DocsService is no longer published directly at docs-api.kamocrm.com
The docs-api-ingress IngressRoute sent the internet straight to DocsService, around the api gateway (and its identity-header stripping). Nothing used the host: ...
Require MANAGE_DOCS_SETTINGS on every doc-settings mutation, not just some
The settings page always sent a member without MANAGE_DOCS_SETTINGS away, but ten mutation endpoints in ImagingSettingsController never asked themselves: canMan...
Scope thumbnail backfill to the caller's org; gate history reads by clearance
Two independent gaps in ImagingController: - /backfill-thumbnails selected candidates platform-wide (no organization predicate at all; the last-resort tier w...
Throttle the anonymous careers talent-alert form
CareersPublicController's POST /{orgRef}/alerts is the one anonymous, unauthenticated endpoint in this service that sends an email on every accepted call, with ...
Audio slides — media metadata, and learners play media through their assignment
An audio slide's navigation lives in media_meta_json (duration, waveform peaks, chapters), which the editor writes and the player reads back verbatim. It is sav...
No live credentials in application.yml defaults
The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...
Apply the per-party/issued/trashed checks everywhere byte-adjacent paths need them
**************** applied the issued-document check but not the per-party (ACCOUNT_MEMBER_VAULT/LOAN) or trashed-row checks that /download, /stream and the sibli...
A document share now actually reaches its recipient, and edit is gated
**************** matched an ImgShare by ImgShare.member — the SHARER, who created the row so they can list what THEY shared (getSharesByImage) — instead of ImgS...
Re-check clearance when rendering a binder's document items
BinderItem pins the Img row it was built from at assembly time. BinderRenderer.renderItem handed that Img straight to **************** with no check at all for ...
Bound and stream the byte-heavy imaging paths
/download loaded the whole file into a byte[] through ImageService.downloadDocument before serving it; /bulk-download built the whole ZIP (or merged PDF) as one...
Stop trusting any https://api.<anything> as a Docs WOPI host
k8s/Docs-deployment.yaml's aliasgroup1 was 'https://api\..*'. Docs's alias matcher (RegexUtil::getValue, std::regex_match) requires only that the WHOLE candidat...
Gate chat attachments, voicemails and call recordings by more than org+clearance
MediaService/telephony store chat attachments (CHAT_ATTACHMENT) and voicemail/call recordings (VM_RECORDING, CALL_RECORDING) at ACCESS_LEVEL 0. Every generic im...
Bind every WOPI endpoint to the document its token was minted for
CheckFileInfo was the only WOPI endpoint that both compared the access token's document against the request path and re-checked live access; GetFile, PutFile, P...
A document's history loads, and names the people on it and on its shares
GET /imaging/history/changes and /history/downloads built each row with Map.of, which throws on a null — and a row with no IPv6 address, no prior data or no mem...
The uploader's member id travels with the list and the history
The document list (/imaging/list) and a document's history carried the uploader's name only, so kamo-internal could show who uploaded a file but not open their ...
Liveness probe on /actuator/health/liveness, not the DB-aware aggregate
The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
A save reaches every colleague with the template open
A save of a template's file told only the member who saved it, so a colleague with the same template open kept placing fields over pages the file had moved on f...
Sharing a document works again, as someone who can read it
The share dialog sends a document id as a string — an img id is an int64 past 2^53, which a JSON number would round — and createShare cast it to Number. Every s...
Read a template's layer by design version
The version history draws a template's fields over each version's pages. It asked for them through a document version (/{imgId}/{n}/design), and a template's wo...
Files and templates, edited in place, with the versions each category keeps
A document was two records: the upload, which nothing edited, and one modified copy derived the first time anyone opened it in either editor. The Docs manager s...
Legal, training and careers emails link only to live hosts
- Legal: the org's console (OrgLinkHosts.internalOrigin) and the member page's Legal & Compliance tab. It linked the bare apex, which serves the marketing s...
Serve the document categories from the enum that defines them
The docs settings page named its own categories and sent the ordinal it believed each one had. Those ordinals were written when ImageAssocType was six constants...
A rename answered with no Url skips Docs's rename callback
Docs shares one client-side callback between RenameFile and Save As, and **************** skips its whole body — the File_Rename event the embedding page listen...
Losing the race to store identical content is not a failed save
The look-up before the ImgDat insert is not a lock, and kamowsdocs runs two replicas behind one gateway — two documents whose bytes are identical (two members c...
A Save As that changes format is not the source document's type
uploadDocument refuses an upload whose claimed MIME type disagrees with what it detects from the bytes, and saveAsNewDocument claimed the type of the row it was...
A Docs save could not store bytes the platform already held
Saving a document twice, and renaming one, both ended in "Document cannot be saved, please check your permissions" — and after five retries Docs gave up and dis...
Gate the member board on being a team member with a role open
The member Careers tab now appears on two conditions and no right among them: the viewer is a team member, and the organization has at least one posting open an...
Retire applying without an account, and notify both sides of one that lands
The public board's Apply button is now a link into registration, so this drops the endpoints behind the old form: /{orgRef}/apply/{uid} in both content types, /...
Retry the two reads a catalog bump broke document editing with
WopiController.checkFileInfo is called repeatedly through an editing session — on open, around locks, after every save — so a conflict on its organization looku...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Three self-invoked transactions that were doing nothing
@Transactional and @Async are PROXIES. A call from inside the same bean never reaches one, so all three of these annotations were inert. Found by audit, not by ...
The CV reader, employee referral links, and the form shape on the public listing
Three things the public careers site needed from this service. The form shape now rides on the public listing (the twelve ask* settings, the additional-info pr...
Apply-first, the job network, alerts, translation and retention
Eight things, all behind the anonymous careers surface, and all sharing the rules the single-org board already enforces rather than growing their own. APPLY-FI...
The profile endpoint stops loading the whole board
Its own comment said it existed so a page could paint the employer "without pulling every advert down with it", and the line under that comment called board() —...
A country is not its enum name
Every card on every careers surface has been printing "United states" — the words after the first lose their capitals when an enum name is prettified — and "Côt...
The anonymous API behind careers.<apex>
The public job board reads this. It is the only surface in Careers with no session, so the safety comes from the QUERY rather than from a rights check: PublicCa...
A REQUIRED resume is now actually enforced
A review of my own commit found the enforcement it claimed. JobApplicationService carried the comment "a REQUIRED resume is enforced at that point by requireRes...
/api/docs/careers — job postings, the member board, and applying
Two controllers behind one feature, and the split is the point. /careers/** is HR's and requires MANAGE_JOB_POSTINGS; /careers/member/** is the employee's and r...
Fill a rectangle, honour a highlight's opacity, and redact
Three things about the way a prepared document renders the designer's marks. A rectangle was drawn as an outline, so the fill a member now picks to cover somet...
Stop ignoring markdown
The "no .md in repos" rule is retired; docs, plans and READMEs are tracked like any other source file.
A document whose bytes are gone answers 410, not 500
The streaming download caught every storage failure as one unexpected error and returned 500, which tells a reader nothing and leaves a viewer with a blank erro...
Rebuild against the storage dedup fix
Picks up kamo-shared-library d21e01ce. uploadDocument created its ImgDat with isMissing=false BEFORE sending the bytes, and its @Transactional did not roll back...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...
Open the one modified record, whichever layer asked
getOrCreateClassic and getOrCreateFormFillable collapse into getOrCreateModified: "open this for editing" means the same thing whichever editor asked, and the a...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.