Seed the calendar widgets to everyone who can already read the calendar
Both widgets show a member exactly what /calendar already shows them, so a calendar reader gains no data they could not reach — which is what makes this a safe ...
Annotate the member roster with its chat policy verdict
SecurityService serves the roster the chat UI is built from, so it has to answer with the same verdicts MediaService enforces with -- one shared evaluator, or t...
Ask EmailService to back-fill a lead's past e-mail
Implements the shared library's LeadEmailBackfillTrigger, so ticking "Associate Past E-Mails w/ Lead" on a lead save reaches the only service that can read mail...
Accept a reservation raised for another agent
POST **************** now honours onBehalfOfMemberId, gated on EDIT_OPPORTUNITIES — the right that gates managing opportunities on the reserved list, and alread...
Publish Hibernate statement counts to Prometheus
/actuator/prometheus already carried jdbc_* and hikaricp_* but no hibernate_*, because Spring Boot 3 only auto-configures those metrics when **************** is...
Return each member's accepted-today count per product
Manage-Credits shows Max Daily Spend but nothing about how much of it is used, so a manager could not tell whether a member was one lead from their cap or had n...
Mint a System User session for a support agent's open ticket
enter-as gains a second reason to say yes. SystemUserEntryPolicy turns the caller's *** into the facts the shared SupportSystemAccessResolver takes, and that re...
Map companyName so a spreadsheet can carry the business name
setDirectFieldOnCreateRequest had no companyName case, so the field was unreachable from the manual-import wizard even though CreateLeadRequest carries it and L...
Accept the discount* signup fields, keep the mrt* ones working
The register site now sends discountVisitorGuid / discountCode. Both names are read, new first, because the two services deploy independently — for the minutes ...
Publish signup and org-created for tracked visitors
The register site now forwards the marketing visitor GUID and tracking code in the request body — not a header, because the proxy strips Cookie and the ingress ...
Enforce is_fake, and close the holes that let an unattended signup in
Two halves of one incident. An account registered, verified an address at a disposable provider, took an auto-login session and created five organizations in th...
Let a member give up their own membership
The network page has offered "Unsubscribe" since it was written. It opened a confirmation dialog and then said the feature would be implemented soon, because th...
Per-member SSO credentials and a preflight that explains failures
Linux is gated on an enabled provision rather than god, and served with the member's own credentials. The connection is omitted from the token entirely when the...
Dev machine service and controllers
Username derives from the member ACCOUNT email, not the TeamMember work email — a work address can sit on another domain and would silently produce a different ...
HTTP client for the dev machine provisioning agent
health() swallows transport failures and answers false so the SSO preflight can return an actionable 503 rather than a 500.
AES-GCM secret codec and POSIX username derivation
Codec is deliberately reversible — RDP auto-login needs a real password — and uses GCM so a tampered or wrong-key row fails loudly rather than decrypting to noi...
Send int64 ids to the browser as strings, without touching sessions
CockroachDB unique_rowid() ids are 19 digits, past Number.MAX_SAFE_INTEGER, so an id sent as a JSON number arrives in the browser with its low digits rounded aw...
Resolve the KamoMeet logo overlay into config.json
KamoMeet is a Meet fork with no access to OrgContext, so it learns org branding from the theme config.json this service bakes. The org stores an overlay TOKEN; ...
Narrow the member search to holders of a given right
The lead assignment picker needs the directory to return only people who can actually work a lead, so /team-members/search takes a requiredRight. An unrecognise...
Let the creator choose the new org's apps
The network-create wizard gains an Apps & Features step, and this is the half that makes it real. /branch-types/creatable now describes the apps each branch ty...
Protect god accounts on the platform administrator list
A god account's platform rights may be changed only by another god, and a god account can never be removed from the list — by anyone, including another god. Go...
Bake the org's background order into config.json
kamo-login, kamo-register, the marketing site and KamoMeet all read the theme bucket's config.json for backgroundImageCount; backgroundOrder now rides alongside...
All-networks follows the System User right
Seeing every organization and being able to enter one are the same decision — the list exists so an operator can find the organization they are about to support...
Enforce platform rights on every platform surface
@RequirePlatformRight + PlatformRightInterceptor replace three hand-rolled "is the caller a top-level-org owner" gates that were copies of each other, one per p...
List, rename, retire and stream uploaded sound effects
Bytes arrive through ConversionService (which owns ffmpeg and the scanner); everything afterwards is here, where the session and the scoping rules already live....
Read and write the three layers of the event-sound stack
GET returns all three layers in one round trip plus what the caller may edit — every settings page needs the whole stack, because an org administrator editing t...
Normalise member overrides against the hierarchy
Member direct rights now go through RightsHierarchy.normalizeLevel before they are persisted: a granted child pulls its ancestors up to GRANTED at the member le...
Callback summary for the leads list marker
Answers which leads have a call still waiting, and when the soonest one is due, for the caller's organisation in one request. Its own endpoint rather than a fie...
A callback that leads back to the lead
The callback already reached the member's calendar, as an event titled "Lead Callback" with their comment in the description. Nothing said whose call it was, no...
The authorization boundary for payroll provider setup
Relays the new **************** surface and enforces who may reach it. TimecardService holds the engine and no session; this holds the session and decides. Secu...
Relay the punch void
Passthrough for POST /punches/{id}/void, the editor's delete key and the machinery behind merging two adjacent spans. Same authority as /correct, and for the s...
Relay the editor's period range
Passthrough for GET /members/{id}/range, the period graph's read. from/to are forwarded only when present so TimecardService can resolve the member's own pay pe...
Account history endpoints, real member rows, an all-members directory
The account view can now say what has happened to an account and who is on it. - Every mutation on the account surface records history: create, field edits, ...
Attendance summary for the HR Overview
One MANAGE_TIMECARDS-gated call composing the roster and manager-queue relays with the local exception, employment and pay-period rows.
Relay enrollment
MANAGE_TIMECARDS to read or change who is on timecards — enrollment decides who gets paid from this system, so it is held to the HR administrator right rather t...
Relay the exception queue
MANAGE_TIMECARDS to read the queue and to waive, because the queue names every member with a problem and waiving changes what the finalize gate reads. The per-m...
Relay bulk operations and attendance
The bulk approval role is DERIVED here from the caller's rights and appended to the path — never read from the body. A body-supplied role is a body-supplied pro...
Relay the compliance reports, evidence pack on identity
The org-wide reports need MANAGE_TIMECARDS. The evidence pack does not, when a member pulls their own — and that is the point. The pack is what an employee need...
Relay the timecard configuration surface
MANAGE_TIMECARDS to read the org's rules — the workweek and rounding settings describe how everyone in the org is paid — and FINALIZE_PAY_PERIODS to change them...
Relay the editor, authorized by identity before rights
An EMPLOYEE may correct their own record — that is the point of the editor, and refusing it leaves the employee with no way to say the clock was wrong about a d...
Sign former employees in to a restricted tier instead of refusing them
A team member whose employment is not ACTIVE was refused at the door with "Your account exists but is not active at this time." That was the wrong shape. A term...
Approval-tier relay with role resolved from rights
THE ROLE IS DECIDED HERE, from the caller's rights and their relationship to the subject -- never from the request body. A body that could name its own role wou...
SecurityService relay to TimecardService
The authorization boundary. TimecardService holds the data and the engine but no session; this holds the session and decides who may do what, then relays. The e...
GET ****************
timezoneService.ts has called this endpoint since it was written and it existed in no Java service; the client swallowed the 404 and resolved to UTC. Meanwhile ...
Gate promotion on the owner's policy, make it idempotent, add its inverse
Promoting a member to pay for themselves was unconditional, one-way and unsafe to repeat. It now refuses when the organization's policy says the organization p...
Expose the fail-open impact to the operator
The app catalog page already answers the org-independent question — does any plan mention this app — and raises a warning when none does. This answers the tenan...
Carry availability, presence and extension on a directory row
Picking a person is easier when the row says whether they are there and how to reach them, so each one now carries what they last declared, whether anything of ...
Resolve what a member may do, not just what their plan includes
Feature grants describe a plan. They never described this member, because the console gates navigation on org-level org.features — so a member with no license a...
Point at YugabyteDB and use PostgreSQLDialect
CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...
Measure the thumbnails and tracks generated from each file
Object keys are content-addressed as **************** so the segment before the first underscore identifies the file a derivative came from. Sizes are summed pe...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.