Keep filter subqueries on their row-key indexes, and test them
EXPLAIN against the live catalog showed the planner driving callback, loan status and rate lock subqueries from their status indexes (every such row on the plat...
Index backfill candidate query without a '::' cast
Hibernate's native-query parser read ':text' in ARRAY[]::text[] as a named parameter and the first live run answered 500. (attachment_types IS NULL OR NOT (mark...
Only write to an owner about domains they have verified
An unverified domain is only a name someone typed in, and the letter's steps assume its owner controls the DNS. Such a domain now counts as nothing to do, so an...
Send as an org's domain when its SPF or DKIM authenticates us
A published DKIM key now puts the org's domain on the From by itself, with the envelope left on the platform so a strict SPF record cannot sink the message. SPF...
Sign calendar invitations from an org domain as well
EmailSmtpService.send carried no domain signer, only sendAsMember did, so an invitation sent from an alias domain left unsigned while the member's ordinary mail...
Outbound mail stops looking like spam: a plain-text part, a real Message-ID, no unreachable Reply-To, no zero-font spacers
rspamd's scan of 76 recent kamouniverse.com messages, fixed where each is built: - MIME_HTML_ONLY (75/76): every body is now multipart/alternative with a text/...
An explicit alias at the default alias domain keeps the member on it
personalMailboxes() leaves out the primary mailbox's copy on an alias domain when the member holds an explicit alias at that address. When that copy was the org...
A member's signature prints the address the letter goes out from
The member's own signature always printed the profile's email - their primary mailbox - so mail sent as Dylan@kamouniverse.com (an alias, or the mailbox on an a...
Voice quiet hours are a partial update and switching them off keeps the member's hours
PUT **************** wrote quietEnd = quietStart to mean 'off', so turning quiet hours off, or saving without quietEnd, lost the member's end, and turning them ...
A colleague's alias can be sent from when their mailbox can
Composing as a colleague offers their aliases in the From picker, but /send authorizes the From against the logged-in member, whose canSendAs knew only the coll...
Dovecot push publishes once per mailbox, EHR letters get a subsystem; four stale tests fixed
Production: - DovecotPushService published every arrival, change and unread recount once per application spelling of the mailbox. That fan-out existed because...
MailProvenanceService names its Spring constructor, so EmailService starts again
5cd632f gave it a second public constructor; Spring found no default one and every new pod crash-looped ("No default constructor found"), holding the deploy on ...
A Reply-To elsewhere is a spoof sign: such mail is never a teammate's proven email
Email templates and the org calendar/contacts connection take MANAGE_EMAIL_SETTINGS (SITP TP02)
EmailTemplateController and EmailTemplateCategoryController checked a session alone: any member could list, read, preview, create, edit, archive, duplicate or r...
An RSVP from a member with no mailbox says so (409 NO_MAILBOX), not a bare 400 (SITP TP12 live smoke)
A shared-mailbox send meets the SI guards; message labels take ?folder= (SITP TP13)
A send as a shared mailbox skipped the checks EmailController#sendEmail runs: an own-domain recipient that is nobody (422 RECIPIENTS_UNKNOWN), the SI thread-tur...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
A member's mail carries the name on their member profile
9351aac named a nameless From with the mailbox row's display_name first, and kept any name the request sent. The composer sends that same row name, and rows can...
A member's mail goes out under their name, not a bare address
The From header carried a name only when the request did, and the composer sends the mailbox's display_name: set for an SI's mailbox when it is made, blank on a...
An alias-domain From row names the mailbox behind it
The From picker offers the member's primary mailbox again on each org alias domain, with an id like <mailbox>:alias-domain:<domain> to keep it unique in the lis...
An SI's HIGH chat card is raised even while an unread-chat card stands
A person with an undismissed CHAT_MESSAGE card was never told of an SI's NOTIFY (KamoCollab CP12 D14): the announce-once rule dropped the HIGH card too, while t...
A meeting's updates and cancellations come from the address that invited its guests
The composer files a meeting under whatever its From said, an alias or a shared mailbox, and that address is the ORGANIZER in every ics. But updates, cancellati...
File a message's search-index row and lead link under its thread id, not the conversation row's surrogate
conversations.thread_id is generated (@GeneratedValue on ConversationEntity, primary key the thread id alone), so the row **************** returns carries a ran...
Labels page in one date order with an exact total; Microsoft 365 folders are counted
Labels - A label was paged through the join table by UID and each page sorted by date afterwards. UIDs only order mail within one folder and a label spans f...
Lower-case NATS mailbox subjects for live updates
Mixed-case addresses like Sales@kamocrm.com published on different NATS subjects than subscribers used, so watched mailboxes never refreshed.
An AI hire no longer waits forever on an email provider that was never connected
An org that chose Google Workspace (or another third-party provider) but left it at PENDING_SETUP, or switched it off, can never produce the AI's mailbox, so th...
A provisioning race Yugabyte reports as a serialization conflict no longer 500s the calendar widget (SP98 T26)
listCalendars provisions the shared and the personal calendar find-then-create, each in its own transaction, and treated a lost race as done only when it surfac...
The AI signature disclosure names the company by its spoken name
An AI member's email disclosure filled {organization} with the organization's title (its letterhead), so Luna's mail said "an AI member of the KamoCRM Inc. team...
Key the cross-root retry on alias-domain membership, not root-or-not
Round 3 review (email-fix-review-3.md) confirmed round 2's BLOCKER fixed (walked sage@kamouniverse.com through both the app code and Postfix's own platform-alia...
Retry every owned domain unconditionally, and drop the +tag fold
Round 2 review (email-fix-review-2.md) found the round 1 fix for MAJOR #3 (multiple root domains) still reopened the original bug: - BLOCKER: kamouniverse.com ...
Close three false-refusal paths the review found in RecipientDomainValidator
Independent review of D-luna-1 (email-fix-review-1.md) found two BLOCKERs and a MAJOR, each a real false refusal of legitimate mail, demonstrated from code alre...
Refuse a guessed recipient at the org's own domain before it reaches the mail server
Luna (AI member) asked to email the owner and guessed **************** instead of looking up the real address (sage@kamocrm.com). kamouniverse.com is one of the...
The KamoMail domain check reads once a minute, and rows off an org's domains leave every list
SP99-T1-f, finished (SP98 Task 8). SP99's final review already refuses a KamoMail binding whose address is not on a domain the organization holds (95c58af); thi...
An AI organiser's invitations carry the AI disclosure its email does
Event invitations wear no compose template, so an invitation, update or cancellation organised by an AI member carried none of the disclosure its email carries ...
A late delivery still raises NEW_EMAIL and buzzes the phone; only IDLE is judged by age
NewMailAnnouncer's 30-minute Date-header gate, there for IMAP IDLE reconnect replays, also dropped Dovecot push arrivals, which report a delivery (MessageNew) a...
A From's mailbox id picks a signature only when the caller may send as it
The compose identity took fromAddress.id at its word: E1's send and E4's render check the From's address and the sending mailbox, never the id, so a member coul...
The groupware provider finds a series by its UID as its master
SP98-F-3. CalendarService.findEventByUid read "the one row with this UID" in a calendar, and an edited instance of a series is a row of its own under the series...
An inbound invitation answers with its summary, as the account that received it
SP98-F-5. **************** returned the CalendarEvent entity, whose attendees point back at their event, so writing it recursed until the stack overflowed; it n...
Address books are found, and reached only by their owner with the web's rights
SP98-F-4. CardDAV wrote resourcetype as empty text for the home, every book and every card, so no client ever found an address book; a book is now *************...
A calendar edit changes only what it sends; a new one without a zone takes the member's
The calendar create and edit bound the UserCalendar entity, whose defaults (zone UTC, visible, sort order 0) stood in for every field a body left out. KamoMobil...
An alias goes only to a member of the caller's own organization
POST /api/email/aliases took any memberId: an administrator could create an alias in their organization that forwards to another tenant's member, and read that ...
Only an open god-mode window bypasses a tenant right, never GD alone
Every EmailService rights check let a session with GD through ("GD passes everything"), but GD is god-mode ELIGIBILITY, permanently true for the operators who h...
KamoMail binds only an address on a domain the organization holds; the provider needs its right
The cross-tenant read path parked as SP99-T1-f. A self-registered organization could point its provider at its own IceWarp or Exchange (PUT /api/email/provider ...
Indexing a listed page can no longer fail the listing
recordSyncedPage was @Transactional and caught every exception of its own. The index repositories join the caller's transaction, so a write that met a concurren...
Basic sign-in asks SecurityService's real credential check
DavAuthFilter posted Basic credentials to **************** which never existed (405), so every username-and-password sign-in from iOS or DAVx5 was answered 401 ...
A mail domain, and every account on it, belongs to the organization that proved it
The KamoMail server's virtual_domains and virtual_users are shared by every tenant, and nothing stopped one tenant from writing to another's part of them: - PO...
An organization's NoReply domain is chosen by name, not by row order
The campaign From, the transactional Reply-To and the provider default domain each took "the first root org_domains row". Organization.getDomains() is unordered...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.