Mabadiliko ya Tabianchi

EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.

The /network Enter action called a non-existent Next route, yielding 404. Forward the request to APIService like other security proxies.

Configuration page called /api/security/system-user/* but no Next handlers existed, so the app returned 404. Add BFF routes matching SecurityService endpoints (...

Adds Platform Administration → Configuration, a parent-org-owner-only page that grants or revokes permission to impersonate the platform System User by departme...

Self-heal provisioning: SystemUserBackfillService runs on every SecurityService boot (from DataLoader) to add the is_system_user column and system_user_access t...

Introduces the platform-wide System User model: a User.isSystemUser flag (unique partial index enforces a singleton), plus a SystemUserAccess table that records...

TeamMember uses JOINED inheritance — it IS a Member, no nested member field. The backfill was calling tm.getMember() which doesn't exist. Also switches the JPQL...

isOrganizationOwner is a primitive boolean on TeamMember, so the Lombok- generated accessor is isOrganizationOwner() not getIsOrganizationOwner(). Fixes compile...

These were added to kamo-internal by mistake — collection of the phone number and security questions belongs in the registration flow in kamo-register, and has ...

Insert two new steps between Password and Account Recovery for 13+ registrants: a phone-number step (optional, skippable, with SMS code verification) and a secu...

Move phone-number and security-question collection into the self-service registration flow (where they were originally intended) rather than requiring a post-si...

New table `registration_phone_codes` stores one-shot SMS verification codes issued during self-service registration, before a User entity exists. Kept separate ...

- /account: replace single ambiguous button with tab-scoped buttons Add <Member> on the Members tab, Add <Team Member> on the Team Members tab. Each button ...

- New MemberCreateController exposes: * GET **************** — age-req, timezone, departments, job titles * GET **************** — debounced existence che...

Used by the Add Member / Add Team Member flow to skip email collection for orgs whose age requirement permits users under 13 (ALL_AGES, KIDS_ONLY, ALL_COPPA_GRA...

- Member page Plans & Billing tab is now right-aligned with a pulsing glow and a StarRate icon on the tab bar. Visible when the viewed member is the signed-...

- EntitlementService computes per-member feature grants by unioning active BillingGroupLicense plan features + KamoCRM Free-tier baseline. Caches 15-minute ...

Deletes the org-level **************** controllers, services, and DTOs. Introduces: - BillingGroupController mounting groups, members, subscriptions, licenses,...

Introduces BillingGroup, BillingGroupMember, BillingGroupSubscription, BillingGroupLicense, BillingGroupPaymentMethod, BillingGroupInvoice, and BillingGroupConf...

forwardToApi already appends the browser request search params; embedding ?query in the path produced a second ? and broke upstream URL parsing, causing GET /ap...

Interaction Center should list TeamMember rows, not base Member records.

NavTop greeting falls back to username when the user is not in the team-only list. Interaction Center copy uses team member wording.

Expand client redirect guard beyond **************** to include CONFIGURE_SYSTEM, EDIT_MEMBER_ACCESS_LEVEL, ALLOW_PROMOTING_MEMBERS, organization owner, and pla...

Clarify that the role field from by-department is the job title line.

Replace RBAC role title with jobTitleOfficial, fallback to JobTitle catalog title for TeamMember, and the label Member for base Member records in the by-departm...

ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...

Load billing subscription and plan metadata like the Apps tab; gray out rows and show an info alert when a default-on policy would not activate without an eligi...

AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...

Add **************** to resolve Stripe or commerce subscriptions and match SubscriptionPlanFeature to ServiceType names. AppliedModelEnforcementService now requ...

Gate on paymentMethod COMP for all orgs, not only top-level platform owner, so child orgs with complimentary grants see unlockable toggles.

When no Stripe mirror row exists, resolve the org active commerce SubscriptionRecord (e.g. COMP grants), include paymentMethod and plan features. Fixes Apps set...