Resolve ambiguous /org/domain handler — Commerce nav was disappearing
SecurityController had a second **************** that collided with **************** Spring rejected the request with "Ambiguous handler methods mapped" → 500 →...
Add /me/language endpoint that bypasses SystemUserGuard
The NavTop language picker did nothing for the System User signed into a sub-org: PUT **************** runs SystemUserGuard first, which 403s every System-User ...
Never gate Kamo-owned subdomains on TXT ownership
Child orgs that picked a Kamo web alias (e.g. gnosia.demo.kamocrm.com) were getting "TXT record found but verification code doesn't match" in the DNS setup UI. ...
Grant top-level org owners cross-org delete/update access
deleteDomain and updateDomain previously rejected platform admins operating on child-org domains because they checked isUserOwnerOfOrg against the target org di...
Allow deleting per-org *.kamocrm.com subdomains
The endsWith(".kamocrm.com") guard blocked every demo org from swapping its platform subdomain (e.g. gmosia.demo.kamocrm.com) for a custom domain. The platform ...
Propagate child-org-creator admin status to parent-org membership
When a user creates a child org they become its owner + admin (via **************** Their PARENT-org membership, however, is whatever it was before — typically ...
Mint owner OTK with grant-all rights without DB round-trip
After **************** assigns the Administrator role and writes member_rights_applied, the OTK-minting block was re-reading those rows via **************** ins...
Allow elevated access on getDomainById and verify-dns endpoints
Top-level org owners and system members were getting 403 on getDomainById and verify-dns because those endpoints checked isUserMemberOfOrg directly. Adds hasEle...
Allow top-level org owners and system members to manage any org's domains
Prevent duplicate root domains and fix primary domain display
ONE_DOMAIN_PER_ORG check incorrectly excluded .kamocrm.com web-alias domains, allowing an org to accumulate multiple root domains (and 10 aliases each) by retry...
Reduce org creation latency and fix translation cascade failures
- OrganizationController: replace ensureTeamMembersForAllOrgs (full org table scan) with ensureTeamMemberForOrg (single org) — eliminates the ~400ms×N DB ro...
Auto-assign first seat, Free as floor, broader org invalidation
BillingSetupService now activates the first open license slot for the creator when seeding a sub-org subscription (and same for promote-to-billing-owner) — othe...
Top-level org members get platform-owner plan, bypass billing gates
KamoCRM (top-level) org members are not subject to the billing system — they get the OWNER_UNLIMITED plan's feature matrix outright (with Free as a defensive fa...
Update OrgThemeProvisionServiceTest for buildConfigJson description parameter
Prioritize real first/last name over usernameAlias for display
usernameAlias is functionally a login handle (often equal to username), not a display name. Real human-readable names live on User.name (EmbNameFull). Apply to ...
Resolve display name with correct priority in by-department endpoint
Priority: member.usernameAlias → user.name.formatFull() → user.alias → user.username
Serialize Long as string to prevent JS precision loss on large CockroachDB IDs
Remove duplicate CorsFilter bean causing double Access-Control-Allow-Origin header
The explicit CorsFilter bean caused a second CORS filter alongside Spring Security's built-in CORS support (which uses CorsConfigurationSource). Both filters re...
Allow system user to manage org branding and fix logo auth
- Add system user bypass as first guard in canManageOrgBranding so platform system user has full branding control over all non-parent orgs - Fix uploadLogo en...
Surface real reason behind GoDaddy 400 error
GoDaddy now returns HTTP 400 with code=UNABLE_TO_AUTHENTICATE and body "Bad Request : Bad Request" when an account does not meet their current production Domain...
Eager-load domains via findByIdWithDomains, drop @Transactional
@Transactional on a controller method keeps a DB connection open across the entire MinIO upload, and also risks LazyInitializationException if the inner getOrga...
Upload directly to public/{domain-folder}/img/ instead of staging bucket
The uploadLogo endpoint was writing to a hardcoded 'sumtingwong' placeholder (unfilled setting) instead of the org's actual public theme path. Logos now go dire...
Remove downed k2m1 node from edge-nodes default
k2m1 (10.8.2.1) is permanently down. Leaving it in the failover list caused upload retries to hang until the new OkHttp timeout fires. Default is now k1m1-only;...
Enforce /network enter rules server-side
Reject when target is current session org, custom domain SSL is not confirmed, or human target membership is inactive. Share domain-setup logic with my-networks...
Require destination memberId and validate org membership
Enter-as now always builds the new *** with the client-supplied target member row; reject mismatched org/member. Improve session debug logging.
Enter-as session uses target org security provider and optional targetMemberId
Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-do...
Resolve system-user session from OTK for BFF requests
SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never s...
Enter-as resolves session from X-OTK BFF auth
EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.
Return only team members from by-department endpoint
Interaction Center should list TeamMember rows, not base Member records.
Apply subscription gate to app routes and feature API
AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...
Harden default template copy for org provisioning
Use explicit source prefix for destination keys, skip S3 folder markers, and fail fast when the template prefix is empty so silent partial copies do not reach g...
Include teamMember owner flag in *** for platform admin UI
Store teamMember { memberId, isOrganizationOwner } in Redis session at login so kamo-internal hasPlatformAdminAccess can satisfy the top-level org owner path. E...
Drop mail from required DNS CNAME aliases
Remove mail from KnownAliases so verify-dns and onboarding no longer require mail.example.com; new custom domains also skip auto-creating the mail child alias.
Parse session orgID and userID when stored as strings in AppliedModelController.
Correct applied-model source and normalize compliance in API
Use resolver resolution for BRANCH_TYPE vs MASTER instead of inferring from branchTypeID alone. Normalize FALSE/TRUE compliance literals in applied-model settin...
Propagate master model compliance and age rules to branch-type security models
Write globals.css before cleanup; run cleanup async
Reorder provisionUpdate so writeConfigFiles (colors, config, manifest) runs before background file cleanup. Reload org from DB for fresh colors. Run cleanupExt...
Apply committed org colors to MinIO globals.css
Reload Organization from the DB at the start of async provision so writeConfigFiles sees colors saved by PATCH /colors (controller snapshot could be stale). Nul...
Mark DNS-verified custom domains as isDefault in domain API
Previously only *.kamocrm.com subdomains were marked isDefault, so orgs with a verified custom apex domain (e.g. kamocrm.com) always got defaultDomain=null and ...
Allow branding when user is org owner TeamMember
Theme provisioning and logo/background uploads only checked Organization.owner FK; the app UI treats organization owner as TeamMember.isOrganizationOwner, which...
Clear user and member FKs before deleting avatar row
Deleting an avatar failed with a DB constraint when it was still the active user avatar or a member-specific override, which matched broken MinIO blobs where us...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.