Enter-as session uses target org security provider and optional targetMemberId
Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-do...
Open /validate for enter-as OTK so target org session applies
ENTER linked to /?otk= which never called /api/validate; shared-domain *** cookies kept the source org. Redirect ?otk= to /validate via middleware for any stray...
Resolve system-user session from OTK for BFF requests
SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never s...
Enter-as resolves session from X-OTK BFF auth
EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.
Add BFF route for POST /api/security/enter-as
The /network Enter action called a non-existent Next route, yielding 404. Forward the request to APIService like other security proxies.
Proxy system-user config API routes to APIService
Configuration page called /api/security/system-user/* but no Next handlers existed, so the app returned 404. Add BFF routes matching SecurityService endpoints (...
TeamMember is-a Member; drop bogus tm.getMember() calls
TeamMember uses JOINED inheritance — it IS a Member, no nested member field. The backfill was calling tm.getMember() which doesn't exist. Also switches the JPQL...
Use **************** primitive getter
isOrganizationOwner is a primitive boolean on TeamMember, so the Lombok- generated accessor is isOrganizationOwner() not getIsOrganizationOwner(). Fixes compile...
Stop duplicating query string in KB media/articles API proxy
forwardToApi already appends the browser request search params; embedding ?query in the path produced a second ? and broke upstream URL parsing, causing GET /ap...
Return only team members from by-department endpoint
Interaction Center should list TeamMember rows, not base Member records.
Align Interaction Center with team members only
NavTop greeting falls back to username when the user is not in the team-only list. Interaction Center copy uses team member wording.
Allow org admins to open other members account pages
Expand client redirect guard beyond **************** to include CONFIGURE_SYSTEM, EDIT_MEMBER_ACCESS_LEVEL, ALLOW_PROMOTING_MEMBERS, organization owner, and pla...
Reload ThemeLogo after config and cache-bust logo URL
ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...
Show subscription context on Allowed Apps in branch types
Load billing subscription and plan metadata like the Apps tab; gray out rows and show an info alert when a default-on policy would not activate without an eligi...
Apply subscription gate to app routes and feature API
AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...
Gate app effective enable on subscription and plan features
Add **************** to resolve Stripe or commerce subscriptions and match SubscriptionPlanFeature to ServiceType names. AppliedModelEnforcementService now requ...
Treat any COMP subscription as full access on Apps tab
Gate on paymentMethod COMP for all orgs, not only top-level platform owner, so child orgs with complimentary grants see unlockable toggles.
Expose commerce subscription on GET /subscriptions/current
When no Stripe mirror row exists, resolve the org active commerce SubscriptionRecord (e.g. COMP grants), include paymentMethod and plan features. Fixes Apps set...
Drop stale commerce_subscription_events event_type CHECK for COMP events
Explicit CHECK for subscription event_type including COMP variants
Run GrantDialog plan useMemo before conditional return (React hooks order)
Preserve int64 org id on create-org redirect to DNS setup
POST /api/security/org: pass through upstream JSON instead of re-parsing, so response bytes keep full id digits. createOrganization reads raw body and extracts ...
Harden default template copy for org provisioning
Use explicit source prefix for destination keys, skip S3 folder markers, and fail fast when the template prefix is empty so silent partial copies do not reach g...
Union listObjects across nodes for complete key sets
The first reachable MinIO node could return an empty listing while other nodes held replicated objects, which broke recursive copies such as theme template sync...
Include teamMember owner flag in *** for platform admin UI
Store teamMember { memberId, isOrganizationOwner } in Redis session at login so kamo-internal hasPlatformAdminAccess can satisfy the top-level org owner path. E...
Stop duplicating query string in access-logs API proxy
forwardToApi already appends the incoming request search string. Embedding ?params in the path produced malformed URLs and Spring failed to parse page/size (Num...
Drop mail from required DNS CNAME aliases
Remove mail from KnownAliases so verify-dns and onboarding no longer require mail.example.com; new custom domains also skip auto-creating the mail child alias.
Align required subdomain list without mail
Match SecurityService KnownAliases for DNS setup UI and manual guide.
Gate behavior labeling on applied-model ready; avoid permissive defaults on fetch error.
Parse session orgID and userID when stored as strings in AppliedModelController.
Je, unaona nini kuhusu usafiri?
Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.