Background_order column for the public slideshow order
Nullable VARCHAR; null resolves to sequential on every client, which is what every org had before the column existed. Plain String rather than an enum so a late...
43 unenforced becomes 41 — the two notes placeholders are deleted
Mirrors the shared-lib removal of SHARE_NOTES (72) and MANAGE_NOTES_SETTINGS (73): the TS constants and the registry array, the one parent-map edge in both righ...
Purge the stored rows for the two retired notes rights
SHARE_NOTES (72) and MANAGE_NOTES_SETTINGS (73) were deleted from RoleRightType today for having no feature to gate. This removes what they left behind, counted...
Delete SHARE_NOTES and MANAGE_NOTES_SETTINGS, which name nothing
Notes are real, and as of today fully gated — VIEW, CREATE, EDIT and DELETE are enforced on every endpoint of KBService's NotesController. These two had nothing...
Rebuild — the i18n guard raced the dictionary push
No source change. 9a5b5167 failed on eleven missing background-slideshow keys because the components reached main at 01:47 and the strings reached kamo-translat...
Add orgs.background_order
Nullable VARCHAR(20), no backfill and no DEFAULT — every client resolves an absent value to sequential, which is the behaviour every org had before the column e...
Read the org's real background count and play order
The hero probed for bg/1.webp and then hardcoded three frames, so an org with more never showed them and the rotation modulo'd by LOCAL_BGS.length regardless of...
Honour the org's sequential/shuffle slideshow order
Same config.json contract as kamo-login: backgroundOrder drives all three registration backgrounds, absent key stays sequential.
Honour the org's sequential/shuffle slideshow order
config.json now carries backgroundOrder alongside backgroundImageCount. Shuffle re-randomises on every advance and never repeats the frame on screen; an absent ...
Renaming a member is an admin act, and now has a gate
The member profile's legal-name card was self-only, so an admin who typed a name wrong on the create form could never correct it — MemberCreateForm asks for pre...
46 unenforced becomes 43 — the notes endpoints are gated
Fifth cluster. The Notes backend is KBService, not SecurityService: the entity sits under donotmodify/dao/beans/security/ and kamo-internal proxies /api/notes/*...
Every notes endpoint takes the right that names it, and hasRight fails closed
NotesController checked no right on any of its ten endpoints. VIEW_NOTES was enforced in exactly one place — navRegistry.ts, hiding the Notes app in the browser...
All-networks follows the System User right
Seeing every organization and being able to enter one are the same decision — the list exists so an operator can find the organization they are about to support...
Stop a page-2 request from cancelling the folder you just opened
Junk, Trash, Archive and every custom folder showed the same mail — whatever was on screen before them. The server was not the problem: replaying listMessages a...
Resolve each handler's platform annotation once
The interceptor is registered for /** so the annotation lookup ran on every request this service serves, sign-in included, and AnnotatedElementUtils walks the m...
Close the add-path route around the platform-admin lockout guard
POST replaces an existing administrator's rights, so it can take them away as well as give them — but only the PUT and DELETE paths checked whether the edit wou...
Let a granted administrator actually see Platform Administration
The section gate and the settings menu topic still asked useUserInfo's hasPlatformAdminAccess, which is owner-of-the-top-level-org or an open god-mode window an...
Send an operator with no Configuration tab somewhere real
SYSTEM_USER and MANAGE_UNIVERSE gate surfaces that are not tabs on this page, so somebody holding only those is a platform administrator the page guard admits a...
The meet seed recomputes applied rights instead of waiting for a boot
Granting the two rights on org_role_rights changes nothing anybody can observe. member_rights_applied is the flattened snapshot the session and the server-side ...
Platform Admins console gates every platform surface
Renames the System User tab to Platform Admins and turns it into what it was always standing in for: a list of the people who may operate the platform, each hol...
Stand up the platform administrator list
Backfills it from the retired system_user_access grants so nobody who could operate the System User before this deploy loses it: direct member grants map one-to...
Decide platform access with the shared resolver
@PlatformAdminOnly now names the platform right it requires (defaulting to MANAGE_ORGANIZATIONS, which is what this service's platform surface is about) and the...
48 unenforced becomes 46 — meet create and join are gated
Fourth cluster of the 48, and it split three ways rather than the two the design predicted. The design attributed the enforced MANAGE_MEET_SETTINGS check to Ch...
Enforce platform rights on every platform surface
@RequirePlatformRight + PlatformRightInterceptor replace three hand-rolled "is the caller a top-level-org owner" gates that were copies of each other, one per p...
Seed the meet rights before the gate can lock anyone out
MediaService now requires START_MEETING to create a meeting and VIEW_MEETINGS to resolve one. Measured on production before writing this: 42 security roles acro...
Creating and resolving a meeting take the rights that name them
/api/meet/create checked only that you had a session, so every authenticated member of every organization could create a meeting with the org's provider — START...
Platform rights as a spine of their own
Who may operate the platform has been three different answers in three different places — a system_user_access grant table, an owner check copied into each plat...
Draw the callback markers as soon as the summary loads
The summary lands after the grid has drawn its rows, and AG Grid keeps the cellRenderer a column was built with and only re-creates a cell when its row changes....
A deleted upload now falls back instead of going silent
The previous commit claimed a retired sound "degrades to the layer beneath it rather than to silence". It did not. `isKnownSoundId` accepts a custom id on shape...
Move the callback marker beside the contact name, add a Callback filter
The marker sits with the name because that is who the call is to, rather than in the id column where it pushed the ids out of line. The filter offers All / Sch...
Upload your own sound effects, at all three layers
The system could only ever play the thirty-nine tones it shipped with. Now any layer can add its own file — the platform's catalogue, an organization's, a membe...
List, rename, retire and stream uploaded sound effects
Bytes arrive through ConversionService (which owns ffmpeg and the scanner); everything afterwards is here, where the session and the scoping rules already live....
Transcode uploaded sound effects to Opus
Extends the ffmpeg wrapper the VoIP recording pipeline already had — this image installs ffmpeg with libopus for it, so putting a second ffmpeg in another image...
Uploaded sound effects, and the storage domain that counts them
EVENT_SOUND_ASSETS: a sound file somebody uploaded, ready to be assigned. Scope mirrors EVENT_SOUND_PROFILES exactly — same three layers, same SCOPE_ID conventi...
48 unenforced — the six PLOS rights are gated now
Gating the LOS proxy made PLOS_* enforced, but they stayed on the unenforced list, so the editors were showing 'Not yet enforced' against six live gates. Third ...
Let the sender edit the meeting invite email subject
The invitation subject was fixed at "<host> from <org> invited you to a meeting" and built inside the send route, so nobody could say what the meeting was actua...
Third cluster triaged — Meet splits in two
All five Meet rights have real running features, so none is a chat-channel case: kamomeet-deployment is live and Meet-jibri is deployed, making recording real i...
Put the callback marker after the lead id
Leading the cell with the marker pushed the id right on any row with a call waiting, so the ids no longer lined up down the column while scrolling.
Gate the personal-loan proxy on the PLOS rights
KamoLOS enforces nothing — no rights check anywhere in its source — so this proxy is the authorization boundary for the module, the position denyUnless occupies...
The meeting reminder reaches the bell, and pops once
MeetReminderPopup drew its own Snackbar from its own subscription to **************** Nothing else knew a reminder had happened: the bell stayed at zero, the de...
The meeting reminder is a notification, not a popup of its own
The sweep published a bespoke event on /topic/meet/reminder/{memberId} that a dedicated Snackbar drew in the corner of the screen. That popup was the entire rem...
A kind for the meeting that is about to start
MEETING_REMINDER, so MediaService can raise the start-time nudge as a notification instead of a popup only it knows about. Its own kind rather than CALENDAR_EV...
Second cluster triaged — PLOS is implement, and cheap right now
The six PLOS_* rights have a real feature: KamoLOS is a full loan service. Not deletable. But nothing enforces any of them — no rights check anywhere in KamoLOS...
One calendar reminder, announced once
A reminder was arriving twice. The deck picks it up as a notification, and the older path picked it up as well: CalendarWebSocketContext opened a second STOMP c...
Subscribe to the course count instead of asking for it every minute
NavTop sums two counts into one obligation badge, and only the legal half was live. A member assigned a course — or excused from one by HR — kept the old number...
Relay the outstanding-course count onto the member's own topic
The twin of the legal relay, because NavTop sums the two counts into one badge and a pair of halves that behaved differently would give the member chrome that w...
The outstanding-course badge moves when the course does, not a minute later
The NavTop obligation badge sums two counts — packages to sign and courses to take — and only one of them was live. The legal half has pushed since its NATS blo...
Drop the proxy route for an endpoint that never existed
/api/notes/statistics forwarded to a KBService endpoint NotesController does not implement, and nothing in the app ever called it — so the only thing it could d...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.