Image attachments are drawn from a 480px preview, not the original
A chat bubble draws an image at most 240x240 CSS px and every viewer downloaded the original to do it — 3-8 MB per phone photo. GET **************** now answers...
Meetings, group chats, attachments and calls need the seat that includes them
Stream the recording, and run the summary after commit — it ran inside the upload
Jibri's upload read the whole recording into heap (file.getBytes()) on the pod that also serves chat; a two-hour meeting is over a gigabyte. It is now streamed ...
Accept a short-lived otk on the WebSocket handshake, alongside ***
kamo-internal is moving the *** session id out of browser JavaScript: it currently sits in sessionStorage and rides every WebSocket URL as `?***=<128-hex id>`, ...
Pin kamo-shared-library 1.6.1, the only version that exists
The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...
Break a circular bean dependency the STOMP live-session guard introduced
d47b471's SessionAccessGuard field on WebSocketConfig crash-looped every pod: Spring must fully construct WebSocketConfig (a **************** every @Autowired f...
Guard STOMP SUBSCRIBE to a session's live messages and WebRTC signaling
/topic/chat/session/{guid} and /topic/webrtc/session/{guid} were not guarded at all: any authenticated socket could SUBSCRIBE to another session's live chat mes...
Chat attachment uploads authenticate before the body is spooled
POST /sessions/{guid}/attachments bound its parts as a @RequestParam MultipartFile[] method parameter. Spring resolves method parameters before a controller met...
Strip client-supplied identity headers at the media.* edge
media-route (HostRegexp ^media[.].+$) carried only media-websocket-upgrade, so a caller hitting media.<domain> directly could set X-Org-Id, X-Member-Id, X-Publi...
Presence bulk reads and the stale-presence sweep stop using Redis KEYS
getBulkPresence/getBulkLastSeen ran KEYS PRESENCE:*/PRESENCE_LAST_SEEN:* on every call - hit on every presence-socket mount and tab focus - and the 30s sweep ra...
Stop logging STOMP frame headers/payloads and /ws request headers
Two leftover debug-logging spots on the WebSocket path: - WebSocketConfig's inbound channel interceptor logged every STOMP frame at INFO, including accessor....
Imaging proxy forces a download for anything that isn't a safe raster or a stream
GET/HEAD **************** always answered with the client-declared Content-Type from upload, no Content-Disposition, no X-Content-Type-Options and no CSP. ChatA...
The meet-provider OAuth result page can no longer break out of its own script tag
MeetProviderController's GET /oauth/callback is sessionless and reflects the provider's error_description into an inline <script> block. The old jsString() only...
The Hold'em invite and the meeting reminder say who they are from
MemberNotificationClient.raise gains an overload carrying actorMemberId/actorName (the id sent as text; the old signature is unchanged and sends neither). Holde...
A reply quoting a contact names the contact, not the connection owner
A social contact has no member row, so everything they send is stored under the connection owner's member. The history read already names such a row as the cont...
The SOCIAL read gate refused every social session, not just cross-org ones
Regression in f7b2bd5, live on kamowsmedia. canReadSession (MediaController, copied into SessionFacesController and ChatSessionMembersController) admitted a mem...
WebRTC signaling, webinar management and Canva schedules stop trusting the caller's say-so
Three more of the same shape. - WebRTCSignalingController relayed **************** straight to **************** using only the payload's own sessionGuid, w...
Session reads, ticket mutations and public keys stop trusting the caller's say-so
Four related holes, all the same shape: a request carried an authenticated member, and that was treated as enough. - **************** SessionFacesController.fa...
Quotes, hand histories, ticket events and bug threads send the id a member card needs
Four surfaces showed a member by name with no id beside it, so the console's member card had nothing to open. Each now sends the id as TEXT next to the name it ...
The Presenters table can see which presenters nobody can book
GET **************** — MANAGE_SUPPORT, the caller's own organization's type only (anything else is "not found") — answers each active presenter with hasBookable...
Tell a presenter, live, when nobody can book a time with them
A presenter whose declared hours have run out is the one state in this feature nothing reported: the booking page simply offers no times, the visitor leaves, an...
The public demo page shows no one's contact details, and a site's key books only its own org
Demo requests from the marketing site come from visitors with no account. That path already needed none: the attendee row is the name and email the form collect...
The scheduler lists the org's webinar types, and a booking badges its presenter
/support/schedule-webinar said "No webinar types are currently available." for every organization, however many types it had. The wizard loads its picker from G...
No secret has a literal fallback in code or config; the Janus API secret never goes to a browser
The Janus API, token and admin secrets and the TURN password were committed four times over: as @Value defaults in WebRTCController and JanusService, as default...
A Canva connect only returns the browser to the org's own console
POST /api/media/canva/connect-start stored whatever returnUrl the body named, and the OAuth callback on the API host redirects to it after Canva's consent scree...
Only an authorized member can connect a Facebook or Instagram page, and only back to their own console
The Meta connect flow trusted its URL. GET **************** took connectionId and returnUrl from the query string with no session, and state was unsigned base64...
Refuse webhook posts for Discord connections, which only ever receive DMs over the Gateway
Discord DMs reach MediaService only through DiscordGatewayManager's WebSocket, which publishes straight to social.inbound.raw. But every social connection has a...
Rebuild so queue consumers self-heal their stale durables
social-inbound-consumer and marketing-conversion-consumer predate their deliver groups and live on SOCIAL_MESSAGES / MARKETING_EVENTS, which the shared NATS rec...
Liveness probe on /actuator/health/liveness, not the DB-aware aggregate
The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Blind-copy the Additionally Notified team members on presenter emails
GET/PUT /api/webinar/notify-members (MANAGE_SUPPORT) read and replace an organization's Additionally Notified list; every id must be a team member of that organ...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Deliver booking, cancellation and reminder emails
Every webinar letter posted to EmailService's /api/email/send, a member-session mailbox endpoint, so each one failed silently; the public booking path sent noth...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Relay org change events to /topic/rt/org/{orgId}/{domain}
Writers publish rt.org.{orgId}.{domain} on core NATS after a successful change; every pod relays it to the org's topic so open screens refetch instead of loadin...
The desk is never a client of itself
Sage and Erik both hold EXEC2EXEC_ACCESS, and each owns organizations of their own. Signed into one, the owner arm of Exec2ExecEligibility gave each a "client" ...
The roster no longer names a voided organization
An organization voided from Platform -> Configuration -> Organizations (orgs.is_active = FALSE) does not exist anywhere but the console's Void tab. findOwnedOrg...
The faces answer says how many people are in the conversation
GET **************** now carries `participants`: the console puts a face beside each message only when three or more people are in a conversation, since between...
A face for every message in every chat window
GET **************** answers, for one conversation, the photo to draw beside each message: everybody on it now AND everybody who ever wrote in it (a roster forg...
A meeting link in the conversation, always on the platform's Kamo Meet
POST **************** lets either side of an Exec2Exec conversation add a meeting link, behind the same gate as sending a message. The meeting is created as the...
Faces on the desk — a client's photo, last sign-in and presence
The desk's roster now carries, for every client, their own photo (users.avatar_id, built on the operator's live theme host — the only one their console loads im...
A conversation reaches the phone
A message on an Exec2Exec line now goes to the recipients' phones as well as their consoles: the customer's phone when KamoCRM replies, every desk member's phon...
Chat and bug emails link to the console the recipient can reach
ChatEmailNoticeService named the recipient org's first domain whatever its state. The reported case: Exec2Exec letters to makeitpopsigns.com, sent before its DN...
The desk's count of client messages not yet viewed
GET **************** returns how many messages from clients this EXEC2EXEC_ACCESS holder has not viewed, across every conversation, and each roster row carries ...
Seat the whole desk on every chat, show who is on it, close the chat feeds
- Standing membership: every explicit EXEC2EXEC_ACCESS holder sits on every Exec2Exec conversation. Exec2ExecDeskReconciler seats and unseats from the grant...
Parse the desk's audience query at test time
findHolderMemberIdsOf lives in the shared library, so nothing in this package parsed it — and a mistyped path there crash-loops MediaService at boot, every endp...
A customer's message reaches the desk, not only the thread
An executive wrote into their Exec2Exec chat and nobody at KamoCRM heard. announce() told the session's own members, and an operator is only a member of a conve...
Serve the executive channel
A conversation with its own audience rule and no ticket machinery, following SystemBug's shape: its own package, its own controller, its own visibility, and Med...
An announce that throws must not roll back the buy-in
`announceToConversation` runs INSIDE the transaction that seats the host and charges them — unlike `announceTable`, which the controller calls after the fact. T...
Colleagues in the invite list, and an invitation from a chat that arrives
Two reported defects, both in who a table can reach. **The invite dialog offered accounts.** `invitableFor` read `members.findByOrganizationId`, and an organiz...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.