Let a RingCentral member sign in instead of minting a JWT
A member's phone-settings tab asked for a JWT credential, and that was the only way to connect them. A RingCentral JWT belongs to one user and is minted by that...
Tell a RingCentral JWT from the app credentials pasted into its box
An org pasted its RingCentral app's credentials JSON — the {"clientId": …, "clientSecret": …, "server": …} blob the developer console shows on the same page as ...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Encode JustCall query values exactly once
The client built its query with build(true), which declares the values already encoded — so nothing was escaped at all. The character that matters is "+": every...
Apply FreePBX config after every write, or the extension never reaches Asterisk
Extension 8777 (Aiden Perry, kamocrm) was created from KamoCRM on 2026-09-02 and never rang. The FreePBX GraphQL `addExtension` mutation had written `users`, `d...
An account with no number to text from is a 409, not a 500
Starting a text threw IllegalStateException when neither the member nor the instance had an outbound number, which Spring turned into a 500 with a stack trace. ...
One source of truth for the platform settings
"Test connection" reported "no master account id" on a phone server whose provisioning had just succeeded, minutes earlier, using that same id. Two sources dis...
A half-provisioned phone server could never be finished, and said the wrong thing
An org's KamoPBX server has been reporting Error: Phone provider instance not found: **************** since it was created. The instance was never missing —...
Outbound external calls were missing from FreePBX call history
On an outbound external call FreePBX rewrites the CDR `src` to the trunk's outbound caller ID — the org's own DID — so a call ext 8080 placed to 9493747110 is r...
A recording whose bytes are gone answers 410, not 500
Same split as the imaging proxy and the docs download. A call recording that is not in storage is permanently not there, and a player handed a 500 shows nothing...
The extension sweep no longer erases every member assignment
MemberVoipConfigController.put writes an assignment to two places - MEMBER_VOIP_CONFIG and **************** - and **************** then cleared the second on it...
Give the text-conversations coder a tiebreaker so tied timestamps aren't dropped
lastActivityAt, so a conversation sharing that exact timestamp was excluded from the lost from the list permanently, not just misordered. Reachable in practice ...
Gate the voicemail nav count on VIEW_VOICEMAIL
**************** handed any authenticated member holding a MemberVoipConfig row the instance-wide unread-voicemail count with no rights check at all, even thoug...
Stop RingCentral OAuth signing white-label tenants out
Two faults, both on the same hop, and each one hides the other. RingCentral rejects every scope value this app can ask for — "invalid_request / Parameter [scop...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Working with voicemail takes a right, not just handling PHI
VoipVoicemailController required VIEW_CALL_LOGS on exactly one path — playback, and only when the organization handles PHI. Listing voicemails with their transc...
Isolate call ingest per row and link only after it commits
Two faults with one root: ingest participated in the sweep's transaction. A throw inside a participating transaction marks the SHARED transaction rollback-only...
Skip soft-deleted extensions in the call-history sweep
syncExtensions soft-deletes by flipping status to UNKNOWN rather than removing the row, so the list accumulates every extension an instance has ever had. Each o...
Close a cross-mailbox hole and six more Teams defects
Adversarial review of 6df0008 confirmed 24 findings. The important ones: CRITICAL — any member could delete a colleague's mail. Teams voicemail ids were compos...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
Guard /internal/voip with InternalAuthFilter as documented — it 401'd on session auth
VoipInternalSyncController always documented InternalAuthFilter as its guard, but /internal/voip was never in PROTECTED_PREFIXES nor excluded from the OTK sessi...
Constant-time internal-auth secret compare (timing oracle)
Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pa...
Return 200 allFalse for unconfigured org capabilities
GET /api/voip/capabilities threw ProviderNotConfiguredException (422) when an org had no phone provider, logging a red console error on every page load for phon...
Exclude /api/voip/sms/templates from OTK session filter
The doc-07 SMS template endpoints are session-less internal calls guarded by InternalAuthFilter (X-Internal-Auth), but OTKValidationFilter still ran on them and...
Implement POST /api/bulktext/send internal transactional SMS
SecurityService's BulkTextSmsClient (password-recovery + account-settings SMS) has always POSTed **************** to /api/bulktext/send, but the controller was ...
Build recording MinIO object key like imaging stream
Omit the extension when FILE_EXT is null/empty so the object name matches RecordingImagingService and ImagingController. Java string concat with null produced {...
Resolve call history extension from member_voip_config, not phone_extension
**************** was NULL for some extensions even when member_voip_config correctly mapped the member to their extension. Using member_voip_config (same source...
Surface imaging fallback when provider has no call history
KamoPBXProvider.getCallHistory now returns null instead of throwing **************** so the 501 response no longer bypasses the imaging fallback. The provider c...
Resolve member→extension before VM/CDR provider lookup
CallController was passing memberId where FreePBX (and other PBX-style providers) expect an extension number — voicemail listing returned empty because no PBX e...
Capture newExtNumber as final for lambda capture in MemberVoipConfigController
newExtNumber is conditionally reassigned inside the if (isVoipEnabled && ...) block, which makes it not effectively final. The TeamMember sync block reads it fr...
Don't wipe member assignment on sync from providers that lack metadata
**************** unconditionally overwrote PhoneExtension.assignedMemberId with whatever the provider returned. FreePBX (and any provider that doesn't track whi...
Use extensionId as external ID, not Relay node id
FreePBX returns the same Relay id (ZXh0ZW5zaW9uOg== = "extension:") for every extension because the id field is not populated. Using it caused all extensions to...
Rewrite all GQL queries/mutations against live schema introspection
Verified every field name and type against the actual FreePBX 17 schema. Full set of corrections: Queries: - fetchAllExtensions: remove non-existent 'voicemail...
Correct GraphQL field name to fetchAsteriskDetails
FreePBX API returns "Did you mean fetchAsteriskDetails?" — rename the health check query and its data path accessor accordingly.
Add XHR/Accept headers and String response parsing to GraphQL client
Same pattern as FreePBXTokenCache: add X-Requested-With + Accept: application/json to suppress FreePBX's HTML redirect responses, and switch all three call site...
Add Accept+XHR headers and raw-string response parsing for token endpoint
FreePBX was returning text/html when called via cluster DNS because the Host header didn't match the configured PBX_HOSTNAME. Adding Accept: application/json an...
Correct OAuth2 scope strings for FreePBX API
FreePBX scopes are top-level identifiers: 'gql' (all GraphQL) and 'rest' (all REST). The format 'gql:read' means GQL for a module named 'read', which doesn't ex...
Include com.kamo.z.shared.commerce in repository scan
Latest kamo-shared-library propagates **************** (donotmodify.dao.services) which has a constructor dependency on **************** **************** The se...
Bump kamo-shared-library to 1.4.0
Docker Stage 1 builds kamo-shared-library main (now 1.4.0) and installs it to the local .m2; the service pom still referenced 1.0.0 which Maven could not find, ...
Handle RC webhook validation token; make body optional for verification requests
Explicitly stringify Long IDs in SmsController responses
**************** Long-as-string approach was not taking effect. Directly call .toString() on all Long IDs in the controller flat-map responses to guarantee no J...
Serialize Long IDs as strings to prevent JS precision loss
CockroachDB unique_rowid() generates 64-bit integers larger than Number.MAX_SAFE_INTEGER (2^53-1). JS JSON.parse silently rounds them, causing conversation ID m...
Return flat map from send endpoint to prevent LazyInitializationException
VoipMessage.conversation is FetchType.LAZY; after @Transactional commits, Jackson serializing the entity would throw LazyInitializationException causing a 500, ...
Fall back to org mainPhoneNumber when member has no VOIP config
Members without an individual MemberVoipConfig (or no fromPhoneNumber set) now use the org's mainPhoneNumber from VoipProviderConfig as the outbound number, ins...
Remove getJwtKey() from WebhookController after OAuth migration
Signature validation used jwtKey as HMAC secret which no longer exists on VoipProviderConfig. Skip validation for now consistent with ****************
Use correct session key casing for orgID and memberID
KSessionService stores keys as orgID and memberID (capital D). Both controllers were calling .get("orgId") and .get("memberId") which always returns null, causi...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.