将会话权限读取为成员端点的列表或遗留 CSV
KSession 服务和安全控制器存储权作为列表 < string > 角色权利Type名. 成员安全主计长投放到字符串和分拆上 逗号,引起ClassCastException 对会员类型和成员访问 PATCH. 添加会话HasRight () 支持列表( enum name 或 id sord) 和遗留的 CSV .
避免交易渗入 DDL 和硬化多孔种族
上一个自愈将 DDL 设置在 @ Transactional syndall () 中 。 当另一边 表ADD CONSTRAINT对一项现有限制(第一次以后的通常情况) 靴子,或者在多波德比赛中丢失的吊舱, runIdempotent吞下爪哇 例外 – 但周围的 DB 交易处于中止状态 。 随后的每次 JPA 呼叫都...
使角色权利同步服务在每只靴子上完全自愈
添加或删除角色RightType 绝不能再要求运行 Kamo Initializer Service. synd All () 现在在每个启动时运行三个阶段: 1. 疗养方面的限制——减少每个CHECK对每项权利的限制 表格,并确保存在两个需要上升的独特限制。 在CREATE 表格中将休眠物质将激发值烤入 CHECK...
提取角色权利同步服务并添加同步权利结束点
- 角色权利同步服务:为两个OrgRole集中角色权利同步逻辑 和 表格; 启动和按需 - DataLoader: 角色权利同步服务. syncall( ) 启动时的代表 - 安全控制器: POST / sync-rig...
在 AppAvailable 中使用 organizationById with Features 截取器
解决懒惰化问题 其他CRM/POS指定路径。 拦截器名为org.getFeatures() 交易结束后; 新方法急切地获取特性 在一个只读交易中的 JOIN FETCH 查询.
解析由于 Hibernate TYPE () 基础类发行而显示空的成员标签
Hibernate 的 TYPE( m) = : 类型 JPQL 过滤器在绑定时返回 0 个结果 参数是基础成员类(JOINED继承). 这影响到 成员-订阅者的终点。 已替换为 findByOrganizationId() + Java 中Team Member 过滤器的例子, 它正确地返回了基础成员 。 还返回临时...
启用 Hibernate SQL 记录以诊断成员查询返回 0
暂时允许 org.hibernate.SQL=DEBUG 查看 TYPE () 的 SQL 类型 JPQL 查询为成员-订阅者端点生成.
添加诊断日志以获取 Members AndSublicers 端点
日志 orgId, 查询结果计数, 以及每个成员为帮助的代理状态 解析为什么成员标签会显示空列表.
Allow god-mode users to provision ownerless orgs; prefer FQDNs in domain resolution
Add PATCH /org/{id}/colors endpoint to safely update only color palette fields
Add theme provisioning — NATS publisher, provision-theme endpoint, logo upload
Use memberID session key and include creatorType in creatable branch-types response
Add GET /branch-types/creatable and /{id}/usages endpoints
/creatable returns branch types filtered by the caller's creator-type (OWNERS/TEAM_MEMBERS/MEMBERS) via AppliedModelEnforcementService. /{id}/usages returns th...
Use correct session key 'memberID' instead of 'MID'
KSessionService stores member ID under key 'memberID' but both **************** and OrganizationController were reading session.get("MID") which always returned...
Exclude master model from models list; add debug log to child-org creation check
SecurityModelController now filters out the org's master model (identified by org.getMasterModelID()) from the /api/security/models response — it is managed exc...
Read session rights as List<String> names, not CSV of integer IDs
Session rights are stored as a JSON array of RoleRightType name strings. Both **************** and OrganizationController were casting them to String (causing C...
Add GET /branch-types/creatable endpoint with creator-type filtering
Returns only the branch types the calling member is permitted to create a child org under, based on their OWNERS/TEAM_MEMBERS/MEMBERS classification against the...
Gate /network child-org creation by right + member-type applicability
Wires the applied-security-model child-org creation gate end-to-end: - SecurityModelController + MasterModelController round-trip the three new apply-to flag...
Rebuild for kamo-shared-library update (appConfig upsert-only fix)
Pulls the hardened **************** that no longer deletes appConfig rows whose service types are absent from the caller's payload — prevents silent data loss w...
Applied-model is the read-time source of truth for feature availability
Closes the "stale DB leaks a disabled feature" gap by gating every surface that touches OrgFeature / ServiceType through the applied security model. - ********...
Surface root-cause on MasterModelController GET failure
When GET /api/security/master-model 500s, log the full stack trace to stderr (captured by kubectl logs) and include the root-cause message on the wire rather th...
Wire applied-model enforcement across every controller
Every non-role setting on the applied security model is now enforced at the exact controller boundary it governs, and the scalar settings round-trip cleanly thr...
Enforce system-role assignment and auto-admin for team-member owners
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requ...
Master-model + applied-model endpoints and template-aware org seeding
Adds the controllers that surface the new branch-type security flow: - /api/security/master-model (GET/PUT) manages the current org's master model; only writ...
Add org-scoping, password length validation, and code quality improvements to PasswordChangeController
Add @Transactional to DataLoader.run to fix LazyInitializationException on startup
Use JPA entity traversal for grant-all detection (covers dept/job roles)
Supplement session rights with all known rights for grant-all roles
Filter null rights in buildAppliedRightsWithSources; upgrade shared-lib to 1.5.0
Use core NATS pub/sub for email-verified SSE fan-out
Replaces in-memory ConcurrentHashMap broadcast with NATS core pub/sub so all pods receive verification events regardless of which pod handled the token. Falls b...
Add SSE endpoint for real-time email verification + improve welcome email logging
Add resetCode to password reset email, add emailVerifyByCode endpoint, send WELCOME_MEMBER after email verification
Use avatarType field + JDBC for photo URL generation to handle Hibernate proxies
**************** previously used instanceof AvatarPhoto to determine avatar type and cast to read fileExtension. When Hibernate returns a base-class proxy (e.g....
Pass human-readable expiry time to email verification template
Add humanizeMinutes() helper that formats minutes as days/hours/minutes (e.g. "1 day" for 1440 min). Pass as {{expiryText}} to match updated canonical template ...