v3.2.120 — Session revocation, pinned TLS for remote agents, a fixed installer

⚠️ Read before upgrading

• Every user is signed out once. Existing sessions carry no password fingerprint, so they are rejected after the upgrade. Sign in again.
• Existing remote agents stop answering until each is installed again. Use "Install agent" over SSH, or generate a new install command. Agents keep their API keys. To keep unpinned agents working on plain HTTP until then, set STOR_AGENT_ALLOW_INSECURE_HTTP=true in the backend .env and restart.

3.2.119 was tagged but never published as a release, so updating from 3.2.118 also brings its fixes: a fail-open frontend auth guard, CORS origin reflection, and the update script that silently rolled every update back.

Security

• A password change ends every existing session. Tokens were signed with the user's id and role only, so a stolen token stayed valid after a password change or reset. Each token now carries a keyed fingerprint of the password hash it was issued against, and one that no longer matches is rejected.
• Remote agents are reached over TLS with a pinned certificate. The agent installer generates a self-signed certificate and prints its SHA-256 fingerprint. "Install agent" and the install command report it to St0r, and "Enter API key" accepts it. St0r checks the certificate before it sends the API key. An agent with a certificate of its own is verified against CAs instead. Redirects are refused, an agent without TLS listens on loopback only, and allowed_ips is enforced.
• The agent no longer prints its API key to the journal or the installer output. It is only in the root-readable /etc/stor-agent/config.json.

Fixed

• The one-line installer installed 3.2.78. It now installs the latest published release. From a checkout it installs that checkout's VERSION, and ST0R_INSTALL_VERSION pins a version. It also records the version it actually installed.
• The agent installer could not build the agent (tsc: not found). It now installs from a lockfile with dev dependencies, builds, and prunes them afterwards.

Dependencies

axios 1.20, multer 2.3, mysql2 3.22, nodemailer 10.1, and in-range fixes for express, body-parser, qs, proxy-addr (critical) and undici. npm audit --omit=dev reports nothing for the backend, frontend or agent.

Not yet tested on real hosts

Agent install over SSH and by install command, re-installing an existing agent, a replication alert email on nodemailer 10, and mysql2 3.22 against a production database. All builds and the 13 automated tests pass in CI.

Full changelog: v3.2.118...v3.2.120