Kugawana hati hufanya kazi tena, kama mtu ambaye anaweza kusoma
Majadiliano ya kushiriki hutuma kitambulisho cha hati kama kamba - id ya img ni Int64 iliyopita 2 ^53, ambayo nambari ya JSON ingezunguka - na kuunda Share cast...
Barua pepe za kisheria, mafunzo na kazi zinaunganisha tu kwa majeshi ya kuishi
- Kisheria: console ya org (OrgLinkHosts.internalOrigin) na mwanachama Ukurasa wa Sheria na Masharti ya Matumizi. Inaunganisha apex, ambayo hutumikia. tovuti ya...
Jina jipya lilijibu bila Url skips Docs rename callback
Docs anashiriki simu ya mteja mmoja kati ya RenameFile na Save As, na ****** kuruka mwili wake wote - faili Rename tukio Ukurasa wa kuingia unasikiliza kwa pamo...
Kupoteza mbio kuhifadhi maudhui sawa sio kuokoa kushindwa
Kutazama kabla ya kuingizwa kwa ImgDat sio kufuli, na kamowsdocs inaendesha mbili replicas nyuma ya lango moja - nyaraka mbili ambazo vidole vyake ni sawa (mbil...
Moja ya kuokoa Kwa kuwa muundo wa mabadiliko sio aina ya hati ya chanzo
uploadDocument anakataa upload ambayo alidai MIME aina kutokubaliana na nini ni Iligunduliwa kutoka kwa bytes, na saveAsNewDocument ilidai aina ya mstari ilikuw...
Hifadhi ya Docs haikuweza kuhifadhi nates jukwaa tayari uliofanyika
Kuokoa hati mara mbili, na renaming moja, wote kuishia katika "Document haiwezi kuwa" Tafadhali angalia ruhusa zakoā ā na baada ya nakala tano zilizotolewa na k...
Retry mbili kusoma catalog bump kuvunja hati editing na
WopiController.checkFileInfo huitwa mara kwa mara kupitia kikao cha uhariri - kwenye kufungua, karibu na kufuli, baada ya kila kuokoa - hivyo mgogoro juu ya shi...
Jaribu kuweka kwa digest, si kwa tag
Ahadi ya awali inaacha "kuweka picha" kuwa kimya hakuna-op. Hii inathibitisha kuwa matokeo: baada ya rollout, tag ni kutatuliwa kwa digest katika Usajili na Vio...
Ujenzi wa mradi huo haukuleta chochote na uliripoti mafanikio
Picha ni tagged na SHA ahadi, hivyo kujenga upya ahadi hiyo kuzalisha Mfano wa picha sawa. "Kuweka picha" kisha hakuna mabadiliko, Kufukuzwa ni kamwe kuguswa, '...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Three self-invoked transactions that were doing nothing
@Transactional and @Async are PROXIES. A call from inside the same bean never reaches one, so all three of these annotations were inert. Found by audit, not by ...
A country is not its enum name
Every card on every careers surface has been printing "United states" ā the words after the first lose their capitals when an enum name is prettified ā and "CĆ“t...
A REQUIRED resume is now actually enforced
A review of my own commit found the enforcement it claimed. JobApplicationService carried the comment "a REQUIRED resume is enforced at that point by requireRes...
A document whose bytes are gone answers 410, not 500
The streaming download caught every storage failure as one unexpected error and returned 500, which tells a reader nothing and leaves a viewer with a blank erro...
Let an unscoped binder hold its own grid's documents
sameCollection demanded an exact assoc_object_id match in both directions, which made every binder in My Docs refuse every document My Docs was showing it. The ...
The document verbs are enforced, as the org's security model resolves them
ImagingController checked ImageAccessLevelType and nothing else, and DocumentController checked only that a session existed. Access level is a real control but ...
Enforce the doc-share alias rights server-side
GET /shares/resolve-alias turns a guessable alias into a real person's NAME and required only a valid session. The rule lived solely in ShareDocumentDialog, and...
Writing the org legal settings needs BOTH HR rights
The Legal & Compliance settings tab is the only writer and is now offered only to a member holding MANAGE_HRS_SETTINGS *and* MANAGE_LEGAL_AND_COMPLIANCE, so the...
Connect DocsService to NATS so the badge lights without a refresh
LegalPendingCountPublisher takes its NATS Connection as required=false and returns quietly when it is null. The shared NatsConfig is **************** and this C...
One snapshot per block, and figures that say what they measure
Both summarize methods are @Transactional(readOnly = true). Each issues six or seven reads whose figures are cross-checked ACROSS query boundaries: countOverdue...
Fill the per-member overdue rollup instead of sending zero
Both summary services built members[] with .overdue(0). The Overview's matrix branches on that field, so legal and training could only ever render amber or gree...
Bound the Resources block to count/sum/recent queries
**************** was loading the org's entire non-hidden HR_RESOURCE Img collection into memory to filter trashed, sum bytes and take 5 recent rows in Java ā un...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop renewing the shared *** TTL for idle users
Caught with redis MONITOR: this pod was issuing GET + PEXPIRE against a *** key whose owner had been idle for over an hour, seconds after SecurityService had co...
Accept repeated status params so the gateway cannot corrupt the filter
Opening **************** answered "Unknown status: **************** for every member. The member grid sent the bucket as one CSV value. A comma in a query valu...
Kamwe usimfuate mwanachama ambaye tayari amesaini, na kuweka suala wazi
Two behavioural defects in the phase-8 notification path. 1. The reminder sweep ran over OPEN_STATES, which includes AWAITING_OTHERS ā "this member finished...
Let a failed pending-count read out instead of downgrading it
publishFor caught Exception around countByTeamMemberIdAndStatusIn and turned it into a WARN. That catch was not only around the badge: the query runs inside the...
Kulinda njia za picha za uharibifu na kufanya ukarabati ufikiwe
DELETE /imaging/delete/{imgId} is the one destructive imaging path and was not wired to the issued-document guard. ImageService.deleteDocument authorizes on org...
Stop colleagues reading a member's HR-issued documents
isPerPartyRestrictedAssoc covers only ACCOUNT_MEMBER_VAULT and LOAN, so assoc 1 ā SERVICE_APPLICATION, what /settings/member/{id}?tab=docs renders ā has no per-...
Resolve the document bucket from ImageAssocType.BUCKET
DocumentService hardcoded "imaging-mydocs" while every other read path went through ImageAssocType.getBucket(). Now that storage is one bucket, point it at the ...
Wire DocsService to ESigService so Deliver stops 503ing
LegalEsignClient.isConfigured() was false in the cluster: neither internal.auth.secret nor legal.esig.service-url was supplied, so Deliver refused every package...
Prove WHOSE signature Finish counts, and report the live one
verify() compared the caller to assignment.teamMemberId but never to the ENVELOPE RECIPIENT's member ā it trusted the recipientUid the delivery fan-out wrote. A...
Commit before the fan-out, and stop redeliver reissuing nothing
Redeliver published the new version row, flipped every OPEN assignment to SUPERSEDED, and submitted the reissue from inside that same uncommitted transaction. T...
Widen the read gate to match hrTabs.ts, make a cleared due date actually clear
LegalPackageAccess.requireRead demanded VIEW_EMPLOYEES alone while hrTabs.ts admits the Legal & Compliance tab on VIEW_EMPLOYEES || EDIT_EMPLOYEES || MANAGE_HRS...
Enforce HR rights and make the fingerprint see the e-sign design
All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages ā and aud...
Enforce document/binder collection scope in addItem
BinderService.addItem checked read access and refused VAULT/LOAN documents, but never compared the document's own collection to the binder's, so a hand-crafted ...
Mirror Maven Central na retry, hivyo uhamisho rushwa kuacha kuua kujenga
The HR_RESOURCE rebuild failed on hibernate-core:6.5.3.Final with 'Tag mismatch' ā a transfer corrupted in flight, not a missing artifact. The shared-lib stage ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Require a session on POST ****************
The handler took an HttpServletRequest but never used it, carrying the comment "No auth required ā internal admin maintenance endpoint". APIService relays /api/...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
Folder create/rename 500 on root folders (Map.of null value)
createFolder/renameFolder built the response with Map.of(..."parentId", parentId), which throws NullPointerException when parentId is null (a root folder) ā the...
Bounds-check assoc-type ordinal lookups (fixes Materials list 500)
DocsService was running a shared-lib built before ImageAssocType.MATERIALS (ordinal 11) was added, so listDocuments' ImageAssocType.values()[11] threw ArrayInde...
Serve e-sign editor PDF for any converted doc, incl native PDFs
The e-sign editor (DocumentEditor ā PdfCanvas / PageThumbnailSidebar) opens any converted document, not only files uploaded through the sig-template flow. It fe...
Generic byte endpoints refuse MLOS per-party docs (vault/loan)
The generic imaging byte endpoints (download / stream / bulk-download / thumbnail) and the binder aggregation authorized only on org + a numeric clearance ceili...
Don't serve soft-deleted documents on /stream and /bulk-download
getDocumentMetadata (used by the stream + bulk-download byte paths) does not filter trashed rows the way downloadDocument does, and a soft delete leaves the Min...
URI-encode WOPISrc + uaminifu majeshi yote ya api. * WOPI (multi-tenant)
Opening a doc for a non-kamocrm tenant failed with 'unauthorized WOPI host'. Docs's alias_groups only trusted api.kamocrm.com (the Docs-deployment env hardcoded...
Node-local MinIO + failover template read + ImgDat dedup (fixes new-doc about:blank)
Uumbaji mpya wa hati ulining ~ 5 min na tab mpya ilikaa karibu:blank. Chanzo cha mizizi: Docs Service pods iliyopangwa kwenye k3m1 kusoma template tupu kutoka M...
Point Docs deployment at k1m1 registry
The Docs-online image host was the bogus **************** (Redis DNS, never a registry), so every DocsService deploy re-applied an unpullable image. Point it at...
Include com.kamo.z.shared.binder in @EnableJpaRepositories
DocsService boots with an explicit basePackages list, not classpath scanning, so BinderRepository wasn't being discovered ā startup failed with "No qualifying b...
Je, unaona nini kuhusu usafiri?
Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.