Live Change Log

The envelope door already hid an envelope whose template sits above the session's clearance and an EMPLOYMENT_OFFER envelope from a member without an HR right, ...

POST /api/esig/envelopes (create and send) checked no right, so any org session could send any template out for signature; it now takes EDIT_DOCUMENTS, the righ...

com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...

EsignBrandingService's asset host of last resort, used for an organization with no live domain of its own, was a private "kamocrm.com" literal. It is **********...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

**************** used String.equals against X-Internal-Auth (a timing side channel on a shared secret) and, when esig.internal-auth-secret was unset, logged a w...

EsignEnvelopeController's **************** checked org membership only — no document right, no clearance, nothing context-specific. Any authenticated staff memb...

ESignTemplateService's signer/design handlers (getSigners, upsertSigners, reorderSigners, deleteSigner, saveDesign, getLatestDesign, listDesignVersions, getDesi...

The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...

The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...

The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...

The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...

The Docs manager gets a Signature Requests tab: every document a collection's templates sent out for signature, in three buckets by signatures (nobody, some, or...

A template is a document with a layer of fields over it, and a version of it is both halves: its bytes and that layer. Its underlying file's saves already reach...

**************** settled for any active root domain, so an org still setting up its domain had signing links mailed to sign.<that domain>, which answered nothin...

Verified against a real completed envelope on the cluster, and the closing paragraph read "Each signer was shown, and accepted, the consumer disclosure required...

`buildSession` reported `stepUpRequired ? "AES" : "SES"`, so requiring a one-time passcode made every signing session assert an ADVANCED electronic signature — ...

What the flatten pipeline appended was one page per signature carrying seven lines: name, email, member id, timestamp, capture method, IP, user agent. No routin...

The unit tests around this cover the pieces — the format, the type predicate, the required-field exclusion — and none of them can see the wiring. A signature_da...

**No e-sign email had been leaving the cluster.** EmailService gates /api/email/templates/send on the cluster-wide internal-auth secret (mlos-internal-auth -> I...

The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...

The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...

Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...

Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...

The redaction was applied at flatten time, which is after signing. Everything before that — the whole signing session — was served the raw source: fetchDocument...

— is processed by javac before the file is even tokenised, so it compiled to the same character it renders as here — but the source read as the escape.

flatten() applied blank pages, rotations, modifiers, field values, page order and certificates. It never drew the annotations. A rectangle, a highlight or an ar...

Broken on main since e9faf11. The image build runs mvn package -DskipTests, so nothing has been compiling the test tree and no red build ever said so — but it m...

Two separate ways the same wrong assumption showed up. The signing page's logo URL was https://<org fqdn>/theme/logo-full.<ext>, which is not a path anything s...

The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...

**************** walked org.getDomains() filtering only on isActive. That collection holds the org's root domain AND its alias rows -- api, login, theme and the...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

**************** required dat.convertedDat to be non-null. ConversionService only mints a second ImgDat when it actually converts something -- a document that a...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...

CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...

ESigService is CrashLooping for a reason that has nothing to do with e-signatures: it rebuilt against a shared library whose DepartmentService had grown a Mailb...

@Transactional is applied by a proxy and sweep() called expireDue() on this, so the annotation was inert. The expiry notices read the envelope's organization do...

Everything after a signer presses Finish was incomplete. Notices: an envelope's last signature produced a flattened PDF in MinIO that only the final signer eve...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

A caller that acts on a recipient's status has to be able to establish WHOSE status it is. DocsService's legal-package Finish writes a WORM attestation on the s...

OTKAuthFilter bypasses only /actuator, /api/esig/public and /api/esig/internal, so this prefix is behind staff OTK auth with orgId/memberId already on the reque...

**************** now take the triple. The public controller keeps resolving it from SIGNSESH, so the signer app is unchanged; a staff-authenticated member surfa...

The signer-count check added last round demanded an EXACT match against the template's declared slots, which would have silently stopped mortgage disclosures go...

envelopeComplete required a literal SIGNED from every recipient, but delegate() leaves the delegator DELEGATED forever and ADDS the replacement instead of subst...

Any single recipient declining set the whole envelope DEcoderD, so a counter-signer could destroy signatures the other parties had already given, with no recove...

Creating an envelope unconditionally emailed an invite, so a caller batching many envelopes behind one notification had no way to stay quiet. Null preserves the...

submit() validated only consent and step-up; it accepted an empty values list and still marked the recipient SIGNED. Ports validation.ts (esign-core), including...