Read session rights as list or legacy CSV for member endpoints
KSessionService and SecurityRoleController store rights as List<String> of RoleRightType names. MemberSecurityController cast to String and split on comma, caus...
Verify-dns checks every KnownAliases label; skip deprecated app/media in optional
Align KnownAliases with DNS and auto-cert (add mail, play, apps, sign; drop app, media)
Avoid transaction-poisoning DDL and harden multi-pod races
The previous self-heal put DDL inside a @Transactional syncAll(). When an ALTER TABLE ADD CONSTRAINT fired on an existing constraint (normal case after first bo...
Make RoleRightsSyncService fully self-healing on every boot
Adding or removing a RoleRightType must never again require running KamoInitializerService. syncAll() now runs three phases on every startup: 1. Heal constrain...
Remove getType() calls from OrganizationController after OrganizationType removal
Set orgOriginal on registration and expose isOriginalOrg in my-networks
Extract RoleRightsSyncService and add sync-rights endpoint
- RoleRightsSyncService: centralizes role rights sync logic for both OrgRole and **************** tables; startup and on-demand - DataLoader: delegates to Rol...
Use getOrganizationByIdWithFeatures in AppAvailabilityInterceptor
Resolves LazyInitializationException on /api/security/leads and all other CRM/POS-gated paths. The interceptor called org.getFeatures() after the transaction cl...
Resolve Members tab showing empty due to Hibernate TYPE() base-class issue
Hibernate's TYPE(m) = :type JPQL filter returns 0 results when the bound parameter is the base Member class (JOINED inheritance). This affects the members-subsc...
Enable Hibernate SQL logging to diagnose members query returning 0
Temporarily enabled org.hibernate.SQL=DEBUG to see what SQL the TYPE() JPQL query generates for the members-subscribers endpoint.
Add diagnostic logging to getMembersAndSubscribers endpoint
Logs orgId, query result count, and per-member isActive status to help diagnose why Members tab shows empty list.
Allow god-mode users to provision ownerless orgs; prefer FQDNs in domain resolution
Add @Transactional to provision-theme for lazy domain loading; remove hardcoded domain from provision request
Add PATCH /org/{id}/colors endpoint to safely update only color palette fields
Add theme provisioning — NATS publisher, provision-theme endpoint, logo upload
Use memberID session key and include creatorType in creatable branch-types response
Add GET /branch-types/creatable and /{id}/usages endpoints
/creatable returns branch types filtered by the caller's creator-type (OWNERS/TEAM_MEMBERS/MEMBERS) via AppliedModelEnforcementService. /{id}/usages returns th...
Use correct session key 'memberID' instead of 'MID'
KSessionService stores member ID under key 'memberID' but both **************** and OrganizationController were reading session.get("MID") which always returned...
Exclude master model from models list; add debug log to child-org creation check
SecurityModelController now filters out the org's master model (identified by org.getMasterModelID()) from the /api/security/models response — it is managed exc...
Read session rights as List<String> names, not CSV of integer IDs
Session rights are stored as a JSON array of RoleRightType name strings. Both **************** and OrganizationController were casting them to String (causing C...
Add GET /branch-types/creatable endpoint with creator-type filtering
Returns only the branch types the calling member is permitted to create a child org under, based on their OWNERS/TEAM_MEMBERS/MEMBERS classification against the...
Gate /network child-org creation by right + member-type applicability
Wires the applied-security-model child-org creation gate end-to-end: - SecurityModelController + MasterModelController round-trip the three new apply-to flag...
Rebuild for kamo-shared-library update (appConfig upsert-only fix)
Pulls the hardened **************** that no longer deletes appConfig rows whose service types are absent from the caller's payload — prevents silent data loss w...
Applied-model is the read-time source of truth for feature availability
Closes the "stale DB leaks a disabled feature" gap by gating every surface that touches OrgFeature / ServiceType through the applied security model. - ********...
Surface root-cause on MasterModelController GET failure
When GET /api/security/master-model 500s, log the full stack trace to stderr (captured by kubectl logs) and include the root-cause message on the wire rather th...
Wire applied-model enforcement across every controller
Every non-role setting on the applied security model is now enforced at the exact controller boundary it governs, and the scalar settings round-trip cleanly thr...
Enforce system-role assignment and auto-admin for team-member owners
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requ...
Master-model + applied-model endpoints and template-aware org seeding
Adds the controllers that surface the new branch-type security flow: - /api/security/master-model (GET/PUT) manages the current org's master model; only writ...
Add org-scoping, password length validation, and code quality improvements to PasswordChangeController
Add @Transactional to DataLoader.run to fix LazyInitializationException on startup
Use JPA entity traversal for grant-all detection (covers dept/job roles)
Supplement session rights with all known rights for grant-all roles
Filter null rights in buildAppliedRightsWithSources; upgrade shared-lib to 1.5.0
Use core NATS pub/sub for email-verified SSE fan-out
Replaces in-memory ConcurrentHashMap broadcast with NATS core pub/sub so all pods receive verification events regardless of which pod handled the token. Falls b...
Add SSE endpoint for real-time email verification + improve welcome email logging
Add resetCode to password reset email, add emailVerifyByCode endpoint, send WELCOME_MEMBER after email verification
Use avatarType field + JDBC for photo URL generation to handle Hibernate proxies
**************** previously used instanceof AvatarPhoto to determine avatar type and cast to read fileExtension. When Hibernate returns a base-class proxy (e.g....
Pass human-readable expiry time to email verification template
Add humanizeMinutes() helper that formats minutes as days/hours/minutes (e.g. "1 day" for 1440 min). Pass as {{expiryText}} to match updated canonical template ...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.