Live Change Log

Add description field to buildConfigJson() and pass org.getDescription() from writeConfigFiles() so the themed config.json carries the org's description for fro...

Both **************** and **************** now include the includeCompany flag so the frontend knows whether to show the company name field on lead creation.

Log orgId, member count, and per-member name resolution to diagnose why the assigned-member name is not resolving correctly.

usernameAlias is functionally a login handle (often equal to username), not a display name. Real human-readable names live on User.name (EmbNameFull). Apply to ...

The by-department endpoint filters to active TeamMembers only, but extension assignments may reference base Members or inactive members. Use /names for ID→name ...

Returns salesType, subType, and customForms for a market by marketId so the Add Lead form can render sub-type fields and intake custom forms without first creat...

Priority: member.usernameAlias → user.name.formatFull() → user.alias → user.username

Log org/index, file info, userId, auth decisions, and MinIO staging key to trace why background uploads are not appearing in staging bucket.

kamo-shared-library b57d156 fixes @JsonIdentityInfo(property = "uniqueId") → "id" on Member, resolving 400 errors on PUT /api/security/org/{id}.

The explicit CorsFilter bean caused a second CORS filter alongside Spring Security's built-in CORS support (which uses CorsConfigurationSource). Both filters re...

- Add system user bypass as first guard in canManageOrgBranding so platform system user has full branding control over all non-parent orgs - Fix uploadLogo en...

Platform-wide configuration surface, gated by the existing top-level-owner guard (matches SystemUserConfigController's requireTopLevelOwner pattern). Endpoints...

GoDaddy now returns HTTP 400 with code=UNABLE_TO_AUTHENTICATE and body "Bad Request : Bad Request" when an account does not meet their current production Domain...

Top-level org owners can now fetch all organizations in the system with membership info relative to the caller. Orgs where the caller has a member record get is...

Mirrors the shared-library change — SecurityModelController, MasterModelController, and AppliedModelController no longer read/write teamMemberPayFeesSetting. Th...

@Transactional on a controller method keeps a DB connection open across the entire MinIO upload, and also risks LazyInitializationException if the inner getOrga...

OrganizationController: - Web-alias org creation now auto-marks ownershipVerified=true and isDnsVerified=true on the created OrgDomain — no TXT record needed ...

The uploadLogo endpoint was writing to a hardcoded 'sumtingwong' placeholder (unfilled setting) instead of the org's actual public theme path. Logos now go dire...

k2m1 (10.8.2.1) is permanently down. Leaving it in the failover list caused upload retries to hang until the new OkHttp timeout fires. Default is now k1m1-only;...

Wires the new Subdomain Branches feature end-to-end on the backend: - SubdomainBranchesController for org-level enable + GoDaddy creds (live-verified) - GoD...

The phone number collected during self-service registration is now a plain optional text field — no /register/phone/initiate, no SMS code, no /register/phone/ve...

- GET **************** now returns namePrefixes and nameSuffixes, sourced from NamePrefixType and NameSuffixType so the Add Member / Add Team Member forms d...

The /api/security/register endpoint previously rejected any request missing email, first name, or last name. That made the under-13 path (KIDS_ONLY orgs, or ALL...

Reject when target is current session org, custom domain SSL is not confirmed, or human target membership is inactive. Share domain-setup logic with my-networks...

Enter-as now always builds the new *** with the client-supplied target member row; reject mismatched org/member. Improve session debug logging.

Extract the post-authentication *** build (grant-all expansion, profile SQL, branch titles, createSession) into PostAuth***Service so enter-as uses the same cod...

Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-do...

SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never s...

EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.

Self-heal provisioning: SystemUserBackfillService runs on every SecurityService boot (from DataLoader) to add the is_system_user column and system_user_access t...

Move phone-number and security-question collection into the self-service registration flow (where they were originally intended) rather than requiring a post-si...

- New MemberCreateController exposes: * GET **************** — age-req, timezone, departments, job titles * GET **************** — debounced existence che...

- EntitlementService computes per-member feature grants by unioning active BillingGroupLicense plan features + KamoCRM Free-tier baseline. Caches 15-minute ...

Interaction Center should list TeamMember rows, not base Member records.

Replace RBAC role title with jobTitleOfficial, fallback to JobTitle catalog title for TeamMember, and the label Member for base Member records in the by-departm...

AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...

Use explicit source prefix for destination keys, skip S3 folder markers, and fail fast when the template prefix is empty so silent partial copies do not reach g...

Store teamMember { memberId, isOrganizationOwner } in Redis session at login so kamo-internal hasPlatformAdminAccess can satisfy the top-level org owner path. E...

Remove mail from KnownAliases so verify-dns and onboarding no longer require mail.example.com; new custom domains also skip auto-creating the mail child alias.