POST /service-jobs, gated on MANAGE_SERVICE_WORK
The create verb the work-order surface never had. app/commerce/service/new is a seventeen-line placeholder because there was nothing to call. Gated on MANAGE_S...
Rebuild to seed the four order and pricing rights
An empty commit built out of tree from origin's own tree. RoleRightsSyncService seeds org_role_rights at boot, so a right shipped without a SecurityService rebu...
Gate the order and pricing surfaces on a right
Thirty-nine endpoints were protected only by "are you signed in". Every order handler on POSController and every pricing and tax handler on CommerceMarketContro...
The exchange status says what would make it connected
The status endpoint is asked before the UI offers a network query, so a practice that is not onboarded sees an explanation instead of a button that always fails...
Never auto-provision Patient Records into a tenant
Two of the three paths that would hand a clinical record system to orgs that never asked for one, now that ServiceType.EHR is COMPLETED and therefore available....
Disclose that drug interactions are not checked
Prescribing ran three checks the practice's own data can answer and no drug-drug interaction check at all. Declining to build one was right -- interaction knowl...
Rebuild against kamo-shared-library for SW6b work-order writes
An empty commit, built out of tree from origin's own tree — NOT 'git commit --allow-empty', which permits an empty result but does not force one and would have ...
Eight work-order endpoints for lines, notes, vendors, sign-off and the clock
SW6b Task 3, controller half. POST/PUT/DELETE /{jobUid}/lines/..., POST /{jobUid}/notes, POST/DELETE /{jobUid}/vendors/..., PATCH /{jobUid}/signoff and PATCH **...
Say why the transaction guard stops at ehr/
The two rules generalise and both shapes exist elsewhere in this service, so the obvious next move is to widen the scan — and doing that would fail the build on...
Say why the overload's @Transactional is inert on the afterCommit path
Prompted by a peer session finding a @Transactional(REQUIRES_NEW) Spring never advised — protected, and self-invoked, so the record of a failed query rolled bac...
Fail the build on a @Transactional Spring cannot advise
Two shapes get no transaction advice at all, and neither is visible at a call site or in a unit test: a non-public method, which the proxy cannot intercept, and...
The outbound audit row was written by an inert REQUIRES_NEW
It was a method on ExchangeQueryService annotated @Transactional(REQUIRES_NEW), called from two private helpers on the same class. Spring's transaction advice l...
Main did not test-compile — PhiExportAuditTest missed a constructor arg
SystemConfigurationController gained a twelfth parameter, PlatformSecretCipher, when platform secrets began being encrypted at rest. This test still passed elev...
Expose platform settings through the system-config API
toDto is an explicit allowlist and updateConfig takes a typed body, so the seven new SYSTEM_CONFIGURATION columns would have been invisible and unsettable — the...
The outbound half of TEFCA — ask, don't only answer
Everything built so far answers other people's queries: discovery, document query, document retrieve, the match-review queue, the accounting. A practice could b...
Right-gated service job API
**************** — list, get, update, and PATCH status. Copies ServiceTaskBookController's idiom: orgId(req) or 401, a right check or 403, a String path variabl...
A picture-frame image whose bytes are gone answers 410, not 500
The frame stream caught everything as stream_failed and returned 500, so a photo whose object is not in storage rendered as a broken image with no explanation -...
Withhold Enterprise pricing from the catalog
Enterprise is negotiated with KamoCRM directly, so its rate is not ours to publish. Every surface that quotes a plan price reads this one endpoint - the public ...
Check the chart before writing a prescription
Prescribing was added with the allergy table, the interaction-checking query and a "safety context" endpoint all sitting beside it, unread. A system that record...
A CCD preview is not a disclosure
Previewing a summary recorded a disclosure naming the recipient — so a patient asking who has their record under §164.528 would be told it went to somebody who ...
Rebuild for SubscriptionPlanFeatureDTO.unit
The catalog stores a unit per feature and the DTO now carries it, so the pricing page can render "15 GB per user" instead of a bare 15. Shared-lib reaches a ser...
One request-body parser, not three
The three clinical write controllers each grew their own string/uuid/integer/ date helpers within a week of each other — identical except for which ones each fi...
Rebuild against the storage dedup fix
Picks up kamo-shared-library d21e01ce. uploadDocument — the path behind member documents, mortgage disclosures, picture frames and media streams here — created ...
Rebuild against kamo-shared-library for the SW5 task book
An empty commit. ServiceTaskBookService and the four task-book entities live in the shared library; ServiceTaskBookController cannot resolve them until Security...
Right-gated task book API
SW5 Task 3, controller half. CRUD for books, categories, tasks and options, plus GET /{bookUid}/tasks/by-code/{code} - the lookup a quote or work order performs...
Find a claim by the number a payer quotes
Posting a remittance needs the claim it settles, and a remittance carries no internal id — only the number the practice sent. Without this lookup, applying mone...
Nothing returned an account id, so nothing could be withdrawn
Withdrawing portal access and granting a proxy both take an account id, and no endpoint ever returned one. A practice could invite a patient to the portal and t...
Rebuild against shared-lib PricingModel.PER_EXTENSION
The running image predates the enum value, so reading the two seeded PBX catalog rows (pricing_model = 'PER_EXTENSION') throws on enum parse - and because Subsc...
Edit demographics, set up the schedule, bill and post
The last four rights that named operations which did not exist. EDIT_PATIENT_DEMOGRAPHICS: a patient's details could be entered once and never corrected. A fie...
Rebuild against kamo-shared-library for SW4 quote conversion
An empty commit. QuoteConversionService, QuoteConversionBilling and the five quote defect fixes all live in the shared library, and none of them reaches anyone ...
POST /quotes/{uid}/convert
On QuoteController rather than POSController: this controller enforces a right on every handler, POSController enforces none on any order endpoint, and it resol...
Prescribe, order and immunise
The chart could display medications, orders and vaccinations and could produce none of them. The read paths, the FHIR renderers and the safety queues were all b...
22 of the 26 clinical rights were never enforced
Only the four population-level rights — bulk export, quality measures, portal administration and EHR settings — were ever checked. Prescribe, sign, cosign, plac...
An organization can be looked up by the reference ?org= carries
GET /org/ref/{ref} — the same projected record as /org/domain/{host}, for an organization named by its id or its web alias. Nothing could answer for one. The s...
The config body carries a scalar, and absence means unchanged
updatePOSConfig bound Map<String, List<String>>, a shape that cannot carry quoteConversionBilling at all. Widened to Map<String, Object>. A key that is absent ...
Actually measure the bulk-export bucket
StorageDomain.BULK_EXPORTS shipped declared, documented as "measured by scanning the object store", and referenced by nothing. It reported zero for every practi...
Provision an organization's branding under its alias, and migrate what exists
The folder every logo, colour, favicon and background is written to was the organization's hostname with the dots turned into dashes. A domain is optional now, ...
$everything records a disclosure when a recipient is named
The whole chart in one response is the largest single thing this system hands out, and until now it wrote a PHI audit row and nothing else. That was right for t...
Rebuild against kamo-shared-library for the SW3 service work domain
An empty commit. A shared-library change reaches nobody until its consumers rebuild, and SecurityService hosts POSController and the order path — so without thi...
Create returns the domain its theme is provisioned under
The caller cannot work this out and must stop trying. GET /org/{id} answers with the entity, whose `domains` is LAZY and serializes as null outside a transactio...
The patient portal — sign-in, records, and proxy access
The §164.524 right of access, made real: a patient signs in and reads their own problems, medications, allergies, immunisations and appointments, and can downlo...
Commerce records as owners, and one place for the matching rules
The third owner the spine was widened for, and the one that was still defined and unused. A record's documents already hang off it through the document manager'...
A push token may be claimed by one device row, not every past sign-in
Companion to MediaService 8a809b3, which stopped members getting the same chat message three-plus times on their phone. That change made dispatch collapse dupli...
The TEFCA responder — discovery, document query, document retrieve
The three operations a partner actually calls, expressed over FHIR rather than SOAP: IHE's XCPD and XCA shapes, on the QHIN Technical Framework's FHIR path, bec...
Five real quality measures, and the engine that runs them
Measures are Java rather than CQL, and the trade is worth stating. The eCQM specifications are published in Clinical Quality Language, and an engine would let a...
Recover a lost background count from the images themselves
commitBackgroundOrder writes the images to STAGING, and imageBgCount is only a record of how many it wrote — which made that one column a single point of failur...
Gate the nine Service Work endpoints on a right
They shipped checking only that the caller had a session, so any member of an org could read and mutate every work order in it regardless of role. ASSIGN_SERVI...
Drop the nine Service Work endpoints from the unguarded baseline
They are gated as of e6e1d02, so their baseline entries no longer match an unguarded endpoint and **************** fails on the stale lines. Requiring the remov...
Stop the customer **************** rights reading every tenant's rows
Every endpoint that accepted a VIEW_OWN_* right as an OR-alternative loaded its record by primary key alone, never checking who it belonged to: getSubscription,...
Bulk export, C-CDA, and one accounting that covers every channel
BULK EXPORT. Kickoff answers 202 with a Content-Location and no body; polling answers 202 while running and 200 with the manifest when done. Returning a friendl...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.