Live Change Log

Reworks the create form to use the entire content area instead of a 1100px-wide centered column. - 3-column responsive layout: sticky left section nav (md+), f...

Next.js 15 refuses to build when both middleware.ts and proxy.ts exist. The OTK hand-off redirect that lived in middleware.ts — sending any request with ?otk=… ...

Combine the previously separate "My E-Mail & Alias", "My Name", and "Phone Number" steps into one "My Profile" step for 13+ registrants, with alias + e-mail + l...

The /api/security/register endpoint previously rejected any request missing email, first name, or last name. That made the under-13 path (KIDS_ONLY orgs, or ALL...

Replica reads missed freshly written sessions after OTK exchange, causing false failure and login redirect. Skip intro delay when otk is present; share in-fligh...

A non-array response (empty body, error envelope, or {data: [...]} wrapper) was landing in the orgs state and blowing up the render with 'e.map is not a functio...

Reject when target is current session org, custom domain SSL is not confirmed, or human target membership is inactive. Share domain-setup logic with my-networks...

Enter-as now always builds the new *** with the client-supplied target member row; reject mismatched org/member. Improve session debug logging.

Extract the post-authentication *** build (grant-all expansion, profile SQL, branch titles, createSession) into PostAuth***Service so enter-as uses the same cod...

Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-do...

ENTER linked to /?otk= which never called /api/validate; shared-domain *** cookies kept the source org. Redirect ?otk= to /validate via middleware for any stray...

SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never s...

EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.

The /network Enter action called a non-existent Next route, yielding 404. Forward the request to APIService like other security proxies.

Configuration page called /api/security/system-user/* but no Next handlers existed, so the app returned 404. Add BFF routes matching SecurityService endpoints (...

Adds Platform Administration → Configuration, a parent-org-owner-only page that grants or revokes permission to impersonate the platform System User by departme...

Self-heal provisioning: SystemUserBackfillService runs on every SecurityService boot (from DataLoader) to add the is_system_user column and system_user_access t...

Introduces the platform-wide System User model: a User.isSystemUser flag (unique partial index enforces a singleton), plus a SystemUserAccess table that records...

TeamMember uses JOINED inheritance — it IS a Member, no nested member field. The backfill was calling tm.getMember() which doesn't exist. Also switches the JPQL...

isOrganizationOwner is a primitive boolean on TeamMember, so the Lombok- generated accessor is isOrganizationOwner() not getIsOrganizationOwner(). Fixes compile...

These were added to kamo-internal by mistake — collection of the phone number and security questions belongs in the registration flow in kamo-register, and has ...

Insert two new steps between Password and Account Recovery for 13+ registrants: a phone-number step (optional, skippable, with SMS code verification) and a secu...

Move phone-number and security-question collection into the self-service registration flow (where they were originally intended) rather than requiring a post-si...

New table `registration_phone_codes` stores one-shot SMS verification codes issued during self-service registration, before a User entity exists. Kept separate ...

- /account: replace single ambiguous button with tab-scoped buttons Add <Member> on the Members tab, Add <Team Member> on the Team Members tab. Each button ...

- New MemberCreateController exposes: * GET **************** — age-req, timezone, departments, job titles * GET **************** — debounced existence che...

Used by the Add Member / Add Team Member flow to skip email collection for orgs whose age requirement permits users under 13 (ALL_AGES, KIDS_ONLY, ALL_COPPA_GRA...

- Member page Plans & Billing tab is now right-aligned with a pulsing glow and a StarRate icon on the tab bar. Visible when the viewed member is the signed-...

- EntitlementService computes per-member feature grants by unioning active BillingGroupLicense plan features + KamoCRM Free-tier baseline. Caches 15-minute ...

Deletes the org-level **************** controllers, services, and DTOs. Introduces: - BillingGroupController mounting groups, members, subscriptions, licenses,...

Introduces BillingGroup, BillingGroupMember, BillingGroupSubscription, BillingGroupLicense, BillingGroupPaymentMethod, BillingGroupInvoice, and BillingGroupConf...

forwardToApi already appends the browser request search params; embedding ?query in the path produced a second ? and broke upstream URL parsing, causing GET /ap...

Interaction Center should list TeamMember rows, not base Member records.

NavTop greeting falls back to username when the user is not in the team-only list. Interaction Center copy uses team member wording.

Expand client redirect guard beyond **************** to include CONFIGURE_SYSTEM, EDIT_MEMBER_ACCESS_LEVEL, ALLOW_PROMOTING_MEMBERS, organization owner, and pla...

Clarify that the role field from by-department is the job title line.

Replace RBAC role title with jobTitleOfficial, fallback to JobTitle catalog title for TeamMember, and the label Member for base Member records in the by-departm...

ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...