Applied-model is the read-time source of truth for feature availability
Closes the "stale DB leaks a disabled feature" gap by gating every surface that touches OrgFeature / ServiceType through the applied security model. - ********...
Wire applied-model enforcement across every controller
Every non-role setting on the applied security model is now enforced at the exact controller boundary it governs, and the scalar settings round-trip cleanly thr...
Enforce system-role assignment and auto-admin for team-member owners
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requ...
Master-model + applied-model endpoints and template-aware org seeding
Adds the controllers that surface the new branch-type security flow: - /api/security/master-model (GET/PUT) manages the current org's master model; only writ...
Supplement session rights with all known rights for grant-all roles
Add SSE endpoint for real-time email verification + improve welcome email logging
Add resetCode to password reset email, add emailVerifyByCode endpoint, send WELCOME_MEMBER after email verification
Pass human-readable expiry time to email verification template
Add humanizeMinutes() helper that formats minutes as days/hours/minutes (e.g. "1 day" for 1440 min). Pass as {{expiryText}} to match updated canonical template ...
Add code-based email verification path to /verify-email endpoint
The endpoint now handles both token (link click) and userId+code (manual 6-digit entry). Token path unchanged; code path hashes the supplied code and matches ag...
Add register-photo endpoint for unauthenticated post-registration avatar upload
POST **************** accepts userId + file/fileSm/fileMd/fileLg without a session. Guards: user must be unverified and have no avatar yet, preventing abuse aga...
Add GET /api/security/geoip/me for client IP country lookup
Reads real client IP from X-Forwarded-For / X-Real-IP headers, does a GeoLite2 lookup, and returns { country_code, country_name }. Used by kamo-register's count...
Implement SP4 email verification and registration wiring
- Delete legacy email/VerificationEmail.java (hardcoded SMTP stub) - Add **************** (mirrors recovery package pattern) - Add **************** — token gene...
Add AccountSettingsController + Service for phone + security questions (SP3)
Allows logged-in users to set/verify phone and configure 3 security questions. Routes to /api/account/* (session-authenticated via KSESSION_DATA).
Add BulkTextSmsClient + EmailTemplateServiceClient + PasswordRecoveryController (SP3)
Full password recovery flow: email-link, SMS OTP, security questions, seed phrase. Routes to /api/recover/* (unauthenticated). Uses SP1 email pipeline + VOIPSer...
Wire EmailTemplateSeedClient into ****************
Thin RestTemplate client that POSTs to EmailService's **************** after an org + owner TeamMember are persisted. Retries twice with backoff; failure throws...
Add public known-aliases endpoint for kamo-nowww build-time bake-in
Add analytics → analytics text replacement in changelog sanitization
Redact tokens ≥32 chars in changelog sanitization
Any word (run of non-whitespace) that is 32 characters or longer is replaced with **************** before titles and descriptions are sent to the translation se...
Generate TXT verification token on domain create, check in verify-dns
- createDomain: generate 32-char UUID token and store via setVerificationToken - verifyDns: check _kamo-verify TXT record for kamo-site-verification=<token> - T...
Update required aliases — add app, capcha, docs, sign; remove legacy
Add /setup/dns backend — one-domain enforcement, SSL probe, new aliases
- Enforce one custom domain per org in POST /api/security/domains - Add capcha, docs, sign to standard aliases; remove legacy aliases - Update verify-dns to tra...
Move changelog word replacement to backend before translation
Text replacements (Docs→Docs, Meet→Meet, etc.) and secret name redaction (K8s secret names→***) were previously applied client-side in ChangelogClient.tsx, mean...
添加铅摄入管理和公共接收控制器
为自动取铅系统增加两个控制器: - 领带摄入控制器:经认证的CRUD,用于取入端点、字段 绘图、有效载荷排队管理、积压处理和统计 - 领队接收控制员:接受第三方的公开终点 采用限制Redis率、有效载荷尺寸的 JSON 平整,每个端点可配置功能/功能
在登录时将成员Type存储于 Redis 会话
当 e.id 不 NULL 时添加 Case, 然后“ TEAM Member” 其他“ Member” 结束为 登录 SQL 查询并通过创建会议将结果传递到 Redis, 因此前端可以通过会话数据区分出团队成员与正会成员.
在模板上传时同步每页缩略图生成, 并有颗粒式 WS 进度
- 在 pom.xml 中添加 PDFBox 依赖性 - 在存储已转换的PDF后,通过PDFRender来渲染所有页面,并将每个页面上传为{id} thumb p{n}.png - 发布生成 thumbnails WS 进度事件,每页(72-95%范围),标签为"Generated jumbnail N of M" ...
添加 Webhook 秘密验证到更改log 端点
深入防御:验证 *** 页眉 除了APIService网关验证之外,还有安全服务侧.
Add member access level and owner status endpoints
Add GET and PATCH **************** endpoints for reading and updating access levels with full permission enforcement. Update organization creation to use create...
Add granular conversion progress stages with 8 distinct WebSocket updates
Stages: downloading (0-15%) → preparing (15-20%) → converting (20-65%) → verifying (65-75%) → storing (75-90%) → finalizing (90-100%) → complete
电子签名模板上传同步 PDF 转换
模板的上传现在通过转换服务直接转换 上传请求 。 为实时 WebSocket 发布 NATS 进度事件 前端更新。 如果转换失败, 就会轻而易举地退后.
添加电子签名模板 API 端点
- POST QQ- 有范围控制的上传模板 - POST QQ——按上下文和状态列出模板 - PATCH ——更新模板生命周期 - 获取- 流转换 PDF - 添加上传模板请求,模板列表请求,更新模板状态请求, 模板元数据 DTO
将 Google re*** 替换为 Capcha *** 校验
删除 Re***Service 和所有 Google re*** 配置 。 增加通过验证***有效载荷的Capcha验证服务 Kamo-capcha服务's /api/验证端点. 更新登录请求 豆和保安管理员使用 *** 付费字段.
通过电子邮件加强 POST / 客户接受联系信息和查询用户
现在创建账户接受电子邮件,联系人Name,电话,接受市场营销,免税. 如果提供电子邮件并匹配现有的用户,则自动设置为主账包.
增加18个商业客户管理账户细节终点
账户主计长在/api/安保/账户/下的新终点: - 客户 CRUD:获取/POP/PUT/DELETE/客户,获取/客户/{uid} - 相关数据:获取/客户/{uid}/领导、/命令、/成员 - 成员管理:PUT/客户/{uid}/成员(添加/删除/设置主机) - 注:获取/POST/客户/{uid}/注 - 账户组...
将111个零售端点添加到商务市场主计长
/{marketId}/ retail/... namespace 下的所有端点覆盖: - 类别、品牌、属性(有价值)、图像、变体、标签、审查 - 客户、地址、客户团体 - 税类、区、税率;折扣;价格清单(附入项);礼品卡 - 库存地点、库存水平(有调整) - 航运区、方法、承运人、货运 - 货物(连同物品)、命令草案...
Expand CommerceMarketController with nested market-centric endpoints
Replace flat POS endpoints with market-scoped REST hierarchy: - Products, inventory, vendor categories under /{marketId}/products, /inventory, /vendor-categorie...