Enforce system-role assignment and auto-admin for team-member owners
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requ...
Apply template force rules and DEFAULT fallback to member rights resolution
**************** now overlays the applied model's 4 default-role templates on top of the existing cascade (org roles → department → job title → member): - Role...
Add master model editor, role templates, and force-rule gating
Surfaces the new branch-type security model in the UI: - branch-types tab gains an "Edit Master Model" button (hidden when the org has a branchTypeID assigne...
Master-model + applied-model endpoints and template-aware org seeding
Adds the controllers that surface the new branch-type security flow: - /api/security/master-model (GET/PUT) manages the current org's master model; only writ...
Add master model, default role templates, and applied-model resolver
Introduces the data layer for the new branch-type security model flow: - Organization gains nullable branchTypeID and masterModelID columns. - New RoleRightTem...
Add branch type chip-input field to security model editor
- BranchTypeChipField with colored dot toggle, edit-on-click label, and X delete - BranchTypeEditDialog for name/description editing - Autocomplete dropdown pul...
Expand ChildOrgSecurityModelDTO with full fields and branchTypes
Update BranchSetupManager subtitle to reference dynamic branch type label
Rename Branch Setup tab to dynamic {branchLabel} Types and update URL to branch-types
Reset Capcha *** after every failed login attempt
Users must re-verify they are human after each incorrect password. Calls widget.reset() and clears CapchaVerified/payload state on both credential failures and ...
Auto-inject logoUrl, logoSimpleUrl, and orgName variables at send time
EmailTemplateService now merges base variables (logoUrl, logoSimpleUrl, orgName) derived from the org's primary domain before rendering, so all transactional te...
Add permission gates for user-level fields and password change section in MyAccountTab
Add access gate and MANAGE_MEMBER_SECURITY tab guard to member settings page
Lock form and auto-proceed after Capcha when submitting early
If the user submits before the Capcha widget is verified, the form is now disabled and the widget is triggered programmatically. Once verification completes the...
Supplement session rights with all known rights for grant-all roles
Remove @Enumerated — RoleRightTypeConverter autoApply takes over
Enforce org+member rights across settings, home, and calculator
- Add 11 new rights (MANAGE_CRM_SETTINGS, VIEW_TASKS, **************** to RoleRightType.ts - Add CALCULATOR to ServiceType.ts, AppType.ts, and Organization.ts (...
SSE-driven live verification status on /verification page
- Add streaming SSE proxy at **************** - PostCompletionScreen subscribes to SSE; auto-sets verified when email link is clicked in another tab - Verifie...
Add SSE endpoint for real-time email verification + improve welcome email logging
Add 11 new rights (119-129) and CALCULATOR service type
MANAGE_CRM_SETTINGS, VIEW_TASKS, CALC_SIMPLE, CALC_SCIENTIFIC, CALC_PROGRAMMER, CALC_GRAPHING, CALC_UNIT_CONVERTER, CALC_CURRENCY_CONVERTER, CALC_EMOJIS, CALC_C...
Pass email_verified and email params on redirect to login
Both the code-verify and token-verify paths now redirect to **************** so the login page can show a success banner and pre-fill the username field.
Show verified banner and pre-fill email after email verification
Reads ?email_verified=1&email=... from URL on mount, shows a success alert, pre-fills the username field, then cleans the URL.
Add Gmail Personal and Outlook Personal provider cards and config components
Add /reset-password page, update Forgot Password link
Three-stage email password reset: email form → 8-char code entry → new password. Auto-verifies token from URL. Glass-morphism card, background carousel, Capcha ...
Redirect Forgot Password to register.{domain}/recover
Uses the existing replaceDeepestAlias pattern, consistent with the register link. Password reset now lives on kamo-register.
Add /recover password reset page and API proxy
Three-stage flow: email → 8-char code entry → new password. Auto-verifies token from URL query param, background carousel, glass-morphism card, Capcha ***, matc...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.