Parse create-org with plain ObjectMapper and return Jackson message on 400
Deserialize create-org body into CreateOrganizationPayload to avoid entity JsonIdentityInfo failure
Parse create-org JSON by stripping wizard domain field before Organization mapping
Parse create-org JSON without @RequestBody to avoid 415
Spring returns Unsupported Media Type when Content-Type is missing or not accepted for @RequestBody. Read bytes and use ObjectMapper instead so APIService/Next ...
Expose ATF compliance policies on models and creatable branch types
- OrganizationController applies model enforcement before age assertions - SecurityModelController and MasterModelController pass policy fields - BranchTypeCont...
Rebuild for kamo-shared-library update (remove OrganizationType, add isTopLevel)
Read session rights as list or legacy CSV for member endpoints
KSessionService and SecurityRoleController store rights as List<String> of RoleRightType names. MemberSecurityController cast to String and split on comma, caus...
Verify-dns checks every KnownAliases label; skip deprecated app/media in optional
Align KnownAliases with DNS and auto-cert (add mail, play, apps, sign; drop app, media)
Avoid transaction-poisoning DDL and harden multi-pod races
The previous self-heal put DDL inside a @Transactional syncAll(). When an ALTER TABLE ADD CONSTRAINT fired on an existing constraint (normal case after first bo...
Make RoleRightsSyncService fully self-healing on every boot
Adding or removing a RoleRightType must never again require running KamoInitializerService. syncAll() now runs three phases on every startup: 1. Heal constrain...
Remove getType() calls from OrganizationController after OrganizationType removal
Set orgOriginal on registration and expose isOriginalOrg in my-networks
Extract RoleRightsSyncService and add sync-rights endpoint
- RoleRightsSyncService: centralizes role rights sync logic for both OrgRole and **************** tables; startup and on-demand - DataLoader: delegates to Rol...
Use getOrganizationByIdWithFeatures in AppAvailabilityInterceptor
Resolves LazyInitializationException on /api/security/leads and all other CRM/POS-gated paths. The interceptor called org.getFeatures() after the transaction cl...
Resolve Members tab showing empty due to Hibernate TYPE() base-class issue
Hibernate's TYPE(m) = :type JPQL filter returns 0 results when the bound parameter is the base Member class (JOINED inheritance). This affects the members-subsc...
Enable Hibernate SQL logging to diagnose members query returning 0
Temporarily enabled org.hibernate.SQL=DEBUG to see what SQL the TYPE() JPQL query generates for the members-subscribers endpoint.
Add diagnostic logging to getMembersAndSubscribers endpoint
Logs orgId, query result count, and per-member isActive status to help diagnose why Members tab shows empty list.
Allow god-mode users to provision ownerless orgs; prefer FQDNs in domain resolution
Add @Transactional to provision-theme for lazy domain loading; remove hardcoded domain from provision request
Add PATCH /org/{id}/colors endpoint to safely update only color palette fields
Add theme provisioning — NATS publisher, provision-theme endpoint, logo upload
Use memberID session key and include creatorType in creatable branch-types response
Add GET /branch-types/creatable and /{id}/usages endpoints
/creatable returns branch types filtered by the caller's creator-type (OWNERS/TEAM_MEMBERS/MEMBERS) via AppliedModelEnforcementService. /{id}/usages returns th...
Use correct session key 'memberID' instead of 'MID'
KSessionService stores member ID under key 'memberID' but both **************** and OrganizationController were reading session.get("MID") which always returned...
Exclude master model from models list; add debug log to child-org creation check
SecurityModelController now filters out the org's master model (identified by org.getMasterModelID()) from the /api/security/models response — it is managed exc...
Read session rights as List<String> names, not CSV of integer IDs
Session rights are stored as a JSON array of RoleRightType name strings. Both **************** and OrganizationController were casting them to String (causing C...
Add GET /branch-types/creatable endpoint with creator-type filtering
Returns only the branch types the calling member is permitted to create a child org under, based on their OWNERS/TEAM_MEMBERS/MEMBERS classification against the...
Gate /network child-org creation by right + member-type applicability
Wires the applied-security-model child-org creation gate end-to-end: - SecurityModelController + MasterModelController round-trip the three new apply-to flag...
Rebuild for kamo-shared-library update (appConfig upsert-only fix)
Pulls the hardened **************** that no longer deletes appConfig rows whose service types are absent from the caller's payload — prevents silent data loss w...
Applied-model is the read-time source of truth for feature availability
Closes the "stale DB leaks a disabled feature" gap by gating every surface that touches OrgFeature / ServiceType through the applied security model. - ********...
Surface root-cause on MasterModelController GET failure
When GET /api/security/master-model 500s, log the full stack trace to stderr (captured by kubectl logs) and include the root-cause message on the wire rather th...
Wire applied-model enforcement across every controller
Every non-role setting on the applied security model is now enforced at the exact controller boundary it governs, and the scalar settings round-trip cleanly thr...
Enforce system-role assignment and auto-admin for team-member owners
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requ...
Master-model + applied-model endpoints and template-aware org seeding
Adds the controllers that surface the new branch-type security flow: - /api/security/master-model (GET/PUT) manages the current org's master model; only writ...
Add org-scoping, password length validation, and code quality improvements to PasswordChangeController
Add @Transactional to DataLoader.run to fix LazyInitializationException on startup
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.