VIEW/MANAGE_ORDERS and VIEW/MANAGE_PRICING, ids 273-276
No order-mutation right existed anywhere. POSController's order endpoints and every pricing and tax handler in CommerceMarketController read the org off the ses...
Publish Patient Records, and make that safe to do
ServiceType.EHR was held at TESTING long after the vertical was finished, because AppCatalogService derives availability from COMPLETED and three separate paths...
A vendor id leaves as a string, for every row
`commerce_vendors.uid` is `INT8 DEFAULT unique_rowid()` -- about 19 digits, where `Number.MAX_SAFE_INTEGER` has sixteen. A numeric id of that size is an IEEE-75...
The per-plan allowance is per seat, and says so
Rename only — PlanStorage.gbPerUser is private to this class and the three call sites are all in it. The comment above it was the misleading half: the allowance...
Line, note, vendor, sign-off and clock writes on a job
SW6b Task 3, library half. Eight new operations on ServiceJobService, plus the wire records for them and the three reads the detail page needs. Three things th...
Job lines, notes and vendors so the work-order tabs can persist
Labour and parts become ServiceJobLine rows on the job rather than ServiceLineItem rows, because OrderLineItem.order is optional = false: a ServiceLineItem cann...
KamoPBX platform settings on SYSTEM_CONFIGURATION
KamoPBX is Kamo's own platform, so all of its configuration is platform-wide: base URL, master account id, account name, admin credential, SIP realm suffix and ...
A line for documents retrieved from other organizations
Its own domain rather than a share of DOCUMENTS, for the reason bulk exports got one: a practice that queries a health information network routinely accumulates...
An org-scoped read/write API for service jobs
ServiceJob has been a mapped entity with repositories and passing tests and no way to read a row. This gives it the header the finished work-order UI already re...
Tell "the bytes are gone" apart from "storage is down"
openRange collapsed every node failure into one IOException, so a caller could do nothing with it but return 500. A browser's <img>/<video>/<audio> cannot rende...
MANAGE_ENTERPRISE_SUBSCRIPTIONS
Enterprise is negotiated, never self-serve. This right gates both halves of that: seeing what it costs, and putting an organization on it. Category.OPERATIONS ...
Actually call the fulfillment policy
SW3 implemented FulfillmentPolicy as the first member of an interface that had none, and nothing ever called it — a grep across kamo-shared-library and Security...
Carry a plan feature's unit to the buying surfaces
The catalog has stored a unit per feature all along - "GB/user", "users", "contacts" - and the plan-feature DTO dropped it, so every surface rendering a measure...
The document upload publishes its row only once the bytes land
The buffered uploadDocument was the one store that wrote its ImgDat with isMissing=false BEFORE sending anything, and merely re-set it to false after a successf...
A failed upload must not become a dedup match
A member sent an 11 MB .wav to a chat, got "Cannot invoke ObjectWriteResponse.etag() because response is null", sent it again, and the second one delivered inst...
Task book service with org-scoped CRUD and code resolution
SW5 Task 3, library half. ServiceTaskBookService exposes books, categories, tasks and options behind an org-scoped API, plus resolveTaskByCode - the lookup a qu...
Add the flat-rate task book
A priced task catalogue whose entries carry labourMinutes — the number that both prices a line and sizes a visit. ServiceLineItem.taskCode, landed in SW3, joins...
Count the extensions a third-party server does not charge for
Queues, IVRs, ring groups and spares are the extensions nobody is assigned to, and under the third-party rule they are free - twelve of one production org's sev...
Count billable phone extensions
Adds the phone twin of the per-mailbox aggregator: PbxBillingClass with an exhaustive VoipProviderType switch and no default arm, OrgPbxBillingAggregator (no Sp...
Let the database decide whether a reaction is already there
The unique constraint on (message, member, emoji) was doing nothing useful. A read-then-save loses the race with the member's own second click, and catching the...
Per-message emoji reactions, and a message its sender can correct
Two things a member asked for on the individual chat: an emoji anyone in the conversation can put on a single message, and the ability to fix a message you have...
An unread count names a sender only when a single member is the answer
senderId is what pins an unread badge to a person — their member-directory row, their hex head — so it has to mean "these messages are from them". It was set fo...
Personal mailbox entities and two consumer providers
GMAIL_PERSONAL and OUTLOOK_PERSONAL were offered by the picker and were not members of the enum, so selecting either produced an unusable org.
An accepted quote becomes an order
acceptPublic wrote four columns and appended an event. No Commitment, no Order, no Transaction — the Quote javadoc's claim that accepting mints a Commitment des...
Count an org's billable mailboxes
Adds PER_MAILBOX pricing, the mail cost mode, and a stereotype-free aggregator: hosted bills every box on the server, third-party bills only what was mapped int...
Each org chooses what an order takes from an accepted quote
There is no platform-wide right answer. A maintenance contractor on a three-year plan bills each period; a capital-equipment installer bills the contract up fro...
Editing top-level lines no longer deletes every option's lines
Quote.lineItems is orphanRemoval=true and option rows set both quote and option — which is why QuoteMapper filters on getOption() == null twice. A bare clear() ...
An option quote keeps the tax and shipping staff entered
recalculate zeroed taxTotal and shippingTotal whenever a quote had options. Both were still stored on the row and still rendered by QuoteMapper, so a staff memb...
Terminal guards on cancel and revise, and stop swallowing bad input
cancel() and revise() had no isTerminal() guard, so an ACCEPTED quote could be flipped to CANCELLED or REVISED while acceptedAt and acceptedByName survived — a ...
Actually exercise the terminal guards
The test that shipped with them asserted only that an ACCEPTED quote reports itself terminal — true before the guards existed and still true if both were delete...
An organization's branding lives under its ALIAS, not its domain
The folder an organization's logo, colours, favicons and backgrounds are written to in the public bucket was its hostname with the dots turned into dashes — wen...
Stop dropping the market and the customer account
CreateQuoteRequest has always declared marketUid and accountUid and QuoteService.create has never read either, so Quote.market and Quote.customerAccount were NU...
The EHR is in TESTING, not PLANNING
The vertical is built end to end — charts, scheduling, notes, orders, results, claims, FHIR and bulk export, C-CDA, TEFCA exchange, quality measures and the pat...
Pin ServiceJob's join columns to INT8
Exporting the table's DDL showed org_id, engagement_id and customer_uid each emitted as INT8 DEFAULT unique_rowid() — inherited from the referenced key. Three f...
The first FulfillmentPolicy implementation
FulfillmentPolicy has declared supports/createFromCommitment since it was written and a repo-wide grep returned exactly one line: the declaration. Its work was ...
Stop discarding status changes and answering 200
updateWorkOrder parsed the requested status inside catch (Exception ignored), saved the entity unchanged, and returned 200 with a DTO showing the old value. The...
ServiceJob and ServiceVisit
A sibling of FulfillmentOrder, not a widening of it: FulfillmentOrder is a shipment with a tracking number and a carrier, and retail depends on it. Job 1..N vi...
Fill ServiceLineItem and its four classification axes
ServiceLineItem shipped as an empty 18-line subclass whose only reference in the whole corpus was its own declaration, so a service sold through POS persisted a...
The patient portal's identity model
A patient is NOT a Member, and this is deliberately not the workforce identity. Reusing the staff login would mean a patient held a principal that every interna...
Lift the free/busy engine out of the webinar feature
The interval arithmetic — expand, restrictionMask, candidateStarts, and the whole of AvailabilityInterval — was never webinar-specific. All the coupling sat in ...
Parse every core repository query against the real mapping
Spring Data validates an annotated @Query at bean creation, so a bad JPQL path ships green and crash-loops the consuming service instead of failing CI. The clin...
Delete findConflictingEvents, which never returned a row
Four independent defects, any one of which emptied the result set: it filtered e.user.id while both callers pass a member id and the two columns never coincide;...
A real credential for exchange partners, and retrieved documents
The responder endpoints have no user session — the caller is another organization's server — so a bearer credential this practice issues at onboarding is the ON...
The quality measure model, and the row that makes it useful
MeasurePatientResult is the point of this commit. A practice shown "67% controlled" can do nothing with it; a practice shown the 41 NAMED patients in the denomi...
Give Service Work its first five rights
ServiceType.SERVICE(28) shipped with zero rights, so its nine endpoints were gated only by whether the caller had a session. Ids start at 268 rather than the p...
Bulk FHIR export and C-CDA, and the rights that gate them
Two things a practice cannot operate without, and neither is a bigger version of reading a chart. BULK EXPORT (clinical/bulk). The FHIR Bulk Data model: a job,...
Count DISTINCT events across a rollup's owners
A phone number can be a contact point on more than one owner at once, and two leads on one account sharing one is the ORDINARY case — they are commonly the same...
Map LINE_WINDOW_ENABLED on MemberVoipConfig
The per-member gate for the dedicated softphone line window. Version pin stays at 1.6.0 — adding a field needs no bump, and a split pin would break CI for every...
Carry the assignee into the account rollup, over a LEFT join
Reading a lead's communications is gated on who it is assigned to. A rollup that returned uids alone could not apply that gate, so the account timeline built on...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.