- Shipped
- August 25, 2026 at 1:11 AM UTC
- Author
- Kamo
- Commit
- 5ab27ed
register.kamocrm.com is the signup page for every organization that has no register host of its own, so the hostname cannot say which one a visitor is signing up to. It resolved all of them to the platform organization — which painted the wrong branding, and created the account in the wrong place. ?org= names the organization by id or alias. It selects the branding and travels with the registration as the organization the account is created under. A hint, not an authorisation: the server re-resolves it and every gate on registration is unchanged. Branding comes from SecurityService's /org/public/{ref}, relayed rather than reimplemented so the rule about what a guessable reference may expose stays in one place. The theme base then follows the organization, used as given — dropping its first label the way the host path does would turn acme.kamocrm.com into kamocrm.com and paint a tenant as the platform. themePath is memoised, and the first render necessarily runs before the reference resolves, so it is recomputed once branding lands. A visit naming no organization clears any reference a previous visit recorded in this tab. Theme.tsx here is CRLF and was edited byte-wise, so the diff is the addition and nothing else.