- Shipped
- May 18, 2026 at 2:33 AM UTC
- Author
- Kamo
- Commit
- 245f31d
Two changes that finish the kamo-los borrower-facing branding pipeline: 1. OrganizationController gains a public GET /api/security/org/domain/{host} endpoint. Resolves the org by exact OrgDomain match, then retries after dropping the deepest hostname alias (apply.lender.com → lender.com) so kamo-los's SSR org fetch lands the lender's record on first paint. 404 when no org owns any matching domain. 2. **************** is rewritten to emit: - The original keys (siteName, siteNameShort, backgroundImageCount, logoFullExt, themeRevision, description) — unchanged shape. - The full colour palette: colorPri, colorPriLight, colorPriLightest, colorSec, colorSecLight, colorSecLightest. Previously the colours only landed in the per-org globals.css; kamo-los expects them in config.json so DynamicMetaLoader can write --org-* CSS vars before fetching any stylesheet. - The new Organization fields (tagline, nmlsId, phoneSupport, emailSupport, equalHousingDisclosure, onPrimaryText, gradientDirection, yearEst). phoneSupport falls back to org.phoneTollFree.number when not explicitly set — most orgs use the same line for both. Old String-based buildConfigJson(...) signature kept as a back-compat wrapper so no existing call site breaks. JSON is built via a small StringBuilder helper with proper escaping for \, ", \n, \r, \t and control chars; values still come from a controlled source (DB columns) but the escape pass means a lender's pasted tagline with quotes won't corrupt the file. Compiles clean against the updated shared-library Organization entity.