- Shipped
- 5 ஜூலை, 2026 அன்று 3:18 PM UTC
- Author
- Kamo
- Commit
- b910c89
BaseLosController now resolves the caller's session via CallerSessionResolver (X-OTK-validated attribute FIRST — operators/BFF unchanged — then a first-party *** cookie fallback) instead of only the X-OTK attribute. This is the keystone that lets the KamoMLOS borrower portal reach /api/security/mortgage-apps/** with a real per-borrower session (a borrower is a plain org Member via the standard login→OTK→validate-otk→*** flow) rather than a shared service account. Backward- compatible; all 7 LOS controllers benefit. Compiles clean.