A god-mode window is open only until its stamped end (SessionPlatformFacts)
godModeActive() now also needs godModeExpiresAt (epoch millis, number or string) to be after now. SecurityService masks an elapsed window only for its own gates...
The endpoint ratchet sees @RequireRight; the org-graph ratchet allows two read-only hits (SITP TPGUARD)
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor ...
Deleting an application that must be kept shows why instead of doing nothing (SITP TP21FU)
SecurityService now answers 409 for a received mortgage application (a record of business, withdraw it instead). The delete handler had no catch, so the rejecti...
Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)
DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now ...
Every clinical audit row names its patient; pick up the shared-lib audit and updated_at fixes (SITP TP23FU)
Production phi_access_log rows from the clinical audit methods carried no purpose, basis or patient: the shared PhiAccessRecorder dropped them while stamping th...
Clinical audit rows keep purpose/basis/patient; updated_at stamped on every save (SITP TP23FU)
PhiAccessRecorder stamped occurredAt by rebuilding each event from a field list written before the clinical columns existed, and no caller sets occurredAt, so e...
Deleting a mortgage application no longer 500s, and a received one is kept (SITP TP21FU)
DELETE **************** failed for every application: AppMortgageService.delete removed the borrowers through the JPA cascade while borrower_declarations / borr...
The deploy-safety audit accepts a reasoned 'spread' exemption for a node-pinned Deployment
Every KlusterServices deploy since run #337 ended red on kamoai-voice (3 replicas pinned to k3m1 by nodeSelector, so no hostname spread is possible). The rule h...
Mlos_update_section keeps what the call does not give (SITP TP21 live smoke)
The loan, property, declarations, military and row saves replace their whole section in SecurityService, so a partial edit would have cleared the fields it left...
Kamo_app is a NOLOGIN group role; services log in as kamo_app_202610
The YugabyteDB application password was exposed (com.zaxxer.hikari DEBUG in ten services' logs, and securityservice's committed diagnose-output.txt), so it was ...
Starting a clinical note no longer fails on updated_at (SITP TP23 live smoke)
ClinicalBaseEntity.updated_at is NOT NULL and defaulted by the database on INSERT only (insertable = false), so a note just inserted holds null in memory and th...
Booking an appointment no longer fails on an untyped null in the conflict check (SITP TP23 live smoke)
findConflicts' (:excludeId IS NULL OR a.uid <> :excludeId) with a null UUID is an untyped parameter on Postgres/Yugabyte ('could not determine data type of para...
The Canva routes take the right of the screen that calls them, not just a session (SITP TP23)
CanvaController checked only that a member was signed in: anyone in the organization could drive its Canva round trip (create, list, export, import, brand templ...
A booking or registration is always a new record in the caller's practice; SI note drafts say so; billing reads write the PHI trail (SITP TP23)
- SchedulingService.book: the body is the entity, so a uid in it made save() a merge onto that appointment in ANY practice (and moved it into the caller's); s...
A loan record's dateUpdated is a UTC instant too (SITP TP22 live smoke)
The live smoke answered loans_get_state_rule and loans_history with dateCreated as a UTC instant and dateUpdated as KamoLOS's offset-less text; both are now ins...
Reports_save_view does not answer empty settings for a view it just saved (SITP TP16 live smoke)
SecurityService answers a save without the view's stored request (the list carries it), so the tool said parameters {} for a view saved with parameters. A view ...
Never seed devices. anywhere under kamocrm.com
ccd50be skipped the devices sibling only when the parent WAS kamocrm.com, so a child-org web alias host **************** seen live) still queued ***************...
A broken servicing rule answers 409 with its own words, not a 500 (SITP TP22)
The services refuse with plain exceptions (offer must be DRAFT to send, draw would exceed credit limit, reason is required, an unknown id's orElseThrow), which ...
The proxy settings live in HA's storage, promoted, not in YAML
Since 2026.10, Home Assistant migrates a YAML `http:` to its storage once, as a PENDING config. It reverts that config and restarts unless an admin promotes it ...
A loan offer is drafted only on the organization's own product and borrower, the aging report counts only its loans, and staff acts are the organization's (SITP TP22)
- POST /api/los/offers: the product must be the caller's organization's and the borrower a member of it (or of a child organization); a body naming another te...
A template above the caller's clearance cannot be read or sent, and a staff employment offer takes an HR right (SITP TP19)
The envelope door already hid an envelope whose template sits above the session's clearance and an EMPLOYMENT_OFFER envelope from a member without an HR right, ...
A scheduled report reaches a colleague who signs in on another domain (SITP TP16 live smoke)
reports_schedule judged a colleague by the organization's mail domains alone, so in sp00verify the owner's own sign-in address was refused as an outsider. A rec...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
Binders_create sends what CreateBinderRequest reads; scripts_create names a market by its leads_list_markets id (SITP TP14 live smoke)
DocsService refused every binders_create: CreateBinderRequest's primitive isTemplate binds as "template", so the body's isTemplate was an unknown field (400). A...
Billing accounts answer to VIEW_ORG_BILLING / MANAGE_ORG_BILLING, and the listing shows a member only their own (SITP TP02)
BillingService authorized 'own account or organization owner' and never consulted a right, so the owner could not hand billing to an administrator or an SI. Acc...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Email templates and the org calendar/contacts connection take MANAGE_EMAIL_SETTINGS (SITP TP02)
EmailTemplateController and EmailTemplateCategoryController checked a session alone: any member could list, read, preview, create, edit, archive, duplicate or r...
An RSVP from a member with no mailbox says so (409 NO_MAILBOX), not a bare 400 (SITP TP12 live smoke)
KamoLOS checks the PLOS right and the organization on every route, and opens a one-time-key door (SITP TP02)
KamoLOS enforced no right: kamo-internal's /api/los proxy was the only gate. LosRightsFilter now applies the proxy's own requiredRight() table (LosRights) to ev...
The Interaction Center and the hexheads stand aside for a guided tour too
Follow-up to 2363d832, which cleared the dock windows. Two more surfaces could still sit in the spotlight: - The Interaction Center. A tour step (Online Meetin...
Sending for signature takes EDIT_DOCUMENTS and reading a template takes VIEW_DOCUMENTS (SITP TP02)
POST /api/esig/envelopes (create and send) checked no right, so any org session could send any template out for signature; it now takes EDIT_DOCUMENTS, the righ...
Chat_send_file posts a text document DocsService typed octet-stream as text/plain (SITP TP13)
DocsService records Markdown, YAML, logs and other text without an ImageMimeType as application/octet-stream, which chat's attachment allow-list refuses. A docu...
Review steps stay in the caller's organization; pins take VIEW_KB_ARTICLES (SITP TP14)
submit-review, approve and reject named an article by guid alone, so a member holding CREATE_/REVIEW_KB_ARTICLES in one organization could move another organiza...
Binders and the share lists take VIEW_DOCUMENTS (SITP TP14)
Every BinderController route (list, get, create, scratch, update, duplicate, delete, items, reorder, shares, render) took a session alone, so a member without V...
Webinar booking checks its rights and the type's organisation; an SI brings SIs into its own meetings (SITP TP12)
Owner decision 5 (security gaps fixed with the tools that use them): - /api/webinar: booking (available types, bookable times, a type's sessions, schedule, join...
/imaging/download answers its bytes again instead of 500 (SITP TP13)
Since d1a8762 the download body was a StreamingResponseBody inside the method's ResponseEntity<?>. Spring hands a StreamingResponseBody to its streaming handler...
Lead callbacks take MANAGE_LEAD_CALLBACKS, as SecurityService now does (SITP TP10, after TP01)
Files_upload sends the type and digests ConversionService checks (SITP TP13)
ConversionService detects a file's type from its bytes and name and refuses a declared type that differs, then compares the client's Blake3 and SHA3-256 digests...
Files_upload files into My Docs by its ordinal (SITP TP13)
ConversionService refuses an upload whose metadata names no assocType (values()[assocType]), and its own no-metadata default (4) is MEET_RECORDING's ordinal. fi...
Rights on the session-only controllers, with the grant backfill (SITP TP01)
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session ...
The quick-insert lists and renders templates through VOIPService's members' door (SITP TP11)
/api/voip/sms/templates is X-Internal-Auth only, so no browser session reached it and the popover always listed nothing. /api/voip/sms/text-templates takes the ...
Rights on the lead doors the SI tools use, and the caller's own callbacks due (SITP TP10)
- PUT /leads/{id} takes EDIT_LEADS; a create that assigns someone else takes ASSIGN_LEADS - the lead pool (/leads/available, /leads/accept) takes VIEW_LEADS or ...
One's own text numbers need the Phone tab's rights, not a bare session (SITP TP11)
ACCESS_VOIP, or MANAGE_EXTENSIONS / MANAGE_VOIP_SETTINGS: the rights settings/member opens its Phone tab on, so nobody who sees the card today loses it.
The members' text-template door refuses flat {error, code, reason} (SITP TP11)
The shape every member-facing VOIPService refusal has, so the Tool Plane and the browser read the reason without unwrapping a nested object.
A shared-mailbox send meets the SI guards; message labels take ?folder= (SITP TP13)
A send as a shared mailbox skipped the checks EmailController#sendEmail runs: an own-domain recipient that is nobody (422 RECIPIENTS_UNKNOWN), the SI thread-tur...
IotConnectionCheck is append-only without @Immutable (every link failed with a 500)
Hibernate 6.5 reads the database-generated checked_at back after the INSERT and then sets a lock mode on the entry; an immutable entry refuses it **************...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.