Restore media as a required DNS alias so its card can verify
media.<domain> backs MediaService realtime websockets and is live in Traefik, auto-cert and the /setup/dns studio catalog, but it was dropped from KnownAliases ...
Stop reporting a missing column as a missing table
Four controllers each rewrote ANY message containing "does not exist" into "Database table X does not exist. Please run KamoInitializerApp to create the schema....
Close two unauthenticated endpoints reachable from the internet
SecurityService is anyRequest().permitAll() with @EnableMethodSecurity absent, so every @PreAuthorize is inert and public is the default; APIService relays /api...
Delete the dead Long-as-string config and pin why it must stay dead
JacksonConfig registered a **************** serializing Long as String -- the standard guard for CockroachDB ids, which run past JavaScript's MAX_SAFE_INTEGER. ...
Stop rejecting request fields the DTO does not have
Declaring an ObjectMapper bean takes binding away from Spring Boot's auto-configured one, and a hand-built mapper carries Jackson's defaults rather than Boot's....
Stop failing a branding save over compliance flags it never sent
PUT /org/{id} derived the age ranges and the three ATF flags from the stored row whenever a request omitted them, then asserted all five against the applied sec...
Creating and deleting a lead take the rights that name them
LeadController is one of the better-gated controllers in the platform — VIEW_LEADS, EDIT_LEADS, ASSIGN_LEADS, REASSIGN_LEADS_MANUALLY, VIEW_UNASSIGNED_LEADS and...
Renaming a member is an admin act, and now has a gate
The member profile's legal-name card was self-only, so an admin who typed a name wrong on the create form could never correct it — MemberCreateForm asks for pre...
Close the add-path route around the platform-admin lockout guard
POST replaces an existing administrator's rights, so it can take them away as well as give them — but only the PUT and DELETE paths checked whether the edit wou...
Enforce the doc-share search rights server-side
/members-subscribers and /team-members-contractors enumerate the organisation's people — names and ids — to fill the document-share autocomplete, and required o...
Stop copying lead details onto the calendar event
The event carried the lead's name, number, email and best time to call, copied into its description when the call was booked. A copy of a record that is still b...
Stop writing the lead path into the callback's description
It read "Open the lead: /leads/view/123" and was not a link. It could not be: a description is edited in a textarea, where text is text — and outside the applic...
An unreadable close-readiness body is unknown, and the approval count moves into its window
The wrong-path bug is fixed and the response shape is verified, but the CLASS of failure it belonged to was still open: if TimecardService renames `blocking`, d...
A failed close-readiness relay leaves awaitingApproval unknown, not a confident zero
With FINALIZE_PAY_PERIODS held, a 5xx/404/unparseable close-readiness response left awaitingApproval sitting at its initial 0 — the WARN log fired but the HR Ov...
Gate the approval half of hr-summary on FINALIZE_PAY_PERIODS
Pointing the composer at close-readiness widened privilege. That relay's own mapping guards with FINALIZE_PAY_PERIODS, and resolveRole does not admit MANAGE_TIM...
The attendance summary called a path that does not exist
summarize() asked TimecardService for **************** That is the name of the SecurityService MAPPING, not of any downstream route. TimecardService has no such...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Return the account's creation date to the account list
buildAccountSummary never emitted dateCreated, so the field the list's Date Created column reads was simply absent from the response. Now that Account records t...
Stop BUSY surviving every future login
Logout writes AWAY and login clears it, so AWAY is a state the system puts you in and takes you out of. Nothing ever cleared BUSY. A member who set it once stay...
SecurityService pool exhaustion caused liveness kills
Hikari had no explicit maximum-pool-size, so it ran on the default of 10 while fronting org/rights lookups for every service and the internal site. Observed tot...
Close four ways round the vertical and app gates
SecurityModelMarketController read and mutated security-model market attachments with no session check, no org scoping and no right — any caller could pass any ...
Stop iterating ServiceType.values() against the resolved catalog
resolveAll() omits the deprecated aliases that share an id with a live app (DOC_MANAGER/DOCS, AI_CHAT/AI_SUPPORT), because those have no catalog row of their ow...
Point the mortgage surface back at the mortgage rights
Companion to the shared-library change. These 13 controllers all guard mortgage endpoints — HMDA LAR, pipeline, application intake, disclosures, credit orders, ...
Two more places that answered "is this app offered" from the enum
Both were missed when FeatureController moved onto the app catalog, and both would have disagreed with it the moment an operator published an app. Organization...
Never offer an unreleased app on a buying surface, bundles included
The stage filter only ran for the public marketing proxy. This endpoint also feeds the in-app SubscriptionOrderWizard, which is where a customer actually pays, ...
Only slide the *** TTL when a human is actually there
getSession() refreshed the Redis TTL on every read, and OTKPreAuthFilter resolves the session before any controller runs — so every API call renewed the session...
Keep co-borrowers on one routing order
deriveSigners numbered borrowers 1, 2, 3… as a display index. ESigService now ENFORCES routing order instead of merely reporting it, so leaving the counter in p...
Stop losing organizations to swallowed exceptions, and accept the full create payload
createOrganization could destroy a customer's signup and report nothing useful. Transaction integrity: - Five Docstors ran behind try/catch that only looked sa...
Make account creation atomic, org-scoped and rights-gated
createCustomer saved the Account before writing its addresses, and was not transactional — so when the address insert failed, the half-built Account stayed comm...
Scope the opportunities read, and give the relay client timeouts
/me/opportunities called reservationRepository.findAll() and filtered org and member in Java. That pulls every reservation on the platform — every tenant's — in...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The session security-level fix failed to deploy because bcprov-jdk18on:1.72 arrived corrupted — 'Tag mismatch' is a TLS auth-tag failure mid-transfer, not a mis...
Name the full logo correctly and resolve an org's domain deterministically
Three defects in how an organization's branding location is derived. my-networks named the full logo "logo-full." + logoFullExt, defaulting to "svg" when the c...
Read the member security level the column actually stores
members.security_level is a VARCHAR holding the ImageAccessLevelType NAME — 'PRIVILEGED', 'MEMBER', 'TEAM_MEMBER'. The session builder tested the value with ins...
Real chat direction, and stop the timeline mapper writing or fanning out
Chat entries claimed no direction and attributed every message to its row's author. Social conversations record BOTH sides against a Kamo Member — the visitor's...
Fall back through every number the agent holds
An extension with no org line to hang it off is undialable, so the resolver falls back to a number the member actually has rather than publishing nothing.
Send the company line as text, not markup
Pairs with the template fix in kamo-shared-library. Per-org template rows are insert-only, so the rows seeded before the markup change still wrap this variable ...
An approver who files a request still gets the approver email
The actor was stripped from every audience, so an approver who raised a request was cut from their own notification about it — and in an organization with a sin...
Require ACTIVATED god mode to read the trail, not eligibility
PhiAuditController.hasRight() bypassed the right check on session GD alone. GD means "may activate god mode"; godModeActive means "has activated it, deliberatel...
Unbreak application.yml, and replace the test that never ran
Three things, all from trying to answer "why not just fix the context test?". 1. **************** declared `kamo:` TWICE and therefore did not parse at all ...
Treat SERVFAIL/timeout (TRY_AGAIN) as pending, not hard error
Flaky customer authoritative servers (seen: migo.host for rodaris.md) intermittently answer SERVFAIL on healthy zones, which /setup/dns rendered as a red 'DNS l...
Time out the *** call instead of hanging every login
A bare `new RestTemplate()` has no connect or read timeout. When the *** service became unreachable today, every login thread blocked on this call indefinitely ...
Declare the MFA bean here, since the library no longer does
kamo-shared-library dropped @Service from MfaEnrollmentService so that ~40 services stop constructing an authentication component they do not use — that stereot...
Add the MFA repositories to the JPA scan — unbreaks login
@EnableJpaRepositories here is an EXPLICIT package list, not a wildcard. com.kamo.z.shared.mfa.repos was missing from it, so UserMfaEnrollmentRepository and Mfa...
Let org owners configure sender photos without a rights grant
The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Gate DELETE /api/security/org/{id} behind active god mode
The handler was `public void **************** Long id)` — no HttpServletRequest parameter at all, calling straight through to a bare deleteById. With ResourceSe...
Require auth + org scope on job-title/department mutations
PUT and DELETE on /api/security/job-titles/{id} and /api/security/departments/{id} resolved no session at all — they read a UUID off the path and called straigh...
Store and read avatars under one domain-independent prefix
Avatar object paths were prefixed with the domain of whatever host the request arrived on (getPublicBucketName → kamocrm-com, optionone-com, cluster-local, …), ...
Credit-balance pen sets an absolute target (mint up / invalidate down)
The Manage-Credits pen edit only ever LOWERED a balance: updateAllotment routed creditBalance to invalidateCreditsToTarget, which no-ops when target >= current....
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.