Mabadiliko
Nini kipya.
Kila kuboresha jukwaa, kama ni meli.
· SecurityService
Translate concurrent-modification IllegalStateException to 409 with code
Pairs with the shared-lib optimistic-lock change: when LoanPipelineService throws "Concurrent modification: refresh and retry", surface a structured {error, code: "CONCURRENT_MODIFICATION"} body so the UI can react with a refresh instead of a raw error toast.
· kamo-shared-library
Optimistic-lock LoanFile.status to prevent racing transitions
Concurrent "Advance" clicks could both write milestones. Adds @Version to LoanFile and an explicit flush in LoanPipelineService.transition so the OptimisticLock failure surfaces as **************** modification: refresh and retry") for the controller to translate to 409.
· kamo-internal
Name display, REO lien editor, webhook admin, string cleanup
Polish pass aligning the frontend with the corresponding backend changes: - Components now render the resolved *MemberName fields from the backend (PipelineSection milestone actor, condition cleared/waived attribution). - ReoSection: liens are now fully editable (was read-only with a TODO). New LienRow with autosaved type / creditor / account last 4 / unpaid balance / monthly payment / credit limit / display order fields, plus a To-Be-Paid-Off toggle and per-row delete. - mortgageAppsApi gains createReoLien / patchReoLien / deleteReoLien and a separate webhookSubscriptionsApi surface for the outbound webhook admin. - New /settings/integrations/webhooks page: subscription list with add/edit modal, rotate-secret action that surfaces the new signing-secret one-time-reveal modal, per-subscription delivery history dialog. - types/mortgageApp.ts gains *MemberName fields, esignTemplateUid on EsignEnvelopeDTO, and the WebhookSubscriptionDTO / WebhookDeliveryDTO shapes. - Hardcoded English strings cleaned up across PipelineSection, PipelineBoardClient, DisclosuresSection, PricingSection, HmdaLarClient, and ApplicationsListClient — every label now flows through useTranslations().
· SecurityService
REO lien endpoints + webhook subscription controller
- MortgageAppController: POST /{uid}/reos/{reoId}/liens, PATCH /{uid}/reo-liens/{id}, DELETE /{uid}/reo-liens/{id} — delegating to the new BorrowerSectionService lien CRUD methods. - WebhookSubscriptionController under **************** for per-org outbound webhook management. Read gated on LOS_VIEW_PIPELINE; write/rotate-secret/delete gated on LOS_UNDERWRITE_LOAN. Returns the signing secret exactly once on create / rotate-secret.
· kamo-shared-library
Name resolution, REO liens, TRID holidays, webhook delivery, ESignTemplate link
Cross-cutting polish pass across all LOS sub-projects: Member display name resolution (MemberNameResolver): - Single shared resolver service that follows the standard Kamo precedence User.name → Member.usernameAlias → User.alias → User.username and a batch resolveAll() for snapshot endpoints - DTOs grew sibling *MemberName fields next to every *MemberId: LoanPipelineMilestoneDTO, LoanConditionDTO, LoanPricingSnapshotDTO, RateLockDTO, AusFindingDTO, DisclosureSetDTO, TridTimerDTO - LoanPipelineService, LoanConditionService, LoanPricingService and DisclosureService now enrich all returned DTOs REO lien CRUD: - **************** via the ReoLien → RealEstateOwned → Borrower → BorrowerPair → AppMortgage → Organization join path - **************** / updateReoLien / deleteReoLien with the existing org-scoping pattern (requireBorrower) - MortgageAppController exposes POST /{uid}/reos/{reoId}/liens, PATCH and DELETE on /{uid}/reo-liens/{id} TRID federal holiday calendar: - **************** now skips US federal holidays per CFPB §1026.2(a)(6) plus weekends. Covers NYE, MLK, Presidents', Memorial, Juneteenth (2021+), Independence, Labor, Columbus, Veterans, Thanksgiving, Christmas with OPM weekend observance for the fixed-date holidays Outbound webhook delivery: - WebhookSubscription + WebhookDelivery entities with per-org config (target URL, event-type filter, NATS subject filter, signing secret, max attempts, last success/failure tracking) - WebhookSubscriptionService for CRUD with auto-generated whsec_ signing secrets, rotate-secret action - WebhookDeliveryWorker subscribes to los.pipeline.> on NATS, matches subscriptions, POSTs with HMAC-SHA-256 signature in the X-Kamo-Signature header, retries with exponential backoff, writes one WebhookDelivery row per attempt - WebhookSubscriptionController under **************** for subscription CRUD, secret rotation, and delivery audit listing. LOS_VIEW_PIPELINE for read, LOS_UNDERWRITE_LOAN for write E-sign — link to existing ESignTemplate (no new provider abstraction): - EsignEnvelope grew esignTemplateUid FK to the existing **************** so the disclosure envelope reuses the per-org signer roster and field placement design owned by ESigService. The send-to-provider flow continues to live in ESigService — no duplicate provider code in the disclosures package.
· kamo-internal
Pricing, disclosures, HMDA LAR UI
Three more sub-projects shipped end-to-end: Sub-project 5 — Pricing & AUS section on the detail page: - Pricing snapshots list with add dialog (program, investor, rate, APR, points, lock-days, term, source, note) - Rate locks list with add dialog (status, lock date/expires, days, rate, points) - AUS findings list with add dialog (DU/LP/GUS engine, decision, case file, risk class, raw findings payload) Sub-project 6 — Disclosures & TRID section: - Disclosure sets with type/delivery dropdowns and presumed-received date display - Per-set document upload (multipart) with MinIO-backed download via presigned URL - E-sign envelopes (provider-agnostic stub) per set - TRID timer list with overdue/due-in highlighting and a "mark satisfied" action Sub-project 7 — HMDA LAR page at /applications/hmda-lar: - Year filter, refresh, CSV download (Blob fetch + anchor click) - 13-column read-only table mirroring the FIG spec - New HMDA LAR button on the applications list header
· SecurityService
Controllers for pricing, disclosures, HMDA LAR
Three new REST controllers under /api/security/mortgage-apps: - MortgagePricingController: pricing snapshots, rate locks, AUS findings CRUD ({uid}/pricing, {uid}/rate-locks, {uid}/aus-findings). - MortgageDisclosureController: disclosure sets and documents (multipart upload + presigned MinIO URL), e-sign envelopes, TRID timer listing + satisfy. - MortgageHmdaController: HMDA LAR JSON list and CSV export ({hmda/lar} and {hmda/lar.csv}, optional year filter). All controllers reuse the standard session-rights + god-eligibility pattern from the rest of the codebase.
· kamo-shared-library
Pricing snapshots, rate locks, AUS findings, disclosures, TRID timers, HMDA LAR
Sub-projects 5, 6, and 7 backend shipped together: Sub-project 5 (pricing & locks): - LoanPricingSnapshot — append-only quotes (program, investor, rate, APR, points, lock days) - RateLock — locked-rate record with status, expiration, broke reason - AusFinding — DU/LP/GUS run record with decision + raw payload - New enums: RateLockStatus, AusKind, AusDecision - LoanPricingService for CRUD across all three Sub-project 6 (disclosures + TRID + e-sign stub): - DisclosureSet (LE/CD/etc.) with delivery method, presumed-received date computed via the mailbox rule (business-day math) - DisclosureDocument backed by MinIO via the existing MinIOStorageService - EsignEnvelope — provider-agnostic stub for the future integration - TridTimer — arms automatically when LE/CD issues; helpers for intent-to-proceed, CD-receipt-required, post-consummation CD due - DisclosureService orchestrates issuance, MinIO upload, presigned download URLs, envelope tracking, and timer satisfaction Sub-project 7 (HMDA LAR): - HmdaLarRecordDTO mirrors the 2018+ HMDA FIG layout - HmdaLarService builds rows from existing URLA entities and emits CSV with proper field-quoting; HMDA Action Taken codes derived from LoanFileStatus
· kamo-internal
LOS pipeline UI — kanban, detail section, template admin
Sub-project 4 frontend, end-to-end: - /applications/pipeline (PipelineBoardClient): kanban grouped by LoanFileStatus with off-ramp lanes below the happy-path columns. Each card surfaces borrower, loan amount, days-in-status, open and blocking condition counts. The "..." menu offers Advance / Off-ramp / Open detail; both Advance and Off-ramp open the same transition dialog with the legal next-status radios fetched from the snapshot. Underwriter override checkbox appears when the chosen forward arrow would skip blocking conditions. - /applications (list): new "Pipeline" header button routing to the kanban; preserves the existing list + filters. - /applications/[uid]: new "Pipeline & Conditions" section in the nav (between Summary and Loan & Property). The section combines current status, conditions list (open/cleared/waived with add/clear/waive/ delete), the loan timeline, and the same transition dialog. - **************** per-org template admin with CRUD list, add/edit modal (title, description, category, typical due offset days, blocksAdvancementDefault, displayOrder). - types/mortgageApp.ts: pipeline/condition/template DTO types, LOAN_FILE_STATUS map, off-ramp helper. - app/lib/mortgageAppsApi.ts: client methods for every new endpoint.
· SecurityService
MortgagePipelineController + LOS_PIPELINE configmap entry
Exposes the LOS pipeline backend under /api/security/mortgage-apps: - GET /pipeline — kanban summary - GET /{uid}/pipeline — full snapshot - POST /{uid}/transitions — perform a transition - GET /{uid}/conditions — list - POST /{uid}/conditions — add - PATCH /{uid}/conditions/{id} — edit - POST /{uid}/conditions/{id}/clear — mark cleared - POST /{uid}/conditions/{id}/waive — mark waived (LOS_UNDERWRITE_LOAN) - DELETE /{uid}/conditions/{id} — delete (open only) - GET /condition-templates — list - POST /condition-templates — create - PATCH /condition-templates/{id} — update - DELETE /condition-templates/{id} — soft-delete Right checks use the standard session-rights pattern with the new LOS_* RoleRightType entries; god-eligibility honours the same sessionData.GD bypass as the rest of the controllers. The configmap gains the los-pipeline.* keys so ops can tune the dedicated NATS stream name and subject filter via env vars.
· kamo-shared-library
Pipeline state machine, conditions, templates, NATS events
Sub-project 4 (LOS pipeline & workflow) backend: - New enum LoanConditionStatus (OPEN/CLEARED/WAIVED) - New entities: LoanPipelineMilestone (append-only transition audit), LoanCondition (per-loan checklist row with own state), and LoanConditionTemplate (per-org reusable checklist source) - New repos for each, plus a one-shot blocking-condition query - LoanPipelineStateMachine declares the URLA pipeline (DRAFT through FUNDED) and the universal SUSPENDED/WITHDRAWN/DENIED off-ramps, with required RoleRightType for each arrow - LoanPipelineService orchestrates a transition atomically: validate legality + right + blocking conditions (override gated by LOS_UNDERWRITE_LOAN), stamp the appropriate LoanFile date column, write a milestone, write an ApplicationSubmission for legally-significant transitions (initial disclosure, resubmit processing/underwriting) with SHA-256 snapshot, publish a NATS event - LoanConditionService and LoanConditionTemplateService cover the rest of the CRUD surface - LosPipelinePublisher publishes to JetStream subjects los.pipeline.transition.<orgId> and los.pipeline.condition.<orgId> - NatsConfig provisions a dedicated LOS_PIPELINE stream alongside the existing chat stream so retention can be tuned independently - Six new RoleRightType entries under ServiceType.LOS (renamed to "Commerce: Loan Origination System"): LOS_VIEW_PIPELINE, LOS_TAKE_APPLICATION, LOS_PROCESS_LOAN, LOS_UNDERWRITE_LOAN, LOS_CLOSE_AND_FUND, LOS_SUSPEND_OR_WITHDRAW
· kamo-internal
Originator & Submissions sections UI
Closes out Sub-project 3: the originator route gets a two-block editor (individual NMLS + organization NMLS + org address) wired to patchOriginator with the standard 800ms autosave, and the submissions route renders a reverse-chronological read-only timeline of the AppMortgage.submissions array (the latest entry pulses green; notes and snapshot hashes display when present). The Coming-Soon fallback is no longer reachable so the catch-all branch is removed.
· kamo-internal
HMDA Demographics section UI
Replaces the Coming-Soon placeholder for the hmda route. Ethnicity uses the tri-state lookup with an inline sub-checkbox block when Hispanic is selected (Mexican/PR/Cuban/Other + description). Race renders as five toggle blocks (American Indian, Asian, Black, NHPI, White) with conditional Asian and Pacific Islander sub-checkbox grids underneath. Sex, collection method, and the three visual-observation flags hang under the verification footer.
· kamo-internal
Military Service section UI
Replaces the Coming-Soon placeholder for the military route. The everServed switch upserts via mortgageAppsApi.putMilitary; toggling it off also clears the service status and projected expiration to avoid stale VA data lingering in the record.
· kamo-internal
Real Estate Owned section UI
Replaces the Coming-Soon placeholder for the REO route. Each property card edits the address, occupancy/status/intended-use, market value, monthly insurance+taxes+HOA, and gross/net rental income with the same autosave pattern as the other sections. Nested liens render in a read-only table; a TODO note in the component plus a footer hint explain the missing /reos/{id}/liens endpoints.
· kamo-internal
Liabilities & Expenses section UI
Replaces the Coming-Soon placeholder for the liabilities route. Section 2c liabilities track unpaid balance, monthly payment, months remaining, and the three URLA disposition flags (paid at closing, paid prior, omitted) as separate toggles; omitted rows dim themselves. Section 2d other monthly expenses share the same borrower chip and totals strip (outstanding debt, monthly debt service, monthly expenses, combined monthly out).
· kamo-internal
Assets & Credits section UI
Replaces the Coming-Soon placeholder for the assets route. Splits the borrower's asset list into Section 2a (bank/retirement/other accounts, type id < 50) and Section 2b (other assets & credits, id >= 50) via the public asset-type ID ranges, with isJoint and usedForCashToClose toggles on every row. Totals strip shows accounts subtotal, credits subtotal, and combined value when any row carries a value.
· kamo-internal
Employment & Income section UI
Replaces the Coming-Soon placeholder for the employment route with a full URLA Section 1d-1g editor. Per-borrower chip selector mirrors the declarations pattern; each employment row autosaves through mortgageAppsApi.patchEmployment with the same 800ms debounce. Card header surfaces the running monthly total (base + overtime + bonus + commission + military + other + self-employed net). Section 1g other- income rows live in their own list below.
· kamo-internal
URLA 2021 mortgage application UI
Adds the new /applications route group, the typed mortgageAppsApi client that talks to SecurityService /api/security/mortgage-apps, full TS types mirroring the backend DTOs, and a sidebar entry alongside Leads. UI: /applications Pipeline view with stat-bucket filters (All / Draft / In progress / Closed), search, animated cards (Framer Motion), empty-state CTA, loading skeleton. /applications/[uid] Detail layout: gradient hero with primary borrower + status badges, sticky section rail with animated active indicator, animated section transitions, autosave indicator (Saving… → Saved ✓ → fade). Sections delivered to production quality: - Loan & Property (Section 4a/4b/4c) full editor, autosave 800ms - Borrowers (1003s) pair management, married-joint toggle, add/remove pair + co- borrower, animated mutations - Declarations (Section 5) per-borrower questionnaire, Yes/No/N/A chip controls, chapter-7/11/12/13 sub-flow Sections with backend support but UI deferred to follow-up: Employment & Income, Assets, Liabilities, REO, Military, HMDA, Loan Originator, Submissions. Each renders a "Coming next" card so navigation is complete and the schema is discoverable. All copy goes through next-intl mortgageApps.* namespace; nothing hardcoded. MoneyInput / PercentInput / SelectInput / Switch primitives are reusable across future sections.
· SecurityService
MortgageAppController for URLA 2021 REST surface
New REST controller exposing the full URLA application lifecycle: GET /api/security/mortgage-apps list (summary) GET **************** full graph POST **************** blank or from-lead DELETE **************** delete PATCH /{uid}/loan-file | /loan | /property | /originator top sections POST /{uid}/pairs add BorrowerPair PATCH /{uid}/pairs/{pairId} edit pair DELETE /{uid}/pairs/{pairId} remove pair POST /{uid}/pairs/{pairId}/borrowers add Borrower PATCH /{uid}/borrowers/{borrowerUid} edit Borrower DELETE /{uid}/borrowers/{borrowerUid} remove Borrower POST/PATCH/DELETE **************** **************** + /{section}/{id} PUT **************** POST/PATCH/DELETE /{uid}/gifts and /{uid}/other-mortgages GET /{uid}/lookups ← enum dump Org-scoped via OTKPreAuthFilter session; uniform {error: msg} envelope on 400/401/404/500; uses existing service-layer @Transactional rules.
· kamo-shared-library
URLA service layer (repos, DTOs, services, lookups)
Adds the full backend service layer for the URLA package introduced in the previous commit: repos/applications/ 20 JpaRepositories scoped per entity dtos/applications/ response DTOs (Long->String) + lookup payload services/applications/ AppMortgageService (root + lead conversion + section saves) and BorrowerSectionService (pairs, borrowers, employment, income, assets, liabilities, REO, declarations, military, HMDA) Conventions follow the existing LeadService pattern: - Field-injected @Autowired deps - @Transactional(readOnly=true) for queries - Static .from(entity) factory mappers, Long ids serialized as String - IllegalArgumentException for not-found / validation failures - All operations org-scoped via the application's organization id The MortgageLookupsDTO returns every URLA enum in one shot so the UI never hardcodes dropdown options.
· kamo-shared-library
URLA 2021 schema foundation for residential mortgage
Refactor AppMortgage into a full URLA package root supporting multiple 1003s per loan with up to two borrowers per pair (married/joint or unmarried). Replaces the empty AppMortgage placeholder with a structured entity graph mirroring every 2021 URLA section: core/ LoanFile, Loan, Property, LoanOriginator, ApplicationSubmission party/ BorrowerPair (the "1003"), Borrower employment/ Employment (Sections 1d/1e/1f/Sec.7), OtherIncome (1g) assets/ Asset (2a/2b), Gift (4e) liabilities/ Liability (2c), OtherExpense (2d) reo/ RealEstateOwned (Sec.3) + ReoLien declarations/Declarations (Sec.5), MilitaryService (Sec.7) hmda/ HmdaDemographics (Sec.8) otherloans/ OtherNewMortgage (4d) Assets/Liabilities/REO use the "per-borrower with isJoint flag" ownership model so the URLA "Account owned by Borrower / Co-Borrower / Both" radio collapses to a single row with implicit pair-mate co-ownership. All monetary fields use EmbMoney (BigDecimal + currency) and all rates use EmbPercent (4dp BigDecimal) — no doubles, no JSON. ID strategy follows existing conventions: unique_rowid() for user-facing entities, gen_random_uuid() for internal detail tables. JSONB appears only on the ApplicationSubmission audit snapshot (intentional — not for live data). Schema is auto-created by KamoInitializerService via hibernate.ddl-auto on the rebuilt JAR; no DDL scripts required. Backend service, UI, and remaining LOS sub-projects (pipeline workflow, pricing/locks, disclosures, HMDA reporting) are deferred to subsequent sessions per the 7-part decomposition.
· KlusterServices
Manage mail.kamocrm.com TLS end-to-end
Auto-cert now provisions and maintains the Let's Encrypt cert for mail.kamocrm.com (HTTP-01 via Traefik on port 80) and keeps the postfix consumer in sync across namespaces. Auto-cert changes: - Add mail.kamocrm.com to STATIC_DOMAINS. - New CROSS_NS_CERT_MIRRORS table mapping FQDN -> (target namespace, deployments to restart). Default entry: mail.kamocrm.com -> ("mail", ["postfix"]). - mirror_secret_to_namespace() copies tls-<stem> from kamo to the target ns idempotently (only restarts consumers when the tls.crt actually changes — every-minute sync stays cheap). - restart_deployment() runs kubectl rollout restart on consumers when a renewal lands. - Hooked into wait_for_host_cert_ready and the main loop so both auto-cert-driven issuances and cert-manager auto-renewals propagate. - New Role/RoleBinding (mail namespace) grants secrets create/update and deployments patch to the auto-cert ServiceAccount. Postfix changes: - Mount tls-mail-kamocrm-com (optional secret) at /etc/letsencrypt. - On boot, copy the LE cert into /etc/postfix/tls/ if present; otherwise generate a short-lived self-signed snakeoil so postfix can start before the cert is issued. - Use the real cert for smtpd_tls_cert_file / key_file with TLSv1.2+ and high ciphers. Submission (587) now offers a valid, trusted cert once auto-cert finishes the first issuance and rolls the deployment.
· kamo-shared-library
**************** for idempotent role promotion
Adds a public, transactional ensureRoleAssigned(memberId, roleId) that: - No-ops if the role is already on the member. - Looks up the OrgRole and saves a new MemberRole join row. - Recomputes member_rights_applied so the persisted snapshot picks up the role's rights immediately. Used by the child-org-creation flow in SecurityService to propagate the creator's admin status from the new child up into their parent-org membership — keeps a user's admin reach consistent across the child's domain (where the createOrganizationOwner-minted *** already gives them owner+admin) and the parent's domain (where their existing registration-time TeamMember session would otherwise lack CONFIGURE_SYSTEM and bounce them off /settings/account).
· KlusterServices
Reverse-proxy priceturbo.com apex + wildcard via k1m1 with TLS
k1m1 Traefik now terminates HTTPS for priceturbo.com and any *.priceturbo.com subdomain, forwarding plain HTTP to the upstream Traefik at 192.168.4.36:80 with the Host header preserved (reuses the ratestack-upstream service). Auto-cert seeds the apex via STATIC_DOMAINS; subdomains are picked up dynamically on first hit via the existing Traefik access-log scan path — per-FQDN HTTP-01 certs require each hostname to already resolve to k1m1.
· SecurityService
Wire template-save recalc + session refresh + effective-rights diagnostic
**************** / updateModel / deleteModel and **************** now invoke recalcAllMembersUsingModel after persisting changes — every org pointed at the model (own master or via branch type) gets member_rights_applied refreshed in the same call. The branch-type delete path also recalcs orphaned child orgs before the row is dropped so their applied-model resolution is correct when the model lookup falls back. **************** writes a freshly-computed rights array into an existing *** Redis entry, preserving TTL + every other field, so live tabs can pick up admin-driven changes without a logout/login cycle. SessionRefreshController exposes POST /api/security/session/refresh — the caller's own *** is resolved from cookie or X-OTK, the live waterfall runs, and the result is written back. Cross-member spoofing is impossible by construction: there is no member-id parameter. RightsDiagnosticsController exposes GET **************** — returns the full waterfall: cascade sources (org roles, dept + dept roles, job title + jt roles, direct overrides), the applied model + non-NOT_SPECIFIED template entries by role type, the live resolved rights split into **************** and an inSyncWithLive flag that surfaces drift between the persisted member_rights_applied snapshot and what the live waterfall produces right now. Auth: must be in the target's org and either be the target, hold **************** or have god mode active.
· kamo-shared-library
Chunked recalc + cross-model fan-out + typeTemplate non-force fallback
Adds three things needed for template edits to actually reach existing members without forcing a logout/login cycle: 1. **************** — walks every org pointing at the model (via masterModelID or branch-type) and chunked-recalcs each member's member_rights_applied. Companion recalcAllMembersUsingBranchType handles the single-branch-type case. 2. Chunked **************** — bulk-delete + saveAll per 500-member chunk so a 50k-member org no longer fires per-row statements. 3. applyTemplateRules precedence fix — typeTemplate non-force GRANTED/NUKE now fills NOT_SPECIFIED before the DEFAULT non-force fallback. Matches the UI labels ("Default enabled; child can disable") and prevents module-access rights on TEAM_MEMBER from being silently ignored. Also exposes computeMemberRights as a public read-through for the new session-refresh and diagnostic endpoints in SecurityService.
· kamo-internal
Unified DNS Setup Studio with inline help per record
Replaces the split DnsProgressView + AliasStatusTable + ManualDnsGuide trio with a single guided experience: each TXT/CNAME record now lives in one card alongside its inline help, removing the duplication where the same records were rendered as both a status table and a separate setup guide. - New DnsSetupStudio orchestrates an animated 3-stage flow (verify ownership > connect subdomains > issue SSL) with gated stages, a staggered card grid, and a live progress ring driven by SVG. - Per-record cards adapt their field-name labels to the user's selected registrar **************** persisted to localStorage) and surface a deep-link to that provider's DNS portal. - Each subdomain card carries a plain-language description (e.g. "internal is your team's workspace") so non-technical users understand what they're configuring. - Workspace-entry, change-domain dialog, polling, countdown, theme provisioning, and the auto-DNS provisioning panel are all preserved.
· KlusterServices
Reverse-proxy rate.loans/stack.loans hosts via k1m1 with TLS
k1m1 Traefik now terminates HTTPS for api.rate.loans, www.rate.loans, and www.stack.loans, forwarding plain HTTP to the upstream Traefik at 192.168.4.36:80. Auto-cert seeds per-host Let's Encrypt certs for all three.
· EmailService
Wire DomainManager and MailboxProvisioner for all cloud providers
Replace the UnsupportedOperationException stubs in every cloud provider with real HTTP calls against each backend's admin API: - Microsoft 365 → Microsoft Graph (/users, /domains, /verify, …) using the per-org OAuth access token. - Google Workspace → Admin SDK Directory + Site Verification using the per-org OAuth access token. - Zoho Mail → Zoho Mail Admin API **************** using the per-org OAuth access token. - IceWarp → IceWarp REST API ({serverUrl}/api/v1/…) using the apiKey stored in providerConfig. - Exchange (Online) → Microsoft Graph via a client-credentials token minted from the tenantId/clientId/clientSecret stored in providerConfig. Also expand the OAuth scopes requested by the Microsoft, Google, and Zoho flows so the per-org admin token actually has the privileges the new code needs (User.ReadWrite.All / Domain.ReadWrite.All for Graph, admin.directory.user / admin.directory.domain / siteverification for Google, **************** for Zoho). Existing connections will need to re-authorise with admin consent to pick up the new scopes. Shared HTTP plumbing lives in ProviderHttpClient — Bearer / Basic / API-key auth, JSON encoding, and error-message extraction across the various provider error envelopes. What's still stubbed (and why): - RealtimeNotifier on Microsoft 365, Google Workspace, IceWarp, and Exchange — every provider's push-notification API needs a public webhook receiver hosted by EmailService, plus (for Gmail) a Cloud Pub/Sub topic. Wiring that up is its own infra task. - On-prem Exchange (authMethod != OAUTH) — needs the SOAP EWS API; the ExchangeProvider throws a clear error in that path until EWS is added.
Ulimwengu wako unasubiri.
Kuanza bure katika dakika. Ongeza bidhaa wakati wowote wewe ni tayari - hakuna uhamiaji, hakuna logins mpya.
Bure milele - hakuna kadi ya mkopo inahitajika