A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("jlrivera1984") when their mail client sent no display name, although the ...
A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("rodarisdolgovanton") when their mail client sent no display name, althoug...
StatusReasonAdviceTest's alias case also needs MANAGE_EMAIL_ACCOUNTS
Same shape as the AliasResponseMemberIsTextTest fix: this class's one shared session lacked the right, so createAlias's new gate answered 403 "MANAGE_EMAIL_ACCO...
Who caused a notification travels with it, so the bell can draw them as a member
- NotificationRequest gains actorMemberId/actorName; the old constructor stays for every producer that predates them. - raise() keeps the pair only when both ...
Scrub copies of live credentials from config and dumps
A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...
AliasResponseMemberIsTextTest's session carries the right createAlias now needs
The full suite caught what the targeted run alone would not have: this fixture's session had no rights on it, so createAlias's new MANAGE_EMAIL_ACCOUNTS gate 40...
Calendar reminder sends move off the shared scheduler thread
Spring's default single scheduler thread is shared by every @Scheduled method in this service — the 1-second campaign pulse, the drip engine's tick, and Reminde...
An IMAP/SMTP connection test must not be usable as a network probe
POST /api/email/member-imap/test and /{id}/imap/test connected to whatever host and port the caller supplied and returned the raw exception message. Any authent...
Alias, domain and personal-mailbox admin actions need a management right
create/delete on an email alias, **************** on the org's sending domains, and **************** on a personal (self-hosted) mailbox all needed only a sessi...
A member's mailboxes and aliases are only readable inside their own organization
GET **************** took no HttpServletRequest at all — no session, no org check anywhere on the path — and GET **************** checked that the CALLER had a ...
A calendar export or import must be one the caller can actually open
GET /export/calendar/{id} and POST /import/{calendarId} took the calendar's UUID alone — no HttpServletRequest, so no session, no org or member check at all. An...
SearchService marks its injection constructor, so the service starts
9809d4b gave SearchService a second constructor (a clock, for tests) and marked neither, so Spring chose neither, looked for a no-argument constructor, and the ...
Search that honours its query, and every mail action on the mailbox that is open
Two problems on /messages, fixed in the service. Search did not work. The index path threw a ClassCastException on every hit (Instant -> Timestamp, visible in ...
A member can put a checklist on their calendar, once
Checklists live in KBService and the calendar owns only WHEN, so a scheduled checklist is an ordinary member event carrying sourceType CHECKLIST, the checklist ...
Shared-mailbox **************** need a management right
**************** on /api/email/shared-mailboxes needed only a session — any authenticated member could create a shared mailbox, delete one, or grant themselves ...
An OAuth state token is a server-side record, not a blob the browser hands back
/api/email/oauth/callback and **************** are public and sessionless (the provider redirects the browser here with no Kamo session), so `state` was the onl...
A From override must be an address the caller may send as
POST /api/email/send took request.getFromAddress() straight into the header From and the SMTP envelope sender **************** -> EmailSmtpService.send, and the...
The deliverability history names the member behind each change
Settings → Email → Deliverability shows an address's opt-out history with who made each change, but HistoryView sent only the actor's name, so the page could no...
Aliases and shared-mailbox access name their members as text
GET and POST /api/email/aliases (and /aliases/member/{id}) and GET and POST **************** answered with the entities themselves, whose Long memberId and gran...
An opt-out row carries the member behind its last change
The opt-out list named who made each address's last change (lastActorName) but not who they are, so the settings page could not open their member card. Each row...
Saving a calendar/contacts integration never blanks or drops its stored credentials
A contact integration's credentialsJson was replaced by whatever a save sent. The org CalDAV/CardDAV tab sends all four server fields (empty — they never show w...
A shared mailbox's access list is only readable inside its own organization
GET **************** called **************** which read the access rows for any mailbox id. Every other access operation (update, delete, grant, revoke) loads t...
A shared mailbox response carries no IMAP login
GET /api/email/shared-mailboxes (and /my-access, create, update) return SharedMailboxEntity itself to any session in the organization. Until the library's crede...
A person taken out of a drip stays out
The engine moves on up to 200 due people per drip from copies it read at the start of a pass, up to 25 seconds old by the time each is used. Meanwhile a member ...
A drip's People counts follow the search, so All is always the sum of its chips
Drip campaigns
A drip is an automated sequence of emails a person enters when something happens: a lead arrives (by hand, imported, or from an integration), a lead's status or...
A campaign's replies go to NoReply, the member's e-mail, or a custom address — NoReply by default
The editor's Reply-To becomes three choices (CampaignReplyTo), kept in the existing reply_to column. No DDL. - NO_REPLY (empty column, the default): Reply-To: N...
Stop refreshing a mailbox grant no app can refresh, and say it needs reconnecting
An org connected Microsoft 365 through Kamo's platform app; the platform app was later switched off and the org has no registration of its own. The resolver the...
Liveness probe on /actuator/health/liveness, not the DB-aware aggregate
The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...
Bounces to org sending domains come home, test sends are signed, and the relays' DNS is read
Async bounces. A campaign's envelope sender is its From at the organization's sending domain, whose MX (through the CNAME to contact.kamocrm.com) is the shared ...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Campaign mail is signed as, sent from, and routed by its verified sending domain
A campaign may name its own From on a verified domain; otherwise it goes as the org's bulk sender — which must itself be on a verified domain (saveSender refuse...
Domain Setup's API, the shared relay's sender map, and a sweep that confirms records live
**************** GET the tab (VIEW_BULK_EMAIL), GET lookup for the add form, POST add, POST {id}/check, DELETE (MANAGE_BULK_EMAIL); every write answers with the...
Sending domains — add one, read its DNS record by record, verify it, know what an address may do
A sending domain (news.acme.com) is kept in the org's encrypted bulk provider blob with its DKIM key. SendingDomainChecker reads what receivers will see — SPF e...
DKIM keys and a relaxed/relaxed rsa-sha256 signer for organizations' sending domains
DkimKeys generates a domain's RSA-2048 key (kept in the org's encrypted bulk provider blob) and the TXT value a member publishes at kamoXXXXXX._domainkey.<domai...
The sendToUser ratchet counts three overloads [skip ci]
TransactionalSendRatchetTest pinned sendToUser at two overloads, so that its first test provably inspects them rather than passing on none. c47fcf6 added the bl...
Every refused request says why, not just campaign calls
2a72597 gave the campaign controllers the member's sentence instead of "Bad Request". The same loss happened everywhere else in EmailService that refuses with a...
DNS for sending domains — each domain's own nameservers first, SPF evaluated, DNS provider named
LiveDnsResolver asks the zone's authoritative nameservers (found through 1.1.1.1/8.8.8.8), so a record a member just saved at their DNS provider is seen at once...
The shared org relay (47.181.8.86) is seeded for every organization; the platform relay stays KamoCRM's
PlatformRelayProperties now knows both in-cluster relays: postfix-bulk (47.181.8.87, hello.kamocrm.com) and postfix-orgs (47.181.8.86), with the egress address,...
The campaigns widget read drops its Live / Sent / Drafts counts
CampaignWidgetView.groups carried those counts only for widget builds from before the stage tabs (kamo-internal d0b56adf). Every deployed build since 949d3889 r...
A refused campaign call says why, instead of "Bad Request"
CampaignService refuses with a ResponseStatusException carrying a sentence written for the member ("Pause the campaign before deleting it.", "Only paused campai...
The campaigns widget reads by stage, the stages the campaigns screen files by
The launchpad widget's read now groups and counts campaigns by the stages /marketing/email's tabs use: In-Progress (sending), Not Started (draft or scheduled), ...
Archive a campaign, and the widget leaves archived ones out
POST **************** and /unarchive (MANAGE_BULK_EMAIL) set and clear the campaign's archivedAt, and CampaignDTO carries it. The /marketing/email screen files ...
A live read and live frames for the Email Campaigns home widget
GET /api/email/widget/campaigns is the launchpad widget's one read, built for a pane that sits on every campaign viewer's home page all day: lean rows with no b...
Blind copies on the service-to-service template send
SendTransactionalRequest takes an optional bcc list, carried through sendToUser and deliver onto the SMTP envelope — including the platform-address retry — so a...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Name the recipient in a header that headers-only complaint reports keep
Microsoft's feedback-loop reports now carry only the original message's headers, with anything shaped like an address masked. Every campaign message carries X-K...
Open and click tracking, complaint reports by email, capped outbox counts
- Tracking: the composer wraps a campaign's web links in a signed redirect (<base>/c/<token>?u=&s=) and adds an open pixel (<base>/o/<token>), as each org c...
One eligibility engine decides who a campaign may mail
Every list add (a member's, an audience's, a copy) and the send itself ask one engine whether an address may receive the campaign, cheapest check first: syntax,...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.