- Shipped
- September 5, 2026 at 6:36 PM UTC
- Author
- Kamo
- Commit
- 303bd83
Three unauthenticated endpoints under **************** plus the CRUD behind the organization's own state licences. **The organization is named by the PATH, never by the host.** A lender that has not pointed a domain at us still needs a white-labelled application to send borrowers to, and **************** is that link. Resolving the tenant from the hostname would paint every such lender in the platform's branding and file every lead under the platform organization — which is precisely what happens to anything proxied through the shared `api.kamocrm.com` gateway, where `X-Forwarded-Host` does not survive. `GET /{productId}` returns branding plus the disclosures a lender already publishes at the foot of its own pages — not the organization record; the endpoint ratchet was right to refuse that once already. `GET **************** is scoped to an ACTIVE team member OF THAT ORGANIZATION, so a guessed member id cannot publish somebody else's photograph and direct line. `POST /{productId}` is fail-CLOSED on Capcha (unlike sign-in, which stays permissive for a mobile client that sends none), rate-limited per IP in Redis, requires the consent box, and creates its lead through `LeadService.createLead` — which re-checks the product's owner before stamping it, and which every other intake path on the platform already funnels through. A product whose market is not RESIDENTIAL_MORTGAGE or COMMERCIAL_MORTGAGE answers 404, identically to a deleted one. All three are in the ratchet baseline with the reasoning written out. **`OrgStateLicenseController`** is how a lender enters what it is actually licensed to do, per state, gated on CONFIGURE_SYSTEM and scoped in the query on every write — a licence id is a UUID in a URL, and an update that resolves the row before checking the organization is an edit of another tenant's regulatory disclosure. Also: `applicationBaseUrl` on the vendors response, so the settings screen can offer a copyable link per product built on `verifiedRootDomain` — the same predicate the sign-in path routes on, decided here because a frontend deriving it from the domain list would hand an operator a hostname whose DNS has never been aimed at us. And `appsLogoOverlayColor` baked into the theme config.json, which is the only route the apps site's branding takes.