Raise memory 1Gi→2Gi; pod idled at ~900Mi and OOM-killed during background uploads
Register mlos.notification JPA repos so SecurityService starts
EconsentService autowires DisclosureTextRepository **************** but that package was absent from @EnableJpaRepositories — the context failed to start, Crash...
Prepare-signin authenticates on api.<root> — the auth path can't resolve the myloan.* alias
Same constraint as in-cluster login: provider resolution keys on the canonical api host, not the portal alias, so a correct password still 401'd.
Preferred name fills AKA+first; pool entry publishes the realtime lead event
(1) The funnel's preferred name now writes nameFirstAKA AND stands in for nameFirst until the legal name arrives (owner rule) — it was landing on first name onl...
Weld the LO chain — portal leads enter the accept-lead pool; accepted LO survives conversion
(1) PortalLeadService routes a portal lead into the credit-based assignment pool (requiresAssignment=true) the moment it has a contact point — portal leads were...
Real soft-delete + reactivate-on-upsert for LOS connection; safe test-connection message
I1: view()/testConnection() now read via the shared-lib's active-filtered finder so a soft-deleted (market,provider) connection reads as "not configured" instea...
Fail the upload if resize fails (no full-size fallback)
Reverts the store-original fallback: if ConversionService cannot resize the image, return 422 instead of storing the full-size original (a huge image would then...
Fall back to the original image when resize fails
ConversionService can native-crash (libwebp-imageio SIGSEGV) or be unavailable, which made every member wallpaper upload fail ("Failed to process image" -> 500)...
Include both desktops in every SSO token, deep-link to the chosen one
Each token carried only its own connection, so the browser's reused json session lacked the other one -> opening Windows after Linux gave 'connection does not e...
Route borrower submit through the pipeline so it fires **************** (audit #3)
patchLoanFile's borrower submit (DRAFT->APPLICATION_TAKEN) now calls **************** instead of a raw updateLoanFile status set, so the submit produces the has...
Resolve session from X-***-Token header in CallerSessionResolver
The kamo-internal -> APIService BFF path forwards the session as the X-***-Token header, but the resolver only read the X-OTK attribute or the *** cookie — so B...
PatchLoanFile is no longer a status backdoor; unblocking a condition needs the underwrite right; clear cascades
**************** status changes are the pipeline state machine's job (POST /transitions enforces legal arrows + per-arrow role gate + open-blocking-condition ga...
Inject KamoDesktop SSO env directly + wire guac-sso into tracked k8s deployment
- @Value reads KAMO_GUAC_SIGNING_KEY / DESKTOP_PASSWORD from env directly (runtime application.yml is configmap-mounted, so property indirection wouldn't bind...
Borrower submit fires the Application-Taken side effects (doc checklist + notify)
The portal borrower submit is PATCH loan-file {statusId:2}, which bypassed the operator /transitions endpoint where the Application-Taken side effects live — so...
Borrower cannot escalate loan-file status or edit the URLA after submission
Two related borrower-authorization holes on the self-service app endpoints: - Privilege escalation (#2): patchLoanFile applied any statusId with no caller-ri...
Borrower self-create idempotency + orphan compensation; don't relay an empty checklist as success
MortgageAppController.create() borrower self-create branch: - Idempotency (#2): resume an existing owned DRAFT via findOwnedDraft instead of minting a duplica...
Revert securityProvider to self-pointing; self-heal member applied rights
Two prod issues from the securityProvider-mirror change: 1. Enter-as-System-Member failed with "No membership in the organization's security provider" for e...
Interpret lock LAST_EDIT_AT as UTC for epoch-millis expiry
dbNow() now returns DB-UTC wall-clock (now()::timestamp), so recover the absolute instant with toInstant(UTC) instead of the JVM default zone — keeps the browse...
File new accounts under the org of the domain, not kamocrm
/register bound the new member's org to the request Host, but the org signal never survived the hop: kamo-register proxies every signup to the shared api.kamocr...
Scope borrower's loan document-requirements to their own party
The enriched /document-requirements read authorized any party to the app and returned EVERY party's requirements, so on a joint loan a borrower saw the co-borro...
Per-party vault authorization + per-party notification routing
The account vault held documents per-PARTY (shared human) but authorized access per-ACCOUNT — two HIGH multi-human defects on a joint loan: - PII leak / lockou...
Pipeline per-transaction grouping was broken
TransactionSummaryDTO.loanUids carried LOAN-FILE uids, but the pipeline console keys rows on the APPLICATION uid — so grouping silently fell back to one row per...
Member-vault upload was broken (access_level NOT-NULL)
The account-level imaging path had never actually run (0 vault Imgs in prod): uploadDocument was passed accessLevel=null. Pass CONFIDENTIAL for borrower PII (ID...
Satisfy-across confused-deputy IDOR + account party self-heal
- HIGH: satisfy-across gated on the path partyId but fanned out over the DOCUMENT's own party downstream; verify the document belongs to the authorized party ...
Self-heal party links before enriched requirement read
listDocumentRequirements calls ensurePartyLinks so requirement rows always carry an accountBorrowerPartyId (the borrower upload/satisfy target).
Default-product set failed — HQL bulk UPDATE disallows the vendor→org join
setDefault used a bulk 'update LeadVendorProduct ... where p.vendor.id in (subquery)' — Hibernate bulk updates reject the implicit association join, so the call...
Borrower self-create = createBlank then stampOwnershipAndGet (two txs)
Sequence the borrower ownership stamp as a separate service call after createBlank commits, so the new borrower/declarations graph is flushed before the account...
Close residual cross-org existence oracles + cap WORM-bound JSON blobs
Adversarial-review findings MLOS-W-01/03/04: - the 404-normalized empty list envelope now echoes the request's identity keys **************** so unknown, fore...
Atomic claim before lead creation — prevent orphan pooled leads
social.lead.new can be processed concurrently (old + new SecurityService pod both hold a core-NATS subscription during a RollingUpdate → one publish delivered t...
Fail-closed tenant guard on underwriting waivers/validations
Review found the org guard was a no-op on the common empty-list case for the by-id waivers/validations reads (which the MLOS service does not org-filter), leaki...
Gate FFA acceptability on suspension in available-summary + available
available-summary now resolves the member's allotment and skips the product when suspended BEFORE the free-for-all short-circuit, and available() gates creditOk...
Accept leadId as string in createPost to preserve CRDB id precision
Lead IDs are CRDB unique_rowid() values that exceed JS MAX_SAFE_INTEGER. The frontend now sends leadId as a string; parse both String and numeric forms so findB...
Correctness, scale & PII hardening in LeadImportController
- dedup via scoped LeadRepository query instead of findAll() over all tenants (was an OOM/DoS + cross-tenant exposure risk, re-run per 1000-row batch) - cap i...
Set site region + use node-local MinIO per pod
- Add kamo.minio.region (MINIO_REGION, default us-west-ca-s-1) so SigV4 signatures match the server's enforced site region; fixes background upload and sett...
Trial banner signal is org-level (all members of a trialing org), not seat-based
Retry boot-time rights sync on transient DB unavailability to avoid CrashLoopBackOff
Stop cross-org background image leak; order-safe reorder + staging bucket
Reordering only re-uploaded new files to their new index, dropping reordered existing images and leaving imageBgCount claiming unpopulated slots; provisioning t...
Return 404 for a missing org instead of 200 with empty body
getOrganizationById returned a bare null, which Spring serialized to HTTP 200 with an empty body; clients calling response.json() then threw 'Unexpected end of ...
Let the System User resolve any org's applied model
The cross-org gate returned 403 when orgId != session org and the caller had no Member row in the target org. The platform-wide System User operates across ever...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Canonicalize webhook repo name to public-projects casing
After the cluster migration the Forgejo repos were recreated lower-cased (securityservice), but historical rows and the public-projects filter use canonical cas...
Generate favicons via multi-node logo read, not single-node exists()
generateAndUploadFavicons() gated on minioService.exists(), which only stats the current MinIO host. When the simple logo was written to (or only replicated ont...
Expose GD (god eligibility) in /user-info for kamo-universe
The session stores the GD flag (KSessionService) but /user-info never returned it, so kamo-universe's KamoIdentity always deserialized is_god=false and the god/...
Case-insensitive email lookup so reset emails send
Password recovery lowercased the input but findByEmailEmail does a case-sensitive match against the stored email (e.g. Sage@KamoCRM.com), so the user was never ...
Carry impersonation audit trail across org jumps
When the caller is already an impersonation session (a god admin acting as another member, carrying SUDO_MEMBER_ID), entering another org from /network minted t...
Select the SUBSCRIPTION market for platform setup
KamoCRM owns several markets **************** so resolveProductMarket must pick the SUBSCRIPTION-type (platform-access) market rather than the first active one....
Regenerate favicons on labeling save; sniff real logo type
provisionUpdate (run on every custom-labeling save) wrote config/css/manifest but never regenerated favicons — those were only produced by provisionFull. An org...
Seed globals.css from template when org folder lacks it
provisionUpdate (run on every color save) rewrote the org's css/globals.css in place, but that object only exists once provisionFull has copied it from the defa...
Detach before replacing features collection in /org/domain
The previous fix wired the applied-model projection into **************** but called org.setFeatures(projected) on the still-managed entity. The Organization.fe...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.