- Shipped
- August 24, 2026 at 11:42 PM UTC
- Author
- Kamo
- Commit
- 7ff6939
Login, registration and the meeting lobby paint an organization's colours before any session exists. They knew which one from the hostname, which is exactly what an organization without a hostname of its own cannot supply. GET /api/security/org/public/{ref} turns an explicit ?org= reference -- the id as digits, or the alias -- into something to paint. Branding ONLY: name, logo, colours, locale, theme host. Not features, not rights, not domains, not members. The first attempt at this reused the projected organization record and the endpoint ratchet refused it, correctly -- aliases are guessable, so a full record behind a guessable reference enumerates every organization's configuration. What is left is what anyone opening that organization's sign-in page already sees, and a test names the excluded fields individually so putting one back has to be deliberate. Read-only. The sibling /org/domain/{host} auto-provisions app features as a side effect; an endpoint reachable by guessing must not write. An unknown reference 404s, and so does an ambiguous alias -- byPublicRef already refuses one naming several orgs, and this pins that the refusal reaches the caller as "no such organization" rather than as someone else's branding. The caller falls back to the platform's own. themeDomain carries the same value the shell and the theme provisioner use, so a pre-session screen reads an org's branding from the folder it was actually written to -- {alias}.kamocrm.com for an org with no domain. 947 tests pass.