A saved background shows the member's picture, never the platform's
Behavior & Labeling pointed each tile at the slot's public URL the moment the commit returned, before provisioning had written the slot (it had not even been re...
Show the organization's own backgrounds, as many as it has
The sign-out screen asked for img/bg/1-3.webp whatever config.json's backgroundImageCount said, so an organization with no backgrounds of its own was shown what...
A new organization's folder holds none of the platform's backgrounds, stylesheet or config
Provisioning copied the whole base theme into every new organization's folder, KamoCRM's three sign-in photographs included. They sat at img/bg/1-3.webp under t...
Let the server say whether the viewer sees every organization
/network chose between all-networks and my-networks from the platform-rights context. That read fails closed and stays failed until the page reloads, and a god ...
A god account is shown every organization, wherever it is signed in
GET /org/all-networks - the list behind /network - was gated on the SYSTEM_USER platform right alone, and platform rights resolve only in a top-level-organizati...
Name the sender once at the top of the preference page
With a logo, the name is its alt text and is not written out again beneath it; without one, the name is the header. It was shown, and read aloud, twice.
A real preference page behind every unsubscribe link
The unsubscribe link opened a bare confirm-or-leave card. Someone who only wanted fewer emails had no way to say so, and nothing told them why they were being m...
Email opt-out chip and panel on the lead page
Beside the lead's email address there is now a chip saying whether the person may be emailed: Emails allowed, Opted out of all email, Paused until a date, Some ...
See and change a lead's email opt-out from the lead
A member working a lead can now see whether that person may be emailed, and change it, without the org-wide opt-out settings list. GET **************** answers...
The opt-out list only names contacts from organization books
A member's personal address book is theirs; the org-wide opt-out list must not become a way to see whose private contacts include someone.
An org admin can see and change the whole opt-out list
Settings -> Email -> Opt Out now has its API under /api/email/opt-outs, behind MANAGE_EMAIL_OPT_OUTS (god bypasses): a summary with the last 30 days, the list f...
Settings -> Email -> Opt Out, the organization's do-not-email list
Everyone who asked not to be emailed, in one place. A masthead says how many are off all email and why (unsubscribed, bounced, marked as spam, asked us to stop)...
Square, bevelled buttons and a 2px-cornered thumb on every scrollbar
The bar's four buttons (jump to start, step back, step forward, jump to end) are now 20px squares with hard corners, and the thumb keeps only a 2px radius. Both...
Count PLAY_CHESS, PLAY_HOLDEM and MANAGE_EMAIL_OPT_OUTS
The two game roots shipped without moving the audited shape, so RoleRightHierarchyTest had been red on main since. The opt-out right is a child of MANAGE_EMAIL_...
The opt-out design, and the client both surfaces will call
Settings -> Email -> Opt Out reads /api/email/opt-outs on EmailService; a lead's own address reads **************** on SecurityService. Long ids arrive as strin...
Every suppression check and bounce goes through the opt-out ledger
SuppressionService now asks EmailOptOutLedger, so a check sees the do-not-email list, pauses and topics alike, and a bounce lands in the same history as an unsu...
One opt-out ledger, topics, pauses and a history of every change
The do-not-email list could be written to but not read, changed or explained. This adds the one place it is read and written from, for every service: email_o...
Outbound e-mail hosts, send windows, per-host warm-up and the staged outbox
- Settings → Platform → Configuration gains an Outbound E-Mail Hosts tab, behind the platform right MANAGE_OUTBOUND_EMAIL_HOSTS: the hosts shared with every o...
Several outbound hosts per org, sent round-robin, each warmed on its own, inside a send window
An organization's campaign mail now leaves through any number of outbound hosts, one message at a time in rotation, instead of one bulk provider. - Hosts: an o...
Postfix-bulk accepts any sender from EmailService [skip ci]
The relay is now a platform outbound host that every organization's campaign mail may go through, as whatever From that organization sends as. Only the null sen...
MANAGE_OUTBOUND_EMAIL_HOSTS is enforced in EmailService
PlatformOutboundHostsController checks it through SessionPlatformFacts and the shared PlatformRightsResolver, so it is listed with the rights enforced elsewhere...
MANAGE_OUTBOUND_EMAIL_HOSTS, the platform console's outbound e-mail hosts
A platform right for the outbound e-mail hosts campaign mail leaves through: the hosts shared with every organization and the ones kept for the platform organiz...
The desk is never a client of itself
Sage and Erik both hold EXEC2EXEC_ACCESS, and each owns organizations of their own. Signed into one, the owner arm of Exec2ExecEligibility gave each a "client" ...
Delete, filter and switch off NoReply Outbound rows
The audit page gains a subsystem column and filter, checkbox selection with "select all" and "select all matching", and deletes for one row, the selected rows, ...
The NoReply ledger can be filtered by subsystem, pruned, and told what to record
Each row now names the subsystem that sent it and, for a template send, the template key. EmailTemplateService and the campaign sender open a NoReplyOutboundSou...
A saved campaign reopens inside its template, and the From is always the bulk sender's
The body is saved between two comment markers inside the finished email, and reopening a campaign puts only that part back in the middle of the template, where ...
Every campaign is sent as the org's bulk sender, and its From never pauses it
A campaign's own from_email/from_name are no longer read: the From is always the address and name on Settings > Email > Bulk Email Sender (else the org's NoRepl...
The unique (campaign, address) index, for a fresh environment
EmailService used to create **************** on every startup; DDL on this cluster belongs here instead. Idempotent, auto-committed (YugabyteDB builds indexes o...
Startup checks for the one-address-per-campaign index instead of creating it
EmailService ran CREATE UNIQUE INDEX on every startup. DDL on this cluster costs every service about fifteen minutes of "schema version mismatch", too much to r...
Read the platform's hex secret as hex, and stretch a short key instead of refusing it
JWTUtils decoded security-service.*** as Base64 only. The platform's secret is 64 hex digits (32 bytes), which Base64 turns into 48 meaningless bytes; those wer...
The campaign editor's Recipients and Send steps fill the width instead of an 860px column
The campaign editor writes edge to edge, merge tokens in their own column
The subject sits under the campaign title and the audience beside the status chip, so the compose step is the email body alone, filling the middle of the page, ...
Review fixes to the provider blob, delivery reports and test send
The provider blob is always written in a transaction of its own, so its lock query stays the first statement and a lost lock race can be retried even when a cal...
A warm-up day nothing was sent on does not count
A warm-up day used to be the N-th 24 hours from the start whether or not anything went, so turning the warm-up on days before the first campaign silently spent ...
Review fixes for the bulk sender, warm-up and pacing banner
A pass over everything the bulk sender and warm-up screens are built from, fixing what it found: - a warm-up poll that started while a write was on the wire co...
A from the platform relay would refuse pauses the campaign instead of failing its recipients
Failing the recipients made every one of them contacted, so once the From was fixed the campaign could never send to those addresses. The send path now checks t...
A campaign the backend cannot send says why and how to fix it
EmailService now pauses a campaign instead of failing its recipients one by one when it cannot send it: its From is off the platform relay's domain, or there is...
Email settings redirect lists its hook dependencies
The rights check that sends a member without MANAGE_EMAIL_SETTINGS back to /settings ran in an effect that listed only `loading`, so the linter flagged the miss...
Warm-up says idle days don't count and draws the dates that slid
A warm-up day in which nothing is sent no longer counts: the run slides forward and the day repeats when sending resumes, which makes switching warm-up on befor...
The platform relay is recognised by one host-and-port check everywhere
Refusing an off-domain From matched the relay by host and port, while the warm-up's delivery tracking and the test send's advice matched by host alone, so a pro...
Live campaign progress reaches browsers on every replica
The STOMP broker is in-heap per pod and progress is raised on whichever pod holds the dispatch lease or received a delivery report, so browsers on the other pod...
The bulk sender tab fills the width it is given
The tab sat in a 1120px column centred in the settings card, so on a wide screen most of the card was empty margin around a narrow form. The column is gone, alo...
This relay only sends as kamocrm.com
Anything in mynetworks (every pod, and the LAN) could relay through 47.181.8.84 as any domain, which receivers treat as spoofing and charge to this IP; that is ...
The delivery-events sidecar drops a batch EmailService rejects as invalid
A 400/413/422 means the batch itself will never be accepted; retrying it forever would hold back every result queued behind it. It is logged and dropped. 401/40...
Deploy postfix-bulk with the rest of the mail server [skip ci]
The bulk relay's four manifests were applied by hand because the mail step applies its files by name. It now applies them too, refuses to continue if the sideca...
Campaign mail the platform relay would refuse fails at once instead of being retried
The relay sends only as its own domain and answers anything else with a 451, so a campaign whose From is on another domain used to retry every recipient three t...
Spring can build the bulk-email, warm-up and delivery beans
Several of them have a second constructor taking a clock for tests, and with two constructors Spring needs to be told which to use or the whole context fails at...
New host warm-up holds an org's campaign mail and releases it at the warm-up's pace
While an org's warm-up is on, the dispatcher leaves its campaigns alone and a releaser sends them one message at a time, the earliest due first across the org's...
Recipient rows carry contacted, and already-sent rows keep their mark beside the status
EmailService's recipient DTO now reports whether the campaign has already emailed each address. The mapper carries it through, together with lastError, and fill...
The campaign From field says when the bulk relay would refuse it
The campaign's own From field, defaulted from the bulk provider, warns when the address is off the provider's domain, as mail that may land in spam. On the plat...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.