Server-side paging for the member assignment listing
The member surface asked for MAX_SIZE unconditionally and sliced the result in the browser, so a grid that showed a page had already downloaded a whole employme...
Personal Email Notifications card replaces the Notifications tab
Both switches move onto My Profile in the same shape as the password card: one card, an icon tile and help text per row, and a tinted inset that appears only wh...
Expose the user-account email on your own member profile
The profile's Personal Email Notifications card has to name the address missed-message notices actually reach, and that address is the user account's — not the ...
Accounting & Finance permission group and finance-right access to account settings
The Access Security and Administration groups existed only in SecurityRoleManager as inline name lists, so JobTitleManager, DepartmentManager and RolesPermissio...
Migration for the commission ledger and Stripe payout tables
Mirrors com.kamo.z.shared.commission. ddl-auto would create these from the annotations anyway; the explicit DDL is the house convention and is what makes the sh...
Seed the finance rights onto every branch model's ADMINISTRATOR template
The three commission rights gate a feature that did not previously exist, so NEW_RIGHT_SEEDS deliberately says nothing about them - that mechanism carries an ex...
Team-member commission ledger and Stripe payout domain
Adds com.kamo.z.shared.commission: an append-only signed ledger, a per-member balance row that exists purely to serialize concurrent withdrawals, the Commission...
Fold MFA into the password card and drop the Sign-in Security tab
Two places asked one question — how do I get into this account — so the second factor now lives beside the password on My Profile, in a card retitled "Password ...
Suggest the org's own mailboxes, aliases and shared mailboxes
The recipient autocomplete only knew contacts and addresses scraped out of the Sent folder, so the organisation's own addresses — everything managed on ********...
One mailbox view, and a column that is all list
The Conversational/Classic toggle is gone and every member gets the classic list. Conversation view carried its own list, its own thread pane and its own API su...
Expose contact email in the by-department roster
The Interaction Center needs a member's address to pre-fill a composer, and the only endpoint that carried one was the single-member detail fetch — one request ...
Email a member straight from their row
The row's action dock could chat, meet, dial and open a profile — the one thing it could not do was start an email, so reaching a colleague by mail meant leavin...
Daily legal-package reminder tick
DaemonService owns the tick because DocsService cannot. DaemonService is strategy:Recreate — the old pod is gone before the new one starts, so a deploy window c...
Due-date reminder ladder and the batched, read-only sweep
The bucket is a pure function of (dueDate, today) and never of "when we last sent": UPCOMING_D{n} for the configured offsets, DUE_TODAY, then PAST_DUE_P{floor(d...
Tell the member — assigned, voided and completed
ONE hr.package_assigned per member per package, never one per document: that is what suppressInvite exists for, and 8 documents x 200 members is 1,600 envelopes...
Outbound email client and a Redis notification ledger
Idempotency with NO schema change. The reminder bucket is a pure function of (dueDate, today) and never of "when we last sent", so the only durable state a noti...
DocsService's first inbound internal-auth filter
DocsService has no service-to-service authentication: ResourceServerConfig is anyRequest().permitAll() and OTKPreAuthFilter CONTINUES the chain when X-OTK is ab...
Four canonical HR legal-package templates
hr.package_assigned, hr.package_reminder, hr.package_voided and hr.package_completed, as {json,html} pairs plus four CANONICAL_KEYS entries. The CONSTANT is no...
Signature button with a live legal-package badge
Hand-written into the fixed left cluster between My Profile and Log out. NAV_REGISTRY cannot express a position between two fixed controls and its badgeKey fiel...
Live pending-package count over the EXISTING chat socket
LegalPackageCountContext consumes **************** rather than opening a fourteenth STOMP connection for one integer, and subscribes to **************** — the d...
Relay the legal-package count and guard per-member SUBSCRIBEs
legal.packages.> -> **************** core NATS, no stream — the same shape SupportStompRelayController and PlatformStompRelayController already use. topicFor is...
Proxy the member's pending-package count
A static segment sibling to [uid] so App Router matches it first. PATH ONLY — forwardToApi owns the query string — and one upstream call, because the OTK is sin...
Serve the caller's own pending-package count
GET **************** through memberGuarded() and the identity funnel. No memberId and no orgId parameter — both come from the session, because an id in a path i...
Emit the badge count on every transition that moves it
Four sites: delivery (none -> PENDING), void (open -> VOIDED), redelivery (open -> SUPERSEDED) and finish (open -> EXECUTED). Each passes the status it read BEF...
Publish the member's open-package count to core NATS
Connection.publish on legal.packages.{memberId}, NOT NatsMessageService: that service pins .expectedStream(CHAT_MESSAGES) in both publish and publishSync, so a ...
Give the executed-package repair an actual button
POST **************** existed upstream and was tested, but nothing in the product could reach it: no proxy route, no helper, no button. Every failure branch in ...
Forward the login host so recovery can resolve the org
Password recovery now accepts a member's primary mailbox address, which only names an account within one org. This proxy reaches SecurityService over cluster DN...
Accept a member's primary mailbox address as a login identifier
The address a member gives out is usually the org mailbox flagged Primary on their member settings, not whatever is on their user account — so typing it into th...
Download the executed package from the grid and the member's own page
Both surfaces go through the LEGAL endpoints, keyed on the assignment, not /api/imaging/download/{imgId}: that path additionally needs organization.isDocs and V...
Draw non-image attachments with the document manager's file-type icons
A staged .docx or .xlsx was a grey MUI outline with the extension lettered underneath — a shape invented for the tray, and one that says less than the icon the ...
File after Finish, repair from HR, and download BY imgId
Filing is queued AFTER COMMIT and OFF the request thread. Finish is @Transactional in a service that also serves WOPI; holding a connection across N ESigService...
File the merged executed package into the member's own library
uploadDocument takes the SUBJECT'S Member, so Img.organization and Img.createdByMember derive from them and HR ends up having filed a document the member owns. ...
Say what is too big, instead of "Failed to send email"
A draft that outgrew the send endpoint's limits produced one flat line of red text after the whole payload had been uploaded — or, when the body itself was the ...
Gate each Human Resources tab on its own right
Overview needs VIEW_OVERVIEW, Attendance MANAGE_TIMECARDS, Legal & Compliance MANAGE_LEGAL_AND_COMPLIANCE, Training MANAGE_TRAINING and Resources MANAGE_RESOURC...
Enforce MANAGE_LEGAL_AND_COMPLIANCE on the package endpoints
LegalPackageAccess mirrors the Legal & Compliance tab gate, and that tab is now gated on one right of its own instead of VIEW_EMPLOYEES || EDIT_EMPLOYEES || MAN...
Carry existing HR holders onto the new per-tab rights
A right that gates something already reachable is a removal of access: new rights insert as NOT_SPECIFIED, so the /hr tabs would have vanished on deploy for eve...
One security right per Human Resources tab
The /hr tabs were gated on whichever pre-existing HR right happened to be an OR-term in the front end: Attendance opened on VIEW_SCHEDULES, Training on VIEW_EMP...
Measure a draft against the send limits before uploading it
A body carrying inline base64 — HTML pasted from a web page, a forward's quoted content, a signature's images — can pass the per-part ceiling on its own. The se...
The executed package certificate and the ordered merge
The certificate carries the package, the frozen version, the subject, the moment and address of execution, the attestation wording verbatim and both digests the...
Expose the content-addressed store so chat attachments can dedup
Chat attachments never went through the hashing pipeline — they wrote a private "<imgId>/<fileName>" object per upload, so the same file attached three times oc...
The two byte sources for the executed artifact
LegalPinnedPdf extracts the frozen-digest rule out of the member read path so the wizard and the filed artifact read the SAME bytes through the SAME check — con...
Member legal-compliance page and the package execution wizard
**************** is gated on identity (memberID === getMemberIdString(), compared as STRINGS because getMemberId() is lossy past MAX_SAFE_INTEGER) and includes ...
Member execution proxy routes and the pure wizard model
Eight 1:1 routes: /api/docs/legal/member/** through forwardToApi (PATH ONLY — forwardToApi owns the query string) and /api/esig/member/** direct to ESIG_SERVICE...
Port the kamo-signer signing core into kamo-internal
Every @kamo/* package is private:true with exports:"./src/index.ts" and no build step, so there is no publishable artifact — the files are copied and rewired on...
Mount the member surface at /api/docs/legal/member/**
A separate controller with a separate funnel, because authorization here is identity and not an HR right. Routing these through guarded() would mean either lock...
Package attestation on finish, and the EXECUTED/AWAITING_OTHERS split
Writes the WORM LegalPackageAttestation: attestationTextSha256 from the FROZEN version (the package's draft wording is mutable and may already have been reworde...
Identity-authorized member read surface for assignments
LegalAssignmentOwnership is a SEPARATE guard from LegalPackageAccess on purpose: a member executing their own agreement holds no HR right, and widening the HR r...
Manifest canonical form and a spoof-resistant client IP
manifestSha256 hashes the ordered [{documentUid, contentSha256, orderIndex}] the member was actually shown, length-prefixed so a crafted uid cannot imitate a fi...
Staff-authenticated member signing surface at /api/esig/member/**
OTKAuthFilter bypasses only /actuator, /api/esig/public and /api/esig/internal, so this prefix is behind staff OTK auth with orgId/memberId already on the reque...
Assigned Packages sub-tab and deliver/redeliver/void actions
AG Grid Community over a MUI-paginated fetch — Community has no server-side row model, so the server pages and the grid renders exactly what it was handed. The ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.