Two more places that answered "is this app offered" from the enum
Both were missed when FeatureController moved onto the app catalog, and both would have disagreed with it the moment an operator published an app. Organization...
Never offer an unreleased app on a buying surface, bundles included
The stage filter only ran for the public marketing proxy. This endpoint also feeds the in-app SubscriptionOrderWizard, which is where a customer actually pays, ...
Only slide the *** TTL when a human is actually there
getSession() refreshed the Redis TTL on every read, and OTKPreAuthFilter resolves the session before any controller runs — so every API call renewed the session...
Keep co-borrowers on one routing order
deriveSigners numbered borrowers 1, 2, 3… as a display index. ESigService now ENFORCES routing order instead of merely reporting it, so leaving the counter in p...
Stop losing organizations to swallowed exceptions, and accept the full create payload
createOrganization could destroy a customer's signup and report nothing useful. Transaction integrity: - Five Docstors ran behind try/catch that only looked sa...
Make account creation atomic, org-scoped and rights-gated
createCustomer saved the Account before writing its addresses, and was not transactional — so when the address insert failed, the half-built Account stayed comm...
Scope the opportunities read, and give the relay client timeouts
/me/opportunities called reservationRepository.findAll() and filtered org and member in Java. That pulls every reservation on the platform — every tenant's — in...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The session security-level fix failed to deploy because bcprov-jdk18on:1.72 arrived corrupted — 'Tag mismatch' is a TLS auth-tag failure mid-transfer, not a mis...
Name the full logo correctly and resolve an org's domain deterministically
Three defects in how an organization's branding location is derived. my-networks named the full logo "logo-full." + logoFullExt, defaulting to "svg" when the c...
Read the member security level the column actually stores
members.security_level is a VARCHAR holding the ImageAccessLevelType NAME — 'PRIVILEGED', 'MEMBER', 'TEAM_MEMBER'. The session builder tested the value with ins...
Real chat direction, and stop the timeline mapper writing or fanning out
Chat entries claimed no direction and attributed every message to its row's author. Social conversations record BOTH sides against a Kamo Member — the visitor's...
Fall back through every number the agent holds
An extension with no org line to hang it off is undialable, so the resolver falls back to a number the member actually has rather than publishing nothing.
Send the company line as text, not markup
Pairs with the template fix in kamo-shared-library. Per-org template rows are insert-only, so the rows seeded before the markup change still wrap this variable ...
An approver who files a request still gets the approver email
The actor was stripped from every audience, so an approver who raised a request was cut from their own notification about it — and in an organization with a sin...
Require ACTIVATED god mode to read the trail, not eligibility
PhiAuditController.hasRight() bypassed the right check on session GD alone. GD means "may activate god mode"; godModeActive means "has activated it, deliberatel...
Unbreak application.yml, and replace the test that never ran
Three things, all from trying to answer "why not just fix the context test?". 1. **************** declared `kamo:` TWICE and therefore did not parse at all ...
Treat SERVFAIL/timeout (TRY_AGAIN) as pending, not hard error
Flaky customer authoritative servers (seen: migo.host for rodaris.md) intermittently answer SERVFAIL on healthy zones, which /setup/dns rendered as a red 'DNS l...
Time out the *** call instead of hanging every login
A bare `new RestTemplate()` has no connect or read timeout. When the *** service became unreachable today, every login thread blocked on this call indefinitely ...
Declare the MFA bean here, since the library no longer does
kamo-shared-library dropped @Service from MfaEnrollmentService so that ~40 services stop constructing an authentication component they do not use — that stereot...
Add the MFA repositories to the JPA scan — unbreaks login
@EnableJpaRepositories here is an EXPLICIT package list, not a wildcard. com.kamo.z.shared.mfa.repos was missing from it, so UserMfaEnrollmentRepository and Mfa...
Let org owners configure sender photos without a rights grant
The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Gate DELETE /api/security/org/{id} behind active god mode
The handler was `public void **************** Long id)` — no HttpServletRequest parameter at all, calling straight through to a bare deleteById. With ResourceSe...
Require auth + org scope on job-title/department mutations
PUT and DELETE on /api/security/job-titles/{id} and /api/security/departments/{id} resolved no session at all — they read a UUID off the path and called straigh...
Store and read avatars under one domain-independent prefix
Avatar object paths were prefixed with the domain of whatever host the request arrived on (getPublicBucketName → kamocrm-com, optionone-com, cluster-local, …), ...
Credit-balance pen sets an absolute target (mint up / invalidate down)
The Manage-Credits pen edit only ever LOWERED a balance: updateAllotment routed creditBalance to invalidateCreditsToTarget, which no-ops when target >= current....
Master Machine SSO uses a VNC connection, not RDP
guacd cannot render KRdp's H.264-only RDP GFX. buildAutoConnectUrl now mints a vncConnection() for Master Machine (192.168.4.46:5900, shared password). Linux/Wi...
Pin RDP color-depth so KamoDesktop SSO reuses one xrdp session
The god-via-kamo-internal SSO path defines its Guacamole connection inline in the json-auth token, so the color-depth pin must live here too (kept in sync with ...
Make org branding authz reachable (owner, god mode, or right)
Uploading a logo to a child org 403'd with no way to succeed: canManageOrgBranding only admitted the org owner, and the isGodModeActive fallback could never ret...
Thread orgId into the rate-sheet version-spine read
The gateway relayed only investorId, so the upstream had nothing to scope by and returned another tenant's version spine for a foreign investor id. Its siblings...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
Stamp the borrower quote's actor from the session
The quote requires createdByMemberId and the browser must never supply it. memberId(req) is hoisted out of the party-check branch so it resolves for stewards to...
Send AIService the secret it actually validates
The vision-capability proxy authenticated with internal.auth.secret, but AIService validates **************** — a different secret. Confirmed live: the console ...
LoanTransactionService ctor gained LeadRealtimePublisher param
assignLoanOfficer now publishes the chat-routing event, so the service ctor takes a 10th arg (LeadRealtimePublisher). Update the unit test's direct instantiatio...
Enforce ACTIVE member status on every session & off-boarding path
The ACTIVE-member login gate previously lived only in the password-login controller. Extend it to every session-minting path via the shared-lib ****************...
Rate-lock commit gate + cross-org loan resolution + borrower vendor-order projection
Verified defects from the session review: - CRITICAL: commitLock hardcoded **************** which the RCE commit engine rejects with a 400 (only LOCK_ELIGIBLE...
Mirror native e-sign completion to the disclosure stub + fix sent status
(1) BorrowerSignatureService now mirrors a terminal native envelope status back onto the locked disclosure stub (doc 05 §4.2 map) on the borrower's my-signature...
Revive soft-deleted member pref on upsert instead of 500
Per-member UI preferences (nav layout, hex-head sizes, etc.) are stored one row per (member_id, pref_key) in MEMBER_UI_PREFERENCES, guarded by the unique constr...
Accept X-***-Token header on my-networks + all-networks
getMyNetworks/getAllNetworks only read the OTK request-attr or the *** cookie, — no org beyond the device-exchanged primary ever loaded, and the active org had ...
Trainer must not clobber its own claim or an operator's pause
After the atomic claim() bulk-updates the row to RUNNING, mirror that in the in-memory entity — the pool thread has no open session, so a later full-row save wo...
Raise memory 1Gi→2Gi; pod idled at ~900Mi and OOM-killed during background uploads
Register mlos.notification JPA repos so SecurityService starts
EconsentService autowires DisclosureTextRepository **************** but that package was absent from @EnableJpaRepositories — the context failed to start, Crash...
Prepare-signin authenticates on api.<root> — the auth path can't resolve the myloan.* alias
Same constraint as in-cluster login: provider resolution keys on the canonical api host, not the portal alias, so a correct password still 401'd.
Preferred name fills AKA+first; pool entry publishes the realtime lead event
(1) The funnel's preferred name now writes nameFirstAKA AND stands in for nameFirst until the legal name arrives (owner rule) — it was landing on first name onl...
Weld the LO chain — portal leads enter the accept-lead pool; accepted LO survives conversion
(1) PortalLeadService routes a portal lead into the credit-based assignment pool (requiresAssignment=true) the moment it has a contact point — portal leads were...
Real soft-delete + reactivate-on-upsert for LOS connection; safe test-connection message
I1: view()/testConnection() now read via the shared-lib's active-filtered finder so a soft-deleted (market,provider) connection reads as "not configured" instea...
Fail the upload if resize fails (no full-size fallback)
Reverts the store-original fallback: if ConversionService cannot resize the image, return 422 instead of storing the full-size original (a huge image would then...
Fall back to the original image when resize fails
ConversionService can native-crash (libwebp-imageio SIGSEGV) or be unavailable, which made every member wallpaper upload fail ("Failed to process image" -> 500)...
Include both desktops in every SSO token, deep-link to the chosen one
Each token carried only its own connection, so the browser's reused json session lacked the other one -> opening Windows after Linux gave 'connection does not e...
Route borrower submit through the pipeline so it fires **************** (audit #3)
patchLoanFile's borrower submit (DRAFT->APPLICATION_TAKEN) now calls **************** instead of a raw updateLoanFile status set, so the submit produces the has...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.