Enforce HR rights and make the fingerprint see the e-sign design
All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages — and aud...
Enforce document/binder collection scope in addItem
BinderService.addItem checked read access and refused VAULT/LOAN documents, but never compared the document's own collection to the binder's, so a hand-crafted ...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The HR_RESOURCE rebuild failed on hibernate-core:6.5.3.Final with 'Tag mismatch' — a transfer corrupted in flight, not a missing artifact. The shared-lib stage ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Require a session on POST ****************
The handler took an HttpServletRequest but never used it, carrying the comment "No auth required — internal admin maintenance endpoint". APIService relays /api/...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
Folder create/rename 500 on root folders (Map.of null value)
createFolder/renameFolder built the response with Map.of(..."parentId", parentId), which throws NullPointerException when parentId is null (a root folder) — the...
Bounds-check assoc-type ordinal lookups (fixes Materials list 500)
DocsService was running a shared-lib built before ImageAssocType.MATERIALS (ordinal 11) was added, so listDocuments' ImageAssocType.values()[11] threw ArrayInde...
Serve e-sign editor PDF for any converted doc, incl native PDFs
The e-sign editor (DocumentEditor → PdfCanvas / PageThumbnailSidebar) opens any converted document, not only files uploaded through the sig-template flow. It fe...
Generic byte endpoints refuse MLOS per-party docs (vault/loan)
The generic imaging byte endpoints (download / stream / bulk-download / thumbnail) and the binder aggregation authorized only on org + a numeric clearance ceili...
Don't serve soft-deleted documents on /stream and /bulk-download
getDocumentMetadata (used by the stream + bulk-download byte paths) does not filter trashed rows the way downloadDocument does, and a soft delete leaves the Min...
URI-encode WOPISrc + trust all api.* WOPI hosts (multi-tenant)
Opening a doc for a non-kamocrm tenant failed with 'unauthorized WOPI host'. Docs's alias_groups only trusted api.kamocrm.com (the Docs-deployment env hardcoded...
Node-local MinIO + failover template read + ImgDat dedup (fixes new-doc about:blank)
New-document creation hung ~5 min and the new tab stayed at about:blank. Root cause: DocsService pods scheduled on k3m1 read the blank template from MinIO at th...
Point Docs deployment at k1m1 registry
The Docs-online image host was the bogus **************** (Redis DNS, never a registry), so every DocsService deploy re-applied an unpullable image. Point it at...
Include com.kamo.z.shared.binder in @EnableJpaRepositories
DocsService boots with an explicit basePackages list, not classpath scanning, so BinderRepository wasn't being discovered — startup failed with "No qualifying b...
Gracefully cancel superseded reconversion jobs on rapid saves
When a document is saved multiple times quickly, each save registers its ImgDat UUID in a ConcurrentHashMap. The async reconversion task checks this at 6 checkp...
Correct member name access in resolveAlias endpoint
member.getNameFirst() doesn't exist — name is on User.getName(). Use getMemberDisplayName() helper which correctly navigates the member -> user -> EmbNameFull p...
Remove auth requirement from backfill-thumbnails endpoint
This is an internal admin maintenance endpoint that needs to be callable from within the cluster without user authentication.
Use RandomAccessReadBuffer instead of ByteArrayInputStream for PDFBox 3.x
**************** was removed in PDFBox 3.0 — use RandomAccessReadBuffer(byte[]) which implements RandomAccessRead.
Add esign repos to JPA repository scan so ESignTemplateRepository bean is found
DocsService was crashing on startup because ESignTemplateRepository lives in com.kamo.z.shared.esign.repos which wasn't included in the @EnableJpaRepositories s...
Use **************** for hasDesignVersion, add systemDocsOnly filter
hasDesignVersion now checks if an esign template exists with current_design_version > 0, instead of using isSigTemplate which is true for all uploads through th...
Use docs-api.* for WOPISrc URL instead of api.*
The WOPI endpoints (/wopi/files/**) live on DocsService, which is exposed at docs-api.kamocrm.com — not api.kamocrm.com (APIService). Docs makes server-side WOP...
Set aliasgroup to api.kamocrm.com and force https WOPISrc
- Docs aliasgroup1 must match the WOPI host (api.kamocrm.com) - WOPISrc URL defaulted to http:// inside K8s; force https and construct api.* hostname from for...
Set MinIO bucket to 'internal' and upload blank templates
The default bucket placeholder was never configured. Use 'internal' bucket which has the blank document templates uploaded.
Remove COPY .mvn/ from Dockerfile to fix CI build
The .mvn directory was empty and untracked, causing builds to fail. Maven is already provided by the base image.
Review fixes - dialect, error handling, CI/CD manifests
- Fix Hibernate dialect to CockroachDialect (matching K8s configmap) - Separate token validation from business logic in checkFileInfo - Add Docs and ingress man...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.