Allow org admins to open other members account pages
Expand client redirect guard beyond **************** to include CONFIGURE_SYSTEM, EDIT_MEMBER_ACCESS_LEVEL, ALLOW_PROMOTING_MEMBERS, organization owner, and pla...
Reload ThemeLogo after config and cache-bust logo URL
ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...
Show subscription context on Allowed Apps in branch types
Load billing subscription and plan metadata like the Apps tab; gray out rows and show an info alert when a default-on policy would not activate without an eligi...
Apply subscription gate to app routes and feature API
AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...
Gate app effective enable on subscription and plan features
Add **************** to resolve Stripe or commerce subscriptions and match SubscriptionPlanFeature to ServiceType names. AppliedModelEnforcementService now requ...
Treat any COMP subscription as full access on Apps tab
Gate on paymentMethod COMP for all orgs, not only top-level platform owner, so child orgs with complimentary grants see unlockable toggles.
Expose commerce subscription on GET /subscriptions/current
When no Stripe mirror row exists, resolve the org active commerce SubscriptionRecord (e.g. COMP grants), include paymentMethod and plan features. Fixes Apps set...
Drop stale commerce_subscription_events event_type CHECK for COMP events
Explicit CHECK for subscription event_type including COMP variants
Run GrantDialog plan useMemo before conditional return (React hooks order)
Preserve int64 org id on create-org redirect to DNS setup
POST /api/security/org: pass through upstream JSON instead of re-parsing, so response bytes keep full id digits. createOrganization reads raw body and extracts ...
Harden default template copy for org provisioning
Use explicit source prefix for destination keys, skip S3 folder markers, and fail fast when the template prefix is empty so silent partial copies do not reach g...
Union listObjects across nodes for complete key sets
The first reachable MinIO node could return an empty listing while other nodes held replicated objects, which broke recursive copies such as theme template sync...
Include teamMember owner flag in *** for platform admin UI
Store teamMember { memberId, isOrganizationOwner } in Redis session at login so kamo-internal hasPlatformAdminAccess can satisfy the top-level org owner path. E...
Stop duplicating query string in access-logs API proxy
forwardToApi already appends the incoming request search string. Embedding ?params in the path produced malformed URLs and Spring failed to parse page/size (Num...
Drop mail from required DNS CNAME aliases
Remove mail from KnownAliases so verify-dns and onboarding no longer require mail.example.com; new custom domains also skip auto-creating the mail child alias.
Align required subdomain list without mail
Match SecurityService KnownAliases for DNS setup UI and manual guide.
Gate behavior labeling on applied-model ready; avoid permissive defaults on fetch error.
Parse session orgID and userID when stored as strings in AppliedModelController.
Honor security model for ages and ATF on behavior labeling
Parse boolean compliance literals from the API. Build age dropdowns from normalized whitelist tokens and numeric AgeReq ids; avoid showing the full age list whe...
Correct applied-model source and normalize compliance in API
Use resolver resolution for BRANCH_TYPE vs MASTER instead of inferring from branchTypeID alone. Normalize FALSE/TRUE compliance literals in applied-model settin...
Applied model source resolution and compliance policy normalization
Expose resolveAppliedModelWithSource so callers know whether the active model came from the branch type or master fallback. Map FALSE/TRUE/0/1 compliance litera...
Propagate master model compliance and age rules to branch-type security models
Fetch branch type security model with JOIN FETCH for applied model resolution
Cache-bust theme CSS and assets via themeRevision
Fetch config with no-store; append v=themeRevision to globals.css and favicon URLs so browsers drop stale cached theme after each provision.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.