Rebuild against the shared-lib loading_logo_overlay column
No source change. CI clones kamo-shared-library at build time, so Organization.loadingLogoOverlay is only mapped once this rebuilds — until then the generic PUT...
Add the loading_logo_overlay column
Second surface for the logo overlay feature: the loading screen shown between page navigations, alongside the home page masthead. Both ALTERs live in the one r...
Carry the loading screen logo overlay on Organization
The same overlay vocabulary as homeLogoOverlay, applied instead to the logo on the loading screen shown between page navigations, plus its branch in the generic...
17 unenforced becomes 16 — support topic creation takes its own right
POST /support/topics was gated on MANAGE_SUPPORT, the parent, so the child right looked dead while being the thing checked. It now takes CREATE_SUPPORT_TOPICS, ...
Creating a topic takes CREATE_SUPPORT_TOPICS, not its parent
The gate was already there and refusing callers — on MANAGE_SUPPORT, the parent — so CREATE_SUPPORT_TOPICS read as decorative in every editor while being exactl...
Campaigns take the bulk-email rights, like the recipient resolver already did
Bulk email was half-enforced and the halves were in different services. **************** in SecurityService has gated recipient resolution on MANAGE_BULK_EMAIL ...
18 unenforced becomes 17 — bulk email campaigns are gated
VIEW_BULK_EMAIL and MANAGE_BULK_EMAIL now cover the campaign and provider surfaces in EmailService, which checked nothing, joining the recipient resolver in Sec...
Stop losing the brand palette on the way to the browser
Organization.fromJSON could not read back its own output. It mapped the brand ramps only from the nested `colors` object SecurityService sends, but what it EMIT...
Pick the assigned agent from the directory, not a dropdown
The Assigned Agent field is now the same control as Manager on a member's profile: a read-only field that opens the searchable member picker. A dropdown could o...
Narrow the member search to holders of a given right
The lead assignment picker needs the directory to return only people who can actually work a lead, so /team-members/search takes a requiredRight. An unrecognise...
Let the directory filter by right, and let a lead be unassigned
Two things the assignment picker needs. The directory queries take an allowed-id set so a caller can narrow the search to the people a thing may actually be gi...
20 unenforced becomes 18 — marketing materials and social media are gated
VIEW_MATERIALS and VIEW_SOCIAL_MEDIA now have server enforcement, alongside their MANAGE counterparts which were client-only. 29 endpoints across seven MediaSer...
Materials and the social timeline take rights, not just ownership
MANAGE_MATERIALS and MANAGE_SOCIAL_MEDIA counted as enforced in the audit and every site was a .tsx file. Behind them 29 endpoints checked ownership and no righ...
The analyzer could not see nested arguments — six rights were never decorative
26 unenforced becomes 20, and none of it is new enforcement. The six sales-agent rights have been gated the whole time: AiSalesAgentController checks them acros...
The editors say "Enforced as MANAGE_TIMECARDS" instead of "Not yet enforced"
One chip was carrying two different truths and misleading in opposite directions. Unbuilt means nothing checks the right and granting it does nothing. Supersede...
Eleventh cluster triaged — employees, time off and schedules all stay
The first cluster whose honest answer is "no action", and two of the six looked deletable until the last check. TimecardService has one authentication boundary...
Let a failed branding save say what actually went wrong
"Save failed: Failed to save branding identity settings" discarded the status and body of a PUT that enforces the applied security model, so a 403 whose reason ...
Stop failing a branding save over compliance flags it never sent
PUT /org/{id} derived the age ranges and the three ATF flags from the stored row whenever a request omitted them, then asserted all five against the applied sec...
Judge the ATF flags a request changes, not the stored row
**************** judges all three flags every time, so an update path had no way to say "this request does not touch tobacco". Callers filled the gap by re-deri...
28 unenforced becomes 26 — AI models and usage are gated
MANAGE_AI_MODELS gates all four endpoints of AiModelController and VIEW_AI_USAGE both of AiUsageController. Neither checked a right before, only org ownership. ...
Administering models and reading usage take the rights that name them
AiModelController and AiUsageController checked organization ownership and no right. The 403s already in the model controller compare provider.getOrganizationId...
30 unenforced becomes 28 — voicemail is gated, call routing is kept
VIEW_VOICEMAIL and MANAGE_VOICEMAIL now gate VoipVoicemailController, which asked for a right only when playing back a recording in a PHI organization and for n...
Working with voicemail takes a right, not just handling PHI
VoipVoicemailController required VIEW_CALL_LOGS on exactly one path — playback, and only when the organization handles PHI. Listing voicemails with their transc...
Rebuild against the shared-lib home_logo_overlay column
No source change here. SecurityService's CI clones kamo-shared-library at build time, so it only maps Organization.homeLogoOverlay once it is rebuilt — and unti...
Carry the home page logo overlay on Organization
The solid colour an org can paint over the masthead logo on the kamo-internal home page, plus its branch in the generic patch path so the existing PUT /org/{id}...
Add the home_logo_overlay column
Backs the Home Page Logo Overlay setting: the solid colour an org can paint over the masthead logo on the kamo-internal home page. Holds a token rather than a ...
Let an org paint the home page logo a solid colour
Adds "Home Page Logo Overlay" to Branding on **************** directly above Background Watermark: No Overlay, White, Black, and every step of the org's own pri...
32 unenforced becomes 30 — mailbox administration gated, email logs deleted
VIEW_EMAIL_ACCOUNTS now gates the administrative reads on MailboxController and MANAGE_EMAIL_ACCOUNTS gates every write. Both were client-only before: the whole...
Purge VIEW_EMAIL_LOGS rows, and stop a test rotting when ordinals shift
VIEW_EMAIL_LOGS (64) was deleted from RoleRightType today for naming a feature that was never built. This removes what it left behind — measured at 42 role rows...
Mailbox administration takes a right, and three endpoints get a session
MailboxController enforced no right at all. MANAGE_EMAIL_ACCOUNTS existed only as a checkRight in the browser and VIEW_EMAIL_ACCOUNTS was referenced nowhere, so...
Delete VIEW_EMAIL_LOGS, which names a feature nobody built
No email log exists anywhere in the platform: no table in any schema, no endpoint among EmailService's 21 controllers, no UI, and no reference in the frontend —...
Put the note composer at the top of All Communications
The composer only existed on the Notes sub-tab, so writing a note about what you were reading meant leaving the tab you were reading it on. All now carries the ...
Keep a security model's app grants off the catalog
The Allowed Apps tab showed "Not Available" for every app and snapped back whenever another option was picked. loadModels() runs from a mount-only effect, so i...
Gate platform uploads on MANAGE_PLATFORM_SOUNDS, not org ownership
An operator granted "Manage Platform Sounds" on the Platform Administrators page saw the Sounds tab — the console gates on the right — opened the upload dialog,...
Choose the new org's apps while creating it
Adds an Apps & Features step between Type and Basics. It lists the apps the chosen branch type's security model actually offers -- the forced ones as "Always in...
Let the creator choose the new org's apps
The network-create wizard gains an Apps & Features step, and this is the half that makes it real. /branch-types/creatable now describes the apps each branch ty...
Rewrite the app catalog copy for the people who read it
The display name and description on ServiceType are the only description of an app most people ever see: an org admin on Settings -> Apps & Features, a parent-o...
37 unenforced becomes 32 — CRM contacts and leads are gated
Contacts: all 26 endpoints of EmailService's ContactRestController now take the verb that names them. They checked ownership carefully and no right at all, with...
Every contact endpoint takes the verb that names it
ContactRestController checked ownership carefully — orgOf, userOf, assertBookIsMine, assertGroupIsMine, and 404 rather than 403 so somebody else's id is never c...
Creating and deleting a lead take the rights that name them
LeadController is one of the better-gated controllers in the platform — VIEW_LEADS, EDIT_LEADS, ASSIGN_LEADS, REASSIGN_LEADS_MANUALLY, VIEW_UNASSIGNED_LEADS and...
Stop the letter-fallback org logos from flashing
An org with no logo shows its initial, and on /network that initial blinked continuously. Three things stacked up. PlatformRightsProvider wraps the whole app, ...
41 unenforced becomes 37 — the document verbs are gated
CREATE, EDIT, DELETE_DOCUMENTS and MANAGE_STORAGE now gate DocsService's ImagingController and DocumentController and ConversionService's upload endpoints. The ...
Uploading a file takes CREATE_DOCUMENTS, like every other way of making one
The document rights are enforced in DocsService as of this change, but the upload endpoints are not in DocsService — kamo-internal's app/api/imaging/upload prox...
The document verbs are enforced, as the org's security model resolves them
ImagingController checked ImageAccessLevelType and nothing else, and DocumentController checked only that a session existed. Access level is a real control but ...
Sixth cluster triaged — documents span four services, and must not be seeded
CREATE, EDIT, DELETE_DOCUMENTS and MANAGE_STORAGE all have real live features, so nothing here is deletable. VIEW_DOCUMENTS is client-only in navRegistry, the s...
A loan id is not a credential — scope every LoanController read to the org
LoanController.get(uid) took a loan id and returned whatever it found. Any caller who reached the service got the loan, balances and borrower included, whicheve...
Protect god accounts on the platform administrator list
A god account's platform rights may be changed only by another god, and a god account can never be removed from the list — by anyone, including another god. Go...
God accounts are protected on the platform admins list
Two rules the server enforces and this only mirrors: a god account's platform rights can be changed by another god and nobody else, and a god account can never ...
Bake the org's background order into config.json
kamo-login, kamo-register, the marketing site and KamoMeet all read the theme bucket's config.json for backgroundImageCount; backgroundOrder now rides alongside...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.