Live Change Log

Review found the org guard was a no-op on the common empty-list case for the by-id waivers/validations reads (which the MLOS service does not org-filter), leaki...

- The base GET/POST /api/security/lead-imports had NO Next proxy route.ts (only sub-paths did), so Past Imports fetch (and the import POST) 500'd at the Next ...

available-summary now resolves the member's allotment and skips the product when suspended BEFORE the free-for-all short-circuit, and available() gates creditOk...

findApplicableAllotments filtered 'AND la.isActive = true', so getMostSpecificAllotment returned a less-specific ACTIVE fallback (or nothing) when a member's sp...

SecurityService's BulkTextSmsClient (password-recovery + account-settings SMS) has always POSTed **************** to /api/bulktext/send, but the controller was ...

parseInt() rounded lead ids past JS MAX_SAFE_INTEGER, so the backend looked up a nonexistent lead and returned 404, surfacing as 'Failed to create post' on the ...

Lead IDs are CRDB unique_rowid() values that exceed JS MAX_SAFE_INTEGER. The frontend now sends leadId as a string; parse both String and numeric forms so findB...

The member column and filter showed raw ids because the name map was built from /api/security/members, whose CockroachDB Long ids serialize as JSON numbers and ...

The assignment card passes `canReassignManually ? startEditAssignment : undefined` to EditableCard.onEdit, but onEdit was typed `() => void` (required), failing...

- disable Start Import / Back and show a spinner + 'Importing…' while the import POST is in flight, preventing duplicate submissions on large files - remove [...

- dedup via scoped LeadRepository query instead of findAll() over all tenants (was an OOM/DoS + cross-tenant exposure risk, re-run per 1000-row batch) - cap i...

- **************** scoped, projection-only duplicate lookup for the manual importer (replaces a per-batch findAll() that hydrated every lead across all tena...

Without columnDefinition, Hibernate copies members.id (INT8 DEFAULT unique_rowid()), so CockroachDB backfilled existing leads rows with bogus member ids on ALTE...

Once a domain was SSL-confirmed, checkDns unconditionally built a new domain object even when sslConfirmed was already true. The new object reference re-trigger...

listFolders and other read endpoints threw IllegalStateException from MailContext.toMailCredentials() when a member had no IMAP credentials provisioned, which t...

LabelManager derived orgIdStr from getOrgIdString() (precision-safe) with a fallback to String(organization.id). organization.id is a JS number and silently tru...

- Add kamo.minio.region (MINIO_REGION, default us-west-ca-s-1) so SigV4 signatures match the server's enforced site region; fixes background upload and sett...

MinIO now enforces MINIO_SITE_REGION (us-west-ca-s-1) in the SigV4 authorization scope since site replication was enabled. The client was built without a region...

Track failed background image loads and filter them out of the Swiper carousel, so an incompletely provisioned theme (e.g. optionone, whose bg/2.webp was never ...

In the existing-subscription update path of provisionCompSubscription, set trialExpiresAt to null so a previously trialling org is cleanly promoted to comp with...

Save now stages new uploads to incoming, then commits the full desired order (existing-by-srcIndex or new-by-token) so reordered existing images are re-slotted ...

Reordering only re-uploaded new files to their new index, dropping reordered existing images and leaving imageBgCount claiming unpopulated slots; provisioning t...

getOrganizationById returned a bare null, which Spring serialized to HTTP 200 with an empty body; clients calling response.json() then threw 'Unexpected end of ...

Pairs with the SecurityService change that now returns 404 for a missing org instead of 200-with-empty-body. Callers already null-check the org, so both the pro...

The cross-org gate returned 403 when orgId != session org and the caller had no Member row in the target org. The platform-wide System User operates across ever...

- org/[id] proxy: backend returns 200 with an empty body for null orgs; response.json() threw 'Unexpected end of JSON input' -> spurious 500. Parse defensiv...

Static metadata.title rendered 'Kamo' server-side; Next re-asserted it after hydration, overriding DynamicMetaLoader's client update and flipping the tab back f...

ag-grid renders rowData beneath the loading overlay, so gating only the loading prop still flashed all leads while getMemberId() was 0. Blank the rows and stay ...

- Default agentFilter to __MYSELF__ at init + gate grid on userInfo load so it no longer flashes All Leads - Single market: auto-select it and hide the market-t...

Opening a doc for a non-kamocrm tenant failed with 'unauthorized WOPI host'. Docs's alias_groups only trusted api.kamocrm.com (the Docs-deployment env hardcoded...