iobroker.eos-admin 7.9.98 → 7.9.99

package/adminWww/static/js/{nexowatt-stable-v98.js → nexowatt-stable-v99.js}

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v98-scroll-login-password-write';
+    const VERSION = 'v99-compact-login-ems-connection';
     const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
     const normalizeUser = value => String(value || '').trim().toLowerCase().replace(/^system\.user\./, '');
     const apply = () => {
@@ -29,5 +29,5 @@
         document.addEventListener('change', schedule, true);
     };
     document.readyState === 'loading' ? document.addEventListener('DOMContentLoaded', start, { once: true }) : start();
-    window.NEXOWATT_EOS_STABLE_V98 = Object.freeze({ version: VERSION, refresh: apply });
+    window.NEXOWATT_EOS_STABLE_V99 = Object.freeze({ version: VERSION, refresh: apply });
 })();

package/build/lib/eosPassword.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeEosPasswordTarget = normalizeEosPasswordTarget;
+exports.setEosUserPasswordWithVerification = setEosUserPasswordWithVerification;
+function normalizeEosPasswordTarget(value) {
+    const raw = String(value || '').trim();
+    const userId = raw.startsWith('system.user.') ? raw : `system.user.${raw}`;
+    const userName = userId.replace(/^system\.user\./, '').trim();
+    if (!userName || userName.includes('.') || !/^system\.user\.[^.]+$/.test(userId)) {
+        throw new Error('invalidPasswordTarget');
+    }
+    return { userId, userName };
+}
+async function callPasswordApi(adapter, userName, password, serviceUser) {
+    const options = { user: serviceUser };
+    if (typeof adapter.setPasswordAsync === 'function') {
+        await adapter.setPasswordAsync(userName, password, options);
+        return;
+    }
+    if (typeof adapter.setPassword === 'function') {
+        await new Promise((resolve, reject) => {
+            adapter.setPassword?.(userName, password, options, error => (error ? reject(error) : resolve()));
+        });
+        return;
+    }
+    throw new Error('passwordApiUnavailable');
+}
+async function waitForPasswordHash(adapter, userId) {
+    for (let attempt = 0; attempt < 6; attempt++) {
+        const user = await adapter.getForeignObjectAsync(userId);
+        if (typeof user?.common?.password === 'string' && user.common.password.length > 0) {
+            return;
+        }
+        if (attempt < 5) {
+            await new Promise(resolve => setTimeout(resolve, 40 * (attempt + 1)));
+        }
+    }
+    throw new Error('passwordNotPersisted');
+}
+async function verifyCredential(adapter, userName, password, serviceUser) {
+    if (typeof adapter.checkPasswordAsync !== 'function') {
+        return;
+    }
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const result = await adapter.checkPasswordAsync(userName, password, { user: serviceUser });
+        const accepted = result === true || (Array.isArray(result) && result[0] === true);
+        if (accepted) {
+            return;
+        }
+        if (attempt < 4) {
+            await new Promise(resolve => setTimeout(resolve, 50 * (attempt + 1)));
+        }
+    }
+    throw new Error('passwordVerificationFailed');
+}
+async function setEosUserPasswordWithVerification(adapter, target, password, serviceUser = 'system.user.admin') {
+    const normalized = normalizeEosPasswordTarget(target);
+    await callPasswordApi(adapter, normalized.userName, password, serviceUser);
+    await waitForPasswordHash(adapter, normalized.userId);
+    await verifyCredential(adapter, normalized.userName, password, serviceUser);
+    return normalized;
+}

package/build/lib/eosRequestSecurity.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isEosSameOriginRequest = isEosSameOriginRequest;
+function isEosSameOriginRequest(headers) {
+    const origin = String(headers.origin || '').trim();
+    if (!origin) {
+        return true;
+    }
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return false;
+        }
+        const allowedHosts = new Set();
+        const addHost = value => {
+            const host = String(value || '').split(',')[0].trim().toLowerCase();
+            if (host)
+                allowedHosts.add(host);
+        };
+        addHost(headers.host);
+        addHost(headers['x-forwarded-host']);
+        if (!allowedHosts.size || !allowedHosts.has(parsed.host.toLowerCase())) {
+            return false;
+        }
+        const fetchSite = String(headers['sec-fetch-site'] || '').trim().toLowerCase();
+        return !fetchSite || fetchSite === 'same-origin' || fetchSite === 'same-site' || fetchSite === 'none';
+    }
+    catch {
+        return false;
+    }
+}

package/build/lib/web.js

@@ -21,6 +21,8 @@ const session = require("express-session");
 const bodyParser = require("body-parser");
 const cookieParser = require("cookie-parser");
 const iobroker_mcp_1 = require("iobroker.mcp");
+const eosPassword_1 = require("./eosPassword");
+const eosRequestSecurity_1 = require("./eosRequestSecurity");
 let AdapterStore;
 /** Content of a socket-io file */
 let socketIoFile;
@@ -713,54 +715,10 @@ class Web {
         }
         return { valid: true, password: value };
     }
-    getEosPasswordUserName(userId) {
-        const userName = String(userId || '').trim().replace(/^system\.user\./, '');
-        if (!/^[A-Za-z0-9_.@-]+$/.test(userName)) {
-            throw new Error('invalidPasswordTarget');
-        }
-        return userName;
-    }
     async setEosUserPassword(userId, password) {
-        // ioBroker's password API expects the account name, not the system.user.* object id.
-        const userName = this.getEosPasswordUserName(userId);
-        // The server-side Admin/Service context performs the controller password write, so managed
-        // Installer and End User accounts do not need global users.write rights in the browser.
-        const options = { user: EOS_PASSWORD_SERVICE_USER };
-        if (typeof this.adapter.setPasswordAsync === 'function') {
-            await this.adapter.setPasswordAsync(userName, password, options);
-        }
-        else if (typeof this.adapter.setPassword === 'function') {
-            await new Promise((resolve, reject) => {
-                this.adapter.setPassword?.(userName, password, options, error => (error ? reject(error) : resolve()));
-            });
-        }
-        else {
-            throw new Error('passwordApiUnavailable');
-        }
-        if (typeof this.adapter.checkPasswordAsync === 'function') {
-            const result = await this.adapter.checkPasswordAsync(userName, password, options);
-            const valid = Array.isArray(result) ? result[0] === true : result === true;
-            if (!valid) {
-                throw new Error('passwordVerificationFailed');
-            }
-            return;
-        }
-        const userObject = (await this.adapter.getForeignObjectAsync(userId));
-        if (!String(userObject?.common?.password || '').trim()) {
-            throw new Error('passwordWriteFailed');
-        }
-    }
-    async updateEosAccountMetadata(userId, updater) {
-        const userObject = (await this.adapter.getForeignObjectAsync(userId));
-        if (!userObject) {
-            throw new Error('userObjectUnavailableAfterPasswordChange');
-        }
-        const native = { ...(userObject.native || {}) };
-        const account = { ...(native.nexowattEosAccount || {}) };
-        native.nexowattEosAccount = account;
-        updater(native, account);
-        await this.adapter.extendForeignObjectAsync(userId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
+        await (0, eosPassword_1.setEosUserPasswordWithVerification)(this.adapter, userId, password, EOS_PASSWORD_SERVICE_USER);
     }
+
     async destroyEosRequestSessions(req) {
         const token = this.readAccessTokenFromRequest(req);
         if (!token || typeof this.adapter.destroySession !== 'function') {
@@ -789,7 +747,11 @@ class Web {
             res.status(403).json({ error: 'passwordSetupNotAllowed' });
             return;
         }
-        if (!this.isEosSameOriginWrite(req) || req.headers['x-nexowatt-eos-first-login'] !== '1') {
+        if (req.headers['x-nexowatt-eos-first-login'] !== '1') {
+            res.status(403).json({ error: 'invalidRequest' });
+            return;
+        }
+        if (!this.isEosSameOriginWrite(req)) {
             res.status(403).json({ error: 'invalidRequestOrigin' });
             return;
         }
@@ -808,24 +770,34 @@ class Web {
             return;
         }
         await this.setEosUserPassword(access.userId, validation.password);
+        const userObject = (await this.adapter.getForeignObjectAsync(access.userId));
+        if (!userObject) {
+            throw new Error('userObjectUnavailableAfterPasswordChange');
+        }
+        const native = { ...(userObject.native || {}) };
+        const account = { ...(native.nexowattEosAccount || {}) };
         const now = new Date().toISOString();
-        await this.updateEosAccountMetadata(access.userId, (native, account) => {
-            account.passwordInitialized = true;
-            account.passwordInitializedAt = Date.now();
-            account.passwordInitializationVersion = 1;
-            account.passwordInitializedBy = 'self';
-            account.passwordSetupVersion = 1;
-            account.passwordSetAt = now;
-            account.firstLoginCompletedAt = now;
-            account.forcePasswordChange = false;
-            account.passwordlessFirstLoginAllowed = false;
-            native.nexowattPasswordChangeRequired = false;
-            native.eosPasswordChangeRequired = false;
-            native.nexowattFirstLoginPending = false;
-            native.eosFirstLoginRequired = false;
-            native.nexowattInitialPasswordApplied = false;
-            native.nexowattPasswordChangedAt = now;
-        });
+        account.passwordInitialized = true;
+        account.passwordInitializedAt = Date.now();
+        account.passwordInitializationVersion = 1;
+        account.passwordInitializedBy = 'self';
+        account.passwordSetupVersion = 1;
+        account.passwordSetAt = now;
+        account.firstLoginCompletedAt = now;
+        account.forcePasswordChange = false;
+        account.passwordlessFirstLoginAllowed = false;
+        native.nexowattEosAccount = account;
+        native.nexowattPasswordChangeRequired = false;
+        native.eosPasswordChangeRequired = false;
+        native.nexowattFirstLoginPending = false;
+        native.eosFirstLoginRequired = false;
+        native.nexowattInitialPasswordApplied = false;
+        native.nexowattPasswordChangedAt = now;
+        await this.adapter.extendForeignObjectAsync(access.userId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
+        const persistedState = await this.getEosFirstLoginPasswordState(access.userId, access.role);
+        if (persistedState.required || !persistedState.initialized) {
+            throw new Error('passwordMetadataNotPersisted');
+        }
         await this.destroyEosRequestSessions(req);
         for (const cookie of ['access_token', 'refresh_token', 'connect.sid']) {
             res.clearCookie(cookie);
@@ -1049,25 +1021,29 @@ class Web {
             return;
         }
         await this.setEosUserPassword(claim.userId, validation.password);
+        const user = (await this.adapter.getForeignObjectAsync(claim.userId));
+        if (!user) {
+            throw new Error('userObjectUnavailableAfterPasswordChange');
+        }
+        const native = { ...(user.native || {}) };
+        const account = { ...(native.nexowattEosAccount || {}) };
         const now = new Date().toISOString();
-        await this.updateEosAccountMetadata(claim.userId, (native, account) => {
-            account.passwordInitialized = true;
-            account.passwordInitializedAt = Date.now();
-            account.passwordInitializationVersion = 1;
-            account.passwordInitializedBy = 'passwordless-first-activation';
-            account.passwordSetupVersion = 1;
-            account.passwordSetAt = now;
-            account.firstLoginCompletedAt = now;
-            account.forcePasswordChange = false;
-            account.passwordlessFirstLoginAllowed = false;
-            account.passwordlessClaimCompletedAt = now;
-            native.nexowattPasswordChangeRequired = false;
-            native.eosPasswordChangeRequired = false;
-            native.nexowattFirstLoginPending = false;
-            native.eosFirstLoginRequired = false;
-            native.nexowattInitialPasswordApplied = false;
-            native.nexowattPasswordChangedAt = now;
-        });
+        account.passwordInitialized = true;
+        account.passwordInitializedAt = Date.now();
+        account.passwordInitializationVersion = 1;
+        account.passwordInitializedBy = 'passwordless-first-activation';
+        account.passwordSetupVersion = 1;
+        account.passwordSetAt = now;
+        account.firstLoginCompletedAt = now;
+        account.forcePasswordChange = false;
+        account.passwordlessFirstLoginAllowed = false;
+        account.passwordlessClaimCompletedAt = now;
+        native.nexowattEosAccount = account;
+        native.nexowattPasswordChangeRequired = false;
+        native.eosPasswordChangeRequired = false;
+        native.nexowattFirstLoginPending = false;
+        native.eosFirstLoginRequired = false;
+        await this.adapter.extendForeignObjectAsync(claim.userId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
         this.invalidateEosPasswordClaimsForUser(claim.userId);
         res.clearCookie('nexowatt_eos_first_login', { path: '/nexowatt/account' });
         this.adapter.log.info(`EOS passwordless first activation completed for ${claim.userId}`);
@@ -1134,10 +1110,14 @@ class Web {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
         const access = await this.getEosRequestAccess(req);
         if (!access.userId || (access.role !== 'admin' && access.role !== 'installer')) {
-            res.status(403).json({ error: 'permissionError' });
+            res.status(403).json({ error: 'permissionError', role: access.role });
             return;
         }
-        if (!this.isEosSameOriginWrite(req) || req.headers['x-nexowatt-eos-account-reset'] !== '1') {
+        if (req.headers['x-nexowatt-eos-account-reset'] !== '1') {
+            res.status(403).json({ error: 'invalidRequest' });
+            return;
+        }
+        if (!this.isEosSameOriginWrite(req)) {
             res.status(403).json({ error: 'invalidRequestOrigin' });
             return;
         }
@@ -1146,19 +1126,12 @@ class Web {
             res.status(400).json({ error: 'invalidTarget' });
             return;
         }
-        const targetAccess = await this.getEosAccessForUserId(targetUserId);
-        const explicitInstaller = targetAccess.groups.some(group => this.getEosInstallerGroups().includes(group));
-        const explicitEndUser = targetAccess.groups.some(group => this.getEosEndUserGroups().includes(group));
-        const explicitlyManagedRole = explicitInstaller
-            ? 'installer'
-            : explicitEndUser
-                ? 'enduser'
-                : null;
-        if (targetAccess.role === 'admin'
-            || !explicitlyManagedRole
-            || (access.role === 'installer' && explicitlyManagedRole !== 'enduser')) {
-            // Never rely on the secure-default "enduser" classification for a password reset. The
-            // target must be an explicit member of a managed EOS installer/end-user group.
+        const managedAccounts = await this.getEosManagedAccounts(access.role);
+        const managedTarget = managedAccounts.find(account => account.id === targetUserId);
+        const explicitlyManagedRole = managedTarget?.role === 'installer' || managedTarget?.role === 'enduser'
+            ? managedTarget.role
+            : null;
+        if (!managedTarget || !explicitlyManagedRole) {
             res.status(403).json({ error: 'permissionError' });
             return;
         }
@@ -1172,26 +1145,36 @@ class Web {
             return;
         }
         await this.setEosUserPassword(targetUserId, 'nexowatt');
+        const user = (await this.adapter.getForeignObjectAsync(targetUserId));
+        if (!user) {
+            throw new Error('userObjectUnavailableAfterPasswordReset');
+        }
+        const native = { ...(user.native || {}) };
+        const account = { ...(native.nexowattEosAccount || {}) };
         const now = new Date().toISOString();
-        await this.updateEosAccountMetadata(targetUserId, (native, account) => {
-            account.passwordInitialized = false;
-            account.passwordSetupVersion = 0;
-            account.passwordInitializationVersion = 0;
-            account.forcePasswordChange = true;
-            account.passwordlessFirstLoginAllowed = false;
-            account.passwordResetAt = now;
-            account.passwordResetBy = access.userId;
-            account.passwordResetMode = 'initial-password';
-            account.passwordSetAt = null;
-            account.firstLoginCompletedAt = null;
-            native.nexowattPasswordChangeRequired = true;
-            native.eosPasswordChangeRequired = true;
-            native.nexowattFirstLoginPending = true;
-            native.eosFirstLoginRequired = true;
-            native.nexowattInitialPasswordApplied = true;
-            native.nexowattInitialPasswordVersion = 1;
-            native.nexowattStableInitialCredentialVersion = 1;
-        });
+        account.passwordInitialized = false;
+        account.passwordSetupVersion = 0;
+        account.passwordInitializationVersion = 0;
+        account.forcePasswordChange = true;
+        account.passwordlessFirstLoginAllowed = false;
+        account.passwordResetAt = now;
+        account.passwordResetBy = access.userId;
+        account.passwordResetMode = 'initial-password';
+        native.nexowattEosAccount = account;
+        native.nexowattPasswordChangeRequired = true;
+        native.eosPasswordChangeRequired = true;
+        native.nexowattFirstLoginPending = true;
+        native.eosFirstLoginRequired = true;
+        native.nexowattInitialPasswordApplied = true;
+        native.nexowattInitialPasswordVersion = 1;
+        native.nexowattStableInitialCredentialVersion = 1;
+        delete account.passwordSetAt;
+        delete account.firstLoginCompletedAt;
+        await this.adapter.extendForeignObjectAsync(targetUserId, { native }, { user: EOS_PASSWORD_SERVICE_USER });
+        const resetState = await this.getEosFirstLoginPasswordState(targetUserId, explicitlyManagedRole);
+        if (!resetState.required || resetState.initialized) {
+            throw new Error('passwordMetadataNotPersisted');
+        }
         this.invalidateEosPasswordClaimsForUser(targetUserId);
         this.adapter.log.warn(`EOS account ${targetUserId} was reset to the mandatory initial-password flow by ${access.userId}`);
         res.status(200).json({
@@ -1268,25 +1251,9 @@ class Web {
         });
     }
     isEosSameOriginWrite(req) {
-        const fetchSite = String(req.headers['sec-fetch-site'] || '').trim().toLowerCase();
-        if (fetchSite === 'cross-site') {
-            return false;
-        }
-        const origin = String(req.headers.origin || '').trim();
-        if (!origin) {
-            return true;
-        }
-        try {
-            const originUrl = new URL(origin);
-            const directHost = String(req.headers.host || '').trim().toLowerCase();
-            const forwardedHost = String(req.headers['x-forwarded-host'] || '').split(',')[0].trim().toLowerCase();
-            const allowedHosts = new Set([directHost, forwardedHost].filter(Boolean));
-            return allowedHosts.has(originUrl.host.toLowerCase());
-        }
-        catch {
-            return false;
-        }
+        return (0, eosRequestSecurity_1.isEosSameOriginRequest)(req.headers);
     }
+
     async saveEosBasicSettings(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
         const access = await this.getEosRequestAccess(req);
@@ -1517,6 +1484,9 @@ class Web {
                 next();
             });*/
             this.server.app.get('/version', (_req, res) => {
+                res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+                res.setHeader('Pragma', 'no-cache');
+                res.setHeader('Expires', '0');
                 res.status(200).send(this.adapter.version);
             });
             // v36: Repair stale/broken URLs generated by older EOS hard-logout builds.
@@ -1795,8 +1765,13 @@ class Web {
             });
             this.server.app.post('/nexowatt/account/first-password', (req, res) => {
                 void this.saveEosFirstLoginPassword(req, res).catch(e => {
-                    this.adapter.log.warn(`Cannot initialize EOS first-login password: ${e instanceof Error ? e.message : e}`);
-                    res.status(500).json({ error: 'passwordSetupFailed' });
+                    const detail = e instanceof Error ? e.message : String(e || '');
+                    this.adapter.log.warn(`Cannot initialize EOS first-login password: ${detail}`);
+                    const known = new Set([
+                        'passwordApiUnavailable', 'passwordNotPersisted', 'passwordVerificationFailed',
+                        'passwordMetadataNotPersisted', 'userObjectUnavailableAfterPasswordChange',
+                    ]);
+                    res.status(500).json({ error: known.has(detail) ? detail : 'passwordSetupFailed' });
                 });
             });
             this.server.app.get('/nexowatt/account/manage', (req, res) => {
@@ -1807,8 +1782,13 @@ class Web {
             });
             this.server.app.post('/nexowatt/account/reset', (req, res) => {
                 void this.resetEosAccountPassword(req, res).catch(e => {
-                    this.adapter.log.warn(`Cannot reset EOS account: ${e instanceof Error ? e.message : e}`);
-                    res.status(500).json({ error: 'accountResetFailed' });
+                    const detail = e instanceof Error ? e.message : String(e || '');
+                    this.adapter.log.warn(`Cannot reset EOS account: ${detail}`);
+                    const known = new Set([
+                        'passwordApiUnavailable', 'passwordNotPersisted', 'passwordVerificationFailed',
+                        'passwordMetadataNotPersisted', 'userObjectUnavailableAfterPasswordReset',
+                    ]);
+                    res.status(500).json({ error: known.has(detail) ? detail : 'accountResetFailed' });
                 });
             });
             this.server.app.get('/iobroker_check.html', (_req, res) => {
@@ -1935,7 +1915,29 @@ class Web {
                     res.status(404).send(get404Page(`File ${escapeHtml(fileName)} not found`));
                 }
             });
-            const appOptions = {};
+            const isEosCurrentAsset = (pathName) => pathName === '/'
+                || pathName === '/index.html'
+                || pathName === '/manifest.json'
+                || pathName === '/mf-manifest.json'
+                || pathName === '/version'
+                || /^\/(?:js|css)\/(?:eos-|nexowatt-)/.test(pathName)
+                || /^\/static\/js\/nexowatt-stable-v\d+\.js$/.test(pathName)
+                || /^\/remoteEntry(?:-v\d+)?\.js$/.test(pathName)
+                || /^\/assets\/(?:bootstrap|hostInit|Intro|index-CQZugZ1z|index-D2ymscJA|iobroker_admin__mf_v__runtimeInit__mf_v__)-[^/]+\.js$/.test(pathName);
+            const applyNoStoreHeaders = (res) => {
+                res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+                res.setHeader('Pragma', 'no-cache');
+                res.setHeader('Expires', '0');
+                res.setHeader('Surrogate-Control', 'no-store');
+            };
+            const appOptions = {
+                setHeaders: (res, filePath) => {
+                    const raw = filePath.startsWith(this.wwwDir) ? filePath.slice(this.wwwDir.length) : filePath;
+                    const relativePath = `/${raw.replace(/\\/g, '/').replace(/^\/+/, '')}`;
+                    if (isEosCurrentAsset(relativePath))
+                        applyNoStoreHeaders(res);
+                },
+            };
             if (this.settings.cache) {
                 appOptions.maxAge = 30_758_400_000;
             }
@@ -2033,31 +2035,24 @@ class Web {
                 this.server.app.get('/empty.html', (_req, res) => {
                     res.status(200).send('');
                 });
-                // Stability release: entrypoints and module-federation manifests must always
-                // revalidate. Hashed leaf assets remain cacheable through express.static.
+                // EOS entrypoints, overlays and patched module bundles must never be reused
+                // from a previous release. Hashed untouched leaf assets may remain cacheable.
                 this.server.app.use((req, res, next) => {
                     const pathName = req.path || req.url.split('?')[0];
-                    if (pathName === '/'
-                        || pathName === '/index.html'
-                        || pathName === '/mf-manifest.json'
-                        || /^\/remoteEntry(?:-v\d+)?\.js$/.test(pathName)
-                        || /^\/assets\/(?:hostInit|index-CQZugZ1z)-[^/]+\.js$/.test(pathName)) {
-                        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-                        res.setHeader('Pragma', 'no-cache');
-                        res.setHeader('Expires', '0');
-                    }
+                    if (isEosCurrentAsset(pathName))
+                        applyNoStoreHeaders(res);
                     next();
                 });
                 this.server.app.get('/index.html', async (_req, res) => {
-                    this.indexHTML ||= await this.prepareIndex('/index.html');
+                    this.indexHTML = await this.prepareIndex('/index.html');
                     res.header('Content-Type', 'text/html');
-                    res.header('Cache-Control', 'no-cache');
+                    applyNoStoreHeaders(res);
                     res.status(200).send(this.indexHTML);
                 });
                 this.server.app.get('/', async (_req, res) => {
-                    this.indexHTML ||= await this.prepareIndex('/index.html');
+                    this.indexHTML = await this.prepareIndex('/index.html');
                     res.header('Content-Type', 'text/html');
-                    res.header('Cache-Control', 'no-cache');
+                    applyNoStoreHeaders(res);
                     res.status(200).send(this.indexHTML);
                 });
                 this.server.app.use('/', express.static(this.wwwDir, appOptions));

package/build/main.js

@@ -20,6 +20,7 @@ const socket_classes_1 = require("@iobroker/socket-classes");
 const ws_server_1 = require("@iobroker/ws-server");
 const translations_1 = require("./lib/translations");
 const web_1 = require("./lib/web");
+const eosPassword_1 = require("./lib/eosPassword");
 const checkLinuxPass_1 = require("./lib/checkLinuxPass");
 const plugin_docker_1 = require("@iobroker/plugin-docker");
 const objectFixes_1 = require("./lib/objectFixes");
@@ -1152,7 +1153,7 @@ class Admin extends adapter_core_1.Adapter {
         }
         if (String(user.common.password || '') === '') {
             const bootstrapSecret = `${(0, node_crypto_1.randomBytes)(48).toString('base64url')}!aA1`;
-            await this.setPasswordAsync(userId.replace(/^system\.user\./, ''), bootstrapSecret, { user: ADMIN_OWNER_USER });
+            await (0, eosPassword_1.setEosUserPasswordWithVerification)(this, userId, bootstrapSecret, ADMIN_OWNER_USER);
             user = (await this.getForeignObjectAsync(userId));
             if (!user) {
                 return;

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.9.98",
+    "version": "7.9.99",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,11 +18,6 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
-      "7.9.98": {
-        "de": "Stable-Kandidat 7.9.98 ergänzt den vertikalen Cockpit-Scrollbereich, bereinigt die Login-Felder und korrigiert Passwort-Reset sowie persönliche Erstpasswortvergabe über die echte ioBroker-Passwort-API.",
-        "en": "Stable candidate 7.9.98 adds vertical cockpit scrolling, cleans up login fields and fixes password reset plus first personal password setup through the real ioBroker password API.",
-        "nl": "Stable-kandidaat 7.9.98 voegt verticaal scrollen in het cockpit toe, herstelt de loginvelden en corrigeert wachtwoordreset en het eerste persoonlijke wachtwoord via de echte ioBroker-wachtwoord-API."
-      },
       "7.9.95": {
         "de": "Stable 7.9.95 macht den Release-Ordner mergesicher: Die flache Update-ZIP kann direkt über einen bestehenden Arbeitsordner entpackt werden. Vor Paketprüfung und npm-Veröffentlichung werden package.json, io-package.json, beide Lockdateien, die Frontend-Version, Build-Informationen und der aktuelle Repository-Eintrag automatisch auf dieselbe Version gebracht. Dadurch wird insbesondere ein stehen gebliebenes io-package.json aus 7.9.92/7.9.94 automatisch repariert. Die Funktionen aus 7.9.94 bleiben unverändert.",
         "en": "Stable 7.9.95 makes the release folder merge-safe: the flat update ZIP can be extracted directly over an existing working directory. Before package validation and npm publishing, package.json, io-package.json, both lockfiles, the frontend version, build information and the current repository entry are synchronized automatically. In particular, a stale io-package.json from 7.9.92/7.9.94 is repaired automatically. Functional behavior from 7.9.94 remains unchanged.",
@@ -334,7 +329,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.98/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.99/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -345,7 +340,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.98/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.99/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -413,7 +408,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.98/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.99/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1122,5 +1117,5 @@
       }
     }
   },
-  "version": "7.9.98"
+  "version": "7.9.99"
 }