Borrower submit fires the Application-Taken side effects (doc checklist + notify)
The portal borrower submit is PATCH loan-file {statusId:2}, which bypassed the operator /transitions endpoint where the Application-Taken side effects live — so...
Reject negative loan amount / property values on section saves
updateLoan and updateProperty now reject a negative monetary amount on the LTV inputs (loan amount, estimated/purchase/appraised value) via requireNonNegative —...
Correct KubeVirt VM cloud-init field + modernize spec
- cloudInitNoCloud userdata secret field is 'secretRef' (not userDataSecretRef); KubeVirt v1.8.4 pruned the wrong field -> 'must have at least one userdatasou...
Never prepend www to subdomains, only to the bare apex
The catch-all redirected ANY non-alias host to https://www.<host>, which is correct for the bare apex (kamocrm.com -> www.kamocrm.com) but wrong for a subdomain...
Borrower cannot escalate loan-file status or edit the URLA after submission
Two related borrower-authorization holes on the self-service app endpoints: - Privilege escalation (#2): patchLoanFile applied any statusId with no caller-ri...
Loan-file status accessor for borrower edit-lock, borrower-delete cascade, gift-recipient app scoping
**************** orgId): read helper backing the borrower post-submission edit lock (a borrower may only edit the URLA while the file is DRAFT). **************...
Hardened KubeVirt remote desktop + Guacamole gateway
Adds a full remote-desktop stack, GitOps-applied via the deploy workflow: - KubeVirt + CDI installed at deploy time (pinned-stable release URLs) - desktop-1: K...
Sub-tabs for chat groups, remember last-open tab
The chats list filtered by a row of multi-select pill chips that looked out of place under the Chats tab. Replace them with a single-select sub-tab bar (one tab...
Design spec for hardened KubeVirt remote desktop + Guacamole gateway
KubeVirt Kubuntu VM (16Gi/500Gi Longhorn) behind Apache Guacamole HTML5, exposed at desktop.kamocrm.com via Traefik (TLS + rate-limit + IP-ban). Adds LAN Window...
Move status editor onto the tabs row; note callback auto-note
- Status/sub-status editor now shares the primary-tabs row: tabs left, status aligned right (removes the separate row under the action buttons). - Callback di...
Show member avatars in the Chats tab
MediaService returns chat-session member avatarUrl=null by design (avatars are resolved on the frontend), but the Chats tab never resolved them, so it always fe...
Borrower self-create idempotency + orphan compensation; don't relay an empty checklist as success
MortgageAppController.create() borrower self-create branch: - Idempotency (#2): resume an existing owned DRAFT via findOwnedDraft instead of minting a duplica...
Readiness banner refreshes with the Refresh button and never shows an empty market name
Two follow-ups on the MLOS default-lead-source readiness banner: - Refresh (IconButton) now also calls loadMlosReadiness(), so surfacing a newly-created marke...
Idempotent borrower self-create draft + deterministic active lead-market resolution
**************** memberId): resolves the member's existing in-progress DRAFT application so a repeated borrower self-create (double-click / reload / second tab ...
Explain when email isn't configured; gate compose
The /messages inbox previously rendered its full shell even when the org had no email provider or the member had no mailbox, silently failing every API call. Ad...
All-types Chats list + browser-tab attention
Chats sub-tab now lists member, group, support and social conversations together, most-recent first, with a multi-select filter (Team Members / Members / Social...
Unified Chats feed across member/support/social sessions
GET /api/media/sessions/chat now accepts a `categories` filter (chat, support, social; default all) and returns one globally most-recent-first, merge of the per...
Paged queries for support + social chat sessions
feed so the unified Interaction Center Chats list can include all kinds: - SUPPORT (TYPE_ID=2): sessions where the member is the assigned agent OR the request...
Finish lead-view header actions + callbacks
- Header: split Call into Call (Work)/Call (Personal) opening the softphone (hidden when the member has no registered extension), Email opens the composer, ...
Internal endpoint to create/cancel a member's calendar event
POST /api/internal/calendar/events (X-Internal-Auth gated) resolves member -> user -> primary calendar (creating a default if needed) and creates an event. Used...
Lead callback endpoints (schedule/list/resolve)
New **************** controller + service: persists the callback, posts scheduling/outcome notes into the lead's media stream, and mirrors the callback onto the...
Add LeadCallback entity, status enum, and repository
Backs the lead-view callback feature: a lead-owned callback record (PENDING/CONTACTED/CANCELED) keyed off leadUid, with a soft reference to the mirrored EmailSe...
Explain why the MLOS default-lead-source control is hidden instead of silently dropping it
On the vendors-products tab the "designate default lead product" control is gated on mortgage-vertical readiness — POS enabled, an active MORTGAGE commerce mark...
Rebuild against shared-lib dbNow() CAST fix
Empty commit to trigger CI, which clones kamo-shared-library at build time and picks up the **************** dbNow() CAST(now() AS timestamp) fix.
DbNow() use CAST(now() AS timestamp), not now()::timestamp
The ::timestamp shorthand is mangled by Hibernate's native-query parser (it reads ':' as a named-parameter prefix, turning ::timestamp into :timestamp) -> CRDB ...
Create a session for group chats opened by memberIds
ChatTool ignored props.memberIds: a group open arrived with an empty userId and no sessionGuid, so the 1:1 createSession bailed early and the window never got a...
Stop duplicate chat popups for the same conversation
The tool-window dedup only exact-matched a single userId key against an async-mirrored windowsRef, so the same 1:1 chat opened twice: - userId from a member ro...
Rebuild against kamo-shared-library rights-waterfall fix (5f20d29)
CI clones and builds kamo-shared-library from source, so this empty commit re-triggers the build to pick up the layered rights resolution. On boot the MemberRig...
Show all enabled-app permission groups in job title & department editors
JobTitleManager and DepartmentManager only ever rendered two permission groups — General and CRM — so **************** rights were invisible and uneditable ther...
Resolve member rights as a true waterfall instead of NUKE-always-wins
Effective rights were computed by folding every source (roles, department, job title, member) into one map where NUKE always won. That meant a member holding bo...
Revert securityProvider to self-pointing; self-heal member applied rights
Two prod issues from the securityProvider-mirror change: 1. Enter-as-System-Member failed with "No membership in the organization's security provider" for e...
Refresh provider status when OAuth popup closes
The provider now redirects to the api-gateway callback (a different origin), so its postMessage may not pass the opener origin check. Re-fetch real provider sta...
Public passthrough for email OAuth provider callback
Forward GET **************** to EmailService sessionlessly (strips auth, no redirect following), mirroring the RingCentral OAuth callback. This is the fixed pub...
Fixed public redirect + gateway-forwarded callback
Platform email OAuth (Microsoft 365 / Google / Zoho) had no valid public redirect URI: the redirect was derived from the request host, which in prod is the clus...
Serve e-sign editor PDF for any converted doc, incl native PDFs
The e-sign editor (DocumentEditor → PdfCanvas / PageThumbnailSidebar) opens any converted document, not only files uploaded through the sig-template flow. It fe...
My Docs uses MY_DOCS ordinal (3), not enum id (4)
The backend resolves ImageAssocType via `values()[assocType]` (ordinal index) and persists it @Enumerated(ORDINAL). Every imaging surface passes the ordinal, bu...
Convert deduplicated documents so e-sign edit is enabled
When an uploaded file's bytes matched an existing ImgDat, the dedup path (register-existing) reused that dat verbatim and never ran the conversion pipeline. If ...
Return 200 allFalse for unconfigured org capabilities
GET /api/voip/capabilities threw ProviderNotConfiguredException (422) when an org had no phone provider, logging a red console error on every page load for phon...
Stop 404/422 console errors for un-customized nav and phone-less orgs
Read the ui-preferences collection endpoint (always 200) for the initial navLayout load instead of the single-key GET, which 404s when a member has never custom...
Proactively provision browser-only aliases (media.*)
The log-scan discovery mechanism can never bootstrap the `media` alias: it is only ever contacted by the browser over a WebSocket/XHR subresource (SockJS /ws/in...
Gate lead contact-info by assignment + new privacy rights
Mirror the three new CRM rights. On the lead detail page, mask/lock the Primary Contact, Mailing Address and Property Address fields for leads not assigned to t...
Enforce lead contact-info privacy rights
getAllLeads now returns the lean LeadListDTO and hides unassigned leads from members without VIEW_UNASSIGNED_LEADS. getLeadById masks contact info (state preser...
Lead contact-info privacy rights + lean list DTO
Add three CRM rights (161-163): "Assigned To Others: View/Edit Lead Contact Info" and "View Unassigned Leads". Add LeadListDTO — a lean projection for the /lead...
Interpret lock LAST_EDIT_AT as UTC for epoch-millis expiry
dbNow() now returns DB-UTC wall-clock (now()::timestamp), so recover the absolute instant with toInstant(UTC) instead of the JVM default zone — keeps the browse...
DbNow() cast now()->::timestamp (TIMESTAMPTZ->Instant broke LocalDateTime)
SELECT now() returns TIMESTAMPTZ, which Hibernate materializes as java.time.Instant and cannot cast to the declared LocalDateTime return type — throwing ClassCa...
Send membership type from the /member and /team paths
/team signups create a TEAM_MEMBER (created PROSPECT, pending admin activation); /member signups create a MEMBER. RegisterFlow takes a memberType prop supplied ...
/team creates a TEAM_MEMBER (PROSPECT), /member creates a MEMBER
Public registration now honors the memberType the register site sends (from the /member vs /team path): /team creates a TEAM_MEMBER — as PROSPECT, so an admin m...
Agent filter shows member name + phone extension, not email
The Agent dropdown labelled each teammate with their email because the loader read firstName/lastName keys the backend never sends (it sends nameFirst/nameLast/...
Expose team-member work phone extension in team-members-contractors
The /leads Agent filter needs the work-phone extension to label options as "Name (ext 8080)". The extension already exists on TeamMember (getPhoneWorkExtension)...
Request-support popup shows parent-org shared topics
Point the ticket-creation topic dropdown at the new /api/support/topics/available endpoint (own-org + parent-shared topics) so child-org users can contact their...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.