Free/busy that never widens visibility, and a slot finder over working hours
No transaction across the members (a Yugabyte read restart is transparent only as a transaction's first statement), one guest read for every member, zero-length...
Send and drafts return Message-ID and UIDs, thread, wrap, dry-run, supersede drafts
Working hours from the timecard schedule, the AI charter, or the org default
A schedule set today counts for all of today, a day ending at its start is a 24-hour shift, only the window's own holidays are reported, and an unreachable Secu...
Server-side threading, quotes, forwards and the outgoing pipeline
Replies thread on the server (In-Reply-To/References from the original, capped at 20 ids), default their recipients and subject, and set \Answered after the sen...
Server-built mail carries its icons as PNG parts and its data: images as cid: parts
The API reads and writes occurrences by key, with scopes, recurrence and IANA zones
Event windows bind as Instants, so a whole-second or offset instant is read (a Date read only the millisecond form, and its failure answered 404); a malformed q...
Minted Message-IDs, Sent/Draft UIDs via UIDPLUS, MIME sends to Microsoft 365
Phone mirror for cards, chat cards raised server-side, calendar lines through chat's fan-out
Body formats, email-safe sanitiser and signature stripper for server-side compose
The sanitiser also drops a style attribute that runs code, as it does a style block, and drops <title> and <template> whole: jsoup's Cleaner keeps the text of a...
Inline pre-sized PNG logos; footer badges served at the drawn height
Transactional emails only inlined a logo when the original was an SVG under 512 KB. A PNG logo org's email linked the whole upload instead — crm's 2.2 MB logo-f...
Sending mail needs a seat, for people and AI members alike
A member without a licensed seat is refused with the shared 403 SEAT_REQUIRED body before anything is sent: POST /api/email/send, the shared-mailbox send, and t...
Pin kamo-shared-library 1.6.1, the version the library stays at
39829f6 pinned 1.6.2 together with the library bump in db737a54. That bump is reverted: about thirty other services pin 1.6.1, and CI can only resolve the one v...
Read the composer's alias-domain default from org_alias_domains
**************** used one hardcoded domain (platform.mail.domain, kamouniverse.com) as a synthetic send-as default, and only for the platform org **************...
An attachment with a Content-ID is still an attachment
A PDF sent from the Gmail app had a paperclip on its list row and no download link in the reading pane. The app stamps every attachment with a Content-ID, and t...
Accept a short-lived otk on the WebSocket handshake, alongside ***
Same change as mediaservice: kamo-internal is moving the *** session id out of browser JavaScript, off sessionStorage and off every WebSocket URL (`?***=<128-he...
Move system mail and the platform org's own send domain to kamouniverse.com
platform.mail.domain now defaults to kamouniverse.com (config value, no code default change) and gates every unverified-domain org's transactional fallback From...
Depend on kamo-shared-library 1.6.1
813d175 moved the library to 1.6.1, and CI installs only the library's HEAD, so the 1.6.0 pin no longer resolves and 6084db9's image build failed. emailservice ...
Catch dead domains and dead mailboxes the checks let through
Campaign 8781b848 ended with 667 bounces and 1,258 failures. Three gaps in the existing eligibility engine let them through: - DomainMailCheck asked A and AAAA...
DKIM-sign transactional mail sent as an org's own domain
Once SecurityService confirms a domain's DKIM record is published (org_domains.dkim_verified), password resets, invitations and other transactional letters sent...
Narrow a campaign's all-leads audience and drip triggers by market, vendor, product and state
The campaign editor's "All Leads" box and the drip trigger's lead filter could only match every lead the sender can see, with no way to target a market, vendor,...
Fictional people in the correspondent-name tests
They used a real lead's name and address from the report.
Fictional people in the correspondent-name tests
They used a real lead's name and address from the report.
A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("jlrivera1984") when their mail client sent no display name, although the ...
A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("rodarisdolgovanton") when their mail client sent no display name, althoug...
StatusReasonAdviceTest's alias case also needs MANAGE_EMAIL_ACCOUNTS
Same shape as the AliasResponseMemberIsTextTest fix: this class's one shared session lacked the right, so createAlias's new gate answered 403 "MANAGE_EMAIL_ACCO...
Who caused a notification travels with it, so the bell can draw them as a member
- NotificationRequest gains actorMemberId/actorName; the old constructor stays for every producer that predates them. - raise() keeps the pair only when both ...
Scrub copies of live credentials from config and dumps
A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...
AliasResponseMemberIsTextTest's session carries the right createAlias now needs
The full suite caught what the targeted run alone would not have: this fixture's session had no rights on it, so createAlias's new MANAGE_EMAIL_ACCOUNTS gate 40...
Calendar reminder sends move off the shared scheduler thread
Spring's default single scheduler thread is shared by every @Scheduled method in this service — the 1-second campaign pulse, the drip engine's tick, and Reminde...
An IMAP/SMTP connection test must not be usable as a network probe
POST /api/email/member-imap/test and /{id}/imap/test connected to whatever host and port the caller supplied and returned the raw exception message. Any authent...
Alias, domain and personal-mailbox admin actions need a management right
create/delete on an email alias, **************** on the org's sending domains, and **************** on a personal (self-hosted) mailbox all needed only a sessi...
A member's mailboxes and aliases are only readable inside their own organization
GET **************** took no HttpServletRequest at all — no session, no org check anywhere on the path — and GET **************** checked that the CALLER had a ...
A calendar export or import must be one the caller can actually open
GET /export/calendar/{id} and POST /import/{calendarId} took the calendar's UUID alone — no HttpServletRequest, so no session, no org or member check at all. An...
SearchService marks its injection constructor, so the service starts
9809d4b gave SearchService a second constructor (a clock, for tests) and marked neither, so Spring chose neither, looked for a no-argument constructor, and the ...
Search that honours its query, and every mail action on the mailbox that is open
Two problems on /messages, fixed in the service. Search did not work. The index path threw a ClassCastException on every hit (Instant -> Timestamp, visible in ...
A member can put a checklist on their calendar, once
Checklists live in KBService and the calendar owns only WHEN, so a scheduled checklist is an ordinary member event carrying sourceType CHECKLIST, the checklist ...
Shared-mailbox **************** need a management right
**************** on /api/email/shared-mailboxes needed only a session — any authenticated member could create a shared mailbox, delete one, or grant themselves ...
An OAuth state token is a server-side record, not a blob the browser hands back
/api/email/oauth/callback and **************** are public and sessionless (the provider redirects the browser here with no Kamo session), so `state` was the onl...
A From override must be an address the caller may send as
POST /api/email/send took request.getFromAddress() straight into the header From and the SMTP envelope sender **************** -> EmailSmtpService.send, and the...
The deliverability history names the member behind each change
Settings → Email → Deliverability shows an address's opt-out history with who made each change, but HistoryView sent only the actor's name, so the page could no...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.