Read session rights as list or legacy CSV for member endpoints
KSessionService and SecurityRoleController store rights as List<String> of RoleRightType names. MemberSecurityController cast to String and split on comma, caus...
Verify-dns checks every KnownAliases label; skip deprecated app/media in optional
Sync SUBDOMAINS with product DNS aliases (add apps, sign; remove media)
Align KnownAliases with DNS and auto-cert (add mail, play, apps, sign; drop app, media)
Remove kamo-capcha-widget node_modules from repo
Drop tracked files under **************** so the tree matches a clean install (dependencies belong in package lock, not git).
Show live state with changelog link and daily count
Replace preview countdown and signup copy with a compact "Now LIVE" callout, keep the changelog link, and always show today’s change count from the API after it...
Security role save for locked roles and clearer API errors
- When isAllowEditSecurity is false, omit rights and securityModelIds from the PUT body so SecurityService accepts metadata-only updates (session timeout, d...
Proxy PATCH membership-type to SecurityService
The member profile UI called **************** but no App Router handler existed, so Next returned HTML 404 and the client showed Unknown error after failed JSON...
Persist RoleRightType by stable getId() instead of ordinal
Hibernate @Enumerated(EnumType.ORDINAL) writes/reads the declaration-index of the enum. When a RoleRightType value is removed (e.g. MANAGE_USERS, id=19), every ...
Avoid transaction-poisoning DDL and harden multi-pod races
The previous self-heal put DDL inside a @Transactional syncAll(). When an ALTER TABLE ADD CONSTRAINT fired on an existing constraint (normal case after first bo...
Make RoleRightsSyncService fully self-healing on every boot
Adding or removing a RoleRightType must never again require running KamoInitializerService. syncAll() now runs three phases on every startup: 1. Heal constrain...
Drop stale CHECK constraints on default-role-rights enum columns
Hibernate auto-generates CHECK (column IN ('VAL1', 'VAL2', ...)) constraints on CREATE TABLE for @Enumerated(EnumType.STRING) columns, freezing the enum's value...
Add missing unique constraints for role-right upserts
**************** + syncSecurityModelRoleRights use `ON CONFLICT (role_id, right_type) DO NOTHING` and `ON CONFLICT (default_role_id, right_type) DO NOTHING`, wh...
Add unique constraint on (role_id, right_type) in OrgRoleRight
Required for ON CONFLICT DO NOTHING in **************** Without this constraint, the sync query fails with "no unique or exclusion constraint matching the ON CO...
Remove getType() calls from OrganizationController after OrganizationType removal
Remove deprecated OrganizationType enum
The enum is being retired — identification of the platform-owner org is now driven by the new Organization.isTopLevel flag, and the remaining values (CRM_CLIENT...
Add Platform Administration settings — org plan grants, events, plan catalog
- New pages under /settings/platform (guarded by hasPlatformAdminAccess): - /organizations — list every org, grant/modify/revoke COMP plans with reasons - /...
Add PlatformAdmin controller + service for comp plan grants
- PlatformAdminController at /api/billing/platform (class-level @PlatformAdminOnly) - GET /orgs, GET /orgs/{orgId} - POST /orgs/{orgId}/grants, PATCH|DELET...
Seed Organization.isTopLevel for kamocrm and OWNER_UNLIMITED self-comp plan
- DataLoader: drop OrganizationType arg from createOrg, set isTopLevel=true on kamocrm - KamoCRMAgeReqUpdateRunner + test: match on IS_TOP_LEVEL = TRUE instead ...
Stop overwriting member avatar with logged-in user's avatar on profile view
fetchAvatars fetched /api/security/avatars (no memberID scope — always returns the logged-in user's avatars) and called setActiveAvatar, clobbering the correct ...
Add Organization.isTopLevel, PaymentMethod.COMP, COMP_* event types; remove OrganizationType enum
- Organization: replace dead `type` field with `isTopLevel` flag for platform-owner identification - PaymentMethod: add COMP for complimentary platform-admin gr...
Add missing sync-rights proxy route
POST /api/security/roles/sync-rights was missing a Next.js proxy handler, causing the Sync Rights button in Security Roles settings to always fail.
Set orgOriginal on registration and expose isOriginalOrg in my-networks
Use PublicChatVisitor displayName for requestorName on visitor tickets
Visitor-initiated tickets hardcode requestor to the org system member, so the DTO was surfacing the org owner's name in the Requestor column. Fall back to the P...
Member-requestor support rights gating and dual-mode ticket view
- NavTop: show SupportButton for any support right (agent or member) - SupportButton: gate each dropdown item by right — Create/View Tickets, Request Webinar,...
Add member-requestor support rights (133-136)
Adds four new SUPPORT-scoped rights for non-agent members: - **************** (133) - CREATE_SUPPORT_TICKET (134) - REQUEST_WEBINAR (135) - VIEW_MY_SCHEDULED_WE...
Add Sync Rights button to SecurityRoleManager for top-level orgs
Button is only visible when organization.hasParent is false. Calls POST /api/security/roles/sync-rights then reloads the roles table.
Gate Support/Settings by rights, fix Network copy, loading on tab switch, nav divider
- Network card: updated description to use dynamic branch title label - Support card: fixed 404 by changing href /help → /support; gated by isSupport + VIEW_SUP...
Extract RoleRightsSyncService and add sync-rights endpoint
- RoleRightsSyncService: centralizes role rights sync logic for both OrgRole and **************** tables; startup and on-demand - DataLoader: delegates to Rol...
Make role rights DTOs enum-driven and add security model rights sync
- SecurityRoleDTO.fromOrgRole(): enumerate all RoleRightType values with DB settings as lookup — new rights appear with NOT_SPECIFIED automatically - ********...
Add membership type chip and promote/demote to Membership Status card, remove session timeout field
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.