System-config + platform-overview endpoints
Platform-wide configuration surface, gated by the existing top-level-owner guard (matches SystemUserConfigController's requireTopLevelOwner pattern). Endpoints...
Add GET /api/security/org/all-networks for platform admins
Top-level org owners can now fetch all organizations in the system with membership info relative to the caller. Orgs where the caller has a member record get is...
Alias visibility filtering + auto-verify subdomain ownership
OrganizationController: - Web-alias org creation now auto-marks ownershipVerified=true and isDnsVerified=true on the created OrgDomain — no TXT record needed ...
Org-level config, GoDaddy client, and web-alias org create path
Wires the new Subdomain Branches feature end-to-end on the backend: - SubdomainBranchesController for org-level enable + GoDaddy creds (live-verified) - GoD...
Explicit team status + name prefix/suffix catalogs
- GET **************** now returns namePrefixes and nameSuffixes, sourced from NamePrefixType and NameSuffixType so the Add Member / Add Team Member forms d...
Make email + legal name optional for under-13 signups
The /api/security/register endpoint previously rejected any request missing email, first name, or last name. That made the under-13 path (KIDS_ONLY orgs, or ALL...
Backfill, enter-as flow, mutation guards, config API
Self-heal provisioning: SystemUserBackfillService runs on every SecurityService boot (from DataLoader) to add the is_system_user column and system_user_access t...
Collect phone + security questions during signup
Move phone-number and security-question collection into the self-service registration flow (where they were originally intended) rather than requiring a post-si...
Add Member / Add Team Member creation flow
- New MemberCreateController exposes: * GET **************** — age-req, timezone, departments, job titles * GET **************** — debounced existence che...
Add EntitlementService + SecurityModel commerce markets
- EntitlementService computes per-member feature grants by unioning active BillingGroupLicense plan features + KamoCRM Free-tier baseline. Caches 15-minute ...
Interaction Center member line uses job titles
Replace RBAC role title with jobTitleOfficial, fallback to JobTitle catalog title for TeamMember, and the label Member for base Member records in the by-departm...
Expose and persist jobTitleOfficial for team members on profile and member-security APIs
ThemeRevision in config and cache headers on theme assets
Emit themeRevision (epoch ms) in config.json on each write; set Cache-Control on config, globals.css, and site.webmanifest uploads so edge caches revalidate.
Expose ATF compliance policies on models and creatable branch types
- OrganizationController applies model enforcement before age assertions - SecurityModelController and MasterModelController pass policy fields - BranchTypeCont...
Align KnownAliases with DNS and auto-cert (add mail, play, apps, sign; drop app, media)
Make RoleRightsSyncService fully self-healing on every boot
Adding or removing a RoleRightType must never again require running KamoInitializerService. syncAll() now runs three phases on every startup: 1. Heal constrain...
Set orgOriginal on registration and expose isOriginalOrg in my-networks
Extract RoleRightsSyncService and add sync-rights endpoint
- RoleRightsSyncService: centralizes role rights sync logic for both OrgRole and **************** tables; startup and on-demand - DataLoader: delegates to Rol...
Add theme provisioning — NATS publisher, provision-theme endpoint, logo upload
Add GET /branch-types/creatable and /{id}/usages endpoints
/creatable returns branch types filtered by the caller's creator-type (OWNERS/TEAM_MEMBERS/MEMBERS) via AppliedModelEnforcementService. /{id}/usages returns th...
Add GET /branch-types/creatable endpoint with creator-type filtering
Returns only the branch types the calling member is permitted to create a child org under, based on their OWNERS/TEAM_MEMBERS/MEMBERS classification against the...
Gate /network child-org creation by right + member-type applicability
Wires the applied-security-model child-org creation gate end-to-end: - SecurityModelController + MasterModelController round-trip the three new apply-to flag...
Applied-model is the read-time source of truth for feature availability
Closes the "stale DB leaks a disabled feature" gap by gating every surface that touches OrgFeature / ServiceType through the applied security model. - ********...
Wire applied-model enforcement across every controller
Every non-role setting on the applied security model is now enforced at the exact controller boundary it governs, and the scalar settings round-trip cleanly thr...
Enforce system-role assignment and auto-admin for team-member owners
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requ...
Master-model + applied-model endpoints and template-aware org seeding
Adds the controllers that surface the new branch-type security flow: - /api/security/master-model (GET/PUT) manages the current org's master model; only writ...
Supplement session rights with all known rights for grant-all roles
Add SSE endpoint for real-time email verification + improve welcome email logging
Add resetCode to password reset email, add emailVerifyByCode endpoint, send WELCOME_MEMBER after email verification
Pass human-readable expiry time to email verification template
Add humanizeMinutes() helper that formats minutes as days/hours/minutes (e.g. "1 day" for 1440 min). Pass as {{expiryText}} to match updated canonical template ...
Add code-based email verification path to /verify-email endpoint
The endpoint now handles both token (link click) and userId+code (manual 6-digit entry). Token path unchanged; code path hashes the supplied code and matches ag...
Add register-photo endpoint for unauthenticated post-registration avatar upload
POST **************** accepts userId + file/fileSm/fileMd/fileLg without a session. Guards: user must be unverified and have no avatar yet, preventing abuse aga...
Add GET /api/security/geoip/me for client IP country lookup
Reads real client IP from X-Forwarded-For / X-Real-IP headers, does a GeoLite2 lookup, and returns { country_code, country_name }. Used by kamo-register's count...
Implement SP4 email verification and registration wiring
- Delete legacy email/VerificationEmail.java (hardcoded SMTP stub) - Add **************** (mirrors recovery package pattern) - Add **************** — token gene...
Add AccountSettingsController + Service for phone + security questions (SP3)
Allows logged-in users to set/verify phone and configure 3 security questions. Routes to /api/account/* (session-authenticated via KSESSION_DATA).
Add BulkTextSmsClient + EmailTemplateServiceClient + PasswordRecoveryController (SP3)
Full password recovery flow: email-link, SMS OTP, security questions, seed phrase. Routes to /api/recover/* (unauthenticated). Uses SP1 email pipeline + VOIPSer...
Wire EmailTemplateSeedClient into ****************
Thin RestTemplate client that POSTs to EmailService's **************** after an org + owner TeamMember are persisted. Retries twice with backoff; failure throws...
Add public known-aliases endpoint for kamo-nowww build-time bake-in
Add analytics → analytics text replacement in changelog sanitization
Redact tokens ≥32 chars in changelog sanitization
Any word (run of non-whitespace) that is 32 characters or longer is replaced with **************** before titles and descriptions are sent to the translation se...
Generate TXT verification token on domain create, check in verify-dns
- createDomain: generate 32-char UUID token and store via setVerificationToken - verifyDns: check _kamo-verify TXT record for kamo-site-verification=<token> - T...
Update required aliases — add app, capcha, docs, sign; remove legacy
Add /setup/dns backend — one-domain enforcement, SSL probe, new aliases
- Enforce one custom domain per org in POST /api/security/domains - Add capcha, docs, sign to standard aliases; remove legacy aliases - Update verify-dns to tra...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.