React to a message with an emoji, and correct one you sent
POST **************** sets or clears the caller's emoji and answers with the message's whole reaction set, so a client that raced itself converges on the server...
A child org's lobby offers its own backgrounds, not the platform's
The folder holding an org's meeting backgrounds and theme config was derived from a hostname — the request's, or the org domain the sidecar passed — by taking t...
Use the shared availability engine
MemberAvailabilityService keeps the CRUD and becomes a BusySource; the arithmetic it used to own now lives in kamo-shared-library. Call sites are unchanged — th...
One phone, one alert — collapse duplicate push destinations
Members were getting the same chat message three-plus times on their phone. Registrations are unique on (device_token_id, org_id, push_kind), NOT on the push t...
Route getChatSessions' unread ambiguity through OwnAuthorshipAmbiguity
MediaController.getChatSessions hand-rolled the pre-extraction version of the "was this written by somebody else?" rule (rowVisitor != null && callerId ********...
Consistent error handling and layering on two review findings
Review findings on Tasks 14 and 15: - SystemBugController held a SystemBugRepository field and queried it directly for the new-bug count, while every other r...
Guard the unread-lookup itself, not just the broadcast
Review finding on Task 9: persistInbound is @Transactional, and only the broadcast() call inside the per-member loop was exception-safe (it swallows its own fai...
GET /api/webinar/presenting
The webinar types the CALLER is a presenter for. The calendar asks this before it offers an availability layer at all: hours declared by a member no type lists ...
Tell a member about a webinar booked on their behalf
Not gated on a webinar right, unlike the ticket counters: the case this exists for is one where the member took no action at all, so requiring the right to requ...
Count unreviewed bug reports for platform admins
Zero for an ungated caller rather than a 403: the nav polls this on every page load for every member, and an error they must routinely swallow is how real error...
Route unread snapshots to their own STOMP topic
Everything on voip.> went to one topic, whose browser subscriber plays the SMS arrival sound and opens a tool window for every frame. A badge refresh there woul...
Refresh unread badges when a visitor message lands
persistInbound announces its own message (publishRealtimeEvent=false, so a visitor's reply does not render as the owner's), and in doing so also skipped the unr...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while consumers stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors Mave...
Resolve bookable times from member availability
Availability is now computed rather than stored. MemberAvailabilityService owns the arithmetic: expand each presenter's declared windows over the type's booking...
Naming a site is optional
It was required, and requiring it was wrong. A site is a hint for whoever picks the report up — a member who is not certain which of five surfaces they were loo...
File a bug or an enhancement
The type is refused rather than defaulted on a write: an enhancement quietly filed as a bug sends the AI session hunting for a fault that was never there. It is...
Deliver cluster alerts into a member's chat thread
Alertmanager webhook receiver at /api/internal/alerts/chat, so a KamoDesktop alert reaches a person instead of a dashboard. This is the BEST-EFFORT leg. Email ...
Build the search pattern outside the query, and parse the query in a test
likePattern turns an absent search term into '%' so no null parameter ever reaches a string expression, and escapes % and _ in the term so a search for a litera...
Bug CRUD, screenshots and the one visibility rule
A system bug crosses the tenancy line in one direction: the platform organization sees every tenant's, and no tenant sees another's. That rule lives in ********...
Guard social messaging and Canva at their credential chokepoints
SOCIAL_MESSAGING is enforced in SocialCredsResolver.resolve — the narrowest point covering every adapter and both directions. No credentials means no Telegram, ...
The Affiliate Sales Scoreboard endpoint
GET **************** answers this organisation's top ten for one metric over one window, plus the caller's own standing when they are not on it. The counters o...
Refuse meeting recording for a tenant that handles PHI
The capability split made ServiceType.MEET permitted — a live conference on self-hosted Meet never leaves the cluster — while MEETING_RECORDING stayed blocked, ...
Let the public config be addressed by org id, not only by host
The meet sidecar looks up an org's meet config to decide whether a guest needs a meeting password. It asked by hostname, which on the shared meet host resolves ...
Carry the type description in both of its shapes
The description is a Lexical document now, so the service stores the plain-text mirror the client sends alongside it and hands readers whichever shape they can ...
Relay "the classic version was just saved" to the editor
DocsService publishes docs.classic-saved.{memberId} after a WOPI save lands on a CLASSIC version; this puts it on /topic/docs/saves/{memberId} over the STOMP co...
Enforce the org chat policy, and close two holes it sat on
Applies the policy at the three places a conversation can start or continue: session creation, member adds, and the send path. A room is not policed pair by pai...
Put the requestor's face and name on each support chat row
A Chats → Support row showed the same support glyph on every line, so a queue of them was a wall of identical blue circles. The face people actually scan for is...
Name the requestor's org, and end System User access when the ticket moves
Three things, all about a support desk that answers more than one tenant. The ticket detail now carries a per-viewer verdict on whether to offer "open the requ...
Rebuild against kamo-shared-library 811db57
Picks up the createLead fix that moves the pool-availability recount to afterCommit. Before it, a read-after-write in the lead's own transaction hit YugabyteDB'...
Stamp every unread frame with the instant its counts were read
The four places that built a member's unread snapshot — the REST read, the frame sent when a message arrives, the frame sent when a session is marked read, and ...
Mint an opaque UUID token, in one insert
createCode generates the token itself, so there is nothing to read first and nothing for two tabs to collide over. That removes the whole apparatus the old sequ...
Move credit on a newer link, and record the moment it moves
The ingest worker now calls reattributeWhileAnonymous after the traffic bumps. The repository method carries the entire rule, so there is nothing to check here ...
Follow the renamed tracking repository queries
findVisitorsForCode and findTimelineForVisitor replace the derived finders, which now carry an id tiebreaker and NULLS LAST; the conversion consumer moves to th...
Serve the tracking-codes tab and ingest the visitor beacon
MediaService already backs the other marketing tabs, so it takes both halves of tracking codes: the authenticated CRUD and stats surface at /api/media/marketing...
Resolve a public chat's owner without walking a lazy association
getChatSessions runs outside a transaction, so reaching the session owner through the visitor's lazy session proxy worked only for as long as open-in-view stays...
Stop reading the org's system member as the web-chat visitor
Four reported faults, one cause. A widget visitor has no Member, so the org's SYSTEM member — the owner, who works the queue — stands in for them as the ticket'...
Rebuild against the shared-library lead id fix
This service creates leads through LeadService, so it hit the same failure as /leads/new: on a mortgage market Hibernate 6.2 emitted "insert into leads (...) re...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
The public chat reads its pages without the count either
Both sites took .getContent() and dropped the total on the floor, so both were paying for the same discarded COUNT over every object in the session that just 50...
Size the pod for the heap the JVM is already allowed to take
The container ran with a 1Gi limit while the image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch. Read off the live process, that is MaxHeapSi...
Creating a topic takes CREATE_SUPPORT_TOPICS, not its parent
The gate was already there and refusing callers — on MANAGE_SUPPORT, the parent — so CREATE_SUPPORT_TOPICS read as decorative in every editor while being exactl...
Materials and the social timeline take rights, not just ownership
MANAGE_MATERIALS and MANAGE_SOCIAL_MEDIA counted as enforced in the audit and every site was a .tsx file. Behind them 29 endpoints checked ownership and no righ...
Creating and resolving a meeting take the rights that name them
/api/meet/create checked only that you had a session, so every authenticated member of every organization could create a meeting with the org's provider — START...
The meeting reminder is a notification, not a popup of its own
The sweep published a bespoke event on /topic/meet/reminder/{memberId} that a dedicated Snackbar drew in the corner of the screen. That popup was the entire rem...
Relay the outstanding-course count onto the member's own topic
The twin of the legal relay, because NavTop sums the two counts into one badge and a pair of halves that behaved differently would give the member chrome that w...
The ticket list survives a broken indicator
The unread read threw and took the whole ticket list with it — the page came back empty, which is a far worse outcome than a page with no markers on it. It is g...
Unread means the requestor spoke, or the ticket just became yours
The badge counted "live tickets nobody has picked up, plus the ones I hold" — message-blind, and it only ever fell when a ticket reached a terminal status. So i...
The ticket list marks the same items the badge counts
countForMember sized a set it built privately, so the list had no way to ask which tickets were in it and approximated instead — it flagged unread chat messages...
A ticket can never be answered by the member who raised it
A support conversation has two sides — someone asking and someone answering — and nothing enforced that they were different people. A member holding ACCEPT_SUPP...
Send an outbound attachment to the endpoint its type belongs to
Every social attachment went out through the adapter's sendImage, which on Telegram is /sendPhoto. A PDF or a zip posted there is rejected by the provider, and ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.