fix: use multipart upload for attachments to resolve chunk size error

feat: smart typography (#360 )
* build(web, deps): add `@tiptap/extension-typography` * feat(editor): add typography extension * chore(editor): disable some typographic characters * chore(editor): disable superscript
2026-02-07 22:41:47 +00:00 · 2026-02-07 20:04:37 +00:00 · 2026-02-07 19:34:06 +00:00 · 2026-02-06 23:34:23 +00:00 · 2026-02-06 23:31:08 +00:00 · 2026-02-05 21:52:40 +00:00
200 changed files with 28563 additions and 4249 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -15,4 +15,4 @@ pnpm-debug.log

 README.md
 .next
-.git
+# .git
--- a/.env.example
+++ b/.env.example
@@ -32,15 +32,23 @@ NEXT_PUBLIC_STORAGE_URL=
 NEXT_PUBLIC_AVATAR_BUCKET_NAME=
 NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME=
 NEXT_PUBLIC_STORAGE_DOMAIN=
+NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS=

 # Auth config (optional)
 NEXT_PUBLIC_ALLOW_CREDENTIALS=
 NEXT_PUBLIC_DISABLE_SIGN_UP=

+# API configuration (optional)
+NEXT_API_BODY_SIZE_LIMIT= # e.g. 50mb (defaults to 1mb)
+
 # Integration providers (optional)
 TRELLO_APP_API_KEY=
 TRELLO_APP_SECRET=

+# Redis (optional - for rate limiting)
+# If not provided, rate limiting will use in-memory storage
+REDIS_URL= # e.g. redis://default:your_password@your_host:6379
+
 # OAuth providers (optional)
 BETTER_AUTH_TRUSTED_ORIGINS=
 # Optional: Restrict OIDC/Social sign-ins to specific email domains (comma-separated)
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -34,6 +34,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0

      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
@@ -74,6 +76,42 @@ jobs:
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}

+      # Extract version from git tag or ref
+      # Uses git describe to get latest tag + commit hash in SemVer format: 1.2.3+abc1234
+      - name: Extract version
+        id: version
+        run: |
+          if [[ "${{ github.ref_type }}" == "tag" ]]; then
+            VERSION="${{ github.ref_name }}"
+            # Remove 'v' prefix if present
+            VERSION="${VERSION#v}"
+          else
+            # Use git describe and simplify: v1.2.3-5-gabc1234 -> 1.2.3+abc1234
+            GIT_DESCRIBE=$(git describe --tags --always --long 2>/dev/null || echo "")
+            if [[ -n "$GIT_DESCRIBE" ]]; then
+              # Match pattern: v1.2.3-5-gabc1234 (tag-commits-gcommit)
+              if [[ "$GIT_DESCRIBE" =~ ^v?([0-9]+\.[0-9]+\.[0-9]+)-[0-9]+-g([a-f0-9]+)$ ]]; then
+                # Format as tag+commit (SemVer build metadata)
+                TAG_VERSION="${BASH_REMATCH[1]}"
+                COMMIT_HASH="${BASH_REMATCH[2]}"
+                VERSION="${TAG_VERSION}+${COMMIT_HASH:0:7}"
+              elif [[ "$GIT_DESCRIBE" =~ ^v?([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
+                # Exactly on a tag
+                VERSION="${BASH_REMATCH[1]}"
+              else
+                # Fallback: just commit hash
+                COMMIT_SHA="${{ github.sha }}"
+                VERSION="${COMMIT_SHA:0:7}"
+              fi
+            else
+              # No tags exist, use commit hash
+              COMMIT_SHA="${{ github.sha }}"
+              VERSION="${COMMIT_SHA:0:7}"
+            fi
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION"
+
      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
@@ -86,6 +124,8 @@ jobs:
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            APP_VERSION=${{ steps.version.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

--- a/.gitignore
+++ b/.gitignore
@@ -34,6 +34,7 @@ yarn-error.log*
 .env
 .env*.local

+
 # vercel
 .vercel

--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,315 @@
+# AGENTS.md
+
+## Project Overview
+
+Kan is an open-source project management tool (Trello alternative) built with:
+
+- **Frontend**: Next.js, React, TypeScript, Tailwind CSS
+- **Backend**: tRPC, Node.js
+- **Database**: PostgreSQL with Drizzle ORM
+- **Monorepo**: pnpm workspaces with Turbo
+- **Auth**: Better Auth
+- **Internationalization**: Lingui
+
+## Setup Commands
+
+- Install deps: `pnpm install`
+- Start dev server: `pnpm dev`
+- Create migrations: `cd packages/db && pnpm drizzle-kit generate --name "AddFieldToTable"`
+- Run database migrations: `pnpm db:migrate`
+- Run linter: `pnpm lint`
+- Run type check: `pnpm typecheck`
+- Format code: `pnpm format:fix`
+- Extract i18n strings: `pnpm lingui:extract`
+
+## Project Structure
+
+- `apps/web/` - Next.js web application
+- `packages/api/` - tRPC API routers
+- `packages/db/` - Database schema, migrations, and repositories
+- `packages/auth/` - Authentication package
+- `packages/shared/` - Shared utilities
+- `packages/email/` - Email templates and sending
+- `packages/stripe/` - Stripe integration
+- `tooling/` - Shared tooling configs (ESLint, Prettier, TypeScript)
+
+## Code Style
+
+### TypeScript
+
+- Use TypeScript strictly - avoid `any` types
+- Prefer explicit types over inference when it improves clarity
+- Use `as const` for literal types when appropriate
+- Follow existing patterns for type definitions
+
+### Naming Conventions
+
+- **Files**: kebab-case for files (e.g., `card-repo.ts`)
+- **Components**: PascalCase for React components
+- **Functions**: camelCase for functions
+- **Constants**: UPPER_SNAKE_CASE for constants
+- **Types/Interfaces**: PascalCase
+
+### Database Layer (`packages/db/`)
+
+- **Schema**: Define schemas in `src/schema/` using Drizzle ORM
+- **Migrations**: Create migrations with `cd packages/db && pnpm drizzle-kit generate --name "MigrationName"`, then run with `pnpm db:migrate`
+- **Repositories**: Put database queries in `src/repository/` files
+- **Soft Deletes**: Use `deletedAt` timestamp for soft deletion (not hard deletes)
+- **Index Management**: Cards have `index` fields that must be maintained sequentially per list
+- **Activity Logging**: Use `card_activity` table to track all card changes
+
+### API Layer (`packages/api/`)
+
+- **Routers**: Create tRPC routers in `src/routers/`
+- **Procedures**: Use `protectedProcedure` for authenticated endpoints, `publicProcedure` for public
+- **Validation**: Use Zod schemas for input validation
+- **Error Handling**: Use `TRPCError` with appropriate error codes
+- **OpenAPI**: Add OpenAPI metadata for all endpoints
+- **Authorization**: Always check workspace membership with `assertUserInWorkspace`
+
+### Frontend (`apps/web/`)
+
+- **Components**: React components in `src/components/`
+- **Views**: Page-level components in `src/views/`
+- **Hooks**: Custom hooks in `src/hooks/`
+- **i18n**: Use `t` template literal for translations (Lingui)
+- **Styling**: Use Tailwind CSS classes
+- **State Management**: Use tRPC React Query hooks for server state
+- **Modals**: Use `useModal` hook for modal management
+- **Popups**: Use `usePopup` hook for toast notifications
+
+## Key Concepts
+
+### Cards
+
+- Cards are the main entity in Kan
+- Cards belong to Lists, which belong to Boards
+- Cards have: title, description, labels, members, checklists, comments, attachments, due dates
+- Cards use soft deletion (`deletedAt` field)
+- Cards have an `index` field that must be maintained sequentially per list
+- All card changes are tracked in `card_activity` table
+
+### Activity Tracking
+
+- Every significant card change creates an activity record
+- Activity types include: created, updated (various fields), etc.
+- Activities are displayed in card activity feeds
+
+### Workspaces & Boards
+
+- Users belong to Workspaces
+- Boards belong to Workspaces
+- Workspace members have different permission levels
+- Boards can be public or private
+
+### Soft Deletion Pattern
+
+- Entities use `deletedAt` timestamp for soft deletion
+- Queries filter with `isNull(table.deletedAt)` to exclude deleted items
+
+## File Locations Reference
+
+### Database
+
+- Schema: `packages/db/src/schema/*.ts`
+- Repositories: `packages/db/src/repository/*.repo.ts`
+- Migrations: `packages/db/migrations/`
+
+### API
+
+- Routers: `packages/api/src/routers/*.ts`
+- Utils: `packages/api/src/utils/`
+- Types: `packages/api/src/types/`
+
+### Frontend
+
+- Components: `apps/web/src/components/`
+- Views: `apps/web/src/views/`
+- Pages: `apps/web/src/pages/`
+- Hooks: `apps/web/src/hooks/`
+- Utils: `apps/web/src/utils/`
+- Locales: `apps/web/src/locales/`
+
+## Database Patterns
+
+- **Soft Deletes**: Always filter with `isNull(table.deletedAt)` in queries
+- **Public IDs**: Use 12-character public IDs (`publicId`) for all user-facing entities
+- **Internal IDs**: Never expose internal database IDs (e.g., `id`, `cardId`, `listId`) in API responses or URLs - always use `publicId` externally
+- **Transactions**: Use database transactions for multi-step operations
+- **Index Management**: When deleting/moving cards, maintain sequential indices
+- **Activity Tracking**: Create activity records for all significant changes
+
+## API Patterns
+
+- **Input Validation**: Always validate inputs with Zod
+- **Error Messages**: Provide clear, user-friendly error messages
+- **Optimistic Updates**: Use tRPC's `onMutate` for optimistic UI updates
+- **Cache Invalidation**: Properly invalidate queries after mutations
+- **ID Exposure**: Never expose internal database IDs (`id`, `cardId`, `listId`, etc.) in API responses, URLs, or frontend code - always use `publicId` for external communication
+
+## Important Patterns
+
+### Card Index Management
+
+When cards are created, moved, or deleted, their indices must be maintained:
+
+- New cards: Append to end (max index + 1) or insert at position
+- Moving cards: Adjust indices of affected cards
+- Deleting cards: Decrement indices of cards after deleted one
+- Always use transactions for index updates
+
+### Activity Logging
+
+Create activity records for:
+
+- Card creation
+- Card updates (title, description, list, etc.)
+- Label/member additions/removals
+- Comments
+- Checklists and items
+- Attachments
+- Due dates
+
+### Authorization
+
+Always check:
+
+1. User is authenticated
+2. User has access to workspace
+3. User has permission for the operation
+
+Use `assertUserInWorkspace` helper for workspace checks.
+
+### Error Handling
+
+- Use TRPCError with appropriate codes (UNAUTHORIZED, NOT_FOUND, etc.)
+- Provide user-friendly error messages
+- Log errors appropriately
+- Show popup notifications for user-facing errors
+
+## Common Patterns
+
+### Creating a Card
+
+1. Create card in repository with proper index management
+2. Create `card.created` activity
+3. Handle label/member relationships if provided
+4. Return the created card
+
+### Updating a Card
+
+1. Validate user has workspace access
+2. Update card fields
+3. Create appropriate activity records
+4. Invalidate relevant queries
+
+### Querying Cards
+
+- Always filter by `isNull(cards.deletedAt)` in queries
+- Include related data (labels, members, checklists) via Drizzle relations
+- Order by `index` for proper card ordering
+
+## Adding a New Feature
+
+1. **Database**: Update schema in `packages/db/src/schema/`
+2. **Migration**: Create migration with `cd packages/db && pnpm drizzle-kit generate --name "MigrationName"`, then run with `pnpm db:migrate`
+3. **Repository**: Add repository functions in `packages/db/src/repository/`
+4. **API**: Add tRPC router procedures in `packages/api/src/routers/`
+5. **Frontend**: Add UI components in `apps/web/src/`
+6. **i18n**: Add translations for new strings
+
+## Database Changes
+
+- Always create migrations (never modify existing migrations)
+- Create migrations with: `cd packages/db && pnpm drizzle-kit generate --name "MigrationName"`
+- Run migrations with: `pnpm db:migrate`
+- Update schema files in `packages/db/src/schema/`
+- Test migrations on development database first
+- Update TypeScript types after schema changes
+- Consider index management for card operations
+
+## API Endpoints
+
+- Use tRPC procedures (not REST)
+- Add OpenAPI metadata for documentation
+- Validate inputs with Zod
+- Check workspace permissions
+- Create activity records for significant changes
+
+## Frontend Components
+
+- Use Tailwind for styling
+- Follow existing component patterns
+- Use tRPC hooks for data fetching
+- Implement optimistic updates where appropriate
+- Add proper loading and error states
+
+## Testing Instructions
+
+- Test database operations in transactions that rollback
+- Test authorization checks
+- Test index management when moving/deleting cards
+- Test activity logging
+- Test UI interactions
+- Run `pnpm lint` and `pnpm typecheck` before committing
+
+## Performance Considerations
+
+- Use database indexes appropriately
+- Batch operations when possible
+- Avoid N+1 queries
+- Use transactions for related operations
+- Implement optimistic updates in UI
+
+## Security
+
+- Always check workspace membership before operations
+- Validate all inputs
+- Never expose internal database IDs (`id`, `cardId`, `listId`, etc.) in API responses, URLs, or frontend code - always use `publicId` externally
+- Sanitize user input
+
+## Internationalization
+
+- All user-facing strings must use `t` template literal
+- Add translations to locale files in `apps/web/src/locales/`
+- Run `pnpm lingui:extract` to update translation files
+- Update locale files for all languages
+
+## Dependencies
+
+- Use workspace dependencies (`workspace:*`) for internal packages
+- Keep dependencies up to date
+- Use catalog for shared dependency versions
+
+## When Implementing Features
+
+### Adding New Card Fields
+
+1. Update schema in `packages/db/src/schema/cards.ts`
+2. Create migration
+3. Update repository functions
+4. Add API endpoints
+5. Update frontend components
+6. Add activity tracking if needed
+
+### Adding New Activity Types
+
+1. Add to `activityTypes` array in schema
+2. Create migration to update enum
+3. Use in activity creation code
+4. Update activity display components if needed
+
+## Git & Commits
+
+- Use conventional commits: `feat:`, `fix:`, `refactor:`, `docs:`, etc.
+- Keep commits focused on single changes
+- Reference issue numbers when applicable
+
+## PR Instructions
+
+- Title format: `feat: description` or `fix: description`
+- Always run `pnpm lint` and `pnpm typecheck` before committing
+- Provide clear description of changes
+- Include screenshots for UI changes
+- Keep PRs focused on a single feature/fix
--- a/README.md
+++ b/README.md
@@ -47,7 +47,17 @@ See our [roadmap](https://kan.bn/kan/roadmap) for upcoming features.

 ## Self Hosting 🐳

-The easiest way to self-host Kan is with Docker Compose. This will set up everything for you including your postgres database.
+### One-click Deployments
+
+The easiest way to deploy Kan is through Railway. We've partnered with Railway to maintain an official template that supports the development of the project.
+
+<a href="https://railway.com/deploy/kan?referralCode=bZPsr2&utm_medium=integration&utm_source=template&utm_campaign=generic">
+  <img src="https://railway.app/button.svg" alt="Deploy on Railway" height="40" />
+</a>
+
+### Docker Compose
+
+Alternatively, you can self-host Kan with Docker Compose. This will set up everything for you including your postgres database.

 1. Create a new file called `docker-compose.yml` and paste the following configuration:

@@ -138,44 +148,48 @@ pnpm dev

 ## Environment Variables 🔐

-| Variable                                  | Description                                               | Required                 | Example                                                     |
-| ----------------------------------------- | --------------------------------------------------------- | ------------------------ | ----------------------------------------------------------- |
-| `POSTGRES_URL`                            | PostgreSQL connection URL                                 | To use external database | `postgres://user:pass@localhost:5432/db`                    |
-| `EMAIL_FROM`                              | Sender email address                                      | For Email                | `"Kan <hello@mail.kan.bn>"`                                 |
-| `SMTP_HOST`                               | SMTP server hostname                                      | For Email                | `smtp.resend.com`                                           |
-| `SMTP_PORT`                               | SMTP server port                                          | For Email                | `465`                                                       |
-| `SMTP_USER`                               | SMTP username/email                                       | No                       | `resend`                                                    |
-| `SMTP_PASSWORD`                           | SMTP password/token                                       | No                       | `re_xxxx`                                                   |
-| `SMTP_SECURE`                             | Use secure SMTP connection (defaults to true if not set)  | For Email                | `true`                                                      |
-| `SMTP_REJECT_UNAUTHORIZED`                | Reject invalid certificates (defaults to true if not set) | For Email                | `false`                                                     |
-| `NEXT_PUBLIC_DISABLE_EMAIL`               | To disable all email features                             | For Email                | `true`                                                      |
-| `NEXT_PUBLIC_BASE_URL`                    | Base URL of your installation                             | Yes                      | `http://localhost:3000`                                     |
-| `BETTER_AUTH_ALLOWED_DOMAINS`             | Comma-separated list of allowed domains for OIDC logins  | For OIDC/Social login    | `example.com,subsidiary.com`                                |
-| `BETTER_AUTH_SECRET`                      | Auth encryption secret                                    | Yes                      | Random 32+ char string                                      |
-| `BETTER_AUTH_TRUSTED_ORIGINS`             | Allowed callback origins                                  | No                       | `http://localhost:3000,http://localhost:3001`               |
-| `GOOGLE_CLIENT_ID`                        | Google OAuth client ID                                    | For Google login         | `xxx.apps.googleusercontent.com`                            |
-| `GOOGLE_CLIENT_SECRET`                    | Google OAuth client secret                                | For Google login         | `xxx`                                                       |
-| `DISCORD_CLIENT_ID`                       | Discord OAuth client ID                                   | For Discord login        | `xxx`                                                       |
-| `DISCORD_CLIENT_SECRET`                   | Discord OAuth client secret                               | For Discord login        | `xxx`                                                       |
-| `GITHUB_CLIENT_ID`                        | GitHub OAuth client ID                                    | For GitHub login         | `xxx`                                                       |
-| `GITHUB_CLIENT_SECRET`                    | GitHub OAuth client secret                                | For GitHub login         | `xxx`                                                       |
-| `OIDC_CLIENT_ID`                          | Generic OIDC client ID                                    | For OIDC login           | `xxx`                                                       |
-| `OIDC_CLIENT_SECRET`                      | Generic OIDC client secret                                | For OIDC login           | `xxx`                                                       |
-| `OIDC_DISCOVERY_URL`                      | OIDC discovery URL                                        | For OIDC login           | `https://auth.example.com/.well-known/openid-configuration` |
-| `TRELLO_APP_API_KEY`                      | Trello app API key                                        | For Trello import        | `xxx`                                                       |
-| `TRELLO_APP_API_SECRET`                   | Trello app API secret                                     | For Trello import        | `xxx`                                                       |
-| `S3_REGION`                               | S3 storage region                                         | For file uploads         | `WEUR`                                                      |
-| `S3_ENDPOINT`                             | S3 endpoint URL                                           | For file uploads         | `https://xxx.r2.cloudflarestorage.com`                      |
+| Variable                                  | Description                                               | Required                              | Example                                                     |
+| ----------------------------------------- | --------------------------------------------------------- | ------------------------------------- | ----------------------------------------------------------- |
+| `POSTGRES_URL`                            | PostgreSQL connection URL                                 | To use external database              | `postgres://user:pass@localhost:5432/db`                    |
+| `REDIS_URL`                               | Redis connection URL                                      | For rate limiting (optional)          | `redis://localhost:6379` or `redis://redis:6379` (Docker)   |
+| `EMAIL_FROM`                              | Sender email address                                      | For Email                             | `"Kan <hello@mail.kan.bn>"`                                 |
+| `SMTP_HOST`                               | SMTP server hostname                                      | For Email                             | `smtp.resend.com`                                           |
+| `SMTP_PORT`                               | SMTP server port                                          | For Email                             | `465`                                                       |
+| `SMTP_USER`                               | SMTP username/email                                       | No                                    | `resend`                                                    |
+| `SMTP_PASSWORD`                           | SMTP password/token                                       | No                                    | `re_xxxx`                                                   |
+| `SMTP_SECURE`                             | Use secure SMTP connection (defaults to true if not set)  | For Email                             | `true`                                                      |
+| `SMTP_REJECT_UNAUTHORIZED`                | Reject invalid certificates (defaults to true if not set) | For Email                             | `false`                                                     |
+| `NEXT_PUBLIC_DISABLE_EMAIL`               | To disable all email features                             | For Email                             | `true`                                                      |
+| `NEXT_PUBLIC_BASE_URL`                    | Base URL of your installation                             | Yes                                   | `http://localhost:3000`                                     |
+| `NEXT_API_BODY_SIZE_LIMIT`                | Maximum API request body size (defaults to 1mb)           | No                                    | `50mb`                                                      |
+| `BETTER_AUTH_ALLOWED_DOMAINS`             | Comma-separated list of allowed domains for OIDC logins   | For OIDC/Social login                 | `example.com,subsidiary.com`                                |
+| `BETTER_AUTH_SECRET`                      | Auth encryption secret                                    | Yes                                   | Random 32+ char string                                      |
+| `BETTER_AUTH_TRUSTED_ORIGINS`             | Allowed callback origins                                  | No                                    | `http://localhost:3000,http://localhost:3001`               |
+| `GOOGLE_CLIENT_ID`                        | Google OAuth client ID                                    | For Google login                      | `xxx.apps.googleusercontent.com`                            |
+| `GOOGLE_CLIENT_SECRET`                    | Google OAuth client secret                                | For Google login                      | `xxx`                                                       |
+| `DISCORD_CLIENT_ID`                       | Discord OAuth client ID                                   | For Discord login                     | `xxx`                                                       |
+| `DISCORD_CLIENT_SECRET`                   | Discord OAuth client secret                               | For Discord login                     | `xxx`                                                       |
+| `GITHUB_CLIENT_ID`                        | GitHub OAuth client ID                                    | For GitHub login                      | `xxx`                                                       |
+| `GITHUB_CLIENT_SECRET`                    | GitHub OAuth client secret                                | For GitHub login                      | `xxx`                                                       |
+| `OIDC_CLIENT_ID`                          | Generic OIDC client ID                                    | For OIDC login                        | `xxx`                                                       |
+| `OIDC_CLIENT_SECRET`                      | Generic OIDC client secret                                | For OIDC login                        | `xxx`                                                       |
+| `OIDC_DISCOVERY_URL`                      | OIDC discovery URL                                        | For OIDC login                        | `https://auth.example.com/.well-known/openid-configuration` |
+| `TRELLO_APP_API_KEY`                      | Trello app API key                                        | For Trello import                     | `xxx`                                                       |
+| `TRELLO_APP_API_SECRET`                   | Trello app API secret                                     | For Trello import                     | `xxx`                                                       |
+| `S3_REGION`                               | S3 storage region                                         | For file uploads                      | `WEUR`                                                      |
+| `S3_ENDPOINT`                             | S3 endpoint URL                                           | For file uploads                      | `https://xxx.r2.cloudflarestorage.com`                      |
 | `S3_ACCESS_KEY_ID`                        | S3 access key                                             | For file uploads (optional with IRSA) | `xxx`                                                       |
 | `S3_SECRET_ACCESS_KEY`                    | S3 secret key                                             | For file uploads (optional with IRSA) | `xxx`                                                       |
-| `S3_FORCE_PATH_STYLE`                     | Use path-style URLs for S3                                | For file uploads         | `true`                                                      |
-| `NEXT_PUBLIC_STORAGE_URL`                 | Storage service URL                                       | For file uploads         | `https://storage.kanbn.com`                                 |
-| `NEXT_PUBLIC_STORAGE_DOMAIN`              | Storage domain name                                       | For file uploads         | `kanbn.com`                                                 |
-| `NEXT_PUBLIC_AVATAR_BUCKET_NAME`          | S3 bucket name for avatars                                | For file uploads         | `avatars`                                                   |
-| `NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME`     | S3 bucket name for attachments                            | For file uploads         | `attachments`                                               |
-| `NEXT_PUBLIC_ALLOW_CREDENTIALS`           | Allow email & password login                              | For authentication       | `true`                                                      |
-| `NEXT_PUBLIC_DISABLE_SIGN_UP`             | Disable sign up                                           | For authentication       | `false`                                                     |
-| `NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY` | Hide “Powered by kan.bn” on public boards (self-host)     | For white labelling      | `true`                                                      |
+| `S3_FORCE_PATH_STYLE`                     | Use path-style URLs for S3                                | For file uploads                      | `true`                                                      |
+| `NEXT_PUBLIC_STORAGE_URL`                 | Storage service URL                                       | For file uploads                      | `https://storage.kanbn.com`                                 |
+| `NEXT_PUBLIC_STORAGE_DOMAIN`              | Storage domain name                                       | For file uploads                      | `kanbn.com`                                                 |
+| `NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS`     | Use virtual-hosted style URLs (bucket.domain.com)         | For file uploads (optional)           | `true`                                                      |
+| `NEXT_PUBLIC_AVATAR_BUCKET_NAME`          | S3 bucket name for avatars                                | For file uploads                      | `avatars`                                                   |
+| `NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME`     | S3 bucket name for attachments                            | For file uploads                      | `attachments`                                               |
+| `NEXT_PUBLIC_ALLOW_CREDENTIALS`           | Allow email & password login                              | For authentication                    | `true`                                                      |
+| `NEXT_PUBLIC_DISABLE_SIGN_UP`             | Disable sign up                                           | For authentication                    | `false`                                                     |
+| `NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY` | Hide “Powered by kan.bn” on public boards (self-host)     | For white labelling                   | `true`                                                      |
+| `KAN_ADMIN_API_KEY`                       | Admin API key for stats and admin endpoints               | For admin/monitoring                  | `your-secret-admin-key`                                     |

 See `.env.example` for a complete list of supported environment variables.

--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -19,43 +19,45 @@ RUN pnpm config set store-dir ~/.pnpm-store

 # 2. Prune projects
 FROM base AS pruner
-# https://stackoverflow.com/questions/49681984/how-to-get-version-value-of-package-json-inside-of-dockerfile
-# RUN export VERSION=$(npm run version)
-
 ARG PROJECT

-# Set working directory
-WORKDIR /app
+RUN apk add --no-cache git

-# It might be the path to <ROOT> turborepo
+WORKDIR /app
 COPY . .
- 
-# Generate a partial monorepo with a pruned lockfile for a target workspace.
-# Assuming "@acme/nextjs" is the name entered in the project's package.json: { name: "@acme/nextjs" }
+
+# Generate version from git (fallback if APP_VERSION not provided)
+RUN git fetch --tags --unshallow 2>/dev/null || git fetch --tags 2>/dev/null || true && \
+    AUTO_VERSION=$(git describe --tags --always --long 2>/dev/null | \
+    sed -E 's/^v?([0-9]+\.[0-9]+\.[0-9]+)-[0-9]+-g([a-f0-9]{7}).*/\1+\2/' | \
+    sed 's/^v//' || \
+    git rev-parse --short HEAD 2>/dev/null | head -c 7 || \
+    echo "unknown") && \
+    echo "$AUTO_VERSION" > /app/AUTO_VERSION
+
 RUN turbo prune --scope=${PROJECT} --scope=@kan/db --docker
 
 # 3. Build the project
 FROM base AS builder
 ARG PROJECT
-
-# Environment to skip .env validation on build
-ENV CI=true
+ARG APP_VERSION

 WORKDIR /app

-# Copy lockfile and package.json's of isolated subworkspace
 COPY --from=pruner /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
 COPY --from=pruner /app/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
 COPY --from=pruner /app/out/json/ .
+COPY --from=pruner /app/AUTO_VERSION /tmp/AUTO_VERSION
+
+ENV CI=true

-# First install the dependencies (as they change less often)
 RUN --mount=type=cache,id=pnpm,target=~/.pnpm-store pnpm install --frozen-lockfile
 
-# Copy source code of isolated subworkspace
 COPY --from=pruner /app/out/full/ .

-
-RUN pnpm build --filter=${PROJECT}
+# Use provided APP_VERSION or auto-generated from pruner stage
+RUN VERSION="${APP_VERSION:-$(cat /tmp/AUTO_VERSION 2>/dev/null | tr -d '\n\r' || echo 'unknown')}" && \
+    NEXT_PUBLIC_APP_VERSION="$VERSION" pnpm build --filter=${PROJECT}

 # # Copy static files to standalone directory
 # RUN mkdir -p apps/web/.next/standalone/.next && \
--- a/apps/web/i18n.json
+++ b/apps/web/i18n.json
@@ -2,7 +2,7 @@
  "version": 0,
  "locale": {
    "source": "en",
-    "targets": ["fr", "de", "es", "it", "nl", "ru", "pl", "ptbr"]
+    "targets": ["fr", "de", "es", "it", "nl", "ru", "pl", "pt-BR"]
  },
  "buckets": {
    "po": {
--- a/apps/web/i18n.lock
+++ b/apps/web/i18n.lock
@@ -5,6 +5,8 @@ checksums:
    "%2C%20or%20see%20our/singular": e8a8f2a078fcaea03481710dcaccce5d
    "%7B0%7D/singular": 18782768c8a0b3c2078747b34fbbcd24
    "%7B0%7D%20%7C%20%7B1%7D/singular": 4628f9c6ec13c2dc2984a6ab80e19f8b
+    "%7B0%7D%20has%20been%20added%20to%20your%20favorites./singular": 0f752180183c80703b3f9f39dc97195f
+    "%7B0%7D%20has%20been%20removed%20from%20your%20favorites./singular": 26e4b4997ad8a711d0b3e46337799454
    "%7B0%7D%20labels/singular": 785f92bedf786ff3e285adfc07c69d18
    "%7B0%7D%20not%20found/singular": a2665fc66f128fee1a80ffec61c9f1a1
    "%7BboardCount%2C%20plural%2C%20one%20%7BImport%20board%20(1)%7D%20other%20%7BImport%20boards%20(%7BboardCount%7D)%7D%7D/singular": 72358c550bd1a99fcb6e8952f0f947ef
@@ -27,6 +29,8 @@ checksums:
    Add%20details.../singular: 2f42547fd5d199f173aa7a88c8a9b19a
    Add%20label/singular: 0be732d46df263265935fda342097a08
    Add%20member/singular: 11979625770516ca287e929381778e02
+    Add%20to%20favorites/singular: 532155acb0a46f2b6c37e15afb3ad21e
+    added%20%7B0%7D%20labels%3A%20%3C0%3E%7BlabelList%7D%3C%2F0%3E/singular: 42b0488d570626dc887c58ff669c953c
    added%20a%20checklist/singular: 44304f4a5ef3a46378eea243b5d2df79
    added%20a%20checklist%20item/singular: 20bc0330dba5a9ec978e04bec174365a
    added%20a%20label%20to%20the%20card/singular: 04c5e4ee9b7b7e77ef089d2ac473d235
@@ -34,10 +38,14 @@ checksums:
    added%20checklist%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: fb6a852c50c1629f47c6f155fc93fdee
    added%20checklist%20item%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: bdd202da20b1fffbec21792c5453f90c
    added%20label%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: b32be052b3d57de0c9120fa7f9fc86ee
+    Added%20to%20favorites/singular: 848046ec65d15913112b466c544722eb
    Adding%20a%20new%20member%20will%20cost%20an%20additional%20%7Bprice%7D%20(%7BbillingType%7D)%20per%20seat./singular: 12e88573028306110fbc15ef1e714892
    Adjust%20the%20square%20crop%20to%20fit%20your%20avatar./singular: a4df26bbce6f14c6962fac1324db00a8
+    Admin/singular: 90eb20f1400db82ab874744e47836dc6
    Admin%20roles/singular: 32a5d78073b9bb9a246773afba8831df
+    All%20member%20permission%20overrides%20have%20been%20reset%20to%20their%20role%20defaults./singular: e5c38724a283373506d53afd22b6d096
    All%20systems%20operational/singular: ee943a4046b09e6334cceeea9fda2bfc
+    Allow%20workspace%20members%20to%20see%20each%20other's%20email%20addresses/singular: 0077436d9f37bfd64f3ae076a5a05040
    Already%20have%20an%20account%3F%20%3C0%3E%3C1%3ESign%20in%3C%2F1%3E%3C%2F0%3E/singular: 2959fd276248208b65cb27ed46b20135
    An%20error%20occurred%20while%20disconnecting%20your%20Trello%20account./singular: 0aa3973b860c1faf8d9123aebf567e40
    An%20unexpected%20error%20occurred.%20Please%20try%20again%20later./singular: 1b5749b0cca6a62d75a577bee6804074
@@ -86,6 +94,30 @@ checksums:
    Brainstorming/singular: 736332f2e4488609e42d2be8547d296e
    Bug/singular: 4509fffdb5931f8905063c80cf802d71
    Bug%20Report/singular: e558d1f100e21230c2f495a8913ac5ec
+    Can%20add%20comments/singular: d7d70b75780156312701f4c5eed1b285
+    Can%20create%20boards/singular: 8538236f8caafd4eaa751b4ec45f1699
+    Can%20create%20cards/singular: dd1cce2d52e0fb261676750bfc46da22
+    Can%20create%20lists/singular: 53c3c1343efff494640b1227e4444de2
+    Can%20delete%20boards/singular: 818ff50f9f21d8ed3741a7933d66b794
+    Can%20delete%20cards/singular: c62309a7e52958aa4bdb477c07d1855d
+    Can%20delete%20comments/singular: 99884fcaf89c47aa33c6ddfd9f94ea5f
+    Can%20delete%20lists/singular: 8d6ff6cd43c6b9fcbc9fc7954d19409e
+    Can%20delete%20workspace/singular: 41bd5a6636500b1a6e04184e6f566198
+    Can%20edit%20boards/singular: 8b77fabfd955d5507b1826dc4a5c1108
+    Can%20edit%20cards/singular: 47e6c92c1056fd6e8b517ba456b3f607
+    Can%20edit%20comments/singular: a0caeec2b2b64e9f371f07dabed5733d
+    Can%20edit%20lists/singular: 1ce5feb15139c881b615edab065b3e12
+    Can%20edit%20member%20roles%20and%20permissions/singular: c364e8e8866111a471f4081db0730049
+    Can%20edit%20workspace/singular: 9768f990844e215c06910fed250da23a
+    Can%20invite%20members/singular: e02e562bcb7f46008d9595e485951413
+    Can%20manage%20workspace%20settings/singular: 27eb18d3be5b3d813996b7d5071e0317
+    Can%20remove%20members/singular: 97a452b0fb4b661eaca7e5b3d5b49dcd
+    Can%20view%20boards/singular: 14977bbbb566f72fc74e17d99bad09bb
+    Can%20view%20cards/singular: 5e728083853948c9d618f2276732d5cd
+    Can%20view%20comments/singular: 76dbbc9ae4bff589d391c67c84ac6470
+    Can%20view%20lists/singular: e36331c4a49f376befc9f0aa42492b01
+    Can%20view%20members/singular: 5b75a467257a1db29d466c0d9ccea3df
+    Can%20view%20workspace/singular: 79a12c55fcd04ea69cbb85b906794e9b
    Cancel/singular: 2e2a849c2223911717de8caa2c71bade
    Card/singular: bba0beaced7ea954ceb980f2b022ffee
    Card%20not%20found/singular: 91509e2f92b0b3b11330b6983139fdbf
@@ -97,6 +129,9 @@ checksums:
    Check%20your%20inbox/singular: e9a430fcd298def74212238df0f680d6
    Checklist%20name/singular: 5eb5de823f7ca5a4d97bb41e6a3f675a
    Checklists/singular: 6f79129c8f08ee54d858a2af57d16dd9
+    Clear%20all%20custom%20permissions%3F/singular: 31d0962985c83a29558c98a765bb1b16
+    Clear%20any%20custom%20member%20permissions%20so%20that%20all%20members%20only%20inherit%20permissions%20from%20their%20role%20defaults./singular: e493291818059bfd51f2c87b938616c4
+    Clear%20custom%20permissions/singular: 288ce8688fd09c5a01eda5a6ba4bc98a
    Clear%20filters/singular: 8f40ab5af527e4b190da94e7b6221379
    Click%20on%20the%20link%20we've%20sent%20to%20%7BmagicLinkRecipient%7D%20to%20sign%20in./singular: 210b6ff8727f976182ec3f29ea3c7667
    Close/singular: 2c2e22f8424a1031de89063bd0022e16
@@ -111,6 +146,7 @@ checksums:
    Complete%20control%20and%20ownership%3A/singular: 0d8b682ba873272217425ccfc96aa9cd
    completed%20a%20checklist%20item/singular: 757b04c6c80cc927e1c597c0ad4fda33
    completed%20checklist%20item%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: 71ec18acf051fc909a48a07ca3578673
+    Configure%20which%20actions%20are%20allowed%20for%20each%20workspace%20role.%20These%20permissions%20apply%20to%20all%20members%20with%20that%20role./singular: 0a46a8a30c6c0ebdcd01e72a7d64ec64
    Confirm%20your%20email%20preferences%3A/singular: 043c161dd9866231ae2418fdd9f61b9c
    Confirm%20your%20new%20password/singular: a0d2935d7b63f8dd19d7c0de47524416
    Connect%20Trello/singular: 4440a0b9e387ef7136e3958e7a089213
@@ -122,6 +158,7 @@ checksums:
    Continue%20with%20/singular: 8ed03cf7c5e60a6edf3470a4558ff058
    Continue%20with%20%7B0%7D/singular: 2eaf6e1da91e208f7c5fb6bf862fe8a6
    Control%20who%20can%20view%20and%20edit%20your%20boards./singular: 2a7e0bec29bac26280de707e2fe8bce5
+    Convert%20to%20link/singular: 66210d2889031426c07f0b2c6c4c09d7
    Core%20features/singular: da95932e7a1465a5d21aa3b855a46dc2
    Create%20%7B0%7D/singular: d37c29be6ccc0eb6062237f8508c3178
    Create%20another/singular: 2de8a82a416eb78c0462aa36278edc9a
@@ -143,6 +180,7 @@ checksums:
    Current%20password%20is%20required/singular: 72536bca9598680027f2be8ce80ac280
    Custom%20board%20templates/singular: c2966b352d76bc53421c01e9c99474bb
    Custom%20domain/singular: b09e7a9c187b7163b4a6cfc78042fe42
+    Custom%20permissions/singular: 6f1748601979e2e4548877b292b43a20
    Custom%20templates/singular: f8caaad67e168f106a298c8e0a66240c
    Custom%20URLs%20require%20upgrading%20to%20a%20Pro%20plan/singular: f7275e3b473b8f7b39dab6b37eb26fea
    Custom%20workspace%20link/singular: 8a19ae46ccea9c54b65ae183cea70b44
@@ -182,14 +220,19 @@ checksums:
    Due%20next%20week/singular: 2f8fac5719df18d25a466ee913dc6487
    Due%20today/singular: a14cb9dd0003485894d328bb803c80e5
    Due%20tomorrow/singular: 0b6c8ad7aba0873b7e212d5f1949ca97
+    Edit/singular: eee7f39ff90b18852afc1671f21fbaa9
    Edit%20board%20URL/singular: d8276dfc0189f371ec7d80a2047c07aa
    Edit%20comment/singular: 7e4b46525fcb6b47b71798e31c46e374
    Edit%20label/singular: 0309e0be1512b1e0b0ceb87c69a53d03
+    Edit%20permissions/singular: 244558dd716491b7ed72ba8ab73aa28f
    Edit%20workspace%20URL/singular: bbae5f2f8a442947d33099979bbbe899
+    Edit%20YouTube%20Video/singular: 4899d9e990d291eb6e71ee40a8ee314b
    Editing/singular: 3449a7988cd69207b7c6929af1f4abf1
    email/singular: f31eb214738e037d58e26149797739df
    Email/singular: e7f34943a0c2fb849db1839ff6ef5cb5
+    Email%20visibility/singular: 81d41cf573a7109c376d30d905beb596
    Enhancement/singular: 785fe23c0eef0a5b60b5b2a88151de31
+    Enter%20a%20custom%20title/singular: f002074db0bd51d4f28d2736e140370a
    Enter%20your%20current%20password/singular: bfceabde4c0b6f2cb439015b76549651
    Enter%20your%20current%20password%20and%20choose%20a%20new%20secure%20password./singular: 9bb88155b18e98ea799c0e939d16af64
    Enter%20your%20email%20address/singular: 9bc008365ebe3e404e241c8ca876f56e
@@ -219,6 +262,7 @@ checksums:
    Failed%20to%20accept%20invitation.%20Please%20try%20again%20later%2C%20or%20contact%20customer%20support./singular: e4505a9df3a81e93a8a8b103c6e3ebc4
    Failed%20to%20copy%20invite%20link/singular: 635884d5ed8d6ee20b85a003939b4ae7
    Failed%20to%20create%20board/singular: a746e2afe881c3bf0a8e82a931ca3495
+    Failed%20to%20fetch%20video%20information/singular: 1e3fd610e8ed3e6c4c66e6ce88fc8b7a
    Failed%20to%20login%20with%20%7B0%7D.%20Please%20try%20again./singular: 669a4b4247a73f53fb9b8b16e42d166f
    Failed%20to%20upload%20attachment.%20Please%20try%20again./singular: f8a50d1c8491404f73d3cf701e11f297
    FAQ/singular: 47e0ee2eb40b4e7e732e05e2233fc71c
@@ -254,6 +298,7 @@ checksums:
    Go%20to%20members/singular: 445f4efbc4b1e7509f4fd79ebfbb1476
    Go%20to%20settings/singular: 24a7f96880650c9b37099d69f4b7e2a9
    Go%20to%20templates/singular: e4e58e33d637282d141df466d729bc7c
+    Guest/singular: 2aec6d6ebe0d9a1db0a5c8cd5a98b8c3
    High%20Priority/singular: 5d231ff8254aabc875f194c4b4f49c97
    Hired/singular: e5a9b1bd409b007141fe3d7890022f9a
    Host%20Kan%20on%20your%20own%20infrastructure.%20Ideal%20for%20organisations%20that%20need%20complete%20control%20over%20their%20data./singular: 8e7ae0783d60ef4624d3caf9bfc3747f
@@ -314,6 +359,9 @@ checksums:
    List/singular: 94f13e7ef909a4de9db7abaa1f9f0b61
    List%20name/singular: e925e2e6ccaf0eb4064a888aaea8d3c2
    Lists/singular: 9f4a73afc8de321175d71935134ef066
+    Load%20more%20activities/singular: f32d40a739ffaa700051c4c7d70055cf
+    Loading%20permissions.../singular: a5665279d4e439186825057c32d4d976
+    Loading.../singular: 82b4ea7ed1439094d7c4be13aaba9a66
    Login%20%7C%20kan.bn/singular: 42a6c8dcd73e0d46e652646dc86871eb
    Logout/singular: 07948fdf20705e04a7bf68ab197512bf
    Long-term/singular: 51cb6f0b112250c5a091ca5f0866904b
@@ -324,6 +372,7 @@ checksums:
    marked%20a%20checklist%20item%20as%20incomplete/singular: 35d0822f65971b97774b962561b02649
    marked%20checklist%20item%20%3C0%3E%7B0%7D%3C%2F0%3E%20as%20incomplete/singular: 4c38799ff25321ea25017bf4cd8e2e4f
    Medium%20Priority/singular: 1f527cd6d1ed602930bcaa303f503b51
+    Member/singular: 1606dc30b369856b9dba1fe9aec425d2
    Members/singular: 0932e80cba1e3e0a7f52bb67ff31da32
    Members%20%7C%20%7B0%7D/singular: a29e3e9f1076acd178c417d047584e88
    Monthly/singular: 818f1192e32bb855597f930d3e78806e
@@ -356,7 +405,9 @@ checksums:
    No%20download%20URL%20available%20for%20this%20attachment./singular: e367d39420b2242f9d2fd749c87f446a
    No%20keyboard%20shortcuts%20registered./singular: 7f1ed5d777cade7d62303e9e591bbf63
    No%20lists/singular: cedf633d99c77ff4356e089f2d98c0a6
+    No%20lists%20have%20been%20created%20yet/singular: f18ee3d7230cc33b68bd17b429d1d442
    No%20results%20found%20for%20%22%7BdebouncedQuery%7D%22./singular: 5db6294712528cd897b15ae36f4fd834
+    No%20roles%20found%20for%20this%20workspace%20yet./singular: 2eb502333aaf6c58e8ab23d881e2e357
    Offer/singular: 82b4e0c9a3f5b4bd93590847de7c32a1
    Onboarding/singular: 52b23f9c62ff199d4c09920e7641829e
    Once%20you%20delete%20your%20account%2C%20there%20is%20no%20going%20back.%20This%20action%20cannot%20be%20undone./singular: 9cf7aa6ef30890e5124e266c081bae1c
@@ -369,6 +420,7 @@ checksums:
    Organize%20and%20find%20cards%20quickly%20with%20powerful%20filtering%20tools./singular: 1b9898c4b21e9dff413b4f76dc59db56
    OSS%20Friends/singular: 706e10666dfe26130c17fedb5366a25d
    Overdue/singular: 24caaa2b5d7a2447ab7664e3771cf98c
+    Overrides%20cleared/singular: f2e380efbae31a6113cc0cbf0eadf7b0
    Own%20your%20data/singular: cc2178dac4bdf6b07f030cfc2a7510e6
    Owned%20by%20Atlassian/singular: ace4ed076a5318ad48c296fa09afed69
    Part-time/singular: 213d63da450f35dabb3ab0e35e29feed
@@ -381,6 +433,10 @@ checksums:
    Payment%20frequency/singular: 63ded0e4ffb462ca8bd33d38e4691d86
    Pending/singular: 030a6f3395d5d4efddd3cc67d6009039
    per%20user%2Fmonth/singular: 72af182c1ba6df6732640f4d8a78d360
+    Permission/singular: cc2ed7274bd8267f9e0a10b079584d8b
+    Permissions/singular: 2160be68b1d6b6577e64634e9feba2ed
+    Permissions%20reset/singular: dd4776f04aca858deb95887e807570fc
+    Permissions%20updated/singular: 0df44570b783b8b284610da8627d333d
    Personal%20Project/singular: d7820b1bf4efecc61ed89234567aaa9c
    Planning/singular: 353f58c75248275fe091740607501610
    Platform/singular: c68862170146325333c7f25af11a3fa2
@@ -388,6 +444,7 @@ checksums:
    Please%20enter%20a%20valid%20email%20address/singular: 8de4bc8832b11b380bc4cbcedc16e48b
    Please%20enter%20a%20valid%20name/singular: f2d741f1b5cae722e35cb5206786f932
    Please%20enter%20a%20valid%20password/singular: 4b32c17e19b79bcbf0bb092c06ba310f
+    Please%20enter%20a%20valid%20YouTube%20URL/singular: c16c69c3b742b1e19148378d50adf37f
    Please%20select%20a%20file%20to%20upload./singular: de315bf594047f8ef9307a7fa9285844
    Please%20try%20again%20later%2C%20or%20contact%20customer%20support./singular: 21ffcf0b00e7cd7b64f7454a95762e1d
    Please%20try%20again%20later./singular: 325dea6dd0348a27a6818db2c1340c98
@@ -408,21 +465,26 @@ checksums:
    Recruitment/singular: 78084ee4954aa22efe9ad7463d2a0c72
    Remote/singular: dc3e4280dfe5c455b38ba6c8884999cf
    Remove/singular: dba2fe5fe9f83f8078c687f28cba4b52
+    Remove%20from%20favorites/singular: 74d9cc2d2f3c7a7dc42a7e62c8ee06d5
    Remove%20member/singular: 1d77c2ca3768e486fd1fb5df30cb60d9
+    removed%20%7B0%7D%20labels%3A%20%3C0%3E%7BlabelList%7D%3C%2F0%3E/singular: 612fcfd4aca6818fc870f81d9687d63f
    removed%20a%20label%20from%20the%20card/singular: f83ec18850a2a8a3f8242a740a04df06
    removed%20a%20member%20from%20the%20card/singular: 0bd7561bb79358fde3d595c3e60a315a
+    Removed%20from%20favorites/singular: 540609ab686ed67b1cfd7649467b8bc1
    removed%20label%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: 7e0936b15831e65754588b8512f62fcb
    removed%20the%20due%20date/singular: 000c084844718540fcad542dd8caf8b4
    renamed%20a%20checklist/singular: 4d208de1857740e63469007c5b8b491a
    renamed%20checklist%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: e95d119ef65b0af6c0a96bef182be671
    renamed%20checklist%20item%20to%20%3C0%3E%7B0%7D%3C%2F0%3E/singular: 50f55f71f9245890afee434d7adc2140
    Research/singular: 3368e9638d1619babd6df9fad592274f
+    Reset%20to%20role%20defaults/singular: fc9ff8ea0503e50da3e9b3e5d8bb75dd
    Resolution/singular: 6d8bd9e1bd7dae5ae38c93061d32990e
    Resources/singular: ec7fb05ed963bb6781a35782b3475502
    REST%20API/singular: 54c9f8d98f45f50399b6b93ba70af0d6
    Review/singular: 299f75db25382980b2895622d7712927
    Roadmap/singular: c60f4a1acf30e566861bf130f13b9ae7
    Role/singular: 53743bbb6ca938f5b893552e839d067f
+    Role%20updated/singular: 73606ae9c35101f1bb518961f68559d0
    Run%20on%20your%20own%20infrastructure/singular: eba804911562b8dbf9d69c3e27f1d708
    Save/singular: f7a2929f33bc420195e59ac5a8bcd454
    Save%20time%20with%20reusable%20board%20templates./singular: d0f2d7d0fd682ceaf4ca12c6353fd75a
@@ -444,6 +506,7 @@ checksums:
    Settings%20%7C%20API/singular: 85101e4b802a09ad9e3f01ff116f0894
    Settings%20%7C%20Billing/singular: e44cba741d5414035a0b499c5766c203
    Settings%20%7C%20Integrations/singular: d04992e28016452f6d3d7dcc0b592415
+    Settings%20%7C%20Permissions/singular: 8aa60ed978b9f45a705d99dc1ee04f37
    Settings%20%7C%20Workspace/singular: 5d0bacf7ff696da940f232df45edfd39
    Shortcuts/singular: db3330ed3240c398054f3be23c52851f
    Sign%20in/singular: cb8757c7450e17de1e226e82fb0fa4a2
@@ -478,6 +541,8 @@ checksums:
    Thank%20you%20for%20your%20feedback!/singular: 07edd8c50685a52c0969d711df26d768
    The%20current%20password%20you%20entered%20is%20incorrect./singular: 67a76bf346ab4b48563269e9d941a64a
    The%20main%20difference%20between%20Kan%20and%20Trello%20is%20that%20Kan%20is%20open%20source%2C%20allowing%20anyone%20to%20view%2C%20modify%2C%20and%20contribute%20to%20our%20code.%20Our%20cloud%20offering%20also%20offers%20no%20restrictions%20on%20features%20for%20individual%20use%2C%20whereas%20Trello%20locks%20basic%20features%20such%20as%20the%20number%20of%20boards%20you%20can%20create%20behind%20a%20paywall./singular: db6e22cc955c5fbe547feedeb48f8719
+    The%20member's%20permissions%20have%20been%20updated./singular: 6ae91be2c5c0504bf521335094c50fa4
+    The%20member's%20role%20has%20been%20updated./singular: e30c30a2beaac7d046c35f628102f83b
    The%20open%20source%20%3C0%2F%3E%20alternative%20to%20Trello/singular: 692cb2e8a8e610953c996826beed45a2
    The%20visibility%20of%20your%20board%20has%20been%20set%20to%20%7B0%7D./singular: 970e17a115f7374e60e0a8ded425db8f
    Theme/singular: 21fe00b7a518089576fb83c08631107a
@@ -487,11 +552,14 @@ checksums:
    This%20board%20is%20private%20or%20does%20not%20exist/singular: a217ff3f04463b4df8c86adb6f83c6bc
    This%20board%20URL%20has%20already%20been%20taken/singular: 1d8b40332a031b5b77a3658e48dd51ca
    This%20invitation%20link%20is%20invalid%20or%20has%20expired./singular: 11cc7ef8f1512e7e058e1fbbe5644001
+    This%20member's%20permissions%20have%20been%20reset%20to%20their%20role%20defaults./singular: 730f33b8f1fc002c4f393ccd262b6664
+    This%20will%20remove%20all%20custom%20member%20permissions%20in%20this%20workspace.%20Members%20will%20inherit%20permissions%20only%20from%20their%20roles./singular: 1c989752736fa41ecdd68ea890f16a15
    This%20will%20result%20in%20the%20permanent%20deletion%20of%20all%20data%20associated%20with%20this%20workspace./singular: a31141558af793635c1ddd2fa0a33499
    This%20will%20result%20in%20the%20permanent%20deletion%20of%20all%20data%20associated%20with%20your%20account./singular: b49224632bd6c3b7f5e462912aeb1081
    This%20workspace%20URL%20has%20already%20been%20taken/singular: b455329e2a71da677acab91d3a00bad6
    This%20workspace%20URL%20is%20reserved/singular: 7e47c892b93d4334c1606010c06e875e
    This%20workspace%20username%20has%20already%20been%20taken/singular: b7eadb89c615874f416d9658d0428c4c
+    Title/singular: 344e64395eaff6822a57d18623853e1a
    To%20Do/singular: d60813ea824f373462471e092d136eed
    Toggle%20menu/singular: 29dea3e0b6238874f8c7a27619df8e36
    Track%20all%20card%20changes%20with%20detailed%20activity%20history./singular: 0d3bac559c71ec4b8734f9f212320de5
@@ -502,6 +570,8 @@ checksums:
    Trusted%20by%20fast-moving%20teams%3C0%2F%3Earound%20the%20world/singular: b065575df380536df9541a91ca9b37bf
    Unable%20to%20add%20checklist%20item/singular: 4c4c3eaaf10b348b39ae97eb5dc455df
    Unable%20to%20add%20comment/singular: 49bb435880817434698f31a6069564d6
+    Unable%20to%20add%20label/singular: b09fda6420ea1dc10dbea0b1dc373f29
+    Unable%20to%20clear%20overrides/singular: dfeac280858332082ad34d2623a59863
    Unable%20to%20create%20card/singular: 90112ea12ec6fa42097a6e022ae048a4
    Unable%20to%20create%20checklist/singular: 94eed122e42e0951cd08b9ec62f5eeb6
    Unable%20to%20create%20list/singular: 7fbbf8314f8d08a4123c7daef09fed05
@@ -513,7 +583,10 @@ checksums:
    Unable%20to%20delete%20checklist%20item/singular: a74144593b625e4d8d7ecf734462c60d
    Unable%20to%20delete%20comment/singular: 550198b2c87f06726a843c79c1026ed9
    Unable%20to%20remove%20member/singular: 39025a0c53818438829603d213baef06
+    Unable%20to%20reorder%20checklist%20item/singular: dcc238c72b85daf74ebd46adcd914473
+    Unable%20to%20reset%20permissions/singular: fb09d88ff4eb32afb852d733bafd515b
    Unable%20to%20send%20feedback/singular: 656c93265d7e2bef1245b17d85f85ae5
+    Unable%20to%20update%20board/singular: 62899897d7bffcb1df3af77d460f0881
    Unable%20to%20update%20board%20URL/singular: 080746884059142358b58d9a44ff7d93
    Unable%20to%20update%20board%20visibility/singular: a76a21d561b8943e9276e027a1e3f70d
    Unable%20to%20update%20card/singular: eca6002e57af8ec97324eae64e3b5731
@@ -524,6 +597,8 @@ checksums:
    Unable%20to%20update%20labels/singular: dca2bdc3dcf74bc9d95e05156039a291
    Unable%20to%20update%20list/singular: 14aa802f91b9b4c05236c8c75afb33da
    Unable%20to%20update%20members/singular: 9a851a6b0c75ee16d25cf2ff4b67b255
+    Unable%20to%20update%20permissions/singular: 134f20c5f2463167509562b284ef1c61
+    Unable%20to%20update%20role/singular: 4f2240aeff6f7275feb33ca3f608e48c
    unassigned%20%3C0%3E%7B0%7D%3C%2F0%3E%20from%20the%20card/singular: b683cc07092348c1e75dba40b1262b85
    unassigned%20themselves%20from%20the%20card/singular: 27c6f293c562af6a44348d7f00036d30
    Unlimited%20activity%20log/singular: 8c993de94cda0deac19ba14ecafce6a5
@@ -582,6 +657,7 @@ checksums:
    Workspace%20name%20is%20required/singular: b8c5162dd08c4d941bc57f9d0cbee451
    Workspace%20name%20must%20be%20at%20least%203%20characters%20long/singular: e448ea97418d44b18b4c21c22b8ba779
    Workspace%20name%20updated/singular: 3206ea410ee1ea4182b27ac0d89f92a1
+    Workspace%20permissions/singular: 72c0202f30e543eb81bf930d85647096
    Workspace%20slug%20updated/singular: 527b92711d38cb35b40741df43aef047
    Workspace%20URL/singular: f4397a838da0f3a44cbd3ebe408ed6c3
    workspace-url/singular: 2d034732ec536f3a2667f956fa50d394
@@ -592,10 +668,12 @@ checksums:
    You%20can%20get%20a%20custom%20workspace%20URL%2C%20like%20%3C0%3Ekan.bn%2Fkan%3C%2F0%3E%2C%20by%20going%20into%20your%20%3C1%3Eworkspace%20settings%3C%2F1%3E%20and%20purchasing%20a%20pro%20workspace%20subscription.%20All%20subscriptions%20help%20fund%20the%20development%20of%20the%20project!/singular: 41dd145ef56f539e12dc064a9807c660
    You%20can%20invite%20team%20members%20by%20clicking%20the%20%22Invite%22%20button%20in%20the%20top%20right%20corner%20of%20the%20%3C0%3Emembers%20page%3C%2F0%3E%20and%20entering%20their%20email%20address.%20They%20will%20receive%20an%20email%20with%20a%20link%20to%20join%20the%20workspace./singular: 47e125eb9b4c11cab5a2f4b3ab08e883
    You%20can%20self-host%20by%20following%20the%20instructions%20in%20our%20%3C0%3Erepo%3C%2F0%3E./singular: a6152a41b2d8f64d5a657e5b8bc808a9
+    You%20don't%20have%20permission/singular: 11d928b1993d95d54a95f85f8ae5016d
    You%20have%20been%20logged%20in%20successfully./singular: ef8fad1dce13ae4112f17c5258655fea
    You%20have%20been%20signed%20up%20successfully./singular: f614a6e3b45f5ffb9a3b0fb420fef84b
    You%20have%20been%20unsubscribed!/singular: e0b9985faa4e7f25b71acc77750923a6
    You%20have%20unlimited%20seats%20with%20your%20Pro%20Plan.%20There%20is%20no%20additional%20charge%20for%20new%20members!/singular: e3dc59a5ba7211cd3d8516b3a79d85ca
+    You%20need%20to%20be%20an%20admin%20to%20manage%20workspace%20permissions./singular: e2e816f2b7a13b1056d79e7f25088664
    You've%20been%20invited%20to%20join%20a%20workspace%20on%20kan.bn./singular: 257b840726f972f384243a72767f880f
    You've%20been%20invited%20to%20join%20a%20workspace./singular: 24fc6cdc8740f37a83df85f582f03293
    Your%20account%20has%20been%20deleted./singular: 8c8d944e07388c5877effdb2c2803dcf
@@ -611,3 +689,4 @@ checksums:
    Your%20workspace%20has%20been%20deleted./singular: e7a3efcfc7dd18cb3e917acb67498292
    Your%20workspace%20name%20has%20been%20updated./singular: a87ea3b0d71e6dc5dd525d77114a9322
    Your%20workspace%20slug%20has%20been%20updated./singular: c808949b9b2b4a9aba2472f5d1050167
+    YouTube%20URL/singular: 0b48896061a1124501fdaba026804148
--- a/apps/web/lingui.config.ts
+++ b/apps/web/lingui.config.ts
@@ -1,7 +1,7 @@
 import type { LinguiConfig } from "@lingui/conf";

 const config: LinguiConfig = {
-  locales: ["en", "fr", "de", "es", "it", "nl", "ru", "pl","ptbr"],
+  locales: ["en", "fr", "de", "es", "it", "nl", "ru", "pl","pt-BR"],
  sourceLocale: "en",
  catalogs: [
    {
--- a/apps/web/next.config.js
+++ b/apps/web/next.config.js
@@ -28,6 +28,9 @@ const config = {
  /** We already do linting and typechecking as separate tasks in CI */
  typescript: { ignoreBuildErrors: true },

+  // temporarily ignore eslint errors during build until we fix all the errors sigh
+  eslint: { ignoreDuringBuilds: true },
+
  images: {
    remotePatterns: (() => {
      /** @type {Array<{protocol: "http" | "https", hostname: string}>} */
@@ -47,6 +50,10 @@ const config = {
          protocol: "https",
          hostname: "*.googleusercontent.com",
        },
+        {
+          protocol: 'https',
+          hostname: 'cdn.discordapp.com',
+        },
      ];

      // Extract root domain from S3_ENDPOINT and add wildcard pattern
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -4,12 +4,14 @@
  "private": true,
  "type": "module",
  "scripts": {
-    "build": "pnpm with-env next build",
+    "build": "pnpm with-env next build --turbo",
    "clean": "git clean -xdf .cache .next .turbo node_modules",
-    "dev": "pnpm with-env next dev",
+    "dev": "pnpm with-env next dev --turbo",
    "format": "prettier --check . --ignore-path ../../.gitignore",
    "lint": "eslint",
    "start": "pnpm with-env next start",
+    "test": "vitest run",
+    "test:watch": "vitest",
    "typecheck": "tsc --noEmit",
    "with-env": "dotenv -e ../../.env --",
    "lingui:extract": "lingui extract",
@@ -18,6 +20,7 @@
  },
  "dependencies": {
    "@aws-sdk/client-s3": "^3.802.0",
+    "@aws-sdk/lib-storage": "^3.802.0",
    "@aws-sdk/s3-request-presigner": "^3.812.0",
    "@headlessui/react": "^2.2.0",
    "@hookform/resolvers": "^3.3.4",
@@ -36,6 +39,7 @@
    "@tiptap/extension-link": "^2.22.2",
    "@tiptap/extension-mention": "^3.0.9",
    "@tiptap/extension-placeholder": "^2.14.0",
+    "@tiptap/extension-typography": "^3.18.0",
    "@tiptap/pm": "^2.14.0",
    "@tiptap/react": "^2.14.0",
    "@tiptap/starter-kit": "^2.14.0",
@@ -45,9 +49,10 @@
    "@trpc/react-query": "catalog:",
    "@trpc/server": "catalog:",
    "date-fns": "^4.1.0",
+    "framer-motion": "^12.26.2",
    "geist": "^1.3.1",
    "jose": "^6.1.2",
-    "next": "^16.0.8",
+    "next": "15.5.9",
    "next-runtime-env": "^1.7.2",
    "next-themes": "^0.4.6",
    "nextjs-cors": "^2.2.0",
@@ -86,7 +91,8 @@
    "jiti": "^1.21.6",
    "prettier": "catalog:",
    "tailwindcss": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "^3.0.0"
  },
  "prettier": "@kan/prettier-config"
 }
--- a/apps/web/public/logos/airbus.svg
+++ b/apps/web/public/logos/airbus.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="2500" height="2500" viewBox="0 0 192.756 192.756"><g fill-rule="evenodd" clip-rule="evenodd"><path fill="none" d="M0 0h192.756v192.756H0z"/><path fill="#313f94" d="M33.272 96.299c-.159-7.649-6.374-13.864-14.023-13.864S5.544 88.809 5.544 96.458h-2.71c0-8.446 6.693-15.298 15.139-15.458 8.446 0 15.458 6.853 15.458 15.299z" style="fill:currentColor"/><path fill="#313f94" d="M33.113 96.458c0-6.215-4.94-11.155-11.155-11.155s-10.677 4.94-10.677 11.155H8.253c0-7.012 5.737-12.589 12.749-12.749 6.853 0 12.43 6.374 12.589 12.589z" style="fill:currentColor"/><path fill="#313f94" d="M33.272 96.299c0-4.462-3.824-8.127-8.446-8.127s-7.968 3.665-7.968 8.287H13.99c0-5.418 4.144-9.88 9.562-9.88s9.721 4.462 9.88 9.721h-.16z" style="fill:currentColor"/><path fill="#313f94" d="M3.153 96.458c0 7.649 6.215 13.864 13.864 13.864 7.809 0 13.864-6.375 13.864-14.023h2.709c0 8.445-6.853 15.457-15.298 15.457S2.994 104.904 2.834 96.458z" style="fill:currentColor"/><path fill="#313f94" d="M3.153 96.299c0 6.215 4.94 11.154 11.155 11.154s10.836-4.939 10.677-11.154h3.028c0 7.012-5.737 12.748-12.589 12.748-7.012 0-12.589-6.373-12.589-12.589z" style="fill:currentColor"/><path fill="#313f94" d="M2.994 96.458c.159 4.462 3.984 8.128 8.446 8.128 4.622 0 7.968-3.666 7.968-8.287h2.868c0 5.418-4.143 9.881-9.562 9.881-5.417 0-9.72-4.303-9.72-9.722m54.341 3.507h-5.1l4.144-8.925zm-8.924 8.285 1.434-3.188h7.968l.479 3.188h7.968l-4.462-24.7H53.67l-13.227 24.7zm21.513 0 4.303-24.7h8.127l-4.302 24.7zm24.064-18.645h3.985c1.273 0 2.07.16 2.549.638.318.318.479.956.318 1.593-.158.797-.479 1.435-1.115 1.753-.479.479-1.434.638-2.709.638h-3.825zM90.8 108.25l1.435-8.605h3.187c.956 0 1.754.16 2.23.32.479.318.797.637.957 1.115q.237.716 0 1.912l-.16 1.912c-.318 1.594-.318 2.709-.318 3.346h8.287v-.797c-.16 0-.479 0-.479-.158-.158-.16-.158-.479 0-1.115l.639-3.826c.158-1.752.158-3.027-.32-3.664-.477-.797-1.434-1.436-2.867-2.072.797-.159 1.434-.479 2.07-.796.797-.638 1.436-1.275 1.912-2.072.639-.957.957-1.913 1.275-3.188q.24-1.434 0-2.39a5.3 5.3 0 0 0-.797-1.912 7.5 7.5 0 0 0-1.594-1.594c-.797-.319-1.594-.638-2.709-.797s-2.548-.319-4.302-.319H87.294l-4.303 24.7zm33.147-19.123c1.115 0 1.912.159 2.23.159.479.16.797.479.957.797.318.319.318.797.318 1.275-.16.638-.479 1.116-1.115 1.594-.479.319-1.436.637-2.709.637H120.6l.797-4.462zm-1.275 19.123c1.912 0 3.188-.158 3.984-.318s1.752-.479 2.549-.797c.957-.479 1.594-.797 2.072-1.275.797-.477 1.275-1.273 1.754-2.07a7.2 7.2 0 0 0 1.115-2.869c.158-1.434 0-2.709-.479-3.666-.637-1.115-1.434-1.752-2.709-2.071 2.391-1.434 3.824-3.187 4.143-5.259.479-2.231-.158-3.825-1.912-4.94-1.275-.957-3.346-1.435-6.533-1.435h-12.111l-4.303 24.7zm.478-10.357c1.594 0 2.549.318 3.027.637.479.479.637.957.479 1.754-.16.637-.479 1.273-1.115 1.752-.639.318-1.594.639-3.188.639h-3.346l.797-4.781zm18.645-14.343h7.969l-2.709 15.298c-.16.957-.16 1.754 0 2.232.158.477.477.955 1.115 1.273.637.32 1.275.479 2.07.479 1.117 0 2.232-.318 2.869-.955.797-.639 1.275-1.754 1.594-3.029l2.709-15.298h7.969l-2.551 14.501c-.318 1.754-.637 3.188-1.115 4.303-.479.957-1.115 1.912-1.912 2.709s-1.754 1.594-2.709 2.072c-1.115.637-2.23 1.115-3.506 1.434-1.434.16-2.869.32-4.303.32-1.754 0-3.188-.16-4.463-.32-1.273-.318-2.23-.797-3.027-1.434-.955-.637-1.594-1.275-2.072-2.072-.477-.797-.797-1.912-.797-3.186-.158-.797 0-2.232.32-3.984zm48.127 7.171h-7.809c0-.638-.318-1.275-.639-1.594-.477-.319-1.115-.478-2.07-.478-.957 0-1.754.159-2.23.478-.479.319-.639.638-.797 1.116 0 .478 0 .637.318.956s1.115.637 2.549.956l3.027.797c2.709.797 4.623 1.753 5.578 3.028.957 1.274 1.275 2.709.957 4.461-.32 1.436-.797 2.551-1.594 3.666s-1.754 2.072-2.709 2.709c-.957.637-2.232 1.115-3.666 1.594-1.434.318-3.027.479-4.621.479s-3.188-.16-4.621-.639q-2.153-.717-3.348-1.912c-1.195-1.195-1.434-1.752-1.752-2.867-.16-.797-.16-1.754-.16-2.869h7.809c0 .797.318 1.434.797 1.752.479.479 1.436.639 2.709.639q1.673 0 2.391-.479c.718-.479.639-.637.797-1.115 0-.479 0-.957-.318-1.275s-1.115-.637-2.551-.955l-2.709-.639c-1.273-.318-2.709-.797-3.824-1.434-1.115-.638-2.07-1.435-2.549-2.55-.479-.956-.479-2.071-.318-3.506.318-1.434.797-2.549 1.592-3.665.797-1.115 1.754-1.912 2.869-2.55.957-.797 2.23-1.115 3.506-1.434s2.551-.478 3.824-.478c1.594 0 2.869.159 4.145.478 1.273.319 2.07.797 2.867 1.275.639.478 1.115 1.115 1.436 1.753.477.637.637 1.275.797 1.912.157.637.317 1.434.317 2.39" style="fill:currentColor"/></g></svg>
--- a/apps/web/public/logos/bitwarden.svg
+++ b/apps/web/public/logos/bitwarden.svg
--- a/apps/web/public/logos/couchbase.svg
+++ b/apps/web/public/logos/couchbase.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 2000 456.5"><path d="M380.5 268.5c0 13.6-8 26-23.6 28.4-26.8 4.8-82.8 7.6-130 7.6s-103.2-2.8-130-7.6c-15.6-2.8-23.2-15.2-23.2-28.4v-89.2c0-13.6 10.4-26.4 23.2-28.4 8-1.6 26.4-2.8 40.8-2.8 5.6 0 9.6 4.4 10 10.8v62c27.6 0 51.6-1.6 79.6-1.6s51.6 1.6 79.6 1.6v-62c0-6.4 4.4-10.8 9.6-10.8 14.4 0 32.8 1.2 40.8 2.8 12.8 2.4 23.6 15.2 23.6 28.4zM226.4 0C101.6 0 0 102.4 0 228.4s101.6 228 226.4 228 226.4-102.4 226.4-228S352.1 0 226.4 0" class="st0" style="fill:currentColor"/><path d="M543.6 309.9c-70.4 0-105.6-51.2-105.6-108 0-56.4 36.8-107.2 106.4-107.2 26.8 0 46 5.6 61.6 16.4l-20 33.2c-11.2-7.2-24-12-42.4-12-38 0-58 30.4-58 68.4 0 38.8 19.2 71.6 58.8 71.6 22 0 35.6-7.6 46.4-16l18.4 32c-10.8 9.6-35.6 21.6-65.6 21.6M694 309.9c-52.4 0-75.6-40-75.6-79.6s22.8-80.4 75.2-80.4 76.4 39.6 76.4 79.2c0 38.8-23.2 80.8-76 80.8m-1.2-128c-22.8 0-29.6 19.2-29.6 47.2s8.8 48.4 31.2 48.4c22.8 0 30.4-18.8 30.4-47.2s-8.8-48.4-32-48.4M836.9 153.9v97.6c0 15.2 5.2 22.4 19.6 22.4 15.2 0 26.8-14.8 29.6-18.4V153.9h42.4v107.6c0 20 2.4 35.6 4.4 44.8h-41.6c-1.2-4.4-2.8-14-3.2-20-8 10.4-23.6 24-48.4 24-33.2 0-45.2-21.6-45.2-49.6V153.9zM1032.5 309.9c-48.8 0-78.4-32-78.4-80 0-51.2 33.6-80.4 80-80.4 24.4 0 38.8 7.2 46 12l-13.6 29.2c-6.4-4.4-16.4-8.8-31.2-8.8-23.6 0-36.4 18.4-36.4 46.4s12 48 37.2 48c16.8 0 27.6-6 32-8.8l12.8 28.4c-7.2 4.8-20.8 14-48.4 14M1194.5 306.3v-97.6c0-15.2-5.2-22.4-19.2-22.4-15.6 0-27.2 14.4-30 18.4v102h-42.4V81.1h42.4v90.8c7.6-8.4 22-22 46.8-22 33.2 0 45.2 21.2 45.2 49.6v106.4zM1314.1 81.1v84.4c6.8-6.8 20-16 36.8-16 37.6 0 63.6 26 63.6 78.8 0 52.4-34.8 81.2-80.4 81.2-34.4 0-55.2-8.4-62.4-12.4v-216zm0 192c2.8.8 9.2 3.2 20 3.2 22 0 35.2-16.4 35.2-47.6 0-28-9.2-44.8-30.8-44.8-12.8 0-22 8-24.8 11.2zM1519.8 306.3c-1.2-4-2.4-11.6-2.8-16.4-6.4 8-20.8 20-42 20-25.6 0-45.6-15.6-45.6-42.8 0-39.6 40-54 80.4-54h5.2v-8.8c0-12.8-5.2-20.4-24-20.4-19.2 0-32.4 10-38.4 14.4l-18-26.4c9.2-8 28.8-22 61.2-22 41.6 0 61.2 16.4 61.2 56.8v53.6c0 20.8 2.4 36 4.4 46zm-4.8-67.2h-5.2c-23.2 0-39.2 6.8-39.2 24.4 0 10.8 8.4 15.6 17.6 15.6 14.4 0 22.4-8 26.8-12.8zM1633.8 309.9c-27.2 0-44.4-8-53.6-14.4l14.4-30c5.6 4 20.4 12.4 37.2 12.4 15.6 0 24.4-4.4 24.4-13.2 0-10-16.8-12.8-38.4-23.2-20.8-10-32.8-22-32.8-44.8 0-28.8 22.4-47.2 56.8-47.2 26 0 41.6 8 48.8 12l-14.8 29.2c-5.6-4-17.6-9.6-32-9.6s-20.4 5.2-20.4 12.8c0 10 14 12.4 30.8 19.2 23.6 9.6 40.4 20.8 40.4 46.8-.8 33.2-23.6 50-60.8 50M1792.2 277.9c20.4 0 31.6-6.4 38.8-10.4l13.6 27.6c-10 5.6-25.6 14.8-56.4 14.8-50.4 0-79.2-32-79.2-80.8 0-48.4 33.2-79.2 74.8-79.2 47.6 0 70.4 33.2 65.2 90.4h-94c1.6 22.8 12.8 37.6 37.2 37.6m16-66.8c-.4-16.8-6.8-30.4-25.2-30.4-16.8 0-26.4 10.8-28.8 30.4z" class="st1" style="fill:currentColor" transform="translate(150.22 27.826)"/></svg>
--- a/apps/web/public/logos/deloitte.svg
+++ b/apps/web/public/logos/deloitte.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="892.4" height="170.507" viewBox="-86.2 14.747 1092.4 170.507"><path d="M3054.827 974.386a4.32 4.32 0 1 1 8.637 0 4.32 4.32 0 0 1-8.637 0M2917.055 962.946q0-4.106-1.587-6.09-1.586-1.98-4.818-1.98h-2.294v16.732h1.755q3.592.001 5.267-2.135 1.676-2.134 1.677-6.527m8.18-.285q0 7.478-4.02 11.522-4.02 4.047-11.304 4.046h-9.436v-29.87h10.095q7.023 0 10.845 3.677 3.82 3.677 3.82 10.625M2951.373 978.229h7.509v-29.996h-7.509zM2969.43 967.04q0 2.87.749 4.374.749 1.505 2.515 1.505 1.748 0 2.469-1.505.719-1.505.718-4.374 0-2.853-.728-4.306-.731-1.457-2.498-1.458-1.727.001-2.476 1.447-.749 1.444-.749 4.317m14.094 0q.001 5.466-2.87 8.524-2.871 3.059-8.036 3.059-4.955 0-7.883-3.128-2.93-3.126-2.93-8.455 0-5.448 2.871-8.467t8.058-3.02q3.206 0 5.664 1.398t3.792 4.003q1.334 2.603 1.334 6.086M2986.506 978.23h7.51v-22.282h-7.51zM2986.506 953.253h7.51v-5.022h-7.51zM3009.23 972.546c1.015 0 2.222-.258 3.63-.769v5.606q-1.517.669-2.89.953-1.372.286-3.217.286-3.781 0-5.455-1.899-1.667-1.897-1.668-5.828v-9.185H2997v-5.76h2.63v-5.69l7.567-1.317v7.007h4.791v5.76h-4.791v8.672q0 2.164 2.034 2.164M3026.612 972.546c1.013 0 2.22-.258 3.63-.769v5.606q-1.518.669-2.89.953-1.374.286-3.218.286-3.782 0-5.452-1.899-1.671-1.897-1.672-5.828v-9.185h-2.63v-5.76h2.63v-5.777l7.567-1.23v7.007h4.793v5.76h-4.793v8.672q0 2.164 2.035 2.164M3039.717 964.326q.155-1.83 1.047-2.685.895-.855 2.217-.855 1.445-.001 2.295.965.857.962.893 2.575zm10.59-6.145q-2.678-2.626-7.593-2.626-5.166 0-7.952 3.018-2.784 3.019-2.785 8.663.001 5.467 3.007 8.426 3.005 2.96 8.44 2.96 2.61 0 4.493-.355a13 13 0 0 0 3.627-1.266l-1.154-5.021c-.851.347-1.661.615-2.426.79q-1.658.386-3.638.386-2.171 0-3.427-1.061-1.258-1.065-1.335-2.932h13.422v-3.42q0-4.938-2.679-7.562M2935.2 964.326q.155-1.83 1.047-2.685.894-.855 2.219-.855 1.44-.001 2.294.965.855.962.893 2.575zm10.592-6.145q-2.68-2.626-7.595-2.626-5.167 0-7.95 3.018-2.785 3.019-2.786 8.663 0 5.467 3.007 8.426 3.004 2.96 8.44 2.96 2.61 0 4.493-.355a13 13 0 0 0 3.627-1.266l-1.155-5.021c-.851.347-1.661.615-2.425.79q-1.66.386-3.639.386-2.17 0-3.427-1.061-1.258-1.065-1.335-2.932h13.422v-3.42q0-4.938-2.677-7.562" style="fill:currentColor" transform="translate(-15746.429 -5136.262)scale(5.4348)"/></svg>
--- a/apps/web/public/logos/fast_company.svg
+++ b/apps/web/public/logos/fast_company.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 295 42"><rect width="100%" height="100%" fill="none"/><path d="M259.5 5.5c0-2.9.9-3.9 2.4-3.9s2.7.6 4.1 3.9l8.5 19.3V37c0 2.9-1.2 3.7-4.5 4.1v.8h15.7v-.8c-3.4-.4-4.5-1.3-4.5-4.1V24.8l8.2-18.6c1.6-3.6 3.2-4.4 5.6-4.8V.6h-11.5v.8c3.9.4 5.3 1.5 4.2 4.1L280.5 22l-7.4-16.9c-1-2.3-.4-3 3.9-3.6V.7h-24.7v.8c3.9.6 5.1 1.3 5.1 4.1v22.6L239.3.7h-8.9v.8c2.9.4 3.8 1.3 3.8 4.1v31.5c0 2.9-.8 3.9-1.8 3.9-.9 0-1.4-.4-2.7-3.9L216.3.5h-.8l-12.9 35c-1.4 3.9-3.6 5.2-5.8 5.7v.8h11.8v-.8c-4.1-.4-5.4-2-4.5-4.6l2.9-8h12.2l2.8 7.5c1.2 3.4.5 4.4-3 5v.8h22.4v-.8c-3.9-.6-5.1-1.3-5.1-4.1V8.8L258.2 42h1.3zM101.6 21.2c0-12.8 6.1-19.5 13.2-19.5 4.2 0 6.9.9 8.5 2.6 1.2 1.2 2.1 2.9 3.1 5.6h.8V1.3C123.1.5 119.4 0 115.7 0 105 0 93.9 6.9 93.9 21.2S105 42.4 115 42.4c4.4 0 8.3-.7 12-1.8l1.2-8.1-.7-.2c-.9 1.7-2 3.2-3.2 4.5-2.6 2.6-6.1 4-9.6 4-6.8-.1-13.1-6.6-13.1-19.6m88.7 1.2c-.9 0-2.1-.1-3.3-.3v-20h3.3c5.5 0 7.9 2.9 7.9 10.1 0 7.3-2.5 10.2-7.9 10.2M61.8.6v9.9h.8c1.2-6.3 3.7-8.3 7.9-8.3h2V37c0 2.9-1.2 3.7-4.5 4.1v.8h15.7v-.8c-3.4-.4-4.5-1.3-4.5-4.1V2.1h2c4.2 0 6.7 2 7.9 8.3h.8V.5H61.8zM49.3 42.4c6.8 0 14-3.9 14-11.9 0-4.7-2.5-8.6-6.9-11l-7.8-4.3c-4.1-2.3-5.3-4.4-5.3-7.4 0-3.4 2.5-6.1 7.2-6.1 2.3 0 4 .6 5.4 1.9 1.2 1.2 2.4 3.2 3.5 6.8h.7V1.3C57.3.5 54.4 0 51 0c-6.7 0-11.7 4.2-11.7 11.3 0 4.5 2.5 8.6 6.6 11l7.2 4c4.1 2.3 5.4 4.5 5.4 7.8 0 3.9-4 6.7-8.4 6.7-2.9 0-5.3-1-7-2.7-1.1-1.1-2.3-2.8-3.1-5h4.7v-.8c-1.3-.3-2.1-.5-3.2-3.1L32.3 7.3h-.8l-9 21.4c-1.2 2.9-2 3.4-3.4 3.6v.8h8v-.8c-2.9-.3-3.7-1.7-3-3.5l1.4-3.4h8.1l1.8 4.2c.8 1.9-.4 2.4-3.3 2.6v.8h6.4v7.9c3.2.9 7.3 1.5 10.8 1.5m101.6-.4 11.9-33.1.9 28.2c.1 2.8-1 3.6-4.4 4v.8h32.8v-.8c-3.9-.6-5.1-1.3-5.1-4.1V23.7c1.3.2 2.6.3 3.6.3 7.9 0 14.7-2.9 14.7-11.7S198.5.6 190.6.6h-14.1v.8c2.9.4 3.8 1.3 3.8 4.1V37c0 2.9-1.2 4.1-4.5 4.1h-.1c-3.5 0-5-1.3-5.1-4l-1.2-31.5c-.1-2.9.9-3.8 4-4.2V.6h-9.7l-10.6 29.7L142.5.6h-10.4v.8c3.1.4 4.1 1.4 4 4.2L135 35.8c-.1 3-1.7 4.8-4.6 5.3v.8h11v-.8c-2.8-.4-4.4-2.2-4.3-5.3l.9-27.5 12.1 33.6zM119 33.3c5.3 0 12.1-4.7 12.1-12.1 0-7.3-6.7-12.1-12.1-12.1-5.3 0-12.1 4.7-12.1 12.1 0 7.3 6.7 12.1 12.1 12.1m0-22.5c3.4 0 5.7 2.8 5.7 10.4 0 7.7-2.4 10.4-5.7 10.4-3.4 0-5.7-2.8-5.7-10.4 0-7.7 2.3-10.4 5.7-10.4m99.7 16.1h-11.1l5.5-15.2zM33.1 23.8h-6.8l3.4-8.3zm-13 2.1h.8V13.5h-.8c-1.3 4.4-2.6 5.4-5 5.4h-4.6V2.1h7.3c4.2 0 6.7 2 7.9 8.3h.8V.5H0v.8c2.9.4 3.8 1.3 3.8 4.1v31.5c0 2.9-.9 3.7-3.8 4.1v.8h15.6V41c-3.9-.6-5.1-1.3-5.1-4.1V20.4h4.6c2.3.1 3.7 1.1 5 5.5" class="currentLayer" style="fill:currentColor"/></svg>
--- a/apps/web/public/logos/lego.svg
+++ b/apps/web/public/logos/lego.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" viewBox="-5 0 24 14"><path d="M11.48 4.37c-.714 0-1.207.284-1.54.678a.9.9 0 0 0-.16-.238c-.273-.308-.712-.452-1.3-.452-.576 0-1.056.18-1.39.462-.172-.28-.585-.467-1.082-.467-.65 0-1.358.092-1.778.769-.01-.244-.032-.373-.169-.518-.166-.176-.436-.222-.698-.222-.478 0-.838.209-1.097.634C1.89 5.616.98 7.59 1 8.546c.014.618.428 1.063 1.17 1.08.579.015 1.034-.14 1.323-.432.26.282.655.447 1.128.447.528 0 1.059-.158 1.372-.504.264.324.68.513 1.214.51a2.19 2.19 0 0 0 1.713-.842c.22.598.777.836 1.386.836 1.335 0 1.92-.918 2.41-2.369.11-.327.256-.873.28-1.33.041-.764-.282-1.571-1.517-1.571M2.598 8.02c.69-.12.864.129.842.36-.065.692-.7.847-1.251.834-.4-.009-.76-.193-.77-.657-.017-.812.811-2.69 1.201-3.314.18-.295.4-.441.75-.441.331 0 .413.17.408.374-.013.544-.892 2.197-1.18 2.843m2.249-.639a7 7 0 0 0-.203.657c.227-.056.397-.096.688-.089.332.008.544.146.544.42 0 .666-.735.86-1.245.86-.56 0-1.052-.318-1.052-.93 0-.718.39-1.807.755-2.532.448-.89.906-1.008 1.695-1.008.347 0 .747.148.747.475 0 .454-.385.627-.766.65a5 5 0 0 1-.563.006s-.127.194-.262.538c.706-.1 1.005.06.886.47-.161.551-.639.587-1.224.483zM8.32 5.665c-.19 0-.316.12-.409.251-.204.288-.648 1.44-.717 1.912-.047.324.093.39.246.39.245 0 .52-.26.614-.688 0 0-.467-.01-.338-.425.125-.402.362-.489.756-.505.775-.032.698.54.636.846-.201.99-.907 1.787-1.904 1.787-.683 0-1.107-.378-1.107-1.075 0-.496.246-1.275.44-1.731.416-.97.852-1.65 1.962-1.65.666 0 1.191.24 1.114.864-.056.457-.286.726-.702.759-.116.009-.593-.003-.435-.454.056-.157.078-.281-.156-.281m4.192.819a6.7 6.7 0 0 1-.668 1.79c-.467.84-1.035.959-1.53.953s-1.055-.19-1.06-.954c-.002-.549.235-1.324.436-1.832.35-.92.708-1.671 1.84-1.658 1.32.016 1.085 1.19.982 1.7m-1.12-.8c-.113-.001-.212.02-.3.158-.2.258-.784 1.854-.774 2.172.004.114.067.214.208.214.161 0 .25-.111.33-.246.184-.311.7-1.721.715-2.074.004-.102-.013-.222-.179-.224" style="fill:currentColor"/></svg>
--- a/apps/web/public/logos/linkedin.svg
+++ b/apps/web/public/logos/linkedin.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="-48.214 -18.217 387.865 116.248"><path d="M1.785 65.652h31.62V55.27H13.23V15.665H1.785zm47.629 0v-34.43H37.97v34.43zm-5.721-39.13c3.99 0 6.474-2.644 6.474-5.95-.074-3.378-2.484-5.947-6.398-5.947-3.915 0-6.475 2.57-6.475 5.947 0 3.306 2.484 5.95 6.324 5.95zm11.034 39.13h11.444V46.424c0-1.029.074-2.058.377-2.791.826-2.056 2.709-4.186 5.871-4.186 4.142 0 5.799 3.158 5.799 7.784v18.42H89.66V45.91c0-10.576-5.646-15.497-13.176-15.497-6.173 0-8.884 3.451-10.39 5.802h.077v-4.993H54.727c.151 3.231 0 34.43 0 34.43m51.078-49.987H94.361v49.987h11.444V54.489l2.86-3.601 8.96 14.764h14.078l-15.056-21.373 13.174-14.54h-13.776s-9.411 13.008-10.24 14.552zm56.501 35.625c.151-.884.377-2.58.377-4.498 0-8.9-4.518-17.936-16.413-17.936-12.724 0-18.597 10.063-18.597 19.19 0 11.288 7.153 18.337 19.65 18.337 4.97 0 9.561-.732 13.327-2.275l-1.506-7.558c-3.088 1.024-6.25 1.537-10.164 1.537-5.345 0-10.012-2.195-10.389-6.871l23.715.072zm-23.79-7.742c.301-2.938 2.26-7.273 7.153-7.273 5.194 0 6.4 4.628 6.4 7.273h-13.552zm52.414-27.883v17.304h-.151c-1.657-2.422-5.12-4.038-9.71-4.038-8.81 0-16.564 7.05-16.49 19.094 0 11.164 7.003 18.435 15.735 18.435 4.744 0 9.26-2.058 11.52-6.024h.225l.453 5.216h10.163c-.15-2.424-.302-6.61-.302-10.723V15.664h-11.444zm0 34.05c0 .88-.075 1.763-.227 2.495-.675 3.16-3.386 5.361-6.699 5.361-4.742 0-7.83-3.818-7.83-9.84 0-5.654 2.637-10.208 7.906-10.208 3.538 0 6.022 2.423 6.7 5.433.15.663.15 1.398.15 2.058v4.7z" style="fill:currentColor"/><mask id="a"><rect width="100%" height="100%" fill="#fff"/><path d="M236.85 65.61V31.18h-11.444v34.43h11.445zm-5.72-39.13c3.99 0 6.474-2.644 6.474-5.948-.075-3.379-2.484-5.949-6.398-5.949-3.917 0-6.475 2.57-6.475 5.949 0 3.304 2.483 5.948 6.324 5.948zm12.054 39.13h11.443V46.385c0-1.028.075-2.058.377-2.792.827-2.057 2.71-4.186 5.872-4.186 4.14 0 5.797 3.157 5.797 7.786V65.61h11.443V45.869c0-10.575-5.645-15.496-13.174-15.496-6.173 0-8.884 3.45-10.39 5.8h.076v-4.992h-11.443c.149 3.23-.001 34.43-.001 34.43z"/></mask><path d="M213.882 7.245c0-3.015 2.508-5.462 5.6-5.462h64.568c3.093 0 5.6 2.447 5.6 5.462V72.57c0 3.016-2.507 5.461-5.6 5.461h-64.568c-3.092 0-5.6-2.445-5.6-5.46V7.244z" mask="url(#a)" style="fill:currentColor"/></svg>
--- a/apps/web/public/logos/sana.svg
+++ b/apps/web/public/logos/sana.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="66" height="24" class="wordmark" viewBox="0 0 66 24"><path d="M0 17.198h3.045c.356 3.077 3.045 4.664 5.927 4.664 3.045 0 5.409-1.814 5.409-4.632 0-2.883-2.332-3.595-6.186-4.47C2.559 11.53.777 9.587.777 6.283.777 2.623 3.984 0 8.486 0c4.178 0 7.806 2.332 8.032 6.057h-3.012c-.227-2.462-2.429-3.919-5.15-3.919-2.947 0-4.761 1.879-4.761 3.951 0 2.462 2.073 3.206 6.121 4.049 5.441 1.134 7.514 3.271 7.514 6.931 0 4.243-3.498 6.931-8.356 6.931C4.081 24 .291 21.636 0 17.198M18.267 19.304c0-3.336 2.818-5.344 10.3-5.538v-.972c0-2.494-1.36-3.725-3.563-3.725-2.267 0-3.401 1.49-3.563 3.077h-2.785c.324-2.721 2.559-4.988 6.348-4.988 4.049 0 6.316 2.202 6.316 5.636v10.721h-2.623v-2.073C27.757 23.093 26.008 24 23.709 24c-2.915 0-5.442-1.717-5.442-4.696m10.3-1.458v-2.3c-5.538.162-7.547 1.458-7.547 3.66 0 1.684 1.36 2.883 3.271 2.883 2.43 0 4.276-1.652 4.276-4.243M33.684 7.676h2.656v2.332c.907-1.684 2.623-2.785 4.923-2.785 3.595 0 5.506 2.364 5.506 5.862v10.429h-2.85v-9.911c0-2.915-1.296-4.275-3.498-4.275s-3.887 1.879-3.887 4.308v9.879h-2.85zM48.389 19.304c0-3.336 2.818-5.344 10.3-5.538v-.972c0-2.494-1.36-3.725-3.563-3.725-2.267 0-3.401 1.49-3.563 3.077h-2.785c.324-2.721 2.559-4.988 6.348-4.988 4.049 0 6.316 2.202 6.316 5.636v10.721h-2.623v-2.073C57.879 23.093 56.13 24 53.83 24c-2.915 0-5.441-1.717-5.441-4.696m10.299-1.458v-2.3c-5.538.162-7.547 1.458-7.547 3.66 0 1.684 1.36 2.883 3.271 2.883 2.43 0 4.276-1.652 4.276-4.243M61.043 1.018h-1.017v3.014h-.602V1.018h-1.017v-.5h2.636zM63.251 3.263l.873-2.745h.917V4.03h-.596V1.137l-.908 2.893h-.581l-.928-2.889V4.03h-.587V.518h.933z" style="fill:currentColor"/></svg>
--- a/apps/web/public/logos/wakam.svg
+++ b/apps/web/public/logos/wakam.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="-50 -20 288.624 78.268"><g data-name="Calque 2"><g data-name="Groupe 1909" opacity=".35"><path fill="#0540ff" d="M68.234 103.2a4.226 4.226 0 0 1-3.767-6.125L73.8 78.55a4.226 4.226 0 0 1 7.548 3.8l-9.335 18.522a4.23 4.23 0 0 1-3.781 2.323Z" data-name="Tracé 10091" style="fill:currentColor" transform="translate(-54.53 -64.931)"/></g><g data-name="Groupe 1910" opacity=".35"><path fill="#0540ff" d="M1093.234 103.213a4.226 4.226 0 0 1-3.766-6.125l9.335-18.522a4.223 4.223 0 0 1 7.542 3.8l-9.335 18.522a4.23 4.23 0 0 1-3.776 2.325" data-name="Tracé 10092" style="fill:currentColor" transform="translate(-927.653 -64.946)"/></g><path fill="#0540ff" d="M140.7 103.184a4.22 4.22 0 0 1-3.759-2.3l-9.483-18.521a4.223 4.223 0 0 1 7.517-3.853l5.7 11.122 5.594-11.1a4.226 4.226 0 0 1 7.548 3.805l-9.335 18.522a4.22 4.22 0 0 1-3.758 2.322Z" data-name="Tracé 10093" style="fill:currentColor" transform="translate(-108.179 -64.918)"/><path fill="#0540ff" d="M13.708 103.2a4.22 4.22 0 0 1-3.762-2.3L.462 82.382a4.223 4.223 0 0 1 7.517-3.852l9.483 18.522a4.226 4.226 0 0 1-3.755 6.149Z" data-name="Tracé 10094" style="fill:currentColor" transform="translate(.003 -64.936)"/><path fill="#0540ff" d="M966.234 103.219a4.226 4.226 0 0 1-3.766-6.125l9.332-18.522a4.22 4.22 0 0 1 3.758-2.322h.013a4.22 4.22 0 0 1 3.758 2.3l9.483 18.522a4.223 4.223 0 0 1-7.517 3.852L975.6 89.8l-5.588 11.1a4.23 4.23 0 0 1-3.778 2.319" data-name="Tracé 10095" style="fill:currentColor" transform="translate(-819.471 -64.952)"/><path fill="#0540ff" d="M1165.708 103.2a4.22 4.22 0 0 1-3.762-2.3l-9.483-18.522a4.223 4.223 0 1 1 7.517-3.852l9.483 18.522a4.226 4.226 0 0 1-3.755 6.149Z" data-name="Tracé 10096" style="fill:currentColor" transform="translate(-981.302 -64.936)"/><path fill="#0540ff" d="m578.369 30.891-8.541-6.677 8.446-5.666a4 4 0 0 0-4.456-6.647l-11.737 7.869V4.186a4.186 4.186 0 1 0-8.372 0v29.783a4.186 4.186 0 0 0 8.372 0V28.32l11.36 8.871a4 4 0 1 0 4.927-6.3Z" data-name="Tracé 10097" style="fill:currentColor" transform="translate(-471.665)"/><path fill="#0540ff" d="M356.4 90.163a13.4 13.4 0 1 0-7 11.854 3.852 3.852 0 0 0 7-2.223zM343 96.09a5.853 5.853 0 1 1 5.853-5.853A5.853 5.853 0 0 1 343 96.09" data-name="Tracé 10098" style="fill:currentColor" transform="translate(-280.762 -65.455)"/><path fill="#0540ff" d="M782.4 90.163a13.4 13.4 0 1 0-7 11.854 3.853 3.853 0 0 0 7-2.223zM769 96.09a5.853 5.853 0 1 1 5.853-5.853A5.853 5.853 0 0 1 769 96.09" data-name="Tracé 10099" style="fill:currentColor" transform="translate(-643.64 -65.455)"/></g></svg>
--- a/apps/web/src/assets/logos/bitwarden.svg
+++ b/apps/web/src/assets/logos/bitwarden.svg
--- a/apps/web/src/components/AuthForm.tsx
+++ b/apps/web/src/components/AuthForm.tsx
@@ -361,8 +361,8 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
          })}
        </div>
      )}
-      <form onSubmit={handleSubmit(onSubmit)}>
-        {!isCredentialsEnabled && socialProviders?.length === 0 && (
+      {!(isCredentialsEnabled || isMagicLinkAvailable) &&
+        socialProviders?.length === 0 && (
          <div className="flex w-full items-center gap-4">
            <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
            <span className="text-center text-sm text-light-900 dark:text-dark-900">
@@ -371,65 +371,62 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
            <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
          </div>
        )}
-        {!isCredentialsEnabled && socialProviders?.length !== 0 && (
-          <div className="mb-[1.5rem] flex w-full items-center gap-4">
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
-            <span className="text-sm text-light-900 dark:text-dark-900">
-              {t`or`}
-            </span>
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
-          </div>
-        )}
-        <div className="space-y-2">
-          {isSignUp && isCredentialsEnabled && (
-            <div>
-              <Input
-                {...register("name", { required: true })}
-                placeholder={t`Enter your name`}
-              />
-              {errors.name && (
-                <p className="mt-2 text-xs text-red-400">
-                  {t`Please enter a valid name`}
-                </p>
-              )}
+      {(isCredentialsEnabled || isMagicLinkAvailable) && (
+        <form onSubmit={handleSubmit(onSubmit)}>
+          {socialProviders?.length !== 0 && (
+            <div className="mb-[1.5rem] flex w-full items-center gap-4">
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
+              <span className="text-sm text-light-900 dark:text-dark-900">
+                {t`or`}
+              </span>
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
            </div>
          )}
-          {(isCredentialsEnabled || isMagicLinkAvailable) && (
-            <>
+          <div className="space-y-2">
+            {isSignUp && isCredentialsEnabled && (
              <div>
                <Input
-                  {...register("email", { required: true })}
-                  placeholder={t`Enter your email address`}
+                  {...register("name", { required: true })}
+                  placeholder={t`Enter your name`}
                />
-                {errors.email && (
+                {errors.name && (
                  <p className="mt-2 text-xs text-red-400">
-                    {t`Please enter a valid email address`}
+                    {t`Please enter a valid name`}
                  </p>
                )}
              </div>
-
-              {isCredentialsEnabled && (
-                <div>
-                  <Input
-                    type="password"
-                    {...register("password", { required: true })}
-                    placeholder={t`Enter your password`}
-                  />
-                  {errors.password && (
-                    <p className="mt-2 text-xs text-red-400">
-                      {errors.password.message ??
-                        t`Please enter a valid password`}
-                    </p>
-                  )}
-                </div>
+            )}
+            <div>
+              <Input
+                {...register("email", { required: true })}
+                placeholder={t`Enter your email address`}
+              />
+              {errors.email && (
+                <p className="mt-2 text-xs text-red-400">
+                  {t`Please enter a valid email address`}
+                </p>
              )}
-            </>
-          )}
-          {loginError && (
-            <p className="mt-2 text-xs text-red-400">{loginError}</p>
-          )}
-        </div>
-        {(isCredentialsEnabled || isMagicLinkAvailable) && (
+            </div>
+
+            {isCredentialsEnabled && (
+              <div>
+                <Input
+                  type="password"
+                  {...register("password", { required: true })}
+                  placeholder={t`Enter your password`}
+                />
+                {errors.password && (
+                  <p className="mt-2 text-xs text-red-400">
+                    {errors.password.message ??
+                      t`Please enter a valid password`}
+                  </p>
+                )}
+              </div>
+            )}
+            {loginError && (
+              <p className="mt-2 text-xs text-red-400">{loginError}</p>
+            )}
+          </div>
          <div className="mt-[1.5rem] flex items-center gap-4">
            <Button
              isLoading={isLoginWithEmailPending}
@@ -441,8 +438,11 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
              {isMagicLinkMode ? t`magic link` : t`email`}
            </Button>
          </div>
-        )}
-      </form>
+        </form>
+      )}
+      {!(isCredentialsEnabled || isMagicLinkAvailable) && loginError && (
+        <p className="mt-2 text-xs text-red-400">{loginError}</p>
+      )}
    </div>
  );
 }
--- a/apps/web/src/components/Avatar.tsx
+++ b/apps/web/src/components/Avatar.tsx
@@ -25,7 +25,7 @@ const Avatar = ({
  icon?: React.ReactNode;
  isLoading?: boolean;
 }) => {
-  const initials = name
+  const initials = name?.trim()
    ? getInitialsFromName(name)
    : inferInitialsFromEmail(email);

--- a/apps/web/src/components/CheckboxDropdown.tsx
+++ b/apps/web/src/components/CheckboxDropdown.tsx
@@ -31,6 +31,7 @@ interface CheckboxDropdownProps {
  handleEdit?: (key: string) => void;
  handleCreate?: () => void;
  asChild?: boolean;
+  disabled?: boolean;
 }

 export default function CheckboxDropdown({
@@ -44,6 +45,7 @@ export default function CheckboxDropdown({
  handleEdit,
  handleCreate,
  asChild = true,
+  disabled = false,
 }: CheckboxDropdownProps) {
  const [selectedGroup, setSelectedGroup] = useState<string | null>(null);

@@ -58,13 +60,13 @@ export default function CheckboxDropdown({
      {items.length > 0 ? (
        items.map((item) => (
          <Menu.Item key={item.key}>
-            <div
-              className="group flex items-center rounded-[5px] p-2 hover:bg-light-200 dark:hover:bg-dark-300"
-              onClick={(e) => {
-                e.preventDefault();
-                handleSelect(groupKey, { key: item.key, value: item.value });
-              }}
-            >
+              <div
+                className="group flex items-center rounded-[5px] p-2 hover:bg-light-200 dark:hover:bg-dark-300"
+                onClick={(e) => {
+                  e.preventDefault();
+                  handleSelect(groupKey, { key: item.key, value: item.value });
+                }}
+              >
              <input
                id={item.key}
                name={item.key}
@@ -132,7 +134,8 @@ export default function CheckboxDropdown({
      <>
        <Menu.Button
          as={asChild ? "div" : undefined}
-          className="h-full w-full cursor-pointer focus-visible:outline-none"
+          disabled={disabled}
+          className="h-full w-full cursor-pointer focus-visible:outline-none disabled:cursor-not-allowed"
        >
          {children}
        </Menu.Button>
--- a/apps/web/src/components/Dashboard.tsx
+++ b/apps/web/src/components/Dashboard.tsx
@@ -12,6 +12,7 @@ import { authClient } from "@kan/auth/client";
 import { useClickOutside } from "~/hooks/useClickOutside";
 import { useModal } from "~/providers/modal";
 import { useWorkspace, WorkspaceProvider } from "~/providers/workspace";
+import { api } from "~/utils/api";
 import SideNavigation from "./SideNavigation";

 interface DashboardProps {
@@ -44,6 +45,12 @@ export default function Dashboard({
  const { availableWorkspaces, hasLoaded } = useWorkspace();

  const { data: session, isPending: sessionLoading } = authClient.useSession();
+  const { data: user, isLoading: userLoading } = api.user.getUser.useQuery(
+    undefined,
+    {
+      enabled: !!session?.user,
+    },
+  );

  const [isSideNavOpen, setIsSideNavOpen] = useState(false);
  const [isRightPanelOpen, setIsRightPanelOpen] = useState(false);
@@ -155,8 +162,12 @@ export default function Dashboard({
            className={`fixed top-12 z-40 h-[calc(100dvh-3rem)] w-[calc(100vw-1.5rem)] transform transition-transform duration-300 ease-in-out md:relative md:top-0 md:h-full md:w-auto md:translate-x-0 ${isSideNavOpen ? "translate-x-0" : "-translate-x-full md:translate-x-0"} `}
          >
            <SideNavigation
-              user={{ email: session?.user.email, image: session?.user.image }}
-              isLoading={sessionLoading}
+              user={{
+                displayName: user?.name ?? session?.user.name,
+                email: user?.email ?? session?.user.email ?? "",
+                image: user?.image ?? undefined,
+              }}
+              isLoading={sessionLoading || userLoading}
              onCloseSideNav={closeSideNav}
            />
          </div>
--- a/apps/web/src/components/Dropdown.tsx
+++ b/apps/web/src/components/Dropdown.tsx
@@ -6,7 +6,7 @@ export default function Dropdown({
  children,
  disabled,
 }: {
-  items: { label: string; action: () => void; icon?: React.ReactNode }[];
+  items: { label: string; action?: () => void; icon?: React.ReactNode; disabled?: boolean }[];
  children: React.ReactNode;
  disabled?: boolean;
 }) {
@@ -30,13 +30,14 @@ export default function Dropdown({
        leaveFrom="transform opacity-100 scale-100"
        leaveTo="transform opacity-0 scale-95"
      >
-        <Menu.Items className="absolute right-0 z-50 mt-2 w-56 origin-top-right rounded-md border border-light-200 bg-light-50 p-1 shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none dark:border-dark-400 dark:bg-dark-300">
+        <Menu.Items className="absolute right-0 z-[100] isolate mt-2 w-56 origin-top-right rounded-md border border-light-200 bg-white p-1 shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none dark:border-dark-400 dark:bg-dark-300">
          <div className="flex flex-col">
            {items.map((item) => (
-              <Menu.Item key={item.label}>
+              <Menu.Item key={item.label} disabled={item.disabled}>
                <button
                  onClick={item.action}
-                  className="flex w-auto items-center gap-2 rounded-[5px] px-2.5 py-1.5 text-left text-sm text-neutral-900 hover:bg-light-200 dark:text-dark-950 dark:hover:bg-dark-400"
+                  disabled={item.disabled ?? !item.action}
+                  className="flex w-auto items-center gap-2 rounded-[5px] px-2.5 py-1.5 text-left text-sm text-neutral-900 hover:bg-light-200 disabled:cursor-not-allowed disabled:opacity-60 dark:text-dark-950 dark:hover:bg-dark-400"
                >
                  {item.icon}
                  {item.label}
--- a/apps/web/src/components/Editor.tsx
+++ b/apps/web/src/components/Editor.tsx
@@ -1,3 +1,4 @@
+import type { Range as TiptapRange } from "@tiptap/core";
 import type { Editor as TiptapEditor } from "@tiptap/react";
 import type {
  SuggestionKeyDownProps,
@@ -16,6 +17,7 @@ import {
  ReactRenderer,
  useEditor,
 } from "@tiptap/react";
+import Typography from "@tiptap/extension-typography";
 import StarterKit from "@tiptap/starter-kit";
 import Suggestion from "@tiptap/suggestion";
 import {
@@ -44,6 +46,7 @@ import { Markdown } from "tiptap-markdown";

 import { getAvatarUrl } from "~/utils/helpers";
 import Avatar from "./Avatar";
+import { YouTubeNode } from "./YouTubeEmbed/YouTubeNode";

 declare module "@tiptap/core" {
  interface Commands<ReturnType> {
@@ -56,7 +59,7 @@ declare module "@tiptap/core" {
 export interface SlashCommandItem {
  title: string;
  icon?: React.ReactNode;
-  command?: (props: { editor: TiptapEditor; range: Range }) => void;
+  command?: (props: { editor: TiptapEditor; range: TiptapRange }) => void;
  disabled?: boolean;
 }

@@ -431,12 +434,14 @@ export default function Editor({
  onBlur,
  readOnly = false,
  workspaceMembers,
+  enableYouTubeEmbed = true,
 }: {
  content: string | null;
  onChange?: (value: string) => void;
  onBlur?: () => void;
  readOnly?: boolean;
  workspaceMembers: WorkspaceMember[];
+  enableYouTubeEmbed?: boolean;
 }) {
  const containerRef = useRef<HTMLDivElement>(null);

@@ -484,10 +489,17 @@ export default function Editor({
                }),
              );
              const q = query.toLowerCase();
-              return all.filter((u) => u.label.toLowerCase().includes(q));
+              return all.filter(
+                (u) =>
+                  u.label &&
+                  typeof u.label === "string" &&
+                  u.label.toLowerCase().includes(q),
+              );
            },
-            command: ({ editor, range, props }: any) => {
-              const mentionHTML = `<span data-type="mention" data-id="${props.id}" data-label="${props.label}">@${props.label}</span>&nbsp;`;
+            command: ({ editor, range, props }) => {
+              const id = props.id ?? "";
+              const label = props.label ?? "";
+              const mentionHTML = `<span data-type="mention" data-id="${id}" data-label="${label}">@${label}</span>&nbsp;`;

              editor
                .chain()
@@ -503,6 +515,18 @@ export default function Editor({
            return `${options.suggestion.char}${node.attrs.label ?? node.attrs.id}`;
          },
        }),
+        Typography.configure({
+            openDoubleQuote: false,
+            closeDoubleQuote: false,
+            openSingleQuote: false,
+            closeSingleQuote: false,
+            oneHalf: false,
+            oneQuarter: false,
+            threeQuarters: false,
+            superscriptTwo: false,
+            superscriptThree: false,
+        }),
+        ...(enableYouTubeEmbed ? [YouTubeNode] : []),
      ],
      content,
      onUpdate: ({ editor }) => onChange?.(editor.getHTML()),
@@ -559,6 +583,9 @@ export default function Editor({
          text-decoration: none;
          font-weight: 500;
        }
+        .tiptap [data-youtube] {
+          margin: 1rem 0;
+        }
      `}</style>
      {!readOnly && editor && <EditorBubbleMenu editor={editor} />}
      <EditorContent
--- a/apps/web/src/components/Popup.tsx
+++ b/apps/web/src/components/Popup.tsx
@@ -25,7 +25,7 @@ const Popup: React.FC = () => {
  return (
    <div
      aria-live="assertive"
-      className="pointer-events-none fixed inset-0 z-10 flex items-end p-3 sm:items-end"
+      className="pointer-events-none fixed inset-0 z-10 flex items-end p-3 sm:items-end m-3"
    >
      <div className="flex w-full flex-col items-center space-y-4 sm:items-end">
        <Transition
@@ -37,43 +37,43 @@ const Popup: React.FC = () => {
          leaveFrom="opacity-100 translate-y-0 sm:scale-100"
          leaveTo="opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95"
        >
-          <div className="pointer-events-auto w-full max-w-sm overflow-hidden rounded-lg border border-light-400 bg-light-50 shadow-lg ring-1 ring-black ring-opacity-5 transition data-[closed]:data-[enter]:translate-y-2 data-[enter]:transform data-[closed]:opacity-0 data-[enter]:duration-300 data-[leave]:duration-100 data-[enter]:ease-out data-[leave]:ease-in dark:border-dark-300 dark:bg-dark-200 data-[closed]:data-[enter]:sm:translate-x-2 data-[closed]:data-[enter]:sm:translate-y-0">
-            <div className="p-4">
+          <div className="pointer-events-auto w-full max-w-[350px] overflow-hidden rounded-xl border border-light-400 bg-light-50 shadow-lg ring-opacity-5 transition data-[closed]:data-[enter]:translate-y-2 data-[enter]:transform data-[closed]:opacity-0 data-[enter]:duration-300 data-[leave]:duration-100 data-[enter]:ease-out data-[leave]:ease-in dark:border-dark-300 dark:bg-dark-100 data-[closed]:data-[enter]:sm:translate-x-2 data-[closed]:data-[enter]:sm:translate-y-0">
+            <div className="p-4 relative">
              <div className="flex items-start">
-                <div className="flex-shrink-0">
+                <div className="flex-shrink-0 mt-1">
                  {popupIcon === "success" && (
                    <HiOutlineCheckCircle
                      aria-hidden="true"
-                      className="h-6 w-6 text-green-400"
+                      className="h-5 w-5 text-green-400"
                    />
                  )}
                  {popupIcon === "error" && (
                    <HiOutlineExclamationCircle
                      aria-hidden="true"
-                      className="h-6 w-6 text-red-400"
+                      className="h-5 w-5 text-red-400"
                    />
                  )}
                </div>
                <div className="ml-3 w-0 flex-1 pt-0.5">
-                  <p className="text-sm font-medium text-neutral-900 dark:text-dark-1000">
+                  <p className="text-[12px] font-bold text-neutral-900 dark:text-dark-950">
                    {popupHeader}
                  </p>
-                  <p className="mt-1 text-sm text-neutral-500 dark:text-dark-900">
+                  <p className="mt-1 text-[12px] text-neutral-500 dark:text-dark-900">
                    {popupMessage}
                  </p>
                </div>
-                <div className="ml-4 flex flex-shrink-0">
+                <div className="ml-4 flex flex-shrink-0 absolute right-3 top-3">
                  <button
                    type="button"
                    onClick={() => {
                      hidePopup();
                    }}
-                    className="mx-1 inline-flex h-fit items-center rounded-md p-1 px-1 text-sm font-semibold text-dark-50 hover:bg-light-100 dark:hover:bg-dark-400"
+                    className="inline-flex h-fit items-center rounded-md p-1 px-1 text-sm font-semibold text-dark-50 hover:bg-light-100 dark:hover:bg-dark-200"
                  >
                    <span className="sr-only">Close</span>
                    <HiXMark
                      aria-hidden="true"
-                      className="h-5 w-5 text-dark-900"
+                      className="h-4 w-4 text-dark-900"
                    />
                  </button>
                </div>
--- a/apps/web/src/components/ReactiveButton.tsx
+++ b/apps/web/src/components/ReactiveButton.tsx
@@ -46,7 +46,8 @@ const Button: React.FC<{
      onMouseEnter={handleMouseEnter}
      onClick={handleClick}
      className={twMerge(
-        "group flex h-[34px] items-center justify-between rounded-md p-1.5 text-sm font-normal leading-6 hover:bg-light-200 hover:text-light-1000 dark:hover:bg-dark-200 dark:hover:text-dark-1000",
+        "group flex h-[34px] items-center rounded-md p-1.5 text-sm font-normal leading-6 hover:bg-light-200 hover:text-light-1000 dark:hover:bg-dark-200 dark:hover:text-dark-1000",
+        isCollapsed ? "md:justify-center" : "justify-between",
        current
          ? "bg-light-200 text-light-1000 dark:bg-dark-200 dark:text-dark-1000"
          : "text-neutral-600 dark:bg-dark-100 dark:text-dark-900",
--- a/apps/web/src/components/SettingsLayout.tsx
+++ b/apps/web/src/components/SettingsLayout.tsx
@@ -14,8 +14,11 @@ import {
  HiOutlineBanknotes,
  HiOutlineCodeBracketSquare,
  HiOutlineRectangleGroup,
+  HiOutlineShieldCheck,
  HiOutlineUser,
 } from "react-icons/hi2";
+import { usePermissions } from "~/hooks/usePermissions";
+import { useWorkspace } from "~/providers/workspace";

 interface SettingsLayoutProps {
  children: React.ReactNode;
@@ -24,8 +27,12 @@ interface SettingsLayoutProps {

 export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
  const router = useRouter();
+  const { workspace } = useWorkspace();
+  const { canViewWorkspace, canEditWorkspace } = usePermissions();
  const [selectedTabIndex, setSelectedTabIndex] = useState(0);

+  const isAdmin = workspace.role === "admin";
+
  const settingsTabs = [
    {
      key: "account",
@@ -37,13 +44,19 @@ export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
      key: "workspace",
      icon: <HiOutlineRectangleGroup />,
      label: t`Workspace`,
-      condition: true,
+      condition: canViewWorkspace,
+    },
+    {
+      key: "permissions",
+      icon: <HiOutlineShieldCheck />,
+      label: t`Permissions`,
+      condition: isAdmin,
    },
    {
      key: "billing",
      label: t`Billing`,
      icon: <HiOutlineBanknotes />,
-      condition: env("NEXT_PUBLIC_KAN_ENV") === "cloud",
+      condition: env("NEXT_PUBLIC_KAN_ENV") === "cloud" && isAdmin,
    },
    {
      key: "api",
@@ -55,7 +68,7 @@ export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
      key: "integrations",
      icon: <HiOutlineCodeBracketSquare />,
      label: t`Integrations`,
-      condition: true,
+      condition: canEditWorkspace,
    },
  ];

@@ -97,7 +110,7 @@ export function SettingsLayout({ children, currentTab }: SettingsLayoutProps) {
              >
                <div className="relative mb-4">
                  <ListboxButton className="w-full appearance-none rounded-lg border-0 bg-light-50 py-2 pl-3 pr-10 text-left text-sm text-light-1000 shadow-sm ring-1 ring-inset ring-light-300 focus:ring-2 focus:ring-inset focus:ring-light-400 dark:bg-dark-50 dark:text-dark-1000 dark:ring-dark-300 dark:focus:ring-dark-500">
-                    {availableTabs[selectedTabIndex]?.label || "Select a tab"}
+                    {availableTabs[selectedTabIndex]?.label ?? "Select a tab"}
                    <HiChevronDown
                      aria-hidden="true"
                      className="pointer-events-none absolute right-3 top-1/2 h-4 w-4 -translate-y-1/2 text-light-900 dark:text-dark-900"
--- a/apps/web/src/components/SideNavigation.tsx
+++ b/apps/web/src/components/SideNavigation.tsx
@@ -39,6 +39,7 @@ interface SideNavigationProps {
 }

 interface UserType {
+  displayName?: string | null | undefined;
  email?: string | null | undefined;
  image?: string | null | undefined;
 }
@@ -54,9 +55,10 @@ export default function SideNavigation({
  const [isInitialised, setIsInitialised] = useState(false);
  const { openModal } = useModal();

-  const { data: workspaceData } = api.workspace.byId.useQuery({
-    workspacePublicId: workspace.publicId,
-  });
+  const { data: workspaceData } = api.workspace.byId.useQuery(
+    { workspacePublicId: workspace.publicId },
+    { enabled: !!workspace.publicId && workspace.publicId.length >= 12 },
+  );

  const subscriptions = workspaceData?.subscriptions as
    | Subscription[]
@@ -206,7 +208,8 @@ export default function SideNavigation({

        <div className="space-y-2">
          <UserMenu
-            email={user.email ?? ""}
+            displayName={user.displayName ?? undefined}
+            email={user.email ?? "Email not provided?"}
            imageUrl={user.image ?? undefined}
            isLoading={isLoading}
            isCollapsed={isCollapsed}
--- a/apps/web/src/components/Toggle.tsx
+++ b/apps/web/src/components/Toggle.tsx
@@ -6,16 +6,20 @@ const Toggle = ({
  onChange,
  label,
  disabled,
+  showLabel = true,
 }: {
  isChecked: boolean;
  onChange: () => void;
  label: string;
  disabled?: boolean;
+  showLabel?: boolean;
 }) => (
  <div className="mr-4 flex items-center justify-end">
-    <span className="mr-2 text-xs text-light-900 dark:text-dark-900">
-      {label}
-    </span>
+    {showLabel && (
+      <span className="mr-2 text-xs text-light-900 dark:text-dark-900">
+        {label}
+      </span>
+    )}
    <Switch
      checked={isChecked}
      onChange={onChange}
--- a/apps/web/src/components/Tooltip.tsx
+++ b/apps/web/src/components/Tooltip.tsx
@@ -7,7 +7,7 @@ import tippy from "tippy.js";

 interface TooltipProps {
  children: ReactNode;
-  content: ReactNode;
+  content?: ReactNode;
  placement?: Placement;
  delay?: number | [number, number];
 }
@@ -24,6 +24,8 @@ export function Tooltip({
  useEffect(() => {
    if (!triggerRef.current) return;

+    if (!content) return;
+
    const container = document.createElement("div");
    const root = createRoot(container);
    rootRef.current = root;
@@ -35,6 +37,7 @@ export function Tooltip({
      delay,
      interactive: false,
      theme: "tooltip",
+      touch: false,
    });

    return () => {
--- a/apps/web/src/components/UserMenu.tsx
+++ b/apps/web/src/components/UserMenu.tsx
@@ -9,6 +9,7 @@ import { twMerge } from "tailwind-merge";

 import { authClient } from "@kan/auth/client";

+import { env } from "~/env";
 import { useIsMobile } from "~/hooks/useMediaQuery";
 import { useKeyboardShortcuts } from "~/providers/keyboard-shortcuts";
 import { useModal } from "~/providers/modal";
@@ -16,6 +17,7 @@ import { getAvatarUrl } from "~/utils/helpers";

 interface UserMenuProps {
  imageUrl: string | undefined;
+  displayName: string | undefined;
  email: string;
  isLoading: boolean;
  isCollapsed?: boolean;
@@ -25,6 +27,7 @@ interface UserMenuProps {
 export default function UserMenu({
  imageUrl,
  email,
+  displayName,
  isLoading,
  isCollapsed = false,
  onCloseSideNav,
@@ -74,7 +77,7 @@ export default function UserMenu({
        ) : (
          <Menu.Button
            className="flex w-full items-center rounded-md p-1.5 text-neutral-900 hover:bg-light-200 dark:text-dark-900 dark:hover:bg-dark-200 dark:hover:text-dark-1000"
-            title={isCollapsed ? email : undefined}
+            title={isCollapsed ? (displayName || email) : undefined}
          >
            {avatarUrl ? (
              <Image
@@ -101,7 +104,7 @@ export default function UserMenu({
                isCollapsed && "md:hidden",
              )}
            >
-              {email}
+              {displayName || email}
            </span>
          </Menu.Button>
        )}
@@ -225,6 +228,25 @@ export default function UserMenu({
                </button>
              </Menu.Item>
            </div>
+            {env.NEXT_PUBLIC_APP_VERSION && (
+              <div className="light-border-600 border-t-[1px] p-1 dark:border-dark-600">
+                <Menu.Item>
+                  <Link
+                    href={
+                      env.NEXT_PUBLIC_APP_VERSION.includes("+")
+                        ? `https://github.com/kanbn/kan/commit/${env.NEXT_PUBLIC_APP_VERSION.split("+")[1]}`
+                        : `https://github.com/kanbn/kan/releases/tag/v${env.NEXT_PUBLIC_APP_VERSION}`
+                    }
+                    target="_blank"
+                    rel="noreferrer"
+                    onClick={handleLinkClick}
+                    className="flex w-full items-center justify-center rounded-[5px] px-3 py-2 text-center text-xs text-light-900 hover:bg-light-200 dark:text-dark-900 dark:hover:bg-dark-400"
+                  >
+                    Version: {env.NEXT_PUBLIC_APP_VERSION}
+                  </Link>
+                </Menu.Item>
+              </div>
+            )}
          </div>
        </Menu.Items>
      </Transition>
--- a/apps/web/src/components/YouTubeEmbed/EditYouTubeModal.tsx
+++ b/apps/web/src/components/YouTubeEmbed/EditYouTubeModal.tsx
@@ -0,0 +1,189 @@
+import { t } from "@lingui/core/macro";
+import { useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
+import { HiXMark } from "react-icons/hi2";
+
+import Button from "~/components/Button";
+import Input from "~/components/Input";
+import { useModal } from "~/providers/modal";
+import { fetchYouTubeMetadata, isYouTubeUrl } from "./utils";
+
+interface EditYouTubeFormInput {
+  url: string;
+  title: string;
+}
+
+interface EditYouTubeModalState {
+  url: string;
+  title: string;
+  onSave: (url: string, title: string) => void;
+}
+
+export function EditYouTubeModal() {
+  const { closeModal, getModalState } = useModal();
+  const [isValidating, setIsValidating] = useState(false);
+  const [urlError, setUrlError] = useState<string | null>(null);
+
+  // Get initial values and callback from modal state
+  const modalState = getModalState("EDIT_YOUTUBE") as
+    | EditYouTubeModalState
+    | undefined;
+  const initialUrl = modalState?.url ?? "";
+  const initialTitle = modalState?.title ?? "";
+  const onSave = modalState?.onSave;
+
+  const { register, handleSubmit, watch, reset } =
+    useForm<EditYouTubeFormInput>({
+      defaultValues: {
+        url: initialUrl,
+        title: initialTitle,
+      },
+    });
+
+  // Reset form when modal state changes (when modal opens with new values)
+  useEffect(() => {
+    if (modalState) {
+      reset({
+        url: modalState.url,
+        title: modalState.title,
+      });
+    }
+  }, [modalState, reset]);
+
+  const currentUrl = watch("url");
+
+  const onSubmit = async (values: EditYouTubeFormInput) => {
+    // Validate URL
+    if (!isYouTubeUrl(values.url)) {
+      setUrlError(t`Please enter a valid YouTube URL`);
+      return;
+    }
+
+    setUrlError(null);
+    setIsValidating(true);
+
+    try {
+      // If title is empty and URL changed, fetch new title
+      let finalTitle = values.title;
+      if (!finalTitle.trim() && values.url !== initialUrl) {
+        const metadata = await fetchYouTubeMetadata(values.url);
+        finalTitle = metadata?.title ?? "YouTube Video";
+      } else if (!finalTitle.trim()) {
+        // Keep existing title if no new title provided and URL unchanged
+        finalTitle = initialTitle || "YouTube Video";
+      }
+
+      if (onSave) {
+        onSave(values.url, finalTitle);
+      }
+      closeModal();
+    } catch (error) {
+      console.error(error);
+      setUrlError(t`Failed to fetch video information`);
+    } finally {
+      setIsValidating(false);
+    }
+  };
+
+  // Auto-focus on title input (more useful for editing)
+  useEffect(() => {
+    const titleElement: HTMLElement | null =
+      document.querySelector<HTMLElement>("#youtube-title");
+    if (titleElement) titleElement.focus();
+  }, []);
+
+  // Validate URL on change
+  useEffect(() => {
+    if (currentUrl && !isYouTubeUrl(currentUrl)) {
+      setUrlError(t`Please enter a valid YouTube URL`);
+    } else {
+      setUrlError(null);
+    }
+  }, [currentUrl]);
+
+  return (
+    <form onSubmit={handleSubmit(onSubmit)}>
+      <div className="px-5 pt-5">
+        <div className="flex w-full items-center justify-between pb-4 text-neutral-900 dark:text-dark-1000">
+          <h2 className="text-sm font-medium">{t`Edit YouTube Video`}</h2>
+          <button
+            type="button"
+            className="rounded p-1 hover:bg-light-300 focus:outline-none dark:hover:bg-dark-300"
+            onClick={(e) => {
+              e.preventDefault();
+              closeModal();
+            }}
+          >
+            <HiXMark size={18} className="text-light-900 dark:text-dark-900" />
+          </button>
+        </div>
+
+        <div className="space-y-4">
+          <div>
+            <label
+              htmlFor="youtube-title"
+              className="mb-2 block text-xs font-medium text-light-900 dark:text-dark-900"
+            >
+              {t`Title`}
+            </label>
+            <Input
+              id="youtube-title"
+              placeholder={t`Enter a custom title`}
+              {...register("title")}
+              onKeyDown={async (e) => {
+                if (e.key === "Enter") {
+                  e.preventDefault();
+                  await handleSubmit(onSubmit)();
+                }
+              }}
+            />
+          </div>
+
+          <div>
+            <label
+              htmlFor="youtube-url"
+              className="mb-2 block text-xs font-medium text-light-900 dark:text-dark-900"
+            >
+              {t`YouTube URL`}
+            </label>
+            <Input
+              id="youtube-url"
+              placeholder={t`https://www.youtube.com/watch?v=...`}
+              {...register("url", { required: true })}
+              onKeyDown={async (e) => {
+                if (e.key === "Enter") {
+                  e.preventDefault();
+                  await handleSubmit(onSubmit)();
+                }
+              }}
+            />
+            {urlError && (
+              <p className="mt-1 text-xs text-red-600 dark:text-red-400">
+                {urlError}
+              </p>
+            )}
+          </div>
+        </div>
+      </div>
+
+      <div className="mt-12 flex items-center justify-end border-t border-light-600 px-5 pb-5 pt-5 dark:border-dark-600">
+        <div className="space-x-2">
+          <Button
+            type="button"
+            variant="secondary"
+            onClick={() => closeModal()}
+          >
+            {t`Cancel`}
+          </Button>
+          <Button
+            type="submit"
+            isLoading={isValidating}
+            disabled={!watch("url") || !!urlError}
+          >
+            {t`Save`}
+          </Button>
+        </div>
+      </div>
+    </form>
+  );
+}
--- a/apps/web/src/components/YouTubeEmbed/YouTubeCard.tsx
+++ b/apps/web/src/components/YouTubeEmbed/YouTubeCard.tsx
@@ -0,0 +1,53 @@
+import YouTubeDropdown from "./YouTubeDropdown";
+
+interface YouTubeCardProps {
+  videoId: string;
+  url: string;
+  title: string;
+  showEmbed?: boolean;
+  onConvertToLink: () => void;
+  onDelete: () => void;
+  onUpdate: (url: string, title: string) => void;
+}
+
+const YouTubeCard = ({
+  videoId,
+  url,
+  title,
+  showEmbed = true,
+  onConvertToLink,
+  onDelete,
+  onUpdate,
+}: YouTubeCardProps) => {
+  return (
+    <div className="w-full max-w-md rounded-lg border border-light-300 bg-light-50 dark:border-dark-300 dark:bg-dark-50">
+      <div className="flex items-center justify-between gap-6 p-0 px-6">
+        <h3 className="truncate text-sm font-medium">{title}</h3>
+        <div className="mt-3">
+          <YouTubeDropdown
+            url={url}
+            title={title}
+            onConvertToLink={onConvertToLink}
+            onDelete={onDelete}
+            onUpdate={onUpdate}
+          />
+        </div>
+      </div>
+
+      {showEmbed && videoId && (
+        <div className="p-6 pt-1">
+          <iframe
+            src={`https://www.youtube.com/embed/${videoId}?rel=0`}
+            title={title}
+            className="aspect-video w-full rounded-lg"
+            allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
+            referrerPolicy="strict-origin-when-cross-origin"
+            allowFullScreen
+          />
+        </div>
+      )}
+    </div>
+  );
+};
+
+export default YouTubeCard;
--- a/apps/web/src/components/YouTubeEmbed/YouTubeDropdown.tsx
+++ b/apps/web/src/components/YouTubeEmbed/YouTubeDropdown.tsx
@@ -0,0 +1,63 @@
+import { t } from "@lingui/core/macro";
+import {
+  HiEllipsisHorizontal,
+  HiLink,
+  HiPencil,
+  HiTrash,
+} from "react-icons/hi2";
+
+import { useModal } from "~/providers/modal";
+import Dropdown from "../Dropdown";
+
+interface YouTubeDropdownProps {
+  url: string;
+  title: string;
+  onConvertToLink: () => void;
+  onDelete: () => void;
+  onUpdate: (url: string, title: string) => void;
+}
+
+const YouTubeDropdown = ({
+  url,
+  title,
+  onConvertToLink,
+  onDelete,
+  onUpdate,
+}: YouTubeDropdownProps) => {
+  const { openModal, setModalState } = useModal();
+
+  const handleEdit = () => {
+    setModalState("EDIT_YOUTUBE", {
+      url,
+      title,
+      onSave: onUpdate,
+    });
+    openModal("EDIT_YOUTUBE");
+  };
+
+  return (
+    <Dropdown
+      items={[
+        {
+          label: t`Edit`,
+          action: handleEdit,
+          icon: <HiPencil className="h-4 w-4 text-dark-900" />,
+        },
+        {
+          label: t`Convert to link`,
+          action: onConvertToLink,
+          icon: <HiLink className="h-4 w-4 text-dark-900" />,
+        },
+        {
+          label: t`Delete`,
+          action: onDelete,
+          icon: <HiTrash className="h-4 w-4 text-dark-900" />,
+        },
+      ]}
+    >
+      <HiEllipsisHorizontal className="h-5 w-5 text-dark-900" />
+    </Dropdown>
+  );
+};
+
+export default YouTubeDropdown;
--- a/apps/web/src/components/YouTubeEmbed/YouTubeNode.tsx
+++ b/apps/web/src/components/YouTubeEmbed/YouTubeNode.tsx
@@ -0,0 +1,196 @@
+import { mergeAttributes, Node } from "@tiptap/core";
+import { Plugin, PluginKey } from "@tiptap/pm/state";
+import { ReactNodeViewRenderer } from "@tiptap/react";
+
+import { extractVideoId, fetchYouTubeMetadata, isYouTubeUrl } from "./utils";
+import YouTubeNodeView from "./YouTubeNodeView";
+
+export interface YouTubeOptions {
+  inline: boolean;
+  HTMLAttributes: Record<string, undefined>;
+}
+
+declare module "@tiptap/core" {
+  interface Commands<ReturnType> {
+    youTube: {
+      setYouTubeEmbed: (options: {
+        videoId: string;
+        url: string;
+        title: string;
+        thumbnailUrl?: string;
+        showEmbed?: boolean;
+      }) => ReturnType;
+    };
+  }
+}
+
+export const YouTubeNode = Node.create<YouTubeOptions>({
+  name: "youtube",
+  group: "block",
+  atom: true,
+  addOptions() {
+    return {
+      inline: false,
+      HTMLAttributes: {},
+    };
+  },
+
+  addAttributes() {
+    return {
+      videoId: {
+        default: null,
+        parseHTML: (element) => element.getAttribute("data-video-id"),
+        renderHTML: (attributes) => {
+          if (!attributes.videoId) return {};
+          return { "data-video-id": attributes.videoId as string };
+        },
+      },
+      url: {
+        default: null,
+        parseHTML: (element) => element.getAttribute("data-url"),
+        renderHTML: (attributes) => {
+          if (!attributes.url) return {};
+          return { "data-url": attributes.url as string };
+        },
+      },
+      title: {
+        default: "YouTube Video",
+        parseHTML: (element) => element.getAttribute("data-title"),
+        renderHTML: (attributes) => {
+          return { "data-title": attributes.title as string };
+        },
+      },
+      thumbnailUrl: {
+        default: null,
+        parseHTML: (element) => element.getAttribute("data-thumbnail"),
+        renderHTML: (attributes) => {
+          if (!attributes.thumbnailUrl) return {};
+          return { "data-thumbnail": attributes.thumbnailUrl as string };
+        },
+      },
+      showEmbed: {
+        default: true,
+        parseHTML: (element) => element.getAttribute("data-show-embed"),
+        renderHTML: (attributes) => {
+          return { "data-show-embed": attributes.showEmbed as string };
+        },
+      },
+    };
+  },
+
+  parseHTML() {
+    return [
+      {
+        tag: "div[data-youtube]",
+      },
+    ];
+  },
+
+  renderHTML({ HTMLAttributes }) {
+    return [
+      "div",
+      mergeAttributes(
+        { "data-youtube": "" },
+        this.options.HTMLAttributes,
+        HTMLAttributes,
+      ),
+    ];
+  },
+
+  addNodeView() {
+    return ReactNodeViewRenderer(YouTubeNodeView);
+  },
+
+  addProseMirrorPlugins() {
+    const nodeType = this.type;
+
+    return [
+      new Plugin({
+        key: new PluginKey("youtubePaste"),
+        props: {
+          handlePaste: (view, event) => {
+            const text = event.clipboardData?.getData("text/plain");
+            if (!text) return false;
+
+            // Check if the pasted text is a YouTube URL
+            const youtubeRegex =
+              /(https?:\/\/)?(www\.)?(youtube\.com\/watch\?v=|youtu\.be\/|youtube\.com\/embed\/)([\w-]+)/;
+            const match = youtubeRegex.exec(text);
+
+            if (!match || !isYouTubeUrl(text)) return false;
+
+            const videoId = extractVideoId(text);
+            if (!videoId) return false;
+
+            const { state, dispatch } = view;
+            const { tr } = state;
+
+            const node = nodeType.create({
+              videoId,
+              url: text,
+              title: "Loading...",
+              showEmbed: true,
+            });
+
+            tr.replaceSelectionWith(node);
+            dispatch(tr);
+
+            // Fetch metadata asynchronously and update the node
+            void fetchYouTubeMetadata(text).then((metadata) => {
+              const { state: newState, dispatch: newDispatch } = view;
+              const { tr: newTr } = newState;
+
+              newState.doc.descendants((n, pos) => {
+                if (
+                  n.type.name === "youtube" &&
+                  n.attrs.videoId === videoId &&
+                  n.attrs.title === "Loading..."
+                ) {
+                  newTr.setNodeMarkup(pos, undefined, {
+                    ...n.attrs,
+                    title: metadata?.title ?? "YouTube Video",
+                    thumbnailUrl: metadata?.thumbnail_url ?? null,
+                  });
+                  return false;
+                }
+                return true;
+              });
+
+              if (newTr.docChanged) {
+                newDispatch(newTr);
+              }
+            });
+
+            return true;
+          },
+        },
+      }),
+    ];
+  },
+
+  // commands for the YouTube embed node
+  addCommands() {
+    return {
+      setYouTubeEmbed:
+        (options: {
+          videoId: string;
+          url: string;
+          title?: string;
+          thumbnailUrl?: string;
+          showEmbed?: boolean;
+        }) =>
+        ({ editor }) => {
+          return editor.commands.insertContent({
+            type: this.name,
+            attrs: {
+              videoId: options.videoId,
+              url: options.url,
+              title: options.title ?? "YouTube Video",
+              thumbnailUrl: options.thumbnailUrl,
+              showEmbed: options.showEmbed ?? true,
+            },
+          });
+        },
+    };
+  },
+});
--- a/apps/web/src/components/YouTubeEmbed/YouTubeNodeView.tsx
+++ b/apps/web/src/components/YouTubeEmbed/YouTubeNodeView.tsx
@@ -0,0 +1,82 @@
+import type { NodeViewProps } from "@tiptap/react";
+import { NodeViewWrapper } from "@tiptap/react";
+
+import { extractVideoId } from "./utils";
+import YouTubeCard from "./YouTubeCard";
+
+export default function YouTubeNodeView({
+  node,
+  editor,
+  getPos,
+  deleteNode,
+  updateAttributes,
+}: NodeViewProps) {
+  const { videoId, title, url, showEmbed } = node.attrs as {
+    videoId: string;
+    title: string;
+    url: string;
+    showEmbed: boolean;
+  };
+
+  const handleConvertToLink = () => {
+    const pos = getPos();
+    if (typeof pos !== "number") return;
+
+    const linkContent = {
+      type: "paragraph",
+      content: [
+        {
+          type: "text",
+          text: url,
+          marks: [
+            {
+              type: "link",
+              attrs: {
+                href: url,
+                target: "_blank",
+              },
+            },
+          ],
+        },
+      ],
+    };
+
+    editor
+      .chain()
+      .focus()
+      .deleteRange({ from: pos, to: pos + node.nodeSize })
+      .insertContentAt(pos, linkContent)
+      .run();
+  };
+
+  const handleDelete = () => {
+    deleteNode();
+  };
+
+  const handleUpdate = (newUrl: string, newTitle: string) => {
+    if (newUrl !== url) {
+      const newVideoId = extractVideoId(newUrl);
+      updateAttributes({
+        url: newUrl,
+        title: newTitle,
+        videoId: newVideoId,
+      });
+    } else {
+      updateAttributes({ title: newTitle });
+    }
+  };
+
+  return (
+    <NodeViewWrapper>
+      <YouTubeCard
+        videoId={videoId}
+        url={url}
+        title={title}
+        showEmbed={showEmbed}
+        onConvertToLink={handleConvertToLink}
+        onDelete={handleDelete}
+        onUpdate={handleUpdate}
+      />
+    </NodeViewWrapper>
+  );
+}
--- a/apps/web/src/components/YouTubeEmbed/utils.ts
+++ b/apps/web/src/components/YouTubeEmbed/utils.ts
@@ -0,0 +1,61 @@
+export function extractVideoId(url: string): string | null {
+  if (!url) return null;
+  url = url.trim();
+
+  // youtube.com/watch?v=VIDEO_ID
+  const watchMatch = /(?:youtube\.com\/watch\?v=)([a-zA-Z0-9_-]{11})/.exec(url);
+  if (watchMatch) return watchMatch[1] ?? null;
+
+  // youtu.be/VIDEO_ID
+  const shortMatch = /(?:youtu\.be\/)([a-zA-Z0-9_-]{11})/.exec(url);
+  if (shortMatch) return shortMatch[1] ?? null;
+
+  // youtube.com/embed/VIDEO_ID
+  const embedMatch = /(?:youtube\.com\/embed\/)([a-zA-Z0-9_-]{11})/.exec(url);
+  if (embedMatch) return embedMatch[1] ?? null;
+
+  return null;
+}
+
+/**
+ * Check if a URL is a valid YouTube link
+ */
+export function isYouTubeUrl(url: string): boolean {
+  if (!url) return false;
+  const videoId = extractVideoId(url);
+  return videoId !== null;
+}
+
+/**
+ * Fetch YouTube video metadata using oEmbed API
+ * Returns title, author, thumbnail URL, etc.
+ * No API key required
+ */
+export async function fetchYouTubeMetadata(url: string): Promise<{
+  title: string;
+  author_name: string;
+  thumbnail_url: string;
+} | null> {
+  try {
+    const oembedUrl = `https://www.youtube.com/oembed?url=${encodeURIComponent(url)}&format=json`;
+    const response = await fetch(oembedUrl);
+
+    if (!response.ok) {
+      return null;
+    }
+
+    const data = (await response.json()) as {
+      title: string;
+      author_name: string;
+      thumbnail_url: string;
+    };
+    return {
+      title: data.title || "YouTube Video",
+      author_name: data.author_name || "",
+      thumbnail_url: data.thumbnail_url || "",
+    };
+  } catch (error) {
+    console.error("Failed to fetch YouTube metadata:", error);
+    return null;
+  }
+}
--- a/apps/web/src/components/modal.tsx
+++ b/apps/web/src/components/modal.tsx
@@ -9,6 +9,7 @@ interface Props {
  positionFromTop?: "sm" | "md" | "lg";
  isVisible?: boolean;
  closeOnClickOutside?: boolean;
+  centered?: boolean;
 }

 const Modal: React.FC<Props> = ({
@@ -17,6 +18,7 @@ const Modal: React.FC<Props> = ({
  positionFromTop = "md",
  isVisible,
  closeOnClickOutside,
+  centered = false,
 }) => {
  const {
    isOpen,
@@ -60,7 +62,7 @@ const Modal: React.FC<Props> = ({
        </Transition.Child>

        <div className="fixed inset-0 z-50 w-screen overflow-y-auto">
-          <div className="flex min-h-full items-start justify-center p-4 text-center sm:items-start sm:p-0">
+          <div className={`flex min-h-full justify-center p-4 text-center sm:p-0 ${centered ? "items-center" : "items-start sm:items-start"}`}>
            <Transition.Child
              as={Fragment}
              enter="ease-out duration-300"
@@ -71,7 +73,7 @@ const Modal: React.FC<Props> = ({
              leaveTo="opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95"
            >
              <Dialog.Panel
-                className={`relative ${positionFromTopMap[positionFromTop]} w-full transform rounded-lg border border-light-600 bg-white/90 text-left shadow-3xl-light backdrop-blur-[6px] transition-all dark:border-dark-600 dark:bg-dark-100/90 dark:shadow-3xl-dark ${modalSizeMap[modalSize]}`}
+                className={`relative ${centered ? "" : positionFromTopMap[positionFromTop]} w-full transform rounded-lg border border-light-600 bg-white/90 text-left shadow-3xl-light backdrop-blur-[6px] transition-all dark:border-dark-600 dark:bg-dark-100/90 dark:shadow-3xl-dark ${modalSizeMap[modalSize]}`}
              >
                {children}
              </Dialog.Panel>
--- a/apps/web/src/env.ts
+++ b/apps/web/src/env.ts
@@ -14,6 +14,7 @@ export const env = createEnv({
   * This way you can ensure the app isn't built with invalid env vars.
   */
  server: {
+    KAN_ADMIN_API_KEY: z.string().optional(),
    BETTER_AUTH_SECRET: z.string(),
    BETTER_AUTH_TRUSTED_ORIGINS: z
      .string()
@@ -77,6 +78,7 @@ export const env = createEnv({
    S3_ENDPOINT: z.string().optional(),
    S3_FORCE_PATH_STYLE: z.string().optional(),
    EMAIL_FROM: z.string().optional(),
+    REDIS_URL: z.string().url().optional().or(z.literal("")),
  },

  /**
@@ -94,6 +96,14 @@ export const env = createEnv({
    NEXT_PUBLIC_AVATAR_BUCKET_NAME: z.string().optional(),
    NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME: z.string().optional(),
    NEXT_PUBLIC_STORAGE_DOMAIN: z.string().optional(),
+    NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS: z
+      .string()
+      .transform((s) => (s === "" ? undefined : s))
+      .refine(
+        (s) => !s || s.toLowerCase() === "true" || s.toLowerCase() === "false",
+      )
+      .optional(),
+    NEXT_PUBLIC_APP_VERSION: z.string().optional(),
    NEXT_PUBLIC_ALLOW_CREDENTIALS: z
      .string()
      .transform((s) => (s === "" ? undefined : s))
@@ -131,6 +141,9 @@ export const env = createEnv({
    NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME:
      process.env.NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME,
    NEXT_PUBLIC_STORAGE_DOMAIN: process.env.NEXT_PUBLIC_STORAGE_DOMAIN,
+    NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS:
+      process.env.NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS,
+    NEXT_PUBLIC_APP_VERSION: process.env.NEXT_PUBLIC_APP_VERSION,
    NEXT_PUBLIC_ALLOW_CREDENTIALS: process.env.NEXT_PUBLIC_ALLOW_CREDENTIALS,
    NEXT_PUBLIC_DISABLE_SIGN_UP: process.env.NEXT_PUBLIC_DISABLE_SIGN_UP,
    NEXT_PUBLIC_USE_STANDALONE_OUTPUT:
--- a/apps/web/src/hooks/useDragToScroll.ts
+++ b/apps/web/src/hooks/useDragToScroll.ts
@@ -0,0 +1,101 @@
+import { useEffect, useRef, useState } from "react";
+
+interface UseDragToScrollOptions {
+  /**
+   * Whether drag-to-scroll is enabled
+   */
+  enabled?: boolean;
+  /**
+   * The direction to scroll
+   */
+  direction?: "horizontal" | "vertical" | "both";
+}
+
+/**
+ * Hook to enable drag-to-scroll functionality on a scrollable element
+ * @param options Configuration options
+ * @returns Ref to attach to the scrollable element and mouse event handlers
+ */
+export function useDragToScroll({
+  enabled = true,
+  direction = "horizontal",
+}: UseDragToScrollOptions = {}) {
+  const scrollRef = useRef<HTMLDivElement>(null);
+  const [isDragging, setIsDragging] = useState(false);
+  const startPosRef = useRef({ x: 0, y: 0 });
+  const scrollStartRef = useRef({ x: 0, y: 0 });
+
+  useEffect(() => {
+    if (!enabled || !isDragging) return;
+
+    const handleMouseMove = (e: MouseEvent) => {
+      if (!scrollRef.current) return;
+
+      const deltaX = e.clientX - startPosRef.current.x;
+      const deltaY = e.clientY - startPosRef.current.y;
+
+      if (direction === "horizontal" || direction === "both") {
+        scrollRef.current.scrollLeft = scrollStartRef.current.x - deltaX;
+      }
+      if (direction === "vertical" || direction === "both") {
+        scrollRef.current.scrollTop = scrollStartRef.current.y - deltaY;
+      }
+    };
+
+    const handleMouseUp = () => {
+      setIsDragging(false);
+    };
+
+    document.addEventListener("mousemove", handleMouseMove);
+    document.addEventListener("mouseup", handleMouseUp);
+    document.body.style.cursor = "grabbing";
+    document.body.style.userSelect = "none";
+
+    return () => {
+      document.removeEventListener("mousemove", handleMouseMove);
+      document.removeEventListener("mouseup", handleMouseUp);
+      document.body.style.cursor = "";
+      document.body.style.userSelect = "";
+    };
+  }, [enabled, isDragging, direction]);
+
+  const handleMouseDown = (e: React.MouseEvent<HTMLDivElement>) => {
+    if (!scrollRef.current) return;
+
+    const target = e.target as HTMLElement;
+    const container = scrollRef.current;
+
+    // Check if the click is on an interactive or draggable element
+    // We need to be careful not to interfere with react-beautiful-dnd dragging
+    const isInteractiveElement =
+      target.closest("a") ||
+      target.closest("button") ||
+      target.closest("input") ||
+      target.closest("textarea") ||
+      target.closest("[role='button']") ||
+      target.closest("[draggable='true']") ||
+      target.closest(".react-beautiful-dnd-drag-handle") ||
+      target.closest("[data-rbd-drag-handle-draggable-id]") ||
+      target.closest("[data-rbd-draggable-id]");
+
+    // Don't start dragging if clicking on interactive elements
+    if (isInteractiveElement) return;
+
+    // Enable drag-to-scroll for any non-interactive element within the container
+    if (container.contains(target)) {
+      e.preventDefault();
+      setIsDragging(true);
+      startPosRef.current = { x: e.clientX, y: e.clientY };
+      scrollStartRef.current = {
+        x: container.scrollLeft,
+        y: container.scrollTop,
+      };
+    }
+  };
+
+  return {
+    ref: scrollRef,
+    onMouseDown: handleMouseDown,
+    isDragging,
+  };
+}
--- a/apps/web/src/hooks/useLocalisation.ts
+++ b/apps/web/src/hooks/useLocalisation.ts
@@ -19,7 +19,7 @@ export function useLocalisation() {
    nl,
    ru,
    pl,
-    ptbr: ptBR,
+    "pt-BR": ptBR,
  };

  const currentDateLocale = dateLocaleMap[locale] ?? enGB;
--- a/apps/web/src/hooks/usePermissions.ts
+++ b/apps/web/src/hooks/usePermissions.ts
@@ -0,0 +1,109 @@
+import type { Permission } from "@kan/shared";
+import { useContext } from "react";
+
+import { WorkspaceContext } from "~/providers/workspace";
+import { api } from "~/utils/api";
+
+interface UsePermissionsResult {
+  permissions: Permission[];
+  role: string | null;
+  isLoading: boolean;
+  hasPermission: (permission: Permission) => boolean;
+  canViewCard: boolean;
+  canCreateCard: boolean;
+  canEditCard: boolean;
+  canDeleteCard: boolean;
+  canCreateList: boolean;
+  canEditList: boolean;
+  canDeleteList: boolean;
+  canCreateBoard: boolean;
+  canEditBoard: boolean;
+  canDeleteBoard: boolean;
+  canViewComment: boolean;
+  canCreateComment: boolean;
+  canEditComment: boolean;
+  canDeleteComment: boolean;
+  canInviteMember: boolean;
+  canEditMember: boolean;
+  canRemoveMember: boolean;
+  canViewWorkspace: boolean;
+  canEditWorkspace: boolean;
+}
+
+export function usePermissions(): UsePermissionsResult {
+  // Check if WorkspaceProvider is available (for public board views, it may not be)
+  const workspaceContext = useContext(WorkspaceContext);
+  
+  // If WorkspaceProvider is not available, return safe defaults
+  if (!workspaceContext) {
+    const emptyPermissions: UsePermissionsResult = {
+      permissions: [],
+      role: null,
+      isLoading: false,
+      hasPermission: () => false,
+      canViewCard: false,
+      canCreateCard: false,
+      canEditCard: false,
+      canDeleteCard: false,
+      canCreateList: false,
+      canEditList: false,
+      canDeleteList: false,
+      canCreateBoard: false,
+      canEditBoard: false,
+      canDeleteBoard: false,
+      canViewComment: false,
+      canCreateComment: false,
+      canEditComment: false,
+      canDeleteComment: false,
+      canInviteMember: false,
+      canEditMember: false,
+      canRemoveMember: false,
+      canViewWorkspace: false,
+      canEditWorkspace: false,
+    };
+    return emptyPermissions;
+  }
+
+  const { workspace } = workspaceContext;
+
+  const { data, isLoading } = api.permission.getMyPermissions.useQuery(
+    { workspacePublicId: workspace.publicId },
+    {
+      enabled: !!workspace.publicId,
+    },
+  );
+
+  const permissions = (data?.permissions ?? []) as Permission[];
+  const role = data?.role ?? null;
+
+  const hasPermission = (permission: Permission): boolean => {
+    return permissions.includes(permission);
+  };
+
+  return {
+    permissions,
+    role,
+    isLoading,
+    hasPermission,
+    canViewCard: hasPermission("card:view"),
+    canCreateCard: hasPermission("card:create"),
+    canEditCard: hasPermission("card:edit"),
+    canDeleteCard: hasPermission("card:delete"),
+    canCreateList: hasPermission("list:create"),
+    canEditList: hasPermission("list:edit"),
+    canDeleteList: hasPermission("list:delete"),
+    canCreateBoard: hasPermission("board:create"),
+    canEditBoard: hasPermission("board:edit"),
+    canDeleteBoard: hasPermission("board:delete"),
+    canViewComment: hasPermission("comment:view"),
+    canCreateComment: hasPermission("comment:create"),
+    canEditComment: hasPermission("comment:edit"),
+    canDeleteComment: hasPermission("comment:delete"),
+    canInviteMember: hasPermission("member:invite"),
+    canEditMember: hasPermission("member:edit"),
+    canRemoveMember: hasPermission("member:remove"),
+    canViewWorkspace: hasPermission("workspace:view"),
+    canEditWorkspace: hasPermission("workspace:edit"),
+  };
+}
+
--- a/apps/web/src/locales/de/messages.po
+++ b/apps/web/src/locales/de/messages.po
--- a/apps/web/src/locales/de/messages.ts
+++ b/apps/web/src/locales/de/messages.ts
--- a/apps/web/src/locales/en/messages.po
+++ b/apps/web/src/locales/en/messages.po
--- a/apps/web/src/locales/en/messages.ts
+++ b/apps/web/src/locales/en/messages.ts
--- a/apps/web/src/locales/es/messages.po
+++ b/apps/web/src/locales/es/messages.po
--- a/apps/web/src/locales/es/messages.ts
+++ b/apps/web/src/locales/es/messages.ts
--- a/apps/web/src/locales/fr/messages.po
+++ b/apps/web/src/locales/fr/messages.po
--- a/apps/web/src/locales/fr/messages.ts
+++ b/apps/web/src/locales/fr/messages.ts
--- a/apps/web/src/locales/index.ts
+++ b/apps/web/src/locales/index.ts
@@ -7,7 +7,7 @@ export const locales = [
  "nl",
  "ru",
  "pl",
-  "ptbr"
+  "pt-BR"
 ] as const;

 export type Locale = (typeof locales)[number];
@@ -23,5 +23,5 @@ export const localeNames: Record<Locale, string> = {
  nl: "Nederlands",
  ru: "Русский",
  pl: "Polski",
-  ptbr: "Português",
+  "pt-BR": "Português",
 };
--- a/apps/web/src/locales/it/messages.po
+++ b/apps/web/src/locales/it/messages.po
--- a/apps/web/src/locales/it/messages.ts
+++ b/apps/web/src/locales/it/messages.ts
--- a/apps/web/src/locales/nl/messages.po
+++ b/apps/web/src/locales/nl/messages.po
--- a/apps/web/src/locales/nl/messages.ts
+++ b/apps/web/src/locales/nl/messages.ts
--- a/apps/web/src/locales/pl/messages.po
+++ b/apps/web/src/locales/pl/messages.po
--- a/apps/web/src/locales/pl/messages.ts
+++ b/apps/web/src/locales/pl/messages.ts
--- a/apps/web/src/locales/pt-BR/messages.po
+++ b/apps/web/src/locales/pt-BR/messages.po
--- a/apps/web/src/locales/pt-BR/messages.ts
+++ b/apps/web/src/locales/pt-BR/messages.ts
--- a/apps/web/src/locales/ptbr/messages.ts
+++ b/apps/web/src/locales/ptbr/messages.ts
--- a/apps/web/src/locales/ru/messages.po
+++ b/apps/web/src/locales/ru/messages.po
--- a/apps/web/src/locales/ru/messages.ts
+++ b/apps/web/src/locales/ru/messages.ts
--- a/apps/web/src/pages/api/auth/[...all].ts
+++ b/apps/web/src/pages/api/auth/[...all].ts
@@ -2,9 +2,17 @@ import { toNodeHandler } from "better-auth/node";

 import { initAuth } from "@kan/auth/server";
 import { createDrizzleClient } from "@kan/db/client";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

 export const config = { api: { bodyParser: false } };

 export const auth = initAuth(createDrizzleClient());

-export default toNodeHandler(auth.handler);
+const authHandler = toNodeHandler(auth.handler);
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req, res) => {
+    return await authHandler(req, res);
+  },
+);
--- a/apps/web/src/pages/api/download/attatchment.ts
+++ b/apps/web/src/pages/api/download/attatchment.ts
@@ -1,9 +1,10 @@
 import type { NextApiRequest, NextApiResponse } from "next";

-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
  if (req.method !== "GET") {
    return res.status(405).json({ message: "Method not allowed" });
  }
@@ -44,4 +45,5 @@ export default async function handler(
    console.error("Error downloading attachment:", error);
    return res.status(500).json({ message: "Failed to download attachment" });
  }
-}
+  },
+);
--- a/apps/web/src/pages/api/oss-friends.ts
+++ b/apps/web/src/pages/api/oss-friends.ts
@@ -1,9 +1,10 @@
 import type { NextApiRequest, NextApiResponse } from "next";

-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
  if (req.method !== "GET") {
    return res.status(405).json({ message: "Method not allowed" });
  }
@@ -20,4 +21,5 @@ export default async function handler(
    console.error("Error fetching OSS friends:", error);
    return res.status(500).json({ message: "Failed to fetch OSS friends" });
  }
-}
+  },
+);
--- a/apps/web/src/pages/api/stripe/create_billing_session.ts
+++ b/apps/web/src/pages/api/stripe/create_billing_session.ts
@@ -3,11 +3,11 @@ import { env } from "next-runtime-env";

 import { createNextApiContext } from "@kan/api/trpc";
 import { createStripeClient } from "@kan/stripe";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
  const stripe = createStripeClient();

  if (req.method !== "POST") {
@@ -31,4 +31,5 @@ export default async function handler(
    console.error("Error:", error);
    return res.status(500).json({ error: "Error creating portal session" });
  }
-}
+  },
+);
--- a/apps/web/src/pages/api/stripe/create_checkout_session.ts
+++ b/apps/web/src/pages/api/stripe/create_checkout_session.ts
@@ -6,6 +6,7 @@ import { createNextApiContext } from "@kan/api/trpc";
 import * as subscriptionRepo from "@kan/db/repository/subscription.repo";
 import * as workspaceRepo from "@kan/db/repository/workspace.repo";
 import { createStripeClient } from "@kan/stripe";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

 const workspaceSlugSchema = z
  .string()
@@ -21,10 +22,9 @@ interface CheckoutSessionRequest {
  stripeCustomerId: string;
 }

-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
  const stripe = createStripeClient();

  if (req.method !== "POST") {
@@ -88,6 +88,7 @@ export default async function handler(

    const session = await stripe.checkout.sessions.create({
      mode: "subscription",
+      payment_method_collection: "always",
      line_items: [
        {
          price: process.env.STRIPE_PRO_PLAN_MONTHLY_PRICE_ID,
@@ -114,4 +115,5 @@ export default async function handler(
    console.error("Error:", error);
    return res.status(500).json({ error: "Error creating checkout session" });
  }
-}
+  },
+);
--- a/apps/web/src/pages/api/trello/authenticate.ts
+++ b/apps/web/src/pages/api/trello/authenticate.ts
@@ -3,11 +3,11 @@ import type { NextApiRequest, NextApiResponse } from "next";
 import { createNextApiContext } from "@kan/api/trpc";
 import { integrations } from "@kan/db/schema";
 import { addYears } from "date-fns";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
  if (req.method !== "POST") {
    return res.status(405).json({ message: "Method not allowed" });
  }
@@ -48,4 +48,5 @@ export default async function handler(
    console.error("Trello authentication error:", err);
    return res.status(400).json({ message: "Trello authentication failed" });
  }
-}
+  },
+);
--- a/apps/web/src/pages/api/trpc/[trpc].ts
+++ b/apps/web/src/pages/api/trpc/[trpc].ts
@@ -3,12 +3,14 @@ import { createNextApiHandler } from "@trpc/server/adapters/next";

 import { appRouter } from "@kan/api/root";
 import { createTRPCContext } from "@kan/api/trpc";
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

 const nextApiHandler = createNextApiHandler({
  router: appRouter,
  createContext: createTRPCContext,
  onError:
-    process.env.NODE_ENV === "development"
+    env.NODE_ENV === "development"
      ? ({ path, error }) => {
          console.error(
            `❌ tRPC failed on ${path ?? "<no-path>"}: ${error.message}`,
@@ -17,11 +19,16 @@ const nextApiHandler = createNextApiHandler({
      : undefined,
 });

-export default function handler(req: NextApiRequest, res: NextApiResponse) {
-  if (req.method === "OPTIONS") {
-    res.writeHead(200);
-    return res.end();
-  }
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method === "OPTIONS") {
+      res.writeHead(200);
+      res.end();
+      return;
+    }

-  return nextApiHandler(req, res);
-}
+    const result = await nextApiHandler(req, res);
+    return result;
+  },
+);
--- a/apps/web/src/pages/api/unsubscribe.ts
+++ b/apps/web/src/pages/api/unsubscribe.ts
@@ -4,6 +4,7 @@ import { jwtVerify } from "jose";
 import { z } from "zod";

 import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

 const requestSchema = z.object({
  token: z.string().min(1),
@@ -19,10 +20,9 @@ type ResponseData =

 const textEncoder = new TextEncoder();

-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse<ResponseData>,
-) {
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse<ResponseData>) => {
  if (process.env.NEXT_PUBLIC_KAN_ENV !== "cloud") {
    return res.status(404).json({
      success: false,
@@ -101,4 +101,5 @@ export default async function handler(
  }

  return res.status(200).json({ success: true });
-}
+  },
+);
--- a/apps/web/src/pages/api/upload/attachment.ts
+++ b/apps/web/src/pages/api/upload/attachment.ts
@@ -0,0 +1,131 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { Upload } from "@aws-sdk/lib-storage";
+
+import { createNextApiContext } from "@kan/api/trpc";
+import * as cardRepo from "@kan/db/repository/card.repo";
+import * as cardActivityRepo from "@kan/db/repository/cardActivity.repo";
+import * as cardAttachmentRepo from "@kan/db/repository/cardAttachment.repo";
+import { generateUID } from "@kan/shared/utils";
+
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+import { createS3Client } from "@kan/shared/utils";
+import { assertPermission } from "@kan/api/utils/permissions";
+
+const MAX_SIZE_BYTES = 50 * 1024 * 1024; // 50MB
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method !== "POST") {
+      return res.status(405).json({ error: "Method not allowed" });
+    }
+
+    try {
+      const { user, db } = await createNextApiContext(req);
+
+      if (!user) {
+        return res.status(401).json({ error: "Unauthorized" });
+      }
+
+      const bucket = env.NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME;
+      if (!bucket) {
+        return res.status(500).json({ error: "Attachments bucket not configured" });
+      }
+
+      const cardPublicId = req.query.cardPublicId;
+      if (typeof cardPublicId !== "string" || cardPublicId.length < 12) {
+        return res.status(400).json({ error: "Invalid cardPublicId" });
+      }
+
+      const contentType = req.headers["content-type"];
+      const contentLengthHeader = req.headers["content-length"];
+      const contentLength = contentLengthHeader
+        ? Number.parseInt(contentLengthHeader, 10)
+        : NaN;
+
+      if (typeof contentType !== "string") {
+        return res.status(400).json({ error: "Missing content type" });
+      }
+
+      if (!Number.isFinite(contentLength) || contentLength <= 0) {
+        return res.status(400).json({ error: "Missing or invalid content length" });
+      }
+
+      if (contentLength > MAX_SIZE_BYTES) {
+        return res.status(400).json({ error: "File too large" });
+      }
+
+      const originalFilenameHeader =
+        (req.headers["x-original-filename"] as string | undefined) ?? "file";
+
+      const sanitizedFilename = originalFilenameHeader
+        .replace(/[^a-zA-Z0-9._-]/g, "_")
+        .substring(0, 200);
+
+      // Get card and check permissions
+      const card = await cardRepo.getWorkspaceAndCardIdByCardPublicId(
+        db,
+        cardPublicId,
+      );
+
+      if (!card) {
+        return res.status(404).json({ error: "Card not found" });
+      }
+
+      // Check if user has permission to edit the card
+      try {
+        await assertPermission(db, user.id, card.workspaceId, "card:edit");
+      } catch {
+        return res.status(403).json({ error: "Permission denied" });
+      }
+
+      const s3Key = `${card.workspaceId}/${cardPublicId}/${generateUID()}-${sanitizedFilename}`;
+
+      const client = createS3Client();
+
+      const upload = new Upload({
+        client,
+        params: {
+          Bucket: bucket,
+          Key: s3Key,
+          Body: req,
+          ContentType: contentType,
+          ContentLength: contentLength,
+        },
+        leavePartsOnError: false,
+      });
+
+      await upload.done();
+
+      // Create attachment record and log activity
+      const attachment = await cardAttachmentRepo.create(db, {
+        cardId: card.id,
+        filename: sanitizedFilename,
+        originalFilename: originalFilenameHeader,
+        contentType,
+        size: contentLength,
+        s3Key,
+        createdBy: user.id,
+      });
+
+      await cardActivityRepo.create(db, {
+        type: "card.updated.attachment.added",
+        cardId: card.id,
+        createdBy: user.id,
+      });
+
+      return res.status(200).json({ attachment });
+    } catch (error) {
+      console.error("Attachment upload failed", error);
+      return res.status(500).json({ error: "Internal server error" });
+    }
+  },
+);
+
--- a/apps/web/src/pages/api/upload/avatar.ts
+++ b/apps/web/src/pages/api/upload/avatar.ts
@@ -0,0 +1,101 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { PutObjectCommand } from "@aws-sdk/client-s3";
+
+import { createNextApiContext } from "@kan/api/trpc";
+import * as userRepo from "@kan/db/repository/user.repo";
+
+import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
+import { createS3Client } from "@kan/shared/utils";
+
+const MAX_SIZE_BYTES = 2 * 1024 * 1024; // 2MB
+const allowedContentTypes = ["image/jpeg", "image/png", "image/webp"];
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method !== "POST") {
+      return res.status(405).json({ error: "Method not allowed" });
+    }
+
+    try {
+      const { user, db } = await createNextApiContext(req);
+
+      if (!user) {
+        return res.status(401).json({ error: "Unauthorized" });
+      }
+
+      const bucket = env.NEXT_PUBLIC_AVATAR_BUCKET_NAME;
+      if (!bucket) {
+        return res.status(500).json({ error: "Avatar bucket not configured" });
+      }
+
+      const contentType = req.headers["content-type"];
+      const contentLengthHeader = req.headers["content-length"];
+      const contentLength = contentLengthHeader
+        ? Number.parseInt(contentLengthHeader, 10)
+        : NaN;
+
+      if (typeof contentType !== "string") {
+        return res.status(400).json({ error: "Missing content type" });
+      }
+
+      if (!allowedContentTypes.includes(contentType)) {
+        return res.status(400).json({ error: "Invalid content type" });
+      }
+
+      if (!Number.isFinite(contentLength) || contentLength <= 0) {
+        return res.status(400).json({ error: "Missing or invalid content length" });
+      }
+
+      if (contentLength > MAX_SIZE_BYTES) {
+        return res.status(400).json({ error: "File too large" });
+      }
+
+      const originalFilenameHeader =
+        (req.headers["x-original-filename"] as string | undefined) ?? "file";
+
+      const sanitizedFilename = originalFilenameHeader
+        .replace(/[^a-zA-Z0-9._-]/g, "_")
+        .substring(0, 200);
+
+      const s3Key = `${user.id}/${sanitizedFilename}`;
+
+      const client = createS3Client();
+
+      // Upload the file to S3
+      await client.send(
+        new PutObjectCommand({
+          Bucket: bucket,
+          Key: s3Key,
+          Body: req,
+          ContentType: contentType,
+          ContentLength: contentLength,
+        }),
+      );
+
+      // Update user image in database
+      const updatedUser = await userRepo.update(db, user.id, {
+        image: s3Key,
+      });
+
+      return res.status(200).json({
+        key: s3Key,
+        filename: sanitizedFilename,
+        contentType,
+        size: contentLength,
+        user: updatedUser,
+      });
+    } catch (error) {
+      console.error("Avatar upload failed", error);
+      return res.status(500).json({ error: "Internal server error" });
+    }
+  },
+);
+
--- a/apps/web/src/pages/api/upload/image.ts
+++ b/apps/web/src/pages/api/upload/image.ts
@@ -1,74 +0,0 @@
-import type { NextApiRequest, NextApiResponse } from "next";
-import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { env as nextRuntimeEnv } from "next-runtime-env";
-
-import { createNextApiContext } from "@kan/api/trpc";
-
-import { env } from "~/env";
-
-const allowedContentTypes = ["image/jpeg", "image/png"];
-
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
-  if (req.method !== "POST") {
-    return res.status(405).json({ error: "Method not allowed" });
-  }
-
-  try {
-    const { user } = await createNextApiContext(req);
-
-    if (!user) {
-      return res.status(401).json({ error: "Unauthorized" });
-    }
-
-    const { filename, contentType } = req.body as {
-      filename: string;
-      contentType: string;
-    };
-
-    // Specific to avatar uploads for now
-    const filenameRegex = /^[a-f0-9\-]+\/[a-zA-Z0-9_\-]+(\.jpg|\.jpeg|\.png)$/;
-
-    if (!filenameRegex.test(filename)) {
-      return res.status(400).json({ error: "Invalid filename" });
-    }
-
-    if (
-      typeof contentType !== "string" ||
-      !allowedContentTypes.includes(contentType)
-    ) {
-      return res.status(400).json({ error: "Invalid content type" });
-    }
-
-    const credentials =
-      env.S3_ACCESS_KEY_ID && env.S3_SECRET_ACCESS_KEY
-        ? {
-            accessKeyId: env.S3_ACCESS_KEY_ID,
-            secretAccessKey: env.S3_SECRET_ACCESS_KEY,
-          }
-        : undefined;
-
-    const client = new S3Client({
-      region: env.S3_REGION ?? "",
-      endpoint: env.S3_ENDPOINT ?? "",
-      forcePathStyle: env.S3_FORCE_PATH_STYLE === "true",
-      credentials,
-    });
-
-    const signedUrl = await getSignedUrl(
-      client,
-      new PutObjectCommand({
-        Bucket: nextRuntimeEnv("NEXT_PUBLIC_AVATAR_BUCKET_NAME") ?? "",
-        Key: filename,
-        ACL: "public-read",
-      }),
-    );
-
-    return res.status(200).json({ url: signedUrl, key: filename });
-  } catch (error) {
-    return res.status(500).json({ error: (error as Error).message });
-  }
-}
--- a/apps/web/src/pages/api/v1/[...trpc].ts
+++ b/apps/web/src/pages/api/v1/[...trpc].ts
@@ -6,25 +6,26 @@ import { appRouter } from "@kan/api";
 import { createRESTContext } from "@kan/api/trpc";

 import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
-  await cors(req, res);
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    await cors(req, res);

-  const openApiHandler = createOpenApiNextHandler({
-    router: appRouter,
-    createContext: createRESTContext,
-    onError:
-      env.NODE_ENV === "development"
-        ? ({ path, error }) => {
-            console.error(
-              `❌ REST failed on ${path ?? "<no-path>"}: ${error.message}`,
-            );
-          }
-        : undefined,
-  });
+    const openApiHandler = createOpenApiNextHandler({
+      router: appRouter,
+      createContext: createRESTContext,
+      onError:
+        env.NODE_ENV === "development"
+          ? ({ path, error }) => {
+              console.error(
+                `❌ REST failed on ${path ?? "<no-path>"}: ${error.message}`,
+              );
+            }
+          : undefined,
+    });

-  return await openApiHandler(req, res);
-}
+    return await openApiHandler(req, res);
+  },
+);
--- a/apps/web/src/pages/api/v1/openapi.json.ts
+++ b/apps/web/src/pages/api/v1/openapi.json.ts
@@ -1,9 +1,11 @@
 import type { NextApiRequest, NextApiResponse } from "next";

 import { openApiDocument } from "@kan/api/openapi";
+import { withRateLimit } from "@kan/api/utils/rateLimit";

-const handler = (req: NextApiRequest, res: NextApiResponse) => {
-  res.status(200).send(openApiDocument);
-};
-
-export default handler;
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  (req: NextApiRequest, res: NextApiResponse) => {
+    res.status(200).send(openApiDocument);
+  },
+);
--- a/apps/web/src/pages/settings/api.tsx
+++ b/apps/web/src/pages/settings/api.tsx
@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import ApiSettings from "~/views/settings/ApiSettings";
+import Popup from "~/components/Popup";

 const ApiSettingsPage: NextPageWithLayout = () => {
  return (
    <SettingsLayout currentTab="api">
      <ApiSettings />
+      <Popup />
    </SettingsLayout>
  );
 };
--- a/apps/web/src/pages/settings/billing.tsx
+++ b/apps/web/src/pages/settings/billing.tsx
@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import BillingSettings from "~/views/settings/BillingSettings";
+import Popup from "~/components/Popup";

 const BillingSettingsPage: NextPageWithLayout = () => {
  return (
    <SettingsLayout currentTab="billing">
      <BillingSettings />
+      <Popup />
    </SettingsLayout>
  );
 };
--- a/apps/web/src/pages/settings/integrations.tsx
+++ b/apps/web/src/pages/settings/integrations.tsx
@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import IntegrationsSettings from "~/views/settings/IntegrationsSettings";
+import Popup from "~/components/Popup";

 const IntegrationsSettingsPage: NextPageWithLayout = () => {
  return (
    <SettingsLayout currentTab="integrations">
      <IntegrationsSettings />
+      <Popup />
    </SettingsLayout>
  );
 };
--- a/apps/web/src/pages/settings/permissions.tsx
+++ b/apps/web/src/pages/settings/permissions.tsx
@@ -0,0 +1,23 @@
+import type { NextPageWithLayout } from "~/pages/_app";
+import { getDashboardLayout } from "~/components/Dashboard";
+import { SettingsLayout } from "~/components/SettingsLayout";
+import Popup from "~/components/Popup";
+import PermissionsSettings from "~/views/settings/PermissionsSettings";
+
+const PermissionsSettingsPage: NextPageWithLayout = () => {
+  return (
+    <>
+      <SettingsLayout currentTab="permissions">
+        <PermissionsSettings />
+        <Popup />
+      </SettingsLayout>
+      
+    </>
+  );
+};
+
+PermissionsSettingsPage.getLayout = (page) => getDashboardLayout(page);
+
+export default PermissionsSettingsPage;
+
+
--- a/apps/web/src/pages/settings/workspace.tsx
+++ b/apps/web/src/pages/settings/workspace.tsx
@@ -2,11 +2,13 @@ import type { NextPageWithLayout } from "~/pages/_app";
 import { getDashboardLayout } from "~/components/Dashboard";
 import { SettingsLayout } from "~/components/SettingsLayout";
 import WorkspaceSettings from "~/views/settings/WorkspaceSettings";
+import Popup from "~/components/Popup";

 const WorkspaceSettingsPage: NextPageWithLayout = () => {
  return (
    <SettingsLayout currentTab="workspace">
      <WorkspaceSettings />
+      <Popup />
    </SettingsLayout>
  );
 };
--- a/apps/web/src/providers/keyboard-shortcuts.tsx
+++ b/apps/web/src/providers/keyboard-shortcuts.tsx
@@ -1,4 +1,5 @@
 import type { ReactNode } from "react";
+import React from "react";
 import {
  Dialog,
  DialogBackdrop,
@@ -464,19 +465,37 @@ function FormattedShortcut({ shortcut }: { shortcut: KeyboardShortcut }) {
      ? stroke.modifiers.map(stringifyModifier)
      : [];

-    modifierStrings.forEach((mod) => {
-      parts.push(<kbd className={kbdClassName}>{mod}</kbd>);
+    modifierStrings.forEach((mod, index) => {
+      parts.push(
+        <kbd key={`mod-${index}-${mod}`} className={kbdClassName}>
+          {mod}
+        </kbd>,
+      );
    });

-    parts.push(<kbd className={kbdClassName}>{stroke.key.toUpperCase()}</kbd>);
+    parts.push(
+      <kbd key={`key-${stroke.key}`} className={kbdClassName}>
+        {stroke.key.toUpperCase()}
+      </kbd>,
+    );

    return parts;
  };

  if (shortcut.type === "SEQUENCE") {
    const parts: ReactNode[] = [];
-    shortcut.strokes.forEach((stroke) => {
-      parts.push(...formatStroke(stroke));
+    shortcut.strokes.forEach((stroke, strokeIndex) => {
+      const strokeParts = formatStroke(stroke);
+      // Add stroke index to keys to ensure uniqueness across multiple strokes
+      const keyedParts = strokeParts.map((part, partIndex) => {
+        if (React.isValidElement(part)) {
+          return React.cloneElement(part, {
+            key: `stroke-${strokeIndex}-${part.key || partIndex}`,
+          });
+        }
+        return part;
+      });
+      parts.push(...keyedParts);
    });
    return <span className="flex items-center gap-1 text-[11px]">{parts}</span>;
  }
--- a/apps/web/src/providers/workspace.tsx
+++ b/apps/web/src/providers/workspace.tsx
@@ -32,7 +32,7 @@ const initialWorkspace: Workspace = {

 const initialAvailableWorkspaces: Workspace[] = [];

-const WorkspaceContext = createContext<WorkspaceContextProps | undefined>(
+export const WorkspaceContext = createContext<WorkspaceContextProps | undefined>(
  undefined,
 );

--- a/apps/web/src/utils/cardInvalidation.ts
+++ b/apps/web/src/utils/cardInvalidation.ts
@@ -0,0 +1,18 @@
+import type { api } from "~/utils/api";
+
+/**
+ * Invalidates all card-related queries for a given card.
+ * Use this after any mutation that affects card data or activities.
+ */
+export async function invalidateCard(
+  utils: ReturnType<typeof api.useUtils>,
+  cardPublicId: string,
+) {
+  if (!cardPublicId || cardPublicId.length < 12) return;
+  
+  await Promise.all([
+    utils.card.byId.invalidate({ cardPublicId }),
+    utils.card.getActivities.invalidate({ cardPublicId }),
+  ]);
+}
+
--- a/apps/web/src/utils/helpers.test.ts
+++ b/apps/web/src/utils/helpers.test.ts
@@ -0,0 +1,101 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("next-runtime-env", () => ({
+  env: vi.fn(),
+}));
+
+import { env } from "next-runtime-env";
+import { getAvatarUrl } from "./helpers";
+
+const mockEnv = env as ReturnType<typeof vi.fn>;
+
+describe("getAvatarUrl", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("returns empty string for null input", () => {
+    expect(getAvatarUrl(null)).toBe("");
+  });
+
+  it("returns empty string for empty string input", () => {
+    expect(getAvatarUrl("")).toBe("");
+  });
+
+  it("returns URL unchanged if already absolute http", () => {
+    expect(getAvatarUrl("http://example.com/avatar.jpg")).toBe(
+      "http://example.com/avatar.jpg",
+    );
+  });
+
+  it("returns URL unchanged if already absolute https", () => {
+    expect(getAvatarUrl("https://example.com/avatar.jpg")).toBe(
+      "https://example.com/avatar.jpg",
+    );
+  });
+
+  describe("path-style URLs (MinIO/LocalStack)", () => {
+    it("constructs path-style URL when STORAGE_DOMAIN is not set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_STORAGE_URL: "http://s3.localtest.me:9000",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "http://s3.localtest.me:9000/kan/user123/avatar.jpg",
+      );
+    });
+  });
+
+  describe("virtual-hosted URLs (Tigris/AWS S3)", () => {
+    it("constructs virtual-hosted URL when USE_VIRTUAL_HOSTED_URLS is true and STORAGE_DOMAIN is set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS: "true",
+          NEXT_PUBLIC_STORAGE_DOMAIN: "fly.storage.tigris.dev",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan-avatars",
+          NEXT_PUBLIC_STORAGE_URL: "https://fly.storage.tigris.dev",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "https://kan-avatars.fly.storage.tigris.dev/user123/avatar.jpg",
+      );
+    });
+
+    it("uses path-style URL when USE_VIRTUAL_HOSTED_URLS is false even if STORAGE_DOMAIN is set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS: "false",
+          NEXT_PUBLIC_STORAGE_DOMAIN: "fly.storage.tigris.dev",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan-avatars",
+          NEXT_PUBLIC_STORAGE_URL: "https://fly.storage.tigris.dev",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "https://fly.storage.tigris.dev/kan-avatars/user123/avatar.jpg",
+      );
+    });
+
+    it("uses path-style URL when USE_VIRTUAL_HOSTED_URLS is not set even if STORAGE_DOMAIN is set", () => {
+      mockEnv.mockImplementation((key: string) => {
+        const vars: Record<string, string> = {
+          NEXT_PUBLIC_STORAGE_DOMAIN: "fly.storage.tigris.dev",
+          NEXT_PUBLIC_AVATAR_BUCKET_NAME: "kan-avatars",
+          NEXT_PUBLIC_STORAGE_URL: "https://fly.storage.tigris.dev",
+        };
+        return vars[key];
+      });
+
+      expect(getAvatarUrl("user123/avatar.jpg")).toBe(
+        "https://fly.storage.tigris.dev/kan-avatars/user123/avatar.jpg",
+      );
+    });
+  });
+});
--- a/apps/web/src/utils/helpers.ts
+++ b/apps/web/src/utils/helpers.ts
@@ -1,5 +1,3 @@
-import { env } from "next-runtime-env";
-
 export const formatToArray = (
  value: string | string[] | undefined,
 ): string[] => {
@@ -52,5 +50,5 @@ export const getAvatarUrl = (imageOrKey: string | null) => {
    return imageOrKey;
  }

-  return `${env("NEXT_PUBLIC_STORAGE_URL")}/${env("NEXT_PUBLIC_AVATAR_BUCKET_NAME")}/${imageOrKey}`;
+  return "";
 };
--- a/apps/web/src/utils/i18n.ts
+++ b/apps/web/src/utils/i18n.ts
@@ -22,8 +22,8 @@ const loadMessages = async (locale: Locale) => {
      return (await import("~/locales/ru/messages")).messages;
    case "pl":
      return (await import("~/locales/pl/messages")).messages;
-    case "ptbr":
-      return (await import("~/locales/ptbr/messages")).messages;
+    case "pt-BR":
+      return (await import("~/locales/pt-BR/messages")).messages;
    default:
      return enMessages;
  }
--- a/apps/web/src/views/board/components/BoardDropdown.tsx
+++ b/apps/web/src/views/board/components/BoardDropdown.tsx
@@ -4,9 +4,12 @@ import {
  HiLink,
  HiOutlineDocumentDuplicate,
  HiOutlineTrash,
+  HiOutlineStar,
+  HiStar,
 } from "react-icons/hi2";

 import Dropdown from "~/components/Dropdown";
+import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
 import { usePopup } from "~/providers/popup";
 import { api } from "~/utils/api";
@@ -15,42 +18,104 @@ export default function BoardDropdown({
  isTemplate,
  isLoading,
  boardPublicId,
-  workspacePublicId,
+  isFavorite,
+  boardName,
 }: {
  isTemplate: boolean;
  isLoading: boolean;
  boardPublicId: string;
-  workspacePublicId: string;
+  isFavorite?: boolean;
+  boardName?: string;
 }) {
  const { openModal } = useModal();
-  return (
-    <Dropdown
-      disabled={isLoading}
-      items={[
-        ...(isTemplate
-          ? []
-          : [
-              {
-                label: t`Make template`,
-                action: () => openModal("CREATE_TEMPLATE"),
-                icon: (
-                  <HiOutlineDocumentDuplicate className="h-[16px] w-[16px] text-dark-900" />
-                ),
-              },
-              {
-                label: t`Edit board URL`,
-                action: () => openModal("UPDATE_BOARD_SLUG"),
-                icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
-              },
-            ]),
+  const { canEditBoard, canDeleteBoard, canCreateBoard } = usePermissions();
+  const { showPopup } = usePopup();
+  const utils = api.useUtils();

-        {
-          label: isTemplate ? t`Delete template` : t`Delete board`,
-          action: () => openModal("DELETE_BOARD"),
-          icon: <HiOutlineTrash className="h-[16px] w-[16px] text-dark-900" />,
-        },
-      ]}
-    >
+  const handleToggleFavorite = () => {
+    updateBoard.mutate({
+      boardPublicId,
+      favorite: !isFavorite,
+    });
+  };
+
+  const updateBoard = api.board.update.useMutation({
+    onSuccess: (data, variables) => {
+      void utils.board.all.invalidate();
+      void utils.board.byId.invalidate();
+
+      // Show popup notification
+      if (variables.favorite !== undefined) {
+        showPopup({
+          header: variables.favorite
+            ? t`Added to favorites`
+            : t`Removed from favorites`,
+          message: variables.favorite
+            ? t`${boardName ?? "Board"} has been added to your favorites.`
+            : t`${boardName ?? "Board"} has been removed from your favorites.`,
+          icon: "success",
+        });
+      }
+    },
+    onError: () => {
+      showPopup({
+        header: t`Unable to update board`,
+        message: t`Please try again later, or contact customer support.`,
+        icon: "error",
+      });
+    },
+  });
+  
+  const items = [
+    ...(isTemplate && canCreateBoard
+      ? [
+          {
+            label: t`Make template`,
+            action: () => openModal("CREATE_TEMPLATE"),
+            icon: (
+              <HiOutlineDocumentDuplicate className="h-[16px] w-[16px] text-dark-900" />
+            ),
+          },
+        ]
+      : []),
+    ...(!isTemplate && canEditBoard
+      ? [
+          {
+            label: t`Edit board URL`,
+            action: () => openModal("UPDATE_BOARD_SLUG"),
+            icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
+          },
+        ]
+      : []),
+    {
+      label: isFavorite
+        ? t`Remove from favorites`
+        : t`Add to favorites`,
+      action: handleToggleFavorite,
+      icon: isFavorite ? (
+        <HiStar className="h-[16px] w-[16px] text-dark-900" />
+      ) : (
+        <HiOutlineStar className="h-[16px] w-[16px] text-dark-900" />
+      ),
+    },
+    ...(canDeleteBoard
+      ? [
+          {
+            label: isTemplate ? t`Delete template` : t`Delete board`,
+            action: () => openModal("DELETE_BOARD"),
+            icon: <HiOutlineTrash className="h-[16px] w-[16px] text-dark-900" />,
+          },
+        ]
+      : []),
+  ];
+  
+
+  if (items.length === 0) {
+    return null;
+  }
+
+  return (
+    <Dropdown disabled={isLoading} items={items}>
      <HiEllipsisHorizontal className="h-5 w-5 text-dark-900" />
    </Dropdown>
  );
--- a/apps/web/src/views/board/components/List.tsx
+++ b/apps/web/src/views/board/components/List.tsx
@@ -9,7 +9,11 @@ import {
  HiOutlineTrash,
 } from "react-icons/hi2";

+import { authClient } from "@kan/auth/client";
+
 import Dropdown from "~/components/Dropdown";
+import { Tooltip } from "~/components/Tooltip";
+import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
 import { api } from "~/utils/api";

@@ -23,6 +27,7 @@ interface ListProps {
 interface List {
  publicId: string;
  name: string;
+  createdBy?: string | null;
 }

 interface FormValues {
@@ -39,8 +44,14 @@ export default function List({
  setSelectedPublicListId,
 }: ListProps) {
  const { openModal } = useModal();
+  const { canCreateCard, canEditList, canDeleteList } = usePermissions();
+  const { data: session } = authClient.useSession();
+  const isCreator = list.createdBy && session?.user.id === list.createdBy;
+  const canEdit = canEditList || isCreator;
+  const canDrag = canEditList || isCreator;

  const openNewCardForm = (publicListId: PublicListId) => {
+    if (!canCreateCard) return;
    openModal("NEW_CARD");
    setSelectedPublicListId(publicListId);
  };
@@ -59,6 +70,7 @@ export default function List({
  });

  const onSubmit = (values: FormValues) => {
+    if (!canEdit) return;
    updateList.mutate({
      listPublicId: values.listPublicId,
      name: values.name,
@@ -71,7 +83,12 @@ export default function List({
  };

  return (
-    <Draggable key={list.publicId} draggableId={list.publicId} index={index}>
+    <Draggable
+      key={list.publicId}
+      draggableId={list.publicId}
+      index={index}
+      isDragDisabled={!canDrag}
+    >
      {(provided) => (
        <div
          key={list.publicId}
@@ -90,41 +107,65 @@ export default function List({
                type="text"
                {...register("name")}
                onBlur={handleSubmit(onSubmit)}
+                readOnly={!canEdit}
                className="w-full border-0 bg-transparent px-4 pt-1 text-sm font-medium text-neutral-900 focus:ring-0 focus-visible:outline-none dark:text-dark-1000"
              />
            </form>
            <div className="flex items-center">
-              <button
-                className="mx-1 inline-flex h-fit items-center rounded-md p-1 px-1 text-sm font-semibold text-dark-50 hover:bg-light-400 dark:hover:bg-dark-200"
-                onClick={() => openNewCardForm(list.publicId)}
+              <Tooltip
+                content={
+                  !canCreateCard ? t`You don't have permission` : undefined
+                }
              >
-                <HiOutlinePlusSmall
-                  className="h-5 w-5 text-dark-900"
-                  aria-hidden="true"
-                />
-              </button>
-              <div className="relative mr-1 inline-block">
-                <Dropdown
-                  items={[
-                    {
-                      label: t`Add a card`,
-                      action: () => openNewCardForm(list.publicId),
-                      icon: (
-                        <HiOutlineSquaresPlus className="h-[18px] w-[18px] text-dark-900" />
-                      ),
-                    },
-                    {
-                      label: t`Delete list`,
-                      action: handleOpenDeleteListConfirmation,
-                      icon: (
-                        <HiOutlineTrash className="h-[18px] w-[18px] text-dark-900" />
-                      ),
-                    },
-                  ]}
+                <button
+                  className="mx-1 inline-flex h-fit items-center rounded-md p-1 px-1 text-sm font-semibold text-dark-50 hover:bg-light-400 disabled:opacity-60 disabled:cursor-not-allowed dark:hover:bg-dark-200"
+                  onClick={() => openNewCardForm(list.publicId)}
+                  disabled={!canCreateCard}
                >
-                  <HiEllipsisHorizontal className="h-5 w-5 text-dark-900" />
-                </Dropdown>
-              </div>
+                  <HiOutlinePlusSmall
+                    className="h-5 w-5 text-dark-900"
+                    aria-hidden="true"
+                  />
+                </button>
+              </Tooltip>
+              {(() => {
+                const dropdownItems = [
+                  ...(canCreateCard
+                    ? [
+                        {
+                          label: t`Add a card`,
+                          action: () => openNewCardForm(list.publicId),
+                          icon: (
+                            <HiOutlineSquaresPlus className="h-[18px] w-[18px] text-dark-900" />
+                          ),
+                        },
+                      ]
+                    : []),
+                  ...(canDeleteList || isCreator
+                    ? [
+                        {
+                          label: t`Delete list`,
+                          action: handleOpenDeleteListConfirmation,
+                          icon: (
+                            <HiOutlineTrash className="h-[18px] w-[18px] text-dark-900" />
+                          ),
+                        },
+                      ]
+                    : []),
+                ];
+
+                if (dropdownItems.length === 0) {
+                  return null;
+                }
+
+                return (
+                  <div className="relative mr-1 inline-block">
+                    <Dropdown items={dropdownItems}>
+                      <HiEllipsisHorizontal className="h-5 w-5 text-dark-900" />
+                    </Dropdown>
+                  </div>
+                );
+              })()}
            </div>
          </div>
          {children}
--- a/apps/web/src/views/board/components/NewCardForm.tsx
+++ b/apps/web/src/views/board/components/NewCardForm.tsx
@@ -335,7 +335,7 @@ export function NewCardForm({
                saveFormState({ ...formState, description: value });
              }}
              workspaceMembers={
-                boardData?.workspace.members?.map(
+                boardData?.workspace.members.map(
                  (member): WorkspaceMember => ({
                    publicId: member.publicId,
                    email: member.email,
@@ -349,6 +349,7 @@ export function NewCardForm({
                  }),
                ) ?? []
              }
+              enableYouTubeEmbed={false}
            />
          </div>
        </div>
--- a/apps/web/src/views/board/components/UpdateBoardSlugButton.tsx
+++ b/apps/web/src/views/board/components/UpdateBoardSlugButton.tsx
@@ -1,19 +1,40 @@
-import Link from "next/link";
+import { Fragment } from "react";
+import { t } from "@lingui/core/macro";
 import { env } from "next-runtime-env";
 import { HiLink } from "react-icons/hi";

+import { Tooltip } from "~/components/Tooltip";
+import { usePopup } from "~/providers/popup";
+
+const displayBaseUrl =
+  env("NEXT_PUBLIC_KAN_ENV") === "cloud"
+    ? "kan.bn"
+    : env("NEXT_PUBLIC_BASE_URL");
+
+const linkBaseUrl = env("NEXT_PUBLIC_BASE_URL");
+
+const pathSeparator = (
+  <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600" />
+);
+
 const UpdateBoardSlugButton = ({
  handleOnClick,
  workspaceSlug,
  boardSlug,
+  boardPublicId,
+  visibility,
  isLoading,
+  canEdit,
 }: {
  handleOnClick: () => void;
  workspaceSlug: string;
  boardSlug: string;
+  boardPublicId: string;
+  visibility: "public" | "private";
  isLoading: boolean;
+  canEdit: boolean;
 }) => {
-  if (!isLoading && (!workspaceSlug || !boardSlug)) return <></>;
+  const { showPopup } = usePopup();

  if (isLoading) {
    return (
@@ -21,32 +42,54 @@ const UpdateBoardSlugButton = ({
    );
  }

+  if (!workspaceSlug || !boardSlug || !boardPublicId) return <></>;
+
+  const isPublic = visibility === "public";
+  const boardUrl = isPublic
+    ? `${linkBaseUrl}/${workspaceSlug}/${boardSlug}`
+    : `${linkBaseUrl}/boards/${boardPublicId}`;
+
+  const pathSegments = isPublic
+    ? [displayBaseUrl, workspaceSlug, boardSlug]
+    : [displayBaseUrl, "boards", boardPublicId];
+
  return (
-    <button
-      onClick={handleOnClick}
-      className="hidden cursor-pointer items-center gap-2 rounded-full border-[1px] bg-light-50 p-1 pl-4 pr-1 text-sm text-light-950 hover:bg-light-100 dark:border-dark-600 dark:bg-dark-50 dark:text-dark-900 dark:hover:bg-dark-100 xl:flex"
+    <Tooltip
+      content={!canEdit ? t`You don't have permission` : undefined}
    >
-      <div className="flex items-center">
-        <span>
-          {env("NEXT_PUBLIC_KAN_ENV") === "cloud"
-            ? "kan.bn"
-            : env("NEXT_PUBLIC_BASE_URL")}
-        </span>
-        <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600"></div>
-        <span>{workspaceSlug}</span>
-        <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600"></div>
-        <span>{boardSlug}</span>
-      </div>
-      <Link
-        href={`${env("NEXT_PUBLIC_BASE_URL")}/${workspaceSlug}/${boardSlug}`}
-        target="_blank"
-        rel="noopener noreferrer"
-        onClick={(e) => e.stopPropagation()}
-        className="flex h-7 w-7 items-center justify-center rounded-full hover:bg-light-200 dark:hover:bg-dark-200"
+      <button
+        onClick={canEdit ? handleOnClick : undefined}
+        disabled={!canEdit || isLoading}
+        className="hidden cursor-pointer items-center gap-2 rounded-full border-[1px] bg-light-50 p-1 pl-4 pr-1 text-sm text-light-950 hover:bg-light-100 disabled:cursor-not-allowed disabled:opacity-60 dark:border-dark-600 dark:bg-dark-50 dark:text-dark-900 dark:hover:bg-dark-100 xl:flex"
      >
-        <HiLink className="h-[13px] w-[13px]" />
-      </Link>
-    </button>
+        <div className="flex items-center">
+          {pathSegments.map((segment, i) => (
+            <Fragment key={i}>
+              {i > 0 && pathSeparator}
+              <span>{segment}</span>
+            </Fragment>
+          ))}
+        </div>
+        <button
+          type="button"
+          onClick={(e) => {
+            e.stopPropagation();
+            navigator.clipboard.writeText(boardUrl).then(
+              () =>
+                showPopup({
+                  header: t`Link copied`,
+                  icon: "success",
+                  message: t`Board URL copied to clipboard`,
+                }),
+            ).catch(() => undefined);
+          }}
+          className="flex h-7 w-7 items-center justify-center rounded-full hover:bg-light-200 dark:hover:bg-dark-200"
+          aria-label={t`Copy board link`}
+        >
+          <HiLink className="h-[13px] w-[13px]" />
+        </button>
+      </button>
+    </Tooltip>
  );
 };

--- a/apps/web/src/views/board/components/UpdateBoardSlugForm.tsx
+++ b/apps/web/src/views/board/components/UpdateBoardSlugForm.tsx
@@ -156,7 +156,7 @@ export function UpdateBoardSlugForm({
        <div className="flex items-center gap-2">
          <Button
            variant="secondary"
-            href="/settings?tab=workspace"
+            href="/settings/workspace"
            onClick={closeModal}
          >
            {t`Edit workspace URL`}
--- a/apps/web/src/views/board/components/VisibilityButton.tsx
+++ b/apps/web/src/views/board/components/VisibilityButton.tsx
@@ -4,6 +4,8 @@ import { HiOutlineEye, HiOutlineEyeSlash } from "react-icons/hi2";

 import Button from "~/components/Button";
 import CheckboxDropdown from "~/components/CheckboxDropdown";
+import { Tooltip } from "~/components/Tooltip";
+import { usePermissions } from "~/hooks/usePermissions";
 import { usePopup } from "~/providers/popup";
 import { api } from "~/utils/api";

@@ -29,6 +31,7 @@ const VisibilityButton = ({
  isAdmin: boolean;
 }) => {
  const { showPopup } = usePopup();
+  const { canEditBoard } = usePermissions();
  const utils = api.useUtils();
  const [stateVisibility, setStateVisibility] = useState<"public" | "private">(
    visibility,
@@ -60,38 +63,47 @@ const VisibilityButton = ({
    },
  });

+  const canEdit = canEditBoard || isAdmin;
+
  return (
    <div className="relative">
-      <CheckboxDropdown
-        items={[
-          {
-            key: "public",
-            value: t`Public`,
-            selected: isPublic,
-          },
-          {
-            key: "private",
-            value: t`Private`,
-            selected: !isPublic,
-          },
-        ]}
-        handleSelect={(_g, i) => {
-          setStateVisibility(isPublic ? "private" : "public");
-          updateBoardVisibility.mutate({
-            visibility: i.key as "public" | "private",
-            boardPublicId,
-          });
-        }}
-        menuSpacing="md"
+      <Tooltip
+        content={
+          !canEdit && !isLoading ? t`You don't have permission` : undefined
+        }
      >
-        <Button
-          variant="secondary"
-          iconLeft={isPublic ? <HiOutlineEye /> : <HiOutlineEyeSlash />}
-          disabled={isLoading || !isAdmin}
+        <CheckboxDropdown
+          items={[
+            {
+              key: "public",
+              value: t`Public`,
+              selected: isPublic,
+            },
+            {
+              key: "private",
+              value: t`Private`,
+              selected: !isPublic,
+            },
+          ]}
+          handleSelect={(_g, i) => {
+            if (!canEdit) return;
+            setStateVisibility(isPublic ? "private" : "public");
+            updateBoardVisibility.mutate({
+              visibility: i.key as "public" | "private",
+              boardPublicId,
+            });
+          }}
+          menuSpacing="md"
        >
-          {t`Visibility`}
-        </Button>
-      </CheckboxDropdown>
+          <Button
+            variant="secondary"
+            iconLeft={isPublic ? <HiOutlineEye /> : <HiOutlineEyeSlash />}
+            disabled={isLoading || !canEdit}
+          >
+            {t`Visibility`}
+          </Button>
+        </CheckboxDropdown>
+      </Tooltip>
    </div>
  );
 };
--- a/apps/web/src/views/board/index.tsx
+++ b/apps/web/src/views/board/index.tsx
@@ -24,12 +24,14 @@ import { PageHead } from "~/components/PageHead";
 import PatternedBackground from "~/components/PatternedBackground";
 import { StrictModeDroppable as Droppable } from "~/components/StrictModeDroppable";
 import { Tooltip } from "~/components/Tooltip";
+import { EditYouTubeModal } from "~/components/YouTubeEmbed/EditYouTubeModal";
+import { useDragToScroll } from "~/hooks/useDragToScroll";
+import { usePermissions } from "~/hooks/usePermissions";
 import { useKeyboardShortcut } from "~/providers/keyboard-shortcuts";
 import { useModal } from "~/providers/modal";
 import { usePopup } from "~/providers/popup";
 import { useWorkspace } from "~/providers/workspace";
 import { api } from "~/utils/api";
-import { convertDueDateFiltersToRanges } from "~/utils/dueDateFilters";
 import { formatToArray } from "~/utils/helpers";
 import BoardDropdown from "./components/BoardDropdown";
 import Card from "./components/Card";
@@ -56,12 +58,19 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
  const [selectedPublicListId, setSelectedPublicListId] =
    useState<PublicListId>("");
  const [isInitialLoading, setIsInitialLoading] = useState(true);
+  
+  const { ref: scrollRef, onMouseDown } = useDragToScroll({
+    enabled: true,
+    direction: "horizontal",
+  });
+
+  const { canCreateList, canEditList, canEditCard, canEditBoard } = usePermissions();

  const { tooltipContent: createListShortcutTooltipContent } =
    useKeyboardShortcut({
      type: "PRESS",
      stroke: { key: "C" },
-      action: () => boardId && openNewListForm(boardId),
+      action: () => boardId && canCreateList && openNewListForm(boardId),
      description: t`Create new list`,
      group: "ACTIONS",
    });
@@ -97,20 +106,17 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
    | "no-due-date"
  )[];

-  const queryParams: {
-    boardPublicId: string;
-    members: string[];
-    labels: string[];
-    lists: string[];
-    dueDate: ReturnType<typeof convertDueDateFiltersToRanges>;
-    type: "regular" | "template";
-  } = {
+  const boardType: "regular" | "template" = isTemplate ? "template" : "regular";
+
+  const queryParams = {
    boardPublicId: boardId ?? "",
    members: formatToArray(router.query.members),
    labels: formatToArray(router.query.labels),
    lists: formatToArray(router.query.lists),
-    dueDate: convertDueDateFiltersToRanges(semanticFilters),
-    type: isTemplate ? "template" : "regular",
+    ...(semanticFilters.length > 0 && {
+      dueDateFilters: semanticFilters,
+    }),
+    type: boardType,
  };

  const {
@@ -257,14 +263,14 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
      return;
    }

-    if (type === "LIST") {
+    if (type === "LIST" && canEditList) {
      updateListMutation.mutate({
        listPublicId: draggableId,
        index: destination.index,
      });
    }

-    if (type === "CARD") {
+    if (type === "CARD" && canEditCard) {
      updateCardMutation.mutate({
        cardPublicId: draggableId,

@@ -376,6 +382,13 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
            sourceBoardName={boardData?.name ?? ""}
          />
        </Modal>
+
+        <Modal
+          modalSize="sm"
+          isVisible={isOpen && modalContentType === "EDIT_YOUTUBE"}
+        >
+          <EditYouTubeModal />
+        </Modal>
      </>
    );
  };
@@ -402,10 +415,12 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                id="name"
                type="text"
                {...register("name")}
-                onBlur={handleSubmit(onSubmit)}
-                className="block border-0 bg-transparent p-0 py-0 font-bold leading-[2.3rem] tracking-tight text-neutral-900 focus:ring-0 focus-visible:outline-none dark:text-dark-1000 sm:text-[1.2rem]"
+                onBlur={canEditBoard ? handleSubmit(onSubmit) : undefined}
+                readOnly={!canEditBoard}
+                className="block border-0 bg-transparent p-0 py-0 font-bold leading-[2.3rem] tracking-tight text-neutral-900 focus:ring-0 focus-visible:outline-none dark:text-dark-1000 sm:text-[1.2rem] disabled:cursor-not-allowed"
              />
            </form>
+
          )}
          {!boardData && !isLoading && (
            <p className="order-2 block p-0 py-0 font-bold leading-[2.3rem] tracking-tight text-neutral-900 dark:text-dark-1000 sm:text-[1.2rem] md:order-1">
@@ -428,6 +443,9 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                  isLoading={isLoading}
                  workspaceSlug={workspace.slug ?? ""}
                  boardSlug={boardData?.slug ?? ""}
+                  boardPublicId={boardId ?? ""}
+                  visibility={boardData?.visibility ?? "private"}
+                  canEdit={canEditBoard}
                />
                <VisibilityButton
                  visibility={boardData?.visibility ?? "private"}
@@ -450,7 +468,13 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                )}
              </>
            )}
-            <Tooltip content={createListShortcutTooltipContent}>
+            <Tooltip
+              content={
+                !canCreateList
+                  ? t`You don't have permission`
+                  : createListShortcutTooltipContent
+              }
+            >
              <Button
                iconLeft={
                  <HiOutlinePlusSmall
@@ -459,9 +483,9 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                  />
                }
                onClick={() => {
-                  if (boardId) openNewListForm(boardId);
+                  if (boardId && canCreateList) openNewListForm(boardId);
                }}
-                disabled={!boardData}
+                disabled={!boardData || !canCreateList}
              >
                {t`New list`}
              </Button>
@@ -471,11 +495,17 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
              isLoading={!boardData}
              boardPublicId={boardId ?? ""}
              workspacePublicId={workspace.publicId}
+              isFavorite={boardData?.favorite}
+              boardName={boardData?.name}
            />
          </div>
        </div>

-        <div className="scrollbar-w-none scrollbar-track-rounded-[4px] scrollbar-thumb-rounded-[4px] scrollbar-h-[8px] z-0 flex-1 overflow-y-hidden overflow-x-scroll overscroll-contain scrollbar scrollbar-track-light-200 scrollbar-thumb-light-400 dark:scrollbar-track-dark-100 dark:scrollbar-thumb-dark-300">
+        <div
+          ref={scrollRef}
+          onMouseDown={onMouseDown}
+          className={`scrollbar-w-none scrollbar-track-rounded-[4px] scrollbar-thumb-rounded-[4px] scrollbar-h-[8px] z-0 flex-1 overflow-y-hidden overflow-x-scroll overscroll-contain scrollbar scrollbar-track-light-200 scrollbar-thumb-light-400 dark:scrollbar-track-dark-100 dark:scrollbar-thumb-dark-300`}
+        >
          {isLoading ? (
            <div className="ml-[2rem] flex">
              <div className="0 mr-5 h-[500px] w-[18rem] animate-pulse rounded-md bg-light-200 dark:bg-dark-100" />
@@ -492,16 +522,25 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                      {t`No lists`}
                    </p>
                    <p className="text-[14px] text-light-900 dark:text-dark-900">
-                      {t`Get started by creating a new list`}
+                      {canCreateList
+                        ? t`Get started by creating a new list`
+                        : t`No lists have been created yet`}
                    </p>
                  </div>
-                  <Button
-                    onClick={() => {
-                      if (boardId) openNewListForm(boardId);
-                    }}
+                  <Tooltip
+                    content={
+                      !canCreateList ? t`You don't have permission` : undefined
+                    }
                  >
-                    {t`Create new list`}
-                  </Button>
+                    <Button
+                      onClick={() => {
+                        if (boardId && canCreateList) openNewListForm(boardId);
+                      }}
+                      disabled={!canCreateList}
+                    >
+                      {t`Create new list`}
+                    </Button>
+                  </Tooltip>
                </div>
              ) : (
                <DragDropContext onDragEnd={onDragEnd}>
@@ -541,6 +580,7 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                                      key={card.publicId}
                                      draggableId={card.publicId}
                                      index={index}
+                                      isDragDisabled={!canEditCard}
                                    >
                                      {(provided) => (
                                        <Link
@@ -558,13 +598,12 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                                              ? `/templates/${boardId}/cards/${card.publicId}`
                                              : `/cards/${card.publicId}`
                                          }
-                                          className={`mb-2 flex !cursor-pointer flex-col ${
-                                            card.publicId.startsWith(
-                                              "PLACEHOLDER",
-                                            )
-                                              ? "pointer-events-none"
-                                              : ""
-                                          }`}
+                                          className={`mb-2 flex !cursor-pointer flex-col ${card.publicId.startsWith(
+                                            "PLACEHOLDER",
+                                          )
+                                            ? "pointer-events-none"
+                                            : ""
+                                            }`}
                                          ref={provided.innerRef}
                                          {...provided.draggableProps}
                                          {...provided.dragHandleProps}
--- a/apps/web/src/views/boards/components/BoardsList.tsx
+++ b/apps/web/src/views/boards/components/BoardsList.tsx
@@ -1,9 +1,11 @@
 import Link from "next/link";
 import { t } from "@lingui/core/macro";
-import { HiOutlineRectangleStack } from "react-icons/hi2";
-
+import { HiOutlineRectangleStack, HiOutlineStar, HiStar } from "react-icons/hi2";
+import { motion } from "framer-motion";
 import Button from "~/components/Button";
 import PatternedBackground from "~/components/PatternedBackground";
+import { Tooltip } from "~/components/Tooltip";
+import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
 import { useWorkspace } from "~/providers/workspace";
 import { api } from "~/utils/api";
@@ -11,6 +13,14 @@ import { api } from "~/utils/api";
 export function BoardsList({ isTemplate }: { isTemplate?: boolean }) {
  const { workspace } = useWorkspace();
  const { openModal } = useModal();
+  const { canCreateBoard } = usePermissions();
+
+  const utils = api.useUtils();
+  const updateBoard = api.board.update.useMutation({
+    onSuccess: () => {
+      void utils.board.all.invalidate();
+    },
+  });

  const { data, isLoading } = api.board.all.useQuery(
    {
@@ -20,6 +30,20 @@ export function BoardsList({ isTemplate }: { isTemplate?: boolean }) {
    { enabled: workspace.publicId ? true : false },
  );

+  const handleToggleFavorite = (
+    e: React.MouseEvent,
+    boardPublicId: string,
+    currentFavorite: boolean | undefined
+  ) => {
+    e.preventDefault();
+    e.stopPropagation();
+    updateBoard.mutate({
+      boardPublicId,
+      favorite: !currentFavorite,
+    });
+  };
+
+
  if (isLoading)
    return (
      <div className="3xl:grid-cols-4 grid h-fit w-full grid-cols-1 gap-4 sm:grid-cols-1 md:grid-cols-2 lg:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-3">
@@ -41,27 +65,69 @@ export function BoardsList({ isTemplate }: { isTemplate?: boolean }) {
            {t`Get started by creating a new ${isTemplate ? "template" : "board"}`}
          </p>
        </div>
-        <Button onClick={() => openModal("NEW_BOARD")}>
-          {t`Create new ${isTemplate ? "template" : "board"}`}
-        </Button>
+        <Tooltip
+          content={
+            !canCreateBoard ? t`You don't have permission` : undefined
+          }
+        >
+          <Button
+            onClick={() => {
+              if (canCreateBoard) openModal("NEW_BOARD");
+            }}
+            disabled={!canCreateBoard}
+          >
+            {t`Create new ${isTemplate ? "template" : "board"}`}
+          </Button>
+        </Tooltip>
      </div>
    );

  return (
-    <div className="3xl:grid-cols-4 grid h-fit w-full grid-cols-1 gap-4 sm:grid-cols-1 md:grid-cols-2 lg:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-3">
+    <motion.div
+      className="3xl:grid-cols-4 grid h-fit w-full grid-cols-1 gap-4 sm:grid-cols-1 md:grid-cols-2 lg:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-3"
+      layout
+    >
      {data?.map((board) => (
-        <Link
+        <motion.div
          key={board.publicId}
-          href={`${isTemplate ? "templates" : "boards"}/${board.publicId}`}
+          layout
+          initial={{ opacity: 0, scale: 0.95 }}
+          animate={{ opacity: 1, scale: 1 }}
+          transition={{
+            layout: {
+              type: "spring",
+              stiffness: 300,
+              damping: 30,
+              mass: 1
+            },
+            opacity: { duration: 0.2 },
+            scale: { duration: 0.2 }
+          }}
        >
-          <div className="align-center relative mr-5 flex h-[150px] w-full items-center justify-center rounded-md border border-dashed border-light-400 bg-light-50 shadow-sm hover:bg-light-200 dark:border-dark-600 dark:bg-dark-50 dark:hover:bg-dark-100">
-            <PatternedBackground />
-            <p className="px-4 text-[14px] font-bold text-neutral-700 dark:text-dark-1000">
-              {board.name}
-            </p>
-          </div>
-        </Link>
+          <Link
+            href={`${isTemplate ? "templates" : "boards"}/${board.publicId}`}
+          >
+            <div className="group relative mr-5 flex h-[150px] w-full items-center justify-center rounded-md border border-dashed border-light-400 bg-light-50 shadow-sm hover:bg-light-200 dark:border-dark-600 dark:bg-dark-50 dark:hover:bg-dark-100">
+              <PatternedBackground />
+                <button
+                  onClick={(e) => handleToggleFavorite(e, board.publicId, board.favorite)}
+                  className={`absolute right-3 top-3 z-10 rounded p-1 transition-all hover:bg-light-300 dark:hover:bg-dark-200 ${board.favorite ? "" : "md:opacity-0 md:group-hover:opacity-100"
+                    }`}
+                  aria-label={board.favorite ? "Remove from favorites" : "Add to favorites"}
+                >
+                  {board.favorite ? (
+                    <HiStar className="h-5 w-5 text-neutral-700 dark:text-dark-1000" />
+                  ) : (
+                    <HiOutlineStar className="h-5 w-5 text-neutral-700 dark:text-dark-800" />
+                  )}
+                </button>
+              <p className="px-4 text-[14px] font-bold text-neutral-700 dark:text-dark-1000">
+                {board.name}
+              </p>
+            </div>
+          </Link>
+        </motion.div>
      ))}
-    </div>
+    </motion.div>
  );
 }
--- a/apps/web/src/views/boards/index.tsx
+++ b/apps/web/src/views/boards/index.tsx
@@ -7,6 +7,7 @@ import Modal from "~/components/modal";
 import { NewWorkspaceForm } from "~/components/NewWorkspaceForm";
 import { PageHead } from "~/components/PageHead";
 import { Tooltip } from "~/components/Tooltip";
+import { usePermissions } from "~/hooks/usePermissions";
 import { useKeyboardShortcut } from "~/providers/keyboard-shortcuts";
 import { useModal } from "~/providers/modal";
 import { useWorkspace } from "~/providers/workspace";
@@ -17,12 +18,13 @@ import { NewBoardForm } from "./components/NewBoardForm";
 export default function BoardsPage({ isTemplate }: { isTemplate?: boolean }) {
  const { openModal, modalContentType, isOpen } = useModal();
  const { workspace } = useWorkspace();
+  const { canCreateBoard } = usePermissions();

  const { tooltipContent: createModalShortcutTooltipContent } =
    useKeyboardShortcut({
      type: "PRESS",
      stroke: { key: "C" },
-      action: () => openModal("NEW_BOARD"),
+      action: () => canCreateBoard && openModal("NEW_BOARD"),
      description: t`Create new ${isTemplate ? "template" : "board"}`,
      group: "ACTIONS",
    });
@@ -39,22 +41,40 @@ export default function BoardsPage({ isTemplate }: { isTemplate?: boolean }) {
          </h1>
          <div className="flex gap-2">
            {!isTemplate && (
-              <Button
-                type="button"
-                variant="secondary"
-                onClick={() => openModal("IMPORT_BOARDS")}
-                iconLeft={
-                  <HiArrowDownTray aria-hidden="true" className="h-4 w-4" />
+              <Tooltip
+                content={
+                  !canCreateBoard ? t`You don't have permission` : undefined
                }
              >
-                {t`Import`}
-              </Button>
+                <Button
+                  type="button"
+                  variant="secondary"
+                  onClick={() => {
+                    if (canCreateBoard) openModal("IMPORT_BOARDS");
+                  }}
+                  disabled={!canCreateBoard}
+                  iconLeft={
+                    <HiArrowDownTray aria-hidden="true" className="h-4 w-4" />
+                  }
+                >
+                  {t`Import`}
+                </Button>
+              </Tooltip>
            )}
-            <Tooltip content={createModalShortcutTooltipContent}>
+            <Tooltip
+              content={
+                !canCreateBoard
+                  ? t`You don't have permission`
+                  : createModalShortcutTooltipContent
+              }
+            >
              <Button
                type="button"
                variant="primary"
-                onClick={() => openModal("NEW_BOARD")}
+                onClick={() => {
+                  if (canCreateBoard) openModal("NEW_BOARD");
+                }}
+                disabled={!canCreateBoard}
                iconLeft={
                  <HiOutlinePlusSmall aria-hidden="true" className="h-4 w-4" />
                }
--- a/apps/web/src/views/card/components/ActivityList.tsx
+++ b/apps/web/src/views/card/components/ActivityList.tsx
@@ -2,6 +2,7 @@ import type { Locale as DateFnsLocale } from "date-fns";
 import { t } from "@lingui/core/macro";
 import { Trans } from "@lingui/react/macro";
 import { format, formatDistanceToNow, isSameYear } from "date-fns";
+import { useEffect, useRef, useState } from "react";
 import {
  HiOutlineArrowLeft,
  HiOutlineArrowRight,
@@ -15,11 +16,16 @@ import {
  HiOutlineUserPlus,
 } from "react-icons/hi2";

-import type { GetCardByIdOutput } from "@kan/api/types";
+import type {
+  GetCardActivitiesOutput,
+  GetCardByIdOutput,
+} from "@kan/api/types";
 import { authClient } from "@kan/auth/client";

 import Avatar from "~/components/Avatar";
 import { useLocalisation } from "~/hooks/useLocalisation";
+import { api } from "~/utils/api";
+import { getAvatarUrl } from "~/utils/helpers";
 import Comment from "./Comment";

 type ActivityType =
@@ -30,30 +36,77 @@ const truncate = (value: string | null, maxLength = 50) => {
  return value.length > maxLength ? `${value.slice(0, maxLength - 1)}…` : value;
 };

+const getUserDisplayName = (
+  user: { name?: string | null; email?: string | null } | null | undefined,
+): string => {
+  if (user?.name?.trim()) return user.name;
+  if (user?.email) return user.email;
+  return t`Member`;
+};
+
 const getActivityText = ({
  type,
  toTitle,
  fromList,
  toList,
  memberName,
+  memberEmail,
  isSelf,
  label,
  fromTitle,
  toDueDate,
  dateLocale,
+  mergedLabels,
 }: {
  type: ActivityType;
  toTitle: string | null;
  fromList: string | null;
  toList: string | null;
  memberName: string | null;
+  memberEmail: string | null;
  isSelf: boolean;
  label: string | null;
  fromTitle?: string | null;
  fromDueDate?: Date | null;
  toDueDate?: Date | null;
  dateLocale: DateFnsLocale;
+  mergedLabels?: string[];
 }) => {
+  const displayName = memberName ?? memberEmail ?? t`Member`;
+  const TextHighlight = ({ children }: { children: React.ReactNode }) => (
+    <span className="font-medium text-light-1000 dark:text-dark-1000">
+      {children}
+    </span>
+  );
+
+  if (
+    type === "card.updated.label.added" &&
+    mergedLabels &&
+    mergedLabels.length > 1
+  ) {
+    const labelList = mergedLabels.join(", ");
+    return (
+      <Trans>
+        added {mergedLabels.length} labels:{" "}
+        <TextHighlight>{labelList}</TextHighlight>
+      </Trans>
+    );
+  }
+
+  if (
+    type === "card.updated.label.removed" &&
+    mergedLabels &&
+    mergedLabels.length > 1
+  ) {
+    const labelList = mergedLabels.join(", ");
+    return (
+      <Trans>
+        removed {mergedLabels.length} labels:{" "}
+        <TextHighlight>{labelList}</TextHighlight>
+      </Trans>
+    );
+  }
+
  const ACTIVITY_TYPE_MAP = {
    "card.created": t`created the card`,
    "card.updated.title": t`updated the title`,
@@ -79,12 +132,6 @@ const getActivityText = ({
  if (!(type in ACTIVITY_TYPE_MAP)) return null;
  const baseText = ACTIVITY_TYPE_MAP[type as keyof typeof ACTIVITY_TYPE_MAP];

-  const TextHighlight = ({ children }: { children: React.ReactNode }) => (
-    <span className="font-medium text-light-1000 dark:text-dark-1000">
-      {children}
-    </span>
-  );
-
  if (type === "card.updated.title" && toTitle) {
    return (
      <Trans>
@@ -103,23 +150,23 @@ const getActivityText = ({
    );
  }

-  if (type === "card.updated.member.added" && memberName) {
+  if (type === "card.updated.member.added" && displayName) {
    if (isSelf) return <Trans>self-assigned the card</Trans>;

    return (
      <Trans>
-        assigned <TextHighlight>{truncate(memberName)}</TextHighlight> to the
+        assigned <TextHighlight>{truncate(displayName)}</TextHighlight> to the
        card
      </Trans>
    );
  }

-  if (type === "card.updated.member.removed" && memberName) {
+  if (type === "card.updated.member.removed" && displayName) {
    if (isSelf) return <Trans>unassigned themselves from the card</Trans>;

    return (
      <Trans>
-        unassigned <TextHighlight>{truncate(memberName)}</TextHighlight> from
+        unassigned <TextHighlight>{truncate(displayName)}</TextHighlight> from
        the card
      </Trans>
    );
@@ -281,37 +328,152 @@ const getActivityIcon = (
  return ACTIVITY_ICON_MAP[type] ?? null;
 };

+const ACTIVITIES_PAGE_SIZE = 20;
+
 const ActivityList = ({
-  activities,
  cardPublicId,
-  isLoading,
+  isLoading: cardIsLoading,
  isAdmin,
  isViewOnly,
 }: {
-  activities: NonNullable<GetCardByIdOutput>["activities"];
  cardPublicId: string;
  isLoading: boolean;
  isAdmin?: boolean;
  isViewOnly?: boolean;
 }) => {
-  const { data } = authClient.useSession();
-  const { dateLocale } = useLocalisation();
+  const { dateLocale, locale } = useLocalisation();
+  const { data: sessionData } = authClient.useSession();
+  const utils = api.useUtils();
+  const [allActivities, setAllActivities] = useState<
+    GetCardActivitiesOutput["activities"]
+  >([]);
+  const [hasMore, setHasMore] = useState(true);
+  const [isLoadingMore, setIsLoadingMore] = useState(false);
+
+  const isFullyExpandedRef = useRef(false);
+  const lastDataUpdatedAtRef = useRef<number | null>(null);
+
+  const {
+    data: firstPageData,
+    isFetching: isFetchingFirst,
+    dataUpdatedAt,
+  } = api.card.getActivities.useQuery(
+    {
+      cardPublicId,
+      limit: ACTIVITIES_PAGE_SIZE,
+    },
+    {
+      enabled: !!cardPublicId && cardPublicId.length >= 12,
+    },
+  );
+
+  useEffect(() => {
+    if (firstPageData && dataUpdatedAt !== lastDataUpdatedAtRef.current) {
+      lastDataUpdatedAtRef.current = dataUpdatedAt;
+
+      if (isFullyExpandedRef.current && firstPageData.hasMore) {
+        setAllActivities(firstPageData.activities);
+        setHasMore(firstPageData.hasMore);
+
+        const fetchAllRemaining = async () => {
+          let currentActivities = [...firstPageData.activities];
+          let currentHasMore = firstPageData.hasMore;
+
+          while (currentHasMore) {
+            const lastActivity =
+              currentActivities[currentActivities.length - 1];
+            if (!lastActivity) break;
+
+            const nextCursor = new Date(lastActivity.createdAt).toISOString();
+            const nextPage = await utils.card.getActivities.fetch({
+              cardPublicId,
+              limit: ACTIVITIES_PAGE_SIZE,
+              cursor: nextCursor,
+            });
+
+            if (nextPage) {
+              const existingIds = new Set(
+                currentActivities.map((a) => a.publicId),
+              );
+              const newActivities = nextPage.activities.filter(
+                (a: { publicId: string }) => !existingIds.has(a.publicId),
+              );
+              currentActivities = [...currentActivities, ...newActivities];
+              currentHasMore = nextPage.hasMore;
+            } else {
+              break;
+            }
+          }
+
+          setAllActivities(currentActivities);
+          setHasMore(false);
+        };
+
+        fetchAllRemaining();
+      } else {
+        setAllActivities(firstPageData.activities);
+        setHasMore(firstPageData.hasMore);
+
+        if (!firstPageData.hasMore) {
+          isFullyExpandedRef.current = true;
+        }
+      }
+    }
+  }, [firstPageData, dataUpdatedAt, cardPublicId, utils.card.getActivities]);
+
+  const handleLoadMore = async () => {
+    if (isLoadingMore || !hasMore || allActivities.length === 0) return;
+
+    const lastActivity = allActivities[allActivities.length - 1];
+    if (!lastActivity) return;
+
+    setIsLoadingMore(true);
+    try {
+      const nextCursor = new Date(lastActivity.createdAt).toISOString();
+      const nextPage = await utils.card.getActivities.fetch({
+        cardPublicId,
+        limit: ACTIVITIES_PAGE_SIZE,
+        cursor: nextCursor,
+      });
+
+      if (nextPage) {
+        const existingIds = new Set(allActivities.map((a) => a.publicId));
+        const newActivities = nextPage.activities.filter(
+          (a: { publicId: string }) => !existingIds.has(a.publicId),
+        );
+        setAllActivities((prev) => [...prev, ...newActivities]);
+        setHasMore(nextPage.hasMore);
+
+        if (!nextPage.hasMore) {
+          isFullyExpandedRef.current = true;
+        }
+      }
+    } finally {
+      setIsLoadingMore(false);
+    }
+  };
+
+  const isFetching = isFetchingFirst || isLoadingMore;
+  const isLoading =
+    cardIsLoading || (isFetchingFirst && allActivities.length === 0);

  return (
    <div className="flex flex-col space-y-4 pt-4">
-      {activities.map((activity, index) => {
+      {allActivities.map((activity, index) => {
        const activityText = getActivityText({
          type: activity.type,
          toTitle: activity.toTitle,
          fromList: activity.fromList?.name ?? null,
          toList: activity.toList?.name ?? null,
          memberName: activity.member?.user?.name ?? null,
-          isSelf: activity.member?.user?.id === data?.user.id,
+          memberEmail: activity.member?.user?.email ?? null,
+          isSelf: activity.member?.user?.id === sessionData?.user.id,
          label: activity.label?.name ?? null,
          fromTitle: activity.fromTitle ?? null,
          fromDueDate: activity.fromDueDate ?? null,
          toDueDate: activity.toDueDate ?? null,
          dateLocale: dateLocale,
+          mergedLabels: (activity as any).mergedLabels,
        });

        if (activity.type === "card.updated.comment.added")
@@ -322,11 +484,12 @@ const ActivityList = ({
              cardPublicId={cardPublicId}
              name={activity.user?.name ?? ""}
              email={activity.user?.email ?? ""}
+              image={activity.user?.image ?? null}
              isLoading={isLoading}
              createdAt={activity.createdAt.toISOString()}
              comment={activity.comment?.comment}
              isEdited={!!activity.comment?.updatedAt}
-              isAuthor={activity.comment?.createdBy === data?.user.id}
+              isAuthor={activity.comment?.createdBy === sessionData?.user.id}
              isAdmin={isAdmin ?? false}
              isViewOnly={!!isViewOnly}
            />
@@ -344,6 +507,7 @@ const ActivityList = ({
                size="sm"
                name={activity.user?.name ?? ""}
                email={activity.user?.email ?? ""}
+                imageUrl={getAvatarUrl(activity.user?.image ?? null) || undefined}
                icon={getActivityIcon(
                  activity.type,
                  activity.fromList?.index,
@@ -351,14 +515,12 @@ const ActivityList = ({
                )}
                isLoading={isLoading}
              />
-              {index !== activities.length - 1 &&
-                activities[index + 1]?.type !==
-                  "card.updated.comment.added" && (
-                  <div className="absolute bottom-[-14px] left-1/2 top-[30px] w-0.5 -translate-x-1/2 bg-light-600 dark:bg-dark-600" />
-                )}
+              {index !== allActivities.length - 1 && (
+                <div className="absolute bottom-[-14px] left-1/2 top-[30px] w-0.5 -translate-x-1/2 bg-light-600 dark:bg-dark-600" />
+              )}
            </div>
            <p className="text-sm">
-              <span className="font-medium dark:text-dark-1000">{`${activity.user?.name} `}</span>
+              <span className="font-medium dark:text-dark-1000">{`${getUserDisplayName(activity.user)} `}</span>
              <span className="space-x-1 text-light-900 dark:text-dark-800">
                {activityText}
              </span>
@@ -373,6 +535,17 @@ const ActivityList = ({
          </div>
        );
      })}
+      {hasMore && (
+        <div className="flex justify-center pt-4">
+          <button
+            onClick={handleLoadMore}
+            disabled={isFetching}
+            className="text-sm font-medium text-light-900 hover:text-light-1000 disabled:opacity-50 dark:text-dark-800 dark:hover:text-dark-1000"
+          >
+            {isFetching ? t`Loading...` : t`Load more activities`}
+          </button>
+        </div>
+      )}
    </div>
  );
 };
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Henry	175999c88c	fix: use multipart upload for attachments to resolve chunk size error	2026-02-07 22:41:47 +00:00
Ivan Shelepugin	24e283e22c	feat: smart typography (#360 ) * build(web, deps): add `@tiptap/extension-typography` * feat(editor): add typography extension * chore(editor): disable some typographic characters * chore(editor): disable superscript	2026-02-07 20:04:37 +00:00
Matt	07db7409cb	fix: remove phantom spacing below social providers in auth form (closes #334 ) (#364 )	2026-02-07 19:34:06 +00:00
Charity	346ddc16be	feat: add functionality to copy card link (#358 ) * Implemented link copying feature in CardDropdown and CardModal components. * Updated Dropdown component to accept new props for card identification.	2026-02-06 23:34:23 +00:00
Charity	f9eee53ed0	fix: board and workspace URL links and copy behavior (#357 ) - Use /boards/{id} for private board links so copied link works; keep pretty URL for public boards - Show matching path in board header (pretty path for public, boards/id for private) - Copy link button copies URL to clipboard instead of opening in new tab (opening a new tab seems redundant since we're already on it) - Edit workspace URL button links to /settings/workspace instead of account settings	2026-02-06 23:31:08 +00:00
Henry	1ab4e24c96	docs: add railway deployment template to self hosting docs (#363 )	2026-02-05 21:52:40 +00:00
Henry	34165b390f	fix: handle missing board in board router	2026-02-04 22:56:17 +00:00
Henry	ef0d53db8f	refactor: standardise S3 URL generation (#362 ) * refactor: replace presigned URL uploads with backend upload endpoints * feat: update avatar upload to use new endpoint * refactor: use createS3Client in auth hooks * feat: generate presigned URLs for avatars * fix: show avatar image in user menu * fix: hide tooltip if content is empty * fix: support external avatar URLs in generateAvatarUrl * fix: remove content type restriction on attachments	2026-02-04 22:40:14 +00:00
Henry	78b9de869f	fix: prevent validation errors in workspace/card queries (#356 ) * fix: prevent workspace.byId validation errors when publicId is empty * fix: add keys to shortcut elements * fix: prevent card.byId validation errors when cardPublicId is empty * chore: remove invalid config option from next.config.js	2026-02-02 22:25:54 +00:00
Henry	81c03b51e2	fix: fallback to email when user name is missing in activity list (#355 ) * fix: fallback to email when user name is missing in activity list * chore: gen translations	2026-02-02 22:00:03 +00:00
Henry	0d3d9a358f	fix: prevent ellipses from showing through member dropdown menu (#352 )	2026-02-02 20:05:53 +00:00
Henry	2269d23c94	fix: return empty permissions if WorkspaceProvider is not available	2026-02-01 23:23:06 +00:00
Henry	e437d075e3	fix: remove duplicate statement	2026-02-01 22:58:57 +00:00
Henry	b422907b53	fix: skip new col if already exists	2026-02-01 22:52:28 +00:00
Henry	672dfe6540	fix: ensure publicId is returned from create card (#350 )	2026-02-01 22:42:13 +00:00
Eliott Herbert-Byrnes	ef5bf87fdf	feat: add board favourites with animations (#318 ) * feat: add board favorites with animations * feat: add board favorites functionality with admin-only access * refactor: make board favorites user-specific via junction table * fix: assertUserInWorkspace * Update pnpm lockfile to match package.json * chore: clean up migrations --------- Co-authored-by: Henry <henry_ball@hotmail.co.uk>	2026-02-01 22:29:51 +00:00
Nick Meinhold	ec37f5480a	fix(api): include name and slug in workspace byId response (#347 ) The GET /workspaces/{id} endpoint was missing the workspace's name and slug fields because they weren't included in the column selection. Fixes #346 Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-01 22:29:37 +00:00
Henry	7f5a1ab513	feat: customisable workspace role permissions (#345 ) * feat: setup schema for workspace roles * chore: regen migration * feat: add publicId to workspace roles * feat: setup default permissions * feat: add repo funcs * feat: setup basic router interactions * feat: add card permissions * feat: assert permissions for lists * feat: assert board permissions * feat: assert permission for remaining routes * feat: add permissions page to settings * feat: enable updating member roles * feat: order members by role and createdAt * feat: allow editing individual permissions * feat: reset role defaults * feat: clear all permission overrides * feat: allow users to delete entities they have created * feat: set roleId when inviting new members * feat: disable UI elements if user does not have permissions * feat: allow admins to assign the admin role to other users * feat: allow delete:list as default * refactor: centre permissions modal * chore: translations	2026-02-01 21:17:18 +00:00
Henry	5f2d409773	fix: allow empty REDIS_URL in environment configuration	2026-01-26 11:44:17 +00:00
Henry	210e44db5c	feat: add env var to use virtual hosted urls (#338 )	2026-01-26 10:16:42 +00:00
Henry	befe7ab7f4	feat: setup AGENTS.md file (#337 )	2026-01-25 22:40:33 +00:00
Henry	53a33c68fc	feat: rate limit api routes (#336 ) * feat: install rate-limiter-flexible and ioredis * feat: setup redis client * feat: add withRateLimit wrapper * feat: wrap trpc endpoint in withRateLimit * feat: wrap withRateLimit on remaining routes * feat: exclude webhook route from rate limiting * chore: update compose files and readme * refactor: move into api/db packages	2026-01-25 22:28:41 +00:00
Henry	3bae03613d	feat(cloud): reset workspace slug on subscription cancelled (#335 )	2026-01-25 21:20:04 +00:00
Sachin Divekar	c42ee7cf2c	fix: disable tooltips on touch devices (#333 )	2026-01-25 13:41:59 +00:00
Henry	07f997c3ad	fix: update localization for brazilian portuguese (#332 ) * fix: update localization for brazilian portuguese * compile	2026-01-24 22:51:32 +00:00
Sachin Divekar	d084d323bc	feat: show user avatar on comments and activity (#331 ) Display user profile pictures instead of initials on card comments and activity items. Fetches the user image field from the database and passes imageUrl to the Avatar component. Co-authored-by: Sachin Divekar <sachin.divekar@remiges.tech>	2026-01-24 22:04:46 +00:00
Sachin Divekar	6729c2e228	fix: support virtual-hosted S3 URLs for avatar storage (#330 ) Avatar images failed to load with 403 on Tigris and newer AWS S3 buckets because getAvatarUrl only constructed path-style URLs. Modern S3-compatible providers require virtual-hosted URLs (bucket.domain/key). Add NEXT_PUBLIC_STORAGE_DOMAIN env var to signal URL style: - If set: virtual-hosted URL (Tigris, AWS S3) - If not set: path-style URL (MinIO, LocalStack) - backward compatible Add vitest and tests for getAvatarUrl behavior. Co-authored-by: Sachin Divekar <sachin.divekar@remiges.tech>	2026-01-24 22:02:41 +00:00
Charity	b18ef10313	refactor: simplify drag-to-scroll logic to enable dragging on any non-interactive element within the container (fixes my oopsie) (#328 )	2026-01-24 21:43:12 +00:00
Charity	03bd2d771b	Hide member emails from non-admins (#327 ) * feat(workspace): sanitize member emails for non-admin users in workspace router * feat(workspace): add email visibility setting and update member display logic * fix(workspace): update default value for showEmailsToMembers column to true * - Removed unnecessary type assertions - Added anonymous name handling (anonymous_[publicId]) in the API - Removed placeholder logic - Reverted null check - Avoided as unknown cast	2026-01-24 21:41:59 +00:00
Redox	ff7944a4a2	Show display name instead of email (#323 ) * Show display name instead of email * Properly pass displayName * Show email on settings page too * Show email on missing username	2026-01-24 21:34:38 +00:00
Redox	0ca9c1d0e6	Add `NEXT_API_BODY_SIZE_LIMIT` config (#325 ) * Add `NEXT_API_BODY_SIZE_LIMIT` config * Add NEXT_API_BODY_SIZE_LIMIT env var to more files	2026-01-24 21:22:32 +00:00
Charity	927bf2fe69	feat: implement horizontal drag-to-scroll functionality in board views (#326 )	2026-01-22 19:49:25 +00:00
Redox	ccd84385a2	Add Discord CDN avatars to allowed image sources (#322 )	2026-01-22 14:23:25 +00:00
Henry	58c5e92155	feat(cloud): handle cancelled subscriptions (#313 ) * feat(cloud): handle cancelled subscriptions * chore: refactor auth	2026-01-16 20:20:22 +00:00
Henry	885f119404	chore: unshallow git clone	2026-01-15 20:15:19 +00:00
Henry	b17a24455a	chore: generate app version during build	2026-01-14 21:21:04 +00:00
Henry	0c9561467d	feat: display app version in user menu (#310 ) * feat: display app version * feat: add fetch depth	2026-01-13 12:48:07 +00:00
Henry	47b6f06be4	fix: set min height for new card editor (#305 )	2026-01-06 09:13:19 +00:00
Eliott Herbert-Byrnes	89c8961176	feat: add YouTube video embed support for TipTap editor (#294 ) * feat: add YouTube video embed support for TipTap editor - Paste YouTube URLs to auto-embed videos with metadata - Edit video title and URL through dropdown menu - Convert embed back to plain URL link - Fetch video titles automatically via YouTube oEmbed API * fix: - reverted NewCardForm CSS properties back to max-h-48. - Added boolean prop to TipTap Edtior for YouTube embed. - Disabled YouTube embed feature for NewCardForm Editor * chore: lint * chore: translations * chore: update translations --------- Co-authored-by: Henry <henry_ball@hotmail.co.uk>	2026-01-05 20:15:07 +00:00
Henry	a5432c60b7	fix: recenter collapsed menu buttons (#303 )	2026-01-03 20:55:37 +00:00
Henry	2b8fe3d3a2	fix: extend allowed card title length (#301 ) * feat: update card title from varchar to text * feat: add input length validation * fix: slice title when longer than max chars during import	2025-12-29 22:50:16 +00:00
Henry	73c9b326a1	fix: map profile to user for OIDC (#297 )	2025-12-29 21:45:35 +00:00
Henry	a55c8cd52b	fix: update checklist when pressing enter on edit (#292 ) * fix: update checklist when pressing enter on edit * feat: open new checklist item form on enter	2025-12-19 21:40:24 +00:00
Henry	cca8a9d424	feat: health check and stats endpoints (#290 )	2025-12-18 08:08:30 +00:00
Ridham Khandar	57186b6b4d	feat: paginate and merge frequent activities (#274 ) * feat: paginate and merge frequent activities * feat: due date activities * fix: requested changes fixes * refactor: slight reshuffle and improve types * chore: translations --------- Co-authored-by: Henry <henry_ball@hotmail.co.uk>	2025-12-16 09:07:08 +00:00
Eliott Herbert-Byrnes	3cb40d0f9a	feat: implement drag-and-drop reordering for checklist items (#275 ) * feat: implement drag-and-drop reordering for checklist items * WIP: Changes before syncing with main * feat: update drag icon and positioning * refactor: consolidate checklist item updates into single endpoint - Remove standalone reorderItem route (now part of updateItem) - Add optional index parameter to updateItem for reordering - Change updateItem from PUT to PATCH method - Add deletedAt IS NULL filter to reorderItem SQL queries - Follows existing pattern from card.update route * feat: add optimistic updates * chore: translations --------- Co-authored-by: Henry <henry_ball@hotmail.co.uk>	2025-12-15 10:01:04 +00:00
Henry	6ebab28606	feat(cloud): force payment method collection for subscription checkout (#285 )	2025-12-14 21:55:03 +00:00
Henry	5765c71ebf	feat: update logos (#284 )	2025-12-13 23:14:25 +00:00
Henry	86ecdca7f1	fix: enable sessions for API keys (#283 ) * fix: enable sessions for API keys * chore: remove old due date filters * chore: update lockfile * fix: temp ignore eslint errors on build	2025-12-13 22:19:16 +00:00
				`@@ -1 +0,0 @@`
				<svg xmlns="http://www.w3.org/2000/svg" width="2500" height="2500" viewBox="0 0 192.756 192.756"><g fill-rule="evenodd" clip-rule="evenodd"><path fill="none" d="M0 0h192.756v192.756H0z"/><path fill="#313f94" d="M33.272 96.299c-.159-7.649-6.374-13.864-14.023-13.864S5.544 88.809 5.544 96.458h-2.71c0-8.446 6.693-15.298 15.139-15.458 8.446 0 15.458 6.853 15.458 15.299z" style="fill:currentColor"/><path fill="#313f94" d="M33.113 96.458c0-6.215-4.94-11.155-11.155-11.155s-10.677 4.94-10.677 11.155H8.253c0-7.012 5.737-12.589 12.749-12.749 6.853 0 12.43 6.374 12.589 12.589z" style="fill:currentColor"/><path fill="#313f94" d="M33.272 96.299c0-4.462-3.824-8.127-8.446-8.127s-7.968 3.665-7.968 8.287H13.99c0-5.418 4.144-9.88 9.562-9.88s9.721 4.462 9.88 9.721h-.16z" style="fill:currentColor"/><path fill="#313f94" d="M3.153 96.458c0 7.649 6.215 13.864 13.864 13.864 7.809 0 13.864-6.375 13.864-14.023h2.709c0 8.445-6.853 15.457-15.298 15.457S2.994 104.904 2.834 96.458z" style="fill:currentColor"/><path fill="#313f94" d="M3.153 96.299c0 6.215 4.94 11.154 11.155 11.154s10.836-4.939 10.677-11.154h3.028c0 7.012-5.737 12.748-12.589 12.748-7.012 0-12.589-6.373-12.589-12.589z" style="fill:currentColor"/><path fill="#313f94" d="M2.994 96.458c.159 4.462 3.984 8.128 8.446 8.128 4.622 0 7.968-3.666 7.968-8.287h2.868c0 5.418-4.143 9.881-9.562 9.881-5.417 0-9.72-4.303-9.72-9.722m54.341 3.507h-5.1l4.144-8.925zm-8.924 8.285 1.434-3.188h7.968l.479 3.188h7.968l-4.462-24.7H53.67l-13.227 24.7zm21.513 0 4.303-24.7h8.127l-4.302 24.7zm24.064-18.645h3.985c1.273 0 2.07.16 2.549.638.318.318.479.956.318 1.593-.158.797-.479 1.435-1.115 1.753-.479.479-1.434.638-2.709.638h-3.825zM90.8 108.25l1.435-8.605h3.187c.956 0 1.754.16 2.23.32.479.318.797.637.957 1.115q.237.716 0 1.912l-.16 1.912c-.318 1.594-.318 2.709-.318 3.346h8.287v-.797c-.16 0-.479 0-.479-.158-.158-.16-.158-.479 0-1.115l.639-3.826c.158-1.752.158-3.027-.32-3.664-.477-.797-1.434-1.436-2.867-2.072.797-.159 1.434-.479 2.07-.796.797-.638 1.436-1.275 1.912-2.072.639-.957.957-1.913 1.275-3.188q.24-1.434 0-2.39a5.3 5.3 0 0 0-.797-1.912 7.5 7.5 0 0 0-1.594-1.594c-.797-.319-1.594-.638-2.709-.797s-2.548-.319-4.302-.319H87.294l-4.303 24.7zm33.147-19.123c1.115 0 1.912.159 2.23.159.479.16.797.479.957.797.318.319.318.797.318 1.275-.16.638-.479 1.116-1.115 1.594-.479.319-1.436.637-2.709.637H120.6l.797-4.462zm-1.275 19.123c1.912 0 3.188-.158 3.984-.318s1.752-.479 2.549-.797c.957-.479 1.594-.797 2.072-1.275.797-.477 1.275-1.273 1.754-2.07a7.2 7.2 0 0 0 1.115-2.869c.158-1.434 0-2.709-.479-3.666-.637-1.115-1.434-1.752-2.709-2.071 2.391-1.434 3.824-3.187 4.143-5.259.479-2.231-.158-3.825-1.912-4.94-1.275-.957-3.346-1.435-6.533-1.435h-12.111l-4.303 24.7zm.478-10.357c1.594 0 2.549.318 3.027.637.479.479.637.957.479 1.754-.16.637-.479 1.273-1.115 1.752-.639.318-1.594.639-3.188.639h-3.346l.797-4.781zm18.645-14.343h7.969l-2.709 15.298c-.16.957-.16 1.754 0 2.232.158.477.477.955 1.115 1.273.637.32 1.275.479 2.07.479 1.117 0 2.232-.318 2.869-.955.797-.639 1.275-1.754 1.594-3.029l2.709-15.298h7.969l-2.551 14.501c-.318 1.754-.637 3.188-1.115 4.303-.479.957-1.115 1.912-1.912 2.709s-1.754 1.594-2.709 2.072c-1.115.637-2.23 1.115-3.506 1.434-1.434.16-2.869.32-4.303.32-1.754 0-3.188-.16-4.463-.32-1.273-.318-2.23-.797-3.027-1.434-.955-.637-1.594-1.275-2.072-2.072-.477-.797-.797-1.912-.797-3.186-.158-.797 0-2.232.32-3.984zm48.127 7.171h-7.809c0-.638-.318-1.275-.639-1.594-.477-.319-1.115-.478-2.07-.478-.957 0-1.754.159-2.23.478-.479.319-.639.638-.797 1.116 0 .478 0 .637.318.956s1.115.637 2.549.956l3.027.797c2.709.797 4.623 1.753 5.578 3.028.957 1.274 1.275 2.709.957 4.461-.32 1.436-.797 2.551-1.594 3.666s-1.754 2.072-2.709 2.709c-.957.637-2.232 1.115-3.666 1.594-1.434.318-3.027.479-4.621.479s-3.188-.16-4.621-.639q-2.153-.717-3.348-1.912c-1.195-1.195-1.434-1.752-1.752-2.867-.16-.797-.16-1.754-.16-2.869h7.809c0 .797.318 1.434.797 1.752.479.479 1.436.639 2.709.639q1.673 0 2.391-.479c.718-.479.639-.637.797-1.115 0-.479 0-.957-.318-1.275s-1.115-.637-2.551-.955l-2.709-.639c-1.273-.318-2.709-.797-3.824-1.434-1.115-.638-2.07-1.435-2.549-2.55-.479-.956-.479-2.071-.318-3.506.318-1.434.797-2.549 1.592-3.665.797-1.115 1.754-1.912 2.869-2.55.957-.797 2.23-1.115 3.506-1.434s2.551-.478 3.824-.478c1.594 0 2.869.159 4.145.478 1.273.319 2.07.797 2.867 1.275.639.478 1.115 1.115 1.436 1.753.477.637.637 1.275.797 1.912.157.637.317 1.434.317 2.39" style="fill:currentColor"/></g></svg>