Live Change Log

MANAGE_TIMECARDS to read or change who is on timecards — enrollment decides who gets paid from this system, so it is held to the HR administrator right rather t...

MANAGE_TIMECARDS to read the queue and to waive, because the queue names every member with a problem and waiving changes what the finalize gate reads. The per-m...

The bulk approval role is DERIVED here from the caller's rights and appended to the path — never read from the body. A body-supplied role is a body-supplied pro...

The org-wide reports need MANAGE_TIMECARDS. The evidence pack does not, when a member pulls their own — and that is the point. The pack is what an employee need...

MANAGE_TIMECARDS to read the org's rules — the workweek and rounding settings describe how everyone in the org is paid — and FINALIZE_PAY_PERIODS to change them...

An EMPLOYEE may correct their own record — that is the point of the editor, and refusing it leaves the employee with no way to say the clock was wrong about a d...

A team member whose employment is not ACTIVE was refused at the door with "Your account exists but is not active at this time." That was the wrong shape. A term...

THE ROLE IS DECIDED HERE, from the caller's rights and their relationship to the subject -- never from the request body. A body that could name its own role wou...

The authorization boundary. TimecardService holds the data and the engine but no session; this holds the session and decides who may do what, then relays. The e...

timezoneService.ts has called this endpoint since it was written and it existed in no Java service; the client swallowed the 404 and resolved to UTC. Meanwhile ...

**************** is gone from the shared library. Its Optional return depended on a unique constraint that no longer exists, so once one account holds both a pe...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

Promoting a member to pay for themselves was unconditional, one-way and unsafe to repeat. It now refuses when the organization's policy says the organization p...

The app catalog page already answers the org-independent question — does any plan mention this app — and raises a warning when none does. This answers the tenan...

Picking a person is easier when the row says whether they are there and how to reach them, so each one now carries what they last declared, whether anything of ...

Feature grants describe a plan. They never described this member, because the console gates navigation on org-level org.features — so a member with no license a...

The expiration on the Redis record IS the session: when it lapses the member is signed out. Reading a session no longer touches it. Only genuine interaction ext...

buildAccountSummary never emitted dateCreated, so the field the list's Date Created column reads was simply absent from the response. Now that Account records t...

Logout writes AWAY and login clears it, so AWAY is a state the system puts you in and takes you out of. Nothing ever cleared BUSY. A member who set it once stay...

Hikari had no explicit maximum-pool-size, so it ran on the default of 10 while fronting org/rights lookups for every service and the internal site. Observed tot...

Picks up the fix for 'Bad value for type long' on the lead communications timeline: Hibernate's PostgreSQL dialect read @Lob String columns as OIDs.

CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...

Object keys are content-addressed as **************** so the segment before the first underscore identifies the file a derivative came from. Sizes are summed pe...

These are the only two things an organization stores that carry no size anywhere in the database — branding assets go straight into the public bucket under the ...

The previous commit rewrote the file through a tool that normalised CRLF to LF, churning every line and burying a 24-line change in a 618-line diff. Content is ...

SecurityModelMarketController read and mutated security-model market attachments with no session check, no org scoping and no right — any caller could pass any ...

Branch Types -> Allowed Apps started loading its app list from /platform-config/app-catalog, which requires a top-level org owner. The host page is gated on CON...

resolveAll() omits the deprecated aliases that share an id with a live app (DOC_MANAGER/DOCS, AI_CHAT/AI_SUPPORT), because those have no catalog row of their ow...

Companion to the shared-library change. These 13 controllers all guard mortgage endpoints — HMDA LAR, pipeline, application intake, disclosures, credit orders, ...

Both were missed when FeatureController moved onto the app catalog, and both would have disagreed with it the moment an operator published an app. Organization...

Also drops the now-unused DevelopmentStageType import and corrects the auto-provision comment, which still described the stage rule the catalog replaced.

FeatureController derived "is this app offered" from the enum's stage in four separate places, so the answer could only be changed by redeploying the platform. ...

The stage filter only ran for the public marketing proxy. This endpoint also feeds the in-app SubscriptionOrderWizard, which is where a customer actually pays, ...

Turns kamo.entitlement.fail-open off now that AppEntitlementCatalogMigration has run against prod and every active plan on both entitlement roots (KamoCRM, Sign...

A MORTGAGE market appeared on /commerce whenever POS was on, regardless of the MLOS app, and /features/enable had no billing check at all — the padlock in the s...

getSession() refreshed the Redis TTL on every read, and OTKPreAuthFilter resolves the session before any controller runs — so every API call renewed the session...

deriveSigners numbered borrowers 1, 2, 3… as a display index. ESigService now ENFORCES routing order instead of merely reporting it, so leaving the counter in p...

GET **************** answers one page of the session org's directory. Search, ordering and paging happen in the database; a hostile ?size= is capped. Words are ...

DepartmentService now takes its request DTO instead of eight positional arguments, so the parent joins the payload rather than becoming a ninth in a row of same...

createOrganization could destroy a customer's signup and report nothing useful. Transaction integrity: - Five Docstors ran behind try/catch that only looked sa...

createCustomer saved the Account before writing its addresses, and was not transactional — so when the address insert failed, the half-built Account stayed comm...

/me/opportunities called reservationRepository.findAll() and filtered org and member in Java. That pulls every reservation on the platform — every tenant's — in...

Resolves the session, authorizes, and relays to CommissionService with the org and member stamped from that session — never from anything the caller sent. This ...

The profile's Personal Email Notifications card has to name the address missed-message notices actually reach, and that address is the user account's — not the ...

The three commission rights gate a feature that did not previously exist, so NEW_RIGHT_SEEDS deliberately says nothing about them - that mechanism carries an ex...

The Interaction Center needs a member's address to pre-fill a composer, and the only endpoint that carried one was the single-member detail fetch — one request ...

The address a member gives out is usually the org mailbox flagged Primary on their member settings, not whatever is on their user account — so typing it into th...

assignLoanOfficer gained a step that looks up the loan's source lead to reroute the borrower's open public-chat session. That lookup runs a JPQL query through t...