An IMAP/SMTP connection test must not be usable as a network probe
POST /api/email/member-imap/test and /{id}/imap/test connected to whatever host and port the caller supplied and returned the raw exception message. Any authent...
Alias, domain and personal-mailbox admin actions need a management right
create/delete on an email alias, **************** on the org's sending domains, and **************** on a personal (self-hosted) mailbox all needed only a sessi...
A member's mailboxes and aliases are only readable inside their own organization
GET **************** took no HttpServletRequest at all — no session, no org check anywhere on the path — and GET **************** checked that the CALLER had a ...
A calendar export or import must be one the caller can actually open
GET /export/calendar/{id} and POST /import/{calendarId} took the calendar's UUID alone — no HttpServletRequest, so no session, no org or member check at all. An...
SearchService marks its injection constructor, so the service starts
9809d4b gave SearchService a second constructor (a clock, for tests) and marked neither, so Spring chose neither, looked for a no-argument constructor, and the ...
Search that honours its query, and every mail action on the mailbox that is open
Two problems on /messages, fixed in the service. Search did not work. The index path threw a ClassCastException on every hit (Instant -> Timestamp, visible in ...
Shared-mailbox **************** need a management right
**************** on /api/email/shared-mailboxes needed only a session — any authenticated member could create a shared mailbox, delete one, or grant themselves ...
An OAuth state token is a server-side record, not a blob the browser hands back
/api/email/oauth/callback and **************** are public and sessionless (the provider redirects the browser here with no Kamo session), so `state` was the onl...
A From override must be an address the caller may send as
POST /api/email/send took request.getFromAddress() straight into the header From and the SMTP envelope sender **************** -> EmailSmtpService.send, and the...
Aliases and shared-mailbox access name their members as text
GET and POST /api/email/aliases (and /aliases/member/{id}) and GET and POST **************** answered with the entities themselves, whose Long memberId and gran...
Saving a calendar/contacts integration never blanks or drops its stored credentials
A contact integration's credentialsJson was replaced by whatever a save sent. The org CalDAV/CardDAV tab sends all four server fields (empty — they never show w...
A shared mailbox's access list is only readable inside its own organization
GET **************** called **************** which read the access rows for any mailbox id. Every other access operation (update, delete, grant, revoke) loads t...
A person taken out of a drip stays out
The engine moves on up to 200 due people per drip from copies it read at the start of a pass, up to 25 seconds old by the time each is used. Meanwhile a member ...
A drip's People counts follow the search, so All is always the sum of its chips
Stop refreshing a mailbox grant no app can refresh, and say it needs reconnecting
An org connected Microsoft 365 through Kamo's platform app; the platform app was later switched off and the org has no registration of its own. The resolver the...
Every refused request says why, not just campaign calls
2a72597 gave the campaign controllers the member's sentence instead of "Bad Request". The same loss happened everywhere else in EmailService that refuses with a...
A refused campaign call says why, instead of "Bad Request"
CampaignService refuses with a ResponseStatusException carrying a sentence written for the member ("Pause the campaign before deleting it.", "Only paused campai...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Saving a campaign no longer fails with "Restart read required"
The bulk-provider row (hosts, send window, warm-ups, campaign audiences) was read inside callers' longer transactions. A campaign save writes the row's audience...
The organization owner can open the opt-out list
A brand-new right is granted to nobody on the day it deploys, so a list gated only on MANAGE_EMAIL_OPT_OUTS would ship visible to no organization. The owner hol...
Name the sender once at the top of the preference page
With a logo, the name is its alt text and is not written out again beneath it; without one, the name is the header. It was shown, and read aloud, twice.
The opt-out list only names contacts from organization books
A member's personal address book is theirs; the org-wide opt-out list must not become a way to see whose private contacts include someone.
Every campaign is sent as the org's bulk sender, and its From never pauses it
A campaign's own from_email/from_name are no longer read: the From is always the address and name on Settings > Email > Bulk Email Sender (else the org's NoRepl...
Startup checks for the one-address-per-campaign index instead of creating it
EmailService ran CREATE UNIQUE INDEX on every startup. DDL on this cluster costs every service about fifteen minutes of "schema version mismatch", too much to r...
Review fixes to the provider blob, delivery reports and test send
The provider blob is always written in a transaction of its own, so its lock query stays the first statement and a lost lock race can be retried even when a cal...
A from the platform relay would refuse pauses the campaign instead of failing its recipients
Failing the recipients made every one of them contacted, so once the From was fixed the campaign could never send to those addresses. The send path now checks t...
The platform relay is recognised by one host-and-port check everywhere
Refusing an off-domain From matched the relay by host and port, while the warm-up's delivery tracking and the test send's advice matched by host alone, so a pro...
Live campaign progress reaches browsers on every replica
The STOMP broker is in-heap per pod and progress is raised on whichever pod holds the dispatch lease or received a delivery report, so browsers on the other pod...
The smtp envelope sender is set to the bare from address
Campaign mail now carries a display name in its From, and the relay it goes through accepts only its own sender domain, judged by MAIL FROM. mail.smtp.from is n...
A missing mailing address no longer blocks sending
assertSendable refused to schedule or send a campaign without a physical address. The org's address still goes in the footer when it has one on file; when it ha...
A hold'em invitation is gated on the right to play hold'em
HOLDEM_INVITE was in neither the gated nor the ungated map, so it shipped ungated and failed the test that exists to catch exactly that.
A line break in a sender's display name can no longer start a header
Jakarta Mail encodes commas, quotes and non-ASCII in a display name but passes a raw CR/LF through, so displayedAs now flattens control characters to spaces bef...
The NoReply recorder names the constructor Spring should use
It has two, the second for tests, and with neither marked Spring picks neither: the context failed with "No default constructor found" and took EmailSmtpService...
Template logos come from a live theme host
resolveLogoUrls built the logo URL from the org's first domain whatever its state, so an org still setting up its domain got a logo URL that could not be fetche...
A notification raised on the wrong pod reached nobody
The broker here is enableSimpleBroker — in-heap, per pod, no relay — and this deployment runs two replicas. MemberNotificationService published straight into it...
The last two durable consumers become queues, and contact sync reaches every pod
The mail relay was one of four NATS subscriptions on a plain durable consumer. A plain durable admits exactly ONE subscriber, so at two replicas the second is r...
A bulk mark-read announces itself, so the nav badge follows it
The single-message endpoints have always published the mailbox events that move the nav badge and reload the other tabs. The three batch endpoints — flags, move...
Every pod relays the mailbox push, so the unread badge moves again
The browser's email relay bound a DURABLE NATS consumer named after the member ("email-ws-<id>"). A durable push consumer admits exactly one subscriber, so with...
A service may change a meeting's link, and the room is told
updateEvent restated the title, description, location, colour, timezone and deep link, and dropped meetingUrl — so a link added to a callback that had already b...
A preference PUT was resetting every setting it did not mention
Reported as "when I enable repeating sound it does not save". It saved. Then the next preference the member touched turned it off again — and the settings page ...
A meeting link can be set, not only read
meetingUrl has been on the entity, in EventDto and in meetingSignature for as long as the dialog has existed, and nothing could ever write it. EventRequest did ...
The join link reaches the guest's calendar, not just their inbox
An invitation carried its meeting link in the html body and nowhere else, so a guest who accepted it on Monday and opened their calendar on Friday had no way in...
Watch a mailbox for the phone, not only for the browser
An IMAP IDLE listener is the only thing that notices a message arriving; it publishes email.inbox.<addr>, which is what eventually asks MediaService to buzz a p...
Give the bug-status preview the denial block it now renders
SystemBugStatusEmail pre-renders two conditional blocks, and the admin preview has to supply both. Present and empty rather than absent: an unsupplied placehold...
A catalog bump emptied the sweep instead of failing it
Both reads the sweep depends on already sat inside a catch that logs and carries on, so a Yugabyte conflict never surfaced as an error — it surfaced as a tick t...
Prove the deploy by digest, not by tag
The previous commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and the...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Stop one member reaching another's calendar integration, and stop the endpoints handing out the credential
Two defects on the /settings/integrations/member endpoints, both live and both reachable by any signed-in member. The id was the only access control. Every /me...
Create a subfolder under its parent, not beside it with a dot in its name
createFolder joined a parent to a new folder's name with a hardcoded ".". On Gmail, which separates its hierarchy with "/", that produced a top-level folder lit...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.