Update EMAIL_VERIFICATION sample vars to match current template
Use expiryText instead of expiryMinutes (renamed variable), and update verifyLink to point to the register subdomain (correct send path).
Prevent double-wrapping of full-document bodyHtml in block designer
When bodyBlocks is null and bodyHtml is a full <!DOCTYPE html> document (e.g. canonical seeded templates), importing it as a single block caused serializeFullEm...
Pass human-readable expiry time to email verification template
Add humanizeMinutes() helper that formats minutes as days/hours/minutes (e.g. "1 day" for 1440 min). Pass as {{expiryText}} to match updated canonical template ...
Improve email verification template — URL fallback, expiry text, subject
- Add plain-text verification link below button as copy-paste fallback - Switch expiry variable from {{expiryMinutes}} to {{expiryText}} for human-readable fo...
Restore verification page layout by zeroing hidden input dimensions
MUI Box interprets numeric width/height values 0–1 as percentages, so width:1 made the hidden input cover the full card. Changed to 0 so the input is invisible ...
Preserve DB domain case in NoReply from address
Removed toLowerCase() — the domain already comes from resolvePrimaryDomain which reads org_domains from the database, so case is canonical from DB.
Serialize full email HTML with outer frame on template save
- serializeFullEmailHtml wraps inner blocks in the branded outer frame (header logo, title/subtitle, content area, footer logo + org name) using absolute UR...
Add branded outer frame to email-verification canonical template
Wraps inner content with a proper email shell: header with org name, padded content area, and footer. Uses {{orgName}} as the identifier.
Add code-based email verification path to /verify-email endpoint
The endpoint now handles both token (link click) and userId+code (manual 6-digit entry). Token path unchanged; code path hashes the supplied code and matches ag...
Token link auto-verifies and redirects to login; add code focus indicator
- /verification?token=xxx now calls verifyEmailByToken on mount and redirects to login on success; falls back to code entry on failure - Active code box shows...
Lift *** widget above click-to-focus overlay (z-index)
The overlay (position:absolute, z-index:0) was covering the Capcha widget because it appeared later in DOM order. Adding z-index:1 to the *** container lets poi...
Remove nonexistent postfix-lmdb package, install lmdb library instead
postfix-lmdb is not a valid Alpine package; lmdb support is built into the base postfix package. The pod was CrashLoopBackOff due to apk failure.
Add weekly image prune and journal vacuum CronJob for k1m1
CronJob runs every Sunday 3am, privileged, pinned to k1m1. - crictl rmi --prune removes unused container images - nsenter journal vacuum enforces 500MB cap - CI...
Fix Docs image registry, add Recreate strategy to coturn/postfix, increase qdrant memory
- Docs: fix wrong image registry (redis.kamo.svc... → **************** add Recreate strategy - coturn: add Recreate strategy to prevent rolling update port conf...
Compact editor header — remove large title/tabs, move actions to nav row
Removes the sticky header card (title, subtitle, Save/Cancel/Preview buttons, Edit/Preview tab bar) from EmailTemplateEdit to reclaim ~200px of vertical space a...
Require *** on verification page before each verify/resend attempt
*** is reset after every action (success or failure) so a fresh solve is required for each subsequent attempt.
Switch Postfix sasl_passwd from hash to lmdb format
Alpine postfix build does not include hash support — postmap and smtp_sasl_password_maps were silently failing, deferring every outbound relay attempt through s...
Redirect to /verification after registration instead of rendering inline
Keeps the URL accurate — browser shows /verification not /member.
Resolve root domain for NoReply from-address instead of bare subdomain
resolvePrimaryDomain() was returning the first domain entry (e.g. "www") which produced NoReply@www. Now prefers root domains (parent == null) so transactional ...
Populate all EMAIL_VERIFICATION template variables
Was sending only {token, code} — template also needs orgName, firstName, verifyLink, and expiryMinutes. Load org and user to build the full vars map, and resolv...
Update redirect from /resend-verification to /verification on register site
Add internal.auth.secret to EmailService configmap
InternalAuthFilter was rejecting all service-to-service calls (send, seed-org) with 503 because internal.auth.secret was unconfigured. Matches the same INTERNAL...
Redirect EMAIL_NOT_VERIFIED to register/resend-verification
Removes the inline EmailVerifyCard from the login page and all related state/callbacks. On EMAIL_NOT_VERIFIED, the user is now forwarded to **************** whe...
Add /resend-verification page for login redirects
Creates a standalone /resend-verification route that accepts ?email and ?userId query params, reusing PostCompletionScreen for a consistent email verification U...
Allow transactional send on port-25 relay and auto-seed missing templates
Port-25 SMTP (postfix) requires no auth — transactionalCredentials() was throwing ProviderUnavailableException when user/pass were unconfigured, blocking all ve...
Use subdomain-aware SQL to match findByDomain JPQL logic
Org domain lookup in resendVerification was doing an exact-match query that failed for subdomains stored as child records (e.g. 'api' with parent 'kamocrm.com')...
Set Host/X-Forwarded-Host so APIService resolves correct org
APIService overwrites X-Forwarded-Host with request.getServerName(), which reads from the Host header. Without an explicit Host header the K8s internal service ...
Correct EmailService URL port in configmap (4203 -> 80)
EmailService K8s service exposes port 80, not 4203. Verification emails were timing out on every registration attempt.
Redesign email verification screen + fix resend email bug
- PostCompletionScreen: full-page layout with animated org background, glassmorphism card, logo, visual 6-digit code boxes, success/verified states - resendVe...
Bypass JPA org lookup to avoid Hibernate cascade flush error
**************** triggers **************** which causes a Hibernate auto-flush. That flush fails because Organization.features was previously replaced with a pl...
Remove eager feature-loading from getOrganizationByDomain
Features are an org-level concern unrelated to most callers of this method (e.g. registration, login domain resolution). Force-loading them via setFeatures() re...
Mutate features collection in-place to avoid cascade orphanRemoval error
Calling org.setFeatures(newList) replaces the Hibernate-tracked persistent collection, causing JpaSystemException when any query triggers auto-flush in an open ...
Use getReferenceById to avoid cascade orphanRemoval flush error on registration
Loading Organization via findById inside @Transactional caused Hibernate to detect the features collection was de-referenced during auto-flush, throwing JpaSyst...
Resend verification using email not userId, forward X-Forwarded-Host
SecurityService /register/resend-verification expects email in the body, not userId (which the login error response never includes). Also forward X-Forwarded-Ho...
Match kamo-internal avatar storage — 3 sizes, MinIO, separate upload step
Crop dialog now produces three PNG blobs (50/150/350px) via canvas, identical to kamo-internal's AvatarManager. After registration returns userId, the blobs are...
Add register-photo endpoint for unauthenticated post-registration avatar upload
POST **************** accepts userId + file/fileSm/fileMd/fileLg without a session. Guards: user must be unverified and have no avatar yet, preventing abuse aga...
Replace EMAIL_NOT_VERIFIED error with rich verification card
When login fails with EMAIL_NOT_VERIFIED the login card is now replaced by a polished "Check your inbox" screen: animated envelope SVG with opening flap and flo...
Extend photo upload to support AVIF and SVG formats
Adds image/avif and image/svg+xml to the file input accept list and validation regex. Updates the hint label to list all six formats. kamo-internal already acce...
Add react-easy-crop photo editor to registration upload step
Mirrors the PhotoCropDialog from kamo-internal's AvatarManager: - crop dialog opens immediately after file selection - pan by dragging, zoom via scroll or slide...
Add dao.repositories to JPA scan so EmailTemplateRepository is found
Same pattern as KamoInitializerService — explicit basePackages overrides default scanning and must include every package that has repositories.
Pass upstream error body through security proxy instead of generic message
Previously returned {error: "Upstream error"} on non-2xx, losing the real error message from SecurityService. Now forwards status code and body directly.
Align registration field names and response shape with frontend contract
Frontend sends nameFirst/nameLast but controller read firstName/lastName, causing 400 "First name is required". Success response now returns {status, userId, al...
Replace Redis session caching with direct Java API fetch in org route
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.