Gate promotion on the owner's policy, make it idempotent, add its inverse
Promoting a member to pay for themselves was unconditional, one-way and unsafe to repeat. It now refuses when the organization's policy says the organization p...
Expose the fail-open impact to the operator
The app catalog page already answers the org-independent question — does any plan mention this app — and raises a warning when none does. This answers the tenan...
Carry availability, presence and extension on a directory row
Picking a person is easier when the row says whether they are there and how to reach them, so each one now carries what they last declared, whether anything of ...
Resolve what a member may do, not just what their plan includes
Feature grants describe a plan. They never described this member, because the console gates navigation on org-level org.features — so a member with no license a...
Make reads read-only, leaving one writer of the *** TTL
The expiration on the Redis record IS the session: when it lapses the member is signed out. Reading a session no longer touches it. Only genuine interaction ext...
Return the account's creation date to the account list
buildAccountSummary never emitted dateCreated, so the field the list's Date Created column reads was simply absent from the response. Now that Account records t...
Stop BUSY surviving every future login
Logout writes AWAY and login clears it, so AWAY is a state the system puts you in and takes you out of. Nothing ever cleared BUSY. A member who set it once stay...
SecurityService pool exhaustion caused liveness kills
Hikari had no explicit maximum-pool-size, so it ran on the default of 10 while fronting org/rights lookups for every service and the internal site. Observed tot...
Rebuild against shared-library @Lob LONGVARCHAR fix
Picks up the fix for 'Bad value for type long' on the lead communications timeline: Hibernate's PostgreSQL dialect read @Lob String columns as OIDs.
Point at YugabyteDB and use PostgreSQLDialect
CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...
Measure the thumbnails and tracks generated from each file
Object keys are content-addressed as **************** so the segment before the first underscore identifies the file a derivative came from. Sizes are summed pe...
Measure branding and Docstive document storage
These are the only two things an organization stores that carry no size anywhere in the database — branding assets go straight into the public bucket under the ...
Restore CRLF on ****************
The previous commit rewrote the file through a tool that normalised CRLF to LF, churning every line and burying a 24-line change in a 618-line diff. Content is ...
Close four ways round the vertical and app gates
SecurityModelMarketController read and mutated security-model market attachments with no session check, no org scoping and no right — any caller could pass any ...
A tenant-readable app catalog for Branch Types
Branch Types -> Allowed Apps started loading its app list from /platform-config/app-catalog, which requires a top-level org owner. The host page is gated on CON...
Stop iterating ServiceType.values() against the resolved catalog
resolveAll() omits the deprecated aliases that share an id with a live app (DOC_MANAGER/DOCS, AI_CHAT/AI_SUPPORT), because those have no catalog row of their ow...
Point the mortgage surface back at the mortgage rights
Companion to the shared-library change. These 13 controllers all guard mortgage endpoints — HMDA LAR, pipeline, application intake, disclosures, credit orders, ...
Two more places that answered "is this app offered" from the enum
Both were missed when FeatureController moved onto the app catalog, and both would have disagreed with it the moment an operator published an app. Organization...
One plan-matrix scan per app-catalog request
Also drops the now-unused DevelopmentStageType import and corrects the auto-provision comment, which still described the stage rule the catalog replaced.
Serve the app catalog and read features through it
FeatureController derived "is this app offered" from the enum's stage in four separate places, so the answer could only be changed by redeploying the platform. ...
Never offer an unreleased app on a buying surface, bundles included
The stage filter only ran for the public marketing proxy. This endpoint also feeds the in-app SubscriptionOrderWizard, which is where a customer actually pays, ...
Fail closed on apps a plan never mentions
Turns kamo.entitlement.fail-open off now that AppEntitlementCatalogMigration has run against prod and every active plan on both entitlement roots (KamoCRM, Sign...
Gate mortgage and personal-loan verticals on app entitlement
A MORTGAGE market appeared on /commerce whenever POS was on, regardless of the MLOS app, and /features/enable had no billing check at all — the padlock in the s...
Only slide the *** TTL when a human is actually there
getSession() refreshed the Redis TTL on every read, and OTKPreAuthFilter resolves the session before any controller runs — so every API call renewed the session...
Keep co-borrowers on one routing order
deriveSigners numbered borrowers 1, 2, 3… as a display index. ESigService now ENFORCES routing order instead of merely reporting it, so leaving the counter in p...
Set a manager, and search the directory a page at a time
GET **************** answers one page of the session org's directory. Search, ordering and paging happen in the database; a hostile ?size= is capped. Words are ...
Thread the parent department through create and update
DepartmentService now takes its request DTO instead of eight positional arguments, so the parent joins the payload rather than becoming a ninth in a row of same...
Stop losing organizations to swallowed exceptions, and accept the full create payload
createOrganization could destroy a customer's signup and report nothing useful. Transaction integrity: - Five Docstors ran behind try/catch that only looked sa...
Make account creation atomic, org-scoped and rights-gated
createCustomer saved the Account before writing its addresses, and was not transactional — so when the address insert failed, the half-built Account stayed comm...
Scope the opportunities read, and give the relay client timeouts
/me/opportunities called reservationRepository.findAll() and filtered org and member in Java. That pulls every reservation on the platform — every tenant's — in...
Browser-facing relay for the commission feature
Resolves the session, authorizes, and relays to CommissionService with the org and member stamped from that session — never from anything the caller sent. This ...
Expose the user-account email on your own member profile
The profile's Personal Email Notifications card has to name the address missed-message notices actually reach, and that address is the user account's — not the ...
Seed the finance rights onto every branch model's ADMINISTRATOR template
The three commission rights gate a feature that did not previously exist, so NEW_RIGHT_SEEDS deliberately says nothing about them - that mechanism carries an ex...
Expose contact email in the by-department roster
The Interaction Center needs a member's address to pre-fill a composer, and the only endpoint that carried one was the single-member detail fetch — one request ...
Accept a member's primary mailbox address as a login identifier
The address a member gives out is usually the org mailbox flagged Primary on their member settings, not whatever is on their user account — so typing it into th...
Cover the chat-routing propagation that broke assignLoanOfficer
assignLoanOfficer gained a step that looks up the loan's source lead to reroute the borrower's open public-chat session. That lookup runs a JPQL query through t...
Carry existing HR holders onto the new per-tab rights
A right that gates something already reachable is a removal of access: new rights insert as NOT_SPECIFIED, so the /hr tabs would have vanished on deploy for eve...
Rebuild for the unified imaging bucket
Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...
Push platform-admin state changes instead of being polled for them
Every platform screen backed by this service refreshed on a timer, because this service has no WebSocket and therefore no way to tell anyone anything: the close...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The session security-level fix failed to deploy because bcprov-jdk18on:1.72 arrived corrupted — 'Tag mismatch' is a TLS auth-tag failure mid-transfer, not a mis...
Name the full logo correctly and resolve an org's domain deterministically
Three defects in how an organization's branding location is derived. my-networks named the full logo "logo-full." + logoFullExt, defaulting to "svg" when the c...
Read the member security level the column actually stores
members.security_level is a VARCHAR holding the ImageAccessLevelType NAME — 'PRIVILEGED', 'MEMBER', 'TEAM_MEMBER'. The session builder tested the value with ins...
Rebuild against kamo-shared-library 8f3c1ec
Picks up the intake-pool fix: LeadService.createLead now flags unowned leads with requiresAssignment so imported leads are counted by countAssignablePool and ca...
Remove the god-mode time-box
Checking in work left uncommitted in this working tree by a concurrent session. Not authored here; committed so it is not lost and so main is not left with a tr...
Real chat direction, and stop the timeline mapper writing or fanning out
Chat entries claimed no direction and attributed every message to its row's author. Social conversations record BOTH sides against a Kamo Member — the visitor's...
State honestly why chat entries carry no direction
The javadoc claimed direction was derived from the author while the code hardcoded UNKNOWN. Social conversations record both sides against a Kamo Member — the v...
Unified communications timeline API
GET **************** returns one date-ordered page across notes, calls, voicemails, texts, e-mails and chat; ?channel= narrows it. Three sources are merged. Ca...
Actually enforce geo and IP access rules
The rules were stored, cached to Redis and never consulted. AccessCheckController was the only caller of the evaluation and nothing called AccessCheckController...
Allow-list countries alongside geo blocks
The geo section only ever denied: a country was blocked or it was absent. Orgs that want to serve one country had to enumerate every other one, which is unmaint...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.