* feat(api): add webhook delivery utility and card event integration
Add the core webhook delivery logic and wire it into card mutations:
- Add sendWebhookToUrl() with HMAC-SHA256 signing, 10s timeout
- Add sendWebhooksForWorkspace() for fan-out delivery (fire-and-forget)
- Add createCardWebhookPayload() for building webhook payloads
- Fire webhooks on card create, update, move, and delete events
- Add unit tests for webhook utility functions
Depends on #391 (DB schema & repository).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(api): use correct boardId in webhook payloads and add rejection safety
- Fix bug where workspaceId was incorrectly passed as boardId in all
webhook payloads — now uses board's publicId via boardPublicId
- Replace void sendWebhooksForWorkspace() with .catch() to prevent
unhandled promise rejections if the DB query inside fails
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(api): add SSRF protection to webhook delivery
Block webhook URLs targeting internal networks:
- Require HTTPS (reject HTTP)
- Block localhost, 127.0.0.1, ::1, 0.0.0.0
- Block cloud metadata endpoints (169.254.169.254, metadata.google.internal)
- Block private IP ranges (10.x, 172.16-31.x, 192.168.x)
- Add tests for all blocked URL patterns
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(api): use WebhookEvent type from schema instead of duplicating
Replace the hardcoded WebhookEventType union with the canonical
WebhookEvent type from @kan/db/schema, addressing reviewer feedback
on PR #392.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(api): improve webhook delivery safety and validation
Cherry-pick delivery-related changes from b2cc9ac:
- Extract URL validation into reusable webhookUrlSchema zod validator
for SSRF checks
- Wrap sendWebhooksForWorkspace in try/catch to prevent unhandled
promise rejections
- Document SSRF risk mitigation on sendWebhookToUrl
- Add corresponding tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* init: schema migration, isArchived added to
board table. refactor: board repo for isArchived filtering
* init: archived, unarchived API procedures. refactor: all query
* fix: migration error
* feat: add tabbed navigation for boards view
* Implemented a Listbox for mobile and a tabbed navigation for desktop to switch between "Boards" and "Archived" views.
* Introduced state management for active tab selection.
* Updated UI components to reflect the new navigation structure.
* init: frontend/boards lists & tabs
* chore: fixed font styling and spacing
* init:boardDropdown / boardView.
* chore:added translations
* Remove .cursor plan file from repo
* fix:build erros
* revert: remove locales changes
* fix:reverted changes under locales, replaced the archive and unarchive endpoints. Reorder migrations
* fix:migration issue
* fix: update journal.json
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
The checklist.update procedure was inheriting the default
protectedProcedure meta (GET /protected) instead of declaring
its own OpenAPI route, making it unreachable via the REST API.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Use `||` instead of `??` so empty strings also fall back to email.
The nullish coalescing operator (`??`) only catches null/undefined,
so users with an empty name string would appear nameless in emails.
The board.byId query was generating presigned S3 URLs for workspace
member avatars but not for card member avatars. This caused card avatars
to silently fall back to initials since the frontend helper returns ""
for raw S3 keys.
Closes#387
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add notifications schema
* chore: gen migration
* feat: add mention email template
* feat: add sendMentionEmail func
* feat: add repo funcs
* feat: update card router to send emails on mention
* fix: update the editor suggestion to show all members
* feat: skip pending members in sendMentionEmails
* feat: update comments to use tiptap editor
* refactor: replace presigned URL uploads with backend upload endpoints
* feat: update avatar upload to use new endpoint
* refactor: use createS3Client in auth hooks
* feat: generate presigned URLs for avatars
* fix: show avatar image in user menu
* fix: hide tooltip if content is empty
* fix: support external avatar URLs in generateAvatarUrl
* fix: remove content type restriction on attachments
* feat: setup schema for workspace roles
* chore: regen migration
* feat: add publicId to workspace roles
* feat: setup default permissions
* feat: add repo funcs
* feat: setup basic router interactions
* feat: add card permissions
* feat: assert permissions for lists
* feat: assert board permissions
* feat: assert permission for remaining routes
* feat: add permissions page to settings
* feat: enable updating member roles
* feat: order members by role and createdAt
* feat: allow editing individual permissions
* feat: reset role defaults
* feat: clear all permission overrides
* feat: allow users to delete entities they have created
* feat: set roleId when inviting new members
* feat: disable UI elements if user does not have permissions
* feat: allow admins to assign the admin role to other users
* feat: allow delete:list as default
* refactor: centre permissions modal
* chore: translations
* feat(workspace): sanitize member emails for non-admin users in workspace router
* feat(workspace): add email visibility setting and update member display logic
* fix(workspace): update default value for showEmailsToMembers column to true
* - Removed unnecessary type assertions
- Added anonymous name handling (anonymous_[publicId]) in the API
- Removed placeholder logic
- Reverted null check
- Avoided as unknown cast
* feat: implement drag-and-drop reordering for checklist items
* WIP: Changes before syncing with main
* feat: update drag icon and positioning
* refactor: consolidate checklist item updates into single endpoint
- Remove standalone reorderItem route (now part of updateItem)
- Add optional index parameter to updateItem for reordering
- Change updateItem from PUT to PATCH method
- Add deletedAt IS NULL filter to reorderItem SQL queries
- Follows existing pattern from card.update route
* feat: add optimistic updates
* chore: translations
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
* feat: add card due dates to schema
* feat: update repo funcs
* feat: update card router to support due dates
* chore: update migration journal
* feat: add date selector
* feat: display date icon and label on cards
* feat: add due date filters
* feat: add due date to new card form
* feat: light mode tweaks
* feat: improve text eligibility on light mode
* feat: reduce selector font size
* feat: display date updates in card activity
* chore: gen translations
* feat: add list filter to board view
* feat: implement API-driven list filtering
* refactor: remove unnecessary list join from card filtering queries
* feat: enable list filter options for public boards
* refactor(perf): move to main query
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
* feat: add migration to remove not null constraint from referenceId on subscriptions
* feat(cloud): write worspace slug availability checks to db
* feat: add migration to add cascade set null to referenceId on subscription
* feat: update workspace and subscripton schema
* feat: add createWorkspaceSlugCheck repo func
* feat: set workspace url on creation
* chore: update translations
* refactor: various tweaks and fixes
* feat: add pro bolt to pricing notice
* feat: toggle pro subscription
* fix: hide pro subscription notice for self hosters
* feat: add pro upgrade message on members page
* feat: hide pro upgrade notice on small viewports
* feat: update workspace url placeholder
* feat: add template selection when creating new boards with predefined lists
* feat: extend templates with labels, update design and add translations
* feat: add validation and error states to new board form
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
* feat: implement Trello integration with OAuth and user fields
* feat: migrate Trello integration to new integrations table
* refactor: migrate Trello integration to use new integration system
* refactor: migrate Trello integration to use new integrations table
* fix: add loading check for Trello integration and update VSCode settings
* feat: enhance import boards UI with dynamic integration providers and local storage config
* feat: add select/unselect all buttons and loading state to board import form
* feat: add Trello import env vars on README
* docs: update Trello import guide to use OAuth flow instead of API keys
* feat: add integrations table for OAuth token management
* feat: connect trello from import modal
* refactor: consolidate Trello integration endpoints into unified integration router
* fix: trello import again
* refactor: generalize integration authorization flow and improve error handling
* refactor: update Trello API endpoints and tags for better organization
* feat: add Integrations tag to OpenAPI specification
* refactor: update Trello auth endpoint to use generic integration provider param
* refactor: move Trello integration logic from trello.ts to import.ts router
* refactor: consolidate Trello integration endpoints and fix API URL
* chore: remove debug logs
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
