Live Change Log

Mirrors the shared-library change — SecurityModelController, MasterModelController, and AppliedModelController no longer read/write teamMemberPayFeesSetting. Th...

@Transactional on a controller method keeps a DB connection open across the entire MinIO upload, and also risks LazyInitializationException if the inner getOrga...

OrganizationController: - Web-alias org creation now auto-marks ownershipVerified=true and isDnsVerified=true on the created OrgDomain — no TXT record needed ...

The uploadLogo endpoint was writing to a hardcoded 'sumtingwong' placeholder (unfilled setting) instead of the org's actual public theme path. Logos now go dire...

k2m1 (10.8.2.1) is permanently down. Leaving it in the failover list caused upload retries to hang until the new OkHttp timeout fires. Default is now k1m1-only;...

Wires the new Subdomain Branches feature end-to-end on the backend: - SubdomainBranchesController for org-level enable + GoDaddy creds (live-verified) - GoD...

The phone number collected during self-service registration is now a plain optional text field — no /register/phone/initiate, no SMS code, no /register/phone/ve...

- GET **************** now returns namePrefixes and nameSuffixes, sourced from NamePrefixType and NameSuffixType so the Add Member / Add Team Member forms d...

The /api/security/register endpoint previously rejected any request missing email, first name, or last name. That made the under-13 path (KIDS_ONLY orgs, or ALL...

Reject when target is current session org, custom domain SSL is not confirmed, or human target membership is inactive. Share domain-setup logic with my-networks...

Enter-as now always builds the new *** with the client-supplied target member row; reject mismatched org/member. Improve session debug logging.

Extract the post-authentication *** build (grant-all expansion, profile SQL, branch titles, createSession) into PostAuth***Service so enter-as uses the same cod...

Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-do...

SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never s...

EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.

Self-heal provisioning: SystemUserBackfillService runs on every SecurityService boot (from DataLoader) to add the is_system_user column and system_user_access t...

Move phone-number and security-question collection into the self-service registration flow (where they were originally intended) rather than requiring a post-si...

- New MemberCreateController exposes: * GET **************** — age-req, timezone, departments, job titles * GET **************** — debounced existence che...

- EntitlementService computes per-member feature grants by unioning active BillingGroupLicense plan features + KamoCRM Free-tier baseline. Caches 15-minute ...

Interaction Center should list TeamMember rows, not base Member records.

Replace RBAC role title with jobTitleOfficial, fallback to JobTitle catalog title for TeamMember, and the label Member for base Member records in the by-departm...

AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...

Use explicit source prefix for destination keys, skip S3 folder markers, and fail fast when the template prefix is empty so silent partial copies do not reach g...

Store teamMember { memberId, isOrganizationOwner } in Redis session at login so kamo-internal hasPlatformAdminAccess can satisfy the top-level org owner path. E...

Remove mail from KnownAliases so verify-dns and onboarding no longer require mail.example.com; new custom domains also skip auto-creating the mail child alias.

Use resolver resolution for BRANCH_TYPE vs MASTER instead of inferring from branchTypeID alone. Normalize FALSE/TRUE compliance literals in applied-model settin...

Emit themeRevision (epoch ms) in config.json on each write; set Cache-Control on config, globals.css, and site.webmanifest uploads so edge caches revalidate.

Reorder provisionUpdate so writeConfigFiles (colors, config, manifest) runs before background file cleanup. Reload org from DB for fresh colors. Run cleanupExt...

Reload Organization from the DB at the start of async provision so writeConfigFiles sees colors saved by PATCH /colors (controller snapshot could be stale). Nul...

Previously only *.kamocrm.com subdomains were marked isDefault, so orgs with a verified custom apex domain (e.g. kamocrm.com) always got defaultDomain=null and ...

Theme provisioning and logo/background uploads only checked Organization.owner FK; the app UI treats organization owner as TeamMember.isOrganizationOwner, which...

Deleting an avatar failed with a DB constraint when it was still the active user avatar or a member-specific override, which matched broken MinIO blobs where us...

Full provision no longer deletes the org prefix before copy. Copy from public/default overwrites matching keys only; other objects under the org folder remain. ...

Theme provisioning required isDnsVerified for every domain, so orgs using only the default kamocrm.com subdomain never started async work (400, no STOMP). Fall ...

JetStream CHAT_MESSAGES stream is configured for chat.> only, so publishes to **************** failed stream validation and the UI saw no progress. Use Connecti...