Ruhusu mtumiaji wa mfumo kutatua mfumo wowote uliotumika wa org
Lango la msalaba lilirudi 403 wakati orgId! = kikao org na mpiga simu Hakukuwa na mgombea wa urais katika chama hicho. Watumiaji wa mfumo wa uendeshaji wa jukwa...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Canonicalize webhook repo name to public-projects casing
After the cluster migration the Forgejo repos were recreated lower-cased (securityservice), but historical rows and the public-projects filter use canonical cas...
Generate favicons via multi-node logo read, not single-node exists()
generateAndUploadFavicons() gated on minioService.exists(), which only stats the current MinIO host. When the simple logo was written to (or only replicated ont...
Expose GD (god eligibility) in /user-info for kamo-universe
The session stores the GD flag (KSessionService) but /user-info never returned it, so kamo-universe's KamoIdentity always deserialized is_god=false and the god/...
Case-insensitive email lookup so reset emails send
Password recovery lowercased the input but findByEmailEmail does a case-sensitive match against the stored email (e.g. Sage@KamoCRM.com), so the user was never ...
Carry impersonation audit trail across org jumps
When the caller is already an impersonation session (a god admin acting as another member, carrying SUDO_MEMBER_ID), entering another org from /network minted t...
Select the SUBSCRIPTION market for platform setup
KamoCRM owns several markets **************** so resolveProductMarket must pick the SUBSCRIPTION-type (platform-access) market rather than the first active one....
Regenerate favicons on labeling save; sniff real logo type
provisionUpdate (run on every custom-labeling save) wrote config/css/manifest but never regenerated favicons — those were only produced by provisionFull. An org...
Seed globals.css from template when org folder lacks it
provisionUpdate (run on every color save) rewrote the org's css/globals.css in place, but that object only exists once provisionFull has copied it from the defa...
Detach before replacing features collection in /org/domain
The previous fix wired the applied-model projection into **************** but called org.setFeatures(projected) on the still-managed entity. The Organization.fe...
Resolve ambiguous /org/domain handler — Commerce nav was disappearing
SecurityController had a second **************** that collided with **************** Spring rejected the request with "Ambiguous handler methods mapped" → 500 →...
Add /me/language endpoint that bypasses SystemUserGuard
The NavTop language picker did nothing for the System User signed into a sub-org: PUT **************** runs SystemUserGuard first, which 403s every System-User ...
Never gate Kamo-owned subdomains on TXT ownership
Child orgs that picked a Kamo web alias (e.g. gnosia.demo.kamocrm.com) were getting "TXT record found but verification code doesn't match" in the DNS setup UI. ...
Grant top-level org owners cross-org delete/update access
deleteDomain and updateDomain previously rejected platform admins operating on child-org domains because they checked isUserOwnerOfOrg against the target org di...
Allow deleting per-org *.kamocrm.com subdomains
The endsWith(".kamocrm.com") guard blocked every demo org from swapping its platform subdomain (e.g. gmosia.demo.kamocrm.com) for a custom domain. The platform ...
Propagate child-org-creator admin status to parent-org membership
When a user creates a child org they become its owner + admin (via **************** Their PARENT-org membership, however, is whatever it was before — typically ...
Mint owner OTK with grant-all rights without DB round-trip
After **************** assigns the Administrator role and writes member_rights_applied, the OTK-minting block was re-reading those rows via **************** ins...
Allow elevated access on getDomainById and verify-dns endpoints
Top-level org owners and system members were getting 403 on getDomainById and verify-dns because those endpoints checked isUserMemberOfOrg directly. Adds hasEle...
Allow top-level org owners and system members to manage any org's domains
Prevent duplicate root domains and fix primary domain display
ONE_DOMAIN_PER_ORG check incorrectly excluded .kamocrm.com web-alias domains, allowing an org to accumulate multiple root domains (and 10 aliases each) by retry...
Reduce org creation latency and fix translation cascade failures
- OrganizationController: replace ensureTeamMembersForAllOrgs (full org table scan) with ensureTeamMemberForOrg (single org) — eliminates the ~400ms×N DB ro...
Auto-assign first seat, Free as floor, broader org invalidation
BillingSetupService now activates the first open license slot for the creator when seeding a sub-org subscription (and same for promote-to-billing-owner) — othe...
Top-level org members get platform-owner plan, bypass billing gates
KamoCRM (top-level) org members are not subject to the billing system — they get the OWNER_UNLIMITED plan's feature matrix outright (with Free as a defensive fa...
Update OrgThemeProvisionServiceTest for buildConfigJson description parameter
Prioritize real first/last name over usernameAlias for display
usernameAlias is functionally a login handle (often equal to username), not a display name. Real human-readable names live on User.name (EmbNameFull). Apply to ...
Resolve display name with correct priority in by-department endpoint
Priority: member.usernameAlias → user.name.formatFull() → user.alias → user.username
Serialize Long as string to prevent JS precision loss on large CockroachDB IDs
Remove duplicate CorsFilter bean causing double Access-Control-Allow-Origin header
The explicit CorsFilter bean caused a second CORS filter alongside Spring Security's built-in CORS support (which uses CorsConfigurationSource). Both filters re...
Allow system user to manage org branding and fix logo auth
- Add system user bypass as first guard in canManageOrgBranding so platform system user has full branding control over all non-parent orgs - Fix uploadLogo en...
Surface real reason behind GoDaddy 400 error
GoDaddy now returns HTTP 400 with code=UNABLE_TO_AUTHENTICATE and body "Bad Request : Bad Request" when an account does not meet their current production Domain...
Eager-load domains via findByIdWithDomains, drop @Transactional
@Transactional on a controller method keeps a DB connection open across the entire MinIO upload, and also risks LazyInitializationException if the inner getOrga...
Upload directly to public/{domain-folder}/img/ instead of staging bucket
The uploadLogo endpoint was writing to a hardcoded 'sumtingwong' placeholder (unfilled setting) instead of the org's actual public theme path. Logos now go dire...
Remove downed k2m1 node from edge-nodes default
k2m1 (10.8.2.1) is permanently down. Leaving it in the failover list caused upload retries to hang until the new OkHttp timeout fires. Default is now k1m1-only;...
Enforce /network enter rules server-side
Reject when target is current session org, custom domain SSL is not confirmed, or human target membership is inactive. Share domain-setup logic with my-networks...
Require destination memberId and validate org membership
Enter-as now always builds the new *** with the client-supplied target member row; reject mismatched org/member. Improve session debug logging.
Enter-as session uses target org security provider and optional targetMemberId
Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-do...
Resolve system-user session from OTK for BFF requests
SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never s...
Enter-as resolves session from X-OTK BFF auth
EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.
Return only team members from by-department endpoint
Interaction Center should list TeamMember rows, not base Member records.
Apply subscription gate to app routes and feature API
AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...
Harden default template copy for org provisioning
Use explicit source prefix for destination keys, skip S3 folder markers, and fail fast when the template prefix is empty so silent partial copies do not reach g...
Include teamMember owner flag in *** for platform admin UI
Store teamMember { memberId, isOrganizationOwner } in Redis session at login so kamo-internal hasPlatformAdminAccess can satisfy the top-level org owner path. E...
Drop mail from required DNS CNAME aliases
Remove mail from KnownAliases so verify-dns and onboarding no longer require mail.example.com; new custom domains also skip auto-creating the mail child alias.
Parse session orgID and userID when stored as strings in AppliedModelController.
Je, unaona nini kuhusu usafiri?
Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.