- Shipped
- 15 ஆகஸ்ட், 2026 அன்று 2:16 PM UTC
- Author
- Kamo
- Commit
- 96ed91e
los.proxy-hmac.enabled has been falling through to its false default since this service deployed, so ProxyHmacFilter existed and never ran. X-Org-Id — the header every org-scoped query in this service trusts — was unsigned and client-shaped on a live multi-tenant loan API. Safe to enable now because step 1 landed first: kamo-internal mounts the same los-proxy-hmac secret and its running pod is signing, verified before this was pushed. The reverse order would have rejected every loan request in the platform. Checked before flipping it: - the filter bypasses /actuator/**, so the startup and readiness probes still pass. Had it caught them the pod would never become ready and this would roll itself back. - it bypasses /api/los/webhooks/**, so Stripe keeps working — those are verified by Stripe's own signature instead. - kamo-internal is the only caller of kamowslos-service, so there is no unsigned service-to-service path left behind. This does not replace the org checks in LoanService and LoanScope. It raises what X-Org-Id means from "a header someone sent" to "a header this proxy sent", while those decide whether the named org may see the row. Defence in depth: neither is sufficient alone.