Invoice checkout sessions are unkeyed, like every checkout Session
A stable idempotency key would hand a returning customer the same, possibly expired, payment page ****************
Pay a subscription invoice by card on a Stripe-hosted page
Internal POST **************** creates a payment-mode Checkout session for the amount owed. It saves the card for future automatic charges when the customer has...
Cap only add-ons the organization holds
An add-on it does not hold is left to the existing entitlement gates, as before caps existed - paying organizations running a phone server without the add-on co...
License usage and per-unit license checks for per-user add-ons
Owner rule 2026-10-22: every per-user add-on bills the licenses purchased, like seats; how many mailboxes or extensions may be in use is limited only by them. ...
Internal card endpoints for subscription invoice auto-charge
GET **************** and POST /charge, guarded by the shared X-Internal-Auth secret (constant-time compare; 403 without it). A charge is an off-session PaymentI...
Stripe bills add-on licenses held, not mailboxes or extensions in use
Every add-on now takes its quantity from AddOnLicenses, the rule the order calculator and subscription invoices share: licenses bought, defaulting to the seat c...
Rebuild the Stripe mirror from Stripe nightly and on startup
Events older than 30 days cannot be fetched, so the September invoice and subscription events lost to the API-version mismatch are unrecoverable as events. Stri...
Read Stripe events from any API version, and replay the ones that failed
The live webhook endpoint renders events at 2026-03-25.dahlia; stripe-java pins 2024-12-18.acacia, so every invoice, payment and subscription event since has fa...
GodModeVerifier judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). windowOpen(session, memberId, now) asked the shared reader at the system clo...
Billing accounts answer to VIEW_ORG_BILLING / MANAGE_ORG_BILLING, and the listing shows a member only their own (SITP TP02)
BillingService authorized 'own account or organization owner' and never consulted a right, so the owner could not hand billing to an administrator or an SI. Acc...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
Seat the organization's existing staff when it starts paying
Turning PAID seated only the buyer; everyone else hit "This needs a licensed seat" on the product just bought until the owner assigned seats by hand. On the tra...
Rebuild onto kamo-shared-library 6fce139a
Picks up OrgStorageAggregator 3eda4b54: BULK_EXPORTS and EXCHANGE_DOCUMENTS read object_storage_days instead of 0.
God mode comes from the caller's own session window, never a header
BillingService took X-God-Mode-Active plus users.is_god as god mode, and kamo-internal copied that header straight off the browser, so a god-eligible operator h...
The Enterprise refusal names KamoUniverse
"The Enterprise plan is arranged directly with KamoCRM and cannot be selected here. Contact us and we will set it up for you." is echoed verbatim to the custome...
The billing console sells an organization its own universe's plans
KamoUniverse adds Family, Community and Personal ladders beside the business one, and BillingService assumed a single catalog: "the Free plan" was the code FREE...
Pin kamo-shared-library 1.6.1, the only version that exists
The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...
Only an organization's owner may change who pays for mailboxes or extensions
**************** and **************** had no authorization check at all — any member of the organization, not only its owner, could move the whole organization'...
Growth Hub files are reported on their own line
This pins the GROWTH_HUB domain kamo-shared-library gained today. Before it, no domain claimed the Growth Hub's two associations, and the imaging pass dropped t...
Scrub copies of live credentials from config and dumps
A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...
A group seat's coverage carries its manager's member id
GET /api/billing/self/coverage named the billing group's manager (managerName) but not who they are, so the member's plan page could not open the manager's memb...
Liveness probe on /actuator/health/liveness, not the DB-aware aggregate
The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Active and Void tabs in the platform org directory
The console's Organizations tab now splits into Active and Void sub-tabs. A voided organization is orgs.is_active = FALSE (set by SecurityService's void endpoin...
Rerun a webhook event whose first attempt died, and refuse one the SDK cannot read
A losing claim on an unprocessed row always answered 500, so an event whose first attempt failed (a unique-constraint race inside the invoice.created/finalized/...
Only a failed charge starts dunning, and Stripe must agree before dunning acts
invoice.finalized carries status=open with an amount due for every auto-charged invoice before the charge is attempted, and the invoice handler started the deli...
The same-commit-rebuild guard could never fire, and the digest check failed open
Both protections against a deploy that deploys nothing were inert, so the pipeline reported two green jobs while the pods stayed on the previous digest. That is...
A catalog row naming an app this build cannot resolve is not for sale
ServiceTypeConverter stopped throwing on an unknown app id and started resolving it to null, which is what a service must do — the enum ships inside each jar wh...
A price Stripe has never heard of is a fault, not a silence
The reconciler compared mapped prices against the catalogue and returned early whenever nothing was mapped at all. So a term the catalogue had gained since the ...
Charge what the screen says, and refuse rather than pretend
An audit of the Plans & Billing console against live Stripe keys found the seam between the screen and Stripe broken in every direction at once, and silent in a...
A plan's startup fee, and the live offer, on the wire
PlanDto carried only the recurring rate, so every surface quoting a plan quoted a price the customer would not be charged: KamoCRM's startup fee is $99 a seat, ...
One endpoint behind the customer's own plan page
GET /api/billing/self/plan answers everything /myplan renders: the plan, what the organization can actually use, the catalogue to compare against, seats and the...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Bill the startup fee on both routes to a plan, and record negotiated terms
Two routes reach the same plan and only one of them was going to charge the new per-seat startup fee. A sales-written order bills through SubscriptionService, w...
Lock every money-moving sweep, and run two pods
BillingService ran one pod and its seven scheduled sweeps were correct only because of it. There is no ShedLock anywhere on this platform, so a second replica w...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Stop offering the internal platform-owner plan for sale
listPlansForMarket filtered on isActive alone, and active is not the same as on the menu. OWNER_UNLIMITED ("Platform Owner — Internal") is active, carries no pr...
Serve the running offer, and say whether a seat is actually PAID for
Adds GET /markets/{id}/promotion. There was no way for an in-app buying surface to know an offer was running at all — the marketing site read promotions through...
Bill the three-year term, and quote its rate to the console
BillingCycles gains TRIENNIAL, expressed to Stripe as three YEARs rather than thirty-six MONTHs so the renewal tracks the signup anniversary — the same reason A...
Per-server lines on the extensions summary
The phone server's extensions tab showed the organization-wide figure and nothing else, so an empty KamoPBX server displayed "21 billable extensions — $63.00 / ...
The platform org is not gated by its own catalog
The platform org was told "Requires the KamoPBX Hosting add-on" on its own phone-server screen, for an add-on it publishes. It owns the plan catalog, the add-o...
Refuse a self-serve Enterprise subscription
Enterprise is negotiated. Hiding the price is presentation; this is the boundary. A request naming the Enterprise plan is refused unless the caller holds ******...
Bill phone service by the extension
PricingModel.PER_EXTENSION, its own reserved quantity key, an allocator, a nightly reconciler, a removal gate and the summary API - the phone twin of the per-ma...
Scan the shared-lib email.billing repository package
@EnableJpaRepositories lists packages explicitly, so MailboxBillingDayRepository was invisible and the service refused to start outright — caught by booting it,...
Rebuild against current kamo-shared-library
CI clones shared-lib at image build time. This service was last built before shared-lib gained GMAIL_PERSONAL and OUTLOOK_PERSONAL, so its deployed enum cannot ...
Bill e-mail per mailbox, reconciled nightly
Quantity is server-computed under a reserved key a request body cannot reach, and pushed through the existing amend path — so Stripe's CREATE_PRORATIONS charges...
Close the webhook idempotency gap BL0's final review found
Finding 1 (Critical): a losing claim on a redelivered Stripe event only proved a row existed, not that the prior attempt finished. A claimed row left behind by ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.