A catalog-version bump must not read as "this host has no organization"
Org resolution funnels every lookup through one query helper that swallows the exception and answers Optional.empty(). For an organization that genuinely is not...
Carry a terminal's activity state to the console
TerminalSummary gains `state`: busy, or waiting for its member. Read off the session's transcript — neither of which is knowable from here, which is why it trav...
Restore SpfAdvisoryService, which main no longer compiles without
45829a6 deleted this file. Nothing in that commit wanted it gone — it was a staged deletion of mine that a concurrent `git add -A` picked up, and the same commi...
Carry the member's model and effort to a coder session
and deliberately not examined here. `coder_flags` on the agent is the one thing that decides what a session runs with — its own comment calls it "the security ...
Refuse a sign-in whose host names no organization
Such a host could sign in until now. It fell through to the workspace-choice path and succeeded on membership alone, which made it a door where none of the tena...
Name the constructor Spring should use, or the context will not start
My own regression, and the second context-startup break on this service today: Error creating bean with name 'terminalTicketRegistry': Failed to inst...
Let Spring pick the terminal registry's constructor
SecurityService has been crash-looping on every new pod since the shared handoff store landed: "No default constructor found" for TerminalTicketRegistry, which ...
Progressive sign-in lockout, escalating to a permanent IP block
A wrong password now costs something, and the cost climbs. Counted since the subject's last successful sign-in: the first five failures are free, the sixth and ...
Resend the verification e-mail under the organization the member is actually on
Nobody at a white-labelled organization has been able to ask for a second verification e-mail. The screen said the letter was on its way every time, and no lett...
Say out loud when a registrant is left with no verification token
The register endpoint caught a failed verification send and logged warn(e.getMessage()). For the fault it kept hitting — EmailService raising a Yugabyte read re...
Share terminal tickets across pods, or half of them are refused
Opening a terminal fails about half the time with "The server refused the terminal connection. Your ticket may have expired", and the log says: Terminal ha...
Serve each org the callback URL on its own domain
This endpoint is where a member finds the string they paste into Google's console, so it is the endpoint that was wrong: it returned only the redirect the org h...
User-account details belong to their owner, or to an operator
One rule, in one place, for the three endpoints that write a USER account: the profile's member update, the profile's personal address, and the platform Users t...
Answer "who owns this account" about the member, not the reader
The member payload now carries accountOwnedByThisOrg. The console used to work this out for itself by comparing the READER's securityOrgId to the current organi...
Restore the @Lazy that stops the context depending on itself
Every SecurityService pod built since 4bd25e7 fails to start: The dependencies of some of the beans in the application context form a cycle: ┌──->──┐ ...
The operator write must answer in the same shape it was asked in
The console adopts this response as its new state. It returned the address and `canChange` but not `mode` or `isSelf`, so after a successful operator write `mod...
A god may fix their own address from any workspace
The tenancy rule refused a god-eligible caller on their OWN record whenever their session was in an organization other than the one that owns the account. That ...
Let a god operator and the System User set somebody's address
The personal address was self-only. It is also the address an administrator has to be able to correct — a member who has lost the mailbox on their account canno...
Make a System User session terminal, so entry cannot chain
The System User is god by construction, so every session minted for it carries GD and offers break glass. That is fine only because the identity does not compos...
Lock the shared sweeps, and run two pods
Sixteen of SecurityService's seventeen scheduled sweeps have a shared effect and now take a named distributed lease before running. There is no ShedLock anywher...
Say whether an org HAS a logo instead of guessing a URL for one
Every "which networks can I reach" row carried logoUrl and logoSimpleUrl derived from the org's alias alone, for any org whose alias was path-safe — which is al...
List a member's coder sessions, and open one in a terminal
Two endpoints beside the terminal ones, and they follow the same rule those do: the Linux account is resolved from the CALLER'S OWN SESSION and no account name ...
Read the account inside a transaction before sending a reset
sendPasswordReset had no transaction, so the User came back detached and `securityProvider` stayed an unresolvable lazy proxy. Working out which organization's ...
Bake the sign-in and sign-up logo overlays into config.json
kamo-login and kamo-register run on their own hosts with no OrgContext, so this file is the only route their branding takes - the same one KamoMeet already uses...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Change a personal address by proving it, and administer accounts
Two surfaces on the USER account, which until now had no server of its own — the account's fields were reachable only through MemberController, an endpoint scop...
Read a domain's live SPF record and say what it actually needs
GET /api/security/domains/{id}/spf, for the SPF step on /setup/dns. The setup page cannot give one set of SPF instructions to everybody, because the right inst...
A member's work address must name them without a mail provider
Forgot-password resolved the address typed on the form against two sources: the account e-mail, and the org mailbox flagged Primary on the member's settings. Th...
Name the allow-list this PUT actually goes through, and rebuild on it
Two things, one of which is the point of the commit. The comment: patchOrganization is an ALLOW-LIST and it lives in the shared library, not here. This control...
Force KamoMobile Logout — revoke a member's mobile devices
Force-logout deletes *** sessions, which ends a browser. It does NOT end a phone: KamoMobile holds a durable device token and mints a fresh *** from it the mome...
Org-side CRUD for an organization's own OAuth2 client
The org-scoped twin of PlatformOAuthClientController, behind **************** Same DTO shape, same encrypt-on-write, same never-return-a-secret rule, plus platf...
Baseline the by-host branding endpoint
**************** refused /org/public/by-host/{host}, which is exactly its job — a new mapping that resolves no session is reachable without credentials through ...
Serve an org's branding from the host it is browsed on
A white-label sign-in screen is reached at login.<customer domain> with no ?org= on the URL and nothing in sessionStorage, so the front end has no way to name t...
Send to AI now runs in a Remote Terminal the operator can watch
The dispatch prepares the hand-off on the dev machine — screenshots, video and the composed prompt written to disk — and answers with the terminal it will run i...
Seed the two careers rights onto HR's existing authoring group
MANAGE_JOB_POSTINGS and VIEW_JOB_LISTINGS are inserted as NOT_SPECIFIED like every new right, so without a seed the /hr/careers tab and the member Careers tab w...
List, rename and end a member's terminals
GET **************** DELETE and PATCH on /terminals/{id}. Every one of them resolves the Linux account from the CALLER'S OWN SESSION and passes no account name...
Only the member or god may set a member's password
MANAGE_MEMBER_SECURITY passed the change-password gate, which made "can administer members" and "can take over any member's account" the same right. They are no...
Every terminal handshake was 403 behind the edge proxy
The reported symptom was a terminal that opened and immediately said "Disconnected", with nothing to act on. Reproduced end to end: the ticket mints fine (200) ...
Assert the mask obfuscates, and skip the gate for callers with no leads
LeadFieldMaskTest still expected a null e-mail. The mask now obfuscates rather than blanks — a blank field reads as "this lead has no e-mail", which is a differ...
Serve the widened accept gate, add self-assignment, and close two contact-mask bypasses
**Endpoints for the new gate.** /leads/available-summary and /leads/available now report both reasons a member is blocked — leads owed a note since they were as...
Move the terminal IngressRoute to where something applies it
This repo's workflow applies exactly configmap.yaml, deployment.yaml and service.yaml, so a fourth manifest beside them was never applied by anything — the rout...
A refused terminal handshake answered 200
Found by probing the deployed endpoint, not by reading it. Returning false from a HandshakeInterceptor aborts the handshake but sets nothing on the response, so...
Rebuild — the last run died fetching actions/checkout
Run 5861 failed in two seconds, before any compilation: the runner could not reach data.forgejo.org to fetch actions/checkout. Nothing to do with the tree, and ...
State why the 101 is read before anything is written
The agent parses the request with a buffered reader and then pumps the raw socket, so a byte sent ahead of the status line would be stranded in that buffer and ...
Serve Remote Terminal — a real shell over a WebSocket
Bridges a browser to a PTY on the member's own dev machine. Binary frames are the terminal, text frames are control; on the far hop an HTTP 101 onto a length-pr...
Send the company alongside the contact wherever a record is labelled
A record that is both an organisation and a person is named "Harmony Home Loans (Nickolas McGarry)" — the company leads, the contact qualifies. That rule lives ...
A communications timeline over the whole /leads filter, not one lead
GET **************** takes the SAME query string GET the lead detail page draws — across every lead the filter bar matches. "What has been said to the leads I a...
Rebuild against kamo-shared-library 8dc3ea4c
Picks up entitlement-cache invalidation on comp provisioning. This service owns both halves: it approves the order and it serves the cached entitlements, so wit...
Rebuild against kamo-shared-library 31b72fe9
Picks up the draft-order reprice fix: changing a draft's seat count or billing cycle left every money field and line item describing the order's previous shape,...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.