2c2; line-height:1.45; }
 .eos-ems-overview-eyebrow { color:#49e39e; font-size:.72rem; font-weight:900; letter-spacing:.13em; text-transform:uppercase; }
@@ -83,9 +83,7 @@ if (!css.includes(cssMarker)) {
 .eos-ems-overview-event time { color:#6f8799; font-size:.68rem; font-variant-numeric:tabular-nums; }
 .eos-ems-overview-event div { display:grid; gap:2px; min-width:0; }
 .eos-ems-overview-empty { color:#718797; font-size:.76rem; }
-.eos-ems-overview-footer { display:flex; justify-content:space-between; gap:12px; margin-top:12px; color:#60798a; font-size:.67rem; }
-.eos-ems-overview-footer a { color:#5ee0c2; font-weight:800; text-decoration:none; }
-.eos-ems-overview-footer a:hover,.eos-ems-overview-footer a:focus-visible { color:#9af2dd; text-decoration:underline; }
+.eos-ems-overview-footer { display:flex; justify-content:flex-start; gap:12px; margin-top:12px; color:#60798a; font-size:.67rem; }
 @media (max-width: 1100px) {
     .eos-ems-overview-card { flex-basis:100%; max-width:none; }
 }

package/tools/nexowatt-cache-update-selftest.cjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');
+const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const fail=m=>{console.error(`[NexoWatt EOS cache update] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
+const source=read('src/lib/web.ts'),built=read('build/lib/web.js'),index=read('adminWww/index.html'),dev=read('src-admin/index.html'),watch=read('adminWww/js/eos-release-watch.js');
+for(const code of [source,built])for(const marker of ['isEosCurrentAsset','applyNoStoreHeaders','Surrogate-Control','this.indexHTML = await this.prepareIndex'])must(code.includes(marker),`server marker missing: ${marker}`);
+for(const marker of ["const RELEASE = '7.9.99'",'nexowatt.eos.loadedRelease','cache: \'no-store\'','window.location.replace','navigator.serviceWorker?.getRegistrations'])must(watch.includes(marker),`watcher marker missing: ${marker}`);
+for(const html of [index,dev])for(const marker of ['eos-release-watch.js?v=99','nexowatt-stable-v99.js?v=99','nexowatt-native-shell.css?v=99'])must(html.includes(marker),`index marker missing: ${marker}`);
+must(index.includes('hostInit-v84.js?v=99')&&index.includes('index-CQZugZ1z-v84.js?v=99'),'productive module entry cache tags missing');
+must(!/\?v=(?:97|98)(?:["'])/.test(index),'stale product cache tag remains');
+console.log('[NexoWatt EOS cache update] OK (no-store entrypoints and release watcher)');

package/tools/nexowatt-clean-legacy-runtime.cjs

@@ -74,7 +74,7 @@ function isLegacyVersionedRuntime(file, activeRuntime, activeShell) {
   // Stable product overlays use the product release number in their filename,
   // while the compiled React runtime can intentionally remain on v84. Keep
   // only the active stable overlay and remove stale release assets left behind
-  // by a flat ZIP update (for example v96 when installing v97).
+  // by a flat ZIP update (for example v98 when installing v99).
   const stableMatch = name.match(/^nexowatt-stable-v(\d+)\.js$/i);
   if (stableMatch) return Number(stableMatch[1]) !== activeShell;
   const versionMatch = name.match(/-v(\d+)\.(?:js|js\.map|css|css\.map)$/i);

package/tools/nexowatt-ems-overview-selftest.cjs

@@ -19,11 +19,11 @@ for (const marker of [
     'document.visibilityState',
     'window.setInterval(() => void load(), 5_000)',
     'Diagnose ist rein lesend',
-    'Vollständige EMS-Diagnose öffnen',
     'system.adapter.nexowatt-ui.*.alive',
 ]) if (!component.includes(marker)) fail(`Komponenten-Vertrag fehlt: ${marker}`);
 if ((component.match(/NexoWatt EMS · Live-Diagnose/g) || []).length !== 1) fail('EMS-Überschrift ist doppelt oder fehlt.');
 if (!css.includes('/* nexowatt-ems-overview-v1 */')) fail('Responsive EMS-CSS fehlt.');
+if (component.includes('Vollständige EMS-Diagnose öffnen')) fail('Nicht vorhandener Diagnose-Link darf nicht angeboten werden.');
 if (/setState\(|setForeignState\(|sendToHost\(/.test(component)) fail('EMS-Overview darf keine ioBroker-Schreiboperation enthalten.');
 const assetDir = path.join(root, 'admin', 'assets');
 if (fs.existsSync(assetDir)) {