Live Change Log

Three new REST controllers under /api/security/mortgage-apps: - MortgagePricingController: pricing snapshots, rate locks, AUS findings CRUD ({uid}/pricing, {...

Exposes the LOS pipeline backend under /api/security/mortgage-apps: - GET /pipeline — kanban summary - GET /{uid}/pipe...

New REST controller exposing the full URLA application lifecycle: GET /api/security/mortgage-apps list (summary) GET ***************...

The NavTop language picker did nothing for the System User signed into a sub-org: PUT **************** runs SystemUserGuard first, which 403s every System-User ...

Child orgs that picked a Kamo web alias (e.g. gnosia.demo.kamocrm.com) were getting "TXT record found but verification code doesn't match" in the DNS setup UI. ...

deleteDomain and updateDomain previously rejected platform admins operating on child-org domains because they checked isUserOwnerOfOrg against the target org di...

The endsWith(".kamocrm.com") guard blocked every demo org from swapping its platform subdomain (e.g. gmosia.demo.kamocrm.com) for a custom domain. The platform ...

Picks up: - HIGH: **************** refuses NUKE/FORCE_NUKE on admin-essential rights for the ADMINISTRATOR template. - MEDIUM: **************** now re-runs ...

This reverts commit ****************

When a user creates a child org they become its owner + admin (via **************** Their PARENT-org membership, however, is whatever it was before — typically ...

**************** / updateModel / deleteModel and **************** now invoke recalcAllMembersUsingModel after persisting changes — every org pointed at the mode...

Picks up the JPA fix that lets orgs.country (smallint) accept the int ordinal Hibernate writes for CountryType, unblocking POST /api/security/org from the /netw...

After **************** assigns the Administrator role and writes member_rights_applied, the OTK-minting block was re-reading those rows via **************** ins...

After createOrganizationOwner, mint a fresh *** bound to the new owner TeamMember and return its OTK alongside id/members. Without this the creator stays on the...

COMP orders are now provisioned automatically on SecurityService startup via SubscriptionService @PostConstruct. Manual endpoint no longer needed.

POST **************** calls **************** then invalidates entitlements for the target org via EntitlementService.

Backs the new hex-head popover size selector and any future small per- member UI preference. Endpoints under /api/security/members/me/ui- preferences resolve th...

This reverts commit ****************

Child-org admins (like GNosia's owner Daniel) have their COMP subscription orders on the root KamoCRM org, not on their own org. FeaturesManager was querying t...

Workflow-level concurrency serialized the whole pipeline (including kubectl rollouts). Move the group to the build job only so deploy jobs from different runs c...

Top-level org owners and system members were getting 403 on getDomainById and verify-dns because those endpoints checked isUserMemberOfOrg directly. Adds hasEle...

ONE_DOMAIN_PER_ORG check incorrectly excluded .kamocrm.com web-alias domains, allowing an org to accumulate multiple root domains (and 10 aliases each) by retry...

- OrganizationController: replace ensureTeamMembersForAllOrgs (full org table scan) with ensureTeamMemberForOrg (single org) — eliminates the ~400ms×N DB ro...

POST **************** triggers the same idempotent setup as the sub-org creation hook (BillingSetupService .setupForSubOrgCreation) but can be called on-demand ...

BillingSetupService now activates the first open license slot for the creator when seeding a sub-org subscription (and same for promote-to-billing-owner) — othe...

KamoCRM (top-level) org members are not subject to the billing system — they get the OWNER_UNLIMITED plan's feature matrix outright (with Free as a defensive fa...

EntitlementService walks SubscriptionMember (not AccountMember) to compute member entitlements — the union of features across active licensee subs, plus the Fre...

Account-group endpoints (customer segmentation tiers, not billing) renamed throughout to use "tier" terminology consistently with the shared-lib rename: - /api/...

AccountController now reflects the Account-as-group model: - computeDisplayName / extractEmail / extractPhone resolve through the primaryMember (Member) inste...

The /register endpoint now accepts language, timezone, and defaultCurrency alongside the existing country field. RegistrationService sets country and timezone o...

EntitlementService resolves member entitlements against AccountLicense records owned by the member's billing Account. The MemberEntitlements shape now exposes a...

- AccountController accepts nested name/email/phoneNumbers JSON on POST/PUT - Initial address on POST creates SHIPPING (and BILLING when useAsBillingToo set), s...

Paginated, filterable, searchable lead-history endpoint with batch actor loading (no N+1). Filters endpoint returns distinct used fields, all registry fields, d...

- GET **************** returns the four counters exposed on the kamo-internal Settings → Platform → Configuration → VoIP/SMS tab (vmPending, callPending, vm...