Sharing a document works again, as someone who can read it
The share dialog sends a document id as a string — an img id is an int64 past 2^53, which a JSON number would round — and createShare cast it to Number. Every s...
Legal, training and careers emails link only to live hosts
- Legal: the org's console (OrgLinkHosts.internalOrigin) and the member page's Legal & Compliance tab. It linked the bare apex, which serves the marketing s...
A rename answered with no Url skips Docs's rename callback
Docs shares one client-side callback between RenameFile and Save As, and **************** skips its whole body — the File_Rename event the embedding page listen...
Losing the race to store identical content is not a failed save
The look-up before the ImgDat insert is not a lock, and kamowsdocs runs two replicas behind one gateway — two documents whose bytes are identical (two members c...
A Save As that changes format is not the source document's type
uploadDocument refuses an upload whose claimed MIME type disagrees with what it detects from the bytes, and saveAsNewDocument claimed the type of the row it was...
A Docs save could not store bytes the platform already held
Saving a document twice, and renaming one, both ended in "Document cannot be saved, please check your permissions" — and after five retries Docs gave up and dis...
Retry the two reads a catalog bump broke document editing with
WopiController.checkFileInfo is called repeatedly through an editing session — on open, around locks, after every save — so a conflict on its organization looku...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Three self-invoked transactions that were doing nothing
@Transactional and @Async are PROXIES. A call from inside the same bean never reaches one, so all three of these annotations were inert. Found by audit, not by ...
A country is not its enum name
Every card on every careers surface has been printing "United states" — the words after the first lose their capitals when an enum name is prettified — and "Côt...
A REQUIRED resume is now actually enforced
A review of my own commit found the enforcement it claimed. JobApplicationService carried the comment "a REQUIRED resume is enforced at that point by requireRes...
A document whose bytes are gone answers 410, not 500
The streaming download caught every storage failure as one unexpected error and returned 500, which tells a reader nothing and leaves a viewer with a blank erro...
Let an unscoped binder hold its own grid's documents
sameCollection demanded an exact assoc_object_id match in both directions, which made every binder in My Docs refuse every document My Docs was showing it. The ...
The document verbs are enforced, as the org's security model resolves them
ImagingController checked ImageAccessLevelType and nothing else, and DocumentController checked only that a session existed. Access level is a real control but ...
Enforce the doc-share alias rights server-side
GET /shares/resolve-alias turns a guessable alias into a real person's NAME and required only a valid session. The rule lived solely in ShareDocumentDialog, and...
Writing the org legal settings needs BOTH HR rights
The Legal & Compliance settings tab is the only writer and is now offered only to a member holding MANAGE_HRS_SETTINGS *and* MANAGE_LEGAL_AND_COMPLIANCE, so the...
Connect DocsService to NATS so the badge lights without a refresh
LegalPendingCountPublisher takes its NATS Connection as required=false and returns quietly when it is null. The shared NatsConfig is **************** and this C...
One snapshot per block, and figures that say what they measure
Both summarize methods are @Transactional(readOnly = true). Each issues six or seven reads whose figures are cross-checked ACROSS query boundaries: countOverdue...
Fill the per-member overdue rollup instead of sending zero
Both summary services built members[] with .overdue(0). The Overview's matrix branches on that field, so legal and training could only ever render amber or gree...
Bound the Resources block to count/sum/recent queries
**************** was loading the org's entire non-hidden HR_RESOURCE Img collection into memory to filter trashed, sum bytes and take 5 recent rows in Java — un...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop renewing the shared *** TTL for idle users
Caught with redis MONITOR: this pod was issuing GET + PEXPIRE against a *** key whose owner had been idle for over an hour, seconds after SecurityService had co...
Accept repeated status params so the gateway cannot corrupt the filter
Opening **************** answered "Unknown status: **************** for every member. The member grid sent the bucket as one CSV value. A comma in a query valu...
Never chase a member who already signed, and keep the subject plain
Two behavioural defects in the phase-8 notification path. 1. The reminder sweep ran over OPEN_STATES, which includes AWAITING_OTHERS — "this member finished...
Let a failed pending-count read out instead of downgrading it
publishFor caught Exception around countByTeamMemberIdAndStatusIn and turned it into a WARN. That catch was not only around the badge: the query runs inside the...
Guard the destructive imaging paths and make the repair reachable
DELETE /imaging/delete/{imgId} is the one destructive imaging path and was not wired to the issued-document guard. ImageService.deleteDocument authorizes on org...
Stop colleagues reading a member's HR-issued documents
isPerPartyRestrictedAssoc covers only ACCOUNT_MEMBER_VAULT and LOAN, so assoc 1 — SERVICE_APPLICATION, what /settings/member/{id}?tab=docs renders — has no per-...
Resolve the document bucket from ImageAssocType.BUCKET
DocumentService hardcoded "imaging-mydocs" while every other read path went through ImageAssocType.getBucket(). Now that storage is one bucket, point it at the ...
Wire DocsService to ESigService so Deliver stops 503ing
LegalEsignClient.isConfigured() was false in the cluster: neither internal.auth.secret nor legal.esig.service-url was supplied, so Deliver refused every package...
Prove WHOSE signature Finish counts, and report the live one
verify() compared the caller to assignment.teamMemberId but never to the ENVELOPE RECIPIENT's member — it trusted the recipientUid the delivery fan-out wrote. A...
Commit before the fan-out, and stop redeliver reissuing nothing
Redeliver published the new version row, flipped every OPEN assignment to SUPERSEDED, and submitted the reissue from inside that same uncommitted transaction. T...
Widen the read gate to match hrTabs.ts, make a cleared due date actually clear
LegalPackageAccess.requireRead demanded VIEW_EMPLOYEES alone while hrTabs.ts admits the Legal & Compliance tab on VIEW_EMPLOYEES || EDIT_EMPLOYEES || MANAGE_HRS...
Enforce HR rights and make the fingerprint see the e-sign design
All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages — and aud...
Enforce document/binder collection scope in addItem
BinderService.addItem checked read access and refused VAULT/LOAN documents, but never compared the document's own collection to the binder's, so a hand-crafted ...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The HR_RESOURCE rebuild failed on hibernate-core:6.5.3.Final with 'Tag mismatch' — a transfer corrupted in flight, not a missing artifact. The shared-lib stage ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Require a session on POST ****************
The handler took an HttpServletRequest but never used it, carrying the comment "No auth required — internal admin maintenance endpoint". APIService relays /api/...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
Folder create/rename 500 on root folders (Map.of null value)
createFolder/renameFolder built the response with Map.of(..."parentId", parentId), which throws NullPointerException when parentId is null (a root folder) — the...
Bounds-check assoc-type ordinal lookups (fixes Materials list 500)
DocsService was running a shared-lib built before ImageAssocType.MATERIALS (ordinal 11) was added, so listDocuments' ImageAssocType.values()[11] threw ArrayInde...
Serve e-sign editor PDF for any converted doc, incl native PDFs
The e-sign editor (DocumentEditor → PdfCanvas / PageThumbnailSidebar) opens any converted document, not only files uploaded through the sig-template flow. It fe...
Generic byte endpoints refuse MLOS per-party docs (vault/loan)
The generic imaging byte endpoints (download / stream / bulk-download / thumbnail) and the binder aggregation authorized only on org + a numeric clearance ceili...
Don't serve soft-deleted documents on /stream and /bulk-download
getDocumentMetadata (used by the stream + bulk-download byte paths) does not filter trashed rows the way downloadDocument does, and a soft delete leaves the Min...
URI-encode WOPISrc + trust all api.* WOPI hosts (multi-tenant)
Opening a doc for a non-kamocrm tenant failed with 'unauthorized WOPI host'. Docs's alias_groups only trusted api.kamocrm.com (the Docs-deployment env hardcoded...
Node-local MinIO + failover template read + ImgDat dedup (fixes new-doc about:blank)
New-document creation hung ~5 min and the new tab stayed at about:blank. Root cause: DocsService pods scheduled on k3m1 read the blank template from MinIO at th...
Point Docs deployment at k1m1 registry
The Docs-online image host was the bogus **************** (Redis DNS, never a registry), so every DocsService deploy re-applied an unpullable image. Point it at...
Include com.kamo.z.shared.binder in @EnableJpaRepositories
DocsService boots with an explicit basePackages list, not classpath scanning, so BinderRepository wasn't being discovered — startup failed with "No qualifying b...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.