v3.2.115 — Customer-scoped user roles (#21), and ten versions of fixes

The first release since v3.2.104, covering everything from 3.2.105 onward. The headline is #21: user
roles are now scoped to customers, which changes who can see and do what — read that section before
updating a multi-user installation.

Security: user roles are scoped to customers (#21)

Previously every non-admin account had full read and write access to every endpoint on the server.
Customers and Users were unrelated features, so in an MSP deployment a client given a St0r login could see
— and change — another client's backups.

Non-admin accounts are now read-only and customer-scoped:

• A scope layer resolves each caller's visible endpoints through the customer → endpoint assignments made
  on the Customers page. An account with no customer assigned sees nothing; scoping fails closed.
• Every mutating endpoint requires an administrator, enforced per route and by a global write guard, so
  a route added later without the check is still refused.
• Endpoint lists, status counters, activities, job logs, backup statistics, storage usage, file browsing and
  downloads are filtered to the caller's customers.
• Server-wide pages — Logs, Settings, Servers, Replication, Disk Guard — are administrator-only.
• The Users page gained the customer picker that was missing.

After updating, existing non-admin accounts see nothing until an administrator assigns them to a
customer. That is the intended fail-closed behaviour, but it will look like a regression if you are not
expecting it.

Bare Metal Restore and the client installers are scoped per endpoint rather than per role, so a
read-only user can still restore and install agents for their own customer's endpoints.

Security: account changes take effect immediately

The session token is stateless and lives 24 hours, and nothing re-checked the account behind it. A deleted
or deactivated user kept full access until their token expired, and a demoted administrator kept
administrator rights for just as long — so removing someone's access did not actually remove it.

Accounts are now re-checked on every request, with the role read from the database rather than the token,
so demotion and promotion both apply at once. The admin-only user list also stopped returning each
account's TOTP seed.

Fixes

• VHD export was broken for everyone. Downloading an image backup failed with decompress-file exited 3. urbackupsrv decompress-file drops privileges to the urbackup user and writes its output in place,
  so it needs write access to the export directory — which St0r created with none. The exported image is
  also no longer made world-readable while the download runs.
• Backup Reports showed dates in the year 58600. Timestamps arrive from the API already in
  milliseconds and were multiplied by 1000 again — in the summary, the endpoint table, and both the CSV and
  PDF exports.
• Unrestorable images are kept out of the restore picker. UrBackup can mark an image complete after the
  transfer failed, leaving a zero-byte record that lists like any other backup but restores nothing — the
  worst thing to pick during an outage. Backup history still shows them, so a broken chain stays visible.
• The installer card reported the wrong address. It showed the web UI port paired with a configured
  FQDN; installers are built for UrBackup's internet_server on internet_server_port. Both values now
  come from UrBackup's own settings, so the label and the installer cannot drift apart.

Update channel

The release package now ships database/migrations, and auto-update.sh applies them — previously a
release with a schema change reached remote installations as code only. This takes effect from the next
update onward, since the script that runs an update is the one already on disk.

deploy.sh was also repaired: it pointed at a source path and a Node version that no longer existed, so
both build steps would have failed.

Housekeeping

• Added the MIT LICENSE file that package.json has always declared. Without it GitHub reported the
  repository as unlicensed, meaning no reuse rights were actually granted.
• Rewrote the README for administrators evaluating St0r, documenting the UrBackup integration as it really
  works — same-server installation is required, the databases are read directly, and the installer takes
  over Nginx's default site and configures no TLS.
• Removed the unreachable in-app bug report path. Bug reports have always gone to GitHub.

Known weakness

First run still creates admin / admin123. Until that password is changed, an unauthenticated endpoint
reports that the default is in use and the login page displays the credentials on screen. Change it before
the server is reachable by anyone you do not trust.

Full changelog: v3.2.104...v3.2.115