Accept X-***-Token for mobile clients in OTKPreAuthFilter
per-tab session id as X-***-Token (matching **************** When present (and no X-OTK), resolve the session non-consumingly and set the same request attribute...
Support "unblock forever" remote-image consent
Adds a wildcard consent (allowAll / isAlwaysAllowed) so a member can opt to display external images in every message. Reuses the existing consent table via a re...
Inline-CID org logo (SVG->PNG) so it renders in Gmail; remove message content; preserve From-domain case
- FIX (security): notification emails carry no message body — remove messagePreview from template vars, ledger, samples and the settings toggle. - FIX (logo):...
Editor sample variables for missed-message notification templates
Preview samples for MISSED_CHAT_MESSAGE and SUPPORT_TICKET_REPLY incl. raw vs html-escaped sender/title variants used by the canonical bodies.
Microsoft 365 mail via Microsoft Graph app-only (zero per-mailbox setup)
Microsoft 365 mail now reads/sends through Microsoft Graph app-only (Mail.ReadWrite/Mail.Send application permissions) instead of IMAP — one app credential cove...
Kuacha serialed xoauth2 getter kwamba kuvunja MailCredentials Redis cache
MailCredentials is cached in Redis (GenericJackson2Json). The added `isXoauth2()` boolean getter was serialized as a "xoauth2" property but has no field to read...
Route all cloud providers' mail through IMAP/SMTP with OAuth2 (XOAUTH2)
Wasambazaji wa wingu (Microsoft 365, Exchange Online, Kazi ya Google, Zoho, IceWarp) Picha zote na Wizara ya Mambo ya Ndani ya Nchi. ..............................
Server-side "display external images" consent
Replaces the client-local (localStorage) remembering of the external-image choice with a durable per-member record. New RemoteImageConsentService (fail-soft rea...
Scope KamoMail mailbox/domain listing to the org's own domains (cross-tenant leak)
SECURITY: **************** ran 'SELECT email FROM virtual_users' (and **************** 'SELECT name FROM virtual_domains') with no org scoping, so mailbox/domai...
Persist selected OAuth provider on callback so it stops reverting to KamoMail
Switching an org to Microsoft 365 (or Google Workspace / Zoho) never stuck: the OAuth callback stored tokens and only flipped status on a pre-existing provider ...
Resolve welcome-email logo from the org theme host, not the apex
Header/footer logos in system emails (welcome/verification) were built as **************** — an apex path that only exists on the Kamo marketing site, so for cu...
Constant-time internal-auth secret compare (timing oracle)
Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pa...
Sample vars for meeting-summary template preview
Inaongeza kesi ya sampuliVariables kwa template mpya ya mkutano wa mwisho ili msimamizi UI hutoa maudhui ya kweli.
Mwisho wa ndani wa kuunda / kutumia tukio la kalenda ya mwanachama
POST /api/internal/calendar/events (X-Internal-Auth gated) resolves member -> user -> primary calendar (creating a default if needed) and creates an event. Used...
Fixed public redirect + gateway-forwarded callback
Platform email OAuth (Microsoft 365 / Google / Zoho) had no valid public redirect URI: the redirect was derived from the request host, which in prod is the clus...
Rebuild dhidi ya gated shared-lib (mlos.intake beans now opt-in; fixes CrashLoop)
Wire mlos-internal-auth (INTERNAL_AUTH_SECRET) into deployment [skip ci]
EmailService's InternalAuthFilter guards /api/email/templates/send + /seed-org on internal.auth.secret, which was unset (fail-closed 503). Share the existing pr...
Return 422 (not 500) when member has no mailbox
listFolders and other read endpoints threw IllegalStateException from MailContext.toMailCredentials() when a member had no IMAP credentials provisioned, which t...
Don't save transactional NoReply sends to a Sent folder
NoReply is a send-only address with no mailbox, but every transactional send still attempted an IMAP append to its Sent folder, producing a noisy AUTHENTICATION...
Self-heal mailbox accounts from app DB (drift recovery)
The app DB is the source of truth for which mailboxes should exist; KamoMail accounts live in the mail server's virtual_users. If the mail DB loses data, mailbo...
Mailbox list API returns UI-shaped ****************
GET /api/email/mailboxes returned the raw entity (providerStatus, lastSyncedAt, no member count). The settings UI reads **************** so status was always un...
Authorize privilege-based mailbox access for read + send-as
resolveForMailbox only granted access via a direct MemberMailbox assignment, so mailboxes surfaced through **************** rights threw NoSuchElementException ...
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Rebuild for kamo-shared-library update (esign signer email templates)
Picks up the new canonical templates esign.signer_verification + esign.signer_invite so seedForOrg can seed them on first send.
Wire DomainManager and MailboxProvisioner for all cloud providers
Replace the UnsupportedOperationException stubs in every cloud provider with real HTTP calls against each backend's admin API: - Microsoft 365 → Microsoft Gra...
IMAP/SMTP-backed send, folder, and search for cloud stubs
Extract the IMAP/SMTP delegation pattern into AbstractImapBackedCloudProvider and have Zoho, IceWarp, Exchange, Google Workspace, and Microsoft 365 extend it. T...
IMAP-backed MailReader for the cloud-provider stubs
Zoho, IceWarp, Exchange, Google Workspace, and Microsoft 365 all expose IMAP, so wire each cloud-provider stub's MailReader methods through EmailImapService ins...
Serve inline image MIME parts and surface Content-ID metadata
Render <img src="cid:..."> in the messages UI by exposing the inline parts that the HTML body references. - AttachmentInfo gains contentId (without angle brack...
Preserve original filename and content type on attachment download
The **************** endpoints (both the personal and shared-mailbox controllers) were emitting Content-Disposition: attachment with no filename parameter and C...
Scope concurrency to build jobs, not Kubernetes deploys
Workflow-level concurrency serialized the whole pipeline (including kubectl rollouts). Move the group to the build job only so deploy jobs from different runs c...
Sync members.email when primary mailbox is assigned, changed, or removed
When a mailbox was assigned to a member in a KAMO_MAIL org, members.email was never updated, causing EmailCredentialService to fail to resolve IMAP credentials ...
Mark-as-read for shared and member mailboxes
EmailController.setFlags now accepts an optional mailboxId query param and routes through resolveProviderWithMailbox so member-mailbox flags are set against the...
Handle IMAPInputStream in getMessage to prevent ClassCastException
JavaMail can return an IMAPInputStream instead of a decoded String from part.getContent() when message content has not been pre-fetched. The direct (String) cas...
Use getHasAttachments() to match Boolean wrapper type
**************** is a Boolean (wrapper), so Lombok generates getHasAttachments() not isHasAttachments(). The latter only exists for primitive boolean. Use Boole...
Je, unaona nini kuhusu usafiri?
Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.