iobroker.eos-admin 7.9.99 → 7.10.0

package/build/lib/web.js

@@ -23,6 +23,7 @@ const cookieParser = require("cookie-parser");
 const iobroker_mcp_1 = require("iobroker.mcp");
 const eosPassword_1 = require("./eosPassword");
 const eosRequestSecurity_1 = require("./eosRequestSecurity");
+const eosAutoUpdate_1 = require("./eosAutoUpdate");
 let AdapterStore;
 /** Content of a socket-io file */
 let socketIoFile;
@@ -163,6 +164,8 @@ class Web {
     mcpServer = null;
     /** Short-lived passwordless first-activation claims. Keys are SHA-256 hashes of HttpOnly cookie tokens. */
     eosPasswordClaims = new Map();
+    /** One-time authenticated tickets for the mandatory personal-password POST. */
+    eosPasswordSetupTickets = new Map();
     /** Small in-memory rate limiter for unauthenticated first-activation requests. */
     eosPasswordClaimRates = new Map();
     /**
@@ -742,11 +745,6 @@ class Web {
     }
     async saveEosFirstLoginPassword(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-        const access = await this.getEosRequestAccess(req);
-        if (!access.userId || access.role === 'admin') {
-            res.status(403).json({ error: 'passwordSetupNotAllowed' });
-            return;
-        }
         if (req.headers['x-nexowatt-eos-first-login'] !== '1') {
             res.status(403).json({ error: 'invalidRequest' });
             return;
@@ -755,22 +753,41 @@ class Web {
             res.status(403).json({ error: 'invalidRequestOrigin' });
             return;
         }
+        const body = req.body || {};
+        const suppliedToken = String(req.headers['x-nexowatt-eos-password-setup-token'] || body.setupToken || '').trim();
+        const ticket = this.resolveEosPasswordSetupTicket(req, suppliedToken);
+        const requestAccess = await this.getEosRequestAccess(req);
+        if (suppliedToken && !ticket) {
+            res.status(403).json({ error: 'passwordSetupTokenExpired' });
+            return;
+        }
+        if (ticket && requestAccess.userId && requestAccess.userId !== ticket.userId) {
+            res.status(403).json({ error: 'passwordSetupTokenMismatch' });
+            return;
+        }
+        const access = ticket ? { ...requestAccess, userId: ticket.userId, role: ticket.role } : requestAccess;
+        if (!access.userId || access.role === 'admin') {
+            res.status(403).json({ error: suppliedToken ? 'passwordSetupTokenMismatch' : 'passwordSetupNotAllowed' });
+            return;
+        }
         const passwordState = await this.getEosFirstLoginPasswordState(access.userId, access.role);
         if (!passwordState.required) {
+            this.invalidateEosPasswordSetupTicketsForUser(access.userId);
             res.status(200).json({ success: true, alreadyInitialized: true });
             return;
         }
-        const body = (req.body || {});
         const validation = this.validateEosFirstLoginPassword(body.password, body.passwordRepeat, access.userId);
         if (!validation.valid) {
-            res.status(400).json({
-                error: validation.error,
-                minLength: passwordState.minLength,
-            });
+            res.status(400).json({ error: validation.error, minLength: passwordState.minLength });
             return;
         }
-        await this.setEosUserPassword(access.userId, validation.password);
-        const userObject = (await this.adapter.getForeignObjectAsync(access.userId));
+        if (body.passwordAlreadyWritten === true) {
+            await (0, eosPassword_1.verifyEosUserPasswordCredential)(this.adapter, access.userId, validation.password, EOS_PASSWORD_SERVICE_USER);
+        }
+        else {
+            await this.setEosUserPassword(access.userId, validation.password);
+        }
+        const userObject = await this.adapter.getForeignObjectAsync(access.userId);
         if (!userObject) {
             throw new Error('userObjectUnavailableAfterPasswordChange');
         }
@@ -798,13 +815,17 @@ class Web {
         if (persistedState.required || !persistedState.initialized) {
             throw new Error('passwordMetadataNotPersisted');
         }
-        await this.destroyEosRequestSessions(req);
+        this.invalidateEosPasswordSetupTicketsForUser(access.userId);
         for (const cookie of ['access_token', 'refresh_token', 'connect.sid']) {
             res.clearCookie(cookie);
         }
-        this.adapter.log.info(`EOS first-login password initialized for ${access.userId}`);
         res.status(200).json({ success: true, role: access.role, logoutRequired: true, sessionInvalidated: true });
+        void this.destroyEosRequestSessions(req).catch(error => {
+            this.adapter.log.debug(`Deferred EOS session cleanup failed: ${error instanceof Error ? error.message : error}`);
+        });
+        this.adapter.log.info(`EOS first-login password initialized for ${access.userId}`);
     }
+
     isEosPasswordlessFirstLoginEnabled() {
         return this.settings.eosPasswordlessFirstLogin !== false;
     }
@@ -843,6 +864,53 @@ class Web {
     hashEosPasswordClaim(token) {
         return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex');
     }
+    cleanEosPasswordSetupTickets() {
+        const now = Date.now();
+        for (const [key, ticket] of this.eosPasswordSetupTickets.entries()) {
+            if (ticket.expiresAt <= now) {
+                this.eosPasswordSetupTickets.delete(key);
+            }
+        }
+    }
+    invalidateEosPasswordSetupTicketsForUser(userId) {
+        for (const [key, ticket] of this.eosPasswordSetupTickets.entries()) {
+            if (ticket.userId === userId) {
+                this.eosPasswordSetupTickets.delete(key);
+            }
+        }
+    }
+    issueEosPasswordSetupTicket(req, userId, role) {
+        if (role !== 'installer' && role !== 'enduser') {
+            return null;
+        }
+        this.cleanEosPasswordSetupTickets();
+        // Policy-client refreshes must not invalidate the token displayed by bootstrap.
+        // Tokens are short-lived and all are removed after a successful password change.
+        const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const expiresAt = Date.now() + 10 * 60_000;
+        this.eosPasswordSetupTickets.set(this.hashEosPasswordClaim(token), {
+            userId,
+            role,
+            expiresAt,
+            remoteAddress: this.getEosRemoteAddress(req),
+        });
+        return { token, expiresAt };
+    }
+    resolveEosPasswordSetupTicket(req, token) {
+        this.cleanEosPasswordSetupTickets();
+        if (!token) {
+            return null;
+        }
+        const ticket = this.eosPasswordSetupTickets.get(this.hashEosPasswordClaim(token));
+        if (!ticket || ticket.expiresAt <= Date.now()) {
+            return null;
+        }
+        const address = this.getEosRemoteAddress(req);
+        if (ticket.remoteAddress && address && ticket.remoteAddress !== address) {
+            return null;
+        }
+        return ticket;
+    }
     readEosCookie(req, name) {
         const row = String(req.headers.cookie || '')
             .split(';')
@@ -1250,6 +1318,38 @@ class Web {
             ],
         });
     }
+    getNexoWattStableUpdateManager() {
+        this.nexowattStableUpdateManager ||= new eosAutoUpdate_1.NexoWattStableUpdateManager(this.adapter);
+        return this.nexowattStableUpdateManager;
+    }
+    async sendNexoWattStableUpdateStatus(req, res) {
+        const access = await this.getEosRequestAccess(req);
+        if (access.role !== 'admin') {
+            res.status(403).json({ error: 'permissionError' });
+            return;
+        }
+        res.status(200).json(await this.getNexoWattStableUpdateManager().getStatus(false));
+    }
+    async saveNexoWattStableUpdateSettings(req, res) {
+        const access = await this.getEosRequestAccess(req);
+        if (access.role !== 'admin') {
+            res.status(403).json({ error: 'permissionError' });
+            return;
+        }
+        if (req.headers['x-nexowatt-eos-auto-update'] !== '1') {
+            res.status(403).json({ error: 'invalidRequest' });
+            return;
+        }
+        if (!this.isEosSameOriginWrite(req)) {
+            res.status(403).json({ error: 'invalidRequestOrigin' });
+            return;
+        }
+        if (typeof req.body?.enabled !== 'boolean') {
+            res.status(400).json({ error: 'invalidEnabledValue' });
+            return;
+        }
+        res.status(200).json(await this.getNexoWattStableUpdateManager().setEnabled(req.body.enabled));
+    }
     isEosSameOriginWrite(req) {
         return (0, eosRequestSecurity_1.isEosSameOriginRequest)(req.headers);
     }
@@ -1321,6 +1421,7 @@ class Web {
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
         const { userId, groups, groupNames, adminGroups, role } = await this.getEosRequestAccess(req);
         const passwordSetup = await this.getEosFirstLoginPasswordState(userId, role);
+        const setupTicket = passwordSetup.required && userId ? this.issueEosPasswordSetupTicket(req, userId, role) : null;
         const isAdministrator = role === 'admin' && (userId === 'system.user.admin' || groups.includes('system.group.administrator'));
         const isEosAdminGroup = role === 'admin';
         const isInstaller = role === 'installer';
@@ -1341,7 +1442,12 @@ class Web {
             isEndUser,
             isAdmin: isEosAdminGroup,
             mustChangePassword: passwordSetup.required,
-            passwordSetup: { ...passwordSetup, userName: userId?.replace(/^system\.user\./, '') || '' },
+            passwordSetup: {
+                ...passwordSetup,
+                userName: userId?.replace(/^system\.user\./, '') || '',
+                setupToken: setupTicket?.token || '',
+                setupTokenExpiresAt: setupTicket?.expiresAt || 0,
+            },
             capabilities: this.getEosRoleCapabilities(role),
             hideLegacyAdminForNonAdmins: this.settings.eosHideLegacyAdminForNonAdmins !== false && this.settings.eosHideLegacyAdminFromNonAdmins !== false,
             hideLegacyAdminFromNonAdmins: this.settings.eosHideLegacyAdminForNonAdmins !== false && this.settings.eosHideLegacyAdminFromNonAdmins !== false,
@@ -1483,6 +1589,21 @@ class Web {
                 res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
                 next();
             });*/
+            void this.getNexoWattStableUpdateManager().start().catch(error => {
+                this.adapter.log.warn(`[NexoWatt stable updates] Startup reconciliation failed: ${error instanceof Error ? error.message : error}`);
+            });
+            this.server.app.get('/nexowatt/updates/status', (req, res) => {
+                void this.sendNexoWattStableUpdateStatus(req, res).catch(error => {
+                    this.adapter.log.warn(`[NexoWatt stable updates] Cannot read status: ${error instanceof Error ? error.message : error}`);
+                    res.status(500).json({ error: 'autoUpdateStatusFailed' });
+                });
+            });
+            this.server.app.post('/nexowatt/updates/settings', (req, res) => {
+                void this.saveNexoWattStableUpdateSettings(req, res).catch(error => {
+                    this.adapter.log.warn(`[NexoWatt stable updates] Cannot save settings: ${error instanceof Error ? error.message : error}`);
+                    res.status(500).json({ error: 'autoUpdateSettingsFailed' });
+                });
+            });
             this.server.app.get('/version', (_req, res) => {
                 res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
                 res.setHeader('Pragma', 'no-cache');
@@ -1766,12 +1887,13 @@ class Web {
             this.server.app.post('/nexowatt/account/first-password', (req, res) => {
                 void this.saveEosFirstLoginPassword(req, res).catch(e => {
                     const detail = e instanceof Error ? e.message : String(e || '');
-                    this.adapter.log.warn(`Cannot initialize EOS first-login password: ${detail}`);
+                    const code = detail.split(':', 1)[0];
+                    this.adapter.log.warn(`Cannot initialize EOS first-login password [${code}]: ${detail}`);
                     const known = new Set([
                         'passwordApiUnavailable', 'passwordNotPersisted', 'passwordVerificationFailed',
                         'passwordMetadataNotPersisted', 'userObjectUnavailableAfterPasswordChange',
                     ]);
-                    res.status(500).json({ error: known.has(detail) ? detail : 'passwordSetupFailed' });
+                    res.status(500).json({ error: known.has(code) ? code : 'passwordSetupFailed', detail: code });
                 });
             });
             this.server.app.get('/nexowatt/account/manage', (req, res) => {
@@ -1783,12 +1905,13 @@ class Web {
             this.server.app.post('/nexowatt/account/reset', (req, res) => {
                 void this.resetEosAccountPassword(req, res).catch(e => {
                     const detail = e instanceof Error ? e.message : String(e || '');
-                    this.adapter.log.warn(`Cannot reset EOS account: ${detail}`);
+                    const code = detail.split(':', 1)[0];
+                    this.adapter.log.warn(`Cannot reset EOS account [${code}]: ${detail}`);
                     const known = new Set([
                         'passwordApiUnavailable', 'passwordNotPersisted', 'passwordVerificationFailed',
                         'passwordMetadataNotPersisted', 'userObjectUnavailableAfterPasswordReset',
                     ]);
-                    res.status(500).json({ error: known.has(detail) ? detail : 'accountResetFailed' });
+                    res.status(500).json({ error: known.has(code) ? code : 'accountResetFailed', detail: code });
                 });
             });
             this.server.app.get('/iobroker_check.html', (_req, res) => {

package/build/main.js

@@ -215,7 +215,7 @@ async function ensureEosStableInitialAccounts(adapter) {
         const pendingFirstLogin = eosNative.nexowattPasswordChangeRequired === true || eosNative.eosPasswordChangeRequired === true || eosNative.nexowattFirstLoginPending === true || eosNative.eosFirstLoginRequired === true;
         const stableCredentialMissing = eosNative.nexowattStableInitialCredentialVersion !== 1;
         if (created || passwordMissing || resetRequested || (pendingFirstLogin && stableCredentialMissing)) {
-            await adapter.setPasswordAsync(account.user, EOS_STABLE_INITIAL_PASSWORD, { user: 'system.user.admin' });
+            await (0, eosPassword_1.setEosUserPasswordWithVerification)(adapter, id, EOS_STABLE_INITIAL_PASSWORD, 'system.user.admin');
             await adapter.extendForeignObjectAsync(id, {
                 native: {
                     ...eosNative,

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.9.99",
+    "version": "7.10.0",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -329,7 +329,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.99/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.0/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -340,7 +340,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.99/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.0/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -408,7 +408,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.99/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.0/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -549,7 +549,8 @@
     "eosAllowPasswordlessFirstLogin": false,
     "eosRequireFirstLoginPasswordChange": true,
     "eosAutoAssignStandardAccounts": true,
-    "eosAssistEnabled": false
+    "eosAssistEnabled": false,
+    "eosNexoWattAutoUpdate": true
   },
   "notifications": [
     {
@@ -1117,5 +1118,5 @@
       }
     }
   },
-  "version": "7.9.99"
+  "version": "7.10.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin – stable candidate with truthful EMS overview, verified user passwords and deterministic browser updates.",
-  "version": "7.9.99",
+  "description": "NexoWatt EOS Admin – stable candidate with native NexoWatt auto updates, reliable account passwords, clean login and scrollable cockpit.",
+  "version": "7.10.0",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -118,22 +118,27 @@
     "tools/nexowatt-version-sync-selftest.cjs",
     "tools/nexowatt-merge-update-selftest.cjs",
     "tools/nexowatt-ems-overview-selftest.cjs",
-    "README_STABILITY_V7.9.99.md",
-    "RELEASE_NOTES_V7.9.99.md",
-    "PUBLISH_STABLE_V7.9.99.md",
-    "INSTALL_TEST_V7.9.99.md",
-    "RELEASE_ACCEPTANCE_V7.9.99.md",
-    "MERGE_UPDATE_README_V7.9.99.md",
+    "README_STABILITY_V7.10.0.md",
+    "RELEASE_NOTES_V7.10.0.md",
+    "PUBLISH_STABLE_V7.10.0.md",
+    "INSTALL_TEST_V7.10.0.md",
+    "RELEASE_ACCEPTANCE_V7.10.0.md",
+    "MERGE_UPDATE_README_V7.10.0.md",
     "README_EMS_OVERVIEW_MERGE.md",
     "RC73_EOS_ADMIN_MERGE_VALIDATION.md",
     "VALIDATION_EMS_OVERVIEW_MERGE.md",
     "NexoWatt_EOS_Admin_EMS_OVERVIEW_MERGE_VALIDATION.md",
     "tools/nexowatt-apply-ems-overview.cjs",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs",
-    "tools/nexowatt-stable-v99-selftest.cjs",
+    "tools/nexowatt-stable-v7100-selftest.cjs",
     "tools/nexowatt-password-write-selftest.cjs",
     "tools/nexowatt-request-security-selftest.cjs",
-    "tools/nexowatt-cache-update-selftest.cjs"
+    "tools/nexowatt-cache-update-selftest.cjs",
+    "src/lib/eosAutoUpdate.ts",
+    "build/lib/eosAutoUpdate.js",
+    "adminWww/js/eos-auto-update.js",
+    "adminWww/css/eos-auto-update.css",
+    "tools/nexowatt-auto-update-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -168,7 +173,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-cache-update-selftest.cjs && node tools/nexowatt-request-security-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && npm run check:eos-stable-v99 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-cache-update-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-request-security-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && npm run check:eos-stable-v7100 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -192,10 +197,11 @@
     "sync:eos-version": "node tools/nexowatt-sync-release-version.cjs",
     "test:eos-version-sync": "node tools/nexowatt-version-sync-selftest.cjs",
     "verify:eos-merge": "node tools/nexowatt-merge-update-selftest.cjs",
-    "check:eos-stable-v99": "node tools/nexowatt-stable-v99-selftest.cjs",
     "test:eos-password-write": "node tools/nexowatt-password-write-selftest.cjs",
     "test:eos-request-security": "node tools/nexowatt-request-security-selftest.cjs",
-    "test:eos-cache-update": "node tools/nexowatt-cache-update-selftest.cjs"
+    "test:eos-cache-update": "node tools/nexowatt-cache-update-selftest.cjs",
+    "check:eos-auto-update": "node tools/nexowatt-auto-update-selftest.cjs",
+    "check:eos-stable-v7100": "node tools/nexowatt-stable-v7100-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -206,7 +212,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.99"
+    "purpose": "accepted stable NexoWatt EOS sales-product release 7.10.0"
   },
   "publisher": "NexoWatt"
 }