feat: update comments to use tiptap editor

* build(web, deps): add `@tiptap/extension-typography`

* feat(editor): add typography extension

* chore(editor): disable some typographic characters

* chore(editor): disable superscript

README.md

@@ -47,7 +47,17 @@ See our [roadmap](https://kan.bn/kan/roadmap) for upcoming features.
 
 ## Self Hosting 🐳
 
-The easiest way to self-host Kan is with Docker Compose. This will set up everything for you including your postgres database.
+### One-click Deployments
+
+The easiest way to deploy Kan is through Railway. We've partnered with Railway to maintain an official template that supports the development of the project.
+
+<a href="https://railway.com/deploy/kan?referralCode=bZPsr2&utm_medium=integration&utm_source=template&utm_campaign=generic">
+  <img src="https://railway.app/button.svg" alt="Deploy on Railway" height="40" />
+</a>
+
+### Docker Compose
+
+Alternatively, you can self-host Kan with Docker Compose. This will set up everything for you including your postgres database.
 
 1. Create a new file called `docker-compose.yml` and paste the following configuration:
 

apps/web/package.json

@@ -38,6 +38,7 @@
     "@tiptap/extension-link": "^2.22.2",
     "@tiptap/extension-mention": "^3.0.9",
     "@tiptap/extension-placeholder": "^2.14.0",
+    "@tiptap/extension-typography": "^3.18.0",
     "@tiptap/pm": "^2.14.0",
     "@tiptap/react": "^2.14.0",
     "@tiptap/starter-kit": "^2.14.0",

apps/web/src/components/AuthForm.tsx

@@ -361,8 +361,8 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
           })}
         </div>
       )}
-      <form onSubmit={handleSubmit(onSubmit)}>
+      {!(isCredentialsEnabled || isMagicLinkAvailable) &&
-        {!isCredentialsEnabled && socialProviders?.length === 0 && (
+        socialProviders?.length === 0 && (
           <div className="flex w-full items-center gap-4">
             <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
             <span className="text-center text-sm text-light-900 dark:text-dark-900">
@@ -371,65 +371,62 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
             <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
           </div>
         )}
-        {!isCredentialsEnabled && socialProviders?.length !== 0 && (
+      {(isCredentialsEnabled || isMagicLinkAvailable) && (
-          <div className="mb-[1.5rem] flex w-full items-center gap-4">
+        <form onSubmit={handleSubmit(onSubmit)}>
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
+          {socialProviders?.length !== 0 && (
-            <span className="text-sm text-light-900 dark:text-dark-900">
+            <div className="mb-[1.5rem] flex w-full items-center gap-4">
-              {t`or`}
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
-            </span>
+              <span className="text-sm text-light-900 dark:text-dark-900">
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
+                {t`or`}
-          </div>
+              </span>
-        )}
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
-        <div className="space-y-2">
-          {isSignUp && isCredentialsEnabled && (
-            <div>
-              <Input
-                {...register("name", { required: true })}
-                placeholder={t`Enter your name`}
-              />
-              {errors.name && (
-                <p className="mt-2 text-xs text-red-400">
-                  {t`Please enter a valid name`}
-                </p>
-              )}
             </div>
           )}
-          {(isCredentialsEnabled || isMagicLinkAvailable) && (
+          <div className="space-y-2">
-            <>
+            {isSignUp && isCredentialsEnabled && (
               <div>
                 <Input
-                  {...register("email", { required: true })}
+                  {...register("name", { required: true })}
-                  placeholder={t`Enter your email address`}
+                  placeholder={t`Enter your name`}
                 />
-                {errors.email && (
+                {errors.name && (
                   <p className="mt-2 text-xs text-red-400">
-                    {t`Please enter a valid email address`}
+                    {t`Please enter a valid name`}
                   </p>
                 )}
               </div>
-
+            )}
-              {isCredentialsEnabled && (
+            <div>
-                <div>
+              <Input
-                  <Input
+                {...register("email", { required: true })}
-                    type="password"
+                placeholder={t`Enter your email address`}
-                    {...register("password", { required: true })}
+              />
-                    placeholder={t`Enter your password`}
+              {errors.email && (
-                  />
+                <p className="mt-2 text-xs text-red-400">
-                  {errors.password && (
+                  {t`Please enter a valid email address`}
-                    <p className="mt-2 text-xs text-red-400">
+                </p>
-                      {errors.password.message ??
-                        t`Please enter a valid password`}
-                    </p>
-                  )}
-                </div>
               )}
-            </>
+            </div>
-          )}
+
-          {loginError && (
+            {isCredentialsEnabled && (
-            <p className="mt-2 text-xs text-red-400">{loginError}</p>
+              <div>
-          )}
+                <Input
-        </div>
+                  type="password"
-        {(isCredentialsEnabled || isMagicLinkAvailable) && (
+                  {...register("password", { required: true })}
+                  placeholder={t`Enter your password`}
+                />
+                {errors.password && (
+                  <p className="mt-2 text-xs text-red-400">
+                    {errors.password.message ??
+                      t`Please enter a valid password`}
+                  </p>
+                )}
+              </div>
+            )}
+            {loginError && (
+              <p className="mt-2 text-xs text-red-400">{loginError}</p>
+            )}
+          </div>
           <div className="mt-[1.5rem] flex items-center gap-4">
             <Button
               isLoading={isLoginWithEmailPending}
@@ -441,8 +438,11 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
               {isMagicLinkMode ? t`magic link` : t`email`}
             </Button>
           </div>
-        )}
+        </form>
-      </form>
+      )}
+      {!(isCredentialsEnabled || isMagicLinkAvailable) && loginError && (
+        <p className="mt-2 text-xs text-red-400">{loginError}</p>
+      )}
     </div>
   );
 }

apps/web/src/components/Avatar.tsx

@@ -25,7 +25,7 @@ const Avatar = ({
   icon?: React.ReactNode;
   isLoading?: boolean;
 }) => {
-  const initials = name
+  const initials = name?.trim()
     ? getInitialsFromName(name)
     : inferInitialsFromEmail(email);
 

apps/web/src/components/Dashboard.tsx

@@ -12,6 +12,7 @@ import { authClient } from "@kan/auth/client";
 import { useClickOutside } from "~/hooks/useClickOutside";
 import { useModal } from "~/providers/modal";
 import { useWorkspace, WorkspaceProvider } from "~/providers/workspace";
+import { api } from "~/utils/api";
 import SideNavigation from "./SideNavigation";
 
 interface DashboardProps {
@@ -44,6 +45,12 @@ export default function Dashboard({
   const { availableWorkspaces, hasLoaded } = useWorkspace();
 
   const { data: session, isPending: sessionLoading } = authClient.useSession();
+  const { data: user, isLoading: userLoading } = api.user.getUser.useQuery(
+    undefined,
+    {
+      enabled: !!session?.user,
+    },
+  );
 
   const [isSideNavOpen, setIsSideNavOpen] = useState(false);
   const [isRightPanelOpen, setIsRightPanelOpen] = useState(false);
@@ -155,8 +162,12 @@ export default function Dashboard({
             className={`fixed top-12 z-40 h-[calc(100dvh-3rem)] w-[calc(100vw-1.5rem)] transform transition-transform duration-300 ease-in-out md:relative md:top-0 md:h-full md:w-auto md:translate-x-0 ${isSideNavOpen ? "translate-x-0" : "-translate-x-full md:translate-x-0"} `}
           >
             <SideNavigation
-              user={{ displayName: session?.user.name, email: session?.user.email, image: session?.user.image }}
+              user={{
-              isLoading={sessionLoading}
+                displayName: user?.name ?? session?.user.name,
+                email: user?.email ?? session?.user.email ?? "",
+                image: user?.image ?? undefined,
+              }}
+              isLoading={sessionLoading || userLoading}
               onCloseSideNav={closeSideNav}
             />
           </div>

apps/web/src/components/Editor.tsx

@@ -17,6 +17,7 @@ import {
   ReactRenderer,
   useEditor,
 } from "@tiptap/react";
+import Typography from "@tiptap/extension-typography";
 import StarterKit from "@tiptap/starter-kit";
 import Suggestion from "@tiptap/suggestion";
 import {
@@ -386,46 +387,54 @@ export interface SlashNodeAttrs {
   label?: string | null;
 }
 
-const CommandItems: SlashCommandItem[] = [
+const getCommandItems = (disableHeadings: boolean): SlashCommandItem[] => {
-  {
+  const headingCommands: SlashCommandItem[] = disableHeadings
-    title: "Heading 1",
+    ? []
-    icon: <HiH1 />,
+    : [
-    command: ({ editor }) =>
+        {
-      editor.chain().focus().setHeading({ level: 1 }).run(),
+          title: "Heading 1",
-  },
+          icon: <HiH1 />,
-  {
+          command: ({ editor }) =>
-    title: "Heading 2",
+            editor.chain().focus().setHeading({ level: 1 }).run(),
-    icon: <HiH2 />,
+        },
-    command: ({ editor }) =>
+        {
-      editor.chain().focus().setHeading({ level: 2 }).run(),
+          title: "Heading 2",
-  },
+          icon: <HiH2 />,
-  {
+          command: ({ editor }) =>
-    title: "Heading 3",
+            editor.chain().focus().setHeading({ level: 2 }).run(),
-    icon: <HiH3 />,
+        },
-    command: ({ editor }) =>
+        {
-      editor.chain().focus().setHeading({ level: 3 }).run(),
+          title: "Heading 3",
-  },
+          icon: <HiH3 />,
-  {
+          command: ({ editor }) =>
-    title: "Bullet List",
+            editor.chain().focus().setHeading({ level: 3 }).run(),
-    icon: <HiOutlineListBullet />,
+        },
-    command: ({ editor }) => editor.chain().focus().toggleBulletList().run(),
+      ];
-  },
+
-  {
+  return [
-    title: "Ordered List",
+    ...headingCommands,
-    icon: <HiOutlineNumberedList />,
+    {
-    command: ({ editor }) => editor.chain().focus().toggleOrderedList().run(),
+      title: "Bullet List",
-  },
+      icon: <HiOutlineListBullet />,
-  {
+      command: ({ editor }) => editor.chain().focus().toggleBulletList().run(),
-    title: "Blockquote",
+    },
-    icon: <HiOutlineChatBubbleLeftEllipsis />,
+    {
-    command: ({ editor }) => editor.chain().focus().toggleBlockquote().run(),
+      title: "Ordered List",
-  },
+      icon: <HiOutlineNumberedList />,
-  {
+      command: ({ editor }) => editor.chain().focus().toggleOrderedList().run(),
-    title: "Code Block",
+    },
-    icon: <HiOutlineCodeBracketSquare />,
+    {
-    command: ({ editor }) => editor.chain().focus().toggleCodeBlock().run(),
+      title: "Blockquote",
-  },
+      icon: <HiOutlineChatBubbleLeftEllipsis />,
-];
+      command: ({ editor }) => editor.chain().focus().toggleBlockquote().run(),
+    },
+    {
+      title: "Code Block",
+      icon: <HiOutlineCodeBracketSquare />,
+      command: ({ editor }) => editor.chain().focus().toggleCodeBlock().run(),
+    },
+  ];
+};
 
 export default function Editor({
   content,
@@ -434,6 +443,8 @@ export default function Editor({
   readOnly = false,
   workspaceMembers,
   enableYouTubeEmbed = true,
+  placeholder,
+  disableHeadings = false,
 }: {
   content: string | null;
   onChange?: (value: string) => void;
@@ -441,18 +452,23 @@ export default function Editor({
   readOnly?: boolean;
   workspaceMembers: WorkspaceMember[];
   enableYouTubeEmbed?: boolean;
+  placeholder?: string;
+  disableHeadings?: boolean;
 }) {
   const containerRef = useRef<HTMLDivElement>(null);
 
   const editor = useEditor(
     {
       extensions: [
-        StarterKit,
+        StarterKit.configure({
+          heading: disableHeadings ? false : undefined,
+        }),
         Markdown,
         Placeholder.configure({
           placeholder: readOnly
             ? ""
-            : t`Add description... (type '/' to open commands or '@' to mention)`,
+            : placeholder ??
+              t`Add description... (type '/' to open commands or '@' to mention)`,
         }),
         Link.configure({
           openOnClick: true,
@@ -465,10 +481,10 @@ export default function Editor({
           autolink: true,
         }),
         SlashCommands.configure({
-          commandItems: CommandItems,
+          commandItems: getCommandItems(disableHeadings),
           suggestion: {
             items: ({ query }: { query: string }) =>
-              filterSlashCommandItems(CommandItems, query),
+              filterSlashCommandItems(getCommandItems(disableHeadings), query),
             startOfLine: true,
             char: "/",
           },
@@ -480,20 +496,28 @@ export default function Editor({
           suggestion: {
             char: "@",
             items: ({ query }: { query: string }) => {
-              const all: MentionItem[] = workspaceMembers.map(
+              const withEmail = workspaceMembers.filter((member) => member.email);
-                (member: WorkspaceMember) => ({
+              
-                  id: member.publicId,
+              const mapped = withEmail.map((member: WorkspaceMember) => ({
-                  label: member?.user?.name ?? member.email,
+                id: member.publicId,
-                  image: member?.user?.image ?? null,
+                label: member?.user?.name?.trim() || member.email || "",
-                }),
+                image: member?.user?.image ?? null,
+              }));
+              
+              const all: MentionItem[] = mapped.filter(
+                (item) => item.label && item.label.length > 0,
               );
-              const q = query.toLowerCase();
+              
-              return all.filter(
+              const q = query.toLowerCase().trim();
-                (u) =>
+              
-                  u.label &&
+              if (q === "") {
-                  typeof u.label === "string" &&
+                return all;
-                  u.label.toLowerCase().includes(q),
+              }
+              
+              const filtered = all.filter((u) =>
+                u.label.toLowerCase().includes(q),
               );
+              return filtered;
             },
             command: ({ editor, range, props }) => {
               const id = props.id ?? "";
@@ -514,6 +538,17 @@ export default function Editor({
             return `${options.suggestion.char}${node.attrs.label ?? node.attrs.id}`;
           },
         }),
+        Typography.configure({
+            openDoubleQuote: false,
+            closeDoubleQuote: false,
+            openSingleQuote: false,
+            closeSingleQuote: false,
+            oneHalf: false,
+            oneQuarter: false,
+            threeQuarters: false,
+            superscriptTwo: false,
+            superscriptThree: false,
+        }),
         ...(enableYouTubeEmbed ? [YouTubeNode] : []),
       ],
       content,

apps/web/src/components/Tooltip.tsx

@@ -7,7 +7,7 @@ import tippy from "tippy.js";
 
 interface TooltipProps {
   children: ReactNode;
-  content: ReactNode;
+  content?: ReactNode;
   placement?: Placement;
   delay?: number | [number, number];
 }
@@ -24,6 +24,8 @@ export function Tooltip({
   useEffect(() => {
     if (!triggerRef.current) return;
 
+    if (!content) return;
+
     const container = document.createElement("div");
     const root = createRoot(container);
     rootRef.current = root;

apps/web/src/pages/api/upload/attachment.ts

@@ -0,0 +1,128 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { PutObjectCommand } from "@aws-sdk/client-s3";
+
+import { createNextApiContext } from "@kan/api/trpc";
+import * as cardRepo from "@kan/db/repository/card.repo";
+import * as cardActivityRepo from "@kan/db/repository/cardActivity.repo";
+import * as cardAttachmentRepo from "@kan/db/repository/cardAttachment.repo";
+import { generateUID } from "@kan/shared/utils";
+
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+import { createS3Client } from "@kan/shared/utils";
+import { assertPermission } from "@kan/api/utils/permissions";
+
+const MAX_SIZE_BYTES = 50 * 1024 * 1024; // 50MB
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method !== "POST") {
+      return res.status(405).json({ error: "Method not allowed" });
+    }
+
+    try {
+      const { user, db } = await createNextApiContext(req);
+
+      if (!user) {
+        return res.status(401).json({ error: "Unauthorized" });
+      }
+
+      const bucket = env.NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME;
+      if (!bucket) {
+        return res.status(500).json({ error: "Attachments bucket not configured" });
+      }
+
+      const cardPublicId = req.query.cardPublicId;
+      if (typeof cardPublicId !== "string" || cardPublicId.length < 12) {
+        return res.status(400).json({ error: "Invalid cardPublicId" });
+      }
+
+      const contentType = req.headers["content-type"];
+      const contentLengthHeader = req.headers["content-length"];
+      const contentLength = contentLengthHeader
+        ? Number.parseInt(contentLengthHeader, 10)
+        : NaN;
+
+      if (typeof contentType !== "string") {
+        return res.status(400).json({ error: "Missing content type" });
+      }
+
+      if (!Number.isFinite(contentLength) || contentLength <= 0) {
+        return res.status(400).json({ error: "Missing or invalid content length" });
+      }
+
+      if (contentLength > MAX_SIZE_BYTES) {
+        return res.status(400).json({ error: "File too large" });
+      }
+
+      const originalFilenameHeader =
+        (req.headers["x-original-filename"] as string | undefined) ?? "file";
+
+      const sanitizedFilename = originalFilenameHeader
+        .replace(/[^a-zA-Z0-9._-]/g, "_")
+        .substring(0, 200);
+
+      // Get card and check permissions
+      const card = await cardRepo.getWorkspaceAndCardIdByCardPublicId(
+        db,
+        cardPublicId,
+      );
+
+      if (!card) {
+        return res.status(404).json({ error: "Card not found" });
+      }
+
+      // Check if user has permission to edit the card
+      try {
+        await assertPermission(db, user.id, card.workspaceId, "card:edit");
+      } catch {
+        return res.status(403).json({ error: "Permission denied" });
+      }
+
+      const s3Key = `${card.workspaceId}/${cardPublicId}/${generateUID()}-${sanitizedFilename}`;
+
+      const client = createS3Client();
+
+      // Upload the file to S3
+      await client.send(
+        new PutObjectCommand({
+          Bucket: bucket,
+          Key: s3Key,
+          Body: req,
+          ContentType: contentType,
+          ContentLength: contentLength,
+        }),
+      );
+
+      // Create attachment record and log activity
+      const attachment = await cardAttachmentRepo.create(db, {
+        cardId: card.id,
+        filename: sanitizedFilename,
+        originalFilename: originalFilenameHeader,
+        contentType,
+        size: contentLength,
+        s3Key,
+        createdBy: user.id,
+      });
+
+      await cardActivityRepo.create(db, {
+        type: "card.updated.attachment.added",
+        cardId: card.id,
+        createdBy: user.id,
+      });
+
+      return res.status(200).json({ attachment });
+    } catch (error) {
+      console.error("Attachment upload failed", error);
+      return res.status(500).json({ error: "Internal server error" });
+    }
+  },
+);
+

apps/web/src/pages/api/upload/avatar.ts

@@ -0,0 +1,101 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { PutObjectCommand } from "@aws-sdk/client-s3";
+
+import { createNextApiContext } from "@kan/api/trpc";
+import * as userRepo from "@kan/db/repository/user.repo";
+
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+import { createS3Client } from "@kan/shared/utils";
+
+const MAX_SIZE_BYTES = 2 * 1024 * 1024; // 2MB
+const allowedContentTypes = ["image/jpeg", "image/png", "image/webp"];
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method !== "POST") {
+      return res.status(405).json({ error: "Method not allowed" });
+    }
+
+    try {
+      const { user, db } = await createNextApiContext(req);
+
+      if (!user) {
+        return res.status(401).json({ error: "Unauthorized" });
+      }
+
+      const bucket = env.NEXT_PUBLIC_AVATAR_BUCKET_NAME;
+      if (!bucket) {
+        return res.status(500).json({ error: "Avatar bucket not configured" });
+      }
+
+      const contentType = req.headers["content-type"];
+      const contentLengthHeader = req.headers["content-length"];
+      const contentLength = contentLengthHeader
+        ? Number.parseInt(contentLengthHeader, 10)
+        : NaN;
+
+      if (typeof contentType !== "string") {
+        return res.status(400).json({ error: "Missing content type" });
+      }
+
+      if (!allowedContentTypes.includes(contentType)) {
+        return res.status(400).json({ error: "Invalid content type" });
+      }
+
+      if (!Number.isFinite(contentLength) || contentLength <= 0) {
+        return res.status(400).json({ error: "Missing or invalid content length" });
+      }
+
+      if (contentLength > MAX_SIZE_BYTES) {
+        return res.status(400).json({ error: "File too large" });
+      }
+
+      const originalFilenameHeader =
+        (req.headers["x-original-filename"] as string | undefined) ?? "file";
+
+      const sanitizedFilename = originalFilenameHeader
+        .replace(/[^a-zA-Z0-9._-]/g, "_")
+        .substring(0, 200);
+
+      const s3Key = `${user.id}/${sanitizedFilename}`;
+
+      const client = createS3Client();
+
+      // Upload the file to S3
+      await client.send(
+        new PutObjectCommand({
+          Bucket: bucket,
+          Key: s3Key,
+          Body: req,
+          ContentType: contentType,
+          ContentLength: contentLength,
+        }),
+      );
+
+      // Update user image in database
+      const updatedUser = await userRepo.update(db, user.id, {
+        image: s3Key,
+      });
+
+      return res.status(200).json({
+        key: s3Key,
+        filename: sanitizedFilename,
+        contentType,
+        size: contentLength,
+        user: updatedUser,
+      });
+    } catch (error) {
+      console.error("Avatar upload failed", error);
+      return res.status(500).json({ error: "Internal server error" });
+    }
+  },
+);
+

apps/web/src/pages/api/upload/image.ts

@@ -1,75 +0,0 @@
-import type { NextApiRequest, NextApiResponse } from "next";
-import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { env as nextRuntimeEnv } from "next-runtime-env";
-
-import { createNextApiContext } from "@kan/api/trpc";
-
-import { env } from "~/env";
-import { withRateLimit } from "@kan/api/utils/rateLimit";
-
-const allowedContentTypes = ["image/jpeg", "image/png"];
-
-export default withRateLimit(
-  { points: 100, duration: 60 },
-  async (req: NextApiRequest, res: NextApiResponse) => {
-  if (req.method !== "POST") {
-    return res.status(405).json({ error: "Method not allowed" });
-  }
-
-  try {
-    const { user } = await createNextApiContext(req);
-
-    if (!user) {
-      return res.status(401).json({ error: "Unauthorized" });
-    }
-
-    const { filename, contentType } = req.body as {
-      filename: string;
-      contentType: string;
-    };
-
-    // Specific to avatar uploads for now
-    const filenameRegex = /^[a-f0-9\-]+\/[a-zA-Z0-9_\-]+(\.jpg|\.jpeg|\.png)$/;
-
-    if (!filenameRegex.test(filename)) {
-      return res.status(400).json({ error: "Invalid filename" });
-    }
-
-    if (
-      typeof contentType !== "string" ||
-      !allowedContentTypes.includes(contentType)
-    ) {
-      return res.status(400).json({ error: "Invalid content type" });
-    }
-
-    const credentials =
-      env.S3_ACCESS_KEY_ID && env.S3_SECRET_ACCESS_KEY
-        ? {
-            accessKeyId: env.S3_ACCESS_KEY_ID,
-            secretAccessKey: env.S3_SECRET_ACCESS_KEY,
-          }
-        : undefined;
-
-    const client = new S3Client({
-      region: env.S3_REGION ?? "",
-      endpoint: env.S3_ENDPOINT ?? "",
-      forcePathStyle: env.S3_FORCE_PATH_STYLE === "true",
-      credentials,
-    });
-
-    const signedUrl = await getSignedUrl(
-      client,
-      new PutObjectCommand({
-        Bucket: nextRuntimeEnv("NEXT_PUBLIC_AVATAR_BUCKET_NAME") ?? "",
-        Key: filename,
-        ACL: "public-read",
-      }),
-    );
-
-    return res.status(200).json({ url: signedUrl, key: filename });
-  } catch (error) {
-    return res.status(500).json({ error: (error as Error).message });
-  }
-  },
-);

apps/web/src/utils/helpers.ts

@@ -1,5 +1,3 @@
-import { env } from "next-runtime-env";
-
 export const formatToArray = (
   value: string | string[] | undefined,
 ): string[] => {
@@ -52,14 +50,5 @@ export const getAvatarUrl = (imageOrKey: string | null) => {
     return imageOrKey;
   }
 
-  const bucket = env("NEXT_PUBLIC_AVATAR_BUCKET_NAME");
+  return "";
-  const useVirtualHostedUrls = env("NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS");
-  const storageDomain = env("NEXT_PUBLIC_STORAGE_DOMAIN");
-
-  if (useVirtualHostedUrls === "true" && storageDomain) {
-    return `https://${bucket}.${storageDomain}/${imageOrKey}`;
-  }
-
-  const storageUrl = env("NEXT_PUBLIC_STORAGE_URL");
-  return `${storageUrl}/${bucket}/${imageOrKey}`;
 };

apps/web/src/views/board/components/UpdateBoardSlugButton.tsx

@@ -1,24 +1,40 @@
-import Link from "next/link";
+import { Fragment } from "react";
 import { t } from "@lingui/core/macro";
 import { env } from "next-runtime-env";
 import { HiLink } from "react-icons/hi";
 
 import { Tooltip } from "~/components/Tooltip";
+import { usePopup } from "~/providers/popup";
+
+const displayBaseUrl =
+  env("NEXT_PUBLIC_KAN_ENV") === "cloud"
+    ? "kan.bn"
+    : env("NEXT_PUBLIC_BASE_URL");
+
+const linkBaseUrl = env("NEXT_PUBLIC_BASE_URL");
+
+const pathSeparator = (
+  <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600" />
+);
 
 const UpdateBoardSlugButton = ({
   handleOnClick,
   workspaceSlug,
   boardSlug,
+  boardPublicId,
+  visibility,
   isLoading,
   canEdit,
 }: {
   handleOnClick: () => void;
   workspaceSlug: string;
   boardSlug: string;
+  boardPublicId: string;
+  visibility: "public" | "private";
   isLoading: boolean;
   canEdit: boolean;
 }) => {
-  if (!isLoading && (!workspaceSlug || !boardSlug)) return <></>;
+  const { showPopup } = usePopup();
 
   if (isLoading) {
     return (
@@ -26,44 +42,55 @@ const UpdateBoardSlugButton = ({
     );
   }
 
+  if (!workspaceSlug || !boardSlug || !boardPublicId) return <></>;
+
+  const isPublic = visibility === "public";
+  const boardUrl = isPublic
+    ? `${linkBaseUrl}/${workspaceSlug}/${boardSlug}`
+    : `${linkBaseUrl}/boards/${boardPublicId}`;
+
+  const pathSegments = isPublic
+    ? [displayBaseUrl, workspaceSlug, boardSlug]
+    : [displayBaseUrl, "boards", boardPublicId];
+
   return (
     <Tooltip
-      content={!canEdit && !isLoading ? t`You don't have permission` : undefined}
+      content={!canEdit ? t`You don't have permission` : undefined}
     >
       <button
         onClick={canEdit ? handleOnClick : undefined}
         disabled={!canEdit || isLoading}
         className="hidden cursor-pointer items-center gap-2 rounded-full border-[1px] bg-light-50 p-1 pl-4 pr-1 text-sm text-light-950 hover:bg-light-100 disabled:cursor-not-allowed disabled:opacity-60 dark:border-dark-600 dark:bg-dark-50 dark:text-dark-900 dark:hover:bg-dark-100 xl:flex"
       >
-      <div className="flex items-center">
+        <div className="flex items-center">
-        <span>
+          {pathSegments.map((segment, i) => (
-          {env("NEXT_PUBLIC_KAN_ENV") === "cloud"
+            <Fragment key={i}>
-            ? "kan.bn"
+              {i > 0 && pathSeparator}
-            : env("NEXT_PUBLIC_BASE_URL")}
+              <span>{segment}</span>
-        </span>
+            </Fragment>
-        <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600"></div>
+          ))}
-        <span>{workspaceSlug}</span>
+        </div>
-        <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600"></div>
+        <button
-        <span>{boardSlug}</span>
+          type="button"
-      </div>
+          onClick={(e) => {
-      <Link
+            e.stopPropagation();
-        href={`${env("NEXT_PUBLIC_BASE_URL")}/${workspaceSlug}/${boardSlug}`}
+            navigator.clipboard.writeText(boardUrl).then(
-        target="_blank"
+              () =>
-        rel="noopener noreferrer"
+                showPopup({
-        onClick={(e) => {
+                  header: t`Link copied`,
-          e.stopPropagation();
+                  icon: "success",
-          if (!canEdit) {
+                  message: t`Board URL copied to clipboard`,
-            e.preventDefault();
+                }),
-          }
+            ).catch(() => undefined);
-        }}
+          }}
-        className="flex h-7 w-7 items-center justify-center rounded-full hover:bg-light-200 dark:hover:bg-dark-200"
+          className="flex h-7 w-7 items-center justify-center rounded-full hover:bg-light-200 dark:hover:bg-dark-200"
-      >
+          aria-label={t`Copy board link`}
-        <HiLink className="h-[13px] w-[13px]" />
+        >
-      </Link>
+          <HiLink className="h-[13px] w-[13px]" />
-    </button>
+        </button>
+      </button>
     </Tooltip>
   );
 };
 
-
 export default UpdateBoardSlugButton;

apps/web/src/views/board/components/UpdateBoardSlugForm.tsx

@@ -156,7 +156,7 @@ export function UpdateBoardSlugForm({
         <div className="flex items-center gap-2">
           <Button
             variant="secondary"
-            href="/settings?tab=workspace"
+            href="/settings/workspace"
             onClick={closeModal}
           >
             {t`Edit workspace URL`}

apps/web/src/views/board/index.tsx

@@ -443,6 +443,8 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                   isLoading={isLoading}
                   workspaceSlug={workspace.slug ?? ""}
                   boardSlug={boardData?.slug ?? ""}
+                  boardPublicId={boardId ?? ""}
+                  visibility={boardData?.visibility ?? "private"}
                   canEdit={canEditBoard}
                 />
                 <VisibilityButton

apps/web/src/views/card/components/AttachmentUpload.tsx

@@ -7,6 +7,7 @@ import { twMerge } from "tailwind-merge";
 import Button from "~/components/Button";
 import { useModal } from "~/providers/modal";
 import { usePopup } from "~/providers/popup";
+import { env } from "next-runtime-env";
 import { api } from "~/utils/api";
 import { invalidateCard } from "~/utils/cardInvalidation";
 
@@ -18,62 +19,33 @@ export function AttachmentUpload({ cardPublicId }: { cardPublicId: string }) {
   const [isDragging, setIsDragging] = useState(false);
   const inputRef = useRef<HTMLInputElement | null>(null);
 
-  const generateUploadUrl = api.attachment.generateUploadUrl.useMutation();
+  const uploadFile = async (file: File) => {
-  const confirmAttachment = api.attachment.confirm.useMutation({
+    setUploading(true);
-    onSuccess: async () => {
+
+    try {
+      const baseUrl = env("NEXT_PUBLIC_BASE_URL") ?? "";
+      const response = await fetch(
+        `${baseUrl}/api/upload/attachment?cardPublicId=${encodeURIComponent(cardPublicId)}`,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": file.type,
+            "x-original-filename": file.name,
+          },
+          body: file,
+        },
+      );
+
+      if (!response.ok) {
+        throw new Error("Upload failed");
+      }
+
       await invalidateCard(utils, cardPublicId);
       showPopup({
         header: t`Attachment uploaded`,
         message: t`Your file has been uploaded successfully.`,
         icon: "success",
       });
-    },
-    onError: () => {
-      showPopup({
-        header: t`Upload failed`,
-        message: t`Failed to upload attachment. Please try again.`,
-        icon: "error",
-      });
-    },
-    onSettled: () => {
-      setUploading(false);
-    },
-  });
-
-  const uploadFile = async (file: File) => {
-    setUploading(true);
-
-    try {
-      // Generate presigned URL
-      const { url, key } = await generateUploadUrl.mutateAsync({
-        cardPublicId,
-        filename: file.name,
-        contentType: file.type,
-        size: file.size,
-      });
-
-      // Upload file to S3
-      const uploadResponse = await fetch(url, {
-        method: "PUT",
-        body: file,
-        headers: {
-          "Content-Type": file.type,
-        },
-      });
-
-      if (!uploadResponse.ok) {
-        throw new Error("Upload failed");
-      }
-
-      // Confirm attachment in database
-      await confirmAttachment.mutateAsync({
-        cardPublicId,
-        s3Key: key,
-        filename: file.name,
-        originalFilename: file.name,
-        contentType: file.type,
-        size: file.size,
-      });
     } catch {
       showPopup({
         header: t`Upload failed`,

apps/web/src/views/card/components/Comment.tsx

@@ -1,12 +1,13 @@
 import { t } from "@lingui/core/macro";
 import { formatDistanceToNow } from "date-fns";
 import { useState } from "react";
-import ContentEditable from "react-contenteditable";
 import { useForm } from "react-hook-form";
 import { HiEllipsisHorizontal, HiPencil, HiTrash } from "react-icons/hi2";
 
 import Avatar from "~/components/Avatar";
 import Button from "~/components/Button";
+import Editor from "~/components/Editor";
+import type { WorkspaceMember } from "~/components/Editor";
 import Dropdown from "~/components/Dropdown";
 import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
@@ -29,7 +30,6 @@ const Comment = ({
   createdAt,
   comment,
   isAuthor,
-  isAdmin,
   isEdited = false,
   isViewOnly = false,
 }: {
@@ -42,7 +42,6 @@ const Comment = ({
   createdAt: string;
   comment: string | undefined;
   isAuthor: boolean;
-  isAdmin: boolean;
   isEdited: boolean;
   isViewOnly: boolean;
 }) => {
@@ -57,6 +56,30 @@ const Comment = ({
     },
   });
 
+  const { data: cardData } = api.card.byId.useQuery(
+    {
+      cardPublicId,
+    },
+    {
+      enabled: !!cardPublicId && cardPublicId.length >= 12,
+    },
+  );
+
+  const workspaceMembers: WorkspaceMember[] =
+    cardData?.list.board.workspace.members
+      .filter((member) => member.email)
+      .map((member) => ({
+        publicId: member.publicId,
+        email: member.email,
+        user: member.user
+          ? {
+              id: member.user.id,
+              name: member.user.name ?? null,
+              image: member.user.image ?? null,
+            }
+          : null,
+      })) ?? [];
+
   if (!publicId) return null;
 
   const updateCommentMutation = api.card.updateComment.useMutation({
@@ -142,21 +165,28 @@ const Comment = ({
         )}
       </div>
       {!isEditing ? (
-        <ContentEditable
+        <div className="mt-2">
-          html={comment ?? ""}
+          <Editor
-          disabled={true}
+            content={comment ?? null}
-          className="break-anywhere mt-2 text-sm"
+            readOnly={true}
-        />
+            workspaceMembers={workspaceMembers}
+            enableYouTubeEmbed={false}
+            disableHeadings={true}
+          />
+        </div>
       ) : (
         <form onSubmit={handleSubmit(onSubmit)}>
-          <ContentEditable
+          <div className="mt-2">
-            placeholder={t`Add a comment...`}
+            <Editor
-            html={watch("comment")}
+              content={watch("comment")}
-            disabled={false}
+              onChange={(value) => setValue("comment", value)}
-            onChange={(e) => setValue("comment", e.target.value)}
+              workspaceMembers={workspaceMembers}
-            className="block w-full max-w-[800px] border-0 bg-transparent py-1.5 text-sm text-light-900 focus-visible:outline-none dark:text-dark-1000 sm:text-sm sm:leading-6"
+              enableYouTubeEmbed={false}
-          />
+              placeholder={t`Add comment... (type '/' to open commands or '@' to mention)`}
-          <div className="flex justify-end space-x-2">
+              disableHeadings={true}
+            />
+          </div>
+          <div className="flex justify-end space-x-2 mt-2">
             <Button
               size="sm"
               variant="ghost"

apps/web/src/views/card/components/Dropdown.tsx

@@ -1,6 +1,7 @@
 import { t } from "@lingui/core/macro";
 import {
   HiEllipsisHorizontal,
+  HiLink,
   HiOutlineCheckCircle,
   HiOutlineTrash,
 } from "react-icons/hi2";
@@ -10,18 +11,54 @@ import { authClient } from "@kan/auth/client";
 import Dropdown from "~/components/Dropdown";
 import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
+import { usePopup } from "~/providers/popup";
 
 export default function CardDropdown({
+  cardPublicId,
+  isTemplate,
+  boardPublicId,
   cardCreatedBy,
 }: {
+  cardPublicId: string;
+  isTemplate?: boolean;
+  boardPublicId?: string;
   cardCreatedBy?: string | null;
 }) {
   const { openModal } = useModal();
+  const { showPopup } = usePopup();
   const { canEditCard, canDeleteCard } = usePermissions();
   const { data: session } = authClient.useSession();
   const isCreator = cardCreatedBy && session?.user.id === cardCreatedBy;
 
+  const handleCopyCardLink = async () => {
+    const path =
+      isTemplate && boardPublicId
+        ? `/templates/${boardPublicId}/cards/${cardPublicId}`
+        : `/cards/${cardPublicId}`;
+    const url = `${window.location.origin}${path}`;
+    try {
+      await navigator.clipboard.writeText(url);
+      showPopup({
+        header: t`Link copied`,
+        icon: "success",
+        message: t`Card URL copied to clipboard`,
+      });
+    } catch (error) {
+      console.error(error);
+      showPopup({
+        header: t`Unable to copy link`,
+        icon: "error",
+        message: t`Please try again.`,
+      });
+    }
+  };
+
   const items = [
+    {
+      label: t`Copy card link`,
+      action: handleCopyCardLink,
+      icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
+    },
     ...(canEditCard
       ? [
           {

apps/web/src/views/card/components/NewCommentForm.tsx

@@ -1,8 +1,9 @@
 import { t } from "@lingui/core/macro";
-import ContentEditable from "react-contenteditable";
 import { useForm } from "react-hook-form";
 import { HiOutlineArrowUp } from "react-icons/hi2";
 
+import Editor from "~/components/Editor";
+import type { WorkspaceMember } from "~/components/Editor";
 import LoadingSpinner from "~/components/LoadingSpinner";
 import { usePermissions } from "~/hooks/usePermissions";
 import { usePopup } from "~/providers/popup";
@@ -13,7 +14,13 @@ interface FormValues {
   comment: string;
 }
 
-const NewCommentForm = ({ cardPublicId }: { cardPublicId: string }) => {
+const NewCommentForm = ({
+  cardPublicId,
+  workspaceMembers,
+}: {
+  cardPublicId: string;
+  workspaceMembers: WorkspaceMember[];
+}) => {
   const utils = api.useUtils();
   const { showPopup } = usePopup();
   const { canCreateComment } = usePermissions();
@@ -23,10 +30,6 @@ const NewCommentForm = ({ cardPublicId }: { cardPublicId: string }) => {
     },
   });
 
-  const queryParams = {
-    cardPublicId,
-  };
-
   const addCommentMutation = api.card.addComment.useMutation({
     onError: (_error, _newList) => {
       showPopup({
@@ -57,18 +60,13 @@ const NewCommentForm = ({ cardPublicId }: { cardPublicId: string }) => {
       onSubmit={handleSubmit(onSubmit)}
       className="flex w-full max-w-[800px] flex-col rounded-xl border border-light-600 bg-light-100 p-4 text-light-900 focus-visible:outline-none dark:border-dark-400 dark:bg-dark-100 dark:text-dark-1000 sm:text-sm sm:leading-6"
     >
-      <ContentEditable
+      <Editor
-        placeholder={t`Add a comment...`}
+        content={watch("comment")}
-        html={watch("comment")}
+        onChange={(value) => setValue("comment", value)}
-        disabled={false}
+        workspaceMembers={workspaceMembers}
-        onChange={(e) => setValue("comment", e.target.value)}
+        enableYouTubeEmbed={false}
-        className="block w-full border-0 bg-transparent py-1.5 text-light-900 focus-visible:outline-none dark:text-dark-1000 sm:text-sm sm:leading-6"
+        placeholder={t`Add comment... (type '/' to open commands or '@' to mention)`}
-        onKeyDown={async (e) => {
+        disableHeadings={true}
-          if (e.key === "Enter" && e.shiftKey) {
-            e.preventDefault();
-            await handleSubmit(onSubmit)();
-          }
-        }}
       />
       <div className="flex justify-end">
         <button

apps/web/src/views/card/index.tsx

@@ -5,6 +5,8 @@ import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
 import { IoChevronForwardSharp } from "react-icons/io5";
 
+import { authClient } from "@kan/auth/client";
+
 import Avatar from "~/components/Avatar";
 import Editor from "~/components/Editor";
 import FeedbackModal from "~/components/FeedbackModal";
@@ -14,8 +16,6 @@ import Modal from "~/components/modal";
 import { NewWorkspaceForm } from "~/components/NewWorkspaceForm";
 import { PageHead } from "~/components/PageHead";
 import { EditYouTubeModal } from "~/components/YouTubeEmbed/EditYouTubeModal";
-import { authClient } from "@kan/auth/client";
-
 import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
 import { usePopup } from "~/providers/popup";
@@ -167,7 +167,6 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
   const {
     modalContentType,
     entityId,
-    openModal,
     getModalState,
     clearModalState,
     isOpen,
@@ -198,8 +197,24 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
   };
 
   const board = card?.list.board;
+  const workspaceMembers = board?.workspace.members;
   const boardId = board?.publicId;
 
+  const editorWorkspaceMembers =
+    workspaceMembers
+      ?.filter((member) => member.email)
+      .map((member) => ({
+        publicId: member.publicId,
+        email: member.email,
+        user: member.user
+          ? {
+              id: member.user.id,
+              name: member.user.name ?? null,
+              image: member.user.image ?? null,
+            }
+          : null,
+      })) ?? [];
+
   const updateCard = api.card.update.useMutation({
     onError: () => {
       showPopup({
@@ -286,6 +301,7 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
 
   if (!cardId) return <></>;
 
+
   return (
     <>
       <PageHead
@@ -317,7 +333,12 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
                 </Link>
               </div>
               <div className="flex items-center gap-2">
-                <Dropdown cardCreatedBy={card?.createdBy} />
+                <Dropdown
+                  cardPublicId={cardId}
+                  isTemplate={isTemplate}
+                  boardPublicId={boardId}
+                  cardCreatedBy={card?.createdBy}
+                />
               </div>
             </>
           )}
@@ -374,9 +395,15 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
                       <div className="mt-2">
                         <Editor
                           content={card.description}
-                          onChange={canEdit ? (e) => setValue("description", e) : undefined}
+                          onChange={
-                          onBlur={canEdit ? () => handleSubmit(onSubmit)() : undefined}
+                            canEdit
-                          workspaceMembers={board?.workspace.members ?? []}
+                              ? (e) => setValue("description", e)
+                              : undefined
+                          }
+                          onBlur={
+                            canEdit ? () => handleSubmit(onSubmit)() : undefined
+                          }
+                          workspaceMembers={workspaceMembers ?? []}
                           readOnly={!canEdit}
                         />
                       </div>
@@ -420,7 +447,10 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
                     </div>
                     {!isTemplate && (
                       <div className="mt-6">
-                        <NewCommentForm cardPublicId={cardId} />
+                        <NewCommentForm
+                          cardPublicId={cardId}
+                          workspaceMembers={editorWorkspaceMembers}
+                        />
                       </div>
                     )}
                   </div>

apps/web/src/views/members/index.tsx

@@ -126,7 +126,6 @@ export default function MembersPage() {
                   name={memberName ?? ""}
                   email={memberEmail ?? ""}
                   imageUrl={memberImage ? getAvatarUrl(memberImage) : undefined}
-                  icon={showPendingIcon ? "?" : undefined}
                 />
               )}
             </div>

apps/web/src/views/public/board/CardModal.tsx

@@ -1,12 +1,13 @@
 import { useRouter } from "next/router";
 import { t } from "@lingui/core/macro";
 import { useEffect, useRef, useState } from "react";
-import { HiXMark } from "react-icons/hi2";
+import { HiLink, HiXMark } from "react-icons/hi2";
 
 import Badge from "~/components/Badge";
 import Editor from "~/components/Editor";
 import LabelIcon from "~/components/LabelIcon";
 import { useModal } from "~/providers/modal";
+import { usePopup } from "~/providers/popup";
 import { api } from "~/utils/api";
 import ActivityList from "~/views/card/components/ActivityList";
 import { AttachmentThumbnails } from "~/views/card/components/AttachmentThumbnails";
@@ -23,10 +24,29 @@ export function CardModal({
 }) {
   const router = useRouter();
   const { closeModal, isOpen } = useModal();
+  const { showPopup } = usePopup();
   const [showFade, setShowFade] = useState(false);
   const [showTopFade, setShowTopFade] = useState(false);
   const scrollRef = useRef<HTMLDivElement>(null);
 
+  const handleCopyCardLink = async () => {
+    try {
+      await navigator.clipboard.writeText(window.location.href);
+      showPopup({
+        header: t`Link copied`,
+        icon: "success",
+        message: t`Card URL copied to clipboard`,
+      });
+    } catch (error) {
+      console.error(error);
+      showPopup({
+        header: t`Unable to copy link`,
+        icon: "error",
+        message: t`Please try again.`,
+      });
+    }
+  };
+
   const { data, isLoading } = api.card.byId.useQuery(
     {
       cardPublicId: cardPublicId ?? "",
@@ -65,33 +85,44 @@ export function CardModal({
         <div className="h-full p-8">
           <div className="mb-6">
             <div className="flex w-full items-center justify-between">
-              <button
+              <div className="absolute right-[2rem] top-[2rem] flex items-center gap-1">
-                className="absolute right-[2rem] top-[2rem] rounded p-1 hover:bg-light-300 focus:outline-none dark:hover:bg-dark-300"
+                <button
-                onClick={(e) => {
+                  type="button"
-                  e.preventDefault();
+                  onClick={handleCopyCardLink}
-                  closeModal();
+                  className="rounded p-1.5 transition-all hover:bg-light-200 focus:outline-none dark:hover:bg-dark-100"
+                  aria-label="Copy card link"
+                >
+                  <HiLink className="h-4 w-4 text-light-900 dark:text-dark-900" />
+                </button>
+                <button
+                  type="button"
+                  className="rounded p-1.5 transition-all hover:bg-light-200 focus:outline-none dark:hover:bg-dark-100"
+                  onClick={(e) => {
+                    e.preventDefault();
+                    closeModal();
 
-                  setTimeout(() => {
+                    setTimeout(() => {
-                    void router.replace(
+                      void router.replace(
-                      {
+                        {
-                        pathname: router.pathname,
+                          pathname: router.pathname,
-                        query: {
+                          query: {
-                          ...router.query,
+                            ...router.query,
-                          workspaceSlug,
+                            workspaceSlug: workspaceSlug ?? "",
-                          boardSlug: [boardSlug],
+                            boardSlug: [boardSlug ?? ""],
+                          },
                         },
-                      },
+                        undefined,
-                      undefined,
+                        { shallow: true },
-                      { shallow: true },
+                      );
-                    );
+                    }, 400);
-                  }, 400);
+                  }}
-                }}
+                >
-              >
+                  <HiXMark
-                <HiXMark
+                    size={18}
-                  size={18}
+                    className="text-light-900 dark:text-dark-900"
-                  className="dark:text-dark-9000 text-light-900"
+                  />
-                />
+                </button>
-              </button>
+              </div>
               {isLoading ? (
                 <div className="flex space-x-2">
                   <div className="h-[2.3rem] w-[300px] animate-pulse rounded-[5px] bg-light-300 dark:bg-dark-300" />

apps/web/src/views/public/board/index.tsx

@@ -70,30 +70,35 @@ export default function PublicBoardView() {
     },
   );
 
-  const CopyBoardLink = () => {
+  const handleCopyBoardLink = async () => {
-    return (
+    try {
-      <button
+      await navigator.clipboard.writeText(window.location.href);
-        onClick={async () => {
+      showPopup({
-          try {
+        header: t`Link copied`,
-            await navigator.clipboard.writeText(window.location.href);
+        icon: "success",
-          } catch (error) {
+        message: t`Board URL copied to clipboard`,
-            console.error(error);
+      });
-          }
+    } catch (error) {
-
+      console.error(error);
-          showPopup({
+      showPopup({
-            header: t`Link copied`,
+        header: t`Unable to copy link`,
-            icon: "success",
+        icon: "error",
-            message: t`Board URL copied to clipboard`,
+        message: t`Please try again.`,
-          });
+      });
-        }}
+    }
-        className="rounded p-1.5 transition-all hover:bg-light-200 dark:hover:bg-dark-100"
-        aria-label={`Copy board URL`}
-      >
-        <HiLink className={`h-4 w-4 text-light-900 dark:text-dark-900`} />
-      </button>
-    );
   };
 
+  const CopyBoardLink = () => (
+    <button
+      type="button"
+      onClick={handleCopyBoardLink}
+      className="rounded p-1.5 transition-all hover:bg-light-200 focus:outline-none dark:hover:bg-dark-100"
+      aria-label="Copy board URL"
+    >
+      <HiLink className="h-4 w-4 text-light-900 dark:text-dark-900" />
+    </button>
+  );
+
   const pathWithoutQuery = router.asPath.split("?")[0];
   const splitPath = pathWithoutQuery?.split("/") ?? [];
   const cardPublicId = splitPath.length > 3 ? splitPath[3] : null;

apps/web/src/views/settings/components/Avatar.tsx

@@ -58,28 +58,6 @@ export default function Avatar({
   const [crop, setCrop] = useState<PercentCrop>();
   const imgRef = useRef<HTMLImageElement | null>(null);
 
-  const updateUser = api.user.update.useMutation({
-    onSuccess: async () => {
-      showPopup({
-        header: t`Profile image updated`,
-        message: t`Your profile image has been updated.`,
-        icon: "success",
-      });
-      try {
-        await utils.user.getUser.refetch();
-      } catch (e) {
-        console.error(e);
-        throw e;
-      }
-    },
-    onError: () => {
-      showPopup({
-        header: t`Error updating profile image`,
-        message: t`Please try again later, or contact customer support.`,
-        icon: "error",
-      });
-    },
-  });
 
   const avatarUrl = userImage ? getAvatarUrl(userImage) : undefined;
 
@@ -187,29 +165,32 @@ export default function Avatar({
       const originalExt = selectedFile.name.split(".").pop() ?? "jpg";
       const fileName = `${userId}/avatar-${generateUID()}.${originalExt}`;
 
+      const baseUrl = env("NEXT_PUBLIC_BASE_URL") ?? "";
       const response = await fetch(
-        env("NEXT_PUBLIC_BASE_URL") + "/api/upload/image",
+        `${baseUrl}/api/upload/avatar`,
         {
           method: "POST",
           headers: {
-            "Content-Type": "application/json",
+            "Content-Type": blob.type,
+            "x-original-filename": fileName,
           },
-          body: JSON.stringify({ filename: fileName, contentType: blob.type }),
+          body: blob,
         },
       );
 
-      if (!response.ok) throw new Error("Failed to get pre-signed URL");
+      if (!response.ok) {
+        throw new Error("Failed to upload profile image");
+      }
 
-      const { url } = (await response.json()) as { url: string };
+      // User image is updated in the backend, refresh user data
+      await utils.user.getUser.refetch();
       
-      const uploadResponse = await fetch(url, {
+      showPopup({
-        method: "PUT",
+        header: t`Profile image updated`,
-        body: blob,
+        message: t`Your profile image has been updated.`,
+        icon: "success",
       });
       
-      if (!uploadResponse.ok) throw new Error("Failed to upload profile image");
-
-      updateUser.mutate({ image: fileName });
       setCropDialogOpen(false);
       resetCropState();
     } catch (error) {
@@ -227,7 +208,7 @@ export default function Avatar({
     resetCropState,
     selectedFile,
     showPopup,
-    updateUser,
+    utils.user.getUser,
     userId,
   ]);
 

packages/api/package.json

@@ -27,6 +27,10 @@
     "./utils/rateLimit": {
       "types": "./dist/utils/rateLimit.d.ts",
       "default": "./src/utils/rateLimit.ts"
+    },
+    "./utils/permissions": {
+      "types": "./dist/utils/permissions.d.ts",
+      "default": "./src/utils/permissions.ts"
     }
   },
   "license": "GPL-3.0",
@@ -39,8 +43,6 @@
     "typecheck": "tsc --noEmit --emitDeclarationOnly false"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.802.0",
-    "@aws-sdk/s3-request-presigner": "^3.812.0",
     "@kan/auth": "workspace:*",
     "@kan/db": "workspace:*",
     "@kan/email": "workspace:^",

packages/api/src/routers/attachment.ts

@@ -9,7 +9,7 @@ import { generateUID } from "@kan/shared/utils";
 
 import { createTRPCRouter, protectedProcedure } from "../trpc";
 import { assertPermission } from "../utils/permissions";
-import { deleteObject, generateUploadUrl } from "../utils/s3";
+import { deleteObject, generateUploadUrl } from "@kan/shared/utils";
 
 export const attachmentRouter = createTRPCRouter({
   generateUploadUrl: protectedProcedure

packages/api/src/routers/board.ts

@@ -10,6 +10,7 @@ import * as workspaceRepo from "@kan/db/repository/workspace.repo";
 import { colours } from "@kan/shared/constants";
 import {
   convertDueDateFiltersToRanges,
+  generateAvatarUrl,
   generateSlug,
   generateUID,
 } from "@kan/shared/utils";
@@ -142,7 +143,40 @@ export const boardRouter = createTRPCRouter({
         },
       );
 
-      return result;
+      if (!result) {
+        throw new TRPCError({
+          message: `Board with public ID ${input.boardPublicId} not found`,
+          code: "NOT_FOUND",
+        });
+      }
+
+      // Generate presigned URLs for workspace member avatars
+      const workspaceWithAvatarUrls = result.workspace
+        ? {
+            ...result.workspace,
+            members: await Promise.all(
+              result.workspace.members.map(async (member) => {
+                if (!member.user?.image) {
+                  return member;
+                }
+
+                const avatarUrl = await generateAvatarUrl(member.user.image);
+                return {
+                  ...member,
+                  user: {
+                    ...member.user,
+                    image: avatarUrl,
+                  },
+                };
+              }),
+            ),
+          }
+        : result.workspace;
+
+      return {
+        ...result,
+        workspace: workspaceWithAvatarUrls,
+      };
     }),
   bySlug: publicProcedure
     .meta({

packages/api/src/routers/card.ts

@@ -10,8 +10,9 @@ import * as workspaceRepo from "@kan/db/repository/workspace.repo";
 
 import { createTRPCRouter, protectedProcedure, publicProcedure } from "../trpc";
 import { mergeActivities } from "../utils/activities";
+import { sendMentionEmails } from "../utils/notifications";
 import { assertCanDelete, assertCanEdit, assertPermission } from "../utils/permissions";
-import { generateDownloadUrl } from "../utils/s3";
+import { generateAttachmentUrl, generateAvatarUrl } from "@kan/shared/utils";
 
 export const cardRouter = createTRPCRouter({
   create: protectedProcedure
@@ -153,6 +154,17 @@ export const cardRouter = createTRPCRouter({
         await cardActivityRepo.bulkCreate(ctx.db, cardActivitesInsert);
       }
 
+      if (input.description) {
+        sendMentionEmails({
+          db: ctx.db,
+          cardPublicId: newCard.publicId,
+          commentHtml: input.description,
+          commenterUserId: userId,
+        }).catch((error) => {
+          console.error("Failed to send mention emails:", error);
+        });
+      }
+
       return newCard;
     }),
   addComment: protectedProcedure
@@ -215,6 +227,16 @@ export const cardRouter = createTRPCRouter({
         createdBy: userId,
       });
 
+      sendMentionEmails({
+        db: ctx.db,
+        cardPublicId: input.cardPublicId,
+        commentHtml: input.comment,
+        commenterUserId: userId,
+        commentId: newComment.id,
+      }).catch((error) => {
+        console.error("Failed to send mention emails:", error);
+      });
+
       return newComment;
     }),
   updateComment: protectedProcedure
@@ -295,6 +317,16 @@ export const cardRouter = createTRPCRouter({
         createdBy: userId,
       });
 
+      sendMentionEmails({
+        db: ctx.db,
+        cardPublicId: input.cardPublicId,
+        commentHtml: input.comment,
+        commenterUserId: userId,
+        commentId: updatedComment.id,
+      }).catch((error) => {
+        console.error("Failed to send mention emails:", error);
+      });
+
       return updatedComment;
     }),
   deleteComment: protectedProcedure
@@ -631,45 +663,54 @@ export const cardRouter = createTRPCRouter({
         });
 
       // Generate URLs for all attachments
-      const bucket = process.env.NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME;
+      const attachmentsWithUrls = await Promise.all(
-      if (result.attachments && Array.isArray(result.attachments)) {
+        result.attachments.map(async (attachment) => {
-        const attachments = result.attachments as {
+          const url = await generateAttachmentUrl(attachment.s3Key);
-          publicId: string;
+          return {
-          contentType: string;
+            publicId: attachment.publicId,
-          s3Key: string;
+            contentType: attachment.contentType,
-          originalFilename: string | null;
+            s3Key: attachment.s3Key,
-          size?: number | null;
+            originalFilename: attachment.originalFilename,
-        }[];
+            size: attachment.size,
+            url,
+          };
+        }),
+      );
 
-        const attachmentsWithUrls = await Promise.all(
+      // Generate presigned URLs for workspace member avatars
-          attachments.map(async (attachment) => {
+      const workspaceWithAvatarUrls = result.list.board.workspace
-            const base = {
+        ? {
-              publicId: attachment.publicId,
+            ...result.list.board.workspace,
-              contentType: attachment.contentType,
+            members: await Promise.all(
-              s3Key: attachment.s3Key,
+              result.list.board.workspace.members.map(async (member) => {
-              originalFilename: attachment.originalFilename,
+                if (!member.user?.image) {
-              size: attachment.size,
+                  return member;
-            };
+                }
-            if (!bucket || !attachment.s3Key) {
-              return { ...base, url: null };
-            }
-            try {
-              const url = await generateDownloadUrl(
-                bucket,
-                attachment.s3Key,
-                86400, // 24 hours expiration
-              );
-              return { ...base, url };
-            } catch {
-              // If URL generation fails, return attachment with url: null
-              return { ...base, url: null };
-            }
-          }),
-        );
-        return { ...result, attachments: attachmentsWithUrls };
-      }
 
-      return { ...result, attachments: [] };
+                const avatarUrl = await generateAvatarUrl(member.user.image);
+                return {
+                  ...member,
+                  user: {
+                    ...member.user,
+                    image: avatarUrl,
+                  },
+                };
+              }),
+            ),
+          }
+        : result.list.board.workspace;
+
+      return {
+        ...result,
+        attachments: attachmentsWithUrls,
+        list: {
+          ...result.list,
+          board: {
+            ...result.list.board,
+            workspace: workspaceWithAvatarUrls,
+          },
+        },
+      };
     }),
   getActivities: publicProcedure
     .meta({
@@ -738,7 +779,39 @@ export const cardRouter = createTRPCRouter({
         },
       );
 
-      const mergedActivities = mergeActivities(result.activities);
+      // Generate presigned URLs for user avatars in activities
+      const activitiesWithAvatarUrls = await Promise.all(
+        result.activities.map(async (activity) => {
+          const updatedActivity = { ...activity };
+
+          // Generate presigned URL for activity user avatar
+          if (activity.user?.image) {
+            const userAvatarUrl = await generateAvatarUrl(activity.user.image);
+            updatedActivity.user = {
+              ...activity.user,
+              image: userAvatarUrl,
+            };
+          }
+
+          // Generate presigned URL for member user avatar (if exists)
+          if (activity.member?.user?.image) {
+            const memberAvatarUrl = await generateAvatarUrl(
+              activity.member.user.image,
+            );
+            updatedActivity.member = {
+              ...activity.member,
+              user: {
+                ...activity.member.user,
+                image: memberAvatarUrl,
+              },
+            };
+          }
+
+          return updatedActivity;
+        }),
+      );
+
+      const mergedActivities = mergeActivities(activitiesWithAvatarUrls);
 
       return {
         activities: mergedActivities,
@@ -883,6 +956,15 @@ export const cardRouter = createTRPCRouter({
           fromDescription: existingCard.description ?? undefined,
           toDescription: input.description,
         });
+
+        sendMentionEmails({
+          db: ctx.db,
+          cardPublicId: input.cardPublicId,
+          commentHtml: input.description,
+          commenterUserId: userId,
+        }).catch((error) => {
+          console.error("Failed to send mention emails:", error);
+        });
       }
 
       if (

packages/api/src/routers/health.ts

@@ -24,7 +24,7 @@ import {
   createTRPCRouter,
   publicProcedure,
 } from "../trpc";
-import { createS3Client } from "../utils/s3";
+import { createS3Client } from "@kan/shared/utils";
 
 const checkDatabaseConnection = async (db: dbClient) => {
   try {

packages/api/src/routers/user.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 import * as userRepo from "@kan/db/repository/user.repo";
 
 import { createTRPCRouter, protectedProcedure } from "../trpc";
+import { generateAvatarUrl } from "@kan/shared/utils";
 
 export const userRouter = createTRPCRouter({
   getUser: protectedProcedure
@@ -55,8 +56,12 @@ export const userRouter = createTRPCRouter({
 
       const apiKey = result.apiKeys[0];
 
+      // Generate presigned URL for avatar
+      const imageUrl = await generateAvatarUrl(result.image);
+
       return {
         ...result,
+        image: imageUrl,
         apiKey: apiKey ?? null,
       };
     }),
@@ -102,6 +107,12 @@ export const userRouter = createTRPCRouter({
         });
       }
 
-      return result;
+      // Generate presigned URL for avatar
+      const imageUrl = await generateAvatarUrl(result.image);
+
+      return {
+        ...result,
+        image: imageUrl,
+      };
     }),
 });

packages/api/src/routers/workspace.ts

@@ -8,6 +8,7 @@ import { generateUID } from "@kan/shared/utils";
 
 import { createTRPCRouter, protectedProcedure, publicProcedure } from "../trpc";
 import { assertPermission } from "../utils/permissions";
+import { generateAvatarUrl } from "@kan/shared/utils";
 
 export const workspaceRouter = createTRPCRouter({
   all: protectedProcedure
@@ -86,9 +87,27 @@ export const workspaceRouter = createTRPCRouter({
       const shouldShowEmails =
         isAdmin || result.showEmailsToMembers === true;
 
+      // Generate presigned URLs for member avatars
+      const membersWithAvatarUrls = await Promise.all(
+        result.members.map(async (member) => {
+          if (!member.user?.image) {
+            return member;
+          }
+
+          const avatarUrl = await generateAvatarUrl(member.user.image);
+          return {
+            ...member,
+            user: {
+              ...member.user,
+              image: avatarUrl,
+            },
+          };
+        }),
+      );
+
       // If emails should be hidden, filter them out
       if (!shouldShowEmails) {
-        const sanitizedMembers = result.members.map((member) => {
+        const sanitizedMembers = membersWithAvatarUrls.map((member) => {
           // If user doesn't have a display name, use anonymous identifier
           const displayName =
             member.user?.name?.trim() ?? `anonymous_${member.publicId}`;
@@ -120,7 +139,10 @@ export const workspaceRouter = createTRPCRouter({
         } as Awaited<ReturnType<typeof workspaceRepo.getByPublicIdWithMembers>>;
       }
 
-      return result;
+      return {
+        ...result,
+        members: membersWithAvatarUrls,
+      };
     }),
   bySlug: publicProcedure
     .meta({

packages/api/src/utils/notifications.ts

@@ -0,0 +1,133 @@
+import { env } from "next-runtime-env";
+
+import type { dbClient } from "@kan/db/client";
+import * as cardRepo from "@kan/db/repository/card.repo";
+import * as memberRepo from "@kan/db/repository/member.repo";
+import * as notificationRepo from "@kan/db/repository/notification.repo";
+import * as userRepo from "@kan/db/repository/user.repo";
+import * as workspaceRepo from "@kan/db/repository/workspace.repo";
+import { sendEmail } from "@kan/email";
+import { parseMentionsFromHTML } from "@kan/shared/utils";
+
+/**
+ * Sends mention notification emails to mentioned members
+ * Only sends emails for new mentions (checks notification table to avoid duplicates)
+ */
+export async function sendMentionEmails({
+  db,
+  cardPublicId,
+  commentHtml,
+  commenterUserId,
+  commentId,
+}: {
+  db: dbClient;
+  cardPublicId: string;
+  commentHtml: string;
+  commenterUserId: string;
+  commentId?: number;
+}) {
+  try {
+    // Parse mentions from HTML
+    const mentionPublicIds = parseMentionsFromHTML(commentHtml);
+    if (mentionPublicIds.length === 0) return;
+
+    // Get card with board information
+    const card = await cardRepo.getWithListAndMembersByPublicId(db, cardPublicId);
+    if (!card?.list.board) return;
+
+    const board = card.list.board;
+    const boardName = board.name;
+    const cardTitle = card.title;
+    const cardId = card.id;
+
+    // Get workspace ID from workspace publicId
+    const workspace = await workspaceRepo.getByPublicId(
+      db,
+      board.workspace.publicId,
+    );
+    if (!workspace?.id) return;
+
+    const workspaceId = workspace.id;
+
+    // Get commenter information
+    const commenter = await userRepo.getById(db, commenterUserId);
+    if (!commenter) return;
+
+    const commenterName = commenter.name ?? commenter.email;
+
+    // Get mentioned members with full details (filtered by workspace)
+    const membersWithDetails = await memberRepo.getByPublicIdsWithUsers(
+      db,
+      mentionPublicIds,
+      workspaceId,
+    );
+
+    // Filter out the commenter
+    const membersToNotify = membersWithDetails.filter(
+      (member) => member.user?.id !== commenterUserId,
+    );
+
+    if (membersToNotify.length === 0) return;
+
+    const baseUrl = env("NEXT_PUBLIC_BASE_URL");
+    const cardUrl = `${baseUrl}/cards/${cardPublicId}`;
+
+    // Send emails to all mentioned members (only if notification doesn't exist)
+    await Promise.all(
+      membersToNotify.map(async (member) => {
+        const userId = member.user?.id;
+        const email = member.user?.email ?? member.email;
+
+        // Skip pending members (no userId) - they can be mentioned but won't receive emails
+        if (!userId || !email) return;
+
+        try {
+          // Check if notification already exists for this mention
+          const notificationExists = await notificationRepo.exists(db, {
+            userId,
+            cardId,
+            type: "mention",
+          });
+
+          // If notification already exists, skip sending email
+          if (notificationExists) {
+            return;
+          }
+
+          // Create notification record
+          await notificationRepo.create(db, {
+            type: "mention",
+            userId,
+            cardId,
+            commentId,
+          });
+
+          // Send email
+          await sendEmail(
+            email,
+            `${commenterName} mentioned you in a comment on ${cardTitle}`,
+            "MENTION",
+            {
+              commenterName,
+              boardName,
+              cardTitle,
+              cardUrl,
+            },
+          );
+        } catch (error) {
+          console.error("Failed to send mention email:", {
+            email,
+            cardPublicId,
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }),
+    );
+  } catch (error) {
+    console.error("Error sending mention emails:", {
+      cardPublicId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+

packages/auth/src/hooks.ts

@@ -1,4 +1,4 @@
-import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { PutObjectCommand } from "@aws-sdk/client-s3";
 import { ChatOrPushProviderEnum } from "@novu/api/models/components";
 import { createAuthMiddleware } from "better-auth/api";
 import { env } from "next-runtime-env";
@@ -7,7 +7,7 @@ import type { dbClient } from "@kan/db/client";
 import * as memberRepo from "@kan/db/repository/member.repo";
 import * as userRepo from "@kan/db/repository/user.repo";
 import { notificationClient } from "@kan/email";
-import { createEmailUnsubscribeLink } from "@kan/shared";
+import { createEmailUnsubscribeLink, createS3Client } from "@kan/shared";
 
 import { downloadImage } from "./utils";
 
@@ -61,20 +61,7 @@ export function createDatabaseHooks(db: dbClient) {
             !user.image.includes(storageDomain)
           ) {
             try {
-              const credentials =
+              const client = createS3Client();
-                env("S3_ACCESS_KEY_ID") && env("S3_SECRET_ACCESS_KEY")
-                  ? {
-                      accessKeyId: env("S3_ACCESS_KEY_ID")!,
-                      secretAccessKey: env("S3_SECRET_ACCESS_KEY")!,
-                    }
-                  : undefined;
-
-              const client = new S3Client({
-                region: env("S3_REGION") ?? "",
-                endpoint: env("S3_ENDPOINT") ?? "",
-                forcePathStyle: env("S3_FORCE_PATH_STYLE") === "true",
-                credentials,
-              });
 
               const allowedFileExtensions = ["jpg", "jpeg", "png", "webp"];
 

packages/db/migrations/20260207214056_AddNotificationsTable.sql

@@ -0,0 +1,46 @@
+CREATE TYPE "public"."notification_type" AS ENUM('mention', 'workspace.member.added', 'workspace.member.removed', 'workspace.role.changed');--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "notification" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"publicId" varchar(12) NOT NULL,
+	"type" "notification_type" NOT NULL,
+	"userId" uuid NOT NULL,
+	"cardId" bigint,
+	"commentId" bigint,
+	"workspaceId" bigint,
+	"metadata" text,
+	"readAt" timestamp,
+	"createdAt" timestamp DEFAULT now() NOT NULL,
+	"deletedAt" timestamp,
+	CONSTRAINT "notification_publicId_unique" UNIQUE("publicId")
+);
+--> statement-breakpoint
+ALTER TABLE "notification" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_userId_user_id_fk" FOREIGN KEY ("userId") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_cardId_card_id_fk" FOREIGN KEY ("cardId") REFERENCES "public"."card"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_commentId_card_comments_id_fk" FOREIGN KEY ("commentId") REFERENCES "public"."card_comments"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_workspaceId_workspace_id_fk" FOREIGN KEY ("workspaceId") REFERENCES "public"."workspace"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_deleted_idx" ON "notification" USING btree ("userId","deletedAt");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_read_deleted_idx" ON "notification" USING btree ("userId","readAt","deletedAt");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_type_card_idx" ON "notification" USING btree ("userId","type","cardId");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_type_workspace_idx" ON "notification" USING btree ("userId","type","workspaceId");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_created_idx" ON "notification" USING btree ("userId","createdAt");

packages/db/migrations/meta/_journal.json

@@ -176,6 +176,13 @@
       "when": 1769983198190,
       "tag": "20260201215958_AddUserBoardFavouritesTable",
       "breakpoints": true
+    },
+    {
+      "idx": 25,
+      "version": "7",
+      "when": 1770500457005,
+      "tag": "20260207214056_AddNotificationsTable",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/repository/board.repo.ts

@@ -212,6 +212,7 @@ export const getByPublicId = async (
             columns: {
               publicId: true,
               email: true,
+              status: true,
             },
             with: {
               user: {

packages/db/src/repository/card.repo.ts

@@ -420,6 +420,7 @@ export const getWithListAndMembersByPublicId = async (
 ) => {
   const card = await db.query.cards.findFirst({
     columns: {
+      id: true,
       publicId: true,
       title: true,
       description: true,
@@ -507,6 +508,7 @@ export const getWithListAndMembersByPublicId = async (
                     columns: {
                       publicId: true,
                       email: true,
+                      status: true,
                     },
                     with: {
                       user: {

packages/db/src/repository/member.repo.ts

@@ -63,6 +63,36 @@ export const getById = async (db: dbClient, memberId: number) => {
   });
 };
 
+export const getByPublicIdsWithUsers = async (
+  db: dbClient,
+  memberPublicIds: string[],
+  workspaceId?: number,
+) => {
+  return db.query.workspaceMembers.findMany({
+    where: (members, { inArray: inArrayFn, eq, and, isNull: isNullFn }) => {
+      const conditions = [inArrayFn(members.publicId, memberPublicIds)];
+      
+      if (workspaceId) {
+        conditions.push(eq(members.workspaceId, workspaceId));
+      }
+      
+      conditions.push(eq(members.status, "active"));
+      conditions.push(isNullFn(members.deletedAt));
+      
+      return and(...conditions);
+    },
+    with: {
+      user: {
+        columns: {
+          id: true,
+          name: true,
+          email: true,
+        },
+      },
+    },
+  });
+};
+
 export const getByEmailAndStatus = async (
   db: dbClient,
   email: string,

packages/db/src/repository/notification.repo.ts

@@ -0,0 +1,98 @@
+import { and, count, eq, isNull } from "drizzle-orm";
+
+import type { dbClient } from "@kan/db/client";
+import type { NotificationType } from "@kan/db/schema";
+import { notifications } from "@kan/db/schema";
+import { generateUID } from "@kan/shared/utils";
+
+export const create = async (
+  db: dbClient,
+  notificationInput: {
+    type: NotificationType;
+    userId: string;
+    cardId?: number;
+    commentId?: number;
+    workspaceId?: number;
+    metadata?: string;
+  },
+) => {
+  const [result] = await db
+    .insert(notifications)
+    .values({
+      publicId: generateUID(),
+      type: notificationInput.type,
+      userId: notificationInput.userId,
+      cardId: notificationInput.cardId,
+      commentId: notificationInput.commentId,
+      workspaceId: notificationInput.workspaceId,
+      metadata: notificationInput.metadata,
+    })
+    .returning();
+
+  return result;
+};
+
+export const exists = async (
+  db: dbClient,
+  args: {
+    userId: string;
+    type: NotificationType;
+    cardId?: number;
+    workspaceId?: number;
+    commentId?: number;
+  },
+) => {
+  const result = await db.query.notifications.findFirst({
+    where: (notifications, { eq, and, isNull: isNullFn }) => {
+      const conditions = [
+        eq(notifications.userId, args.userId),
+        eq(notifications.type, args.type),
+        isNullFn(notifications.deletedAt),
+      ];
+
+      if (args.cardId) {
+        conditions.push(eq(notifications.cardId, args.cardId));
+      }
+
+      if (args.workspaceId) {
+        conditions.push(eq(notifications.workspaceId, args.workspaceId));
+      }
+
+      return and(...conditions);
+    },
+  });
+
+  return !!result;
+};
+
+export const markAsRead = async (
+  db: dbClient,
+  notificationId: number,
+) => {
+  const [result] = await db
+    .update(notifications)
+    .set({ readAt: new Date() })
+    .where(eq(notifications.id, notificationId))
+    .returning();
+
+  return result;
+};
+
+export const getUnreadCount = async (
+  db: dbClient,
+  userId: string,
+) => {
+  const result = await db
+    .select({ count: count() })
+    .from(notifications)
+    .where(
+      and(
+        eq(notifications.userId, userId),
+        isNull(notifications.readAt),
+        isNull(notifications.deletedAt),
+      ),
+    );
+
+  return result[0]?.count ?? 0;
+};
+

packages/db/src/schema/index.ts

@@ -13,3 +13,4 @@ export * from "./workspaces";
 export * from "./subscriptions";
 export * from "./workspaceInviteLinks";
 export * from "./permissions";
+export * from "./notifications";

packages/db/src/schema/notifications.ts

@@ -0,0 +1,98 @@
+import { relations } from "drizzle-orm";
+import {
+  bigint,
+  bigserial,
+  index,
+  pgEnum,
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+  varchar,
+} from "drizzle-orm/pg-core";
+
+import { cards } from "./cards";
+import { comments } from "./cards";
+import { users } from "./users";
+import { workspaces } from "./workspaces";
+
+export const notificationTypes = [
+  "mention",
+  "workspace.member.added",
+  "workspace.member.removed",
+  "workspace.role.changed",
+] as const;
+
+export type NotificationType = (typeof notificationTypes)[number];
+
+export const notificationTypeEnum = pgEnum("notification_type", notificationTypes);
+
+export const notifications = pgTable(
+  "notification",
+  {
+    id: bigserial("id", { mode: "number" }).primaryKey(),
+    publicId: varchar("publicId", { length: 12 }).notNull().unique(),
+    type: notificationTypeEnum("type").notNull(),
+    userId: uuid("userId")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    cardId: bigint("cardId", { mode: "number" }).references(() => cards.id, {
+      onDelete: "cascade",
+    }),
+    commentId: bigint("commentId", { mode: "number" }).references(
+      () => comments.id,
+      { onDelete: "cascade" },
+    ),
+    workspaceId: bigint("workspaceId", { mode: "number" }).references(
+      () => workspaces.id,
+      { onDelete: "cascade" },
+    ),
+    metadata: text("metadata"),
+    readAt: timestamp("readAt"),
+    createdAt: timestamp("createdAt").defaultNow().notNull(),
+    deletedAt: timestamp("deletedAt"),
+  },
+  (table) => [
+    index("notification_user_deleted_idx").on(table.userId, table.deletedAt),
+    index("notification_user_read_deleted_idx").on(
+      table.userId,
+      table.readAt,
+      table.deletedAt,
+    ),
+    index("notification_user_type_card_idx").on(
+      table.userId,
+      table.type,
+      table.cardId,
+    ),
+    index("notification_user_type_workspace_idx").on(
+      table.userId,
+      table.type,
+      table.workspaceId,
+    ),
+    index("notification_user_created_idx").on(table.userId, table.createdAt),
+  ],
+).enableRLS();
+
+export const notificationsRelations = relations(notifications, ({ one }) => ({
+  user: one(users, {
+    fields: [notifications.userId],
+    references: [users.id],
+    relationName: "notificationsUser",
+  }),
+  card: one(cards, {
+    fields: [notifications.cardId],
+    references: [cards.id],
+    relationName: "notificationsCard",
+  }),
+  comment: one(comments, {
+    fields: [notifications.commentId],
+    references: [comments.id],
+    relationName: "notificationsComment",
+  }),
+  workspace: one(workspaces, {
+    fields: [notifications.workspaceId],
+    references: [workspaces.id],
+    relationName: "notificationsWorkspace",
+  }),
+}));
+

packages/email/src/sendEmail.tsx

@@ -3,14 +3,16 @@ import nodemailer from "nodemailer";
 
 import JoinWorkspaceTemplate from "./templates/join-workspace";
 import MagicLinkTemplate from "./templates/magic-link";
+import MentionTemplate from "./templates/mention";
 import ResetPasswordTemplate from "./templates/reset-password";
 
-type Templates = "MAGIC_LINK" | "JOIN_WORKSPACE" | "RESET_PASSWORD";
+type Templates = "MAGIC_LINK" | "JOIN_WORKSPACE" | "RESET_PASSWORD" | "MENTION";
 
-const emailTemplates: Record<Templates, React.FC> = {
+const emailTemplates: Record<Templates, React.ComponentType<any>> = {
   MAGIC_LINK: MagicLinkTemplate,
   JOIN_WORKSPACE: JoinWorkspaceTemplate,
   RESET_PASSWORD: ResetPasswordTemplate,
+  MENTION: MentionTemplate,
 };
 
 const transporter = nodemailer.createTransport({

packages/email/src/templates/mention.tsx

@@ -0,0 +1,108 @@
+import { Body } from "@react-email/body";
+import { Button } from "@react-email/button";
+import { Container } from "@react-email/container";
+import { Head } from "@react-email/head";
+import { Heading } from "@react-email/heading";
+import { Hr } from "@react-email/hr";
+import { Html } from "@react-email/html";
+import { Link } from "@react-email/link";
+import { Preview } from "@react-email/preview";
+import { Text } from "@react-email/text";
+import { env } from "next-runtime-env";
+import * as React from "react";
+
+export const MentionTemplate = ({
+  commenterName,
+  boardName,
+  cardTitle,
+  cardUrl,
+}: {
+  commenterName: string;
+  boardName: string;
+  cardTitle: string;
+  cardUrl: string;
+}) => (
+  <Html>
+    <Head />
+    <Preview>
+      {commenterName} mentioned you in a comment on {cardTitle}
+    </Preview>
+    <Body style={{ backgroundColor: "white" }}>
+      <Container
+        style={{
+          fontFamily:
+            '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif',
+          margin: "auto",
+          paddingLeft: "0.75rem",
+          paddingRight: "0.75rem",
+        }}
+      >
+        <Heading
+          style={{
+            marginTop: "2.5rem",
+            marginBottom: "2.5rem",
+            fontSize: "24px",
+            fontWeight: "bold",
+            color: "#232323",
+          }}
+        >
+          kan.bn
+        </Heading>
+        <Heading
+          style={{ fontSize: "24px", fontWeight: "bold", color: "#232323" }}
+        >
+          You were mentioned in a comment
+        </Heading>
+        <Text
+          style={{
+            fontSize: "0.875rem",
+            marginBottom: "1rem",
+            color: "#232323",
+          }}
+        >
+          <strong>{commenterName}</strong> mentioned you in a comment on the
+          card <strong>{cardTitle}</strong> in the board <strong>{boardName}</strong>.
+        </Text>
+        <Button
+          target="_blank"
+          href={cardUrl}
+          style={{
+            marginBottom: "2rem",
+            borderRadius: "0.375rem",
+            backgroundColor: "#282828",
+            paddingLeft: "1.5rem",
+            paddingRight: "1.5rem",
+            paddingTop: "1rem",
+            paddingBottom: "1rem",
+            fontSize: "0.875rem",
+            fontWeight: "500",
+            lineHeight: "1",
+            color: "white",
+          }}
+        >
+          View Card
+        </Button>
+        <Hr
+          style={{
+            marginTop: "2.5rem",
+            marginBottom: "2rem",
+            borderWidth: "1px",
+          }}
+        />
+        <Text style={{ color: "#7e7e7e" }}>
+          <Link
+            href={env("NEXT_PUBLIC_BASE_URL")}
+            target="_blank"
+            style={{ color: "#7e7e7e", textDecoration: "underline" }}
+          >
+            Kan
+          </Link>
+          , the open source Trello alternative.
+        </Text>
+      </Container>
+    </Body>
+  </Html>
+);
+
+export default MentionTemplate;
+

packages/shared/package.json

@@ -36,6 +36,8 @@
   },
   "prettier": "@kan/prettier-config",
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.802.0",
+    "@aws-sdk/s3-request-presigner": "^3.812.0",
     "date-fns": "^4.1.0",
     "jose": "^6.1.2",
     "nanoid": "^5.0.9",

packages/shared/src/utils/index.ts

@@ -3,3 +3,5 @@ export * from "./generateSlug";
 export * from "./subscriptions";
 export * from "./email";
 export * from "./dueDateFilters";
+export * from "./s3";
+export * from "./mentions";

packages/shared/src/utils/mentions.ts

@@ -0,0 +1,22 @@
+/**
+ * Parses mention data-id attributes from HTML content
+ * Mentions are stored as: <span data-type="mention" data-id="..." data-label="...">@label</span>
+ * @param htmlContent - The HTML content to parse
+ * @returns Array of unique mention public IDs
+ */
+export function parseMentionsFromHTML(htmlContent: string): string[] {
+  if (!htmlContent) return [];
+
+  // Match all mention spans with data-id attributes
+  const mentionRegex = /<span[^>]*data-type="mention"[^>]*data-id="([^"]+)"[^>]*>/gi;
+  const matches = Array.from(htmlContent.matchAll(mentionRegex));
+  
+  // Extract unique mention IDs
+  const mentionIds = matches
+    .map((match) => match[1])
+    .filter((id): id is string => !!id && id.length >= 12);
+
+  // Return unique IDs
+  return Array.from(new Set(mentionIds));
+}
+

packages/shared/src/utils/s3.ts

@@ -5,6 +5,7 @@ import {
   S3Client,
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { env } from "next-runtime-env";
 
 export function createS3Client() {
   const credentials =
@@ -67,3 +68,60 @@ export async function deleteObject(bucket: string, key: string) {
     }),
   );
 }
+
+/**
+ * Generate presigned URL for an avatar image
+ * Returns the URL as-is if it's already a full URL (external provider)
+ * Returns presigned URL if it's an S3 key
+ * Returns null if image key is missing, bucket is not configured, or URL generation fails
+ */
+export async function generateAvatarUrl(
+  imageKey: string | null | undefined,
+  expiresIn = 86400, // 24 hours
+): Promise<string | null> {
+  if (!imageKey) {
+    return null;
+  }
+
+  if (imageKey.startsWith("http://") || imageKey.startsWith("https://")) {
+    return imageKey;
+  }
+
+  const bucket = env("NEXT_PUBLIC_AVATAR_BUCKET_NAME");
+  if (!bucket) {
+    return null;
+  }
+
+  try {
+    return await generateDownloadUrl(bucket, imageKey, expiresIn);
+  } catch {
+    // If URL generation fails, return null
+    return null;
+  }
+}
+
+/**
+ * Generate presigned URL for an attachment
+ * Returns null if attachment key is missing, bucket is not configured, or URL generation fails
+ */
+export async function generateAttachmentUrl(
+  attachmentKey: string | null | undefined,
+  expiresIn = 86400, // 24 hours
+): Promise<string | null> {
+  if (!attachmentKey) {
+    return null;
+  }
+
+  const bucket = env("NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME");
+  if (!bucket) {
+    return null;
+  }
+
+  try {
+    return await generateDownloadUrl(bucket, attachmentKey, expiresIn);
+  } catch {
+    // If URL generation fails, return null
+    return null;
+  }
+}
+

pnpm-lock.yaml

@@ -136,6 +136,9 @@ importers:
       '@tiptap/extension-placeholder':
         specifier: ^2.14.0
         version: 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)
+      '@tiptap/extension-typography':
+        specifier: ^3.18.0
+        version: 3.18.0(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
       '@tiptap/pm':
         specifier: ^2.14.0
         version: 2.26.1
@@ -293,12 +296,6 @@ importers:
 
   packages/api:
     dependencies:
-      '@aws-sdk/client-s3':
-        specifier: ^3.802.0
-        version: 3.879.0
-      '@aws-sdk/s3-request-presigner':
-        specifier: ^3.812.0
-        version: 3.879.0
       '@kan/auth':
         specifier: workspace:*
         version: link:../auth
@@ -483,6 +480,12 @@ importers:
 
   packages/shared:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.802.0
+        version: 3.879.0
+      '@aws-sdk/s3-request-presigner':
+        specifier: ^3.812.0
+        version: 3.879.0
       date-fns:
         specifier: ^4.1.0
         version: 4.1.0
@@ -3779,6 +3782,11 @@ packages:
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
+  '@tiptap/extension-typography@3.18.0':
+    resolution: {integrity: sha512-zTNGJjhJG3lObUhhTbDC1IOyi1DCiCd6i11xsnJDPy5BODYc7t7ZP6VMOWU0LIuMsK9kX02dXoNU7OarJgLpCg==}
+    peerDependencies:
+      '@tiptap/core': ^3.18.0
+
   '@tiptap/pm@2.26.1':
     resolution: {integrity: sha512-8aF+mY/vSHbGFqyG663ds84b+vca5Lge3tHdTMTKazxCnhXR9dn2oQJMnZ78YZvdRbkPkMJJHti9h3K7u2UQvw==}
 
@@ -11919,6 +11927,10 @@ snapshots:
     dependencies:
       '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
 
+  '@tiptap/extension-typography@3.18.0(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+    dependencies:
+      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+
   '@tiptap/pm@2.26.1':
     dependencies:
       prosemirror-changeset: 2.3.1