A REQUIRED resume is now actually enforced
A review of my own commit found the enforcement it claimed. JobApplicationService carried the comment "a REQUIRED resume is enforced at that point by requireRes...
A document whose bytes are gone answers 410, not 500
The streaming download caught every storage failure as one unexpected error and returned 500, which tells a reader nothing and leaves a viewer with a blank erro...
Let an unscoped binder hold its own grid's documents
sameCollection demanded an exact assoc_object_id match in both directions, which made every binder in My Docs refuse every document My Docs was showing it. The ...
The document verbs are enforced, as the org's security model resolves them
ImagingController checked ImageAccessLevelType and nothing else, and DocumentController checked only that a session existed. Access level is a real control but ...
Enforce the doc-share alias rights server-side
GET /shares/resolve-alias turns a guessable alias into a real person's NAME and required only a valid session. The rule lived solely in ShareDocumentDialog, and...
Writing the org legal settings needs BOTH HR rights
The Legal & Compliance settings tab is the only writer and is now offered only to a member holding MANAGE_HRS_SETTINGS *and* MANAGE_LEGAL_AND_COMPLIANCE, so the...
Connect DocsService to NATS so the badge lights without a refresh
LegalPendingCountPublisher takes its NATS Connection as required=false and returns quietly when it is null. The shared NatsConfig is **************** and this C...
One snapshot per block, and figures that say what they measure
Both summarize methods are @Transactional(readOnly = true). Each issues six or seven reads whose figures are cross-checked ACROSS query boundaries: countOverdue...
Fill the per-member overdue rollup instead of sending zero
Both summary services built members[] with .overdue(0). The Overview's matrix branches on that field, so legal and training could only ever render amber or gree...
Bound the Resources block to count/sum/recent queries
**************** was loading the org's entire non-hidden HR_RESOURCE Img collection into memory to filter trashed, sum bytes and take 5 recent rows in Java — un...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop renewing the shared *** TTL for idle users
Caught with redis MONITOR: this pod was issuing GET + PEXPIRE against a *** key whose owner had been idle for over an hour, seconds after SecurityService had co...
Accept repeated status params so the gateway cannot corrupt the filter
Opening **************** answered "Unknown status: **************** for every member. The member grid sent the bucket as one CSV value. A comma in a query valu...
Never chase a member who already signed, and keep the subject plain
Two behavioural defects in the phase-8 notification path. 1. The reminder sweep ran over OPEN_STATES, which includes AWAITING_OTHERS — "this member finished...
Let a failed pending-count read out instead of downgrading it
publishFor caught Exception around countByTeamMemberIdAndStatusIn and turned it into a WARN. That catch was not only around the badge: the query runs inside the...
Guard the destructive imaging paths and make the repair reachable
DELETE /imaging/delete/{imgId} is the one destructive imaging path and was not wired to the issued-document guard. ImageService.deleteDocument authorizes on org...
Stop colleagues reading a member's HR-issued documents
isPerPartyRestrictedAssoc covers only ACCOUNT_MEMBER_VAULT and LOAN, so assoc 1 — SERVICE_APPLICATION, what /settings/member/{id}?tab=docs renders — has no per-...
Resolve the document bucket from ImageAssocType.BUCKET
DocumentService hardcoded "imaging-mydocs" while every other read path went through ImageAssocType.getBucket(). Now that storage is one bucket, point it at the ...
Wire DocsService to ESigService so Deliver stops 503ing
LegalEsignClient.isConfigured() was false in the cluster: neither internal.auth.secret nor legal.esig.service-url was supplied, so Deliver refused every package...
Prove WHOSE signature Finish counts, and report the live one
verify() compared the caller to assignment.teamMemberId but never to the ENVELOPE RECIPIENT's member — it trusted the recipientUid the delivery fan-out wrote. A...
Commit before the fan-out, and stop redeliver reissuing nothing
Redeliver published the new version row, flipped every OPEN assignment to SUPERSEDED, and submitted the reissue from inside that same uncommitted transaction. T...
Widen the read gate to match hrTabs.ts, make a cleared due date actually clear
LegalPackageAccess.requireRead demanded VIEW_EMPLOYEES alone while hrTabs.ts admits the Legal & Compliance tab on VIEW_EMPLOYEES || EDIT_EMPLOYEES || MANAGE_HRS...
Enforce HR rights and make the fingerprint see the e-sign design
All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages — and aud...
Enforce document/binder collection scope in addItem
BinderService.addItem checked read access and refused VAULT/LOAN documents, but never compared the document's own collection to the binder's, so a hand-crafted ...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The HR_RESOURCE rebuild failed on hibernate-core:6.5.3.Final with 'Tag mismatch' — a transfer corrupted in flight, not a missing artifact. The shared-lib stage ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Require a session on POST ****************
The handler took an HttpServletRequest but never used it, carrying the comment "No auth required — internal admin maintenance endpoint". APIService relays /api/...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
Folder create/rename 500 on root folders (Map.of null value)
createFolder/renameFolder built the response with Map.of(..."parentId", parentId), which throws NullPointerException when parentId is null (a root folder) — the...
Bounds-check assoc-type ordinal lookups (fixes Materials list 500)
DocsService was running a shared-lib built before ImageAssocType.MATERIALS (ordinal 11) was added, so listDocuments' ImageAssocType.values()[11] threw ArrayInde...
Serve e-sign editor PDF for any converted doc, incl native PDFs
The e-sign editor (DocumentEditor → PdfCanvas / PageThumbnailSidebar) opens any converted document, not only files uploaded through the sig-template flow. It fe...
Generic byte endpoints refuse MLOS per-party docs (vault/loan)
The generic imaging byte endpoints (download / stream / bulk-download / thumbnail) and the binder aggregation authorized only on org + a numeric clearance ceili...
Don't serve soft-deleted documents on /stream and /bulk-download
getDocumentMetadata (used by the stream + bulk-download byte paths) does not filter trashed rows the way downloadDocument does, and a soft delete leaves the Min...
URI-encode WOPISrc + trust all api.* WOPI hosts (multi-tenant)
Opening a doc for a non-kamocrm tenant failed with 'unauthorized WOPI host'. Docs's alias_groups only trusted api.kamocrm.com (the Docs-deployment env hardcoded...
Node-local MinIO + failover template read + ImgDat dedup (fixes new-doc about:blank)
New-document creation hung ~5 min and the new tab stayed at about:blank. Root cause: DocsService pods scheduled on k3m1 read the blank template from MinIO at th...
Point Docs deployment at k1m1 registry
The Docs-online image host was the bogus **************** (Redis DNS, never a registry), so every DocsService deploy re-applied an unpullable image. Point it at...
Include com.kamo.z.shared.binder in @EnableJpaRepositories
DocsService boots with an explicit basePackages list, not classpath scanning, so BinderRepository wasn't being discovered — startup failed with "No qualifying b...
Gracefully cancel superseded reconversion jobs on rapid saves
When a document is saved multiple times quickly, each save registers its ImgDat UUID in a ConcurrentHashMap. The async reconversion task checks this at 6 checkp...
Correct member name access in resolveAlias endpoint
member.getNameFirst() doesn't exist — name is on User.getName(). Use getMemberDisplayName() helper which correctly navigates the member -> user -> EmbNameFull p...
Remove auth requirement from backfill-thumbnails endpoint
This is an internal admin maintenance endpoint that needs to be callable from within the cluster without user authentication.
Use RandomAccessReadBuffer instead of ByteArrayInputStream for PDFBox 3.x
**************** was removed in PDFBox 3.0 — use RandomAccessReadBuffer(byte[]) which implements RandomAccessRead.
Add esign repos to JPA repository scan so ESignTemplateRepository bean is found
DocsService was crashing on startup because ESignTemplateRepository lives in com.kamo.z.shared.esign.repos which wasn't included in the @EnableJpaRepositories s...
Use **************** for hasDesignVersion, add systemDocsOnly filter
hasDesignVersion now checks if an esign template exists with current_design_version > 0, instead of using isSigTemplate which is true for all uploads through th...
Use docs-api.* for WOPISrc URL instead of api.*
The WOPI endpoints (/wopi/files/**) live on DocsService, which is exposed at docs-api.kamocrm.com — not api.kamocrm.com (APIService). Docs makes server-side WOP...
Set aliasgroup to api.kamocrm.com and force https WOPISrc
- Docs aliasgroup1 must match the WOPI host (api.kamocrm.com) - WOPISrc URL defaulted to http:// inside K8s; force https and construct api.* hostname from for...
Set MinIO bucket to 'internal' and upload blank templates
The default bucket placeholder was never configured. Use 'internal' bucket which has the blank document templates uploaded.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.