fix: use multipart upload for attachments to resolve chunk size error

* build(web, deps): add `@tiptap/extension-typography`

* feat(editor): add typography extension

* chore(editor): disable some typographic characters

* chore(editor): disable superscript

.dockerignore

@@ -15,4 +15,4 @@ pnpm-debug.log
 
 README.md
 .next
-.git
+# .git

.env.example

@@ -17,6 +17,7 @@ SMTP_USER=
 SMTP_PASSWORD=
 EMAIL_FROM= # e.g. "Kan <hello@mail.kan.bn>"
 SMTP_SECURE= # set to "false" to use port 587
+SMTP_REJECT_UNAUTHORIZED= # set to "false" to accept invalid certs
 
 # Switch email features off entirely (optional)
 NEXT_PUBLIC_DISABLE_EMAIL=
@@ -29,18 +30,29 @@ S3_SECRET_ACCESS_KEY=
 S3_FORCE_PATH_STYLE=
 NEXT_PUBLIC_STORAGE_URL=
 NEXT_PUBLIC_AVATAR_BUCKET_NAME=
+NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME=
 NEXT_PUBLIC_STORAGE_DOMAIN=
+NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS=
 
 # Auth config (optional)
 NEXT_PUBLIC_ALLOW_CREDENTIALS=
 NEXT_PUBLIC_DISABLE_SIGN_UP=
 
+# API configuration (optional)
+NEXT_API_BODY_SIZE_LIMIT= # e.g. 50mb (defaults to 1mb)
+
 # Integration providers (optional)
 TRELLO_APP_API_KEY=
 TRELLO_APP_SECRET=
 
+# Redis (optional - for rate limiting)
+# If not provided, rate limiting will use in-memory storage
+REDIS_URL= # e.g. redis://default:your_password@your_host:6379
+
 # OAuth providers (optional)
 BETTER_AUTH_TRUSTED_ORIGINS=
+# Optional: Restrict OIDC/Social sign-ins to specific email domains (comma-separated)
+BETTER_AUTH_ALLOWED_DOMAINS=
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 DISCORD_CLIENT_ID=
@@ -78,4 +90,3 @@ TWITCH_CLIENT_SECRET=
 APPLE_CLIENT_ID=
 APPLE_CLIENT_SECRET=
 APPLE_APP_BUNDLE_IDENTIFIER=
-

.github/workflows/docker-publish.yml

@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
@@ -74,6 +76,42 @@ jobs:
             type=semver,pattern={{major}}
             type=raw,value=latest,enable={{is_default_branch}}
 
+      # Extract version from git tag or ref
+      # Uses git describe to get latest tag + commit hash in SemVer format: 1.2.3+abc1234
+      - name: Extract version
+        id: version
+        run: |
+          if [[ "${{ github.ref_type }}" == "tag" ]]; then
+            VERSION="${{ github.ref_name }}"
+            # Remove 'v' prefix if present
+            VERSION="${VERSION#v}"
+          else
+            # Use git describe and simplify: v1.2.3-5-gabc1234 -> 1.2.3+abc1234
+            GIT_DESCRIBE=$(git describe --tags --always --long 2>/dev/null || echo "")
+            if [[ -n "$GIT_DESCRIBE" ]]; then
+              # Match pattern: v1.2.3-5-gabc1234 (tag-commits-gcommit)
+              if [[ "$GIT_DESCRIBE" =~ ^v?([0-9]+\.[0-9]+\.[0-9]+)-[0-9]+-g([a-f0-9]+)$ ]]; then
+                # Format as tag+commit (SemVer build metadata)
+                TAG_VERSION="${BASH_REMATCH[1]}"
+                COMMIT_HASH="${BASH_REMATCH[2]}"
+                VERSION="${TAG_VERSION}+${COMMIT_HASH:0:7}"
+              elif [[ "$GIT_DESCRIBE" =~ ^v?([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
+                # Exactly on a tag
+                VERSION="${BASH_REMATCH[1]}"
+              else
+                # Fallback: just commit hash
+                COMMIT_SHA="${{ github.sha }}"
+                VERSION="${COMMIT_SHA:0:7}"
+              fi
+            else
+              # No tags exist, use commit hash
+              COMMIT_SHA="${{ github.sha }}"
+              VERSION="${COMMIT_SHA:0:7}"
+            fi
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION"
+
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
@@ -86,6 +124,8 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            APP_VERSION=${{ steps.version.outputs.version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 

.gitignore

@@ -34,6 +34,7 @@ yarn-error.log*
 .env
 .env*.local
 
+
 # vercel
 .vercel
 

AGENTS.md

@@ -0,0 +1,315 @@
+# AGENTS.md
+
+## Project Overview
+
+Kan is an open-source project management tool (Trello alternative) built with:
+
+- **Frontend**: Next.js, React, TypeScript, Tailwind CSS
+- **Backend**: tRPC, Node.js
+- **Database**: PostgreSQL with Drizzle ORM
+- **Monorepo**: pnpm workspaces with Turbo
+- **Auth**: Better Auth
+- **Internationalization**: Lingui
+
+## Setup Commands
+
+- Install deps: `pnpm install`
+- Start dev server: `pnpm dev`
+- Create migrations: `cd packages/db && pnpm drizzle-kit generate --name "AddFieldToTable"`
+- Run database migrations: `pnpm db:migrate`
+- Run linter: `pnpm lint`
+- Run type check: `pnpm typecheck`
+- Format code: `pnpm format:fix`
+- Extract i18n strings: `pnpm lingui:extract`
+
+## Project Structure
+
+- `apps/web/` - Next.js web application
+- `packages/api/` - tRPC API routers
+- `packages/db/` - Database schema, migrations, and repositories
+- `packages/auth/` - Authentication package
+- `packages/shared/` - Shared utilities
+- `packages/email/` - Email templates and sending
+- `packages/stripe/` - Stripe integration
+- `tooling/` - Shared tooling configs (ESLint, Prettier, TypeScript)
+
+## Code Style
+
+### TypeScript
+
+- Use TypeScript strictly - avoid `any` types
+- Prefer explicit types over inference when it improves clarity
+- Use `as const` for literal types when appropriate
+- Follow existing patterns for type definitions
+
+### Naming Conventions
+
+- **Files**: kebab-case for files (e.g., `card-repo.ts`)
+- **Components**: PascalCase for React components
+- **Functions**: camelCase for functions
+- **Constants**: UPPER_SNAKE_CASE for constants
+- **Types/Interfaces**: PascalCase
+
+### Database Layer (`packages/db/`)
+
+- **Schema**: Define schemas in `src/schema/` using Drizzle ORM
+- **Migrations**: Create migrations with `cd packages/db && pnpm drizzle-kit generate --name "MigrationName"`, then run with `pnpm db:migrate`
+- **Repositories**: Put database queries in `src/repository/` files
+- **Soft Deletes**: Use `deletedAt` timestamp for soft deletion (not hard deletes)
+- **Index Management**: Cards have `index` fields that must be maintained sequentially per list
+- **Activity Logging**: Use `card_activity` table to track all card changes
+
+### API Layer (`packages/api/`)
+
+- **Routers**: Create tRPC routers in `src/routers/`
+- **Procedures**: Use `protectedProcedure` for authenticated endpoints, `publicProcedure` for public
+- **Validation**: Use Zod schemas for input validation
+- **Error Handling**: Use `TRPCError` with appropriate error codes
+- **OpenAPI**: Add OpenAPI metadata for all endpoints
+- **Authorization**: Always check workspace membership with `assertUserInWorkspace`
+
+### Frontend (`apps/web/`)
+
+- **Components**: React components in `src/components/`
+- **Views**: Page-level components in `src/views/`
+- **Hooks**: Custom hooks in `src/hooks/`
+- **i18n**: Use `t` template literal for translations (Lingui)
+- **Styling**: Use Tailwind CSS classes
+- **State Management**: Use tRPC React Query hooks for server state
+- **Modals**: Use `useModal` hook for modal management
+- **Popups**: Use `usePopup` hook for toast notifications
+
+## Key Concepts
+
+### Cards
+
+- Cards are the main entity in Kan
+- Cards belong to Lists, which belong to Boards
+- Cards have: title, description, labels, members, checklists, comments, attachments, due dates
+- Cards use soft deletion (`deletedAt` field)
+- Cards have an `index` field that must be maintained sequentially per list
+- All card changes are tracked in `card_activity` table
+
+### Activity Tracking
+
+- Every significant card change creates an activity record
+- Activity types include: created, updated (various fields), etc.
+- Activities are displayed in card activity feeds
+
+### Workspaces & Boards
+
+- Users belong to Workspaces
+- Boards belong to Workspaces
+- Workspace members have different permission levels
+- Boards can be public or private
+
+### Soft Deletion Pattern
+
+- Entities use `deletedAt` timestamp for soft deletion
+- Queries filter with `isNull(table.deletedAt)` to exclude deleted items
+
+## File Locations Reference
+
+### Database
+
+- Schema: `packages/db/src/schema/*.ts`
+- Repositories: `packages/db/src/repository/*.repo.ts`
+- Migrations: `packages/db/migrations/`
+
+### API
+
+- Routers: `packages/api/src/routers/*.ts`
+- Utils: `packages/api/src/utils/`
+- Types: `packages/api/src/types/`
+
+### Frontend
+
+- Components: `apps/web/src/components/`
+- Views: `apps/web/src/views/`
+- Pages: `apps/web/src/pages/`
+- Hooks: `apps/web/src/hooks/`
+- Utils: `apps/web/src/utils/`
+- Locales: `apps/web/src/locales/`
+
+## Database Patterns
+
+- **Soft Deletes**: Always filter with `isNull(table.deletedAt)` in queries
+- **Public IDs**: Use 12-character public IDs (`publicId`) for all user-facing entities
+- **Internal IDs**: Never expose internal database IDs (e.g., `id`, `cardId`, `listId`) in API responses or URLs - always use `publicId` externally
+- **Transactions**: Use database transactions for multi-step operations
+- **Index Management**: When deleting/moving cards, maintain sequential indices
+- **Activity Tracking**: Create activity records for all significant changes
+
+## API Patterns
+
+- **Input Validation**: Always validate inputs with Zod
+- **Error Messages**: Provide clear, user-friendly error messages
+- **Optimistic Updates**: Use tRPC's `onMutate` for optimistic UI updates
+- **Cache Invalidation**: Properly invalidate queries after mutations
+- **ID Exposure**: Never expose internal database IDs (`id`, `cardId`, `listId`, etc.) in API responses, URLs, or frontend code - always use `publicId` for external communication
+
+## Important Patterns
+
+### Card Index Management
+
+When cards are created, moved, or deleted, their indices must be maintained:
+
+- New cards: Append to end (max index + 1) or insert at position
+- Moving cards: Adjust indices of affected cards
+- Deleting cards: Decrement indices of cards after deleted one
+- Always use transactions for index updates
+
+### Activity Logging
+
+Create activity records for:
+
+- Card creation
+- Card updates (title, description, list, etc.)
+- Label/member additions/removals
+- Comments
+- Checklists and items
+- Attachments
+- Due dates
+
+### Authorization
+
+Always check:
+
+1. User is authenticated
+2. User has access to workspace
+3. User has permission for the operation
+
+Use `assertUserInWorkspace` helper for workspace checks.
+
+### Error Handling
+
+- Use TRPCError with appropriate codes (UNAUTHORIZED, NOT_FOUND, etc.)
+- Provide user-friendly error messages
+- Log errors appropriately
+- Show popup notifications for user-facing errors
+
+## Common Patterns
+
+### Creating a Card
+
+1. Create card in repository with proper index management
+2. Create `card.created` activity
+3. Handle label/member relationships if provided
+4. Return the created card
+
+### Updating a Card
+
+1. Validate user has workspace access
+2. Update card fields
+3. Create appropriate activity records
+4. Invalidate relevant queries
+
+### Querying Cards
+
+- Always filter by `isNull(cards.deletedAt)` in queries
+- Include related data (labels, members, checklists) via Drizzle relations
+- Order by `index` for proper card ordering
+
+## Adding a New Feature
+
+1. **Database**: Update schema in `packages/db/src/schema/`
+2. **Migration**: Create migration with `cd packages/db && pnpm drizzle-kit generate --name "MigrationName"`, then run with `pnpm db:migrate`
+3. **Repository**: Add repository functions in `packages/db/src/repository/`
+4. **API**: Add tRPC router procedures in `packages/api/src/routers/`
+5. **Frontend**: Add UI components in `apps/web/src/`
+6. **i18n**: Add translations for new strings
+
+## Database Changes
+
+- Always create migrations (never modify existing migrations)
+- Create migrations with: `cd packages/db && pnpm drizzle-kit generate --name "MigrationName"`
+- Run migrations with: `pnpm db:migrate`
+- Update schema files in `packages/db/src/schema/`
+- Test migrations on development database first
+- Update TypeScript types after schema changes
+- Consider index management for card operations
+
+## API Endpoints
+
+- Use tRPC procedures (not REST)
+- Add OpenAPI metadata for documentation
+- Validate inputs with Zod
+- Check workspace permissions
+- Create activity records for significant changes
+
+## Frontend Components
+
+- Use Tailwind for styling
+- Follow existing component patterns
+- Use tRPC hooks for data fetching
+- Implement optimistic updates where appropriate
+- Add proper loading and error states
+
+## Testing Instructions
+
+- Test database operations in transactions that rollback
+- Test authorization checks
+- Test index management when moving/deleting cards
+- Test activity logging
+- Test UI interactions
+- Run `pnpm lint` and `pnpm typecheck` before committing
+
+## Performance Considerations
+
+- Use database indexes appropriately
+- Batch operations when possible
+- Avoid N+1 queries
+- Use transactions for related operations
+- Implement optimistic updates in UI
+
+## Security
+
+- Always check workspace membership before operations
+- Validate all inputs
+- Never expose internal database IDs (`id`, `cardId`, `listId`, etc.) in API responses, URLs, or frontend code - always use `publicId` externally
+- Sanitize user input
+
+## Internationalization
+
+- All user-facing strings must use `t` template literal
+- Add translations to locale files in `apps/web/src/locales/`
+- Run `pnpm lingui:extract` to update translation files
+- Update locale files for all languages
+
+## Dependencies
+
+- Use workspace dependencies (`workspace:*`) for internal packages
+- Keep dependencies up to date
+- Use catalog for shared dependency versions
+
+## When Implementing Features
+
+### Adding New Card Fields
+
+1. Update schema in `packages/db/src/schema/cards.ts`
+2. Create migration
+3. Update repository functions
+4. Add API endpoints
+5. Update frontend components
+6. Add activity tracking if needed
+
+### Adding New Activity Types
+
+1. Add to `activityTypes` array in schema
+2. Create migration to update enum
+3. Use in activity creation code
+4. Update activity display components if needed
+
+## Git & Commits
+
+- Use conventional commits: `feat:`, `fix:`, `refactor:`, `docs:`, etc.
+- Keep commits focused on single changes
+- Reference issue numbers when applicable
+
+## PR Instructions
+
+- Title format: `feat: description` or `fix: description`
+- Always run `pnpm lint` and `pnpm typecheck` before committing
+- Provide clear description of changes
+- Include screenshots for UI changes
+- Keep PRs focused on a single feature/fix

README.md

@@ -34,7 +34,7 @@ See our [roadmap](https://kan.bn/kan/roadmap) for upcoming features.
 
 ## Screenshot 👁️
 
-<img width="1507" alt="hero-dark" src="https://github.com/user-attachments/assets/5f7b6ad3-f31d-4b45-93dc-0132b3f2afd4" />
+<img width="1507" alt="hero-dark" src="https://github.com/user-attachments/assets/8490104a-cd5d-49de-afc2-152fd8a93119" />
 
 ## Made With 🛠️
 
@@ -47,7 +47,17 @@ See our [roadmap](https://kan.bn/kan/roadmap) for upcoming features.
 
 ## Self Hosting 🐳
 
-The easiest way to self-host Kan is with Docker Compose. This will set up everything for you including your postgres database.
+### One-click Deployments
+
+The easiest way to deploy Kan is through Railway. We've partnered with Railway to maintain an official template that supports the development of the project.
+
+<a href="https://railway.com/deploy/kan?referralCode=bZPsr2&utm_medium=integration&utm_source=template&utm_campaign=generic">
+  <img src="https://railway.app/button.svg" alt="Deploy on Railway" height="40" />
+</a>
+
+### Docker Compose
+
+Alternatively, you can self-host Kan with Docker Compose. This will set up everything for you including your postgres database.
 
 1. Create a new file called `docker-compose.yml` and paste the following configuration:
 
@@ -138,41 +148,48 @@ pnpm dev
 
 ## Environment Variables 🔐
 
-| Variable                                  | Description                                              | Required                 | Example                                                     |
-| ----------------------------------------- | -------------------------------------------------------- | ------------------------ | ----------------------------------------------------------- |
-| `POSTGRES_URL`                            | PostgreSQL connection URL                                | To use external database | `postgres://user:pass@localhost:5432/db`                    |
-| `EMAIL_FROM`                              | Sender email address                                     | For Email                | `"Kan <hello@mail.kan.bn>"`                                 |
-| `SMTP_HOST`                               | SMTP server hostname                                     | For Email                | `smtp.resend.com`                                           |
-| `SMTP_PORT`                               | SMTP server port                                         | For Email                | `465`                                                       |
-| `SMTP_USER`                               | SMTP username/email                                      | No                       | `resend`                                                    |
-| `SMTP_PASSWORD`                           | SMTP password/token                                      | No                       | `re_xxxx`                                                   |
-| `SMTP_SECURE`                             | Use secure SMTP connection (defaults to true if not set) | For Email                | `true`                                                      |
-| `NEXT_PUBLIC_DISABLE_EMAIL`               | To disable all email features                            | For Email                | `true`                                                      |
-| `NEXT_PUBLIC_BASE_URL`                    | Base URL of your installation                            | Yes                      | `http://localhost:3000`                                     |
-| `BETTER_AUTH_SECRET`                      | Auth encryption secret                                   | Yes                      | Random 32+ char string                                      |
-| `BETTER_AUTH_TRUSTED_ORIGINS`             | Allowed callback origins                                 | No                       | `http://localhost:3000,http://localhost:3001`               |
-| `GOOGLE_CLIENT_ID`                        | Google OAuth client ID                                   | For Google login         | `xxx.apps.googleusercontent.com`                            |
-| `GOOGLE_CLIENT_SECRET`                    | Google OAuth client secret                               | For Google login         | `xxx`                                                       |
-| `DISCORD_CLIENT_ID`                       | Discord OAuth client ID                                  | For Discord login        | `xxx`                                                       |
-| `DISCORD_CLIENT_SECRET`                   | Discord OAuth client secret                              | For Discord login        | `xxx`                                                       |
-| `GITHUB_CLIENT_ID`                        | GitHub OAuth client ID                                   | For GitHub login         | `xxx`                                                       |
-| `GITHUB_CLIENT_SECRET`                    | GitHub OAuth client secret                               | For GitHub login         | `xxx`                                                       |
-| `OIDC_CLIENT_ID`                          | Generic OIDC client ID                                   | For OIDC login           | `xxx`                                                       |
-| `OIDC_CLIENT_SECRET`                      | Generic OIDC client secret                               | For OIDC login           | `xxx`                                                       |
-| `OIDC_DISCOVERY_URL`                      | OIDC discovery URL                                       | For OIDC login           | `https://auth.example.com/.well-known/openid-configuration` |
-| `TRELLO_APP_API_KEY`                      | Trello app API key                                       | For Trello import        | `xxx`                                                       |
-| `TRELLO_APP_API_SECRET`                   | Trello app API secret                                    | For Trello import        | `xxx`                                                       |
-| `S3_REGION`                               | S3 storage region                                        | For file uploads         | `WEUR`                                                      |
-| `S3_ENDPOINT`                             | S3 endpoint URL                                          | For file uploads         | `https://xxx.r2.cloudflarestorage.com`                      |
-| `S3_ACCESS_KEY_ID`                        | S3 access key                                            | For file uploads         | `xxx`                                                       |
-| `S3_SECRET_ACCESS_KEY`                    | S3 secret key                                            | For file uploads         | `xxx`                                                       |
-| `S3_FORCE_PATH_STYLE`                     | Use path-style URLs for S3                               | For file uploads         | `true`                                                      |
-| `NEXT_PUBLIC_STORAGE_URL`                 | Storage service URL                                      | For file uploads         | `https://storage.kanbn.com`                                 |
-| `NEXT_PUBLIC_STORAGE_DOMAIN`              | Storage domain name                                      | For file uploads         | `kanbn.com`                                                 |
-| `NEXT_PUBLIC_AVATAR_BUCKET_NAME`          | S3 bucket name for avatars                               | For file uploads         | `avatars`                                                   |
-| `NEXT_PUBLIC_ALLOW_CREDENTIALS`           | Allow email & password login                             | For authentication       | `true`                                                      |
-| `NEXT_PUBLIC_DISABLE_SIGN_UP`             | Disable sign up                                          | For authentication       | `false`                                                     |
-| `NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY` | Hide “Powered by kan.bn” on public boards (self-host)    | For white labelling      | `true`                                                      |
+| Variable                                  | Description                                               | Required                              | Example                                                     |
+| ----------------------------------------- | --------------------------------------------------------- | ------------------------------------- | ----------------------------------------------------------- |
+| `POSTGRES_URL`                            | PostgreSQL connection URL                                 | To use external database              | `postgres://user:pass@localhost:5432/db`                    |
+| `REDIS_URL`                               | Redis connection URL                                      | For rate limiting (optional)          | `redis://localhost:6379` or `redis://redis:6379` (Docker)   |
+| `EMAIL_FROM`                              | Sender email address                                      | For Email                             | `"Kan <hello@mail.kan.bn>"`                                 |
+| `SMTP_HOST`                               | SMTP server hostname                                      | For Email                             | `smtp.resend.com`                                           |
+| `SMTP_PORT`                               | SMTP server port                                          | For Email                             | `465`                                                       |
+| `SMTP_USER`                               | SMTP username/email                                       | No                                    | `resend`                                                    |
+| `SMTP_PASSWORD`                           | SMTP password/token                                       | No                                    | `re_xxxx`                                                   |
+| `SMTP_SECURE`                             | Use secure SMTP connection (defaults to true if not set)  | For Email                             | `true`                                                      |
+| `SMTP_REJECT_UNAUTHORIZED`                | Reject invalid certificates (defaults to true if not set) | For Email                             | `false`                                                     |
+| `NEXT_PUBLIC_DISABLE_EMAIL`               | To disable all email features                             | For Email                             | `true`                                                      |
+| `NEXT_PUBLIC_BASE_URL`                    | Base URL of your installation                             | Yes                                   | `http://localhost:3000`                                     |
+| `NEXT_API_BODY_SIZE_LIMIT`                | Maximum API request body size (defaults to 1mb)           | No                                    | `50mb`                                                      |
+| `BETTER_AUTH_ALLOWED_DOMAINS`             | Comma-separated list of allowed domains for OIDC logins   | For OIDC/Social login                 | `example.com,subsidiary.com`                                |
+| `BETTER_AUTH_SECRET`                      | Auth encryption secret                                    | Yes                                   | Random 32+ char string                                      |
+| `BETTER_AUTH_TRUSTED_ORIGINS`             | Allowed callback origins                                  | No                                    | `http://localhost:3000,http://localhost:3001`               |
+| `GOOGLE_CLIENT_ID`                        | Google OAuth client ID                                    | For Google login                      | `xxx.apps.googleusercontent.com`                            |
+| `GOOGLE_CLIENT_SECRET`                    | Google OAuth client secret                                | For Google login                      | `xxx`                                                       |
+| `DISCORD_CLIENT_ID`                       | Discord OAuth client ID                                   | For Discord login                     | `xxx`                                                       |
+| `DISCORD_CLIENT_SECRET`                   | Discord OAuth client secret                               | For Discord login                     | `xxx`                                                       |
+| `GITHUB_CLIENT_ID`                        | GitHub OAuth client ID                                    | For GitHub login                      | `xxx`                                                       |
+| `GITHUB_CLIENT_SECRET`                    | GitHub OAuth client secret                                | For GitHub login                      | `xxx`                                                       |
+| `OIDC_CLIENT_ID`                          | Generic OIDC client ID                                    | For OIDC login                        | `xxx`                                                       |
+| `OIDC_CLIENT_SECRET`                      | Generic OIDC client secret                                | For OIDC login                        | `xxx`                                                       |
+| `OIDC_DISCOVERY_URL`                      | OIDC discovery URL                                        | For OIDC login                        | `https://auth.example.com/.well-known/openid-configuration` |
+| `TRELLO_APP_API_KEY`                      | Trello app API key                                        | For Trello import                     | `xxx`                                                       |
+| `TRELLO_APP_API_SECRET`                   | Trello app API secret                                     | For Trello import                     | `xxx`                                                       |
+| `S3_REGION`                               | S3 storage region                                         | For file uploads                      | `WEUR`                                                      |
+| `S3_ENDPOINT`                             | S3 endpoint URL                                           | For file uploads                      | `https://xxx.r2.cloudflarestorage.com`                      |
+| `S3_ACCESS_KEY_ID`                        | S3 access key                                             | For file uploads (optional with IRSA) | `xxx`                                                       |
+| `S3_SECRET_ACCESS_KEY`                    | S3 secret key                                             | For file uploads (optional with IRSA) | `xxx`                                                       |
+| `S3_FORCE_PATH_STYLE`                     | Use path-style URLs for S3                                | For file uploads                      | `true`                                                      |
+| `NEXT_PUBLIC_STORAGE_URL`                 | Storage service URL                                       | For file uploads                      | `https://storage.kanbn.com`                                 |
+| `NEXT_PUBLIC_STORAGE_DOMAIN`              | Storage domain name                                       | For file uploads                      | `kanbn.com`                                                 |
+| `NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS`     | Use virtual-hosted style URLs (bucket.domain.com)         | For file uploads (optional)           | `true`                                                      |
+| `NEXT_PUBLIC_AVATAR_BUCKET_NAME`          | S3 bucket name for avatars                                | For file uploads                      | `avatars`                                                   |
+| `NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME`     | S3 bucket name for attachments                            | For file uploads                      | `attachments`                                               |
+| `NEXT_PUBLIC_ALLOW_CREDENTIALS`           | Allow email & password login                              | For authentication                    | `true`                                                      |
+| `NEXT_PUBLIC_DISABLE_SIGN_UP`             | Disable sign up                                           | For authentication                    | `false`                                                     |
+| `NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY` | Hide “Powered by kan.bn” on public boards (self-host)     | For white labelling                   | `true`                                                      |
+| `KAN_ADMIN_API_KEY`                       | Admin API key for stats and admin endpoints               | For admin/monitoring                  | `your-secret-admin-key`                                     |
 
 See `.env.example` for a complete list of supported environment variables.
 

apps/web/Dockerfile

@@ -4,8 +4,9 @@ ARG PROJECT=@kan/web
 
 # 1. Alpine image
 FROM node:${NODE_VERSION}-alpine AS alpine
-RUN apk update
-RUN apk add --no-cache libc6-compat python3 make g++
+RUN apk update && \
+    apk add --no-cache --virtual .build-deps libc6-compat python3 make g++ && \
+    rm -rf /var/cache/apk/* /tmp/* || true
 
 # Setup pnpm and turbo on the alpine base
 FROM alpine AS base
@@ -18,43 +19,45 @@ RUN pnpm config set store-dir ~/.pnpm-store
 
 # 2. Prune projects
 FROM base AS pruner
-# https://stackoverflow.com/questions/49681984/how-to-get-version-value-of-package-json-inside-of-dockerfile
-# RUN export VERSION=$(npm run version)
-
 ARG PROJECT
 
-# Set working directory
-WORKDIR /app
+RUN apk add --no-cache git
 
-# It might be the path to <ROOT> turborepo
+WORKDIR /app
 COPY . .
- 
-# Generate a partial monorepo with a pruned lockfile for a target workspace.
-# Assuming "@acme/nextjs" is the name entered in the project's package.json: { name: "@acme/nextjs" }
+
+# Generate version from git (fallback if APP_VERSION not provided)
+RUN git fetch --tags --unshallow 2>/dev/null || git fetch --tags 2>/dev/null || true && \
+    AUTO_VERSION=$(git describe --tags --always --long 2>/dev/null | \
+    sed -E 's/^v?([0-9]+\.[0-9]+\.[0-9]+)-[0-9]+-g([a-f0-9]{7}).*/\1+\2/' | \
+    sed 's/^v//' || \
+    git rev-parse --short HEAD 2>/dev/null | head -c 7 || \
+    echo "unknown") && \
+    echo "$AUTO_VERSION" > /app/AUTO_VERSION
+
 RUN turbo prune --scope=${PROJECT} --scope=@kan/db --docker
  
 # 3. Build the project
 FROM base AS builder
 ARG PROJECT
-
-# Environment to skip .env validation on build
-ENV CI=true
+ARG APP_VERSION
 
 WORKDIR /app
 
-# Copy lockfile and package.json's of isolated subworkspace
 COPY --from=pruner /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
 COPY --from=pruner /app/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
 COPY --from=pruner /app/out/json/ .
+COPY --from=pruner /app/AUTO_VERSION /tmp/AUTO_VERSION
+
+ENV CI=true
 
-# First install the dependencies (as they change less often)
 RUN --mount=type=cache,id=pnpm,target=~/.pnpm-store pnpm install --frozen-lockfile
  
-# Copy source code of isolated subworkspace
 COPY --from=pruner /app/out/full/ .
 
-
-RUN pnpm build --filter=${PROJECT}
+# Use provided APP_VERSION or auto-generated from pruner stage
+RUN VERSION="${APP_VERSION:-$(cat /tmp/AUTO_VERSION 2>/dev/null | tr -d '\n\r' || echo 'unknown')}" && \
+    NEXT_PUBLIC_APP_VERSION="$VERSION" pnpm build --filter=${PROJECT}
 
 # # Copy static files to standalone directory
 # RUN mkdir -p apps/web/.next/standalone/.next && \

apps/web/i18n.json

@@ -2,7 +2,7 @@
   "version": 0,
   "locale": {
     "source": "en",
-    "targets": ["fr", "de", "es", "it", "nl", "ru", "pl"]
+    "targets": ["fr", "de", "es", "it", "nl", "ru", "pl", "pt-BR"]
   },
   "buckets": {
     "po": {

apps/web/i18n.lock

@@ -5,15 +5,19 @@ checksums:
     "%2C%20or%20see%20our/singular": e8a8f2a078fcaea03481710dcaccce5d
     "%7B0%7D/singular": 18782768c8a0b3c2078747b34fbbcd24
     "%7B0%7D%20%7C%20%7B1%7D/singular": 4628f9c6ec13c2dc2984a6ab80e19f8b
+    "%7B0%7D%20has%20been%20added%20to%20your%20favorites./singular": 0f752180183c80703b3f9f39dc97195f
+    "%7B0%7D%20has%20been%20removed%20from%20your%20favorites./singular": 26e4b4997ad8a711d0b3e46337799454
     "%7B0%7D%20labels/singular": 785f92bedf786ff3e285adfc07c69d18
     "%7B0%7D%20not%20found/singular": a2665fc66f128fee1a80ffec61c9f1a1
     "%7BboardCount%2C%20plural%2C%20one%20%7BImport%20board%20(1)%7D%20other%20%7BImport%20boards%20(%7BboardCount%7D)%7D%7D/singular": 72358c550bd1a99fcb6e8952f0f947ef
     "%2410%2Fmonth/singular": cab5e752ed83096e34fca780d90e1fb9
     "%248%2Fmonth/singular": 4667034934bb2bc3d569c70b94205b51
     1%20user/singular: 3b547431ab12f0fba84307e6a81109d8
+    14%20day%20free%20trial/singular: b2f7a80b5184d79ddd56b78d57d28225
     A%20powerful%2C%20flexible%20kanban%20app%20that%20helps%20you%20organise%20work%2C%20track%20progress%2C%20and%20deliver%20results%E2%80%94all%20in%20one%20place./singular: d405b83b0d631cb72f4347c10bcbb643
     Account/singular: 01215c12fb1cdb93bd0c84c1382bef56
     Account%20deleted/singular: a25da96a1579c4491be0a95669ef18a4
+    Actions/singular: c46571856723b03262fd33f511116298
     Activity/singular: 1948763de8e531483a798b68195e297e
     Activity%20log/singular: 3ec6755040306fdc9ce801bcf6ab28e1
     Activity%20logs/singular: 8b1f0bb96a905646ecfad1cfdfa42168
@@ -25,6 +29,8 @@ checksums:
     Add%20details.../singular: 2f42547fd5d199f173aa7a88c8a9b19a
     Add%20label/singular: 0be732d46df263265935fda342097a08
     Add%20member/singular: 11979625770516ca287e929381778e02
+    Add%20to%20favorites/singular: 532155acb0a46f2b6c37e15afb3ad21e
+    added%20%7B0%7D%20labels%3A%20%3C0%3E%7BlabelList%7D%3C%2F0%3E/singular: 42b0488d570626dc887c58ff669c953c
     added%20a%20checklist/singular: 44304f4a5ef3a46378eea243b5d2df79
     added%20a%20checklist%20item/singular: 20bc0330dba5a9ec978e04bec174365a
     added%20a%20label%20to%20the%20card/singular: 04c5e4ee9b7b7e77ef089d2ac473d235
@@ -32,10 +38,14 @@ checksums:
     added%20checklist%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: fb6a852c50c1629f47c6f155fc93fdee
     added%20checklist%20item%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: bdd202da20b1fffbec21792c5453f90c
     added%20label%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: b32be052b3d57de0c9120fa7f9fc86ee
+    Added%20to%20favorites/singular: 848046ec65d15913112b466c544722eb
     Adding%20a%20new%20member%20will%20cost%20an%20additional%20%7Bprice%7D%20(%7BbillingType%7D)%20per%20seat./singular: 12e88573028306110fbc15ef1e714892
     Adjust%20the%20square%20crop%20to%20fit%20your%20avatar./singular: a4df26bbce6f14c6962fac1324db00a8
+    Admin/singular: 90eb20f1400db82ab874744e47836dc6
     Admin%20roles/singular: 32a5d78073b9bb9a246773afba8831df
+    All%20member%20permission%20overrides%20have%20been%20reset%20to%20their%20role%20defaults./singular: e5c38724a283373506d53afd22b6d096
     All%20systems%20operational/singular: ee943a4046b09e6334cceeea9fda2bfc
+    Allow%20workspace%20members%20to%20see%20each%20other's%20email%20addresses/singular: 0077436d9f37bfd64f3ae076a5a05040
     Already%20have%20an%20account%3F%20%3C0%3E%3C1%3ESign%20in%3C%2F1%3E%3C%2F0%3E/singular: 2959fd276248208b65cb27ed46b20135
     An%20error%20occurred%20while%20disconnecting%20your%20Trello%20account./singular: 0aa3973b860c1faf8d9123aebf567e40
     An%20unexpected%20error%20occurred.%20Please%20try%20again%20later./singular: 1b5749b0cca6a62d75a577bee6804074
@@ -59,6 +69,7 @@ checksums:
     Are%20you%20sure%20you%20want%20to%20delete%20your%20account%3F/singular: 428b74d781063224c3e63980e1094ec3
     assigned%20%3C0%3E%7B0%7D%3C%2F0%3E%20to%20the%20card/singular: 9df6d89fa83706123dedd8cba2243d04
     Assignees/singular: 96fc0e28a783d80decfd4716a440ac08
+    Attachment%20uploaded/singular: c0233f8c2560f95ac0834f35eb07b9e7
     Awaiting%20Customer/singular: 122c108794f321c10e05a08f09b11457
     Backlog/singular: 35919fd5b10ad212839a75e72829fe4e
     Basic%20Kanban/singular: e46ebc406749486f3907436970d4d6c7
@@ -83,15 +94,44 @@ checksums:
     Brainstorming/singular: 736332f2e4488609e42d2be8547d296e
     Bug/singular: 4509fffdb5931f8905063c80cf802d71
     Bug%20Report/singular: e558d1f100e21230c2f495a8913ac5ec
+    Can%20add%20comments/singular: d7d70b75780156312701f4c5eed1b285
+    Can%20create%20boards/singular: 8538236f8caafd4eaa751b4ec45f1699
+    Can%20create%20cards/singular: dd1cce2d52e0fb261676750bfc46da22
+    Can%20create%20lists/singular: 53c3c1343efff494640b1227e4444de2
+    Can%20delete%20boards/singular: 818ff50f9f21d8ed3741a7933d66b794
+    Can%20delete%20cards/singular: c62309a7e52958aa4bdb477c07d1855d
+    Can%20delete%20comments/singular: 99884fcaf89c47aa33c6ddfd9f94ea5f
+    Can%20delete%20lists/singular: 8d6ff6cd43c6b9fcbc9fc7954d19409e
+    Can%20delete%20workspace/singular: 41bd5a6636500b1a6e04184e6f566198
+    Can%20edit%20boards/singular: 8b77fabfd955d5507b1826dc4a5c1108
+    Can%20edit%20cards/singular: 47e6c92c1056fd6e8b517ba456b3f607
+    Can%20edit%20comments/singular: a0caeec2b2b64e9f371f07dabed5733d
+    Can%20edit%20lists/singular: 1ce5feb15139c881b615edab065b3e12
+    Can%20edit%20member%20roles%20and%20permissions/singular: c364e8e8866111a471f4081db0730049
+    Can%20edit%20workspace/singular: 9768f990844e215c06910fed250da23a
+    Can%20invite%20members/singular: e02e562bcb7f46008d9595e485951413
+    Can%20manage%20workspace%20settings/singular: 27eb18d3be5b3d813996b7d5071e0317
+    Can%20remove%20members/singular: 97a452b0fb4b661eaca7e5b3d5b49dcd
+    Can%20view%20boards/singular: 14977bbbb566f72fc74e17d99bad09bb
+    Can%20view%20cards/singular: 5e728083853948c9d618f2276732d5cd
+    Can%20view%20comments/singular: 76dbbc9ae4bff589d391c67c84ac6470
+    Can%20view%20lists/singular: e36331c4a49f376befc9f0aa42492b01
+    Can%20view%20members/singular: 5b75a467257a1db29d466c0d9ccea3df
+    Can%20view%20workspace/singular: 79a12c55fcd04ea69cbb85b906794e9b
     Cancel/singular: 2e2a849c2223911717de8caa2c71bade
     Card/singular: bba0beaced7ea954ceb980f2b022ffee
     Card%20not%20found/singular: 91509e2f92b0b3b11330b6983139fdbf
     Card%20title/singular: 7c34f59f4005e6cb3a6ff546ea0b96e3
     Change%20Password/singular: a552fc5c4189ebc3e2e6018edda7d18f
     Change%20your%20language%20preferences./singular: 293d49fc3c75e9c425b64bd7126e6b46
+    changed%20the%20due%20date%20to%20%3C0%3E%7BformattedDate%7D%3C%2F0%3E/singular: 32189aa87452ab18f90f02742bfa9910
+    Check%20out%20some%20of%20our%20favorite%20open%20source%20projects./singular: b0d0be4f63c16552b3aa795af29240d1
     Check%20your%20inbox/singular: e9a430fcd298def74212238df0f680d6
     Checklist%20name/singular: 5eb5de823f7ca5a4d97bb41e6a3f675a
     Checklists/singular: 6f79129c8f08ee54d858a2af57d16dd9
+    Clear%20all%20custom%20permissions%3F/singular: 31d0962985c83a29558c98a765bb1b16
+    Clear%20any%20custom%20member%20permissions%20so%20that%20all%20members%20only%20inherit%20permissions%20from%20their%20role%20defaults./singular: e493291818059bfd51f2c87b938616c4
+    Clear%20custom%20permissions/singular: 288ce8688fd09c5a01eda5a6ba4bc98a
     Clear%20filters/singular: 8f40ab5af527e4b190da94e7b6221379
     Click%20on%20the%20link%20we've%20sent%20to%20%7BmagicLinkRecipient%7D%20to%20sign%20in./singular: 210b6ff8727f976182ec3f29ea3c7667
     Close/singular: 2c2e22f8424a1031de89063bd0022e16
@@ -106,6 +146,8 @@ checksums:
     Complete%20control%20and%20ownership%3A/singular: 0d8b682ba873272217425ccfc96aa9cd
     completed%20a%20checklist%20item/singular: 757b04c6c80cc927e1c597c0ad4fda33
     completed%20checklist%20item%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: 71ec18acf051fc909a48a07ca3578673
+    Configure%20which%20actions%20are%20allowed%20for%20each%20workspace%20role.%20These%20permissions%20apply%20to%20all%20members%20with%20that%20role./singular: 0a46a8a30c6c0ebdcd01e72a7d64ec64
+    Confirm%20your%20email%20preferences%3A/singular: 043c161dd9866231ae2418fdd9f61b9c
     Confirm%20your%20new%20password/singular: a0d2935d7b63f8dd19d7c0de47524416
     Connect%20Trello/singular: 4440a0b9e387ef7136e3958e7a089213
     Connect%20your%20favorite%20tools%20to%20streamline%20your%20workflow./singular: 033c5dcdb059ccb634aef7fe63f2f45d
@@ -116,6 +158,7 @@ checksums:
     Continue%20with%20/singular: 8ed03cf7c5e60a6edf3470a4558ff058
     Continue%20with%20%7B0%7D/singular: 2eaf6e1da91e208f7c5fb6bf862fe8a6
     Control%20who%20can%20view%20and%20edit%20your%20boards./singular: 2a7e0bec29bac26280de707e2fe8bce5
+    Convert%20to%20link/singular: 66210d2889031426c07f0b2c6c4c09d7
     Core%20features/singular: da95932e7a1465a5d21aa3b855a46dc2
     Create%20%7B0%7D/singular: d37c29be6ccc0eb6062237f8508c3178
     Create%20another/singular: 2de8a82a416eb78c0462aa36278edc9a
@@ -137,6 +180,7 @@ checksums:
     Current%20password%20is%20required/singular: 72536bca9598680027f2be8ce80ac280
     Custom%20board%20templates/singular: c2966b352d76bc53421c01e9c99474bb
     Custom%20domain/singular: b09e7a9c187b7163b4a6cfc78042fe42
+    Custom%20permissions/singular: 6f1748601979e2e4548877b292b43a20
     Custom%20templates/singular: f8caaad67e168f106a298c8e0a66240c
     Custom%20URLs%20require%20upgrading%20to%20a%20Pro%20plan/singular: f7275e3b473b8f7b39dab6b37eb26fea
     Custom%20workspace%20link/singular: 8a19ae46ccea9c54b65ae183cea70b44
@@ -164,19 +208,31 @@ checksums:
     Display%20name%20must%20be%20at%20least%203%20characters%20long/singular: 84178b79845a70937af5e26020403052
     Display%20name%20updated/singular: 4e27503ca24ef5f009713951ca9e5b97
     Do%20you%20offer%20a%20free%20plan%3F/singular: 3ef16b0994f0d9ae17067782ca9bed1b
+    Do%20you%20want%20to%20unsubscribe%3F/singular: 8173b82c731ba885939d223eeef2e40b
     docs/singular: 307bff5678ada918da1f1ec3edc76cac
     Docs/singular: 55fea190a0c0fb32acd3dc986cd3cc91
     Documentation/singular: 1563fcb5ddb5037b0709ccd3dd384a92
     Don't%20have%20an%20account%3F%20%3C0%3E%3C1%3ESign%20up%3C%2F1%3E%3C%2F0%3E/singular: 6ae8282ab8b4a01b4ce87b119e13714b
     Done/singular: ffd408fa29d5bc9039ef8ea1b9b699bb
+    Download%20failed/singular: 142b391cca3e05f2af9617092f7358c5
+    Due%20date/singular: b098b52aff38516c5838c2ac4419f958
+    Due%20next%20month/singular: 223ab6f1211e1dfdf39ea68d25fe380b
+    Due%20next%20week/singular: 2f8fac5719df18d25a466ee913dc6487
+    Due%20today/singular: a14cb9dd0003485894d328bb803c80e5
+    Due%20tomorrow/singular: 0b6c8ad7aba0873b7e212d5f1949ca97
+    Edit/singular: eee7f39ff90b18852afc1671f21fbaa9
     Edit%20board%20URL/singular: d8276dfc0189f371ec7d80a2047c07aa
     Edit%20comment/singular: 7e4b46525fcb6b47b71798e31c46e374
     Edit%20label/singular: 0309e0be1512b1e0b0ceb87c69a53d03
+    Edit%20permissions/singular: 244558dd716491b7ed72ba8ab73aa28f
     Edit%20workspace%20URL/singular: bbae5f2f8a442947d33099979bbbe899
+    Edit%20YouTube%20Video/singular: 4899d9e990d291eb6e71ee40a8ee314b
     Editing/singular: 3449a7988cd69207b7c6929af1f4abf1
     email/singular: f31eb214738e037d58e26149797739df
     Email/singular: e7f34943a0c2fb849db1839ff6ef5cb5
+    Email%20visibility/singular: 81d41cf573a7109c376d30d905beb596
     Enhancement/singular: 785fe23c0eef0a5b60b5b2a88151de31
+    Enter%20a%20custom%20title/singular: f002074db0bd51d4f28d2736e140370a
     Enter%20your%20current%20password/singular: bfceabde4c0b6f2cb439015b76549651
     Enter%20your%20current%20password%20and%20choose%20a%20new%20secure%20password./singular: 9bb88155b18e98ea799c0e939d16af64
     Enter%20your%20email%20address/singular: 9bc008365ebe3e404e241c8ca876f56e
@@ -206,7 +262,9 @@ checksums:
     Failed%20to%20accept%20invitation.%20Please%20try%20again%20later%2C%20or%20contact%20customer%20support./singular: e4505a9df3a81e93a8a8b103c6e3ebc4
     Failed%20to%20copy%20invite%20link/singular: 635884d5ed8d6ee20b85a003939b4ae7
     Failed%20to%20create%20board/singular: a746e2afe881c3bf0a8e82a931ca3495
+    Failed%20to%20fetch%20video%20information/singular: 1e3fd610e8ed3e6c4c66e6ce88fc8b7a
     Failed%20to%20login%20with%20%7B0%7D.%20Please%20try%20again./singular: 669a4b4247a73f53fb9b8b16e42d166f
+    Failed%20to%20upload%20attachment.%20Please%20try%20again./singular: f8a50d1c8491404f73d3cf701e11f297
     FAQ/singular: 47e0ee2eb40b4e7e732e05e2233fc71c
     FAQs/singular: dc36d7992372ccd419b39ef51cf5b16c
     Fast%20%26%20lightweight/singular: 4f2a80c555a5427b94eef5124aa10775
@@ -217,13 +275,14 @@ checksums:
     Feedback/singular: 6fac88806e0c269a30777b283988c61c
     Feedback%20sent/singular: 38a490c7ad5f1aa6013dfa879d2c7818
     Filter/singular: 626325a05e4c8800f7ede7012b0cadaf
-    Find%20answers%20to%20common%20questions%20about%20the%20project.%20Can't%20find%20what%20you're%20looking%20for%3F%20Feel%20free%20to%20%3C0%3Econtact%20us%3C%2F0%3E./singular: 4d99230dad703bf2d71ba670c2f79d3d
-    For%20long-term%20sustainability%2C%20we%20recognise%20all%20good%20open%20source%20projects%20need%20a%20source%20of%20revenue.%20Ours%20comes%20from%20the%20paid%20cloud%20offering%20for%20workspaces%20with%20multiple%20users%20(free%20during%20the%20beta)%20and%20for%20custom%20workspace%20slugs.%20There's%20no%20obligation%20to%20use%20it%2C%20and%20you%20can%20self-host%20the%20software%20on%20your%20own%20infrastructure%20free%20of%20charge./singular: 4eedacd4311ff69bf0fd87083c90a268
+    Find%20answers%20to%20common%20questions%20about%20Kan.%20Can't%20find%20what%20you're%20looking%20for%3F%20Feel%20free%20to%20%3C0%3Econtact%20us%3C%2F0%3E./singular: b4c05c9174637f4da2a41ead0d65bc01
+    For%20long-term%20sustainability%2C%20we%20recognise%20all%20good%20open%20source%20projects%20need%20a%20source%20of%20revenue.%20Ours%20comes%20from%20the%20paid%20cloud%20offering%20for%20workspaces%20with%20multiple%20users%20and%20for%20custom%20workspace%20slugs.%20There's%20no%20obligation%20to%20use%20it%2C%20and%20you%20can%20self-host%20the%20software%20on%20your%20own%20infrastructure%20free%20of%20charge./singular: 9fa1c942feb40d6350322b71561df789
     Free/singular: 0326365539c004f6088656f692602078
     Free%20Plan/singular: c995acccc1e3cba379786892a5b4d4e5
     Free%2C%20forever/singular: ae4f2f81e88a50b5f250ef8e8e77e74b
     Full-time/singular: fe6e201f6676ae354111435cf6c76910
     Fun/singular: 395bdc48e943762b6cde649f4a96771d
+    General/singular: b891e8f15579fc5d97bcaf3637f5ae59
     Get%20started/singular: 5c783951b0100a168bdd2161ff294833
     Get%20Started/singular: 1d5f030c4ec9c869e647ae060518b948
     Get%20started%20by%20creating%20a%20new%20%7B0%7D/singular: 4ca5ef637c08104e9dbb5ff9f49f0680
@@ -235,6 +294,11 @@ checksums:
     GitHub/singular: 6e1cf3c00fa6fbe24afcc78ea3b5f3e4
     Go%20Home/singular: 6251589da1964d55afabdfd64c84c335
     Go%20to%20app/singular: 896d0441384dcd2bfb3b23d61ff1944d
+    Go%20to%20boards/singular: dc1362de207d67fe84fb0caf60262e73
+    Go%20to%20members/singular: 445f4efbc4b1e7509f4fd79ebfbb1476
+    Go%20to%20settings/singular: 24a7f96880650c9b37099d69f4b7e2a9
+    Go%20to%20templates/singular: e4e58e33d637282d141df466d729bc7c
+    Guest/singular: 2aec6d6ebe0d9a1db0a5c8cd5a98b8c3
     High%20Priority/singular: 5d231ff8254aabc875f194c4b4f49c97
     Hired/singular: e5a9b1bd409b007141fe3d7890022f9a
     Host%20Kan%20on%20your%20own%20infrastructure.%20Ideal%20for%20organisations%20that%20need%20complete%20control%20over%20their%20data./singular: 8e7ae0783d60ef4624d3caf9bfc3747f
@@ -278,6 +342,7 @@ checksums:
     Kanban%20is%20better%20with%20a%20team.%20Perfect%20for%20small%20and%20growing%20teams%20looking%20to%20collaborate./singular: a77bee43046b260797c8936ad23e9223
     Kanban%20reimagined/singular: 613ccfdd9f54c66cbf68cfa313498766
     Keep%20in%20mind%20that%20this%20action%20is%20irreversible./singular: 79702b2ad3be71cb8b87f1122a60c199
+    Keyboard%20Shortcuts/singular: ef00d7494b69def6841620bd6554d040
     Labels/singular: 6f15627a90002323eac018274b6922d6
     Labels%20%26%20filters/singular: e1ceda0c6cc32fb04cb9423582ad8fe4
     Labels%20%26%20Filters/singular: 8f0bdd6084516f8241cb613178114390
@@ -285,6 +350,7 @@ checksums:
     Launch%20offer/singular: 624592ba2ecf647a3fe60d493c1ee71a
     Launch%20offer%3A%20Get%20unlimited%20members%20with%20Pro/singular: 8c1be80f5b2fcc112922282afbe30287
     Launch%20offer%3A%20unlimited%20seats%20for%20just%20%2429%2Fmonth%20with%20Pro/singular: 235d1cda21811c296afdc0dcc438cc24
+    Learn%20more/singular: e598091d132f890c37a6d4ed94f6d794
     Learning/singular: 90e91da3f870f065f2da9aa9adf53514
     Legal/singular: 00d3f08da61a21887009819cf93fb414
     License/singular: ac2bcac75151e2fcd9eb768cea275a77
@@ -292,6 +358,10 @@ checksums:
     Link%20copied/singular: 4a4805700b31ec65bcb3ca962bccfd1b
     List/singular: 94f13e7ef909a4de9db7abaa1f9f0b61
     List%20name/singular: e925e2e6ccaf0eb4064a888aaea8d3c2
+    Lists/singular: 9f4a73afc8de321175d71935134ef066
+    Load%20more%20activities/singular: f32d40a739ffaa700051c4c7d70055cf
+    Loading%20permissions.../singular: a5665279d4e439186825057c32d4d976
+    Loading.../singular: 82b4ea7ed1439094d7c4be13aaba9a66
     Login%20%7C%20kan.bn/singular: 42a6c8dcd73e0d46e652646dc86871eb
     Logout/singular: 07948fdf20705e04a7bf68ab197512bf
     Long-term/singular: 51cb6f0b112250c5a091ca5f0866904b
@@ -302,6 +372,7 @@ checksums:
     marked%20a%20checklist%20item%20as%20incomplete/singular: 35d0822f65971b97774b962561b02649
     marked%20checklist%20item%20%3C0%3E%7B0%7D%3C%2F0%3E%20as%20incomplete/singular: 4c38799ff25321ea25017bf4cd8e2e4f
     Medium%20Priority/singular: 1f527cd6d1ed602930bcaa303f503b51
+    Member/singular: 1606dc30b369856b9dba1fe9aec425d2
     Members/singular: 0932e80cba1e3e0a7f52bb67ff31da32
     Members%20%7C%20%7B0%7D/singular: a29e3e9f1076acd178c417d047584e88
     Monthly/singular: 818f1192e32bb855597f930d3e78806e
@@ -309,6 +380,7 @@ checksums:
     moved%20the%20card%20from%20%3C0%3E%7B0%7D%3C%2F0%3E%20to%3C1%3E%7B1%7D%3C%2F1%3E/singular: 11edf0427766c26db541d46379dc3c16
     moved%20the%20card%20to%20another%20list/singular: 2e8c41bfafb42fa299ce56e4300205ff
     Name/singular: 9368b5a047572b6051f334af5aa76819
+    Navigation/singular: 0373afd8238db1c49f4be4fa6cdf5cd3
     Need%20help%3F/singular: 04e7322f2d3ffb2d73ff2f64b71637c8
     New/singular: 126d036fae5fb6b629728ecb97e6195b
     New%20%7B0%7D/singular: 67b6a22a65e0956f2091d00e6966652b
@@ -326,17 +398,29 @@ checksums:
     Newsletter/singular: dcfb9666301924431ac8ae88e5b6f9d7
     Next%20Steps/singular: 12392fe73ae60b6e5a9d851256b8477e
     No%20%7B0%7D/singular: a7a95e1dfdb4396da9e2be0e27f42323
+    No%20authentication%20methods%20are%20currently%20available/singular: f718c896810da3612202887f9a4374fa
     No%20boards%20found/singular: e044088d2c51b6bdf660fafa86ee1e17
     No%20credit%20card%20required/singular: 2090aa4171dc0b60735069f89b592883
+    No%20dates/singular: bd0ec82b3b1f4a5fa89d362b71f8141d
+    No%20download%20URL%20available%20for%20this%20attachment./singular: e367d39420b2242f9d2fd749c87f446a
+    No%20keyboard%20shortcuts%20registered./singular: 7f1ed5d777cade7d62303e9e591bbf63
     No%20lists/singular: cedf633d99c77ff4356e089f2d98c0a6
+    No%20lists%20have%20been%20created%20yet/singular: f18ee3d7230cc33b68bd17b429d1d442
     No%20results%20found%20for%20%22%7BdebouncedQuery%7D%22./singular: 5db6294712528cd897b15ae36f4fd834
+    No%20roles%20found%20for%20this%20workspace%20yet./singular: 2eb502333aaf6c58e8ab23d881e2e357
     Offer/singular: 82b4e0c9a3f5b4bd93590847de7c32a1
     Onboarding/singular: 52b23f9c62ff199d4c09920e7641829e
     Once%20you%20delete%20your%20account%2C%20there%20is%20no%20going%20back.%20This%20action%20cannot%20be%20undone./singular: 9cf7aa6ef30890e5124e266c081bae1c
     Once%20you%20delete%20your%20workspace%2C%20there%20is%20no%20going%20back.%20This%20action%20cannot%20be%20undone./singular: c9ce6a516ed1f361653e8f8db3dd5ffd
+    Open%20command%20menu/singular: cf00563ea1a994e7c36a761d56664acc
+    Open%20keyboard%20shortcuts/singular: 638ae0999fd03d2c611064274859422e
     Open%20source/singular: 81a747dc664de1a3389b495c8f84843b
+    Open%20Source%20Friends/singular: ffe3d75e5d03b8469c9dcb019dceb164
     or/singular: 7b133c38bec0d5ee23cc6bcf9a8de50b
     Organize%20and%20find%20cards%20quickly%20with%20powerful%20filtering%20tools./singular: 1b9898c4b21e9dff413b4f76dc59db56
+    OSS%20Friends/singular: 706e10666dfe26130c17fedb5366a25d
+    Overdue/singular: 24caaa2b5d7a2447ab7664e3771cf98c
+    Overrides%20cleared/singular: f2e380efbae31a6113cc0cbf0eadf7b0
     Own%20your%20data/singular: cc2178dac4bdf6b07f030cfc2a7510e6
     Owned%20by%20Atlassian/singular: ace4ed076a5318ad48c296fa09afed69
     Part-time/singular: 213d63da450f35dabb3ab0e35e29feed
@@ -349,6 +433,10 @@ checksums:
     Payment%20frequency/singular: 63ded0e4ffb462ca8bd33d38e4691d86
     Pending/singular: 030a6f3395d5d4efddd3cc67d6009039
     per%20user%2Fmonth/singular: 72af182c1ba6df6732640f4d8a78d360
+    Permission/singular: cc2ed7274bd8267f9e0a10b079584d8b
+    Permissions/singular: 2160be68b1d6b6577e64634e9feba2ed
+    Permissions%20reset/singular: dd4776f04aca858deb95887e807570fc
+    Permissions%20updated/singular: 0df44570b783b8b284610da8627d333d
     Personal%20Project/singular: d7820b1bf4efecc61ed89234567aaa9c
     Planning/singular: 353f58c75248275fe091740607501610
     Platform/singular: c68862170146325333c7f25af11a3fa2
@@ -356,6 +444,7 @@ checksums:
     Please%20enter%20a%20valid%20email%20address/singular: 8de4bc8832b11b380bc4cbcedc16e48b
     Please%20enter%20a%20valid%20name/singular: f2d741f1b5cae722e35cb5206786f932
     Please%20enter%20a%20valid%20password/singular: 4b32c17e19b79bcbf0bb092c06ba310f
+    Please%20enter%20a%20valid%20YouTube%20URL/singular: c16c69c3b742b1e19148378d50adf37f
     Please%20select%20a%20file%20to%20upload./singular: de315bf594047f8ef9307a7fa9285844
     Please%20try%20again%20later%2C%20or%20contact%20customer%20support./singular: 21ffcf0b00e7cd7b64f7454a95762e1d
     Please%20try%20again%20later./singular: 325dea6dd0348a27a6818db2c1340c98
@@ -376,20 +465,26 @@ checksums:
     Recruitment/singular: 78084ee4954aa22efe9ad7463d2a0c72
     Remote/singular: dc3e4280dfe5c455b38ba6c8884999cf
     Remove/singular: dba2fe5fe9f83f8078c687f28cba4b52
+    Remove%20from%20favorites/singular: 74d9cc2d2f3c7a7dc42a7e62c8ee06d5
     Remove%20member/singular: 1d77c2ca3768e486fd1fb5df30cb60d9
+    removed%20%7B0%7D%20labels%3A%20%3C0%3E%7BlabelList%7D%3C%2F0%3E/singular: 612fcfd4aca6818fc870f81d9687d63f
     removed%20a%20label%20from%20the%20card/singular: f83ec18850a2a8a3f8242a740a04df06
     removed%20a%20member%20from%20the%20card/singular: 0bd7561bb79358fde3d595c3e60a315a
+    Removed%20from%20favorites/singular: 540609ab686ed67b1cfd7649467b8bc1
     removed%20label%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: 7e0936b15831e65754588b8512f62fcb
+    removed%20the%20due%20date/singular: 000c084844718540fcad542dd8caf8b4
     renamed%20a%20checklist/singular: 4d208de1857740e63469007c5b8b491a
     renamed%20checklist%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: e95d119ef65b0af6c0a96bef182be671
     renamed%20checklist%20item%20to%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: 50f55f71f9245890afee434d7adc2140
     Research/singular: 3368e9638d1619babd6df9fad592274f
+    Reset%20to%20role%20defaults/singular: fc9ff8ea0503e50da3e9b3e5d8bb75dd
     Resolution/singular: 6d8bd9e1bd7dae5ae38c93061d32990e
     Resources/singular: ec7fb05ed963bb6781a35782b3475502
     REST%20API/singular: 54c9f8d98f45f50399b6b93ba70af0d6
     Review/singular: 299f75db25382980b2895622d7712927
     Roadmap/singular: c60f4a1acf30e566861bf130f13b9ae7
     Role/singular: 53743bbb6ca938f5b893552e839d067f
+    Role%20updated/singular: 73606ae9c35101f1bb518961f68559d0
     Run%20on%20your%20own%20infrastructure/singular: eba804911562b8dbf9d69c3e27f1d708
     Save/singular: f7a2929f33bc420195e59ac5a8bcd454
     Save%20time%20with%20reusable%20board%20templates./singular: d0f2d7d0fd682ceaf4ca12c6353fd75a
@@ -404,12 +499,16 @@ checksums:
     Self-hostable/singular: 3e3597145cc17f03b8b5646b80d59592
     Send%20feedback/singular: 9631cc08d49da04475b30a0d320ce97c
     Senior/singular: 3fff865dc00435f82896fc302ea45630
+    Set%20due%20date/singular: 3cb81c4829857556f5d117c9a23f7bcc
+    set%20the%20due%20date/singular: b5d9a1edd988f455041aee9fa7fb3d63
     Settings/singular: 8df6777277469c1fd88cc18dde2f1cc3
     Settings%20%7C%20Account/singular: 050e18406849ec057edac877c297c3e1
     Settings%20%7C%20API/singular: 85101e4b802a09ad9e3f01ff116f0894
     Settings%20%7C%20Billing/singular: e44cba741d5414035a0b499c5766c203
     Settings%20%7C%20Integrations/singular: d04992e28016452f6d3d7dcc0b592415
+    Settings%20%7C%20Permissions/singular: 8aa60ed978b9f45a705d99dc1ee04f37
     Settings%20%7C%20Workspace/singular: 5d0bacf7ff696da940f232df45edfd39
+    Shortcuts/singular: db3330ed3240c398054f3be23c52851f
     Sign%20in/singular: cb8757c7450e17de1e226e82fb0fa4a2
     Sign%20In/singular: ec7b8f314fe9bc6591006707484ede61
     Sign%20Up/singular: 0dd2ae69be4618c1f9e615774a4509ca
@@ -422,6 +521,7 @@ checksums:
     Social%20Media/singular: 2227508afb0d38a027e323207e47d4a2
     Software%20Development/singular: 67659097ef6bcb194839858b2c4f3a3c
     Star%20on%20Github/singular: e5cb0428f1ac6485688f120d78742875
+    Start%2014%20day%20free%20trial/singular: 4be2811a8f3455618032ccb59e40658b
     Subscription%20Required/singular: 05f2b4abfc36def17756a6969983cf86
     Success/singular: c43827becada6750f7a25890905f38b9
     Supercharge%20your%20workspace%20for%20just%20%2429%2Fmonth.%20Here's%20what%20you'll%20get%3A/singular: 21af8119141afcce5f12da489f34db6a
@@ -441,6 +541,8 @@ checksums:
     Thank%20you%20for%20your%20feedback!/singular: 07edd8c50685a52c0969d711df26d768
     The%20current%20password%20you%20entered%20is%20incorrect./singular: 67a76bf346ab4b48563269e9d941a64a
     The%20main%20difference%20between%20Kan%20and%20Trello%20is%20that%20Kan%20is%20open%20source%2C%20allowing%20anyone%20to%20view%2C%20modify%2C%20and%20contribute%20to%20our%20code.%20Our%20cloud%20offering%20also%20offers%20no%20restrictions%20on%20features%20for%20individual%20use%2C%20whereas%20Trello%20locks%20basic%20features%20such%20as%20the%20number%20of%20boards%20you%20can%20create%20behind%20a%20paywall./singular: db6e22cc955c5fbe547feedeb48f8719
+    The%20member's%20permissions%20have%20been%20updated./singular: 6ae91be2c5c0504bf521335094c50fa4
+    The%20member's%20role%20has%20been%20updated./singular: e30c30a2beaac7d046c35f628102f83b
     The%20open%20source%20%3C0%2F%3E%20alternative%20to%20Trello/singular: 692cb2e8a8e610953c996826beed45a2
     The%20visibility%20of%20your%20board%20has%20been%20set%20to%20%7B0%7D./singular: 970e17a115f7374e60e0a8ded425db8f
     Theme/singular: 21fe00b7a518089576fb83c08631107a
@@ -450,11 +552,14 @@ checksums:
     This%20board%20is%20private%20or%20does%20not%20exist/singular: a217ff3f04463b4df8c86adb6f83c6bc
     This%20board%20URL%20has%20already%20been%20taken/singular: 1d8b40332a031b5b77a3658e48dd51ca
     This%20invitation%20link%20is%20invalid%20or%20has%20expired./singular: 11cc7ef8f1512e7e058e1fbbe5644001
+    This%20member's%20permissions%20have%20been%20reset%20to%20their%20role%20defaults./singular: 730f33b8f1fc002c4f393ccd262b6664
+    This%20will%20remove%20all%20custom%20member%20permissions%20in%20this%20workspace.%20Members%20will%20inherit%20permissions%20only%20from%20their%20roles./singular: 1c989752736fa41ecdd68ea890f16a15
     This%20will%20result%20in%20the%20permanent%20deletion%20of%20all%20data%20associated%20with%20this%20workspace./singular: a31141558af793635c1ddd2fa0a33499
     This%20will%20result%20in%20the%20permanent%20deletion%20of%20all%20data%20associated%20with%20your%20account./singular: b49224632bd6c3b7f5e462912aeb1081
     This%20workspace%20URL%20has%20already%20been%20taken/singular: b455329e2a71da677acab91d3a00bad6
     This%20workspace%20URL%20is%20reserved/singular: 7e47c892b93d4334c1606010c06e875e
     This%20workspace%20username%20has%20already%20been%20taken/singular: b7eadb89c615874f416d9658d0428c4c
+    Title/singular: 344e64395eaff6822a57d18623853e1a
     To%20Do/singular: d60813ea824f373462471e092d136eed
     Toggle%20menu/singular: 29dea3e0b6238874f8c7a27619df8e36
     Track%20all%20card%20changes%20with%20detailed%20activity%20history./singular: 0d3bac559c71ec4b8734f9f212320de5
@@ -465,26 +570,35 @@ checksums:
     Trusted%20by%20fast-moving%20teams%3C0%2F%3Earound%20the%20world/singular: b065575df380536df9541a91ca9b37bf
     Unable%20to%20add%20checklist%20item/singular: 4c4c3eaaf10b348b39ae97eb5dc455df
     Unable%20to%20add%20comment/singular: 49bb435880817434698f31a6069564d6
+    Unable%20to%20add%20label/singular: b09fda6420ea1dc10dbea0b1dc373f29
+    Unable%20to%20clear%20overrides/singular: dfeac280858332082ad34d2623a59863
     Unable%20to%20create%20card/singular: 90112ea12ec6fa42097a6e022ae048a4
     Unable%20to%20create%20checklist/singular: 94eed122e42e0951cd08b9ec62f5eeb6
     Unable%20to%20create%20list/singular: 7fbbf8314f8d08a4123c7daef09fed05
     Unable%20to%20create%20template/singular: 7495f1434c9188849bffd015811d5337
     Unable%20to%20create%20workspace/singular: c1c949477e121d73ed6683eddf9cd874
+    Unable%20to%20delete%20attachment/singular: 99d0b17b78d44e15f13d876d155f0efc
     Unable%20to%20delete%20card/singular: 50ff06aa1265fe464f776aba33f1bef9
     Unable%20to%20delete%20checklist/singular: d7067e2c009f4919f0cca77df3c228ee
     Unable%20to%20delete%20checklist%20item/singular: a74144593b625e4d8d7ecf734462c60d
     Unable%20to%20delete%20comment/singular: 550198b2c87f06726a843c79c1026ed9
     Unable%20to%20remove%20member/singular: 39025a0c53818438829603d213baef06
+    Unable%20to%20reorder%20checklist%20item/singular: dcc238c72b85daf74ebd46adcd914473
+    Unable%20to%20reset%20permissions/singular: fb09d88ff4eb32afb852d733bafd515b
     Unable%20to%20send%20feedback/singular: 656c93265d7e2bef1245b17d85f85ae5
+    Unable%20to%20update%20board/singular: 62899897d7bffcb1df3af77d460f0881
     Unable%20to%20update%20board%20URL/singular: 080746884059142358b58d9a44ff7d93
     Unable%20to%20update%20board%20visibility/singular: a76a21d561b8943e9276e027a1e3f70d
     Unable%20to%20update%20card/singular: eca6002e57af8ec97324eae64e3b5731
     Unable%20to%20update%20checklist/singular: 44c10f49f448909ceca481ed9b4b07e7
     Unable%20to%20update%20checklist%20item/singular: 5c86b3523531c30d58856e3ecde0cb55
     Unable%20to%20update%20comment/singular: 05e798ed6b0f3fee41f3e8832eb699ea
+    Unable%20to%20update%20due%20date/singular: af20d7482cb639a8c8264c681a18abed
     Unable%20to%20update%20labels/singular: dca2bdc3dcf74bc9d95e05156039a291
     Unable%20to%20update%20list/singular: 14aa802f91b9b4c05236c8c75afb33da
     Unable%20to%20update%20members/singular: 9a851a6b0c75ee16d25cf2ff4b67b255
+    Unable%20to%20update%20permissions/singular: 134f20c5f2463167509562b284ef1c61
+    Unable%20to%20update%20role/singular: 4f2240aeff6f7275feb33ca3f608e48c
     unassigned%20%3C0%3E%7B0%7D%3C%2F0%3E%20from%20the%20card/singular: b683cc07092348c1e75dba40b1262b85
     unassigned%20themselves%20from%20the%20card/singular: 27c6f293c562af6a44348d7f00036d30
     Unlimited%20activity%20log/singular: 8c993de94cda0deac19ba14ecafce6a5
@@ -495,16 +609,17 @@ checksums:
     Unlimited%20lists/singular: 5c418701b27b9acbc5dd199719007362
     Unlimited%20members/singular: f2949ca2dc18b0063af92e60779abb65
     Unlimited%20workspaces/singular: b504d01997bf908af1d486d9942fed36
+    Unsubscribe/singular: d1a0b07295687d1f08d4df1c411072dd
     Update/singular: 079fc039262fd31b10532929685c2d1b
     Update%20label/singular: 97880b503dfe956941c5f23025a1c102
     updated%20a%20checklist%20item/singular: 198e1d1d503f4b69b752dd84d0cc0e9d
     updated%20the%20description/singular: 70fd604b6dc957a75be90ea77572d76d
+    updated%20the%20due%20date/singular: 7636c200d50fed58a4295ed1e9b5c1e0
     updated%20the%20title/singular: 98cf8f12923ec1a58e767e3a40863b21
     updated%20the%20title%20to%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: aca196d729401d8adc5c8ca9d558840e
-    Upgrade/singular: 63c3b52882e0d779859307d672c178c2
     Upgrade%20to%20Pro/singular: 972773025e763ddf53273df6d37a729a
     Upgrade%20to%20Pro%20(%2429%2Fmonth)/singular: 9a91ea70f5eb55aac96640bf0fd7feff
-    Upgrade%20to%20Team%20Plan/singular: 40e2ef151266937f8bbe63b3d361f645
+    Upload%20failed/singular: 5b7b755f05330164dbfb00096c500ee3
     Urgent/singular: e79afcd4398e52e10e7e8243a7eecabe
     URL%20can%20only%20contain%20letters%2C%20numbers%2C%20and%20hyphens/singular: 875d37d2d920f98ef60a314eda8a5d9a
     URL%20cannot%20exceed%2024%20characters/singular: 395c25732b84ac1f5b63ee310da08e93
@@ -521,11 +636,12 @@ checksums:
     View%20workspace/singular: c9e4b789330b08c18ca8db7044409e5f
     Visibility/singular: 1ff412f8fcde0f460acbf11153649646
     We%20are%20using%20the%20%3C0%3EAGPL-3.0%20license%3C%2F0%3E./singular: 08c5ddd938a2a70f61d684e41e18697a
+    We%20couldn't%20update%20your%20preferences.%20Please%20try%20again./singular: 69d1d2575f2e73b08ac622bde0a45b4d
     We're%20just%20getting%20started.%20/singular: 2dfa121e0ff1914e08068308a81973c0
     Welcome%20back/singular: 4928884739ba559e6e4b960e80fe1452
     What%20license%20are%20you%20using%3F/singular: 59d00e1bf28edc21b77fec94875f57ca
     What's%20the%20difference%20between%20Kan%20and%20Trello%3F/singular: 7a02f507dd6abbfab1fdae0b172d31b7
-    When%20Trello%20launched%20in%202011%2C%20it%20blew%20everyone%20away%20with%20its%20carefully%20designed%20simplicity%2C%20but%20over%20time%20(and%20atlassification)%20it%20lost%20its%20magic%20and%20grew%20into%20something%20closer%20to%20%22Jira%20Lite%22.%20This%20project%20is%20our%20attempt%20to%20recapture%20the%20original%20magic%20of%20Trello's%20simplicity%2C%20in%20open%20source./singular: 60a55e9bd16c3d1beff1a6c7633c5911
+    When%20Trello%20launched%20in%202011%2C%20it%20blew%20everyone%20away%20with%20its%20carefully%20designed%20simplicity%2C%20but%20over%20the%20years%20it%20lost%20its%20magic%20and%20grew%20into%20something%20closer%20to%20%22Jira%20Lite%22.%20This%20project%20is%20our%20attempt%20to%20recapture%20the%20original%20magic%20of%20Trello's%20simplicity%2C%20in%20open%20source./singular: 2c0790e6654e5460453ad2e523bbd377
     White%20label/singular: 2570386f73a010b07219e7658aaf9d9b
     Why%20make%20an%20open%20source%20Trello%3F/singular: 090833338ba8c64ef7a75e0f2615b34b
     Workspace/singular: b63ef0e99ee6f7fef6cbe4971ca6cf0f
@@ -537,10 +653,11 @@ checksums:
     Workspace%20description%20updated/singular: 19ddb6ee9ead26982a90dee426f3ee1f
     Workspace%20members/singular: 1857292f9567c556c781a23bd7e10544
     Workspace%20name/singular: 855614bbf862fd6a9f6a3e76943f92d4
-    Workspace%20name%20cannot%20exceed%2024%20characters/singular: c8b8f79fb83abf8329cc34c1f51fcfc9
+    Workspace%20name%20cannot%20exceed%2064%20characters/singular: 681f86c9ca31699fc5a3ca3790e5972c
     Workspace%20name%20is%20required/singular: b8c5162dd08c4d941bc57f9d0cbee451
     Workspace%20name%20must%20be%20at%20least%203%20characters%20long/singular: e448ea97418d44b18b4c21c22b8ba779
     Workspace%20name%20updated/singular: 3206ea410ee1ea4182b27ac0d89f92a1
+    Workspace%20permissions/singular: 72c0202f30e543eb81bf930d85647096
     Workspace%20slug%20updated/singular: 527b92711d38cb35b40741df43aef047
     Workspace%20URL/singular: f4397a838da0f3a44cbd3ebe408ed6c3
     workspace-url/singular: 2d034732ec536f3a2667f956fa50d394
@@ -551,19 +668,25 @@ checksums:
     You%20can%20get%20a%20custom%20workspace%20URL%2C%20like%20%3C0%3Ekan.bn%2Fkan%3C%2F0%3E%2C%20by%20going%20into%20your%20%3C1%3Eworkspace%20settings%3C%2F1%3E%20and%20purchasing%20a%20pro%20workspace%20subscription.%20All%20subscriptions%20help%20fund%20the%20development%20of%20the%20project!/singular: 41dd145ef56f539e12dc064a9807c660
     You%20can%20invite%20team%20members%20by%20clicking%20the%20%22Invite%22%20button%20in%20the%20top%20right%20corner%20of%20the%20%3C0%3Emembers%20page%3C%2F0%3E%20and%20entering%20their%20email%20address.%20They%20will%20receive%20an%20email%20with%20a%20link%20to%20join%20the%20workspace./singular: 47e125eb9b4c11cab5a2f4b3ab08e883
     You%20can%20self-host%20by%20following%20the%20instructions%20in%20our%20%3C0%3Erepo%3C%2F0%3E./singular: a6152a41b2d8f64d5a657e5b8bc808a9
+    You%20don't%20have%20permission/singular: 11d928b1993d95d54a95f85f8ae5016d
     You%20have%20been%20logged%20in%20successfully./singular: ef8fad1dce13ae4112f17c5258655fea
     You%20have%20been%20signed%20up%20successfully./singular: f614a6e3b45f5ffb9a3b0fb420fef84b
+    You%20have%20been%20unsubscribed!/singular: e0b9985faa4e7f25b71acc77750923a6
     You%20have%20unlimited%20seats%20with%20your%20Pro%20Plan.%20There%20is%20no%20additional%20charge%20for%20new%20members!/singular: e3dc59a5ba7211cd3d8516b3a79d85ca
+    You%20need%20to%20be%20an%20admin%20to%20manage%20workspace%20permissions./singular: e2e816f2b7a13b1056d79e7f25088664
     You've%20been%20invited%20to%20join%20a%20workspace%20on%20kan.bn./singular: 257b840726f972f384243a72767f880f
     You've%20been%20invited%20to%20join%20a%20workspace./singular: 24fc6cdc8740f37a83df85f582f03293
     Your%20account%20has%20been%20deleted./singular: 8c8d944e07388c5877effdb2c2803dcf
     Your%20boards%20have%20been%20imported./singular: 403972e7a25afc2415762c1c2b1ec868
     Your%20display%20name%20has%20been%20updated./singular: 15e5fff36c554c16ec5214427fae1bf4
+    Your%20file%20has%20been%20uploaded%20successfully./singular: 19d84e934877efc0fef285ff3d6e7849
     Your%20password%20has%20been%20changed./singular: 8f730f68d52b7efa727aa0784282ebcb
     Your%20profile%20image%20has%20been%20updated./singular: 099e1780348cd7bf617721344371a430
     Your%20Trello%20account%20has%20been%20disconnected./singular: 126aeeb73f7e4cad338056e4c933f39b
     Your%20Trello%20account%20is%20connected./singular: 0499d193001fce2fbec445ae034ce512
+    Your%20unsubscribe%20link%20is%20missing%20a%20token.%20Please%20open%20the%20latest%20email%20and%20try%20again./singular: 3e4cce96bc1197a1caa2b7fb4d3c7e53
     Your%20workspace%20description%20has%20been%20updated./singular: 98de6f65c567c6654cc0adce3c9d5656
     Your%20workspace%20has%20been%20deleted./singular: e7a3efcfc7dd18cb3e917acb67498292
     Your%20workspace%20name%20has%20been%20updated./singular: a87ea3b0d71e6dc5dd525d77114a9322
     Your%20workspace%20slug%20has%20been%20updated./singular: c808949b9b2b4a9aba2472f5d1050167
+    YouTube%20URL/singular: 0b48896061a1124501fdaba026804148

apps/web/lingui.config.ts

@@ -1,7 +1,7 @@
 import type { LinguiConfig } from "@lingui/conf";
 
 const config: LinguiConfig = {
-  locales: ["en", "fr", "de", "es", "it", "nl", "ru", "pl"],
+  locales: ["en", "fr", "de", "es", "it", "nl", "ru", "pl","pt-BR"],
   sourceLocale: "en",
   catalogs: [
     {

apps/web/next.config.js

@@ -26,34 +26,68 @@ const config = {
   ],
 
   /** We already do linting and typechecking as separate tasks in CI */
-  eslint: { ignoreDuringBuilds: true },
   typescript: { ignoreBuildErrors: true },
 
+  // temporarily ignore eslint errors during build until we fix all the errors sigh
+  eslint: { ignoreDuringBuilds: true },
+
   images: {
-    remotePatterns: [
-      {
-        protocol: "https",
-        hostname:
-          env("S3_FORCE_PATH_STYLE") === "true"
-            ? `${env("NEXT_PUBLIC_STORAGE_DOMAIN")}`
-            : `*.${env("NEXT_PUBLIC_STORAGE_DOMAIN")}`,
-      },
-      {
-        protocol: "http",
-        hostname: "localhost",
-      },
-      {
-        protocol: "https",
-        hostname: "*.googleusercontent.com",
-      },
-    ],
+    remotePatterns: (() => {
+      /** @type {Array<{protocol: "http" | "https", hostname: string}>} */
+      const patterns = [
+        {
+          protocol: "https",
+          hostname:
+            env("S3_FORCE_PATH_STYLE") === "true"
+              ? `${env("NEXT_PUBLIC_STORAGE_DOMAIN")}`
+              : `*.${env("NEXT_PUBLIC_STORAGE_DOMAIN")}`,
+        },
+        {
+          protocol: "http",
+          hostname: "localhost",
+        },
+        {
+          protocol: "https",
+          hostname: "*.googleusercontent.com",
+        },
+        {
+          protocol: 'https',
+          hostname: 'cdn.discordapp.com',
+        },
+      ];
+
+      // Extract root domain from S3_ENDPOINT and add wildcard pattern
+      const s3Endpoint = env("S3_ENDPOINT");
+      if (s3Endpoint) {
+        try {
+          const url = new URL(s3Endpoint);
+          const hostname = url.hostname;
+          const protocol = url.protocol.replace(":", "");
+
+          // Extract root domain (last 2 parts: e.g. cloudflarestorage.com)
+          const parts = hostname.split(".");
+          if (parts.length >= 2) {
+            const rootDomain = parts.slice(-2).join(".");
+            patterns.push({
+              protocol: protocol === "http" ? "http" : "https",
+              hostname: `*.${rootDomain}`,
+            });
+          }
+        } catch {
+          // If S3_ENDPOINT is not a valid URL, ignore it
+        }
+      }
+
+      return patterns;
+    })(),
   },
-  webpack(config) {
-    config.module.rules.push({
-      test: /\.svg$/,
-      use: ["@svgr/webpack"],
-    });
-    return config;
+  turbopack: {
+    rules: {
+      "*.svg": {
+        loaders: ["@svgr/webpack"],
+        as: "*.js",
+      },
+    },
   },
   experimental: {
     // instrumentationHook: true,

apps/web/package.json

@@ -4,12 +4,14 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "pnpm with-env next build",
+    "build": "pnpm with-env next build --turbo",
     "clean": "git clean -xdf .cache .next .turbo node_modules",
-    "dev": "pnpm with-env next dev",
+    "dev": "pnpm with-env next dev --turbo",
     "format": "prettier --check . --ignore-path ../../.gitignore",
     "lint": "eslint",
     "start": "pnpm with-env next start",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
     "with-env": "dotenv -e ../../.env --",
     "lingui:extract": "lingui extract",
@@ -18,6 +20,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.802.0",
+    "@aws-sdk/lib-storage": "^3.802.0",
     "@aws-sdk/s3-request-presigner": "^3.812.0",
     "@headlessui/react": "^2.2.0",
     "@hookform/resolvers": "^3.3.4",
@@ -29,12 +32,14 @@
     "@lingui/conf": "^5.3.2",
     "@lingui/macro": "^5.3.2",
     "@lingui/react": "^5.3.2",
+    "@novu/api": "^3.11.0",
     "@t3-oss/env-nextjs": "^0.11.1",
     "@tailwindcss/typography": "^0.5.16",
     "@tanstack/react-query": "catalog:",
     "@tiptap/extension-link": "^2.22.2",
     "@tiptap/extension-mention": "^3.0.9",
     "@tiptap/extension-placeholder": "^2.14.0",
+    "@tiptap/extension-typography": "^3.18.0",
     "@tiptap/pm": "^2.14.0",
     "@tiptap/react": "^2.14.0",
     "@tiptap/starter-kit": "^2.14.0",
@@ -43,15 +48,14 @@
     "@trpc/next": "^11.0.0-rc.660",
     "@trpc/react-query": "catalog:",
     "@trpc/server": "catalog:",
-    "aws-sdk": "^2.1692.0",
     "date-fns": "^4.1.0",
+    "framer-motion": "^12.26.2",
     "geist": "^1.3.1",
-    "next": "^15.3.4",
-    "next-logger": "^5.0.1",
+    "jose": "^6.1.2",
+    "next": "15.5.9",
     "next-runtime-env": "^1.7.2",
     "next-themes": "^0.4.6",
     "nextjs-cors": "^2.2.0",
-    "pino": "^9.6.0",
     "posthog-js": "^1.254.0",
     "react": "catalog:react18",
     "react-beautiful-dnd": "^13.1.1",
@@ -65,6 +69,7 @@
     "superjson": "2.2.1",
     "tailwind-merge": "^2.5.2",
     "tippy.js": "^6.3.7",
+    "tiptap-markdown": "^0.8",
     "zod": "catalog:"
   },
   "devDependencies": {
@@ -84,10 +89,10 @@
     "dotenv-cli": "^7.4.4",
     "eslint": "catalog:",
     "jiti": "^1.21.6",
-    "pino-pretty": "^13.0.0",
     "prettier": "catalog:",
     "tailwindcss": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "^3.0.0"
   },
   "prettier": "@kan/prettier-config"
 }

apps/web/src/components/AuthForm.tsx

@@ -303,6 +303,10 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
 
   const password = watch("password");
 
+  const isMagicLinkAvailable = useMemo(() => {
+    return isCloudEnv || (isEmailSendingEnabled && !isSignUp);
+  }, [isCloudEnv, isEmailSendingEnabled, isSignUp]);
+
   // Determine if we should operate in magic link mode for current form state (login only)
   const isMagicLinkMode = useMemo(() => {
     // Magic link only viable when email sending enabled AND not sign up.
@@ -357,71 +361,88 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
           })}
         </div>
       )}
-      <form onSubmit={handleSubmit(onSubmit)}>
-        {socialProviders?.length !== 0 && (
-          <div className="mb-[1.5rem] flex w-full items-center gap-4">
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
-            <span className="text-sm text-light-900 dark:text-dark-900">
-              {t`or`}
+      {!(isCredentialsEnabled || isMagicLinkAvailable) &&
+        socialProviders?.length === 0 && (
+          <div className="flex w-full items-center gap-4">
+            <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
+            <span className="text-center text-sm text-light-900 dark:text-dark-900">
+              {t`No authentication methods are currently available`}
             </span>
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
+            <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
           </div>
         )}
-        <div className="space-y-2">
-          {isSignUp && isCredentialsEnabled && (
+      {(isCredentialsEnabled || isMagicLinkAvailable) && (
+        <form onSubmit={handleSubmit(onSubmit)}>
+          {socialProviders?.length !== 0 && (
+            <div className="mb-[1.5rem] flex w-full items-center gap-4">
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
+              <span className="text-sm text-light-900 dark:text-dark-900">
+                {t`or`}
+              </span>
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
+            </div>
+          )}
+          <div className="space-y-2">
+            {isSignUp && isCredentialsEnabled && (
+              <div>
+                <Input
+                  {...register("name", { required: true })}
+                  placeholder={t`Enter your name`}
+                />
+                {errors.name && (
+                  <p className="mt-2 text-xs text-red-400">
+                    {t`Please enter a valid name`}
+                  </p>
+                )}
+              </div>
+            )}
             <div>
               <Input
-                {...register("name", { required: true })}
-                placeholder={t`Enter your name`}
+                {...register("email", { required: true })}
+                placeholder={t`Enter your email address`}
               />
-              {errors.name && (
+              {errors.email && (
                 <p className="mt-2 text-xs text-red-400">
-                  {t`Please enter a valid name`}
+                  {t`Please enter a valid email address`}
                 </p>
               )}
             </div>
-          )}
-          <div>
-            <Input
-              {...register("email", { required: true })}
-              placeholder={t`Enter your email address`}
-            />
-            {errors.email && (
-              <p className="mt-2 text-xs text-red-400">
-                {t`Please enter a valid email address`}
-              </p>
+
+            {isCredentialsEnabled && (
+              <div>
+                <Input
+                  type="password"
+                  {...register("password", { required: true })}
+                  placeholder={t`Enter your password`}
+                />
+                {errors.password && (
+                  <p className="mt-2 text-xs text-red-400">
+                    {errors.password.message ??
+                      t`Please enter a valid password`}
+                  </p>
+                )}
+              </div>
+            )}
+            {loginError && (
+              <p className="mt-2 text-xs text-red-400">{loginError}</p>
             )}
           </div>
-          {isCredentialsEnabled && (
-            <div>
-              <Input
-                type="password"
-                {...register("password", { required: true })}
-                placeholder={t`Enter your password`}
-              />
-              {errors.password && (
-                <p className="mt-2 text-xs text-red-400">
-                  {errors.password.message ?? t`Please enter a valid password`}
-                </p>
-              )}
-            </div>
-          )}
-          {loginError && (
-            <p className="mt-2 text-xs text-red-400">{loginError}</p>
-          )}
-        </div>
-        <div className="mt-[1.5rem] flex items-center gap-4">
-          <Button
-            isLoading={isLoginWithEmailPending}
-            fullWidth
-            size="lg"
-            variant="secondary"
-          >
-            {isSignUp ? t`Sign up with ` : t`Continue with `}
-            {isMagicLinkMode ? t`magic link` : t`email`}
-          </Button>
-        </div>
-      </form>
+          <div className="mt-[1.5rem] flex items-center gap-4">
+            <Button
+              isLoading={isLoginWithEmailPending}
+              fullWidth
+              size="lg"
+              variant="secondary"
+            >
+              {isSignUp ? t`Sign up with ` : t`Continue with `}
+              {isMagicLinkMode ? t`magic link` : t`email`}
+            </Button>
+          </div>
+        </form>
+      )}
+      {!(isCredentialsEnabled || isMagicLinkAvailable) && loginError && (
+        <p className="mt-2 text-xs text-red-400">{loginError}</p>
+      )}
     </div>
   );
 }

apps/web/src/components/Avatar.tsx

@@ -25,7 +25,7 @@ const Avatar = ({
   icon?: React.ReactNode;
   isLoading?: boolean;
 }) => {
-  const initials = name
+  const initials = name?.trim()
     ? getInitialsFromName(name)
     : inferInitialsFromEmail(email);
 

apps/web/src/components/Button.tsx

@@ -12,6 +12,7 @@ interface ButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
   href?: string;
   fullWidth?: boolean;
   openInNewTab?: boolean;
+  iconOnly?: boolean;
 }
 
 const Button = ({
@@ -24,6 +25,7 @@ const Button = ({
   href,
   fullWidth,
   openInNewTab,
+  iconOnly,
   ...props
 }: ButtonProps) => {
   const classes = twMerge(
@@ -32,6 +34,15 @@ const Button = ({
     size === "sm" && "text-xs",
     size === "lg" && "py-[0.65rem]",
     fullWidth && "w-full",
+    iconOnly && "p-0",
+    iconOnly &&
+      (size === "xs"
+        ? "h-6 w-6"
+        : size === "sm"
+          ? "h-8 w-8"
+          : size === "lg"
+            ? "h-10 w-10"
+            : "h-9 w-9"),
     variant === "primary" &&
       "bg-light-1000 dark:bg-dark-1000 dark:text-dark-50",
     variant === "secondary" &&
@@ -47,19 +58,60 @@ const Button = ({
     <span className="relative flex items-center justify-center">
       {isLoading && (
         <span className="absolute">
-          <LoadingSpinner size={size} />
+          <LoadingSpinner size={size === "xs" ? "sm" : size} />
         </span>
       )}
-      <div
-        className={twMerge(
-          "flex items-center",
-          isLoading ? "invisible" : "visible",
-        )}
-      >
-        {iconLeft && <span className="mr-2">{iconLeft}</span>}
-        {children}
-        {iconRight && <span className="ml-1">{iconRight}</span>}
-      </div>
+      {iconOnly ? (
+        <div
+          className={twMerge(
+            "flex items-center",
+            isLoading ? "invisible" : "visible",
+          )}
+        >
+          {iconLeft ?? iconRight}
+        </div>
+      ) : (
+        <div
+          className={twMerge(
+            fullWidth
+              ? "grid w-full grid-cols-[auto_1fr_auto] items-center gap-x-2"
+              : "flex items-center",
+            isLoading ? "invisible" : "visible",
+          )}
+        >
+          {fullWidth && !iconLeft && iconRight && (
+            <span className="col-start-1 opacity-0">{iconRight}</span>
+          )}
+          {iconLeft && (
+            <span
+              className={twMerge(
+                fullWidth ? "col-start-1 justify-self-start" : "mr-2",
+              )}
+            >
+              {iconLeft}
+            </span>
+          )}
+          <span
+            className={twMerge(
+              fullWidth ? "col-start-2 justify-self-center text-center" : "",
+            )}
+          >
+            {children}
+          </span>
+          {iconRight && (
+            <span
+              className={twMerge(
+                fullWidth ? "col-start-3 justify-self-end" : "ml-1",
+              )}
+            >
+              {iconRight}
+            </span>
+          )}
+          {fullWidth && !iconRight && iconLeft && (
+            <span className="col-start-3 opacity-0">{iconLeft}</span>
+          )}
+        </div>
+      )}
     </span>
   );
 

apps/web/src/components/CheckboxDropdown.tsx

@@ -31,6 +31,7 @@ interface CheckboxDropdownProps {
   handleEdit?: (key: string) => void;
   handleCreate?: () => void;
   asChild?: boolean;
+  disabled?: boolean;
 }
 
 export default function CheckboxDropdown({
@@ -44,6 +45,7 @@ export default function CheckboxDropdown({
   handleEdit,
   handleCreate,
   asChild = true,
+  disabled = false,
 }: CheckboxDropdownProps) {
   const [selectedGroup, setSelectedGroup] = useState<string | null>(null);
 
@@ -58,13 +60,13 @@ export default function CheckboxDropdown({
       {items.length > 0 ? (
         items.map((item) => (
           <Menu.Item key={item.key}>
-            <div
-              className="group flex items-center rounded-[5px] p-2 hover:bg-light-200 dark:hover:bg-dark-300"
-              onClick={(e) => {
-                e.preventDefault();
-                handleSelect(groupKey, { key: item.key, value: item.value });
-              }}
-            >
+              <div
+                className="group flex items-center rounded-[5px] p-2 hover:bg-light-200 dark:hover:bg-dark-300"
+                onClick={(e) => {
+                  e.preventDefault();
+                  handleSelect(groupKey, { key: item.key, value: item.value });
+                }}
+              >
               <input
                 id={item.key}
                 name={item.key}
@@ -132,7 +134,8 @@ export default function CheckboxDropdown({
       <>
         <Menu.Button
           as={asChild ? "div" : undefined}
-          className="h-full w-full cursor-pointer focus-visible:outline-none"
+          disabled={disabled}
+          className="h-full w-full cursor-pointer focus-visible:outline-none disabled:cursor-not-allowed"
         >
           {children}
         </Menu.Button>

apps/web/src/components/Dashboard.tsx

@@ -12,6 +12,7 @@ import { authClient } from "@kan/auth/client";
 import { useClickOutside } from "~/hooks/useClickOutside";
 import { useModal } from "~/providers/modal";
 import { useWorkspace, WorkspaceProvider } from "~/providers/workspace";
+import { api } from "~/utils/api";
 import SideNavigation from "./SideNavigation";
 
 interface DashboardProps {
@@ -44,6 +45,12 @@ export default function Dashboard({
   const { availableWorkspaces, hasLoaded } = useWorkspace();
 
   const { data: session, isPending: sessionLoading } = authClient.useSession();
+  const { data: user, isLoading: userLoading } = api.user.getUser.useQuery(
+    undefined,
+    {
+      enabled: !!session?.user,
+    },
+  );
 
   const [isSideNavOpen, setIsSideNavOpen] = useState(false);
   const [isRightPanelOpen, setIsRightPanelOpen] = useState(false);
@@ -155,8 +162,12 @@ export default function Dashboard({
             className={`fixed top-12 z-40 h-[calc(100dvh-3rem)] w-[calc(100vw-1.5rem)] transform transition-transform duration-300 ease-in-out md:relative md:top-0 md:h-full md:w-auto md:translate-x-0 ${isSideNavOpen ? "translate-x-0" : "-translate-x-full md:translate-x-0"} `}
           >
             <SideNavigation
-              user={{ email: session?.user.email, image: session?.user.image }}
-              isLoading={sessionLoading}
+              user={{
+                displayName: user?.name ?? session?.user.name,
+                email: user?.email ?? session?.user.email ?? "",
+                image: user?.image ?? undefined,
+              }}
+              isLoading={sessionLoading || userLoading}
               onCloseSideNav={closeSideNav}
             />
           </div>

apps/web/src/components/DateSelector.tsx

@@ -0,0 +1,136 @@
+import {
+  addMonths,
+  eachDayOfInterval,
+  endOfMonth,
+  endOfWeek,
+  format,
+  isSameDay,
+  isToday,
+  startOfMonth,
+  startOfWeek,
+  subMonths,
+} from "date-fns";
+import { useMemo, useState } from "react";
+import { HiChevronLeft, HiChevronRight } from "react-icons/hi2";
+import { twMerge } from "tailwind-merge";
+
+interface DateSelectorProps {
+  selectedDate?: Date | null;
+  onDateSelect?: (date: Date | undefined) => void;
+}
+
+const DateSelector = ({ selectedDate, onDateSelect }: DateSelectorProps) => {
+  const [currentMonth, setCurrentMonth] = useState(() => {
+    return selectedDate ? startOfMonth(selectedDate) : startOfMonth(new Date());
+  });
+
+  const monthName = format(currentMonth, "MMMM");
+  const year = format(currentMonth, "yyyy");
+
+  const dayHeaders = useMemo(() => {
+    const weekStart = startOfWeek(new Date(), { weekStartsOn: 1 }); // Monday
+    return eachDayOfInterval({
+      start: weekStart,
+      end: new Date(weekStart.getTime() + 6 * 24 * 60 * 60 * 1000),
+    }).map((date) => format(date, "EEEEEE")); // Shortest localized day name
+  }, []);
+
+  const days = useMemo(() => {
+    const monthStart = startOfMonth(currentMonth);
+    const monthEnd = endOfMonth(currentMonth);
+    const calendarStart = startOfWeek(monthStart, { weekStartsOn: 1 }); // Monday
+    const calendarEnd = endOfWeek(monthEnd, { weekStartsOn: 1 }); // Monday
+
+    return eachDayOfInterval({ start: calendarStart, end: calendarEnd }).map(
+      (date) => {
+        const dateString = format(date, "yyyy-MM-dd");
+        return {
+          date: dateString,
+          isToday: isToday(date),
+          isSelected: selectedDate ? isSameDay(date, selectedDate) : false,
+          isCurrentMonth: date >= monthStart && date <= monthEnd,
+          dateObj: date,
+        };
+      },
+    );
+  }, [currentMonth, selectedDate]);
+
+  const handlePreviousMonth = () => {
+    setCurrentMonth(subMonths(currentMonth, 1));
+  };
+
+  const handleNextMonth = () => {
+    setCurrentMonth(addMonths(currentMonth, 1));
+  };
+
+  const handleDateClick = (date: Date, e: React.MouseEvent) => {
+    e.stopPropagation();
+    // If clicking the same date that's already selected, unselect it
+    if (selectedDate && isSameDay(date, selectedDate)) {
+      onDateSelect?.(undefined);
+    } else {
+      onDateSelect?.(date);
+    }
+  };
+
+  return (
+    <div className="w-[250px] p-4">
+      <div className="flex items-center text-light-1000 dark:text-dark-1000">
+        <button
+          type="button"
+          onClick={handlePreviousMonth}
+          className="flex flex-none items-center justify-center p-1.5 text-light-700 hover:text-light-900 dark:text-dark-700 dark:hover:text-dark-1000"
+        >
+          <span className="sr-only">Previous month</span>
+          <HiChevronLeft aria-hidden="true" className="h-4 w-4" />
+        </button>
+        <div className="flex-1 text-center text-sm font-semibold">
+          {monthName} {year}
+        </div>
+        <button
+          type="button"
+          onClick={handleNextMonth}
+          className="flex flex-none items-center justify-center p-1.5 text-light-700 hover:text-light-900 dark:text-dark-700 dark:hover:text-dark-1000"
+        >
+          <span className="sr-only">Next month</span>
+          <HiChevronRight aria-hidden="true" className="h-4 w-4" />
+        </button>
+      </div>
+      <div className="mt-6 grid grid-cols-7 text-center text-xs/6 text-light-950 dark:text-dark-950">
+        {dayHeaders.map((day, index) => (
+          <div key={index}>{day}</div>
+        ))}
+      </div>
+      <div className="isolate mt-2 grid grid-cols-7 text-sm">
+        {days.map((day) => (
+          <button
+            key={day.date}
+            type="button"
+            onClick={(e) => handleDateClick(day.dateObj, e)}
+            className={twMerge(
+              "flex aspect-square items-center justify-center rounded-lg focus:z-10",
+              day.isSelected
+                ? "bg-light-1000 hover:bg-light-1000 dark:bg-dark-1000 dark:hover:bg-dark-1000"
+                : "bg-transparent hover:bg-light-200 dark:bg-transparent dark:hover:bg-dark-200",
+            )}
+          >
+            <time
+              dateTime={day.date}
+              className={twMerge(
+                "mx-auto flex size-7 items-center justify-center rounded-full text-light-900 dark:text-dark-900",
+                day.isCurrentMonth
+                  ? "text-light-900 dark:text-dark-900"
+                  : "text-light-700 dark:text-dark-600",
+                day.isSelected && "text-light-50 dark:text-dark-50",
+              )}
+            >
+              {day.date.split("-").pop()?.replace(/^0/, "")}
+            </time>
+          </button>
+        ))}
+      </div>
+    </div>
+  );
+};
+
+export default DateSelector;

apps/web/src/components/Dropdown.tsx

@@ -6,7 +6,7 @@ export default function Dropdown({
   children,
   disabled,
 }: {
-  items: { label: string; action: () => void; icon?: React.ReactNode }[];
+  items: { label: string; action?: () => void; icon?: React.ReactNode; disabled?: boolean }[];
   children: React.ReactNode;
   disabled?: boolean;
 }) {
@@ -30,13 +30,14 @@ export default function Dropdown({
         leaveFrom="transform opacity-100 scale-100"
         leaveTo="transform opacity-0 scale-95"
       >
-        <Menu.Items className="absolute right-0 z-50 mt-2 w-56 origin-top-right rounded-md border border-light-200 bg-light-50 p-1 shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none dark:border-dark-400 dark:bg-dark-300">
+        <Menu.Items className="absolute right-0 z-[100] isolate mt-2 w-56 origin-top-right rounded-md border border-light-200 bg-white p-1 shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none dark:border-dark-400 dark:bg-dark-300">
           <div className="flex flex-col">
             {items.map((item) => (
-              <Menu.Item key={item.label}>
+              <Menu.Item key={item.label} disabled={item.disabled}>
                 <button
                   onClick={item.action}
-                  className="flex w-auto items-center gap-2 rounded-[5px] px-2.5 py-1.5 text-left text-sm text-neutral-900 hover:bg-light-200 dark:text-dark-950 dark:hover:bg-dark-400"
+                  disabled={item.disabled ?? !item.action}
+                  className="flex w-auto items-center gap-2 rounded-[5px] px-2.5 py-1.5 text-left text-sm text-neutral-900 hover:bg-light-200 disabled:cursor-not-allowed disabled:opacity-60 dark:text-dark-950 dark:hover:bg-dark-400"
                 >
                   {item.icon}
                   {item.label}

apps/web/src/components/Editor.tsx

@@ -1,3 +1,4 @@
+import type { Range as TiptapRange } from "@tiptap/core";
 import type { Editor as TiptapEditor } from "@tiptap/react";
 import type {
   SuggestionKeyDownProps,
@@ -7,6 +8,7 @@ import type { Instance as TippyInstance } from "tippy.js";
 import { Button } from "@headlessui/react";
 import { t } from "@lingui/core/macro";
 import Link from "@tiptap/extension-link";
+import Mention from "@tiptap/extension-mention";
 import Placeholder from "@tiptap/extension-placeholder";
 import {
   BubbleMenu,
@@ -15,6 +17,7 @@ import {
   ReactRenderer,
   useEditor,
 } from "@tiptap/react";
+import Typography from "@tiptap/extension-typography";
 import StarterKit from "@tiptap/starter-kit";
 import Suggestion from "@tiptap/suggestion";
 import {
@@ -39,9 +42,11 @@ import {
 } from "react-icons/hi2";
 import { twMerge } from "tailwind-merge";
 import tippy from "tippy.js";
-import Mention from "@tiptap/extension-mention";
-import Avatar from "./Avatar";
+import { Markdown } from "tiptap-markdown";
+
 import { getAvatarUrl } from "~/utils/helpers";
+import Avatar from "./Avatar";
+import { YouTubeNode } from "./YouTubeEmbed/YouTubeNode";
 
 declare module "@tiptap/core" {
   interface Commands<ReturnType> {
@@ -54,7 +59,7 @@ declare module "@tiptap/core" {
 export interface SlashCommandItem {
   title: string;
   icon?: React.ReactNode;
-  command?: (props: { editor: TiptapEditor; range: Range }) => void;
+  command?: (props: { editor: TiptapEditor; range: TiptapRange }) => void;
   disabled?: boolean;
 }
 
@@ -77,7 +82,7 @@ export interface RenderSuggestionsProps {
   command: (item: SlashCommandItem) => void;
 }
 
-export type WorkspaceMember = {
+export interface WorkspaceMember {
   publicId: string;
   user: {
     id: string;
@@ -85,7 +90,7 @@ export type WorkspaceMember = {
     image: string | null;
   } | null;
   email: string;
-};
+}
 
 const CommandsList = forwardRef<
   { onKeyDown: (props: SuggestionKeyDownProps) => boolean },
@@ -200,7 +205,11 @@ const RenderSuggestions = () => {
   };
 };
 
-type MentionItem = { id: string; label: string; image: string | null };
+interface MentionItem {
+  id: string;
+  label: string;
+  image: string | null;
+}
 
 const MentionList = forwardRef<
   { onKeyDown: (props: SuggestionKeyDownProps) => boolean },
@@ -238,30 +247,32 @@ const MentionList = forwardRef<
   return (
     <div className="w-56 rounded-md border-[1px] border-light-200 bg-light-50 shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none dark:border-dark-500 dark:bg-dark-200">
       <div className="max-h-[350px] overflow-y-auto p-1 scrollbar-thin scrollbar-thumb-light-200 dark:scrollbar-thumb-dark-300">
-        {items.length > 0 ? items.map((item, index) => (
-          <button
-            key={item.id}
-            onClick={() => command(item)}
-            className={twMerge(
-              "group flex w-full items-center rounded-[5px] p-2 hover:bg-light-200 dark:hover:bg-dark-300",
-              index === selectedIndex && "bg-light-200 dark:bg-dark-300",
-            )}
-          >
-            <Avatar
-              size="xs"
-              name={item.label}
-              imageUrl={
-                item.image ? getAvatarUrl(item.image) : undefined
-              }
-              email={item.label}
-            />
-            <span className="ml-3 text-[12px] font-medium text-dark-900 dark:text-dark-1000">
-              {item.label}
-            </span>
-          </button>
-        )) : (
+        {items.length > 0 ? (
+          items.map((item, index) => (
+            <button
+              key={item.id}
+              onClick={() => command(item)}
+              className={twMerge(
+                "group flex w-full items-center rounded-[5px] p-2 hover:bg-light-200 dark:hover:bg-dark-300",
+                index === selectedIndex && "bg-light-200 dark:bg-dark-300",
+              )}
+            >
+              <Avatar
+                size="xs"
+                name={item.label}
+                imageUrl={item.image ? getAvatarUrl(item.image) : undefined}
+                email={item.label}
+              />
+              <span className="ml-3 text-[12px] font-medium text-dark-900 dark:text-dark-1000">
+                {item.label}
+              </span>
+            </button>
+          ))
+        ) : (
           <div className="flex items-center justify-start p-2">
-            <span className="text-dark-900 text-[12px] dark:text-dark-1000">No results</span>
+            <span className="text-[12px] text-dark-900 dark:text-dark-1000">
+              No results
+            </span>
           </div>
         )}
       </div>
@@ -423,12 +434,14 @@ export default function Editor({
   onBlur,
   readOnly = false,
   workspaceMembers,
+  enableYouTubeEmbed = true,
 }: {
   content: string | null;
   onChange?: (value: string) => void;
   onBlur?: () => void;
   readOnly?: boolean;
   workspaceMembers: WorkspaceMember[];
+  enableYouTubeEmbed?: boolean;
 }) {
   const containerRef = useRef<HTMLDivElement>(null);
 
@@ -436,6 +449,7 @@ export default function Editor({
     {
       extensions: [
         StarterKit,
+        Markdown,
         Placeholder.configure({
           placeholder: readOnly
             ? ""
@@ -462,36 +476,57 @@ export default function Editor({
         }),
         Mention.configure({
           HTMLAttributes: {
-            class: 'mention',
+            class: "mention",
           },
           suggestion: {
             char: "@",
             items: ({ query }: { query: string }) => {
-              const all: MentionItem[] = workspaceMembers.map((member: WorkspaceMember) => ({
-                id: member.publicId,
-                label: member?.user?.name ?? member.email,
-                image: member?.user?.image ?? null,
-              }));
+              const all: MentionItem[] = workspaceMembers.map(
+                (member: WorkspaceMember) => ({
+                  id: member.publicId,
+                  label: member?.user?.name ?? member.email,
+                  image: member?.user?.image ?? null,
+                }),
+              );
               const q = query.toLowerCase();
-              return all.filter((u) => u.label.toLowerCase().includes(q));
+              return all.filter(
+                (u) =>
+                  u.label &&
+                  typeof u.label === "string" &&
+                  u.label.toLowerCase().includes(q),
+              );
             },
-            command: ({ editor, range, props }: any) => {
-               const mentionHTML = `<span data-type="mention" data-id="${props.id}" data-label="${props.label}">@${props.label}</span>&nbsp;`;
-               
-               editor
-               .chain()
-               .focus()
-               .deleteRange(range)
-               .insertContent(mentionHTML)
-               .focus()
-               .run();
-              },
-              render: renderMentionSuggestions,
-            },
-            renderText({ options, node }) {
-              return `${options.suggestion.char}${node.attrs.label ?? node.attrs.id}`;
+            command: ({ editor, range, props }) => {
+              const id = props.id ?? "";
+              const label = props.label ?? "";
+              const mentionHTML = `<span data-type="mention" data-id="${id}" data-label="${label}">@${label}</span>&nbsp;`;
+
+              editor
+                .chain()
+                .focus()
+                .deleteRange(range)
+                .insertContent(mentionHTML)
+                .focus()
+                .run();
             },
+            render: renderMentionSuggestions,
+          },
+          renderText({ options, node }) {
+            return `${options.suggestion.char}${node.attrs.label ?? node.attrs.id}`;
+          },
         }),
+        Typography.configure({
+            openDoubleQuote: false,
+            closeDoubleQuote: false,
+            openSingleQuote: false,
+            closeSingleQuote: false,
+            oneHalf: false,
+            oneQuarter: false,
+            threeQuarters: false,
+            superscriptTwo: false,
+            superscriptThree: false,
+        }),
+        ...(enableYouTubeEmbed ? [YouTubeNode] : []),
       ],
       content,
       onUpdate: ({ editor }) => onChange?.(editor.getHTML()),
@@ -548,6 +583,9 @@ export default function Editor({
           text-decoration: none;
           font-weight: 500;
         }
+        .tiptap [data-youtube] {
+          margin: 1rem 0;
+        }
       `}</style>
       {!readOnly && editor && <EditorBubbleMenu editor={editor} />}
       <EditorContent

apps/web/src/components/NewWorkspaceForm.tsx

@@ -24,7 +24,10 @@ import { api } from "~/utils/api";
 import LoadingSpinner from "./LoadingSpinner";
 
 const schema = z.object({
-  name: z.string().min(1, { message: t`Workspace name is required` }),
+  name: z
+    .string()
+    .min(1, { message: t`Workspace name is required` })
+    .max(64, { message: t`Workspace name cannot exceed 64 characters` }),
   slug: z
     .string()
     .min(3, {

apps/web/src/components/Popup.tsx

@@ -25,7 +25,7 @@ const Popup: React.FC = () => {
   return (
     <div
       aria-live="assertive"
-      className="pointer-events-none fixed inset-0 z-10 flex items-end p-3 sm:items-end"
+      className="pointer-events-none fixed inset-0 z-10 flex items-end p-3 sm:items-end m-3"
     >
       <div className="flex w-full flex-col items-center space-y-4 sm:items-end">
         <Transition
@@ -37,43 +37,43 @@ const Popup: React.FC = () => {
           leaveFrom="opacity-100 translate-y-0 sm:scale-100"
           leaveTo="opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95"
         >
-          <div className="pointer-events-auto w-full max-w-sm overflow-hidden rounded-lg border border-light-400 bg-light-50 shadow-lg ring-1 ring-black ring-opacity-5 transition data-[closed]:data-[enter]:translate-y-2 data-[enter]:transform data-[closed]:opacity-0 data-[enter]:duration-300 data-[leave]:duration-100 data-[enter]:ease-out data-[leave]:ease-in dark:border-dark-300 dark:bg-dark-200 data-[closed]:data-[enter]:sm:translate-x-2 data-[closed]:data-[enter]:sm:translate-y-0">
-            <div className="p-4">
+          <div className="pointer-events-auto w-full max-w-[350px] overflow-hidden rounded-xl border border-light-400 bg-light-50 shadow-lg ring-opacity-5 transition data-[closed]:data-[enter]:translate-y-2 data-[enter]:transform data-[closed]:opacity-0 data-[enter]:duration-300 data-[leave]:duration-100 data-[enter]:ease-out data-[leave]:ease-in dark:border-dark-300 dark:bg-dark-100 data-[closed]:data-[enter]:sm:translate-x-2 data-[closed]:data-[enter]:sm:translate-y-0">
+            <div className="p-4 relative">
               <div className="flex items-start">
-                <div className="flex-shrink-0">
+                <div className="flex-shrink-0 mt-1">
                   {popupIcon === "success" && (
                     <HiOutlineCheckCircle
                       aria-hidden="true"
-                      className="h-6 w-6 text-green-400"
+                      className="h-5 w-5 text-green-400"
                     />
                   )}
                   {popupIcon === "error" && (
                     <HiOutlineExclamationCircle
                       aria-hidden="true"
-                      className="h-6 w-6 text-red-400"
+                      className="h-5 w-5 text-red-400"
                     />
                   )}
                 </div>
                 <div className="ml-3 w-0 flex-1 pt-0.5">
-                  <p className="text-sm font-medium text-neutral-900 dark:text-dark-1000">
+                  <p className="text-[12px] font-bold text-neutral-900 dark:text-dark-950">
                     {popupHeader}
                   </p>
-                  <p className="mt-1 text-sm text-neutral-500 dark:text-dark-900">
+                  <p className="mt-1 text-[12px] text-neutral-500 dark:text-dark-900">
                     {popupMessage}
                   </p>
                 </div>
-                <div className="ml-4 flex flex-shrink-0">
+                <div className="ml-4 flex flex-shrink-0 absolute right-3 top-3">
                   <button
                     type="button"
                     onClick={() => {
                       hidePopup();
                     }}
-                    className="mx-1 inline-flex h-fit items-center rounded-md p-1 px-1 text-sm font-semibold text-dark-50 hover:bg-light-100 dark:hover:bg-dark-400"
+                    className="inline-flex h-fit items-center rounded-md p-1 px-1 text-sm font-semibold text-dark-50 hover:bg-light-100 dark:hover:bg-dark-200"
                   >
                     <span className="sr-only">Close</span>
                     <HiXMark
                       aria-hidden="true"
-                      className="h-5 w-5 text-dark-900"
+                      className="h-4 w-4 text-dark-900"
                     />
                   </button>
                 </div>

apps/web/src/components/ReactiveButton.tsx

@@ -2,8 +2,10 @@ import Link from "next/link";
 import { useState } from "react";
 import { twMerge } from "tailwind-merge";
 
+import type { KeyboardShortcut } from "~/providers/keyboard-shortcuts";
 import LottieIcon from "~/components/LottieIcon";
 import { useIsMobile } from "~/hooks/useMediaQuery";
+import { useKeyboardShortcut } from "~/providers/keyboard-shortcuts";
 
 const Button: React.FC<{
   href: string;
@@ -12,10 +14,20 @@ const Button: React.FC<{
   json: object;
   isCollapsed?: boolean;
   onCloseSideNav?: () => void;
-}> = ({ href, current, name, json, isCollapsed = false, onCloseSideNav }) => {
+  keyboardShortcut: KeyboardShortcut;
+}> = ({
+  href,
+  current,
+  name,
+  json,
+  isCollapsed = false,
+  keyboardShortcut,
+  onCloseSideNav,
+}) => {
   const [isHovered, setIsHovered] = useState(false);
   const [index, setIndex] = useState(0);
   const isMobile = useIsMobile();
+  const { keys: shortcutKeys } = useKeyboardShortcut(keyboardShortcut);
 
   const handleMouseEnter = () => {
     setIsHovered(true);
@@ -35,17 +47,27 @@ const Button: React.FC<{
       onClick={handleClick}
       className={twMerge(
         "group flex h-[34px] items-center rounded-md p-1.5 text-sm font-normal leading-6 hover:bg-light-200 hover:text-light-1000 dark:hover:bg-dark-200 dark:hover:text-dark-1000",
+        isCollapsed ? "md:justify-center" : "justify-between",
         current
           ? "bg-light-200 text-light-1000 dark:bg-dark-200 dark:text-dark-1000"
           : "text-neutral-600 dark:bg-dark-100 dark:text-dark-900",
-        isCollapsed
-          ? "justify-start gap-x-3 md:justify-center md:gap-x-0"
-          : "gap-x-3",
       )}
       title={isCollapsed ? name : undefined}
     >
-      <LottieIcon index={index} json={json} isPlaying={isHovered} />
-      <span className={twMerge(isCollapsed && "md:hidden")}>{name}</span>
+      <div
+        className={twMerge(
+          "flex items-center",
+          isCollapsed
+            ? "justify-start gap-x-3 md:justify-center md:gap-x-0"
+            : "gap-x-3",
+        )}
+      >
+        <LottieIcon index={index} json={json} isPlaying={isHovered} />
+        <span className={twMerge(isCollapsed && "md:hidden")}>{name}</span>
+      </div>
+      {!isCollapsed && (
+        <div className="hidden md:group-hover:inline-flex">{shortcutKeys}</div>
+      )}
     </Link>
   );
 };

apps/web/src/components/SettingsLayout.tsx

@@ -14,8 +14,11 @@ import {
   HiOutlineBanknotes,
   HiOutlineCodeBracketSquare,
   HiOutlineRectangleGroup,
+  HiOutlineShieldCheck,
   HiOutlineUser,
 } from "react-icons/hi2";
+import { usePermissions } from "~/hooks/usePermissions";
+import { useWorkspace } from "~/providers/workspace";
 
 interface SettingsLayoutProps {
   children: React.ReactNode;
@@ -24,8 +27,12 @@ interface SettingsLayoutProps {
 
 export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
   const router = useRouter();
+  const { workspace } = useWorkspace();
+  const { canViewWorkspace, canEditWorkspace } = usePermissions();
   const [selectedTabIndex, setSelectedTabIndex] = useState(0);
 
+  const isAdmin = workspace.role === "admin";
+
   const settingsTabs = [
     {
       key: "account",
@@ -37,13 +44,19 @@ export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
       key: "workspace",
       icon: <HiOutlineRectangleGroup />,
       label: t`Workspace`,
-      condition: true,
+      condition: canViewWorkspace,
+    },
+    {
+      key: "permissions",
+      icon: <HiOutlineShieldCheck />,
+      label: t`Permissions`,
+      condition: isAdmin,
     },
     {
       key: "billing",
       label: t`Billing`,
       icon: <HiOutlineBanknotes />,
-      condition: env("NEXT_PUBLIC_KAN_ENV") === "cloud",
+      condition: env("NEXT_PUBLIC_KAN_ENV") === "cloud" && isAdmin,
     },
     {
       key: "api",
@@ -55,7 +68,7 @@ export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
       key: "integrations",
       icon: <HiOutlineCodeBracketSquare />,
       label: t`Integrations`,
-      condition: true,
+      condition: canEditWorkspace,
     },
   ];
 
@@ -97,7 +110,7 @@ export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
               >
                 <div className="relative mb-4">
                   <ListboxButton className="w-full appearance-none rounded-lg border-0 bg-light-50 py-2 pl-3 pr-10 text-left text-sm text-light-1000 shadow-sm ring-1 ring-inset ring-light-300 focus:ring-2 focus:ring-inset focus:ring-light-400 dark:bg-dark-50 dark:text-dark-1000 dark:ring-dark-300 dark:focus:ring-dark-500">
-                    {availableTabs[selectedTabIndex]?.label || "Select a tab"}
+                    {availableTabs[selectedTabIndex]?.label ?? "Select a tab"}
                     <HiChevronDown
                       aria-hidden="true"
                       className="pointer-events-none absolute right-3 top-1/2 h-4 w-4 -translate-y-1/2 text-light-900 dark:text-dark-900"

apps/web/src/components/SideNavigation.tsx

@@ -2,14 +2,20 @@ import Link from "next/link";
 import { useRouter } from "next/router";
 import { Button } from "@headlessui/react";
 import { t } from "@lingui/core/macro";
+import { env } from "next-runtime-env";
 import { useTheme } from "next-themes";
 import { useEffect, useState } from "react";
+import { HiBolt } from "react-icons/hi2";
 import {
   TbLayoutSidebarLeftCollapse,
   TbLayoutSidebarLeftExpand,
 } from "react-icons/tb";
 import { twMerge } from "tailwind-merge";
 
+import type { Subscription } from "@kan/shared/utils";
+import { hasActiveSubscription } from "@kan/shared/utils";
+
+import type { KeyboardShortcut } from "~/providers/keyboard-shortcuts";
 import boardsIconDark from "~/assets/boards-dark.json";
 import boardsIconLight from "~/assets/boards-light.json";
 import membersIconDark from "~/assets/members-dark.json";
@@ -18,9 +24,13 @@ import settingsIconDark from "~/assets/settings-dark.json";
 import settingsIconLight from "~/assets/settings-light.json";
 import templatesIconDark from "~/assets/templates-dark.json";
 import templatesIconLight from "~/assets/templates-light.json";
+import ButtonComponent from "~/components/Button";
 import ReactiveButton from "~/components/ReactiveButton";
 import UserMenu from "~/components/UserMenu";
 import WorkspaceMenu from "~/components/WorkspaceMenu";
+import { useModal } from "~/providers/modal";
+import { useWorkspace } from "~/providers/workspace";
+import { api } from "~/utils/api";
 
 interface SideNavigationProps {
   user: UserType;
@@ -29,6 +39,7 @@ interface SideNavigationProps {
 }
 
 interface UserType {
+  displayName?: string | null | undefined;
   email?: string | null | undefined;
   image?: string | null | undefined;
 }
@@ -39,13 +50,24 @@ export default function SideNavigation({
   onCloseSideNav,
 }: SideNavigationProps) {
   const router = useRouter();
+  const { workspace } = useWorkspace();
   const [isCollapsed, setIsCollapsed] = useState(false);
   const [isInitialised, setIsInitialised] = useState(false);
+  const { openModal } = useModal();
+
+  const { data: workspaceData } = api.workspace.byId.useQuery(
+    { workspacePublicId: workspace.publicId },
+    { enabled: !!workspace.publicId && workspace.publicId.length >= 12 },
+  );
+
+  const subscriptions = workspaceData?.subscriptions as
+    | Subscription[]
+    | undefined;
 
   useEffect(() => {
     const savedState = localStorage.getItem("kan_sidebar-collapsed");
     if (savedState !== null) {
-      setIsCollapsed(JSON.parse(savedState));
+      setIsCollapsed(Boolean(JSON.parse(savedState)));
     }
     setIsInitialised(true);
   }, []);
@@ -61,30 +83,65 @@ export default function SideNavigation({
 
   const { pathname } = router;
 
-  const { theme, resolvedTheme } = useTheme();
+  const { resolvedTheme } = useTheme();
+
+  const isCloudEnv = env("NEXT_PUBLIC_KAN_ENV") === "cloud";
 
   const isDarkMode = resolvedTheme === "dark";
 
-  const navigation = [
+  const navigation: {
+    name: string;
+    href: string;
+    icon: object;
+    keyboardShortcut: KeyboardShortcut;
+  }[] = [
     {
       name: t`Boards`,
       href: "/boards",
       icon: isDarkMode ? boardsIconDark : boardsIconLight,
+      keyboardShortcut: {
+        type: "SEQUENCE",
+        strokes: [{ key: "G" }, { key: "B" }],
+        action: () => router.push("/boards"),
+        group: "NAVIGATION",
+        description: t`Go to boards`,
+      },
     },
     {
       name: t`Templates`,
       href: "/templates",
       icon: isDarkMode ? templatesIconDark : templatesIconLight,
+      keyboardShortcut: {
+        type: "SEQUENCE",
+        strokes: [{ key: "G" }, { key: "T" }],
+        action: () => router.push("/templates"),
+        group: "NAVIGATION",
+        description: t`Go to templates`,
+      },
     },
     {
       name: t`Members`,
       href: "/members",
       icon: isDarkMode ? membersIconDark : membersIconLight,
+      keyboardShortcut: {
+        type: "SEQUENCE",
+        strokes: [{ key: "G" }, { key: "M" }],
+        action: () => router.push("/members"),
+        group: "NAVIGATION",
+        description: t`Go to members`,
+      },
     },
     {
       name: t`Settings`,
       href: "/settings",
       icon: isDarkMode ? settingsIconDark : settingsIconLight,
+      keyboardShortcut: {
+        type: "SEQUENCE",
+        strokes: [{ key: "G" }, { key: "S" }],
+        action: () => router.push("/settings"),
+        group: "NAVIGATION",
+        description: t`Go to settings`,
+      },
     },
   ];
 
@@ -101,10 +158,10 @@ export default function SideNavigation({
         )}
       >
         <div>
-          <div className="hidden h-14 items-center justify-between pb-[18px] pt-1.5 md:flex">
+          <div className="hidden h-[45px] items-center justify-between pb-3 md:flex">
             {!isCollapsed && (
               <Link href="/" className="block">
-                <h1 className="pl-2 text-lg font-bold tracking-tight text-neutral-900 dark:text-dark-1000">
+                <h1 className="pl-2 text-[16px] font-bold tracking-tight text-neutral-900 dark:text-dark-1000">
                   kan.bn
                 </h1>
               </Link>
@@ -142,20 +199,49 @@ export default function SideNavigation({
                   json={item.icon}
                   isCollapsed={isCollapsed}
                   onCloseSideNav={onCloseSideNav}
+                  keyboardShortcut={item.keyboardShortcut}
                 />
               </li>
             ))}
           </ul>
         </div>
 
-        <div className="space-y-3">
+        <div className="space-y-2">
           <UserMenu
-            email={user.email ?? ""}
+            displayName={user.displayName ?? undefined}
+            email={user.email ?? "Email not provided?"}
             imageUrl={user.image ?? undefined}
             isLoading={isLoading}
             isCollapsed={isCollapsed}
             onCloseSideNav={onCloseSideNav}
           />
+          {isCloudEnv &&
+            !hasActiveSubscription(subscriptions, "pro") &&
+            !hasActiveSubscription(subscriptions, "team") && (
+              <div className={twMerge(isCollapsed && "flex justify-center")}>
+                {isCollapsed ? (
+                  <ButtonComponent
+                    iconLeft={<HiBolt />}
+                    variant="secondary"
+                    href="/settings/workspace?upgrade=pro"
+                    aria-label="Upgrade to Pro"
+                    title="Upgrade to Pro"
+                    iconOnly
+                    onClick={() => openModal("UPGRADE_TO_PRO")}
+                  />
+                ) : (
+                  <ButtonComponent
+                    iconLeft={<HiBolt />}
+                    fullWidth
+                    variant="secondary"
+                    href="/settings/workspace?upgrade=pro"
+                    onClick={() => openModal("UPGRADE_TO_PRO")}
+                  >
+                    {t`Upgrade to Pro`}
+                  </ButtonComponent>
+                )}
+              </div>
+            )}
         </div>
       </nav>
     </>

apps/web/src/components/Toggle.tsx

@@ -6,16 +6,20 @@ const Toggle = ({
   onChange,
   label,
   disabled,
+  showLabel = true,
 }: {
   isChecked: boolean;
   onChange: () => void;
   label: string;
   disabled?: boolean;
+  showLabel?: boolean;
 }) => (
   <div className="mr-4 flex items-center justify-end">
-    <span className="mr-2 text-xs text-light-900 dark:text-dark-900">
-      {label}
-    </span>
+    {showLabel && (
+      <span className="mr-2 text-xs text-light-900 dark:text-dark-900">
+        {label}
+      </span>
+    )}
     <Switch
       checked={isChecked}
       onChange={onChange}

apps/web/src/components/Tooltip.tsx

@@ -0,0 +1,54 @@
+import type { ReactNode } from "react";
+import type { Root } from "react-dom/client";
+import type { Placement } from "tippy.js";
+import { useEffect, useRef } from "react";
+import { createRoot } from "react-dom/client";
+import tippy from "tippy.js";
+
+interface TooltipProps {
+  children: ReactNode;
+  content?: ReactNode;
+  placement?: Placement;
+  delay?: number | [number, number];
+}
+
+export function Tooltip({
+  children,
+  content,
+  placement = "bottom",
+  delay = [500, 0],
+}: TooltipProps) {
+  const triggerRef = useRef<HTMLDivElement>(null);
+  const rootRef = useRef<Root | null>(null);
+
+  useEffect(() => {
+    if (!triggerRef.current) return;
+
+    if (!content) return;
+
+    const container = document.createElement("div");
+    const root = createRoot(container);
+    rootRef.current = root;
+    root.render(content);
+
+    const instance = tippy(triggerRef.current, {
+      content: container,
+      placement,
+      delay,
+      interactive: false,
+      theme: "tooltip",
+      touch: false,
+    });
+
+    return () => {
+      instance.destroy();
+      rootRef.current?.unmount();
+    };
+  }, [content, placement, delay]);
+
+  return (
+    <div ref={triggerRef} className="inline-flex">
+      {children}
+    </div>
+  );
+}

apps/web/src/components/UserMenu.tsx

@@ -9,12 +9,15 @@ import { twMerge } from "tailwind-merge";
 
 import { authClient } from "@kan/auth/client";
 
+import { env } from "~/env";
 import { useIsMobile } from "~/hooks/useMediaQuery";
+import { useKeyboardShortcuts } from "~/providers/keyboard-shortcuts";
 import { useModal } from "~/providers/modal";
 import { getAvatarUrl } from "~/utils/helpers";
 
 interface UserMenuProps {
   imageUrl: string | undefined;
+  displayName: string | undefined;
   email: string;
   isLoading: boolean;
   isCollapsed?: boolean;
@@ -24,6 +27,7 @@ interface UserMenuProps {
 export default function UserMenu({
   imageUrl,
   email,
+  displayName,
   isLoading,
   isCollapsed = false,
   onCloseSideNav,
@@ -31,6 +35,7 @@ export default function UserMenu({
   const router = useRouter();
   const { theme, setTheme } = useTheme();
   const { openModal } = useModal();
+  const { openLegend } = useKeyboardShortcuts();
   const isMobile = useIsMobile();
 
   const handleLogout = async () => {
@@ -72,7 +77,7 @@ export default function UserMenu({
         ) : (
           <Menu.Button
             className="flex w-full items-center rounded-md p-1.5 text-neutral-900 hover:bg-light-200 dark:text-dark-900 dark:hover:bg-dark-200 dark:hover:text-dark-1000"
-            title={isCollapsed ? email : undefined}
+            title={isCollapsed ? (displayName || email) : undefined}
           >
             {avatarUrl ? (
               <Image
@@ -99,7 +104,7 @@ export default function UserMenu({
                 isCollapsed && "md:hidden",
               )}
             >
-              {email}
+              {displayName || email}
             </span>
           </Menu.Button>
         )}
@@ -169,6 +174,19 @@ export default function UserMenu({
               </Menu.Item>
             </div>
             <div className="light-border-600 border-t-[1px] p-1 dark:border-dark-600">
+              <Menu.Item>
+                <button
+                  onClick={() => {
+                    if (onCloseSideNav && isMobile) {
+                      onCloseSideNav();
+                    }
+                    openLegend();
+                  }}
+                  className="flex w-full items-center rounded-[5px] px-3 py-2 text-left text-xs hover:bg-light-200 dark:hover:bg-dark-400"
+                >
+                  {t`Shortcuts`}
+                </button>
+              </Menu.Item>
               <Menu.Item>
                 <Link
                   href="mailto:support@kan.bn"
@@ -210,6 +228,25 @@ export default function UserMenu({
                 </button>
               </Menu.Item>
             </div>
+            {env.NEXT_PUBLIC_APP_VERSION && (
+              <div className="light-border-600 border-t-[1px] p-1 dark:border-dark-600">
+                <Menu.Item>
+                  <Link
+                    href={
+                      env.NEXT_PUBLIC_APP_VERSION.includes("+")
+                        ? `https://github.com/kanbn/kan/commit/${env.NEXT_PUBLIC_APP_VERSION.split("+")[1]}`
+                        : `https://github.com/kanbn/kan/releases/tag/v${env.NEXT_PUBLIC_APP_VERSION}`
+                    }
+                    target="_blank"
+                    rel="noreferrer"
+                    onClick={handleLinkClick}
+                    className="flex w-full items-center justify-center rounded-[5px] px-3 py-2 text-center text-xs text-light-900 hover:bg-light-200 dark:text-dark-900 dark:hover:bg-dark-400"
+                  >
+                    Version: {env.NEXT_PUBLIC_APP_VERSION}
+                  </Link>
+                </Menu.Item>
+              </div>
+            )}
           </div>
         </Menu.Items>
       </Transition>

apps/web/src/components/WorkspaceMenu.tsx

@@ -1,12 +1,14 @@
 import { Button, Menu, Transition } from "@headlessui/react";
 import { t } from "@lingui/core/macro";
-import { Fragment, useEffect, useState } from "react";
+import { Fragment, useState } from "react";
 import { HiCheck, HiMagnifyingGlass } from "react-icons/hi2";
 import { twMerge } from "tailwind-merge";
 
+import { useKeyboardShortcut } from "~/providers/keyboard-shortcuts";
 import { useModal } from "~/providers/modal";
 import { useWorkspace } from "~/providers/workspace";
 import CommandPallette from "./CommandPallette";
+import { Tooltip } from "./Tooltip";
 
 export default function WorkspaceMenu({
   isCollapsed = false,
@@ -18,17 +20,17 @@ export default function WorkspaceMenu({
   const { openModal } = useModal();
   const [isOpen, setIsOpen] = useState(false);
 
-  useEffect(() => {
-    const handleKeyDown = (event: KeyboardEvent) => {
-      if ((event.metaKey || event.ctrlKey) && event.key === "k") {
-        event.preventDefault();
-        setIsOpen(true);
-      }
-    };
-
-    document.addEventListener("keydown", handleKeyDown);
-    return () => document.removeEventListener("keydown", handleKeyDown);
-  }, []);
+  const { tooltipContent: commandPaletteShortcutTooltipContent } =
+    useKeyboardShortcut({
+      type: "PRESS",
+      stroke: {
+        key: "k",
+        modifiers: ["META"],
+      },
+      action: () => setIsOpen(true),
+      description: t`Open command menu`,
+      group: "GENERAL",
+    });
 
   return (
     <>
@@ -48,13 +50,13 @@ export default function WorkspaceMenu({
           ) : (
             <div
               className={twMerge(
-                "flex items-center gap-1",
-                isCollapsed && "md:flex-col-reverse md:items-stretch",
+                "flex items-center justify-start gap-1",
+                isCollapsed && "md:flex-col-reverse md:items-center",
               )}
             >
               <Menu.Button
                 className={twMerge(
-                  "mb-1 flex h-[34px] flex-1 items-center rounded-md p-1.5 hover:bg-light-200 dark:hover:bg-dark-200",
+                  "mb-1 flex h-[34px] min-w-0 flex-1 items-center justify-start rounded-md p-1.5 hover:bg-light-200 dark:hover:bg-dark-200",
                   isCollapsed &&
                     "md:mb-1.5 md:h-9 md:w-9 md:flex-none md:justify-center md:p-0",
                 )}
@@ -67,7 +69,7 @@ export default function WorkspaceMenu({
                 </span>
                 <span
                   className={twMerge(
-                    "ml-2 truncate text-sm font-bold text-neutral-900 dark:text-dark-1000",
+                    "ml-2 min-w-0 flex-1 truncate text-left text-sm font-bold text-neutral-900 dark:text-dark-1000",
                     isCollapsed && "md:hidden",
                   )}
                 >
@@ -84,15 +86,17 @@ export default function WorkspaceMenu({
                   </span>
                 )}
               </Menu.Button>
-              <Button
-                className={twMerge(
-                  "mb-1 h-[34px] w-[34px] flex-shrink-0 rounded-lg bg-light-200 p-2 hover:bg-light-300 focus:outline-none dark:bg-dark-200 dark:hover:bg-dark-300",
-                  isCollapsed && "md:mb-2 md:h-9 md:w-9 md:self-center",
-                )}
-                onClick={() => setIsOpen(true)}
-              >
-                <HiMagnifyingGlass className="h-4 w-4" aria-hidden="true" />
-              </Button>
+              <Tooltip content={commandPaletteShortcutTooltipContent}>
+                <Button
+                  className={twMerge(
+                    "mb-1 h-[34px] w-[34px] flex-shrink-0 rounded-lg bg-light-200 p-2 hover:bg-light-300 focus:outline-none dark:bg-dark-200 dark:hover:bg-dark-300",
+                    isCollapsed && "md:mb-2 md:h-9 md:w-9",
+                  )}
+                  onClick={() => setIsOpen(true)}
+                >
+                  <HiMagnifyingGlass className="h-4 w-4" aria-hidden="true" />
+                </Button>
+              </Tooltip>
             </div>
           )}
         </div>

apps/web/src/components/YouTubeEmbed/EditYouTubeModal.tsx

@@ -0,0 +1,189 @@
+import { t } from "@lingui/core/macro";
+import { useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
+import { HiXMark } from "react-icons/hi2";
+
+import Button from "~/components/Button";
+import Input from "~/components/Input";
+import { useModal } from "~/providers/modal";
+import { fetchYouTubeMetadata, isYouTubeUrl } from "./utils";
+
+interface EditYouTubeFormInput {
+  url: string;
+  title: string;
+}
+
+interface EditYouTubeModalState {
+  url: string;
+  title: string;
+  onSave: (url: string, title: string) => void;
+}
+
+export function EditYouTubeModal() {
+  const { closeModal, getModalState } = useModal();
+  const [isValidating, setIsValidating] = useState(false);
+  const [urlError, setUrlError] = useState<string | null>(null);
+
+  // Get initial values and callback from modal state
+  const modalState = getModalState("EDIT_YOUTUBE") as
+    | EditYouTubeModalState
+    | undefined;
+  const initialUrl = modalState?.url ?? "";
+  const initialTitle = modalState?.title ?? "";
+  const onSave = modalState?.onSave;
+
+  const { register, handleSubmit, watch, reset } =
+    useForm<EditYouTubeFormInput>({
+      defaultValues: {
+        url: initialUrl,
+        title: initialTitle,
+      },
+    });
+
+  // Reset form when modal state changes (when modal opens with new values)
+  useEffect(() => {
+    if (modalState) {
+      reset({
+        url: modalState.url,
+        title: modalState.title,
+      });
+    }
+  }, [modalState, reset]);
+
+  const currentUrl = watch("url");
+
+  const onSubmit = async (values: EditYouTubeFormInput) => {
+    // Validate URL
+    if (!isYouTubeUrl(values.url)) {
+      setUrlError(t`Please enter a valid YouTube URL`);
+      return;
+    }
+
+    setUrlError(null);
+    setIsValidating(true);
+
+    try {
+      // If title is empty and URL changed, fetch new title
+      let finalTitle = values.title;
+      if (!finalTitle.trim() && values.url !== initialUrl) {
+        const metadata = await fetchYouTubeMetadata(values.url);
+        finalTitle = metadata?.title ?? "YouTube Video";
+      } else if (!finalTitle.trim()) {
+        // Keep existing title if no new title provided and URL unchanged
+        finalTitle = initialTitle || "YouTube Video";
+      }
+
+      if (onSave) {
+        onSave(values.url, finalTitle);
+      }
+      closeModal();
+    } catch (error) {
+      console.error(error);
+      setUrlError(t`Failed to fetch video information`);
+    } finally {
+      setIsValidating(false);
+    }
+  };
+
+  // Auto-focus on title input (more useful for editing)
+  useEffect(() => {
+    const titleElement: HTMLElement | null =
+      document.querySelector<HTMLElement>("#youtube-title");
+    if (titleElement) titleElement.focus();
+  }, []);
+
+  // Validate URL on change
+  useEffect(() => {
+    if (currentUrl && !isYouTubeUrl(currentUrl)) {
+      setUrlError(t`Please enter a valid YouTube URL`);
+    } else {
+      setUrlError(null);
+    }
+  }, [currentUrl]);
+
+  return (
+    <form onSubmit={handleSubmit(onSubmit)}>
+      <div className="px-5 pt-5">
+        <div className="flex w-full items-center justify-between pb-4 text-neutral-900 dark:text-dark-1000">
+          <h2 className="text-sm font-medium">{t`Edit YouTube Video`}</h2>
+          <button
+            type="button"
+            className="rounded p-1 hover:bg-light-300 focus:outline-none dark:hover:bg-dark-300"
+            onClick={(e) => {
+              e.preventDefault();
+              closeModal();
+            }}
+          >
+            <HiXMark size={18} className="text-light-900 dark:text-dark-900" />
+          </button>
+        </div>
+
+        <div className="space-y-4">
+          <div>
+            <label
+              htmlFor="youtube-title"
+              className="mb-2 block text-xs font-medium text-light-900 dark:text-dark-900"
+            >
+              {t`Title`}
+            </label>
+            <Input
+              id="youtube-title"
+              placeholder={t`Enter a custom title`}
+              {...register("title")}
+              onKeyDown={async (e) => {
+                if (e.key === "Enter") {
+                  e.preventDefault();
+                  await handleSubmit(onSubmit)();
+                }
+              }}
+            />
+          </div>
+
+          <div>
+            <label
+              htmlFor="youtube-url"
+              className="mb-2 block text-xs font-medium text-light-900 dark:text-dark-900"
+            >
+              {t`YouTube URL`}
+            </label>
+            <Input
+              id="youtube-url"
+              placeholder={t`https://www.youtube.com/watch?v=...`}
+              {...register("url", { required: true })}
+              onKeyDown={async (e) => {
+                if (e.key === "Enter") {
+                  e.preventDefault();
+                  await handleSubmit(onSubmit)();
+                }
+              }}
+            />
+            {urlError && (
+              <p className="mt-1 text-xs text-red-600 dark:text-red-400">
+                {urlError}
+              </p>
+            )}
+          </div>
+        </div>
+      </div>
+
+      <div className="mt-12 flex items-center justify-end border-t border-light-600 px-5 pb-5 pt-5 dark:border-dark-600">
+        <div className="space-x-2">
+          <Button
+            type="button"
+            variant="secondary"
+            onClick={() => closeModal()}
+          >
+            {t`Cancel`}
+          </Button>
+          <Button
+            type="submit"
+            isLoading={isValidating}
+            disabled={!watch("url") || !!urlError}
+          >
+            {t`Save`}
+          </Button>
+        </div>
+      </div>
+    </form>
+  );
+}

apps/web/src/components/YouTubeEmbed/YouTubeCard.tsx

@@ -0,0 +1,53 @@
+import YouTubeDropdown from "./YouTubeDropdown";
+
+interface YouTubeCardProps {
+  videoId: string;
+  url: string;
+  title: string;
+  showEmbed?: boolean;
+  onConvertToLink: () => void;
+  onDelete: () => void;
+  onUpdate: (url: string, title: string) => void;
+}
+
+const YouTubeCard = ({
+  videoId,
+  url,
+  title,
+  showEmbed = true,
+  onConvertToLink,
+  onDelete,
+  onUpdate,
+}: YouTubeCardProps) => {
+  return (
+    <div className="w-full max-w-md rounded-lg border border-light-300 bg-light-50 dark:border-dark-300 dark:bg-dark-50">
+      <div className="flex items-center justify-between gap-6 p-0 px-6">
+        <h3 className="truncate text-sm font-medium">{title}</h3>
+        <div className="mt-3">
+          <YouTubeDropdown
+            url={url}
+            title={title}
+            onConvertToLink={onConvertToLink}
+            onDelete={onDelete}
+            onUpdate={onUpdate}
+          />
+        </div>
+      </div>
+
+      {showEmbed && videoId && (
+        <div className="p-6 pt-1">
+          <iframe
+            src={`https://www.youtube.com/embed/${videoId}?rel=0`}
+            title={title}
+            className="aspect-video w-full rounded-lg"
+            allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
+            referrerPolicy="strict-origin-when-cross-origin"
+            allowFullScreen
+          />
+        </div>
+      )}
+    </div>
+  );
+};
+
+export default YouTubeCard;

apps/web/src/components/YouTubeEmbed/YouTubeDropdown.tsx

@@ -0,0 +1,63 @@
+import { t } from "@lingui/core/macro";
+import {
+  HiEllipsisHorizontal,
+  HiLink,
+  HiPencil,
+  HiTrash,
+} from "react-icons/hi2";
+
+import { useModal } from "~/providers/modal";
+import Dropdown from "../Dropdown";
+
+interface YouTubeDropdownProps {
+  url: string;
+  title: string;
+  onConvertToLink: () => void;
+  onDelete: () => void;
+  onUpdate: (url: string, title: string) => void;
+}
+
+const YouTubeDropdown = ({
+  url,
+  title,
+  onConvertToLink,
+  onDelete,
+  onUpdate,
+}: YouTubeDropdownProps) => {
+  const { openModal, setModalState } = useModal();
+
+  const handleEdit = () => {
+    setModalState("EDIT_YOUTUBE", {
+      url,
+      title,
+      onSave: onUpdate,
+    });
+    openModal("EDIT_YOUTUBE");
+  };
+
+  return (
+    <Dropdown
+      items={[
+        {
+          label: t`Edit`,
+          action: handleEdit,
+          icon: <HiPencil className="h-4 w-4 text-dark-900" />,
+        },
+        {
+          label: t`Convert to link`,
+          action: onConvertToLink,
+          icon: <HiLink className="h-4 w-4 text-dark-900" />,
+        },
+        {
+          label: t`Delete`,
+          action: onDelete,
+          icon: <HiTrash className="h-4 w-4 text-dark-900" />,
+        },
+      ]}
+    >
+      <HiEllipsisHorizontal className="h-5 w-5 text-dark-900" />
+    </Dropdown>
+  );
+};
+
+export default YouTubeDropdown;

apps/web/src/components/YouTubeEmbed/YouTubeNode.tsx

@@ -0,0 +1,196 @@
+import { mergeAttributes, Node } from "@tiptap/core";
+import { Plugin, PluginKey } from "@tiptap/pm/state";
+import { ReactNodeViewRenderer } from "@tiptap/react";
+
+import { extractVideoId, fetchYouTubeMetadata, isYouTubeUrl } from "./utils";
+import YouTubeNodeView from "./YouTubeNodeView";
+
+export interface YouTubeOptions {
+  inline: boolean;
+  HTMLAttributes: Record<string, undefined>;
+}
+
+declare module "@tiptap/core" {
+  interface Commands<ReturnType> {
+    youTube: {
+      setYouTubeEmbed: (options: {
+        videoId: string;
+        url: string;
+        title: string;
+        thumbnailUrl?: string;
+        showEmbed?: boolean;
+      }) => ReturnType;
+    };
+  }
+}
+
+export const YouTubeNode = Node.create<YouTubeOptions>({
+  name: "youtube",
+  group: "block",
+  atom: true,
+  addOptions() {
+    return {
+      inline: false,
+      HTMLAttributes: {},
+    };
+  },
+
+  addAttributes() {
+    return {
+      videoId: {
+        default: null,
+        parseHTML: (element) => element.getAttribute("data-video-id"),
+        renderHTML: (attributes) => {
+          if (!attributes.videoId) return {};
+          return { "data-video-id": attributes.videoId as string };
+        },
+      },
+      url: {
+        default: null,
+        parseHTML: (element) => element.getAttribute("data-url"),
+        renderHTML: (attributes) => {
+          if (!attributes.url) return {};
+          return { "data-url": attributes.url as string };
+        },
+      },
+      title: {
+        default: "YouTube Video",
+        parseHTML: (element) => element.getAttribute("data-title"),
+        renderHTML: (attributes) => {
+          return { "data-title": attributes.title as string };
+        },
+      },
+      thumbnailUrl: {
+        default: null,
+        parseHTML: (element) => element.getAttribute("data-thumbnail"),
+        renderHTML: (attributes) => {
+          if (!attributes.thumbnailUrl) return {};
+          return { "data-thumbnail": attributes.thumbnailUrl as string };
+        },
+      },
+      showEmbed: {
+        default: true,
+        parseHTML: (element) => element.getAttribute("data-show-embed"),
+        renderHTML: (attributes) => {
+          return { "data-show-embed": attributes.showEmbed as string };
+        },
+      },
+    };
+  },
+
+  parseHTML() {
+    return [
+      {
+        tag: "div[data-youtube]",
+      },
+    ];
+  },
+
+  renderHTML({ HTMLAttributes }) {
+    return [
+      "div",
+      mergeAttributes(
+        { "data-youtube": "" },
+        this.options.HTMLAttributes,
+        HTMLAttributes,
+      ),
+    ];
+  },
+
+  addNodeView() {
+    return ReactNodeViewRenderer(YouTubeNodeView);
+  },
+
+  addProseMirrorPlugins() {
+    const nodeType = this.type;
+
+    return [
+      new Plugin({
+        key: new PluginKey("youtubePaste"),
+        props: {
+          handlePaste: (view, event) => {
+            const text = event.clipboardData?.getData("text/plain");
+            if (!text) return false;
+
+            // Check if the pasted text is a YouTube URL
+            const youtubeRegex =
+              /(https?:\/\/)?(www\.)?(youtube\.com\/watch\?v=|youtu\.be\/|youtube\.com\/embed\/)([\w-]+)/;
+            const match = youtubeRegex.exec(text);
+
+            if (!match || !isYouTubeUrl(text)) return false;
+
+            const videoId = extractVideoId(text);
+            if (!videoId) return false;
+
+            const { state, dispatch } = view;
+            const { tr } = state;
+
+            const node = nodeType.create({
+              videoId,
+              url: text,
+              title: "Loading...",
+              showEmbed: true,
+            });
+
+            tr.replaceSelectionWith(node);
+            dispatch(tr);
+
+            // Fetch metadata asynchronously and update the node
+            void fetchYouTubeMetadata(text).then((metadata) => {
+              const { state: newState, dispatch: newDispatch } = view;
+              const { tr: newTr } = newState;
+
+              newState.doc.descendants((n, pos) => {
+                if (
+                  n.type.name === "youtube" &&
+                  n.attrs.videoId === videoId &&
+                  n.attrs.title === "Loading..."
+                ) {
+                  newTr.setNodeMarkup(pos, undefined, {
+                    ...n.attrs,
+                    title: metadata?.title ?? "YouTube Video",
+                    thumbnailUrl: metadata?.thumbnail_url ?? null,
+                  });
+                  return false;
+                }
+                return true;
+              });
+
+              if (newTr.docChanged) {
+                newDispatch(newTr);
+              }
+            });
+
+            return true;
+          },
+        },
+      }),
+    ];
+  },
+
+  // commands for the YouTube embed node
+  addCommands() {
+    return {
+      setYouTubeEmbed:
+        (options: {
+          videoId: string;
+          url: string;
+          title?: string;
+          thumbnailUrl?: string;
+          showEmbed?: boolean;
+        }) =>
+        ({ editor }) => {
+          return editor.commands.insertContent({
+            type: this.name,
+            attrs: {
+              videoId: options.videoId,
+              url: options.url,
+              title: options.title ?? "YouTube Video",
+              thumbnailUrl: options.thumbnailUrl,
+              showEmbed: options.showEmbed ?? true,
+            },
+          });
+        },
+    };
+  },
+});

apps/web/src/components/YouTubeEmbed/YouTubeNodeView.tsx

@@ -0,0 +1,82 @@
+import type { NodeViewProps } from "@tiptap/react";
+import { NodeViewWrapper } from "@tiptap/react";
+
+import { extractVideoId } from "./utils";
+import YouTubeCard from "./YouTubeCard";
+
+export default function YouTubeNodeView({
+  node,
+  editor,
+  getPos,
+  deleteNode,
+  updateAttributes,
+}: NodeViewProps) {
+  const { videoId, title, url, showEmbed } = node.attrs as {
+    videoId: string;
+    title: string;
+    url: string;
+    showEmbed: boolean;
+  };
+
+  const handleConvertToLink = () => {
+    const pos = getPos();
+    if (typeof pos !== "number") return;
+
+    const linkContent = {
+      type: "paragraph",
+      content: [
+        {
+          type: "text",
+          text: url,
+          marks: [
+            {
+              type: "link",
+              attrs: {
+                href: url,
+                target: "_blank",
+              },
+            },
+          ],
+        },
+      ],
+    };
+
+    editor
+      .chain()
+      .focus()
+      .deleteRange({ from: pos, to: pos + node.nodeSize })
+      .insertContentAt(pos, linkContent)
+      .run();
+  };
+
+  const handleDelete = () => {
+    deleteNode();
+  };
+
+  const handleUpdate = (newUrl: string, newTitle: string) => {
+    if (newUrl !== url) {
+      const newVideoId = extractVideoId(newUrl);
+      updateAttributes({
+        url: newUrl,
+        title: newTitle,
+        videoId: newVideoId,
+      });
+    } else {
+      updateAttributes({ title: newTitle });
+    }
+  };
+
+  return (
+    <NodeViewWrapper>
+      <YouTubeCard
+        videoId={videoId}
+        url={url}
+        title={title}
+        showEmbed={showEmbed}
+        onConvertToLink={handleConvertToLink}
+        onDelete={handleDelete}
+        onUpdate={handleUpdate}
+      />
+    </NodeViewWrapper>
+  );
+}

apps/web/src/components/YouTubeEmbed/utils.ts

@@ -0,0 +1,61 @@
+export function extractVideoId(url: string): string | null {
+  if (!url) return null;
+  url = url.trim();
+
+  // youtube.com/watch?v=VIDEO_ID
+  const watchMatch = /(?:youtube\.com\/watch\?v=)([a-zA-Z0-9_-]{11})/.exec(url);
+  if (watchMatch) return watchMatch[1] ?? null;
+
+  // youtu.be/VIDEO_ID
+  const shortMatch = /(?:youtu\.be\/)([a-zA-Z0-9_-]{11})/.exec(url);
+  if (shortMatch) return shortMatch[1] ?? null;
+
+  // youtube.com/embed/VIDEO_ID
+  const embedMatch = /(?:youtube\.com\/embed\/)([a-zA-Z0-9_-]{11})/.exec(url);
+  if (embedMatch) return embedMatch[1] ?? null;
+
+  return null;
+}
+
+/**
+ * Check if a URL is a valid YouTube link
+ */
+export function isYouTubeUrl(url: string): boolean {
+  if (!url) return false;
+  const videoId = extractVideoId(url);
+  return videoId !== null;
+}
+
+/**
+ * Fetch YouTube video metadata using oEmbed API
+ * Returns title, author, thumbnail URL, etc.
+ * No API key required
+ */
+export async function fetchYouTubeMetadata(url: string): Promise<{
+  title: string;
+  author_name: string;
+  thumbnail_url: string;
+} | null> {
+  try {
+    const oembedUrl = `https://www.youtube.com/oembed?url=${encodeURIComponent(url)}&format=json`;
+    const response = await fetch(oembedUrl);
+
+    if (!response.ok) {
+      return null;
+    }
+
+    const data = (await response.json()) as {
+      title: string;
+      author_name: string;
+      thumbnail_url: string;
+    };
+    return {
+      title: data.title || "YouTube Video",
+      author_name: data.author_name || "",
+      thumbnail_url: data.thumbnail_url || "",
+    };
+  } catch (error) {
+    console.error("Failed to fetch YouTube metadata:", error);
+    return null;
+  }
+}

apps/web/src/components/modal.tsx

@@ -9,6 +9,7 @@ interface Props {
   positionFromTop?: "sm" | "md" | "lg";
   isVisible?: boolean;
   closeOnClickOutside?: boolean;
+  centered?: boolean;
 }
 
 const Modal: React.FC<Props> = ({
@@ -17,6 +18,7 @@ const Modal: React.FC<Props> = ({
   positionFromTop = "md",
   isVisible,
   closeOnClickOutside,
+  centered = false,
 }) => {
   const {
     isOpen,
@@ -60,7 +62,7 @@ const Modal: React.FC<Props> = ({
         </Transition.Child>
 
         <div className="fixed inset-0 z-50 w-screen overflow-y-auto">
-          <div className="flex min-h-full items-start justify-center p-4 text-center sm:items-start sm:p-0">
+          <div className={`flex min-h-full justify-center p-4 text-center sm:p-0 ${centered ? "items-center" : "items-start sm:items-start"}`}>
             <Transition.Child
               as={Fragment}
               enter="ease-out duration-300"
@@ -71,7 +73,7 @@ const Modal: React.FC<Props> = ({
               leaveTo="opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95"
             >
               <Dialog.Panel
-                className={`relative ${positionFromTopMap[positionFromTop]} w-full transform rounded-lg border border-light-600 bg-white/90 text-left shadow-3xl-light backdrop-blur-[6px] transition-all dark:border-dark-600 dark:bg-dark-100/90 dark:shadow-3xl-dark ${modalSizeMap[modalSize]}`}
+                className={`relative ${centered ? "" : positionFromTopMap[positionFromTop]} w-full transform rounded-lg border border-light-600 bg-white/90 text-left shadow-3xl-light backdrop-blur-[6px] transition-all dark:border-dark-600 dark:bg-dark-100/90 dark:shadow-3xl-dark ${modalSizeMap[modalSize]}`}
               >
                 {children}
               </Dialog.Panel>

apps/web/src/env.ts

@@ -14,6 +14,7 @@ export const env = createEnv({
    * This way you can ensure the app isn't built with invalid env vars.
    */
   server: {
+    KAN_ADMIN_API_KEY: z.string().optional(),
     BETTER_AUTH_SECRET: z.string(),
     BETTER_AUTH_TRUSTED_ORIGINS: z
       .string()
@@ -51,6 +52,8 @@ export const env = createEnv({
     VK_CLIENT_SECRET: z.string().optional(),
     LINKEDIN_CLIENT_ID: z.string().optional(),
     LINKEDIN_CLIENT_SECRET: z.string().optional(),
+    NOVU_API_KEY: z.string().optional(),
+    EMAIL_UNSUBSCRIBE_SECRET: z.string().optional(),
     // Generic OIDC Provider
     OIDC_CLIENT_ID: z.string().optional(),
     OIDC_CLIENT_SECRET: z.string().optional(),
@@ -75,6 +78,7 @@ export const env = createEnv({
     S3_ENDPOINT: z.string().optional(),
     S3_FORCE_PATH_STYLE: z.string().optional(),
     EMAIL_FROM: z.string().optional(),
+    REDIS_URL: z.string().url().optional().or(z.literal("")),
   },
 
   /**
@@ -87,10 +91,19 @@ export const env = createEnv({
     NEXT_PUBLIC_POSTHOG_KEY: z.string().optional(),
     NEXT_PUBLIC_POSTHOG_HOST: z.string().optional(),
     NEXT_PUBLIC_USE_STANDALONE_OUTPUT: z.string().optional(),
-    NEXT_PUBLIC_BASE_URL: z.string().url(),
+    NEXT_PUBLIC_BASE_URL: z.string().url().optional(),
     NEXT_PUBLIC_STORAGE_URL: z.string().url().optional(),
     NEXT_PUBLIC_AVATAR_BUCKET_NAME: z.string().optional(),
+    NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME: z.string().optional(),
     NEXT_PUBLIC_STORAGE_DOMAIN: z.string().optional(),
+    NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS: z
+      .string()
+      .transform((s) => (s === "" ? undefined : s))
+      .refine(
+        (s) => !s || s.toLowerCase() === "true" || s.toLowerCase() === "false",
+      )
+      .optional(),
+    NEXT_PUBLIC_APP_VERSION: z.string().optional(),
     NEXT_PUBLIC_ALLOW_CREDENTIALS: z
       .string()
       .transform((s) => (s === "" ? undefined : s))
@@ -125,7 +138,12 @@ export const env = createEnv({
     NEXT_PUBLIC_BASE_URL: process.env.NEXT_PUBLIC_BASE_URL,
     NEXT_PUBLIC_STORAGE_URL: process.env.NEXT_PUBLIC_STORAGE_URL,
     NEXT_PUBLIC_AVATAR_BUCKET_NAME: process.env.NEXT_PUBLIC_AVATAR_BUCKET_NAME,
+    NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME:
+      process.env.NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME,
     NEXT_PUBLIC_STORAGE_DOMAIN: process.env.NEXT_PUBLIC_STORAGE_DOMAIN,
+    NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS:
+      process.env.NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS,
+    NEXT_PUBLIC_APP_VERSION: process.env.NEXT_PUBLIC_APP_VERSION,
     NEXT_PUBLIC_ALLOW_CREDENTIALS: process.env.NEXT_PUBLIC_ALLOW_CREDENTIALS,
     NEXT_PUBLIC_DISABLE_SIGN_UP: process.env.NEXT_PUBLIC_DISABLE_SIGN_UP,
     NEXT_PUBLIC_USE_STANDALONE_OUTPUT:

apps/web/src/hooks/useDragToScroll.ts

@@ -0,0 +1,101 @@
+import { useEffect, useRef, useState } from "react";
+
+interface UseDragToScrollOptions {
+  /**
+   * Whether drag-to-scroll is enabled
+   */
+  enabled?: boolean;
+  /**
+   * The direction to scroll
+   */
+  direction?: "horizontal" | "vertical" | "both";
+}
+
+/**
+ * Hook to enable drag-to-scroll functionality on a scrollable element
+ * @param options Configuration options
+ * @returns Ref to attach to the scrollable element and mouse event handlers
+ */
+export function useDragToScroll({
+  enabled = true,
+  direction = "horizontal",
+}: UseDragToScrollOptions = {}) {
+  const scrollRef = useRef<HTMLDivElement>(null);
+  const [isDragging, setIsDragging] = useState(false);
+  const startPosRef = useRef({ x: 0, y: 0 });
+  const scrollStartRef = useRef({ x: 0, y: 0 });
+
+  useEffect(() => {
+    if (!enabled || !isDragging) return;
+
+    const handleMouseMove = (e: MouseEvent) => {
+      if (!scrollRef.current) return;
+
+      const deltaX = e.clientX - startPosRef.current.x;
+      const deltaY = e.clientY - startPosRef.current.y;
+
+      if (direction === "horizontal" || direction === "both") {
+        scrollRef.current.scrollLeft = scrollStartRef.current.x - deltaX;
+      }
+      if (direction === "vertical" || direction === "both") {
+        scrollRef.current.scrollTop = scrollStartRef.current.y - deltaY;
+      }
+    };
+
+    const handleMouseUp = () => {
+      setIsDragging(false);
+    };
+
+    document.addEventListener("mousemove", handleMouseMove);
+    document.addEventListener("mouseup", handleMouseUp);
+    document.body.style.cursor = "grabbing";
+    document.body.style.userSelect = "none";
+
+    return () => {
+      document.removeEventListener("mousemove", handleMouseMove);
+      document.removeEventListener("mouseup", handleMouseUp);
+      document.body.style.cursor = "";
+      document.body.style.userSelect = "";
+    };
+  }, [enabled, isDragging, direction]);
+
+  const handleMouseDown = (e: React.MouseEvent<HTMLDivElement>) => {
+    if (!scrollRef.current) return;
+
+    const target = e.target as HTMLElement;
+    const container = scrollRef.current;
+
+    // Check if the click is on an interactive or draggable element
+    // We need to be careful not to interfere with react-beautiful-dnd dragging
+    const isInteractiveElement =
+      target.closest("a") ||
+      target.closest("button") ||
+      target.closest("input") ||
+      target.closest("textarea") ||
+      target.closest("[role='button']") ||
+      target.closest("[draggable='true']") ||
+      target.closest(".react-beautiful-dnd-drag-handle") ||
+      target.closest("[data-rbd-drag-handle-draggable-id]") ||
+      target.closest("[data-rbd-draggable-id]");
+
+    // Don't start dragging if clicking on interactive elements
+    if (isInteractiveElement) return;
+
+    // Enable drag-to-scroll for any non-interactive element within the container
+    if (container.contains(target)) {
+      e.preventDefault();
+      setIsDragging(true);
+      startPosRef.current = { x: e.clientX, y: e.clientY };
+      scrollStartRef.current = {
+        x: container.scrollLeft,
+        y: container.scrollTop,
+      };
+    }
+  };
+
+  return {
+    ref: scrollRef,
+    onMouseDown: handleMouseDown,
+    isDragging,
+  };
+}

apps/web/src/hooks/useLocalisation.ts

@@ -1,4 +1,6 @@
+import type { Locale as DateFnsLocale } from "date-fns";
 import { useLingui } from "@lingui/react";
+import { de, enGB, es, fr, it, nl, pl, ru, ptBR} from "date-fns/locale";
 
 import type { Locale } from "~/locales";
 import { useLinguiContext } from "~/providers/lingui";
@@ -8,6 +10,20 @@ export function useLocalisation() {
   const { i18n } = useLingui();
   const { locale, setLocale, availableLocales } = useLinguiContext();
 
+  const dateLocaleMap: Partial<Record<Locale, DateFnsLocale>> = {
+    en: enGB,
+    fr,
+    de,
+    es,
+    it,
+    nl,
+    ru,
+    pl,
+    "pt-BR": ptBR,
+  };
+
+  const currentDateLocale = dateLocaleMap[locale] ?? enGB;
+
   const handleSetLocale = async (newLocale: Locale) => {
     await activateLocale(newLocale);
     setLocale(newLocale);
@@ -15,9 +31,9 @@ export function useLocalisation() {
 
   return {
     locale,
+    dateLocale: currentDateLocale,
     setLocale: handleSetLocale,
     availableLocales,
-    formatDate: i18n.date,
     formatNumber: i18n.number,
   };
 }

apps/web/src/hooks/usePermissions.ts

@@ -0,0 +1,109 @@
+import type { Permission } from "@kan/shared";
+import { useContext } from "react";
+
+import { WorkspaceContext } from "~/providers/workspace";
+import { api } from "~/utils/api";
+
+interface UsePermissionsResult {
+  permissions: Permission[];
+  role: string | null;
+  isLoading: boolean;
+  hasPermission: (permission: Permission) => boolean;
+  canViewCard: boolean;
+  canCreateCard: boolean;
+  canEditCard: boolean;
+  canDeleteCard: boolean;
+  canCreateList: boolean;
+  canEditList: boolean;
+  canDeleteList: boolean;
+  canCreateBoard: boolean;
+  canEditBoard: boolean;
+  canDeleteBoard: boolean;
+  canViewComment: boolean;
+  canCreateComment: boolean;
+  canEditComment: boolean;
+  canDeleteComment: boolean;
+  canInviteMember: boolean;
+  canEditMember: boolean;
+  canRemoveMember: boolean;
+  canViewWorkspace: boolean;
+  canEditWorkspace: boolean;
+}
+
+export function usePermissions(): UsePermissionsResult {
+  // Check if WorkspaceProvider is available (for public board views, it may not be)
+  const workspaceContext = useContext(WorkspaceContext);
+  
+  // If WorkspaceProvider is not available, return safe defaults
+  if (!workspaceContext) {
+    const emptyPermissions: UsePermissionsResult = {
+      permissions: [],
+      role: null,
+      isLoading: false,
+      hasPermission: () => false,
+      canViewCard: false,
+      canCreateCard: false,
+      canEditCard: false,
+      canDeleteCard: false,
+      canCreateList: false,
+      canEditList: false,
+      canDeleteList: false,
+      canCreateBoard: false,
+      canEditBoard: false,
+      canDeleteBoard: false,
+      canViewComment: false,
+      canCreateComment: false,
+      canEditComment: false,
+      canDeleteComment: false,
+      canInviteMember: false,
+      canEditMember: false,
+      canRemoveMember: false,
+      canViewWorkspace: false,
+      canEditWorkspace: false,
+    };
+    return emptyPermissions;
+  }
+
+  const { workspace } = workspaceContext;
+
+  const { data, isLoading } = api.permission.getMyPermissions.useQuery(
+    { workspacePublicId: workspace.publicId },
+    {
+      enabled: !!workspace.publicId,
+    },
+  );
+
+  const permissions = (data?.permissions ?? []) as Permission[];
+  const role = data?.role ?? null;
+
+  const hasPermission = (permission: Permission): boolean => {
+    return permissions.includes(permission);
+  };
+
+  return {
+    permissions,
+    role,
+    isLoading,
+    hasPermission,
+    canViewCard: hasPermission("card:view"),
+    canCreateCard: hasPermission("card:create"),
+    canEditCard: hasPermission("card:edit"),
+    canDeleteCard: hasPermission("card:delete"),
+    canCreateList: hasPermission("list:create"),
+    canEditList: hasPermission("list:edit"),
+    canDeleteList: hasPermission("list:delete"),
+    canCreateBoard: hasPermission("board:create"),
+    canEditBoard: hasPermission("board:edit"),
+    canDeleteBoard: hasPermission("board:delete"),
+    canViewComment: hasPermission("comment:view"),
+    canCreateComment: hasPermission("comment:create"),
+    canEditComment: hasPermission("comment:edit"),
+    canDeleteComment: hasPermission("comment:delete"),
+    canInviteMember: hasPermission("member:invite"),
+    canEditMember: hasPermission("member:edit"),
+    canRemoveMember: hasPermission("member:remove"),
+    canViewWorkspace: hasPermission("workspace:view"),
+    canEditWorkspace: hasPermission("workspace:edit"),
+  };
+}
+

apps/web/src/instrumentation.ts

@@ -1,6 +0,0 @@
-export async function register() {
-  if (process.env.NEXT_RUNTIME === "nodejs") {
-    await require("pino");
-    await require("next-logger");
-  }
-}

apps/web/src/locales/index.ts

@@ -7,6 +7,7 @@ export const locales = [
   "nl",
   "ru",
   "pl",
+  "pt-BR"
 ] as const;
 
 export type Locale = (typeof locales)[number];
@@ -22,4 +23,5 @@ export const localeNames: Record<Locale, string> = {
   nl: "Nederlands",
   ru: "Русский",
   pl: "Polski",
+  "pt-BR": "Português",
 };

apps/web/src/pages/_app.tsx

@@ -12,6 +12,7 @@ import posthog from "posthog-js";
 import { PostHogProvider } from "posthog-js/react";
 import { useEffect } from "react";
 
+import { KeyboardShortcutProvider } from "~/providers/keyboard-shortcuts";
 import { LinguiProviderWrapper } from "~/providers/lingui";
 import { ModalProvider } from "~/providers/modal";
 import { PopupProvider } from "~/providers/popup";
@@ -80,21 +81,23 @@ const MyApp: AppType = ({ Component, pageProps }: AppPropsWithLayout) => {
       )}
       <script src="/__ENV.js" />
       <main className="font-sans">
-        <LinguiProviderWrapper>
-          <ThemeProvider attribute="class" defaultTheme="system" enableSystem>
-            <ModalProvider>
-              <PopupProvider>
-                {posthogKey ? (
-                  <PostHogProvider client={posthog}>
-                    {getLayout(<Component {...pageProps} />)}
-                  </PostHogProvider>
-                ) : (
-                  getLayout(<Component {...pageProps} />)
-                )}
-              </PopupProvider>
-            </ModalProvider>
-          </ThemeProvider>
-        </LinguiProviderWrapper>
+        <KeyboardShortcutProvider>
+          <LinguiProviderWrapper>
+            <ThemeProvider attribute="class" defaultTheme="system" enableSystem>
+              <ModalProvider>
+                <PopupProvider>
+                  {posthogKey ? (
+                    <PostHogProvider client={posthog}>
+                      {getLayout(<Component {...pageProps} />)}
+                    </PostHogProvider>
+                  ) : (
+                    getLayout(<Component {...pageProps} />)
+                  )}
+                </PopupProvider>
+              </ModalProvider>
+            </ThemeProvider>
+          </LinguiProviderWrapper>
+        </KeyboardShortcutProvider>
       </main>
     </>
   );

apps/web/src/pages/api/auth/[...all].ts

@@ -2,9 +2,17 @@ import { toNodeHandler } from "better-auth/node";
 
 import { initAuth } from "@kan/auth/server";
 import { createDrizzleClient } from "@kan/db/client";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
 export const config = { api: { bodyParser: false } };
 
 export const auth = initAuth(createDrizzleClient());
 
-export default toNodeHandler(auth.handler);
+const authHandler = toNodeHandler(auth.handler);
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req, res) => {
+    return await authHandler(req, res);
+  },
+);

apps/web/src/pages/api/download/attatchment.ts

@@ -0,0 +1,49 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+  if (req.method !== "GET") {
+    return res.status(405).json({ message: "Method not allowed" });
+  }
+
+  const { url, filename } = req.query;
+
+  if (!url || typeof url !== "string") {
+    return res.status(400).json({
+      message: "url parameter is required",
+    });
+  }
+
+  try {
+    const downloadFilename = typeof filename === "string"
+      ? encodeURIComponent(filename)
+      : "attachment";
+
+    const upstream = await fetch(url);
+
+    if (!upstream.ok) {
+      return res.status(upstream.status).json({
+        message: "Failed to fetch attachment",
+      });
+    }
+
+    const contentType =
+      upstream.headers.get("Content-Type") ?? "application/octet-stream";
+
+    res.setHeader("Content-Type", contentType);
+    res.setHeader(
+      "Content-Disposition",
+      `attachment; filename="${downloadFilename}"; filename*=UTF-8''${downloadFilename}`,
+    );
+
+    const buffer = await upstream.arrayBuffer();
+    return res.send(Buffer.from(buffer));
+  } catch (error) {
+    console.error("Error downloading attachment:", error);
+    return res.status(500).json({ message: "Failed to download attachment" });
+  }
+  },
+);

apps/web/src/pages/api/oss-friends.ts

@@ -0,0 +1,25 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+  if (req.method !== "GET") {
+    return res.status(405).json({ message: "Method not allowed" });
+  }
+
+  try {
+    const response = await fetch("https://formbricks.com/api/oss-friends");
+    if (!response.ok) {
+      throw new Error("Failed to fetch from Formbricks");
+    }
+    const data = await response.json();
+
+    return res.status(200).json(data);
+  } catch (error) {
+    console.error("Error fetching OSS friends:", error);
+    return res.status(500).json({ message: "Failed to fetch OSS friends" });
+  }
+  },
+);

apps/web/src/pages/api/stripe/create_billing_session.ts

@@ -3,11 +3,11 @@ import { env } from "next-runtime-env";
 
 import { createNextApiContext } from "@kan/api/trpc";
 import { createStripeClient } from "@kan/stripe";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
   const stripe = createStripeClient();
 
   if (req.method !== "POST") {
@@ -31,4 +31,5 @@ export default async function handler(
     console.error("Error:", error);
     return res.status(500).json({ error: "Error creating portal session" });
   }
-}
+  },
+);

apps/web/src/pages/api/stripe/create_checkout_session.ts

@@ -6,6 +6,7 @@ import { createNextApiContext } from "@kan/api/trpc";
 import * as subscriptionRepo from "@kan/db/repository/subscription.repo";
 import * as workspaceRepo from "@kan/db/repository/workspace.repo";
 import { createStripeClient } from "@kan/stripe";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
 const workspaceSlugSchema = z
   .string()
@@ -21,10 +22,9 @@ interface CheckoutSessionRequest {
   stripeCustomerId: string;
 }
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
   const stripe = createStripeClient();
 
   if (req.method !== "POST") {
@@ -88,12 +88,16 @@ export default async function handler(
 
     const session = await stripe.checkout.sessions.create({
       mode: "subscription",
+      payment_method_collection: "always",
       line_items: [
         {
           price: process.env.STRIPE_PRO_PLAN_MONTHLY_PRICE_ID,
           quantity: 1,
         },
       ],
+      subscription_data: {
+        trial_period_days: 14,
+      },
       success_url: `${env("NEXT_PUBLIC_BASE_URL")}${successUrl}`,
       cancel_url: `${env("NEXT_PUBLIC_BASE_URL")}${cancelUrl}`,
       client_reference_id: workspacePublicId,
@@ -111,4 +115,5 @@ export default async function handler(
     console.error("Error:", error);
     return res.status(500).json({ error: "Error creating checkout session" });
   }
-}
+  },
+);

apps/web/src/pages/api/trello/authenticate.ts

@@ -3,11 +3,11 @@ import type { NextApiRequest, NextApiResponse } from "next";
 import { createNextApiContext } from "@kan/api/trpc";
 import { integrations } from "@kan/db/schema";
 import { addYears } from "date-fns";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
   if (req.method !== "POST") {
     return res.status(405).json({ message: "Method not allowed" });
   }
@@ -48,4 +48,5 @@ export default async function handler(
     console.error("Trello authentication error:", err);
     return res.status(400).json({ message: "Trello authentication failed" });
   }
-}
+  },
+);

apps/web/src/pages/api/trpc/[trpc].ts

@@ -3,12 +3,14 @@ import { createNextApiHandler } from "@trpc/server/adapters/next";
 
 import { appRouter } from "@kan/api/root";
 import { createTRPCContext } from "@kan/api/trpc";
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
 const nextApiHandler = createNextApiHandler({
   router: appRouter,
   createContext: createTRPCContext,
   onError:
-    process.env.NODE_ENV === "development"
+    env.NODE_ENV === "development"
       ? ({ path, error }) => {
           console.error(
             `❌ tRPC failed on ${path ?? "<no-path>"}: ${error.message}`,
@@ -17,11 +19,16 @@ const nextApiHandler = createNextApiHandler({
       : undefined,
 });
 
-export default function handler(req: NextApiRequest, res: NextApiResponse) {
-  if (req.method === "OPTIONS") {
-    res.writeHead(200);
-    return res.end();
-  }
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method === "OPTIONS") {
+      res.writeHead(200);
+      res.end();
+      return;
+    }
 
-  return nextApiHandler(req, res);
-}
+    const result = await nextApiHandler(req, res);
+    return result;
+  },
+);

apps/web/src/pages/api/unsubscribe.ts

@@ -0,0 +1,105 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { Novu } from "@novu/api";
+import { jwtVerify } from "jose";
+import { z } from "zod";
+
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+
+const requestSchema = z.object({
+  token: z.string().min(1),
+});
+
+const tokenPayloadSchema = z.object({
+  subscriberId: z.string(),
+});
+
+type ResponseData =
+  | { success: true }
+  | { success: false; error: string; code?: string };
+
+const textEncoder = new TextEncoder();
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse<ResponseData>) => {
+  if (process.env.NEXT_PUBLIC_KAN_ENV !== "cloud") {
+    return res.status(404).json({
+      success: false,
+      error: "Unsubscribe endpoint is not available.",
+      code: "UNAVAILABLE",
+    });
+  }
+
+  if (req.method !== "POST") {
+    res.setHeader("Allow", "POST");
+    return res.status(405).json({
+      success: false,
+      error: "Method not allowed.",
+      code: "METHOD_NOT_ALLOWED",
+    });
+  }
+
+  const parsedBody = requestSchema.safeParse(req.body);
+
+  if (!parsedBody.success) {
+    return res.status(400).json({
+      success: false,
+      error: "Invalid request payload.",
+      code: "BAD_REQUEST",
+    });
+  }
+
+  if (!env.EMAIL_UNSUBSCRIBE_SECRET || !env.NOVU_API_KEY) {
+    return res.status(500).json({
+      success: false,
+      error: "Unsubscribe service is not configured.",
+      code: "NOT_CONFIGURED",
+    });
+  }
+
+  let payload: z.infer<typeof tokenPayloadSchema>;
+
+  try {
+    const verified = await jwtVerify(
+      parsedBody.data.token,
+      textEncoder.encode(env.EMAIL_UNSUBSCRIBE_SECRET),
+      {
+        // We intentionally do not use exp/iat claims –
+        // tokens are long-lived and validated only by signature + payload.
+        clockTolerance: "0s",
+      },
+    );
+    payload = tokenPayloadSchema.parse(verified.payload);
+  } catch {
+    return res.status(401).json({
+      success: false,
+      error: "Your unsubscribe link is invalid or has expired.",
+      code: "INVALID_TOKEN",
+    });
+  }
+
+  const novu = new Novu({ secretKey: env.NOVU_API_KEY });
+
+  try {
+    await novu.subscribers.preferences.update(
+      {
+        channels: {
+          email: false,
+        },
+      },
+      payload.subscriberId,
+    );
+  } catch (error) {
+    console.error("Failed to update Novu preferences", error);
+    return res.status(502).json({
+      success: false,
+      error:
+        "We could not update your email preferences right now. Please try again later.",
+      code: "NOVU_ERROR",
+    });
+  }
+
+  return res.status(200).json({ success: true });
+  },
+);

apps/web/src/pages/api/upload/attachment.ts

@@ -0,0 +1,131 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { Upload } from "@aws-sdk/lib-storage";
+
+import { createNextApiContext } from "@kan/api/trpc";
+import * as cardRepo from "@kan/db/repository/card.repo";
+import * as cardActivityRepo from "@kan/db/repository/cardActivity.repo";
+import * as cardAttachmentRepo from "@kan/db/repository/cardAttachment.repo";
+import { generateUID } from "@kan/shared/utils";
+
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+import { createS3Client } from "@kan/shared/utils";
+import { assertPermission } from "@kan/api/utils/permissions";
+
+const MAX_SIZE_BYTES = 50 * 1024 * 1024; // 50MB
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method !== "POST") {
+      return res.status(405).json({ error: "Method not allowed" });
+    }
+
+    try {
+      const { user, db } = await createNextApiContext(req);
+
+      if (!user) {
+        return res.status(401).json({ error: "Unauthorized" });
+      }
+
+      const bucket = env.NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME;
+      if (!bucket) {
+        return res.status(500).json({ error: "Attachments bucket not configured" });
+      }
+
+      const cardPublicId = req.query.cardPublicId;
+      if (typeof cardPublicId !== "string" || cardPublicId.length < 12) {
+        return res.status(400).json({ error: "Invalid cardPublicId" });
+      }
+
+      const contentType = req.headers["content-type"];
+      const contentLengthHeader = req.headers["content-length"];
+      const contentLength = contentLengthHeader
+        ? Number.parseInt(contentLengthHeader, 10)
+        : NaN;
+
+      if (typeof contentType !== "string") {
+        return res.status(400).json({ error: "Missing content type" });
+      }
+
+      if (!Number.isFinite(contentLength) || contentLength <= 0) {
+        return res.status(400).json({ error: "Missing or invalid content length" });
+      }
+
+      if (contentLength > MAX_SIZE_BYTES) {
+        return res.status(400).json({ error: "File too large" });
+      }
+
+      const originalFilenameHeader =
+        (req.headers["x-original-filename"] as string | undefined) ?? "file";
+
+      const sanitizedFilename = originalFilenameHeader
+        .replace(/[^a-zA-Z0-9._-]/g, "_")
+        .substring(0, 200);
+
+      // Get card and check permissions
+      const card = await cardRepo.getWorkspaceAndCardIdByCardPublicId(
+        db,
+        cardPublicId,
+      );
+
+      if (!card) {
+        return res.status(404).json({ error: "Card not found" });
+      }
+
+      // Check if user has permission to edit the card
+      try {
+        await assertPermission(db, user.id, card.workspaceId, "card:edit");
+      } catch {
+        return res.status(403).json({ error: "Permission denied" });
+      }
+
+      const s3Key = `${card.workspaceId}/${cardPublicId}/${generateUID()}-${sanitizedFilename}`;
+
+      const client = createS3Client();
+
+      const upload = new Upload({
+        client,
+        params: {
+          Bucket: bucket,
+          Key: s3Key,
+          Body: req,
+          ContentType: contentType,
+          ContentLength: contentLength,
+        },
+        leavePartsOnError: false,
+      });
+
+      await upload.done();
+
+      // Create attachment record and log activity
+      const attachment = await cardAttachmentRepo.create(db, {
+        cardId: card.id,
+        filename: sanitizedFilename,
+        originalFilename: originalFilenameHeader,
+        contentType,
+        size: contentLength,
+        s3Key,
+        createdBy: user.id,
+      });
+
+      await cardActivityRepo.create(db, {
+        type: "card.updated.attachment.added",
+        cardId: card.id,
+        createdBy: user.id,
+      });
+
+      return res.status(200).json({ attachment });
+    } catch (error) {
+      console.error("Attachment upload failed", error);
+      return res.status(500).json({ error: "Internal server error" });
+    }
+  },
+);
+

apps/web/src/pages/api/upload/avatar.ts

@@ -0,0 +1,101 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { PutObjectCommand } from "@aws-sdk/client-s3";
+
+import { createNextApiContext } from "@kan/api/trpc";
+import * as userRepo from "@kan/db/repository/user.repo";
+
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+import { createS3Client } from "@kan/shared/utils";
+
+const MAX_SIZE_BYTES = 2 * 1024 * 1024; // 2MB
+const allowedContentTypes = ["image/jpeg", "image/png", "image/webp"];
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method !== "POST") {
+      return res.status(405).json({ error: "Method not allowed" });
+    }
+
+    try {
+      const { user, db } = await createNextApiContext(req);
+
+      if (!user) {
+        return res.status(401).json({ error: "Unauthorized" });
+      }
+
+      const bucket = env.NEXT_PUBLIC_AVATAR_BUCKET_NAME;
+      if (!bucket) {
+        return res.status(500).json({ error: "Avatar bucket not configured" });
+      }
+
+      const contentType = req.headers["content-type"];
+      const contentLengthHeader = req.headers["content-length"];
+      const contentLength = contentLengthHeader
+        ? Number.parseInt(contentLengthHeader, 10)
+        : NaN;
+
+      if (typeof contentType !== "string") {
+        return res.status(400).json({ error: "Missing content type" });
+      }
+
+      if (!allowedContentTypes.includes(contentType)) {
+        return res.status(400).json({ error: "Invalid content type" });
+      }
+
+      if (!Number.isFinite(contentLength) || contentLength <= 0) {
+        return res.status(400).json({ error: "Missing or invalid content length" });
+      }
+
+      if (contentLength > MAX_SIZE_BYTES) {
+        return res.status(400).json({ error: "File too large" });
+      }
+
+      const originalFilenameHeader =
+        (req.headers["x-original-filename"] as string | undefined) ?? "file";
+
+      const sanitizedFilename = originalFilenameHeader
+        .replace(/[^a-zA-Z0-9._-]/g, "_")
+        .substring(0, 200);
+
+      const s3Key = `${user.id}/${sanitizedFilename}`;
+
+      const client = createS3Client();
+
+      // Upload the file to S3
+      await client.send(
+        new PutObjectCommand({
+          Bucket: bucket,
+          Key: s3Key,
+          Body: req,
+          ContentType: contentType,
+          ContentLength: contentLength,
+        }),
+      );
+
+      // Update user image in database
+      const updatedUser = await userRepo.update(db, user.id, {
+        image: s3Key,
+      });
+
+      return res.status(200).json({
+        key: s3Key,
+        filename: sanitizedFilename,
+        contentType,
+        size: contentLength,
+        user: updatedUser,
+      });
+    } catch (error) {
+      console.error("Avatar upload failed", error);
+      return res.status(500).json({ error: "Internal server error" });
+    }
+  },
+);
+

apps/web/src/pages/api/upload/image.ts

@@ -1,70 +0,0 @@
-import type { NextApiRequest, NextApiResponse } from "next";
-import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { env as nextRuntimeEnv } from "next-runtime-env";
-
-import { createNextApiContext } from "@kan/api/trpc";
-
-import { env } from "~/env";
-
-const allowedContentTypes = ["image/jpeg", "image/png"];
-
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
-  if (req.method !== "POST") {
-    return res.status(405).json({ error: "Method not allowed" });
-  }
-
-  try {
-    const { user } = await createNextApiContext(req);
-
-    if (!user) {
-      return res.status(401).json({ error: "Unauthorized" });
-    }
-
-    const { filename, contentType } = req.body as {
-      filename: string;
-      contentType: string;
-    };
-
-    // Specific to avatar uploads for now
-    const filenameRegex = /^[a-f0-9\-]+\/[a-zA-Z0-9_\-]+(\.jpg|\.jpeg|\.png)$/;
-
-    if (!filenameRegex.test(filename)) {
-      return res.status(400).json({ error: "Invalid filename" });
-    }
-
-    if (
-      typeof contentType !== "string" ||
-      !allowedContentTypes.includes(contentType)
-    ) {
-      return res.status(400).json({ error: "Invalid content type" });
-    }
-
-    const client = new S3Client({
-      region: env.S3_REGION ?? "",
-      endpoint: env.S3_ENDPOINT ?? "",
-      forcePathStyle: env.S3_FORCE_PATH_STYLE === "true",
-      credentials: {
-        accessKeyId: env.S3_ACCESS_KEY_ID ?? "",
-        secretAccessKey: env.S3_SECRET_ACCESS_KEY ?? "",
-      },
-    });
-
-    const signedUrl = await getSignedUrl(
-      // @ts-ignore
-      client,
-      new PutObjectCommand({
-        Bucket: nextRuntimeEnv("NEXT_PUBLIC_AVATAR_BUCKET_NAME") ?? "",
-        Key: filename,
-        ACL: "public-read",
-      }),
-    );
-
-    return res.status(200).json({ url: signedUrl, key: filename });
-  } catch (error) {
-    return res.status(500).json({ error: (error as Error).message });
-  }
-}

apps/web/src/pages/api/v1/[...trpc].ts

@@ -6,25 +6,26 @@ import { appRouter } from "@kan/api";
 import { createRESTContext } from "@kan/api/trpc";
 
 import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
-  await cors(req, res);
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    await cors(req, res);
 
-  const openApiHandler = createOpenApiNextHandler({
-    router: appRouter,
-    createContext: createRESTContext,
-    onError:
-      env.NODE_ENV === "development"
-        ? ({ path, error }) => {
-            console.error(
-              `❌ REST failed on ${path ?? "<no-path>"}: ${error.message}`,
-            );
-          }
-        : undefined,
-  });
+    const openApiHandler = createOpenApiNextHandler({
+      router: appRouter,
+      createContext: createRESTContext,
+      onError:
+        env.NODE_ENV === "development"
+          ? ({ path, error }) => {
+              console.error(
+                `❌ REST failed on ${path ?? "<no-path>"}: ${error.message}`,
+              );
+            }
+          : undefined,
+    });
 
-  return await openApiHandler(req, res);
-}
+    return await openApiHandler(req, res);
+  },
+);

apps/web/src/pages/api/v1/openapi.json.ts

@@ -1,9 +1,11 @@
 import type { NextApiRequest, NextApiResponse } from "next";
 
 import { openApiDocument } from "@kan/api/openapi";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
-const handler = (req: NextApiRequest, res: NextApiResponse) => {
-  res.status(200).send(openApiDocument);
-};
-
-export default handler;
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  (req: NextApiRequest, res: NextApiResponse) => {
+    res.status(200).send(openApiDocument);
+  },
+);

apps/web/src/pages/oss-friends/index.tsx

@@ -0,0 +1,5 @@
+import OSSFriendsView from "~/views/oss-friends";
+
+export default function OSSFriends() {
+  return <OSSFriendsView />;
+}

apps/web/src/pages/settings/api.tsx

@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import ApiSettings from "~/views/settings/ApiSettings";
+import Popup from "~/components/Popup";
 
 const ApiSettingsPage: NextPageWithLayout = () => {
   return (
     <SettingsLayout currentTab="api">
       <ApiSettings />
+      <Popup />
     </SettingsLayout>
   );
 };

apps/web/src/pages/settings/billing.tsx

@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import BillingSettings from "~/views/settings/BillingSettings";
+import Popup from "~/components/Popup";
 
 const BillingSettingsPage: NextPageWithLayout = () => {
   return (
     <SettingsLayout currentTab="billing">
       <BillingSettings />
+      <Popup />
     </SettingsLayout>
   );
 };

apps/web/src/pages/settings/integrations.tsx

@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import IntegrationsSettings from "~/views/settings/IntegrationsSettings";
+import Popup from "~/components/Popup";
 
 const IntegrationsSettingsPage: NextPageWithLayout = () => {
   return (
     <SettingsLayout currentTab="integrations">
       <IntegrationsSettings />
+      <Popup />
     </SettingsLayout>
   );
 };

apps/web/src/pages/settings/permissions.tsx

@@ -0,0 +1,23 @@
+import type { NextPageWithLayout } from "~/pages/_app";
+import { getDashboardLayout } from "~/components/Dashboard";
+import { SettingsLayout } from "~/components/SettingsLayout";
+import Popup from "~/components/Popup";
+import PermissionsSettings from "~/views/settings/PermissionsSettings";
+
+const PermissionsSettingsPage: NextPageWithLayout = () => {
+  return (
+    <>
+      <SettingsLayout currentTab="permissions">
+        <PermissionsSettings />
+        <Popup />
+      </SettingsLayout>
+      
+    </>
+  );
+};
+
+PermissionsSettingsPage.getLayout = (page) => getDashboardLayout(page);
+
+export default PermissionsSettingsPage;
+
+

apps/web/src/pages/settings/workspace.tsx

@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import WorkspaceSettings from "~/views/settings/WorkspaceSettings";
+import Popup from "~/components/Popup";
 
 const WorkspaceSettingsPage: NextPageWithLayout = () => {
   return (
     <SettingsLayout currentTab="workspace">
       <WorkspaceSettings />
+      <Popup />
     </SettingsLayout>
   );
 };

apps/web/src/pages/unsubscribe/index.tsx

@@ -0,0 +1,110 @@
+import { useRouter } from "next/router";
+import { t } from "@lingui/core/macro";
+import { useEffect, useState } from "react";
+
+import Button from "~/components/Button";
+import { PageHead } from "~/components/PageHead";
+import PatternedBackground from "~/components/PatternedBackground";
+
+type UnsubscribeStatus = "idle" | "processing" | "success" | "error";
+
+export default function UnsubscribePage() {
+  const router = useRouter();
+  const [token, setToken] = useState("");
+  const [status, setStatus] = useState<UnsubscribeStatus>("idle");
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!router.isReady) return;
+    const value = router.query.token;
+    if (typeof value === "string") {
+      setToken(value);
+    } else if (Array.isArray(value)) {
+      setToken(value[0] ?? "");
+    } else {
+      setToken("");
+    }
+  }, [router.isReady, router.query.token]);
+
+  const handleUnsubscribe = async () => {
+    if (!token) {
+      setStatus("error");
+      setErrorMessage(
+        t`Your unsubscribe link is missing a token. Please open the latest email and try again.`,
+      );
+      return;
+    }
+
+    setStatus("processing");
+    setErrorMessage(null);
+
+    try {
+      const response = await fetch("/api/unsubscribe", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token }),
+      });
+
+      if (!response.ok) {
+        const payload = (await response.json().catch(() => null)) as {
+          error?: string;
+        } | null;
+
+        throw new Error(
+          payload?.error ??
+            "We couldn't update your preferences. Please try again.",
+        );
+      }
+
+      setStatus("success");
+    } catch (error) {
+      setStatus("error");
+      setErrorMessage(
+        t`We couldn't update your preferences. Please try again.`,
+      );
+    }
+  };
+
+  const title = t`Unsubscribe`;
+
+  return (
+    <>
+      <PageHead title={`${title} | kan.bn`} />
+      <div className="relative flex min-h-screen items-center justify-center px-4 py-12 sm:px-6 lg:px-8">
+        <PatternedBackground />
+        <div className="z-10 w-full max-w-md space-y-6">
+          <div>
+            <h1 className="mt-6 text-center text-3xl font-bold tracking-tight text-light-1000 dark:text-dark-1000">
+              {t`Do you want to unsubscribe?`}
+            </h1>
+            <p className="mt-4 text-center text-sm text-light-900 dark:text-dark-800">
+              {t`Confirm your email preferences:`}
+            </p>
+          </div>
+
+          <div className="flex justify-center">
+            <Button
+              onClick={handleUnsubscribe}
+              disabled={status === "success"}
+              isLoading={status === "processing"}
+              variant="primary"
+              size="md"
+            >
+              {t`Unsubscribe`}
+            </Button>
+          </div>
+          {status === "success" && (
+            <p className="text-center text-sm text-light-900 dark:text-dark-800">
+              {t`You have been unsubscribed!`}
+            </p>
+          )}
+          {status === "error" && (
+            <p className="mx-auto max-w-[300px] text-center text-sm font-medium text-red-600 dark:text-red-400">
+              {errorMessage}
+            </p>
+          )}
+        </div>
+      </div>
+    </>
+  );
+}

apps/web/src/providers/keyboard-shortcuts.tsx

@@ -0,0 +1,611 @@
+import type { ReactNode } from "react";
+import React from "react";
+import {
+  Dialog,
+  DialogBackdrop,
+  DialogPanel,
+  DialogTitle,
+} from "@headlessui/react";
+import { t } from "@lingui/core/macro";
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { HiXMark } from "react-icons/hi2";
+
+import { env } from "~/env";
+import { useEventListener } from "~/hooks/useEventListener";
+
+const ModifierKey = {
+  CONTROL: "CONTROL",
+  META: "META",
+  ALT: "ALT",
+  SHIFT: "SHIFT",
+} as const;
+type ModifierKey = (typeof ModifierKey)[keyof typeof ModifierKey];
+
+const ModifierKeyInfo: Record<
+  ModifierKey,
+  {
+    macSymbol: string;
+    winName: string;
+    linuxName: string;
+  }
+> = {
+  CONTROL: { macSymbol: "⌃", winName: "Ctrl", linuxName: "Ctrl" },
+  META: { macSymbol: "⌘", winName: "Win", linuxName: "Super" },
+  ALT: { macSymbol: "⌥", winName: "Alt", linuxName: "Alt" },
+  SHIFT: { macSymbol: "⇧", winName: "Shift", linuxName: "Shift" },
+};
+
+const ShortcutGroup = {
+  GENERAL: "GENERAL",
+  NAVIGATION: "NAVIGATION",
+  ACTIONS: "ACTIONS",
+} as const;
+type ShortcutGroup = (typeof ShortcutGroup)[keyof typeof ShortcutGroup];
+
+const getShortcutGroupInfo = (): Record<ShortcutGroup, { label: string }> => ({
+  GENERAL: { label: t`General` },
+  NAVIGATION: { label: t`Navigation` },
+  ACTIONS: { label: t`Actions` },
+});
+
+interface KeyStroke {
+  key: string;
+  modifiers?: ModifierKey[];
+}
+
+interface Press {
+  type: "PRESS";
+  stroke: KeyStroke;
+}
+
+interface Sequence {
+  type: "SEQUENCE";
+  strokes: KeyStroke[];
+}
+
+export type KeyboardShortcut = {
+  action: () => void;
+  description: string;
+  group: ShortcutGroup;
+} & (Press | Sequence);
+
+interface ShortcutTreeStepNode {
+  type: "STEP";
+  children: ShortcutTreeLevel;
+}
+interface ShortcutTreeActionNode {
+  type: "ACTION";
+  shortcut: KeyboardShortcut;
+}
+type ShortcutTreeNode = ShortcutTreeStepNode | ShortcutTreeActionNode;
+type ShortcutTreeLevel = Record<string, ShortcutTreeNode>;
+
+const SEQUENCE_TIMEOUT_MS = 1000;
+
+const ShortcutConflictCode = {
+  ACTION_ON_SEQUENCE: "ACTION_ON_SEQUENCE",
+  DUPLICATE_ACTION: "DUPLICATE_ACTION",
+  SEQUENCE_ON_ACTION: "SEQUENCE_ON_ACTION",
+} as const;
+type ShortcutConflictCode = keyof typeof ShortcutConflictCode;
+
+interface ShortcutConflictErrorOptions {
+  code: ShortcutConflictCode;
+  shortcut: KeyboardShortcut;
+  conflictPath: string;
+  existingShortcut?: KeyboardShortcut;
+}
+
+class ShortcutConflictError extends Error {
+  public readonly code: ShortcutConflictCode;
+  public readonly shortcut: KeyboardShortcut;
+  public readonly conflictPath: string;
+  public readonly existingShortcut?: KeyboardShortcut;
+
+  constructor(options: ShortcutConflictErrorOptions) {
+    super(ShortcutConflictError.formatMessage(options));
+    this.name = "ShortcutConflictError";
+    this.code = options.code;
+    this.shortcut = options.shortcut;
+    this.conflictPath = options.conflictPath;
+    this.existingShortcut = options.existingShortcut;
+  }
+
+  private static stringifyShortcut(shortcut: KeyboardShortcut): string {
+    if (shortcut.type === "SEQUENCE") {
+      return shortcut.strokes.map(serializeKeyStroke).join(" → ");
+    }
+    return serializeKeyStroke(shortcut.stroke);
+  }
+
+  private static formatMessage(options: ShortcutConflictErrorOptions): string {
+    const formatted = ShortcutConflictError.stringifyShortcut(options.shortcut);
+    switch (options.code) {
+      case ShortcutConflictCode.ACTION_ON_SEQUENCE:
+        return `Cannot register "${formatted}": desired action conflicts with existing sequence at "${options.conflictPath}"`;
+      case ShortcutConflictCode.DUPLICATE_ACTION:
+        return `Cannot register "${formatted}": action already registered`;
+      case ShortcutConflictCode.SEQUENCE_ON_ACTION:
+        return `Cannot register "${formatted}": desired sequence conflicts with existing action at "${options.conflictPath}"`;
+    }
+  }
+}
+
+interface KeyboardShortcutContextType {
+  registerShortcut: (shortcut: KeyboardShortcut) => () => void;
+  openLegend: () => void;
+  openLegendKeys: ReactNode;
+}
+
+const KeyboardShortcutContext = createContext<
+  KeyboardShortcutContextType | undefined
+>(undefined);
+
+export function KeyboardShortcutProvider({
+  children,
+}: {
+  children: ReactNode;
+}) {
+  const treeRootRef = useRef<ShortcutTreeLevel>({});
+  const currentNodeRef = useRef<ShortcutTreeLevel>(treeRootRef.current);
+  const shortcutsRef = useRef<Map<string, KeyboardShortcut>>(new Map());
+  const sequenceTimeoutRef = useRef<NodeJS.Timeout | null>(null);
+
+  const [isLegendOpen, setIsLegendOpen] = useState(false);
+
+  const openLegendShortcut: KeyboardShortcut = useMemo(
+    () => ({
+      type: "PRESS",
+      stroke: {
+        key: "/",
+        modifiers: ["META"],
+      },
+      action: () => setIsLegendOpen(true),
+      description: t`Open keyboard shortcuts`,
+      group: ShortcutGroup.GENERAL,
+    }),
+    [setIsLegendOpen],
+  );
+
+  const handleKeyDown = useCallback((event: KeyboardEvent) => {
+    if (isTypingInInput(event)) {
+      return;
+    }
+
+    if (sequenceTimeoutRef.current) {
+      clearTimeout(sequenceTimeoutRef.current);
+      sequenceTimeoutRef.current = null;
+    }
+
+    const serializedKey = serializeEvent(event);
+    const node = currentNodeRef.current[serializedKey];
+
+    if (!node) {
+      currentNodeRef.current = treeRootRef.current;
+      return;
+    }
+
+    switch (node.type) {
+      case "STEP":
+        event.preventDefault();
+        currentNodeRef.current = node.children;
+        sequenceTimeoutRef.current = setTimeout(() => {
+          currentNodeRef.current = treeRootRef.current;
+        }, SEQUENCE_TIMEOUT_MS);
+        return;
+      case "ACTION":
+        event.preventDefault();
+        node.shortcut.action();
+        currentNodeRef.current = treeRootRef.current;
+        return;
+      default:
+        return;
+    }
+  }, []);
+
+  const registerShortcut = useCallback(
+    (shortcut: KeyboardShortcut): (() => void) => {
+      const strokes =
+        shortcut.type === "SEQUENCE" ? shortcut.strokes : [shortcut.stroke];
+
+      const path = strokes.map(serializeKeyStroke);
+      const pathKey = path.join(" → ");
+
+      path.reduce((currentLevel, key, i) => {
+        const isLast = i === path.length - 1;
+        const existingNode = currentLevel[key];
+
+        if (env.NODE_ENV === "development" && existingNode) {
+          const conflictPath = path.slice(0, i + 1).join(" → ");
+          validateNoConflict(existingNode, isLast, shortcut, conflictPath);
+        }
+
+        if (isLast) {
+          currentLevel[key] = {
+            type: "ACTION",
+            shortcut,
+          };
+          return currentLevel;
+        }
+
+        if (existingNode?.type === "STEP") {
+          return existingNode.children;
+        }
+
+        const newNode: ShortcutTreeStepNode = {
+          type: "STEP",
+          children: {},
+        };
+        currentLevel[key] = newNode;
+        return newNode.children;
+      }, treeRootRef.current);
+
+      shortcutsRef.current.set(pathKey, shortcut);
+
+      return () => {
+        removePathAndPrune(treeRootRef.current, path);
+        shortcutsRef.current.delete(pathKey);
+      };
+    },
+    [],
+  );
+
+  useEventListener("keydown", handleKeyDown);
+
+  // Register built-in shortcut to open legend
+  useEffect(() => {
+    const cleanup = registerShortcut(openLegendShortcut);
+    return cleanup;
+  }, [registerShortcut, openLegendShortcut]);
+
+  // Cleanup timeout on unmount
+  useEffect(() => {
+    return () => {
+      if (sequenceTimeoutRef.current) {
+        clearTimeout(sequenceTimeoutRef.current);
+      }
+    };
+  }, []);
+
+  const shortcutsArray = Array.from(shortcutsRef.current.values());
+  const groupedShortcuts = shortcutsArray.reduce<
+    Partial<Record<ShortcutGroup, KeyboardShortcut[]>>
+  >((acc, shortcut) => {
+    const group = shortcut.group;
+    acc[group] ??= [];
+    acc[group].push(shortcut);
+    return acc;
+  }, {});
+
+  const openLegend = useCallback(() => {
+    setIsLegendOpen(true);
+  }, []);
+
+  const openLegendKeys = useMemo(
+    () => <FormattedShortcut shortcut={openLegendShortcut} />,
+    [openLegendShortcut],
+  );
+
+  return (
+    <KeyboardShortcutContext.Provider
+      value={{ registerShortcut, openLegend, openLegendKeys }}
+    >
+      {children}
+
+      {/* Shortcut Legend */}
+      <Dialog
+        className="relative z-50"
+        open={isLegendOpen}
+        onClose={() => setIsLegendOpen(false)}
+      >
+        <DialogBackdrop
+          transition
+          className="data-closed:opacity-0 data-enter:duration-300 data-enter:ease-out data-leave:duration-200 data-leave:ease-in fixed inset-0 bg-light-50 bg-opacity-40 transition-opacity dark:bg-dark-50 dark:bg-opacity-40"
+        />
+
+        <div className="fixed inset-0 flex min-h-full w-screen items-center justify-center overflow-y-auto p-4">
+          <DialogPanel
+            transition
+            className="relative w-full max-w-sm transform overflow-hidden rounded-lg border border-light-600 bg-white shadow-3xl-light dark:border-dark-600 dark:bg-dark-100 dark:shadow-3xl-dark"
+          >
+            <div className="flex items-center justify-between border-b border-light-300 px-6 py-4 dark:border-dark-300">
+              <DialogTitle className="text-[14px] font-semibold text-neutral-900 dark:text-dark-1000">
+                {t`Keyboard Shortcuts`}
+              </DialogTitle>
+              <button
+                onClick={() => setIsLegendOpen(false)}
+                className="rounded p-1 hover:bg-light-200 dark:hover:bg-dark-200"
+              >
+                <HiXMark className="h-5 w-5 text-neutral-700 dark:text-dark-700" />
+              </button>
+            </div>
+
+            <div className="max-h-[60vh] overflow-y-auto p-6">
+              {shortcutsArray.length === 0 ? (
+                <p className="text-center text-sm text-neutral-600 dark:text-dark-600">
+                  {t`No keyboard shortcuts registered.`}
+                </p>
+              ) : (
+                <div className="space-y-6">
+                  {Object.values(ShortcutGroup).map((group, idx) => {
+                    const shortcuts = groupedShortcuts[group];
+                    if (!shortcuts?.length) return null;
+                    const groupInfo = getShortcutGroupInfo();
+                    return (
+                      <div key={`${group}-${idx}`}>
+                        <h3 className="mb-3 text-xs font-semibold uppercase tracking-wide text-light-1000 dark:text-dark-1000">
+                          {groupInfo[group].label}
+                        </h3>
+                        <div className="flex flex-col gap-y-2">
+                          {shortcuts.map((shortcut) => (
+                            <ShortcutListItem
+                              key={shortcut.description}
+                              shortcut={shortcut}
+                            />
+                          ))}
+                        </div>
+                      </div>
+                    );
+                  })}
+                </div>
+              )}
+            </div>
+          </DialogPanel>
+        </div>
+      </Dialog>
+    </KeyboardShortcutContext.Provider>
+  );
+}
+
+/**
+ * Hook to register a keyboard shortcut. Cleanup is handled automatically.
+ * Returns both formatted keys and pre-built tooltip content.
+ *
+ * IMPORTANT: The shortcut object reference must be stable. If it changes
+ * on every render, the shortcut will be continuously registered and unregistered.
+ *
+ * @example
+ * ```tsx
+ * const { keys, tooltipContent } = useKeyboardShortcut({
+ *   type: "PRESS",
+ *   stroke: { key: "k", modifiers: ["META"] },
+ *   action: () => openCommandPalette(),
+ *   description: "Open command palette",
+ *   group: "GENERAL"
+ * });
+ *
+ * // Use tooltip for Tooltip component
+ * <Tooltip content={tooltipContent}>
+ *   <button>Search</button>
+ * </Tooltip>
+ *
+ * // Or use keys directly for custom formatting
+ * <span>Press {keys} to search</span>
+ * ```
+ */
+export function useKeyboardShortcuts(): KeyboardShortcutContextType {
+  const context = useContext(KeyboardShortcutContext);
+
+  if (!context) {
+    throw new Error(
+      "useKeyboardShortcuts must be used within KeyboardShortcutProvider",
+    );
+  }
+
+  return context;
+}
+
+export function useKeyboardShortcut(shortcut: KeyboardShortcut): {
+  keys: ReactNode;
+  tooltipContent: ReactNode;
+} {
+  const context = useContext(KeyboardShortcutContext);
+
+  if (!context) {
+    throw new Error(
+      "useKeyboardShortcut must be used within KeyboardShortcutProvider",
+    );
+  }
+
+  const { registerShortcut } = context;
+
+  useEffect(() => {
+    const cleanup = registerShortcut(shortcut);
+    return cleanup;
+  }, [shortcut, registerShortcut]);
+
+  const keys = <FormattedShortcut shortcut={shortcut} />;
+  const tooltipContent = (
+    <div className="flex flex-row items-center gap-2 text-[11px]">
+      {shortcut.description} {keys}
+    </div>
+  );
+
+  return { keys, tooltipContent };
+}
+
+function ShortcutListItem({ shortcut }: { shortcut: KeyboardShortcut }) {
+  return (
+    <div className="flex items-center justify-between gap-2">
+      <span className="text-sm text-dark-50 dark:text-dark-900">
+        {shortcut.description}
+      </span>
+      <FormattedShortcut shortcut={shortcut} />
+    </div>
+  );
+}
+
+function FormattedShortcut({ shortcut }: { shortcut: KeyboardShortcut }) {
+  const kbdClassName =
+    "inline-flex h-5 w-5 items-center justify-center rounded border border-light-400 bg-light-200 px-1.5 py-0.5 font-mono text-[8px] font-semibold text-center text-neutral-900 dark:border-dark-400 dark:bg-dark-200 dark:text-dark-950";
+
+  const stringifyModifier = (modifier: ModifierKey): string => {
+    const isMac =
+      typeof navigator !== "undefined" && navigator.userAgent.includes("Mac");
+    const isLinux =
+      typeof navigator !== "undefined" && navigator.userAgent.includes("Linux");
+
+    const info = ModifierKeyInfo[modifier];
+    if (isMac) return info.macSymbol;
+    if (isLinux) return info.linuxName;
+    return info.winName;
+  };
+
+  const formatStroke = (stroke: KeyStroke): ReactNode[] => {
+    const parts: ReactNode[] = [];
+    const modifierStrings = stroke.modifiers
+      ? stroke.modifiers.map(stringifyModifier)
+      : [];
+
+    modifierStrings.forEach((mod, index) => {
+      parts.push(
+        <kbd key={`mod-${index}-${mod}`} className={kbdClassName}>
+          {mod}
+        </kbd>,
+      );
+    });
+
+    parts.push(
+      <kbd key={`key-${stroke.key}`} className={kbdClassName}>
+        {stroke.key.toUpperCase()}
+      </kbd>,
+    );
+
+    return parts;
+  };
+
+  if (shortcut.type === "SEQUENCE") {
+    const parts: ReactNode[] = [];
+    shortcut.strokes.forEach((stroke, strokeIndex) => {
+      const strokeParts = formatStroke(stroke);
+      // Add stroke index to keys to ensure uniqueness across multiple strokes
+      const keyedParts = strokeParts.map((part, partIndex) => {
+        if (React.isValidElement(part)) {
+          return React.cloneElement(part, {
+            key: `stroke-${strokeIndex}-${part.key || partIndex}`,
+          });
+        }
+        return part;
+      });
+      parts.push(...keyedParts);
+    });
+    return <span className="flex items-center gap-1 text-[11px]">{parts}</span>;
+  }
+
+  return (
+    <span className="inline-flex flex-shrink-0 items-center gap-1 text-[11px]">
+      {formatStroke(shortcut.stroke)}
+    </span>
+  );
+}
+
+/** Checks for conflicts given existing nodes and current path
+ * Throws an error if conflict is found
+ *
+ */
+function validateNoConflict(
+  existingNode: ShortcutTreeNode,
+  isLastKey: boolean,
+  shortcut: KeyboardShortcut,
+  conflictPath: string,
+): void {
+  if (isLastKey) {
+    if (existingNode.type === "STEP") {
+      throw new ShortcutConflictError({
+        code: ShortcutConflictCode.ACTION_ON_SEQUENCE,
+        shortcut,
+        conflictPath,
+      });
+    } else {
+      throw new ShortcutConflictError({
+        code: ShortcutConflictCode.DUPLICATE_ACTION,
+        shortcut,
+        conflictPath,
+        existingShortcut: existingNode.shortcut,
+      });
+    }
+  } else if (existingNode.type === "ACTION") {
+    throw new ShortcutConflictError({
+      code: ShortcutConflictCode.SEQUENCE_ON_ACTION,
+      shortcut,
+      conflictPath,
+      existingShortcut: existingNode.shortcut,
+    });
+  }
+}
+
+/**
+ * Checks if the user is currently typing in an input field
+ */
+function isTypingInInput(event: KeyboardEvent): boolean {
+  if (!event.target) return false;
+
+  const target = event.target as HTMLElement;
+  const tagName = target.tagName.toLowerCase();
+  const isInput = tagName === "input" || tagName === "textarea";
+  const isContentEditable = target.isContentEditable;
+
+  return isInput || isContentEditable;
+}
+
+/**
+ * Serializes a KeyStroke to a consistent string format
+ * Returns lowercase string like "ctrl+shift+k" with alphabetically sorted modifiers
+ */
+function serializeKeyStroke(stroke: KeyStroke): string {
+  const key = stroke.key.toLowerCase();
+  if (!stroke.modifiers || stroke.modifiers.length === 0) return key;
+  const sorted = [...stroke.modifiers].sort();
+  return `${sorted.join("+")}+${key}`;
+}
+
+/**
+ * Converts a keyboard event to a KeyStroke
+ */
+function eventToKeyStroke(event: KeyboardEvent): KeyStroke {
+  const modifiers: ModifierKey[] = [];
+  if (event.altKey) modifiers.push(ModifierKey.ALT);
+  if (event.ctrlKey) modifiers.push(ModifierKey.CONTROL);
+  if (event.metaKey) modifiers.push(ModifierKey.META);
+  // Only include shift if the key is a letter (shift wasn't consumed to produce the character)
+  if (event.shiftKey && /^[a-zA-Z]$/.test(event.key))
+    modifiers.push(ModifierKey.SHIFT);
+  return { key: event.key, modifiers };
+}
+
+/**
+ * Serializes a keyboard event to a consistent string format
+ */
+function serializeEvent(event: KeyboardEvent): string {
+  return serializeKeyStroke(eventToKeyStroke(event));
+}
+
+/**
+ * Removes a path from the tree and prunes empty branches
+ */
+function removePathAndPrune(tree: ShortcutTreeLevel, path: string[]): void {
+  const [first, ...rest] = path;
+  if (!first) return;
+
+  if (rest.length === 0) {
+    delete tree[first];
+    return;
+  }
+
+  const node = tree[first];
+  if (!node || node.type !== "STEP") return;
+
+  removePathAndPrune(node.children, rest);
+
+  if (Object.keys(node.children).length === 0) {
+    delete tree[first];
+  }
+}

apps/web/src/providers/modal.tsx

@@ -59,7 +59,18 @@ export const ModalProvider: React.FC<Props> = ({ children }) => {
         entityLabel,
         closeOnClickOutside,
       };
-      setModalStack((prev) => [...prev, newModal]);
+      setModalStack((prev) => {
+        const last = prev[prev.length - 1];
+        if (
+          last &&
+          last.contentType === newModal.contentType &&
+          last.entityId === newModal.entityId &&
+          last.entityLabel === newModal.entityLabel
+        ) {
+          return prev; // prevent stacking duplicate modal on top
+        }
+        return [...prev, newModal];
+      });
     },
     [],
   );

apps/web/src/providers/workspace.tsx

@@ -32,7 +32,7 @@ const initialWorkspace: Workspace = {
 
 const initialAvailableWorkspaces: Workspace[] = [];
 
-const WorkspaceContext = createContext<WorkspaceContextProps | undefined>(
+export const WorkspaceContext = createContext<WorkspaceContextProps | undefined>(
   undefined,
 );
 

apps/web/src/styles/globals.css

@@ -39,3 +39,17 @@
     }
   }
 }
+
+/* Tippy.js tooltip theme */
+.tippy-box[data-theme~="tooltip"] {
+  @apply rounded-md border border-light-600 bg-white px-2 py-1 text-sm text-neutral-900 shadow-lg dark:border-dark-600 dark:bg-dark-100 dark:text-dark-1000;
+}
+
+.tippy-box[data-theme~="tooltip"] > .tippy-arrow::before {
+  @apply border-t-light-600 dark:border-t-dark-600;
+}
+
+.tippy-box[data-theme~="tooltip"][data-placement^="bottom"]
+  > .tippy-arrow::before {
+  @apply border-b-light-600 dark:border-b-dark-600;
+}

apps/web/src/utils/cardInvalidation.ts

@@ -0,0 +1,18 @@
+import type { api } from "~/utils/api";
+
+/**
+ * Invalidates all card-related queries for a given card.
+ * Use this after any mutation that affects card data or activities.
+ */
+export async function invalidateCard(
+  utils: ReturnType<typeof api.useUtils>,
+  cardPublicId: string,
+) {
+  if (!cardPublicId || cardPublicId.length < 12) return;
+  
+  await Promise.all([
+    utils.card.byId.invalidate({ cardPublicId }),
+    utils.card.getActivities.invalidate({ cardPublicId }),
+  ]);
+}
+

apps/web/src/utils/helpers.test.ts

@@ -0,0 +1,101 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("next-runtime-env", () => ({
+  env: vi.fn(),
+}));
+
+import { env } from "next-runtime-env";
+import { getAvatarUrl } from "./helpers";
+
+const mockEnv = env as ReturnType<typeof vi.fn>;
+
+describe("getAvatarUrl", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("returns empty string for null input", () => {
+    expect(getAvatarUrl(null)).toBe("");
+  });
+
+  it("returns empty string for empty string input", () => {
+    expect(getAvatarUrl("")).toBe("");
+  });
+
+  it("returns URL unchanged if already absolute http", () => {
+    expect(getAvatarUrl("http://example.com/avatar.jpg")).toBe(
+      "http://example.com/avatar.jpg",
+    );
+  });
+
+  it("returns URL unchanged if already absolute https", () => {
+    expect(getAvatarUrl("https://example.com/avatar.jpg")).toBe(
+      "https://example.com/avatar.jpg",
+    );
+  });
+
+  describe("path-style URLs (MinIO/LocalStack)", () => {
+    it("constructs path-style URL when STORAGE_DOMAIN is not set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_STORAGE_URL: "http://s3.localtest.me:9000",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "http://s3.localtest.me:9000/kan/user123/avatar.jpg",
+      );
+    });
+  });
+
+  describe("virtual-hosted URLs (Tigris/AWS S3)", () => {
+    it("constructs virtual-hosted URL when USE_VIRTUAL_HOSTED_URLS is true and STORAGE_DOMAIN is set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS: "true",
+          NEXT_PUBLIC_STORAGE_DOMAIN: "fly.storage.tigris.dev",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan-avatars",
+          NEXT_PUBLIC_STORAGE_URL: "https://fly.storage.tigris.dev",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "https://kan-avatars.fly.storage.tigris.dev/user123/avatar.jpg",
+      );
+    });
+
+    it("uses path-style URL when USE_VIRTUAL_HOSTED_URLS is false even if STORAGE_DOMAIN is set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS: "false",
+          NEXT_PUBLIC_STORAGE_DOMAIN: "fly.storage.tigris.dev",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan-avatars",
+          NEXT_PUBLIC_STORAGE_URL: "https://fly.storage.tigris.dev",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "https://fly.storage.tigris.dev/kan-avatars/user123/avatar.jpg",
+      );
+    });
+
+    it("uses path-style URL when USE_VIRTUAL_HOSTED_URLS is not set even if STORAGE_DOMAIN is set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_STORAGE_DOMAIN: "fly.storage.tigris.dev",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan-avatars",
+          NEXT_PUBLIC_STORAGE_URL: "https://fly.storage.tigris.dev",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "https://fly.storage.tigris.dev/kan-avatars/user123/avatar.jpg",
+      );
+    });
+  });
+});

apps/web/src/utils/helpers.ts

@@ -1,5 +1,3 @@
-import { env } from "next-runtime-env";
-
 export const formatToArray = (
   value: string | string[] | undefined,
 ): string[] => {
@@ -52,5 +50,5 @@ export const getAvatarUrl = (imageOrKey: string | null) => {
     return imageOrKey;
   }
 
-  return `${env("NEXT_PUBLIC_STORAGE_URL")}/${env("NEXT_PUBLIC_AVATAR_BUCKET_NAME")}/${imageOrKey}`;
+  return "";
 };

apps/web/src/utils/i18n.ts

@@ -22,6 +22,8 @@ const loadMessages = async (locale: Locale) => {
       return (await import("~/locales/ru/messages")).messages;
     case "pl":
       return (await import("~/locales/pl/messages")).messages;
+    case "pt-BR":
+      return (await import("~/locales/pt-BR/messages")).messages;
     default:
       return enMessages;
   }

apps/web/src/views/board/components/BoardDropdown.tsx

@@ -4,9 +4,12 @@ import {
   HiLink,
   HiOutlineDocumentDuplicate,
   HiOutlineTrash,
+  HiOutlineStar,
+  HiStar,
 } from "react-icons/hi2";
 
 import Dropdown from "~/components/Dropdown";
+import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
 import { usePopup } from "~/providers/popup";
 import { api } from "~/utils/api";
@@ -15,42 +18,104 @@ export default function BoardDropdown({
   isTemplate,
   isLoading,
   boardPublicId,
-  workspacePublicId,
+  isFavorite,
+  boardName,
 }: {
   isTemplate: boolean;
   isLoading: boolean;
   boardPublicId: string;
-  workspacePublicId: string;
+  isFavorite?: boolean;
+  boardName?: string;
 }) {
   const { openModal } = useModal();
-  return (
-    <Dropdown
-      disabled={isLoading}
-      items={[
-        ...(isTemplate
-          ? []
-          : [
-              {
-                label: t`Make template`,
-                action: () => openModal("CREATE_TEMPLATE"),
-                icon: (
-                  <HiOutlineDocumentDuplicate className="h-[16px] w-[16px] text-dark-900" />
-                ),
-              },
-              {
-                label: t`Edit board URL`,
-                action: () => openModal("UPDATE_BOARD_SLUG"),
-                icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
-              },
-            ]),
+  const { canEditBoard, canDeleteBoard, canCreateBoard } = usePermissions();
+  const { showPopup } = usePopup();
+  const utils = api.useUtils();
 
-        {
-          label: isTemplate ? t`Delete template` : t`Delete board`,
-          action: () => openModal("DELETE_BOARD"),
-          icon: <HiOutlineTrash className="h-[16px] w-[16px] text-dark-900" />,
-        },
-      ]}
-    >
+  const handleToggleFavorite = () => {
+    updateBoard.mutate({
+      boardPublicId,
+      favorite: !isFavorite,
+    });
+  };
+
+  const updateBoard = api.board.update.useMutation({
+    onSuccess: (data, variables) => {
+      void utils.board.all.invalidate();
+      void utils.board.byId.invalidate();
+
+      // Show popup notification
+      if (variables.favorite !== undefined) {
+        showPopup({
+          header: variables.favorite
+            ? t`Added to favorites`
+            : t`Removed from favorites`,
+          message: variables.favorite
+            ? t`${boardName ?? "Board"} has been added to your favorites.`
+            : t`${boardName ?? "Board"} has been removed from your favorites.`,
+          icon: "success",
+        });
+      }
+    },
+    onError: () => {
+      showPopup({
+        header: t`Unable to update board`,
+        message: t`Please try again later, or contact customer support.`,
+        icon: "error",
+      });
+    },
+  });
+  
+  const items = [
+    ...(isTemplate && canCreateBoard
+      ? [
+          {
+            label: t`Make template`,
+            action: () => openModal("CREATE_TEMPLATE"),
+            icon: (
+              <HiOutlineDocumentDuplicate className="h-[16px] w-[16px] text-dark-900" />
+            ),
+          },
+        ]
+      : []),
+    ...(!isTemplate && canEditBoard
+      ? [
+          {
+            label: t`Edit board URL`,
+            action: () => openModal("UPDATE_BOARD_SLUG"),
+            icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
+          },
+        ]
+      : []),
+    {
+      label: isFavorite
+        ? t`Remove from favorites`
+        : t`Add to favorites`,
+      action: handleToggleFavorite,
+      icon: isFavorite ? (
+        <HiStar className="h-[16px] w-[16px] text-dark-900" />
+      ) : (
+        <HiOutlineStar className="h-[16px] w-[16px] text-dark-900" />
+      ),
+    },
+    ...(canDeleteBoard
+      ? [
+          {
+            label: isTemplate ? t`Delete template` : t`Delete board`,
+            action: () => openModal("DELETE_BOARD"),
+            icon: <HiOutlineTrash className="h-[16px] w-[16px] text-dark-900" />,
+          },
+        ]
+      : []),
+  ];
+  
+
+  if (items.length === 0) {
+    return null;
+  }
+
+  return (
+    <Dropdown disabled={isLoading} items={items}>
       <HiEllipsisHorizontal className="h-5 w-5 text-dark-900" />
     </Dropdown>
   );

apps/web/src/views/board/components/Card.tsx

@@ -1,9 +1,17 @@
-import { HiBars3BottomLeft, HiChatBubbleLeft } from "react-icons/hi2";
+import { format, isBefore, isSameYear, startOfDay } from "date-fns";
+import { HiOutlinePaperClip } from "react-icons/hi";
+import {
+  HiBars3BottomLeft,
+  HiChatBubbleLeft,
+  HiOutlineClock,
+} from "react-icons/hi2";
+import { twMerge } from "tailwind-merge";
 
 import Avatar from "~/components/Avatar";
 import Badge from "~/components/Badge";
 import CircularProgress from "~/components/CircularProgress";
 import LabelIcon from "~/components/LabelIcon";
+import { useLocalisation } from "~/hooks/useLocalisation";
 import { getAvatarUrl } from "~/utils/helpers";
 
 const Card = ({
@@ -13,6 +21,8 @@ const Card = ({
   checklists,
   description,
   comments,
+  attachments,
+  dueDate,
 }: {
   title: string;
   labels: { name: string; colourCode: string | null }[];
@@ -33,7 +43,12 @@ const Card = ({
   }[];
   description: string | null;
   comments: { publicId: string }[];
+  attachments?: { publicId: string }[];
+  dueDate?: Date | null;
 }) => {
+  const { dateLocale } = useLocalisation();
+  const showYear = dueDate ? !isSameYear(dueDate, new Date()) : false;
+  const isOverdue = dueDate ? isBefore(dueDate, startOfDay(new Date())) : false;
   const completedItems = checklists.reduce((acc, checklist) => {
     return acc + checklist.items.filter((item) => item.completed).length;
   }, 0);
@@ -47,6 +62,8 @@ const Card = ({
 
   const hasDescription =
     description && description.replace(/<[^>]*>/g, "").trim().length > 0;
+  const hasAttachments = attachments && attachments.length > 0;
+  const hasDueDate = !!dueDate;
 
   return (
     <div className="flex flex-col rounded-md border border-light-200 bg-light-50 px-3 py-2 text-sm text-neutral-900 dark:border-dark-200 dark:bg-dark-200 dark:text-dark-1000 dark:hover:bg-dark-300">
@@ -55,7 +72,9 @@ const Card = ({
       members.length ||
       checklists.length > 0 ||
       hasDescription ||
-      comments.length > 0 ? (
+      comments.length > 0 ||
+      hasDueDate ||
+      hasAttachments ? (
         <div className="mt-2 flex flex-col justify-end">
           <div className="space-x-0.5">
             {labels.map((label) => (
@@ -72,11 +91,33 @@ const Card = ({
                   <HiBars3BottomLeft className="h-4 w-4" />
                 </div>
               )}
+              {hasDueDate && dueDate && (
+                <div
+                  className={twMerge(
+                    "flex items-center gap-1",
+                    isOverdue
+                      ? "text-red-600 dark:text-red-400"
+                      : "text-light-800 dark:text-dark-800",
+                  )}
+                >
+                  <HiOutlineClock className="h-4 w-4" />
+                  <span className="text-[11px]">
+                    {format(dueDate, showYear ? "do MMM yyyy" : "do MMM", {
+                      locale: dateLocale,
+                    })}
+                  </span>
+                </div>
+              )}
               {comments.length > 0 && (
                 <div className="flex items-center gap-1 text-light-700 dark:text-dark-800">
                   <HiChatBubbleLeft className="h-4 w-4" />
                 </div>
               )}
+              {hasAttachments && (
+                <div className="flex items-center gap-1 text-light-700 dark:text-dark-800">
+                  <HiOutlinePaperClip className="h-4 w-4" />
+                </div>
+              )}
             </div>
             <div className="flex items-center justify-end gap-1">
               {checklists.length > 0 && (