Live Change Log

Username derives from the member ACCOUNT email, not the TeamMember work email — a work address can sit on another domain and would silently produce a different ...

health() swallows transport failures and answers false so the SSO preflight can return an actionable 503 rather than a 500.

Codec is deliberately reversible — RDP auto-login needs a real password — and uses GCM so a tampered or wrong-key row fails loudly rather than decrypting to noi...

CockroachDB unique_rowid() ids are 19 digits, past Number.MAX_SAFE_INTEGER, so an id sent as a JSON number arrives in the browser with its low digits rounded aw...

JacksonConfig registered a **************** serializing Long as String -- the standard guard for CockroachDB ids, which run past JavaScript's MAX_SAFE_INTEGER. ...

Declaring an ObjectMapper bean takes binding away from Spring Boot's auto-configured one, and a hand-built mapper carries Jackson's defaults rather than Boot's....

KamoMeet is a Meet fork with no access to OrgContext, so it learns org branding from the theme config.json this service bakes. The org stores an overlay TOKEN; ...

No source change. CI clones kamo-shared-library at build time, so Organization.loadingLogoOverlay is only mapped once this rebuilds — until then the generic PUT...

The lead assignment picker needs the directory to return only people who can actually work a lead, so /team-members/search takes a requiredRight. An unrecognise...

PUT /org/{id} derived the age ranges and the three ATF flags from the stored row whenever a request omitted them, then asserted all five against the applied sec...

No source change here. SecurityService's CI clones kamo-shared-library at build time, so it only maps Organization.homeLogoOverlay once it is rebuilt — and unti...

The network-create wizard gains an Apps & Features step, and this is the half that makes it real. /branch-types/creatable now describes the apps each branch ty...

LeadController is one of the better-gated controllers in the platform — VIEW_LEADS, EDIT_LEADS, ASSIGN_LEADS, REASSIGN_LEADS_MANUALLY, VIEW_UNASSIGNED_LEADS and...

A god account's platform rights may be changed only by another god, and a god account can never be removed from the list — by anyone, including another god. Go...

kamo-login, kamo-register, the marketing site and KamoMeet all read the theme bucket's config.json for backgroundImageCount; backgroundOrder now rides alongside...

The member profile's legal-name card was self-only, so an admin who typed a name wrong on the create form could never correct it — MemberCreateForm asks for pre...

Seeing every organization and being able to enter one are the same decision — the list exists so an operator can find the organization they are about to support...

The interceptor is registered for /** so the annotation lookup ran on every request this service serves, sign-in included, and AnnotatedElementUtils walks the m...

POST replaces an existing administrator's rights, so it can take them away as well as give them — but only the PUT and DELETE paths checked whether the edit wou...

@RequirePlatformRight + PlatformRightInterceptor replace three hand-rolled "is the caller a top-level-org owner" gates that were copies of each other, one per p...

Bytes arrive through ConversionService (which owns ffmpeg and the scanner); everything afterwards is here, where the session and the scoping rules already live....

GET returns all three layers in one round trip plus what the caller may edit — every settings page needs the whole stack, because an org administrator editing t...

/members-subscribers and /team-members-contractors enumerate the organisation's people — names and ids — to fill the document-share autocomplete, and required o...

Member direct rights now go through RightsHierarchy.normalizeLevel before they are persisted: a granted child pulls its ancestors up to GRANTED at the member le...

The event carried the lead's name, number, email and best time to call, copied into its description when the call was booked. A copy of a record that is still b...

It read "Open the lead: /leads/view/123" and was not a link. It could not be: a description is edited in a textarea, where text is text — and outside the applic...

Answers which leads have a call still waiting, and when the soonest one is due, for the caller's organisation in one request. Its own endpoint rather than a fie...

The callback already reached the member's calendar, as an event titled "Lead Callback" with their comment in the description. Nothing said whose call it was, no...

Relays the new **************** surface and enforces who may reach it. TimecardService holds the engine and no session; this holds the session and decides. Secu...

Passthrough for POST /punches/{id}/void, the editor's delete key and the machinery behind merging two adjacent spans. Same authority as /correct, and for the s...

Passthrough for GET /members/{id}/range, the period graph's read. from/to are forwarded only when present so TimecardService can resolve the member's own pay pe...

The account view can now say what has happened to an account and who is on it. - Every mutation on the account surface records history: create, field edits, ...

The wrong-path bug is fixed and the response shape is verified, but the CLASS of failure it belonged to was still open: if TimecardService renames `blocking`, d...

With FINALIZE_PAY_PERIODS held, a 5xx/404/unparseable close-readiness response left awaitingApproval sitting at its initial 0 — the WARN log fired but the HR Ov...

Pointing the composer at close-readiness widened privilege. That relay's own mapping guards with FINALIZE_PAY_PERIODS, and resolveRole does not admit MANAGE_TIM...

summarize() asked TimecardService for **************** That is the name of the SecurityService MAPPING, not of any downstream route. TimecardService has no such...

One MANAGE_TIMECARDS-gated call composing the roster and manager-queue relays with the local exception, employment and pay-period rows.

MANAGE_TIMECARDS to read or change who is on timecards — enrollment decides who gets paid from this system, so it is held to the HR administrator right rather t...

MANAGE_TIMECARDS to read the queue and to waive, because the queue names every member with a problem and waiving changes what the finalize gate reads. The per-m...

The bulk approval role is DERIVED here from the caller's rights and appended to the path — never read from the body. A body-supplied role is a body-supplied pro...

The org-wide reports need MANAGE_TIMECARDS. The evidence pack does not, when a member pulls their own — and that is the point. The pack is what an employee need...

MANAGE_TIMECARDS to read the org's rules — the workweek and rounding settings describe how everyone in the org is paid — and FINALIZE_PAY_PERIODS to change them...

An EMPLOYEE may correct their own record — that is the point of the editor, and refusing it leaves the employee with no way to say the clock was wrong about a d...

A team member whose employment is not ACTIVE was refused at the door with "Your account exists but is not active at this time." That was the wrong shape. A term...

THE ROLE IS DECIDED HERE, from the caller's rights and their relationship to the subject -- never from the request body. A body that could name its own role wou...

The authorization boundary. TimecardService holds the data and the engine but no session; this holds the session and decides who may do what, then relays. The e...

timezoneService.ts has called this endpoint since it was written and it existed in no Java service; the client swallowed the 404 and resolved to UTC. Meanwhile ...

**************** is gone from the shared library. Its Optional return depended on a unique constraint that no longer exists, so once one account holds both a pe...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...