Live Change Log

Renames the System User tab to Platform Admins and turns it into what it was always standing in for: a list of the people who may operate the platform, each hol...

Backfills it from the retired system_user_access grants so nobody who could operate the System User before this deploy loses it: direct member grants map one-to...

@PlatformAdminOnly now names the platform right it requires (defaulting to MANAGE_ORGANIZATIONS, which is what this service's platform surface is about) and the...

@RequirePlatformRight + PlatformRightInterceptor replace three hand-rolled "is the caller a top-level-org owner" gates that were copies of each other, one per p...

MediaService now requires START_MEETING to create a meeting and VIEW_MEETINGS to resolve one. Measured on production before writing this: 42 security roles acro...

/api/meet/create checked only that you had a session, so every authenticated member of every organization could create a meeting with the org's provider — START...

Who may operate the platform has been three different answers in three different places — a system_user_access grant table, an owner check copied into each plat...

The marker sits with the name because that is who the call is to, rather than in the id column where it pushed the ids out of line. The filter offers All / Sch...

The system could only ever play the thirty-nine tones it shipped with. Now any layer can add its own file — the platform's catalogue, an organization's, a membe...

Bytes arrive through ConversionService (which owns ffmpeg and the scanner); everything afterwards is here, where the session and the scoping rules already live....

Extends the ffmpeg wrapper the VoIP recording pipeline already had — this image installs ffmpeg with libopus for it, so putting a second ffmpeg in another image...

EVENT_SOUND_ASSETS: a sound file somebody uploaded, ready to be assigned. Scope mirrors EVENT_SOUND_PROFILES exactly — same three layers, same SCOPE_ID conventi...

The invitation subject was fixed at "<host> from <org> invited you to a meeting" and built inside the send route, so nobody could say what the meeting was actua...

KamoLOS enforces nothing — no rights check anywhere in its source — so this proxy is the authorization boundary for the module, the position denyUnless occupies...

MEETING_REMINDER, so MediaService can raise the start-time nudge as a notification instead of a popup only it knows about. Its own kind rather than CALENDAR_EV...

NavTop sums two counts into one obligation badge, and only the legal half was live. A member assigned a course — or excused from one by HR — kept the old number...

The twin of the legal relay, because NavTop sums the two counts into one badge and a pair of halves that behaved differently would give the member chrome that w...

The NavTop obligation badge sums two counts — packages to sign and courses to take — and only one of them was live. The legal half has pushed since its NATS blo...

A member has this open in more than one tab about as often as not, and often on a phone as well. Each of those holds its own socket and draws its own bell, and ...

The nav-top bell was live for arrivals and nothing else. Reads, dismissals, snoozes and deletions were applied to whichever tab the member clicked in and announ...

Mirrors the shared-lib deletion: the enum mirror, its registry array, both hierarchy edges (ACCESS_CHAT -> CREATE_CHANNELS -> MANAGE_CHANNELS and ACCESS_CHAT ->...

Ids 74/75/76 no longer resolve. RoleRightsSyncService would sweep them on some future SecurityService boot anyway — silently, at an unpredictable moment, with n...

CREATE_CHANNELS (74), MANAGE_CHANNELS (75) and MODERATE_CHAT (76) gated nothing and could not be implemented as written: chat is real but the platform has no ch...

Adds notes.member_id and attaches each note to its owner's earliest membership — the organisation the account has belonged to longest, which in practice is wher...

There were two sound systems and neither knew about the other: four mp3s behind useChatSounds, and four synthesised tones behind notificationSound with a five-o...

GET returns all three layers in one round trip plus what the caller may edit — every settings page needs the whole stack, because an org administrator editing t...

Platform defaults, an organization's overrides and a member's own are the same shape, so they are the same table: a scope, the id that scope is about, and the s...

Dropping `layout` to stop the card lurching onto the edge of the screen also took the sibling slide with it: dismissing a card left the rest snapping into its p...

The cascade highlight now travels the chain instead of flashing every affected row at once. enabledAncestors already arrives nearest-first, so the index IS the ...

Five editors granted 199 rights as five flat lists of checkboxes, and none of them showed that one right can be a prerequisite for another. Granting a child wit...

Member direct rights now go through RightsHierarchy.normalizeLevel before they are persisted: a granted child pulls its ancestors up to GRANTED at the member le...

MemberRightsAppliedService now denies any right whose parent chain is not granted. Every row written before the hierarchy existed knows nothing about ancestors,...

RoleRightType has declared a 'parent' field and a public getParent() for years. Every constant passed null and nothing ever called it. This finishes that scaffo...

The card is the organisation's primary colour now, with every mark on it drawn in --on-primary rather than a literal white — a white-label org that picks a pale...

A new tab on /settings/features/hrs holding Default Legal Text, linked from the settings menu and the settings launchpad. Creating a package on /hr/legal-compli...

A note now says whether it is rich text or plain text, and both the editor and the floating sticky can switch it. The floating note in rich mode embeds the ver...

Create honours the requested mode and defaults to rich, matching the editor a note is created in. Update is null-guarded like every other field on that endpoint...

Whether a note is edited as rich text or plain text cannot be read back out of its content: a rich note nobody has formatted yet is byte-for-byte a plain one. W...

The mode cannot be derived from the content. A rich note the member has not formatted yet serializes byte-for-byte identically to a plain one — both are a Lexic...

The notifications page wore a header of its own — an eyebrow, a title and three pill buttons inside a bordered card — while every neighbouring page (the account...

/api/docs/legal/settings, behind the same guarded() funnel as every other mapping on this controller. The read NEVER creates a row: it resolves to LegalDefault...

One hr_legal_settings row per org, unique on org_id, carrying **************** INSERT-ONLY, never an UPDATE. An org that has edited its own wording owns it; a ...

LegalSettings is one row per organization carrying the wording a NEW legal package starts with. It is a DEFAULT, never a live reference: creating a package copi...

The bell opened a popover, which is the right shape for "what just happened" and the wrong one for "what did that reminder say on Tuesday". A panel hanging off ...

The centre could answer one question: the most recent hundred, unread or not, with no way to ask for what had already been read. So anything a member had seen w...

The browsable history filters by kind and by whether a notification has been read, and those combine freely — which as JPQL is a query per combination, or one q...

The page was the last screen still on raw Tailwind blue-600/gray-50 while everything around it moved to the house system, and every one of its ~100 `dark:` vari...

The sticky could recolour, rename, minimize, maximize and close a note but not pin it — so pinning meant going back to /notes for the one thing the note is alre...

There were two. The pair near the top of the page silenced the in-app cards; the pair at the bottom silenced the missed-message emails. Nothing on screen said t...