A template above the caller's clearance cannot be read or sent, and a staff employment offer takes an HR right (SITP TP19)
The envelope door already hid an envelope whose template sits above the session's clearance and an EMPLOYMENT_OFFER envelope from a member without an HR right, ...
Sending for signature takes EDIT_DOCUMENTS and reading a template takes VIEW_DOCUMENTS (SITP TP02)
POST /api/esig/envelopes (create and send) checked no right, so any org session could send any template out for signature; it now takes EDIT_DOCUMENTS, the righ...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
A signing page's logo falls back to theme.kamouniverse.com
EsignBrandingService's asset host of last resort, used for an organization with no live domain of its own, was a private "kamocrm.com" literal. It is **********...
Pin kamo-shared-library 1.6.1, the only version that exists
The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...
The internal envelope API fails closed and compares its secret in constant time
**************** used String.equals against X-Internal-Auth (a timing side channel on a shared secret) and, when esig.internal-auth-secret was unset, logged a w...
The staff envelope API now requires a document right, and HR envelopes need an HR one
EsignEnvelopeController's **************** checked org membership only — no document right, no clearance, nothing context-specific. Any authenticated staff memb...
Thread orgId through every template handler, EDIT_DOCUMENTS on writes
ESignTemplateService's signer/design handlers (getSigners, upsertSigners, reorderSigners, deleteSigner, saveDesign, getLatestDesign, listDesignVersions, getDesi...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Signing and document-manager links only name a live domain
**************** settled for any active root domain, so an org still setting up its domain had signing links mailed to sign.<that domain>, which answered nothin...
The certificate must not claim a disclosure nobody was shown
Verified against a real completed envelope on the cluster, and the closing paragraph read "Each signer was shown, and accepted, the consumer disclosure required...
Stop asserting an eIDAS assurance tier this product does not implement
`buildSession` reported `stepUpRequired ? "AES" : "SES"`, so requiring a one-time passcode made every signing session assert an ADVANCED electronic signature — ...
Every e-signature email was a silent 403, and a Signature Date field
**No e-sign email had been leaving the cluster.** EmailService gates /api/email/templates/send on the cluster-wide internal-auth secret (mlos-internal-auth -> I...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Redact when the document is served, not only when it is signed
The redaction was applied at flatten time, which is after signing. Everything before that — the whole signing session — was served the raw source: fetchDocument...
OrgBranding gained a sixth component and this stub kept passing five
Broken on main since e9faf11. The image build runs mvn package -DskipTests, so nothing has been compiling the test tree and no red build ever said so — but it m...
The signer app gets the sender's brand, not Kamo's
Two separate ways the same wrong assumption showed up. The signing page's logo URL was https://<org fqdn>/theme/logo-full.<ext>, which is not a path anything s...
Stop handing an alias row over as the org's domain
**************** walked org.getDomains() filtering only on isActive. That collection holds the org's root domain AND its alias rows -- api, login, theme and the...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Resolve a native PDF's source bytes instead of demanding a rendition
**************** required dat.convertedDat to be non-null. ConversionService only mints a second ImgDat when it actually converts something -- a document that a...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
The expiry sweep ran with no transaction
@Transactional is applied by a proxy and sweep() called expireDue() on this, so the annotation was inert. The expiry notices read the envelope's organization do...
Close out the signing lifecycle — notices, routing, guards, expiry
Everything after a signer presses Finish was incomplete. Notices: an envelope's last signature produced a flattened PDF in MinIO that only the final signer eve...
Put memberId on RecipientSummary, and stop the IP check DNS-resolving
A caller that acts on a recipient's status has to be able to establish WHOSE status it is. DocsService's legal-package Finish writes a WORM attestation on the s...
Let a send under-fill a template's signer slots, keep rejecting over-fill
The signer-count check added last round demanded an EXACT match against the template's declared slots, which would have silently stopped mortgage disclosures go...
Complete delegated envelopes, and reject a bad signer count before sending
envelopeComplete required a literal SIGNED from every recipient, but delegate() leaves the delegator DELEGATED forever and ADDS the replacement instead of subst...
Scope a decoder to the recipient who decoderd
Any single recipient declining set the whole envelope DEcoderD, so a counter-signer could destroy signatures the other parties had already given, with no recove...
Enforce required fields on the server, not just in the browser
submit() validated only consent and step-up; it accepted an empty values list and still marked the recipient SIGNED. Ports validation.ts (esign-core), including...
Bind every recipient to a template signer slot
No caller supplied signerUid, so recipients were created without one. buildSession filters a signer's fields by signerUid, so myFields came back empty, completi...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
AntPathRequestMatcher — immune to multi-servlet contexts
Belt-and-braces with the shared-lib SoapClientOnlyGuard (c4a3b2c): the 891c58c build raced the guard's push into shared-lib main and kept crash-looping on 'more...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Replace upsertSigners with full delete+insert to handle frontend temp UUIDs
The frontend assigns temporary crypto.randomUUID() values to newly-added signers before any backend call. The previous upsert-by-uid logic would throw 404 for t...
Add CockroachDB transaction retry for template init endpoint
CockroachDB serializable isolation can trigger RETRY_SERIALIZABLE on the read-then-write pattern in initTemplate. Retries up to 3 times with backoff when detect...
Correct OTK Redis key format and add imaging template list endpoint
OTK keys use OTK<id> and ***<id> (no colon) matching the Next.js proxy. Added POST /api/esig/templates/list to query imaging templates via shared library ImgRep...
Replace OTK auth with trusted session headers for internal K8s calls
ESigService is internal — the Next.js backend reads the session from Redis and passes orgId/memberId/userId as X-Org-Id, X-Member-Id, X-User-Id headers. No OTK ...
Scan all shared library repository packages to resolve bean dependencies
ComponentScan picks up shared library services which depend on repos in donotmodify.dao.repos and commerce packages — must scan those too.
Remove .mvn/ copy from Dockerfile — directory does not exist in this project
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.