Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping the shared credential in this repo
The mail MySQL password sat in plaintext across fourteen files here — in ConfigMaps that kubectl will hand to anyone who can read them, in two Jobs that CI appl...
Stop shipping the shared credential in this repo
The mail MySQL password sat in plaintext across fourteen files here — in ConfigMaps that kubectl will hand to anyone who can read them, in two Jobs that CI appl...
Enforce storage quota on inbound delivery, and stop shipping the DB password
Object storage already refuses content that would take an organization past its ceiling, which covers every domain going through the object store. Inbound mail ...
Enforce storage quota on inbound delivery, and stop shipping the DB password
Object storage already refuses content that would take an organization past its ceiling, which covers every domain going through the object store. Inbound mail ...
The Dovecot quota change, written out and not applied
Object storage now refuses content that would take an organization past its ceiling, which covers every domain that goes through the object store. Inbound mail ...
The Dovecot quota change, written out and not applied
Object storage now refuses content that would take an organization past its ceiling, which covers every domain that goes through the object store. Inbound mail ...
Let a member license their own seat from the console
The panel that closes the loop on self-pay. It appears only where the organization's policy permits it, and only for people who are not already buying on the or...
Tell people their payment failed, and stand the subscription down
The dunning that did not exist. invoice.payment_failed wrote a row and returned: no email, no flag, no state change, and billing.email-service-url was configure...
Add the dunning clock columns
past_due_since and suspension_notified_at, both nullable. Null means paying and not-yet-told respectively.
Make a failed payment mean something
PAST_DUE counted as fully live in both entitlement resolvers, with no timestamp and no cap, so a customer whose card failed kept every feature for as long as St...
Let a member buy their own seat, and close a body-parameter hole
Self-pay had no route inside the console. Everything on the billing surface is account-shaped — you must already hold an AccountMember row before Plans & Billin...
Let the owner decide who can pay, and manage the groups that do
The owner had exactly one lever over self-payment and it was the wrong shape: an irreversible promote gesture, with no way to say in advance whether it was perm...
Org policy and billing group APIs
Who inside an organization may pay Kamo is now answerable and settable. Both routes are org-scoped and therefore deliberately outside /api/billing/accounts/** a...
A Plans & billing console an owner can actually find
There was no way to buy a first subscription anywhere in the product. Plan lists were reachable only through a subscription you already held, so an organization...
Default a new subscription's target org to the caller's
A first purchase has no existing subscription to copy targetOrganizationId from, and requiring it unconditionally is what made creating one from the console imp...
Show the ceiling, not just the bytes
The panel reported stored, added, removed and lifetime bytes against no reference at all — so an owner looking at 400 GB had no way to tell whether that was com...
Pin the delegation-mode semantics
These predicates are what the surfaces hide themselves on, so getting one wrong either offers a button that cannot work or silently permits a charge the owner m...
Gate promotion on the owner's policy, make it idempotent, add its inverse
Promoting a member to pay for themselves was unconditional, one-way and unsafe to repeat. It now refuses when the organization's policy says the organization p...
Stop revoking a member's billing access when adding them elsewhere
add() deleted the member's row on any other account to satisfy a global unique that no longer exists. Adding someone to a second billing account now leaves the ...
Drop the constraint that limited a member to one billing account
Finds the constraint by shape rather than by name — Hibernate generated it and the name is not stable across environments, so any unique constraint on account_m...
Let members and groups pay for themselves, under the owner's rules
Three things were missing and one was actively harmful. account_members carried a global unique on member_id — a member could administer exactly ONE billing ac...
Expose the fail-open impact to the operator
The app catalog page already answers the org-independent question — does any plan mention this app — and raises a warning when none does. This answers the tenan...
Show what turning off fail-open would cost
kamo.entitlement.fail-open grants any app the plan matrix never mentions. It is documented as a temporary valve for the catalog backfill — turn it off once the ...
Show whether someone is there, and their extension
Every row now carries a presence dot and word beside the name, and its extension in the detail line — so choosing a person no longer means picking a name and ho...
Carry availability, presence and extension on a directory row
Picking a person is easier when the row says whether they are there and how to reach them, so each one now carries what they last declared, whether anything of ...
Buy a block when an opted-in org runs out of room
Runs shortly after the nightly snapshot sweep, because that is what produces the usage figure it decides on — expanding against yesterday's number would buy a b...
Opt-in auto-expand with a ceiling
Two columns on the subscription that holds the blocks: whether to buy another one automatically when the organization runs out of room, and the most it may ever...
Let a catalog price change actually reach Stripe
Stripe Prices are immutable and the mapping holds one row per (org, type, code, cycle) behind a unique key, so once a price existed it could never change. A pri...
Add the columns that make a price change detectable
Order(0), nullable, no backfill — a null amount reads as "we do not know what this price was created with" and the reconciler treats it as unknown rather than a...
Record what each Stripe price was created with
The mapping stored only which price id to use, so a catalog price change could not even be noticed. ensurePlanPrices short-circuited on the row's existence and ...
Type the storage capacity the summary now returns
Keeps the client contract in step with BillingService, which now reports what the plan includes, what blocks were bought, the combined ceiling and the fraction ...
Report capacity alongside usage
The storage panel reported bytes stored against nothing at all — no allowance, no percentage, no money — so an owner looking at 400 GB had no way to tell whethe...
Give the storage allowance an effect
Storage was measured across nineteen domains, nightly, with a build-failing coverage test — and nothing anywhere computed an allowance or refused a byte. The pl...
Tell the requestor whether their agent is actually there
A silent thread does not distinguish "nobody has looked at this" from "my agent stepped away", and the person waiting cannot tell which. The notice under the co...
Reassignment reaches the new agent, and the requestor is told who is there
Reassignment did not reach anybody. assignmentOpenedAt records that a client put the conversation on screen, and it is what raises a ticket at sign-in — but it ...
Assign a chat request, and assign from the tickets list
Two gaps, same cause — assignment was treated as something that happens to a ticket rather than to a piece of work. The assign button was hidden for pre-ticket...
Assigning by hand must not consume the PRE_TICKET status
assignToAgent and reassignAgent set ASSIGNED unconditionally, which quietly made a chat request impossible to convert afterwards — convertPreTicket accepts noth...
Quote engine for the plan picker, matching what Stripe will bill
The arithmetic behind a live running total, kept apart from any component so the numbers can be tested directly. It mirrors **************** exactly: per-seat a...
Make a first plan purchasable, and return real plan prices
Two things stopped an organization ever buying a first subscription. Plan lists were reachable only through sub.marketId on a subscription the org already held...
Let a sub-org reach the account that pays for it
AccountSubscription deliberately separates the payer from the organization whose members consume the seats, and auto-provisioned accounts sit on the top-level K...
Gate paid actions on a licensed seat, at the chokepoint
Nearly every gateable action in the product — dial an extension, email a member, open the AI assistant, play a recording, start a social conversation — is a bar...
Resolve what a member may do, not just what their plan includes
Feature grants describe a plan. They never described this member, because the console gates navigation on org-level org.features — so a member with no license a...
Derive the add-on unit from the catalog, and correct stale prices
The storage add-on advertised as "+$4 /user/month" for a pool the same page called organization-wide. Cause: mapAddOns matched addonCode "additional_storage" wh...
Bill per-unit add-ons by units bought, not by headcount
Threads the new add-on quantity through create and update: a FLAT add-on now takes its Stripe quantity from what the subscription actually bought, so four 10 GB...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.