Add internal auth secret for public catalog API proxy
Add **************** to the SecurityService deployment so the APIService can authenticate when proxying public subscription catalog and promotions requests.
Account endpoints use direct contact fields, no User required
POST /customers now saves firstName, lastName, email, phone, address directly on Account. PUT /customers/{uid} updates all direct fields. Display name, email, p...
Add retail provider integration endpoints for connection testing, sync, capabilities, and webhooks
Enhance POST /customers to accept contact info and lookup user by email
Create account now accepts email, contactName, phone, acceptsMarketing, taxExempt. If email is provided and matches an existing user, auto-sets as masterAccount...
Add 18 account detail endpoints for commerce customer management
New endpoints on AccountController under /api/security/account/: - Customer CRUD: GET/POST/PUT/DELETE /customers, GET /customers/{uid} - Associated data: GET /c...
Update customer endpoints to use Account (Long uid), remove address endpoints
Customer/group @PathVariable changed from UUID to Long to match Account entity. Address endpoints removed — addresses come from Account's primaryMember (Member ...
Add 111 retail endpoints to CommerceMarketController
All endpoints under /{marketId}/retail/... namespace covering: - Categories, brands, attributes (with values), images, variants, tags, reviews - Customers, addr...
Pass includeInactive=true default for agreement templates endpoint
Templates management UI needs to see inactive templates too.
Add missing vendor-categories endpoints to CommerceMarketController
GET/POST/PUT/DELETE /{marketId}/vendor-categories were missing, causing 404 when the Vendors tab tried to load categories.
Expand CommerceMarketController with nested market-centric endpoints
Replace flat POS endpoints with market-scoped REST hierarchy: - Products, inventory, vendor categories under /{marketId}/products, /inventory, /vendor-categorie...
Include memberType, departmentId/Title, jobTitleId/Title in member profile GET response
Add LeadStatusLabelController for org-level CRM status label CRUD endpoints
Add department and job title assignment to member security endpoint
GET now returns departmentId/Title and jobTitleId/Title for team members. PUT accepts departmentId and jobTitleId to assign/unassign department and job title, w...
Sync social links to normalized social_links table
Write member social links to both the embedded EmbSocialLinks columns (backward compat) and the new normalized social_links table. Add socialLinksNormalized to ...
Rewrite MemberSecurityController as singleton config with roles, direct rights, session timeout
GET returns full member security config (associated roles, direct rights, session timeout override, applied rights with sources). PUT saves the entire config as...
Add MemberSecurityController for member role assignment and applied rights
Provides GET /member-security/{id} (assigned role, applied rights with sources, session timeout), PUT /member-security/{id}/role, and DELETE /member-security/{i...
Allow members to view their own account activity without VIEW_ACCESS_LOGS permission
Support internal service auth for subscription catalog and promotions endpoints
Add X-Internal-Auth + X-Public-Chat-Org-Id header validation so APIService can proxy public catalog requests to the subscription endpoints. Session auth still w...
Align POSController subscription endpoints with SubscriptionService signatures
Add subscription API endpoints to POSController (50+ endpoints)
Add complete enterprise subscription management endpoints covering plans, prices, features, add-ons, bundles, volume discounts, catalog, orders, subscriptions, ...
Query avatar_photos extension via SQL instead of Hibernate proxy
avatarRepository.findById() returns a Hibernate proxy (Avatar$HibernateProxy) that fails instanceof AvatarPhoto check. This caused the file extension to always ...
Use correct table name 'avatars' instead of 'avatar' in session SQL query
Store full avatar relative path in session instead of bare file hash
The login SQL now also fetches avatar_type and file_extension from avatar_photos so the session stores a complete relative path like **************** or *******...
Add first name, last name, and avatar hash to *** session
Include memberFirstName, memberLastName, and memberAvatarUrl in Redis session data so cross-domain services like KamoMeet can display proper user identity witho...
Auto-provision completed-stage app features in org domain endpoint
Moves auto-provisioning from the FeatureController (only hit from the apps settings page) to the SecurityController org domain endpoint (hit on every page load ...
Auto-provision missing completed-stage app features for existing orgs
When listing features, the controller now checks for missing OrgFeature rows for COMPLETED-stage apps and creates them. This ensures orgs created before new app...
Catch all exceptions in FeatureController enable/disable endpoints
Prevents uncaught RuntimeExceptions from becoming opaque 500 errors. Now returns structured error messages for any failure.
Prevent duplicate apps in features list by excluding all existing types
The available list was only excluding features with enabled=true, so a disabled feature (isActive=false) appeared in both the features array AND the available a...
Auto-refresh Redis session rights after feature/role changes
FeatureController and SecurityRoleController now rebuild the caller's session rights in Redis after enable/disable, role create/update/delete, and recalculate-r...
Add FeatureController for org app enable/disable management
REST endpoints for managing organization app features: GET features list, POST enable/disable with CONFIGURE_SYSTEM permission check, root-org-only gating for i...
Add POST **************** endpoint
Triggers org-wide member_rights_applied recalculation. Needed after schema migrations or manual DB changes to permissions.
Use targeted role-scoped rights recalculation
SecurityRoleController now uses updateRoleMemberRightsApplied() to only recalculate members who have the modified role, instead of recalculating all members in ...
Recalculate member_rights_applied after role create/update/delete
The member_rights_applied table was never recalculated when roles were modified, causing all members to have 0 applied rights. Now calls **************** after ...
Rebuild with updated shared library containing support permissions
SecurityService needs the new ACCEPT_SUPPORT_TICKETS and MANAGE_SUPPORT entries in RoleRightType enum to include them in *** session rights.
Enforce role protection flags and add parent label support to session
- Enforce isAllowEditSecurity in SecurityRoleController update endpoint - Add parentMemberTitlePlural and parentTeamMemberTitlePlural to *** session - Resolve p...
Remove notes code, moved to KBService
Notes management (controller, service, encryption) has been relocated to KBService where it better aligns with knowledge and content management responsibilities...
Transparent server-side encryption with stable master key
- Add permanent notes.master-encryption-key to ConfigMap (was generating a random key on each pod restart, making old notes undecryptable) - Always encrypt ...
Clear undecryptable note content and disable encryption flag
When server-side decryption fails (corrupted data or key mismatch), clear the content and set isEncrypted=false on the entity so the note stops showing cipherte...
Decrypt encrypted notes in getAllNotes and searchNotes responses
getAllNotes and searchNotes were returning raw encrypted content for notes with isEncrypted=true. Now decrypts content server-side before returning, matching th...
Support multi-size photo avatar uploads and crop endpoint
Update uploadPhotoAvatar to accept optional sized variants (fileSm, fileMd, fileLg) stored with suffix naming ({hash}_sm.png, etc). Add PUT /{id}/crop endpoint ...
Rebuild with updated shared library (NoteDTO string ID serialization)
Use OTKPreAuthFilter attributes instead of re-validating OTK in NotesController
The OTKPreAuthFilter already consumes and validates the OTK, storing the session data in request attributes. NotesController was trying to re-validate the alrea...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.