Reset Capcha *** after every failed login attempt
Users must re-verify they are human after each incorrect password. Calls widget.reset() and clears CapchaVerified/payload state on both credential failures and ...
Properly clean up Capcha event listeners on step transition
The removeEventListener calls were inside the setTimeout callback's return value, which JavaScript ignores. This caused handlers to accumulate on every user→pas...
Lock form and auto-proceed after Capcha when submitting early
If the user submits before the Capcha widget is verified, the form is now disabled and the widget is triggered programmatically. Once verification completes the...
Show verified banner and pre-fill email after email verification
Reads ?email_verified=1&email=... from URL on mount, shows a success alert, pre-fills the username field, then cleans the URL.
Add /reset-password page, update Forgot Password link
Three-stage email password reset: email form → 8-char code entry → new password. Auto-verifies token from URL. Glass-morphism card, background carousel, Capcha ...
Redirect Forgot Password to register.{domain}/recover
Uses the existing replaceDeepestAlias pattern, consistent with the register link. Password reset now lives on kamo-register.
Update redirect from /resend-verification to /verification on register site
Redirect EMAIL_NOT_VERIFIED to register/resend-verification
Removes the inline EmailVerifyCard from the login page and all related state/callbacks. On EMAIL_NOT_VERIFIED, the user is now forwarded to **************** whe...
Set Host/X-Forwarded-Host so APIService resolves correct org
APIService overwrites X-Forwarded-Host with request.getServerName(), which reads from the Host header. Without an explicit Host header the K8s internal service ...
Resend verification using email not userId, forward X-Forwarded-Host
SecurityService /register/resend-verification expects email in the body, not userId (which the login error response never includes). Also forward X-Forwarded-Ho...
Replace EMAIL_NOT_VERIFIED error with rich verification card
When login fails with EMAIL_NOT_VERIFIED the login card is now replaced by a polished "Check your inbox" screen: animated envelope SVG with opening flap and flo...
Wire real API calls into /recover page (SP3)
Replaces all fakeSubmit() stubs with recoveryApi calls. Adds SMS OTP verify phase, seed email input, new-password step, and token landing via ?token= URL param.
Make PoweredByKamo legible with WCAG-grade contrast
The previous styling (low-opacity currentColor on a near-transparent background) was effectively invisible against most client backgrounds — which also puts the...
Backlink target to www.kamocrm.com (canonical host)
The PoweredByKamo component shipped pointing at apex https://kamocrm.com/ but the canonical kamo-marketing host is https://www.kamocrm.com/. Updating all three ...
Add subtle KamoCRM backlink to auth pages
Adds a small "Powered by KamoCRM" style footer badge to the three user- facing auth surfaces (login, recover, validate). Since kamo-login is the shared white-la...
Proxy *** challenge through login server for multi-domain support
Replaces direct cross-origin fetch to capcha.{domain}/api/challenge with a same-origin proxy at /api/capcha/challenge. The previous approach required a valid TL...
Add concurrency group to prevent duplicate workflow runs
When a push triggers a workflow and workflow_dispatch is also fired (or two pushes arrive in quick succession), both runs would execute simultaneously. Adding a...
Add ?next= forward parameter support for post-login redirect
Captures ?next=/path from URL and carries it through both manual login and auto-login flows, appending it to the OTK redirect URL so kamo-internal can redirect ...
Upgrade to Next.js 16.2.3, TypeScript 6.0.2, Node 24, React 19 types
- Next.js 16.2.3 with Turbopack as default dev server - TypeScript 6.0.2 with erasableSyntaxOnly and ES2022 target - @types/react@^19 and @types/react-dom@^19 (...
Attach widget event listeners when password step renders, not on initial mount
Listen for both statechange and verified events, remove payload requirement from login gate
Use identical explicit pixel spacing on both username and password option rows
Context-aware *** error messages, tighten spacing between fields and options
Swap spacing on username/password views, label to 'I am Human', update error message
Use widget's CSSVariables type instead of React.CSSProperties for style prop
Remove duplicate Capcha-widget JSX type declarations (widget ships its own)
Vendor kamo-capcha-widget locally instead of git URL (Docker can't resolve k0m1)
Replace Capcha npm package with private-labeled kamo-capcha-widget fork
Switched from upstream Capcha npm package to our MIT-forked kamo-capcha-widget with all branding stripped at source. Removed shadow DOM hacks and CSS overrides ...
Block login until *** verified, remove all Capcha branding via shadow DOM, use onfocus auto mode
Remove Capcha branding and upgrade to PBKDF2/SHA-256 with deterministic effort
Integrate Capcha proof-of-work *** widget into login and recovery pages
Read OTK from Redis master after SecurityService login
Avoids missing *** when REDIS_REPLICA_HOST points at a lagging replica.
Force light mode and prevent dark mode from being applied by OS or dynamic themes
Forward visitor IP and User-Agent to backend for accurate account activity logging
The Next.js API routes were not forwarding X-Forwarded-For, X-Real-IP, or User-Agent headers to the Java backend, causing account activity to log the Next.js po...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.