A save reaches every colleague with the template open
A save of a template's file told only the member who saved it, so a colleague with the same template open kept placing fields over pages the file had moved on f...
Read a template's layer by design version
The version history draws a template's fields over each version's pages. It asked for them through a document version (/{imgId}/{n}/design), and a template's wo...
Files and templates, edited in place, with the versions each category keeps
A document was two records: the upload, which nothing edited, and one modified copy derived the first time anyone opened it in either editor. The Docs manager s...
Serve the document categories from the enum that defines them
The docs settings page named its own categories and sent the ordinal it believed each one had. Those ordinals were written when ImageAssocType was six constants...
Gate the member board on being a team member with a role open
The member Careers tab now appears on two conditions and no right among them: the viewer is a team member, and the organization has at least one posting open an...
Retire applying without an account, and notify both sides of one that lands
The public board's Apply button is now a link into registration, so this drops the endpoints behind the old form: /{orgRef}/apply/{uid} in both content types, /...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
The CV reader, employee referral links, and the form shape on the public listing
Three things the public careers site needed from this service. The form shape now rides on the public listing (the twelve ask* settings, the additional-info pr...
Apply-first, the job network, alerts, translation and retention
Eight things, all behind the anonymous careers surface, and all sharing the rules the single-org board already enforces rather than growing their own. APPLY-FI...
The anonymous API behind careers.<apex>
The public job board reads this. It is the only surface in Careers with no session, so the safety comes from the QUERY rather than from a rights check: PublicCa...
/api/docs/careers — job postings, the member board, and applying
Two controllers behind one feature, and the split is the point. /careers/** is HR's and requires MANAGE_JOB_POSTINGS; /careers/member/** is the employee's and r...
Fill a rectangle, honour a highlight's opacity, and redact
Three things about the way a prepared document renders the designer's marks. A rectangle was drawn as an outline, so the fill a member now picks to cover somet...
Announce a classic save to the member who made it
A WOPI save on a CLASSIC version now publishes docs.classic-saved.{memberId} so the Kamo PDF editor, if it is open on the form-fillable version, can redraw the ...
Save As branches a new original, not a new copy of one
PutRelativeFile was unimplemented, so "Save As" in the LibreOffice editor did nothing. It now does what the member means by it: the bytes become a brand-new ORI...
Derive modified versions instead of editing originals
Opening a document in the LibreOffice editor no longer hands over the original. It derives that document's CLASSIC version — once, reused every time after, and ...
Serve and sync the Selected Docs binder
POST /api/docs/binders/scratch fetches the caller's Selected Docs binder for one collection, creating it on first use, and replaces its documents with the grid ...
The outstanding-course badge moves when the course does, not a minute later
The NavTop obligation badge sums two counts — packages to sign and courses to take — and only one of them was live. The legal half has pushed since its NATS blo...
GET/PATCH the org's default legal text
/api/docs/legal/settings, behind the same guarded() funnel as every other mapping on this controller. The read NEVER creates a row: it resolves to LegalDefault...
Legal, training and resource summary for the HR Overview
One read per tab domain, each block gated on its own right and omitted rather than refused when out of reach.
The complete HR Training backend
Course authoring, publishing, assignment, the member player, server-side grading, WORM evidence and the reminder sweep — the whole module behind /api/docs/train...
The member-facing Training API
Registers com.kamo.z.shared.hr.training in @EnableJpaRepositories — @EntityScan is broad so the entities are found either way, but repositories are not. Two au...
Point at YugabyteDB and use PostgreSQLDialect
CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...
Server-side paging for the member assignment listing
The member surface asked for MAX_SIZE unconditionally and sliced the result in the browser, so a grid that showed a page had already downloaded a whole employme...
Due-date reminder ladder and the batched, read-only sweep
The bucket is a pure function of (dueDate, today) and never of "when we last sent": UPCOMING_D{n} for the configured offsets, DUE_TODAY, then PAST_DUE_P{floor(d...
Tell the member — assigned, voided and completed
ONE hr.package_assigned per member per package, never one per document: that is what suppressInvite exists for, and 8 documents x 200 members is 1,600 envelopes...
Outbound email client and a Redis notification ledger
Idempotency with NO schema change. The reminder bucket is a pure function of (dueDate, today) and never of "when we last sent", so the only durable state a noti...
DocsService's first inbound internal-auth filter
DocsService has no service-to-service authentication: ResourceServerConfig is anyRequest().permitAll() and OTKPreAuthFilter CONTINUES the chain when X-OTK is ab...
Serve the caller's own pending-package count
GET **************** through memberGuarded() and the identity funnel. No memberId and no orgId parameter — both come from the session, because an id in a path i...
Emit the badge count on every transition that moves it
Four sites: delivery (none -> PENDING), void (open -> VOIDED), redelivery (open -> SUPERSEDED) and finish (open -> EXECUTED). Each passes the status it read BEF...
Publish the member's open-package count to core NATS
Connection.publish on legal.packages.{memberId}, NOT NatsMessageService: that service pins .expectedStream(CHAT_MESSAGES) in both publish and publishSync, so a ...
File after Finish, repair from HR, and download BY imgId
Filing is queued AFTER COMMIT and OFF the request thread. Finish is @Transactional in a service that also serves WOPI; holding a connection across N ESigService...
File the merged executed package into the member's own library
uploadDocument takes the SUBJECT'S Member, so Img.organization and Img.createdByMember derive from them and HR ends up having filed a document the member owns. ...
Enforce MANAGE_LEGAL_AND_COMPLIANCE on the package endpoints
LegalPackageAccess mirrors the Legal & Compliance tab gate, and that tab is now gated on one right of its own instead of VIEW_EMPLOYEES || EDIT_EMPLOYEES || MAN...
The executed package certificate and the ordered merge
The certificate carries the package, the frozen version, the subject, the moment and address of execution, the attestation wording verbatim and both digests the...
The two byte sources for the executed artifact
LegalPinnedPdf extracts the frozen-digest rule out of the member read path so the wizard and the filed artifact read the SAME bytes through the SAME check — con...
Mount the member surface at /api/docs/legal/member/**
A separate controller with a separate funnel, because authorization here is identity and not an HR right. Routing these through guarded() would mean either lock...
Package attestation on finish, and the EXECUTED/AWAITING_OTHERS split
Writes the WORM LegalPackageAttestation: attestationTextSha256 from the FROZEN version (the package's draft wording is mutable and may already have been reworde...
Identity-authorized member read surface for assignments
LegalAssignmentOwnership is a SEPARATE guard from LegalPackageAccess on purpose: a member executing their own agreement holds no HR right, and widening the HR r...
Manifest canonical form and a spoof-resistant client IP
manifestSha256 hashes the ordered [{documentUid, contentSha256, orderIndex}] the member was actually shown, length-prefixed so a crafted uid cannot imitate a fi...
Org-scoped, paged, filterable legal package assignment listing
Built on the EntityManager rather than a shared-lib repository method: the filter set is dynamic and adding it to kamo-shared-library would force a shared-artif...
Void legal package assignments, org-wide or for named members
Per-assignment outcomes — voided, skipped-executed, not-found — because an admin voiding a package for six named people needs to know which had already executed...
Redeliver a changed package, superseding the open assignments
Refused unless the live fingerprint differs from the published one. Binder.dateUpdated is dead and Img has no revision counter, so that fingerprint is the only ...
Deliver a legal package to its audience, off the request thread
Plan on the request thread (two cheap queries, so the response is exact about who is included and who was skipped and why), write off it: 200 members x 8 docume...
Delivery planner — incremental targeting, email pre-filter, due dates
Deliver is the new-hire path and is meant to be re-run, so members who already hold an assignment are subtracted rather than given a second copy of the same ins...
ESigService internal client for legal package delivery
DocsService's first outbound service-to-service client. Posts to **************** (origin MANUAL, never metered) with suppressInvite=true — HR sends one notific...
Audience resolution preview
Resolves a saved or draft audience through TeamMemberRepo.findAudience, which is the only reader carrying the mandatory ACTIVE + recordState eligibility predica...
Publish freezes a version with byte-pinned documents
Pins img_dat_id plus a content hash, not img_id: saveImgContent repoints the same Img at new bytes on every Docs save, and resolveSource walks to the dat live a...
Legal package CRUD at /api/docs/legal/packages
List, create, get, update and delete, with ordered binder refs and audience rows replaced as a set. Org comes from the session on every path — DocsService is pe...
Legal package wire contract and request normalization
Ids cross as strings (unique_rowid exceeds MAX_SAFE_INTEGER). Binder order is the list order, de-duplicated, and a non-numeric entry 400s rather than being skip...
Content fingerprint for legal packages
Binder.dateUpdated never moves after INSERT, so a package's content has no change signal to compare. Adds a SHA-256 over the canonical ordered binder/item tuple...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.