PR #777 — fix(security): consolidate issues #760–#766

Release Notes

Summary

This release strengthens account security, access control, file
upload validation, and terms acceptance across the platform. Users
and administrators may notice stricter enforcement when roles change,
accounts are disabled, or files are uploaded.

Changes

• Active sessions are revoked when an account is disabled or re-enabled,
  and when administrative roles are removed.
• Expired agent API keys are rejected at authentication time.
• Permission checks now use current authorization state instead of
  cached session roles, so revoked access takes effect without waiting
  for a session to expire.
• Terms of service acceptance must be completed by the signed-in user;
  unauthenticated acceptance by email alone is no longer supported.
• File uploads are validated using verified storage metadata and content
  type checks rather than client-submitted values.
• Virtual file system folder assignments are validated to prevent
  invalid parent placement, cross-project moves, or folder cycles.
• Upload-related storage configuration is no longer exposed when the
  upload service is unavailable.
• Large file transfer records now support bigger file sizes.
• The terms acceptance experience in the dashboard reflects the
  authenticated acceptance requirement.

Impact

Security/audit impact: Access is revoked more promptly when roles
change or accounts are disabled. Upload and authorization controls
are tightened to reduce misuse of stale sessions, unverified file
metadata, or invalid folder placement.

Classification

Security, Auth, Policy, Storage, API, UI, Tenant Workflow, Admin, Bug Fix

Source: cursor-automation | PR: https://github.com/EpykLab/stllr/pull/777 | Status: draft