feat: add url validation to download attatchment endpoint

* feat: initial github integration with importing projects

* fix: remove unused args

* chore: remove duplicate col

---------

Co-authored-by: Henry <henry_ball@hotmail.co.uk>

.dockerignore

@@ -1,18 +1,62 @@
+# Environment
 .env
+.env.*
+!.env.example
 
-docker-compose.override.yml
-
-Dockerfile
-./**/*/Dockerfile
-
+# Docker
+docker-compose*.yml
 .dockerignore
 
+# Dependencies (rebuilt in Docker)
 node_modules
-./**/*/node_modules
+**/node_modules
 
+# Build outputs (rebuilt in Docker)
+**/.next
+**/dist
+**/out
+**/.turbo
+**/.cache
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# IDE
+.vscode
+.idea
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# CI/CD
+.github
+.husky
+.changeset
+
+# Documentation (not needed in build)
+*.md
+!packages/db/migrations/**
+LICENSE
+CONTRIBUTING.md
+AGENTS.md
+CHANGELOG.md
+
+# Test files
+**/*.test.ts
+**/*.test.tsx
+**/*.spec.ts
+**/*.spec.tsx
+**/__tests__
+**/coverage
+
+# Logs
 pnpm-debug.log
-./**/*/pnpm-debug.log
+**/pnpm-debug.log
 
-README.md
-.next
-# .git
+# Cloud compose (separate deployment)
+cloud/

.github/workflows/docker-publish.yml

@@ -6,23 +6,31 @@ name: Docker
 # documentation.
 
 on:
-  schedule:
-    - cron: "21 21 * * *"
   push:
-    branches: ["main"]
-    # Publish semver tags as releases.
+    # Only trigger on tags (releases), not main branch pushes
+    # Main branch builds are handled by workflow_run after Translate completes
     tags: ["v*.*.*"]
   pull_request:
     branches: ["main"]
+  workflow_run:
+    workflows: ["Translate"]
+    types: [completed]
+    branches: [main]
+    # Docker builds after Translate completes (success or failure)
+    # This ensures Docker always has the latest translations
 
 env:
   # Use docker.io for Docker Hub if empty
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  MIGRATE_IMAGE_NAME: ${{ github.repository }}-migrate
 
 jobs:
   build:
+    concurrency:
+      group: docker-build-${{ github.ref }}
+      cancel-in-progress: true
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -74,7 +82,22 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
+            type=raw,value=edge,enable={{is_default_branch}}
+
+      - name: Extract Docker metadata (migrate)
+        id: meta-migrate
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.MIGRATE_IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
+            type=raw,value=edge,enable={{is_default_branch}}
 
       # Extract version from git tag or ref
       # Uses git describe to get latest tag + commit hash in SemVer format: 1.2.3+abc1234
@@ -129,6 +152,22 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Build and push migrate Docker image
+        id: build-and-push-migrate
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
+        with:
+          context: .
+          file: apps/web/Dockerfile
+          target: migrate
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta-migrate.outputs.tags }}
+          labels: ${{ steps.meta-migrate.outputs.labels }}
+          build-args: |
+            APP_VERSION=${{ steps.version.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       # Sign the resulting Docker image digest except on PRs.
       # This will only write to the public Rekor transparency log when the Docker
       # repository is public to avoid leaking data.  If you would like to publish
@@ -143,3 +182,10 @@ jobs:
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
         run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
+
+      - name: Sign the published migrate Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          TAGS: ${{ steps.meta-migrate.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push-migrate.outputs.digest }}
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.github/workflows/translate.yml

@@ -0,0 +1,56 @@
+name: Translate
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  translate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v2
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --filter @kan/web...
+
+      - name: Extract translations
+        working-directory: apps/web
+        run: pnpm lingui:extract
+
+      - name: Lingo.dev
+        uses: lingodotdev/lingo.dev@main
+        with:
+          api-key: ${{ secrets.LINGODOTDEV_API_KEY }}
+          commit-message: "chore: update translations"
+          working-directory: apps/web
+          commit-author-name: "${{ github.actor }}"
+          commit-author-email: "${{ github.actor }}@users.noreply.github.com"
+          parallel: true
+
+      - name: Compile translations
+        working-directory: apps/web
+        run: pnpm lingui:compile
+
+      - name: Commit compiled translations
+        run: |
+          git config --local user.email "${{ github.actor }}@users.noreply.github.com"
+          git config --local user.name "${{ github.actor }}"
+          if ls apps/web/src/locales/*/messages.ts 1> /dev/null 2>&1; then
+            git add apps/web/src/locales/*/messages.ts
+            git diff --staged --quiet || (git commit -m "chore: compile translations" && git push)
+          fi

README.md

@@ -57,39 +57,61 @@ The easiest way to deploy Kan is through Railway. We've partnered with Railway t
 
 ### Docker Compose
 
-Alternatively, you can self-host Kan with Docker Compose. This will set up everything for you including your postgres database.
+Alternatively, you can self-host Kan with Docker Compose. This will set up everything for you including your postgres database and automatically run migrations.
 
-1. Create a new file called `docker-compose.yml` and paste the following configuration:
+1. Create a `.env` file with your environment variables (see [Environment Variables](#environment-variables-) section below)
+
+2. Use the provided `docker-compose.yml` file or create your own with the following configuration:
 
 ```yaml
 services:
+  migrate:
+    image: ghcr.io/kanbn/kan-migrate:latest
+    container_name: kan-migrate
+    networks:
+      - kan-network
+    environment:
+      - POSTGRES_URL=${POSTGRES_URL}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: "no"
+
   web:
     image: ghcr.io/kanbn/kan:latest
     container_name: kan-web
     ports:
-      - "3000:3000"
+      - "${WEB_PORT:-3000}:3000"
     networks:
       - kan-network
+    env_file:
+      - .env
     environment:
-      NEXT_PUBLIC_BASE_URL: http://localhost:3000
-      BETTER_AUTH_SECRET: your_auth_secret
-      POSTGRES_URL: postgresql://kan:your_postgres_password@postgres:5432/kan_db
-      NEXT_PUBLIC_ALLOW_CREDENTIALS: true
+      - NEXT_PUBLIC_BASE_URL=${NEXT_PUBLIC_BASE_URL}
+      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
+      - POSTGRES_URL=${POSTGRES_URL}
+      - NEXT_PUBLIC_ALLOW_CREDENTIALS=true
     depends_on:
-      - postgres
+      migrate:
+        condition: service_completed_successfully
     restart: unless-stopped
 
   postgres:
     image: postgres:15
     container_name: kan-db
     environment:
-      POSTGRES_DB: kan_db
-      POSTGRES_USER: kan
-      POSTGRES_PASSWORD: your_postgres_password
+      - POSTGRES_DB=kan_db
+      - POSTGRES_USER=kan
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
     ports:
       - 5432:5432
     volumes:
       - kan_postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U kan -d kan_db"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
     restart: unless-stopped
     networks:
       - kan-network
@@ -101,23 +123,23 @@ volumes:
   kan_postgres_data:
 ```
 
-2. Start the containers in detached mode:
+3. Start the containers in detached mode:
 
 ```bash
 docker compose up -d
 ```
 
-3. Access Kan at http://localhost:3000
+The `migrate` service will automatically run database migrations before the web service starts. The application will be available at http://localhost:3000 (or the port specified in `WEB_PORT`).
 
-The application will be running in the background. You can manage the containers using these commands:
+**Managing containers:**
 
 - To stop the containers: `docker compose down`
 - To view logs: `docker compose logs -f`
+- To view logs for a specific service: `docker compose logs -f web` or `docker compose logs -f migrate`
 - To restart the containers: `docker compose restart`
+- To rebuild after code changes: `docker compose up -d --build`
 
-For the complete Docker Compose configuration, see [docker-compose.yml](./docker-compose.yml) in the repository.
-
-> **Note**: The Docker Compose configuration shown above is a minimal example. For a complete setup with all features (email, OAuth, file uploads, etc.), you'll need to create a `.env` file with the required environment variables. See the Environment Variables section below for the full list of available options.
+For the complete Docker Compose configuration with all optional features, see [docker-compose.yml](./docker-compose.yml) in the repository.
 
 ## Local Development 🧑‍💻
 

apps/web/Dockerfile

@@ -1,25 +1,23 @@
-ARG NODE_VERSION=20
-ARG APP_DIRNAME=web
-ARG PROJECT=@kan/web
+# syntax=docker/dockerfile:1.7
 
-# 1. Alpine image
+ARG NODE_VERSION=20
+ARG DISTROLESS_NODE_IMAGE=gcr.io/distroless/nodejs${NODE_VERSION}-debian12
+
+# ============================================
+# Stage 1: Alpine base with pnpm and turbo
+# ============================================
 FROM node:${NODE_VERSION}-alpine AS alpine
 RUN apk update && \
-    apk add --no-cache --virtual .build-deps libc6-compat python3 make g++ && \
-    rm -rf /var/cache/apk/* /tmp/* || true
+    apk add --no-cache libc6-compat && \
+    rm -rf /var/cache/apk/* /tmp/* || true && \
+    corepack enable && \
+    npm install turbo@2.3.1 --global && \
+    pnpm config set store-dir ~/.pnpm-store
 
-# Setup pnpm and turbo on the alpine base
-FROM alpine AS base
-RUN corepack enable
-# Replace <your-major-version> with the major version installed in your repository. For example:
-# RUN npm install turbo@2.1.3 --global
-RUN npm install turbo@2.3.1 --global
-
-RUN pnpm config set store-dir ~/.pnpm-store
-
-# 2. Prune projects
-FROM base AS pruner
-ARG PROJECT
+# ============================================
+# Stage 2: Prune the monorepo
+# ============================================
+FROM alpine AS pruner
 
 RUN apk add --no-cache git
 
@@ -35,53 +33,89 @@ RUN git fetch --tags --unshallow 2>/dev/null || git fetch --tags 2>/dev/null ||
     echo "unknown") && \
     echo "$AUTO_VERSION" > /app/AUTO_VERSION
 
-RUN turbo prune --scope=${PROJECT} --scope=@kan/db --docker
- 
-# 3. Build the project
-FROM base AS builder
-ARG PROJECT
-ARG APP_VERSION
+RUN turbo prune --scope=@kan/web --scope=@kan/db --docker
 
+# ============================================
+# Stage 3: Install dependencies
+# ============================================
+FROM alpine AS deps
 WORKDIR /app
 
 COPY --from=pruner /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
 COPY --from=pruner /app/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
 COPY --from=pruner /app/out/json/ .
-COPY --from=pruner /app/AUTO_VERSION /tmp/AUTO_VERSION
 
 ENV CI=true
-
 RUN --mount=type=cache,id=pnpm,target=~/.pnpm-store pnpm install --frozen-lockfile
- 
-COPY --from=pruner /app/out/full/ .
 
-# Use provided APP_VERSION or auto-generated from pruner stage
-RUN VERSION="${APP_VERSION:-$(cat /tmp/AUTO_VERSION 2>/dev/null | tr -d '\n\r' || echo 'unknown')}" && \
-    NEXT_PUBLIC_APP_VERSION="$VERSION" pnpm build --filter=${PROJECT}
-
-# # Copy static files to standalone directory
-# RUN mkdir -p apps/web/.next/standalone/.next && \
-# mv apps/web/public apps/web/.next/standalone/ && \
-# mv apps/web/.next/static apps/web/.next/standalone/.next/
-
-# 4. Final image - runner stage to run the application
-FROM base AS runner
-ARG APP_DIRNAME
- 
-# Don't run production as root
-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 nextjs
-USER nextjs
+# ============================================
+# Stage 4: Build the web application
+# ============================================
+FROM alpine AS builder
+ARG APP_VERSION
 
 WORKDIR /app
 
+COPY --from=deps /app/ ./
+COPY --from=pruner /app/out/full/ .
+COPY --from=pruner /app/AUTO_VERSION /tmp/AUTO_VERSION
+
+# Force standalone output for production Docker image
+ENV NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true
+ENV CI=true
+
+RUN VERSION="${APP_VERSION:-$(cat /tmp/AUTO_VERSION 2>/dev/null | tr -d '\n\r' || echo 'unknown')}" && \
+    NEXT_PUBLIC_APP_VERSION="$VERSION" pnpm build --filter=@kan/web
+
+# ============================================
+# Stage 5: Migration image (run-once container)
+# ============================================
+FROM node:${NODE_VERSION}-alpine AS migrate
+WORKDIR /db
+
+COPY packages/db/drizzle.config.ts ./drizzle.config.ts
+COPY packages/db/migrations/ ./migrations/
+
+RUN npm init -y && \
+    npm install drizzle-kit drizzle-orm pg --save-exact && \
+    # Strip unnecessary files from node_modules
+    find node_modules -type f \( \
+      -name '*.d.ts' -o \
+      -name '*.d.mts' -o \
+      -name '*.d.cts' -o \
+      -name '*.map' -o \
+      -name '*.md' -o \
+      -name '*.txt' -o \
+      -name 'LICENSE*' -o \
+      -name 'CHANGELOG*' -o \
+      -name 'README*' -o \
+      -name '.eslint*' -o \
+      -name '.prettier*' -o \
+      -name 'tsconfig*.json' \
+    \) -delete && \
+    find node_modules -type d -empty -delete && \
+    rm -rf /root/.npm /tmp/*
+
+CMD ["npx", "drizzle-kit", "migrate"]
+
+# ============================================
+# Stage 6: Production web image (distroless)
+# ============================================
+FROM ${DISTROLESS_NODE_IMAGE} AS web
+WORKDIR /app
+
 ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
 
-COPY --chown=nextjs:nodejs --from=builder /app/ ./
-WORKDIR /app/apps/${APP_DIRNAME}
+# Copy the standalone Next.js server
+COPY --from=builder /app/apps/web/.next/standalone/ ./
+# Copy static assets and public files
+COPY --from=builder /app/apps/web/.next/static/ ./apps/web/.next/static/
+COPY --from=builder /app/apps/web/public/ ./apps/web/public/
 
-ARG PORT=3000
-ENV PORT=${PORT}
-EXPOSE ${PORT}
+# Copy bootstrap script for runtime env var injection
+COPY apps/web/bootstrap.cjs ./bootstrap.cjs
 
-CMD ["sh", "-c", "if [ -n \"$POSTGRES_URL\" ]; then cd /app && pnpm db:migrate && cd /app/apps/web; fi && pnpm start"]
+EXPOSE 3000
+CMD ["bootstrap.cjs"]

apps/web/bootstrap.cjs

@@ -0,0 +1,44 @@
+/**
+ * Bootstrap script for the distroless production image.
+ *
+ * Distroless images have no shell, so this Node.js script handles two tasks
+ * that would normally be done in an entrypoint.sh:
+ *
+ * 1. Regenerate `public/__ENV.js` with the current runtime NEXT_PUBLIC_*
+ *    environment variables.  The file was originally created at build time by
+ *    next-runtime-env's `configureRuntimeEnv()`, but in a Docker deployment the
+ *    env vars are provided at *run* time via docker-compose / docker run.
+ *
+ * 2. Start the Next.js standalone server.
+ */
+
+const { writeFileSync, existsSync, mkdirSync } = require("fs");
+const path = require("path");
+
+// ---------------------------------------------------------------------------
+// 1. Inject runtime NEXT_PUBLIC_* env vars into __ENV.js
+// ---------------------------------------------------------------------------
+
+const publicDir = path.join(__dirname, "apps", "web", "public");
+
+if (!existsSync(publicDir)) {
+  mkdirSync(publicDir, { recursive: true });
+}
+
+const envVars = {};
+for (const [key, value] of Object.entries(process.env)) {
+  if (key.startsWith("NEXT_PUBLIC_")) {
+    envVars[key] = value;
+  }
+}
+
+writeFileSync(
+  path.join(publicDir, "__ENV.js"),
+  `self.__ENV = ${JSON.stringify(envVars)};`,
+);
+
+// ---------------------------------------------------------------------------
+// 2. Start the Next.js standalone server
+// ---------------------------------------------------------------------------
+
+require("./apps/web/server.js");

apps/web/i18n.json

@@ -1,12 +1,12 @@
 {
-  "version": 0,
+  "version": "1.10",
   "locale": {
     "source": "en",
     "targets": ["fr", "de", "es", "it", "nl", "ru", "pl", "pt-BR"]
   },
   "buckets": {
-    "po": {
-      "include": ["src/locales/[locale]/messages.po"]
+    "json": {
+      "include": ["src/locales/[locale]/messages.json"]
     }
   },
   "$schema": "https://lingo.dev/schema/i18n.json"

apps/web/lingui.config.ts

@@ -1,7 +1,9 @@
-import type { LinguiConfig } from "@lingui/conf";
+import { defineConfig } from "@lingui/cli";
+import { formatter } from "@lingui/format-json";
 
-const config: LinguiConfig = {
-  locales: ["en", "fr", "de", "es", "it", "nl", "ru", "pl","pt-BR"],
+
+export default defineConfig({
+  locales: ["en", "fr", "de", "es", "it", "nl", "ru", "pl", "pt-BR"],
   sourceLocale: "en",
   catalogs: [
     {
@@ -10,6 +12,5 @@ const config: LinguiConfig = {
       exclude: ["**/node_modules/**"],
     },
   ],
-};
-
-export default config;
+  format: formatter({ style: "lingui" }),
+});

apps/web/next.config.js

@@ -16,6 +16,18 @@ const config = {
       : undefined,
   reactStrictMode: true,
 
+  /** Exclude build tools and dev-only packages from the standalone output */
+  outputFileTracingExcludes: {
+    "**/*": [
+      "@esbuild/**",
+      "esbuild/**",
+      "typescript/**",
+      "webpack/**",
+      "uglify-js/**",
+      "terser/**",
+    ],
+  },
+
   /** Enables hot reloading for local packages without a build step */
   transpilePackages: [
     "@kan/api",
@@ -35,49 +47,13 @@ const config = {
     remotePatterns: (() => {
       /** @type {Array<{protocol: "http" | "https", hostname: string}>} */
       const patterns = [
-        {
-          protocol: "https",
-          hostname:
-            env("S3_FORCE_PATH_STYLE") === "true"
-              ? `${env("NEXT_PUBLIC_STORAGE_DOMAIN")}`
-              : `*.${env("NEXT_PUBLIC_STORAGE_DOMAIN")}`,
-        },
+        { protocol: "https", hostname: "**" },
         {
           protocol: "http",
           hostname: "localhost",
         },
-        {
-          protocol: "https",
-          hostname: "*.googleusercontent.com",
-        },
-        {
-          protocol: 'https',
-          hostname: 'cdn.discordapp.com',
-        },
       ];
 
-      // Extract root domain from S3_ENDPOINT and add wildcard pattern
-      const s3Endpoint = env("S3_ENDPOINT");
-      if (s3Endpoint) {
-        try {
-          const url = new URL(s3Endpoint);
-          const hostname = url.hostname;
-          const protocol = url.protocol.replace(":", "");
-
-          // Extract root domain (last 2 parts: e.g. cloudflarestorage.com)
-          const parts = hostname.split(".");
-          if (parts.length >= 2) {
-            const rootDomain = parts.slice(-2).join(".");
-            patterns.push({
-              protocol: protocol === "http" ? "http" : "https",
-              hostname: `*.${rootDomain}`,
-            });
-          }
-        } catch {
-          // If S3_ENDPOINT is not a valid URL, ignore it
-        }
-      }
-
       return patterns;
     })(),
   },

apps/web/package.json

@@ -20,6 +20,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.802.0",
+    "@aws-sdk/lib-storage": "^3.802.0",
     "@aws-sdk/s3-request-presigner": "^3.812.0",
     "@headlessui/react": "^2.2.0",
     "@hookform/resolvers": "^3.3.4",
@@ -38,6 +39,7 @@
     "@tiptap/extension-link": "^2.22.2",
     "@tiptap/extension-mention": "^3.0.9",
     "@tiptap/extension-placeholder": "^2.14.0",
+    "@tiptap/extension-typography": "^3.18.0",
     "@tiptap/pm": "^2.14.0",
     "@tiptap/react": "^2.14.0",
     "@tiptap/starter-kit": "^2.14.0",
@@ -77,6 +79,7 @@
     "@kan/tailwind-config": "workspace:*",
     "@kan/tsconfig": "workspace:*",
     "@lingui/cli": "^5.3.2",
+    "@lingui/format-json": "^5.9.1",
     "@lingui/loader": "^5.3.2",
     "@lingui/swc-plugin": "^5.5.2",
     "@svgr/webpack": "^8.1.0",

apps/web/src/components/AuthForm.tsx

@@ -361,8 +361,8 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
           })}
         </div>
       )}
-      <form onSubmit={handleSubmit(onSubmit)}>
-        {!isCredentialsEnabled && socialProviders?.length === 0 && (
+      {!(isCredentialsEnabled || isMagicLinkAvailable) &&
+        socialProviders?.length === 0 && (
           <div className="flex w-full items-center gap-4">
             <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
             <span className="text-center text-sm text-light-900 dark:text-dark-900">
@@ -371,65 +371,62 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
             <div className="h-[1px] w-1/3 bg-light-600 dark:bg-dark-600" />
           </div>
         )}
-        {!isCredentialsEnabled && socialProviders?.length !== 0 && (
-          <div className="mb-[1.5rem] flex w-full items-center gap-4">
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
-            <span className="text-sm text-light-900 dark:text-dark-900">
-              {t`or`}
-            </span>
-            <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
-          </div>
-        )}
-        <div className="space-y-2">
-          {isSignUp && isCredentialsEnabled && (
-            <div>
-              <Input
-                {...register("name", { required: true })}
-                placeholder={t`Enter your name`}
-              />
-              {errors.name && (
-                <p className="mt-2 text-xs text-red-400">
-                  {t`Please enter a valid name`}
-                </p>
-              )}
+      {(isCredentialsEnabled || isMagicLinkAvailable) && (
+        <form onSubmit={handleSubmit(onSubmit)}>
+          {socialProviders?.length !== 0 && (
+            <div className="mb-[1.5rem] flex w-full items-center gap-4">
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
+              <span className="text-sm text-light-900 dark:text-dark-900">
+                {t`or`}
+              </span>
+              <div className="h-[1px] w-full bg-light-600 dark:bg-dark-600" />
             </div>
           )}
-          {(isCredentialsEnabled || isMagicLinkAvailable) && (
-            <>
+          <div className="space-y-2">
+            {isSignUp && isCredentialsEnabled && (
               <div>
                 <Input
-                  {...register("email", { required: true })}
-                  placeholder={t`Enter your email address`}
+                  {...register("name", { required: true })}
+                  placeholder={t`Enter your name`}
                 />
-                {errors.email && (
+                {errors.name && (
                   <p className="mt-2 text-xs text-red-400">
-                    {t`Please enter a valid email address`}
+                    {t`Please enter a valid name`}
                   </p>
                 )}
               </div>
-
-              {isCredentialsEnabled && (
-                <div>
-                  <Input
-                    type="password"
-                    {...register("password", { required: true })}
-                    placeholder={t`Enter your password`}
-                  />
-                  {errors.password && (
-                    <p className="mt-2 text-xs text-red-400">
-                      {errors.password.message ??
-                        t`Please enter a valid password`}
-                    </p>
-                  )}
-                </div>
+            )}
+            <div>
+              <Input
+                {...register("email", { required: true })}
+                placeholder={t`Enter your email address`}
+              />
+              {errors.email && (
+                <p className="mt-2 text-xs text-red-400">
+                  {t`Please enter a valid email address`}
+                </p>
               )}
-            </>
-          )}
-          {loginError && (
-            <p className="mt-2 text-xs text-red-400">{loginError}</p>
-          )}
-        </div>
-        {(isCredentialsEnabled || isMagicLinkAvailable) && (
+            </div>
+
+            {isCredentialsEnabled && (
+              <div>
+                <Input
+                  type="password"
+                  {...register("password", { required: true })}
+                  placeholder={t`Enter your password`}
+                />
+                {errors.password && (
+                  <p className="mt-2 text-xs text-red-400">
+                    {errors.password.message ??
+                      t`Please enter a valid password`}
+                  </p>
+                )}
+              </div>
+            )}
+            {loginError && (
+              <p className="mt-2 text-xs text-red-400">{loginError}</p>
+            )}
+          </div>
           <div className="mt-[1.5rem] flex items-center gap-4">
             <Button
               isLoading={isLoginWithEmailPending}
@@ -441,8 +438,11 @@ export function Auth({ setIsMagicLinkSent, isSignUp }: AuthProps) {
               {isMagicLinkMode ? t`magic link` : t`email`}
             </Button>
           </div>
-        )}
-      </form>
+        </form>
+      )}
+      {!(isCredentialsEnabled || isMagicLinkAvailable) && loginError && (
+        <p className="mt-2 text-xs text-red-400">{loginError}</p>
+      )}
     </div>
   );
 }

apps/web/src/components/Editor.tsx

@@ -17,6 +17,7 @@ import {
   ReactRenderer,
   useEditor,
 } from "@tiptap/react";
+import Typography from "@tiptap/extension-typography";
 import StarterKit from "@tiptap/starter-kit";
 import Suggestion from "@tiptap/suggestion";
 import {
@@ -386,46 +387,54 @@ export interface SlashNodeAttrs {
   label?: string | null;
 }
 
-const CommandItems: SlashCommandItem[] = [
-  {
-    title: "Heading 1",
-    icon: <HiH1 />,
-    command: ({ editor }) =>
-      editor.chain().focus().setHeading({ level: 1 }).run(),
-  },
-  {
-    title: "Heading 2",
-    icon: <HiH2 />,
-    command: ({ editor }) =>
-      editor.chain().focus().setHeading({ level: 2 }).run(),
-  },
-  {
-    title: "Heading 3",
-    icon: <HiH3 />,
-    command: ({ editor }) =>
-      editor.chain().focus().setHeading({ level: 3 }).run(),
-  },
-  {
-    title: "Bullet List",
-    icon: <HiOutlineListBullet />,
-    command: ({ editor }) => editor.chain().focus().toggleBulletList().run(),
-  },
-  {
-    title: "Ordered List",
-    icon: <HiOutlineNumberedList />,
-    command: ({ editor }) => editor.chain().focus().toggleOrderedList().run(),
-  },
-  {
-    title: "Blockquote",
-    icon: <HiOutlineChatBubbleLeftEllipsis />,
-    command: ({ editor }) => editor.chain().focus().toggleBlockquote().run(),
-  },
-  {
-    title: "Code Block",
-    icon: <HiOutlineCodeBracketSquare />,
-    command: ({ editor }) => editor.chain().focus().toggleCodeBlock().run(),
-  },
-];
+const getCommandItems = (disableHeadings: boolean): SlashCommandItem[] => {
+  const headingCommands: SlashCommandItem[] = disableHeadings
+    ? []
+    : [
+        {
+          title: "Heading 1",
+          icon: <HiH1 />,
+          command: ({ editor }) =>
+            editor.chain().focus().setHeading({ level: 1 }).run(),
+        },
+        {
+          title: "Heading 2",
+          icon: <HiH2 />,
+          command: ({ editor }) =>
+            editor.chain().focus().setHeading({ level: 2 }).run(),
+        },
+        {
+          title: "Heading 3",
+          icon: <HiH3 />,
+          command: ({ editor }) =>
+            editor.chain().focus().setHeading({ level: 3 }).run(),
+        },
+      ];
+
+  return [
+    ...headingCommands,
+    {
+      title: "Bullet List",
+      icon: <HiOutlineListBullet />,
+      command: ({ editor }) => editor.chain().focus().toggleBulletList().run(),
+    },
+    {
+      title: "Ordered List",
+      icon: <HiOutlineNumberedList />,
+      command: ({ editor }) => editor.chain().focus().toggleOrderedList().run(),
+    },
+    {
+      title: "Blockquote",
+      icon: <HiOutlineChatBubbleLeftEllipsis />,
+      command: ({ editor }) => editor.chain().focus().toggleBlockquote().run(),
+    },
+    {
+      title: "Code Block",
+      icon: <HiOutlineCodeBracketSquare />,
+      command: ({ editor }) => editor.chain().focus().toggleCodeBlock().run(),
+    },
+  ];
+};
 
 export default function Editor({
   content,
@@ -434,6 +443,8 @@ export default function Editor({
   readOnly = false,
   workspaceMembers,
   enableYouTubeEmbed = true,
+  placeholder,
+  disableHeadings = false,
 }: {
   content: string | null;
   onChange?: (value: string) => void;
@@ -441,18 +452,16 @@ export default function Editor({
   readOnly?: boolean;
   workspaceMembers: WorkspaceMember[];
   enableYouTubeEmbed?: boolean;
+  placeholder?: string;
+  disableHeadings?: boolean;
 }) {
   const containerRef = useRef<HTMLDivElement>(null);
 
   const editor = useEditor(
     {
       extensions: [
-        StarterKit,
-        Markdown,
-        Placeholder.configure({
-          placeholder: readOnly
-            ? ""
-            : t`Add description... (type '/' to open commands or '@' to mention)`,
+        StarterKit.configure({
+          heading: disableHeadings ? false : undefined,
         }),
         Link.configure({
           openOnClick: true,
@@ -463,12 +472,20 @@ export default function Editor({
           },
           validate: (href) => /^https?:\/\//.test(href),
           autolink: true,
+          linkOnPaste: true,
+        }),
+        Markdown,
+        Placeholder.configure({
+          placeholder: readOnly
+            ? ""
+            : placeholder ??
+              t`Add description... (type '/' to open commands or '@' to mention)`,
         }),
         SlashCommands.configure({
-          commandItems: CommandItems,
+          commandItems: getCommandItems(disableHeadings),
           suggestion: {
             items: ({ query }: { query: string }) =>
-              filterSlashCommandItems(CommandItems, query),
+              filterSlashCommandItems(getCommandItems(disableHeadings), query),
             startOfLine: true,
             char: "/",
           },
@@ -480,20 +497,28 @@ export default function Editor({
           suggestion: {
             char: "@",
             items: ({ query }: { query: string }) => {
-              const all: MentionItem[] = workspaceMembers.map(
-                (member: WorkspaceMember) => ({
-                  id: member.publicId,
-                  label: member?.user?.name ?? member.email,
-                  image: member?.user?.image ?? null,
-                }),
+              const withEmail = workspaceMembers.filter((member) => member.email);
+              
+              const mapped = withEmail.map((member: WorkspaceMember) => ({
+                id: member.publicId,
+                label: member?.user?.name?.trim() || member.email || "",
+                image: member?.user?.image ?? null,
+              }));
+              
+              const all: MentionItem[] = mapped.filter(
+                (item) => item.label && item.label.length > 0,
               );
-              const q = query.toLowerCase();
-              return all.filter(
-                (u) =>
-                  u.label &&
-                  typeof u.label === "string" &&
-                  u.label.toLowerCase().includes(q),
+              
+              const q = query.toLowerCase().trim();
+              
+              if (q === "") {
+                return all;
+              }
+              
+              const filtered = all.filter((u) =>
+                u.label.toLowerCase().includes(q),
               );
+              return filtered;
             },
             command: ({ editor, range, props }) => {
               const id = props.id ?? "";
@@ -514,6 +539,17 @@ export default function Editor({
             return `${options.suggestion.char}${node.attrs.label ?? node.attrs.id}`;
           },
         }),
+        Typography.configure({
+            openDoubleQuote: false,
+            closeDoubleQuote: false,
+            openSingleQuote: false,
+            closeSingleQuote: false,
+            oneHalf: false,
+            oneQuarter: false,
+            threeQuarters: false,
+            superscriptTwo: false,
+            superscriptThree: false,
+        }),
         ...(enableYouTubeEmbed ? [YouTubeNode] : []),
       ],
       content,

apps/web/src/components/NewWorkspaceForm.tsx

@@ -33,7 +33,7 @@ const schema = z.object({
     .min(3, {
       message: t`URL must be at least 3 characters long`,
     })
-    .max(24, { message: t`URL cannot exceed 24 characters` })
+    .max(64, { message: t`URL cannot exceed 64 characters` })
     .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/, {
       message: t`URL can only contain letters, numbers, and hyphens`,
     })

apps/web/src/hooks/usePermissions.ts

@@ -19,6 +19,7 @@ interface UsePermissionsResult {
   canCreateBoard: boolean;
   canEditBoard: boolean;
   canDeleteBoard: boolean;
+  canArchiveBoard: boolean;
   canViewComment: boolean;
   canCreateComment: boolean;
   canEditComment: boolean;
@@ -33,7 +34,7 @@ interface UsePermissionsResult {
 export function usePermissions(): UsePermissionsResult {
   // Check if WorkspaceProvider is available (for public board views, it may not be)
   const workspaceContext = useContext(WorkspaceContext);
-  
+
   // If WorkspaceProvider is not available, return safe defaults
   if (!workspaceContext) {
     const emptyPermissions: UsePermissionsResult = {
@@ -51,6 +52,7 @@ export function usePermissions(): UsePermissionsResult {
       canCreateBoard: false,
       canEditBoard: false,
       canDeleteBoard: false,
+      canArchiveBoard: false,
       canViewComment: false,
       canCreateComment: false,
       canEditComment: false,
@@ -95,6 +97,7 @@ export function usePermissions(): UsePermissionsResult {
     canCreateBoard: hasPermission("board:create"),
     canEditBoard: hasPermission("board:edit"),
     canDeleteBoard: hasPermission("board:delete"),
+    canArchiveBoard: hasPermission("board:edit"),
     canViewComment: hasPermission("comment:view"),
     canCreateComment: hasPermission("comment:create"),
     canEditComment: hasPermission("comment:edit"),

apps/web/src/locales/index.ts

@@ -7,7 +7,7 @@ export const locales = [
   "nl",
   "ru",
   "pl",
-  "pt-BR"
+  "ptbr"
 ] as const;
 
 export type Locale = (typeof locales)[number];
@@ -23,5 +23,5 @@ export const localeNames: Record<Locale, string> = {
   nl: "Nederlands",
   ru: "Русский",
   pl: "Polski",
-  "pt-BR": "Português",
+  ptbr: "Português",
 };

apps/web/src/pages/api/auth/[...all].ts

@@ -13,6 +13,23 @@ const authHandler = toNodeHandler(auth.handler);
 export default withRateLimit(
   { points: 100, duration: 60 },
   async (req, res) => {
+    /**
+     * Better-auth behind proxies (Nginx/Cloudflare) can sometimes fail to parse the protocol
+     * if headers are incorrectly set or if there are multiple values in X-Forwarded-Proto.
+     * We sanitize these headers here to ensure better-auth gets a clean protocol and host.
+     */
+    const forwardedProto = req.headers["x-forwarded-proto"];
+    if (forwardedProto) {
+      const p = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
+      req.headers["x-forwarded-proto"] = p?.split(",")[0]?.trim();
+    }
+
+    const forwardedHost = req.headers["x-forwarded-host"];
+    if (forwardedHost) {
+      const h = Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost;
+      req.headers["host"] = h?.split(",")[0]?.trim();
+    }
+
     return await authHandler(req, res);
   },
 );

apps/web/src/pages/api/download/attatchment.ts

@@ -2,48 +2,74 @@ import type { NextApiRequest, NextApiResponse } from "next";
 
 import { withRateLimit } from "@kan/api/utils/rateLimit";
 
+import { env } from "~/env";
+
 export default withRateLimit(
   { points: 100, duration: 60 },
   async (req: NextApiRequest, res: NextApiResponse) => {
-  if (req.method !== "GET") {
-    return res.status(405).json({ message: "Method not allowed" });
-  }
-
-  const { url, filename } = req.query;
-
-  if (!url || typeof url !== "string") {
-    return res.status(400).json({
-      message: "url parameter is required",
-    });
-  }
-
-  try {
-    const downloadFilename = typeof filename === "string"
-      ? encodeURIComponent(filename)
-      : "attachment";
-
-    const upstream = await fetch(url);
-
-    if (!upstream.ok) {
-      return res.status(upstream.status).json({
-        message: "Failed to fetch attachment",
-      });
+    if (req.method !== "GET") {
+      return res.status(405).json({ message: "Method not allowed" });
     }
 
-    const contentType =
-      upstream.headers.get("Content-Type") ?? "application/octet-stream";
+    const { url, filename } = req.query;
 
-    res.setHeader("Content-Type", contentType);
-    res.setHeader(
-      "Content-Disposition",
-      `attachment; filename="${downloadFilename}"; filename*=UTF-8''${downloadFilename}`,
-    );
+    if (!url || typeof url !== "string") {
+      return res.status(400).json({ message: "url parameter is required" });
+    }
 
-    const buffer = await upstream.arrayBuffer();
-    return res.send(Buffer.from(buffer));
-  } catch (error) {
-    console.error("Error downloading attachment:", error);
-    return res.status(500).json({ message: "Failed to download attachment" });
-  }
+    const s3Endpoint = env.S3_ENDPOINT;
+
+    if (s3Endpoint) {
+      let parsed: URL;
+      try {
+        parsed = new URL(url);
+      } catch {
+        return res.status(400).json({ message: "Invalid URL" });
+      }
+
+      const hostname = parsed.hostname.toLowerCase();
+      let allowedHost: string;
+      try {
+        allowedHost = new URL(s3Endpoint).hostname.toLowerCase();
+      } catch {
+        return res.status(500).json({ message: "Storage endpoint misconfigured" });
+      }
+
+      if (hostname !== allowedHost && !hostname.endsWith(`.${allowedHost}`)) {
+        return res.status(403).json({ message: "URL not allowed" });
+      }
+    }
+
+    try {
+      const downloadFilename =
+        typeof filename === "string"
+          ? encodeURIComponent(filename)
+          : "attachment";
+
+      const upstream = await fetch(url);
+
+      if (!upstream.ok) {
+        return res
+          .status(upstream.status)
+          .json({ message: "Failed to fetch attachment" });
+      }
+
+      const contentType =
+        upstream.headers.get("Content-Type") ?? "application/octet-stream";
+
+      res.setHeader("Content-Type", contentType);
+      res.setHeader(
+        "Content-Disposition",
+        `attachment; filename="${downloadFilename}"; filename*=UTF-8''${downloadFilename}`,
+      );
+
+      const buffer = await upstream.arrayBuffer();
+      return res.send(Buffer.from(buffer));
+    } catch (error) {
+      console.error("Error downloading attachment:", error);
+      return res
+        .status(500)
+        .json({ message: "Failed to download attachment" });
+    }
   },
 );

apps/web/src/pages/api/stripe/create_checkout_session.ts

@@ -11,7 +11,7 @@ import { withRateLimit } from "@kan/api/utils/rateLimit";
 const workspaceSlugSchema = z
   .string()
   .min(3)
-  .max(24)
+  .max(64)
   .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/);
 
 interface CheckoutSessionRequest {

apps/web/src/pages/api/upload/attachment.ts

@@ -1,17 +1,17 @@
 import type { NextApiRequest, NextApiResponse } from "next";
-import { PutObjectCommand } from "@aws-sdk/client-s3";
+import { Upload } from "@aws-sdk/lib-storage";
 
 import { createNextApiContext } from "@kan/api/trpc";
+import { assertPermission } from "@kan/api/utils/permissions";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 import * as cardRepo from "@kan/db/repository/card.repo";
 import * as cardActivityRepo from "@kan/db/repository/cardActivity.repo";
 import * as cardAttachmentRepo from "@kan/db/repository/cardAttachment.repo";
-import { generateUID } from "@kan/shared/utils";
+import { createS3Client, generateUID } from "@kan/shared/utils";
 
 import { env } from "~/env";
-import { withRateLimit } from "@kan/api/utils/rateLimit";
-import { createS3Client } from "@kan/shared/utils";
-import { assertPermission } from "@kan/api/utils/permissions";
 
+// FIXME: Respect the environment variable: NEXT_API_BODY_SIZE_LIMIT
 const MAX_SIZE_BYTES = 50 * 1024 * 1024; // 50MB
 
 export const config = {
@@ -90,16 +90,19 @@ export default withRateLimit(
 
       const client = createS3Client();
 
-      // Upload the file to S3
-      await client.send(
-        new PutObjectCommand({
+      const upload = new Upload({
+        client,
+        params: {
           Bucket: bucket,
           Key: s3Key,
           Body: req,
           ContentType: contentType,
           ContentLength: contentLength,
-        }),
-      );
+        },
+        leavePartsOnError: false,
+      });
+
+      await upload.done();
 
       // Create attachment record and log activity
       const attachment = await cardAttachmentRepo.create(db, {
@@ -112,9 +115,15 @@ export default withRateLimit(
         createdBy: user.id,
       });
 
+      if (!attachment) {
+        return res.status(500).json({ error: "Failed to create attachment" });
+      }
+
       await cardActivityRepo.create(db, {
         type: "card.updated.attachment.added",
         cardId: card.id,
+        attachmentId: attachment.id,
+        toTitle: originalFilenameHeader,
         createdBy: user.id,
       });
 
@@ -125,4 +134,3 @@ export default withRateLimit(
     }
   },
 );
-

apps/web/src/views/auth/login/index.tsx

@@ -58,7 +58,7 @@ export default function LoginPage() {
                 </div>
               </div>
             )}
-            {!isSignUpDisabled && (
+            {(!isSignUpDisabled || redirect?.startsWith("/invite/")) && (
               <p className="mt-4 text-sm text-light-1000 dark:text-dark-1000">
                 <Trans>
                   Don't have an account?{" "}

apps/web/src/views/auth/signup/index.tsx

@@ -28,7 +28,9 @@ export default function SignUpPage() {
     setMagicLinkRecipient(recipient);
   };
 
-  if (isSignUpDisabled) {
+  const isInviteFlow = redirect?.startsWith("/invite/");
+
+  if (isSignUpDisabled && !isInviteFlow) {
     return (
       <>
         <PageHead title={t`Sign up | kan.bn`} />

apps/web/src/views/board/components/BoardDropdown.tsx

@@ -7,7 +7,7 @@ import {
   HiOutlineStar,
   HiStar,
 } from "react-icons/hi2";
-
+import { IoArchiveOutline } from "react-icons/io5";
 import Dropdown from "~/components/Dropdown";
 import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
@@ -17,6 +17,7 @@ import { api } from "~/utils/api";
 export default function BoardDropdown({
   isTemplate,
   isLoading,
+  isArchived,
   boardPublicId,
   isFavorite,
   boardName,
@@ -24,28 +25,29 @@ export default function BoardDropdown({
   isTemplate: boolean;
   isLoading: boolean;
   boardPublicId: string;
+  isArchived?: boolean;
   isFavorite?: boolean;
   boardName?: string;
 }) {
   const { openModal } = useModal();
-  const { canEditBoard, canDeleteBoard, canCreateBoard } = usePermissions();
   const { showPopup } = usePopup();
+  const { canEditBoard, canDeleteBoard, canCreateBoard, canArchiveBoard } =
+    usePermissions();
   const utils = api.useUtils();
 
-  const handleToggleFavorite = () => {
-    updateBoard.mutate({
-      boardPublicId,
-      favorite: !isFavorite,
-    });
-  };
-
   const updateBoard = api.board.update.useMutation({
-    onSuccess: (data, variables) => {
+    onSuccess: (_data, variables) => {
       void utils.board.all.invalidate();
       void utils.board.byId.invalidate();
-
-      // Show popup notification
-      if (variables.favorite !== undefined) {
+      if (variables.isArchived !== undefined) {
+        showPopup({
+          header: variables.isArchived ? t`Board archived` : t`Board unarchived`,
+          message: variables.isArchived
+            ? t`The board has been archived.`
+            : t`The board has been unarchived.`,
+          icon: "success",
+        });
+      } else if (variables.favorite !== undefined) {
         showPopup({
           header: variables.favorite
             ? t`Added to favorites`
@@ -65,27 +67,54 @@ export default function BoardDropdown({
       });
     },
   });
-  
+
+  const handleToggleFavorite = () => {
+    updateBoard.mutate({
+      boardPublicId,
+      favorite: !isFavorite,
+    });
+  };
+
+  const handleArchiveOrUnarchive = () => {
+    updateBoard.mutate({
+      boardPublicId,
+      isArchived: !isArchived,
+    });
+  };
+
+  const isArchiveActionPending = updateBoard.isPending;
+
   const items = [
     ...(isTemplate && canCreateBoard
       ? [
-          {
-            label: t`Make template`,
-            action: () => openModal("CREATE_TEMPLATE"),
-            icon: (
-              <HiOutlineDocumentDuplicate className="h-[16px] w-[16px] text-dark-900" />
-            ),
-          },
-        ]
+        {
+          label: t`Make template`,
+          action: () => openModal("CREATE_TEMPLATE"),
+          icon: (
+            <HiOutlineDocumentDuplicate className="h-[16px] w-[16px] text-dark-900" />
+          ),
+        },
+      ]
       : []),
     ...(!isTemplate && canEditBoard
       ? [
-          {
-            label: t`Edit board URL`,
-            action: () => openModal("UPDATE_BOARD_SLUG"),
-            icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
-          },
-        ]
+        {
+          label: t`Edit board URL`,
+          action: () => openModal("UPDATE_BOARD_SLUG"),
+          icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
+        },
+      ]
+      : []),
+    ...(!isTemplate && canArchiveBoard
+      ? [
+        {
+          label: isArchived ? t`Unarchive board` : t`Archive board`,
+          action: handleArchiveOrUnarchive,
+          icon: (
+            <IoArchiveOutline className="h-[16px] w-[16px] text-dark-900" />
+          ),
+        },
+      ]
       : []),
     {
       label: isFavorite
@@ -100,22 +129,26 @@ export default function BoardDropdown({
     },
     ...(canDeleteBoard
       ? [
-          {
-            label: isTemplate ? t`Delete template` : t`Delete board`,
-            action: () => openModal("DELETE_BOARD"),
-            icon: <HiOutlineTrash className="h-[16px] w-[16px] text-dark-900" />,
-          },
-        ]
+        {
+          label: isTemplate ? t`Delete template` : t`Delete board`,
+          action: () => openModal("DELETE_BOARD"),
+          icon: (
+            <HiOutlineTrash className="h-[16px] w-[16px] text-dark-900" />
+          ),
+        },
+      ]
       : []),
   ];
-  
 
   if (items.length === 0) {
     return null;
   }
 
   return (
-    <Dropdown disabled={isLoading} items={items}>
+    <Dropdown
+      disabled={isLoading || isArchiveActionPending}
+      items={items}
+    >
       <HiEllipsisHorizontal className="h-5 w-5 text-dark-900" />
     </Dropdown>
   );

apps/web/src/views/board/components/Card.tsx

@@ -66,8 +66,8 @@ const Card = ({
   const hasDueDate = !!dueDate;
 
   return (
-    <div className="flex flex-col rounded-md border border-light-200 bg-light-50 px-3 py-2 text-sm text-neutral-900 dark:border-dark-200 dark:bg-dark-200 dark:text-dark-1000 dark:hover:bg-dark-300">
-      <span>{title}</span>
+    <div className="flex flex-col overflow-hidden rounded-md border border-light-200 bg-light-50 px-3 py-2 text-sm text-neutral-900 dark:border-dark-200 dark:bg-dark-200 dark:text-dark-1000 dark:hover:bg-dark-300">
+      <span className="break-words">{title}</span>
       {labels.length ||
       members.length ||
       checklists.length > 0 ||

apps/web/src/views/board/components/UpdateBoardSlugButton.tsx

@@ -1,24 +1,40 @@
-import Link from "next/link";
+import { Fragment } from "react";
 import { t } from "@lingui/core/macro";
 import { env } from "next-runtime-env";
 import { HiLink } from "react-icons/hi";
 
 import { Tooltip } from "~/components/Tooltip";
+import { usePopup } from "~/providers/popup";
+
+const displayBaseUrl =
+  env("NEXT_PUBLIC_KAN_ENV") === "cloud"
+    ? "kan.bn"
+    : env("NEXT_PUBLIC_BASE_URL");
+
+const linkBaseUrl = env("NEXT_PUBLIC_BASE_URL");
+
+const pathSeparator = (
+  <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600" />
+);
 
 const UpdateBoardSlugButton = ({
   handleOnClick,
   workspaceSlug,
   boardSlug,
+  boardPublicId,
+  visibility,
   isLoading,
   canEdit,
 }: {
   handleOnClick: () => void;
   workspaceSlug: string;
   boardSlug: string;
+  boardPublicId: string;
+  visibility: "public" | "private";
   isLoading: boolean;
   canEdit: boolean;
 }) => {
-  if (!isLoading && (!workspaceSlug || !boardSlug)) return <></>;
+  const { showPopup } = usePopup();
 
   if (isLoading) {
     return (
@@ -26,44 +42,55 @@ const UpdateBoardSlugButton = ({
     );
   }
 
+  if (!workspaceSlug || !boardSlug || !boardPublicId) return <></>;
+
+  const isPublic = visibility === "public";
+  const boardUrl = isPublic
+    ? `${linkBaseUrl}/${workspaceSlug}/${boardSlug}`
+    : `${linkBaseUrl}/boards/${boardPublicId}`;
+
+  const pathSegments = isPublic
+    ? [displayBaseUrl, workspaceSlug, boardSlug]
+    : [displayBaseUrl, "boards", boardPublicId];
+
   return (
     <Tooltip
-      content={!canEdit && !isLoading ? t`You don't have permission` : undefined}
+      content={!canEdit ? t`You don't have permission` : undefined}
     >
       <button
         onClick={canEdit ? handleOnClick : undefined}
         disabled={!canEdit || isLoading}
         className="hidden cursor-pointer items-center gap-2 rounded-full border-[1px] bg-light-50 p-1 pl-4 pr-1 text-sm text-light-950 hover:bg-light-100 disabled:cursor-not-allowed disabled:opacity-60 dark:border-dark-600 dark:bg-dark-50 dark:text-dark-900 dark:hover:bg-dark-100 xl:flex"
       >
-      <div className="flex items-center">
-        <span>
-          {env("NEXT_PUBLIC_KAN_ENV") === "cloud"
-            ? "kan.bn"
-            : env("NEXT_PUBLIC_BASE_URL")}
-        </span>
-        <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600"></div>
-        <span>{workspaceSlug}</span>
-        <div className="mx-1.5 h-4 w-px rotate-[20deg] bg-gray-300 dark:bg-dark-600"></div>
-        <span>{boardSlug}</span>
-      </div>
-      <Link
-        href={`${env("NEXT_PUBLIC_BASE_URL")}/${workspaceSlug}/${boardSlug}`}
-        target="_blank"
-        rel="noopener noreferrer"
-        onClick={(e) => {
-          e.stopPropagation();
-          if (!canEdit) {
-            e.preventDefault();
-          }
-        }}
-        className="flex h-7 w-7 items-center justify-center rounded-full hover:bg-light-200 dark:hover:bg-dark-200"
-      >
-        <HiLink className="h-[13px] w-[13px]" />
-      </Link>
-    </button>
+        <div className="flex items-center">
+          {pathSegments.map((segment, i) => (
+            <Fragment key={i}>
+              {i > 0 && pathSeparator}
+              <span>{segment}</span>
+            </Fragment>
+          ))}
+        </div>
+        <button
+          type="button"
+          onClick={(e) => {
+            e.stopPropagation();
+            navigator.clipboard.writeText(boardUrl).then(
+              () =>
+                showPopup({
+                  header: t`Link copied`,
+                  icon: "success",
+                  message: t`Board URL copied to clipboard`,
+                }),
+            ).catch(() => undefined);
+          }}
+          className="flex h-7 w-7 items-center justify-center rounded-full hover:bg-light-200 dark:hover:bg-dark-200"
+          aria-label={t`Copy board link`}
+        >
+          <HiLink className="h-[13px] w-[13px]" />
+        </button>
+      </button>
     </Tooltip>
   );
 };
 
-
 export default UpdateBoardSlugButton;

apps/web/src/views/board/components/UpdateBoardSlugForm.tsx

@@ -156,7 +156,7 @@ export function UpdateBoardSlugForm({
         <div className="flex items-center gap-2">
           <Button
             variant="secondary"
-            href="/settings?tab=workspace"
+            href="/settings/workspace"
             onClick={closeModal}
           >
             {t`Edit workspace URL`}

apps/web/src/views/board/index.tsx

@@ -58,13 +58,14 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
   const [selectedPublicListId, setSelectedPublicListId] =
     useState<PublicListId>("");
   const [isInitialLoading, setIsInitialLoading] = useState(true);
-  
+
   const { ref: scrollRef, onMouseDown } = useDragToScroll({
     enabled: true,
     direction: "horizontal",
   });
 
-  const { canCreateList, canEditList, canEditCard, canEditBoard } = usePermissions();
+  const { canCreateList, canEditList, canEditCard, canEditBoard } =
+    usePermissions();
 
   const { tooltipContent: createListShortcutTooltipContent } =
     useKeyboardShortcut({
@@ -417,10 +418,9 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                 {...register("name")}
                 onBlur={canEditBoard ? handleSubmit(onSubmit) : undefined}
                 readOnly={!canEditBoard}
-                className="block border-0 bg-transparent p-0 py-0 font-bold leading-[2.3rem] tracking-tight text-neutral-900 focus:ring-0 focus-visible:outline-none dark:text-dark-1000 sm:text-[1.2rem] disabled:cursor-not-allowed"
+                className="block border-0 bg-transparent p-0 py-0 font-bold leading-[2.3rem] tracking-tight text-neutral-900 focus:ring-0 focus-visible:outline-none disabled:cursor-not-allowed dark:text-dark-1000 sm:text-[1.2rem]"
               />
             </form>
-
           )}
           {!boardData && !isLoading && (
             <p className="order-2 block p-0 py-0 font-bold leading-[2.3rem] tracking-tight text-neutral-900 dark:text-dark-1000 sm:text-[1.2rem] md:order-1">
@@ -443,6 +443,8 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
                   isLoading={isLoading}
                   workspaceSlug={workspace.slug ?? ""}
                   boardSlug={boardData?.slug ?? ""}
+                  boardPublicId={boardId ?? ""}
+                  visibility={boardData?.visibility ?? "private"}
                   canEdit={canEditBoard}
                 />
                 <VisibilityButton
@@ -492,7 +494,7 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
               isTemplate={!!isTemplate}
               isLoading={!boardData}
               boardPublicId={boardId ?? ""}
-              workspacePublicId={workspace.publicId}
+              isArchived={boardData?.isArchived ?? false}
               isFavorite={boardData?.favorite}
               boardName={boardData?.name}
             />

apps/web/src/views/boards/components/BoardsList.tsx

@@ -10,7 +10,7 @@ import { useModal } from "~/providers/modal";
 import { useWorkspace } from "~/providers/workspace";
 import { api } from "~/utils/api";
 
-export function BoardsList({ isTemplate }: { isTemplate?: boolean }) {
+export function BoardsList({ isTemplate, archived = false }: { isTemplate?: boolean; archived?: boolean }) {
   const { workspace } = useWorkspace();
   const { openModal } = useModal();
   const { canCreateBoard } = usePermissions();
@@ -26,6 +26,7 @@ export function BoardsList({ isTemplate }: { isTemplate?: boolean }) {
     {
       workspacePublicId: workspace.publicId,
       type: isTemplate ? "template" : "regular",
+      archived: archived,
     },
     { enabled: workspace.publicId ? true : false },
   );
@@ -59,10 +60,10 @@ export function BoardsList({ isTemplate }: { isTemplate?: boolean }) {
         <div className="flex flex-col items-center">
           <HiOutlineRectangleStack className="h-10 w-10 text-light-800 dark:text-dark-800" />
           <p className="mb-2 mt-4 text-[14px] font-bold text-light-1000 dark:text-dark-950">
-            {t`No ${isTemplate ? "templates" : "boards"}`}
+            {archived ? t`No archived boards` : t`No ${isTemplate ? "templates" : "boards"}`}
           </p>
           <p className="text-[14px] text-light-900 dark:text-dark-900">
-            {t`Get started by creating a new ${isTemplate ? "template" : "board"}`}
+            {archived ? t`Boards you archive will appear here.` : t`Get started by creating a new ${isTemplate ? "template" : "board"}`}
           </p>
         </div>
         <Tooltip
@@ -109,18 +110,18 @@ export function BoardsList({ isTemplate }: { isTemplate?: boolean }) {
           >
             <div className="group relative mr-5 flex h-[150px] w-full items-center justify-center rounded-md border border-dashed border-light-400 bg-light-50 shadow-sm hover:bg-light-200 dark:border-dark-600 dark:bg-dark-50 dark:hover:bg-dark-100">
               <PatternedBackground />
-                <button
-                  onClick={(e) => handleToggleFavorite(e, board.publicId, board.favorite)}
-                  className={`absolute right-3 top-3 z-10 rounded p-1 transition-all hover:bg-light-300 dark:hover:bg-dark-200 ${board.favorite ? "" : "md:opacity-0 md:group-hover:opacity-100"
-                    }`}
-                  aria-label={board.favorite ? "Remove from favorites" : "Add to favorites"}
-                >
-                  {board.favorite ? (
-                    <HiStar className="h-5 w-5 text-neutral-700 dark:text-dark-1000" />
-                  ) : (
-                    <HiOutlineStar className="h-5 w-5 text-neutral-700 dark:text-dark-800" />
-                  )}
-                </button>
+              <button
+                onClick={(e) => handleToggleFavorite(e, board.publicId, board.favorite)}
+                className={`absolute right-3 top-3 z-10 rounded p-1 transition-all hover:bg-light-300 dark:hover:bg-dark-200 ${board.favorite ? "" : "md:opacity-0 md:group-hover:opacity-100"
+                  }`}
+                aria-label={board.favorite ? "Remove from favorites" : "Add to favorites"}
+              >
+                {board.favorite ? (
+                  <HiStar className="h-5 w-5 text-neutral-700 dark:text-dark-1000" />
+                ) : (
+                  <HiOutlineStar className="h-5 w-5 text-neutral-700 dark:text-dark-800" />
+                )}
+              </button>
               <p className="px-4 text-[14px] font-bold text-neutral-700 dark:text-dark-1000">
                 {board.name}
               </p>

apps/web/src/views/boards/components/ImportBoardsForm.tsx

@@ -4,7 +4,7 @@ import { t } from "@lingui/core/macro";
 import { Plural, Trans } from "@lingui/react/macro";
 import { Fragment, useEffect, useState } from "react";
 import { Controller, useForm } from "react-hook-form";
-import { FaTrello } from "react-icons/fa";
+import { FaGithub, FaTrello } from "react-icons/fa";
 import {
   HiChevronUpDown,
   HiMiniArrowTopRightOnSquare,
@@ -27,12 +27,23 @@ const integrationProviders: Record<
     name: "Trello",
     icon: <FaTrello />,
   },
+  github: {
+    name: "GitHub",
+    icon: <FaGithub />,
+  },
 };
 
-const SelectSource = ({ handleNextStep }: { handleNextStep: () => void }) => {
+const SelectSource = ({
+  handleNextStep,
+}: {
+  handleNextStep: (provider: string) => void;
+}) => {
   const { data: integrations, refetch: refetchIntegrations } =
     api.integration.providers.useQuery();
-  const { control, handleSubmit } = useForm({
+  const { data: githubStatus, refetch: refetchGithubStatus } =
+    api.integration.getGitHubStatus.useQuery();
+
+  const { control, handleSubmit, watch } = useForm({
     defaultValues: {
       source: integrations?.[0]?.provider ?? "trello",
     },
@@ -47,23 +58,36 @@ const SelectSource = ({ handleNextStep }: { handleNextStep: () => void }) => {
     },
   );
 
-  const hasIntegrations = integrations && integrations.length > 0;
+  const availableIntegrations = [
+    ...(integrations ?? []),
+    ...(githubStatus?.connected ? [{ provider: "github" }] : []),
+  ];
+
+  const hasIntegrations = availableIntegrations.length > 0;
 
   useEffect(() => {
     const handleFocus = () => {
-      refetchIntegrations();
+      void refetchIntegrations();
+      void refetchGithubStatus();
     };
     window.addEventListener("focus", handleFocus);
     return () => {
       window.removeEventListener("focus", handleFocus);
     };
-  }, [refetchIntegrations]);
+  }, [refetchIntegrations, refetchGithubStatus]);
 
   const onSubmit = () => {
-    if (!hasIntegrations && trelloUrl) {
-      window.open(trelloUrl.url, "trello_auth", "height=800,width=600");
+    const selected = watch("source");
+    if (
+      selected === "trello" &&
+      !integrations?.some((i) => i.provider === "trello")
+    ) {
+      if (trelloUrl)
+        window.open(trelloUrl.url, "trello_auth", "height=800,width=600");
+    } else if (selected === "github" && !githubStatus?.connected) {
+      window.open("/settings/integrations", "_blank");
     } else {
-      handleNextStep();
+      handleNextStep(selected);
     }
   };
 
@@ -102,7 +126,7 @@ const SelectSource = ({ handleNextStep }: { handleNextStep: () => void }) => {
                     >
                       <Listbox.Options className="absolute z-10 mt-1 max-h-60 w-full overflow-auto rounded-md bg-light-50 py-1 text-base text-neutral-900 shadow-lg ring-1 ring-light-600 ring-opacity-5 focus:outline-none dark:bg-dark-300 dark:text-dark-1000 sm:text-sm">
                         {hasIntegrations ? (
-                          integrations.map((integration, index) => (
+                          availableIntegrations.map((integration, index) => (
                             <Listbox.Option
                               key={`source_${index}`}
                               className="relative cursor-default select-none px-1"
@@ -123,18 +147,32 @@ const SelectSource = ({ handleNextStep }: { handleNextStep: () => void }) => {
                             </Listbox.Option>
                           ))
                         ) : (
-                          <Listbox.Option
-                            key="trello_placeholder"
-                            className="font-sm relative cursor-default select-none px-1"
-                            value="trello"
-                          >
-                            <div className="flex items-center rounded-[5px] p-1 text-sm hover:bg-light-200 dark:hover:bg-dark-400">
-                              {integrationProviders.trello?.icon}
-                              <span className="ml-2 block truncate text-sm">
-                                {integrationProviders.trello?.name}
-                              </span>
-                            </div>
-                          </Listbox.Option>
+                          <>
+                            <Listbox.Option
+                              key="trello_placeholder"
+                              className="font-sm relative cursor-default select-none px-1"
+                              value="trello"
+                            >
+                              <div className="flex items-center rounded-[5px] p-1 text-sm hover:bg-light-200 dark:hover:bg-dark-400">
+                                {integrationProviders.trello?.icon}
+                                <span className="ml-2 block truncate text-sm">
+                                  {integrationProviders.trello?.name}
+                                </span>
+                              </div>
+                            </Listbox.Option>
+                            <Listbox.Option
+                              key="github_placeholder"
+                              className="font-sm relative cursor-default select-none px-1"
+                              value="github"
+                            >
+                              <div className="flex items-center rounded-[5px] p-1 text-sm hover:bg-light-200 dark:hover:bg-dark-400">
+                                {integrationProviders.github?.icon}
+                                <span className="ml-2 block truncate text-sm">
+                                  {integrationProviders.github?.name}
+                                </span>
+                              </div>
+                            </Listbox.Option>
+                          </>
                         )}
                       </Listbox.Options>
                     </Transition>
@@ -154,7 +192,159 @@ const SelectSource = ({ handleNextStep }: { handleNextStep: () => void }) => {
               !hasIntegrations ? <HiMiniArrowTopRightOnSquare /> : undefined
             }
           >
-            {hasIntegrations ? t`Select source` : t`Connect Trello`}
+            {hasIntegrations ? t`Select source` : t`Connect`}
+          </Button>
+        </div>
+      </div>
+    </form>
+  );
+};
+
+const ImportGithub: React.FC = () => {
+  const utils = api.useUtils();
+  const { closeModal } = useModal();
+  const { workspace } = useWorkspace();
+  const { showPopup } = usePopup();
+  const [isSelectAllEnabled, setIsSelectAllEnabled] = useState(false);
+
+  const refetchBoards = () => utils.board.all.refetch();
+
+  const { data: projects, isLoading: projectsLoading } =
+    api.import.github.getProjects.useQuery();
+
+  const {
+    register: registerProjects,
+    handleSubmit: handleSubmitProjects,
+    setValue,
+    watch,
+  } = useForm({
+    defaultValues: Object.fromEntries(
+      projects?.map((project) => [project.id, true]) ?? [],
+    ),
+  });
+
+  const importProjects = api.import.github.importProjects.useMutation({
+    onSuccess: async () => {
+      showPopup({
+        header: t`Import complete`,
+        message: t`Your projects have been imported.`,
+        icon: "success",
+      });
+      try {
+        await refetchBoards();
+        closeModal();
+      } catch (e) {
+        console.log(e);
+      }
+    },
+    onError: () => {
+      showPopup({
+        header: t`Import failed`,
+        message: t`Please try again later, or contact customer support.`,
+        icon: "error",
+      });
+    },
+  });
+
+  const projectWatchers = projects?.map((project) => ({
+    id: project.id,
+    value: watch(project.id),
+  }));
+
+  const projectCount =
+    projectWatchers?.filter((w) => w.value === true).length ?? 0;
+
+  const onSubmitProjects = (values: Record<string, boolean>) => {
+    const projectIds = Object.keys(values).filter(
+      (key) => values[key] === true,
+    );
+
+    importProjects.mutate({
+      projectIds,
+      workspacePublicId: workspace.publicId,
+    });
+  };
+
+  const renderContent = () => {
+    if (projectsLoading) {
+      return (
+        <div className="flex h-full w-full flex-col items-center justify-center gap-1">
+          <div className="h-[30px] w-full animate-pulse rounded-[5px] bg-light-200 dark:bg-dark-300" />
+          <div className="h-[30px] w-full animate-pulse rounded-[5px] bg-light-200 dark:bg-dark-300" />
+          <div className="h-[30px] w-full animate-pulse rounded-[5px] bg-light-200 dark:bg-dark-300" />
+        </div>
+      );
+    }
+
+    if (!projects?.length) {
+      return (
+        <div className="flex h-full w-full items-center justify-center">
+          <p className="text-sm text-neutral-500 dark:text-dark-900">
+            {t`No projects found`}
+          </p>
+        </div>
+      );
+    }
+
+    return projects.map((project) => (
+      <div key={project.id}>
+        <label
+          className="flex cursor-pointer items-center rounded-[5px] p-2 hover:bg-light-100 dark:hover:bg-dark-300"
+          htmlFor={project.id}
+        >
+          <input
+            id={project.id}
+            type="checkbox"
+            className="h-[14px] w-[14px] rounded bg-transparent ring-0 focus:outline-none focus:ring-0 focus:ring-offset-0"
+            {...registerProjects(project.id)}
+          />
+          <span className="ml-3 text-sm text-neutral-900 dark:text-dark-1000">
+            {project.name}
+          </span>
+        </label>
+      </div>
+    ));
+  };
+
+  return (
+    <form onSubmit={handleSubmitProjects(onSubmitProjects)}>
+      <div className="h-[105px] overflow-auto px-5">{renderContent()}</div>
+
+      <div className="mt-12 flex items-center justify-end border-t border-light-600 px-5 pb-5 pt-5 dark:border-dark-600">
+        <Toggle
+          label={t`Select all`}
+          isChecked={!!isSelectAllEnabled}
+          onChange={() => {
+            const newState = !isSelectAllEnabled;
+            setIsSelectAllEnabled(newState);
+
+            for (const project of projects ?? []) {
+              setValue(project.id, newState);
+            }
+          }}
+        />
+        <div className="space-x-2">
+          <Button
+            type="submit"
+            isLoading={importProjects.isPending}
+            disabled={
+              importProjects.isPending ||
+              projectsLoading ||
+              !projects?.length ||
+              !projects.some(
+                (project) =>
+                  projectWatchers?.find((w) => w.id === project.id)?.value ===
+                  true,
+              )
+            }
+          >
+            <Trans>
+              <Plural
+                value={projectCount}
+                one={`Import project (1)`}
+                other={`Import projects (${projectCount})`}
+              />
+            </Trans>
           </Button>
         </div>
       </div>
@@ -213,7 +403,7 @@ const ImportTrello: React.FC = () => {
     value: watch(board.id),
   }));
 
-  const boardCount = boardWatchers?.filter((w) => w.value === true).length || 0;
+  const boardCount = boardWatchers?.filter((w) => w.value === true).length ?? 0;
 
   const onSubmitBoards = (values: Record<string, boolean>) => {
     const boardIds = Object.keys(values).filter((key) => values[key] === true);
@@ -267,7 +457,7 @@ const ImportTrello: React.FC = () => {
 
   return (
     <form onSubmit={handleSubmitBoards(onSubmitBoards)}>
-      <div className="h-[105px] overflow-scroll px-5">{renderContent()}</div>
+      <div className="h-[105px] overflow-auto px-5">{renderContent()}</div>
 
       <div className="mt-12 flex items-center justify-end border-t border-light-600 px-5 pb-5 pt-5 dark:border-dark-600">
         <Toggle
@@ -277,7 +467,7 @@ const ImportTrello: React.FC = () => {
             const newState = !isSelectAllEnabled;
             setIsSelectAllEnabled(newState);
 
-            for (const board of boards || []) {
+            for (const board of boards ?? []) {
               setValue(board.id, newState);
             }
           }}
@@ -313,6 +503,7 @@ const ImportTrello: React.FC = () => {
 export function ImportBoardsForm() {
   const { closeModal } = useModal();
   const [step, setStep] = useState(1);
+  const [provider, setProvider] = useState<string | null>(null);
 
   return (
     <div>
@@ -339,8 +530,16 @@ export function ImportBoardsForm() {
         </button>
       </div>
 
-      {step === 1 && <SelectSource handleNextStep={() => setStep(step + 1)} />}
-      {step === 2 && <ImportTrello />}
+      {step === 1 && (
+        <SelectSource
+          handleNextStep={(p) => {
+            setProvider(p);
+            setStep(step + 1);
+          }}
+        />
+      )}
+      {step === 2 && provider === "trello" && <ImportTrello />}
+      {step === 2 && provider === "github" && <ImportGithub />}
     </div>
   );
 }

apps/web/src/views/boards/components/TemplateBoards.tsx

@@ -23,6 +23,18 @@ export const getTemplates = (): Template[] => [
     lists: [t`Backlog`, t`To Do`, t`In Progress`, t`Code Review`, t`Done`],
     labels: [t`Bug`, t`Feature`, t`Enhancement`, t`Critical`, t`Documentation`],
   },
+  {
+    id: "roadmap-basic",
+    name: t`Basic Roadmap`,
+    lists: [t`Requested`, t`Planned`, t`In Progress`, t`Done`],
+    labels: [t`Feature`, t`Enhancement`, t`Critical`, t`Documentation`],
+  },
+  {
+    id: "roadmap-extended",
+    name: t`Extended Roadmap`,
+    lists: [t`Requested`, t`Under Review`, t`Planned`, t`In Progress`, t`Done`, t`Rejected`],
+    labels: [t`Feature`, t`Enhancement`, t`Critical`, t`Documentation`],
+  },
   {
     id: "content-creation",
     name: t`Content Creation`,

apps/web/src/views/boards/index.tsx

@@ -1,5 +1,12 @@
+import {
+  Listbox,
+  ListboxButton,
+  ListboxOption,
+  ListboxOptions,
+} from "@headlessui/react";
 import { t } from "@lingui/core/macro";
-import { HiArrowDownTray, HiOutlinePlusSmall } from "react-icons/hi2";
+import { HiArrowDownTray, HiChevronDown, HiOutlinePlusSmall } from "react-icons/hi2";
+import { useState } from "react";
 
 import Button from "~/components/Button";
 import FeedbackModal from "~/components/FeedbackModal";
@@ -15,9 +22,15 @@ import { BoardsList } from "./components/BoardsList";
 import { ImportBoardsForm } from "./components/ImportBoardsForm";
 import { NewBoardForm } from "./components/NewBoardForm";
 
+const boardsTabs = [
+  { key: "boards" as const, label: t`Active` },
+  { key: "archived" as const, label: t`Archived` },
+];
+
 export default function BoardsPage({ isTemplate }: { isTemplate?: boolean }) {
   const { openModal, modalContentType, isOpen } = useModal();
   const { workspace } = useWorkspace();
+  const [activeTab, setActiveTab] = useState<"boards" | "archived">("boards");
   const { canCreateBoard } = usePermissions();
 
   const { tooltipContent: createModalShortcutTooltipContent } =
@@ -34,7 +47,7 @@ export default function BoardsPage({ isTemplate }: { isTemplate?: boolean }) {
       <PageHead
         title={t`${isTemplate ? "Templates" : "Boards"} | ${workspace.name ?? t`Workspace`}`}
       />
-      <div className="m-auto h-full max-w-[1100px] p-6 px-5 md:px-28 md:py-12">
+      <div className="m-auto h-full max-w-[1100px] p-8 px-5 md:px-28 md:py-12">
         <div className="relative z-10 mb-8 flex w-full items-center justify-between">
           <h1 className="font-bold tracking-tight text-neutral-900 dark:text-dark-1000 sm:text-[1.2rem]">
             {t`${isTemplate ? "Templates" : "Boards"}`}
@@ -115,9 +128,79 @@ export default function BoardsPage({ isTemplate }: { isTemplate?: boolean }) {
           </Modal>
         </>
 
-        <div className="flex h-full flex-row">
-          <BoardsList isTemplate={!!isTemplate} />
-        </div>
+        {!isTemplate ? (
+          <div className="flex h-full w-full flex-col">
+            <div className="focus:outline-none">
+              <div className="sm:hidden">
+                <Listbox
+                  value={activeTab}
+                  onChange={(tab) => setActiveTab(tab)}
+                >
+                  <div className="relative mb-4">
+                    <ListboxButton className="w-full appearance-none rounded-md border-0 bg-light-50 py-3 pl-3 pr-10 text-left text-sm font-semibold text-light-1000 shadow-sm ring-1 ring-inset ring-light-300  dark:bg-dark-50 dark:text-dark-1000 dark:ring-dark-300 dark:focus:ring-dark-500">
+                      {boardsTabs.find((tab) => tab.key === activeTab)?.label ??
+                        "Select a tab"}
+                      <HiChevronDown
+                        aria-hidden="true"
+                        className="pointer-events-none absolute right-3 top-1/2 h-4 w-4 -translate-y-1/2 text-light-900 dark:text-dark-900"
+                      />
+                    </ListboxButton>
+                    <ListboxOptions className="absolute z-10 mt-1 w-full rounded-md bg-light-50 py-1 text-sm shadow-lg ring-1 ring-inset ring-light-300 dark:bg-dark-50 dark:ring-dark-300">
+                      {boardsTabs.map((tab) => (
+                        <ListboxOption
+                          key={tab.key}
+                          value={tab.key}
+                          className={({ selected }) =>
+                            `relative cursor-pointer select-none py-2 pl-3 pr-9 ${selected
+                              ? "font-bold text-light-1000 dark:text-dark-1000"
+                              : "font-normal text-light-1000 dark:text-dark-1000"
+                            }`
+                          }
+                        >
+                          {tab.label}
+                        </ListboxOption>
+                      ))}
+                    </ListboxOptions>
+                  </div>
+                </Listbox>
+              </div>
+              <div className="hidden sm:block">
+                <div>
+                  <nav
+                    aria-label="Tabs"
+                    className="-mb-px flex space-x-8 focus:outline-none"
+                  >
+                    {boardsTabs.map((tab) => (
+                      <button
+                        key={tab.key}
+                        type="button"
+                        onClick={() => setActiveTab(tab.key)}
+                        className={`whitespace-nowrap px-1 py-0 mt-2 mb-8 text-sm font-semibold transition-colors focus:outline-none ${activeTab === tab.key
+                          ? "border-light-1000 text-light-1000 dark:border-dark-1000 dark:text-dark-1000"
+                          : "border-transparent text-light-900 hover:border-light-950 hover:text-light-950 dark:text-dark-900 dark:hover:border-white/20 dark:hover:text-dark-950"
+                          }`}
+                      >
+                        {tab.label}
+                      </button>
+                    ))}
+                  </nav>
+                </div>
+              </div>
+            </div>
+            <div className="flex h-full flex-row focus:outline-none">
+              {activeTab === "boards" && (
+                <BoardsList isTemplate={false} archived={false} />
+              )}
+              {activeTab === "archived" && (
+                <BoardsList isTemplate={false} archived={true} />
+              )}
+            </div>
+          </div>
+        ) : (
+          <div className="flex h-full flex-row">
+            <BoardsList isTemplate={!!isTemplate} />
+          </div>
+        )}
       </div>
     </>
   );

apps/web/src/views/card/components/ActivityList.tsx

@@ -8,6 +8,7 @@ import {
   HiOutlineArrowRight,
   HiOutlineCheckCircle,
   HiOutlineClock,
+  HiOutlinePaperClip,
   HiOutlinePencil,
   HiOutlinePlus,
   HiOutlineTag,
@@ -31,6 +32,16 @@ import Comment from "./Comment";
 type ActivityType =
   NonNullable<GetCardByIdOutput>["activities"][number]["type"];
 
+type ActivityWithMergedLabels =
+  GetCardActivitiesOutput["activities"][number] & {
+    mergedLabels?: string[];
+    attachment?: {
+      publicId: string;
+      filename: string;
+      originalFilename: string;
+    } | null;
+  };
+
 const truncate = (value: string | null, maxLength = 50) => {
   if (!value) return value;
   return value.length > maxLength ? `${value.slice(0, maxLength - 1)}…` : value;
@@ -57,6 +68,7 @@ const getActivityText = ({
   toDueDate,
   dateLocale,
   mergedLabels,
+  attachmentName,
 }: {
   type: ActivityType;
   toTitle: string | null;
@@ -71,6 +83,7 @@ const getActivityText = ({
   toDueDate?: Date | null;
   dateLocale: DateFnsLocale;
   mergedLabels?: string[];
+  attachmentName?: string | null;
 }) => {
   const displayName = memberName ?? memberEmail ?? t`Member`;
   const TextHighlight = ({ children }: { children: React.ReactNode }) => (
@@ -124,6 +137,8 @@ const getActivityText = ({
     "card.updated.checklist.item.completed": t`completed a checklist item`,
     "card.updated.checklist.item.uncompleted": t`marked a checklist item as incomplete`,
     "card.updated.checklist.item.deleted": t`deleted a checklist item`,
+    "card.updated.attachment.added": t`added an attachment`,
+    "card.updated.attachment.removed": t`removed an attachment`,
     "card.updated.dueDate.added": t`set the due date`,
     "card.updated.dueDate.updated": t`updated the due date`,
     "card.updated.dueDate.removed": t`removed the due date`,
@@ -256,6 +271,27 @@ const getActivityText = ({
     );
   }
 
+  if (type === "card.updated.attachment.added") {
+    const filename = attachmentName ?? toTitle;
+    if (!filename) return baseText;
+    return (
+      <Trans>
+        added an attachment <TextHighlight>{truncate(filename)}</TextHighlight>
+      </Trans>
+    );
+  }
+
+  if (type === "card.updated.attachment.removed") {
+    const filename = attachmentName ?? fromTitle;
+    if (!filename) return baseText;
+    return (
+      <Trans>
+        removed an attachment{" "}
+        <TextHighlight>{truncate(filename)}</TextHighlight>
+      </Trans>
+    );
+  }
+
   if (type === "card.updated.dueDate.added" && toDueDate) {
     const showYear = !isSameYear(toDueDate, new Date());
     const formattedDate = format(
@@ -308,6 +344,8 @@ const ACTIVITY_ICON_MAP: Partial<Record<ActivityType, React.ReactNode | null>> =
     "card.updated.checklist.item.completed": <HiOutlineCheckCircle />,
     "card.updated.checklist.item.uncompleted": <HiOutlineCheckCircle />,
     "card.updated.checklist.item.deleted": <HiOutlineTrash />,
+    "card.updated.attachment.added": <HiOutlinePaperClip />,
+    "card.updated.attachment.removed": <HiOutlinePaperClip />,
     "card.updated.dueDate.added": <HiOutlineClock />,
     "card.updated.dueDate.updated": <HiOutlineClock />,
     "card.updated.dueDate.removed": <HiOutlineClock />,
@@ -341,7 +379,7 @@ const ActivityList = ({
   isAdmin?: boolean;
   isViewOnly?: boolean;
 }) => {
-  const { dateLocale, locale } = useLocalisation();
+  const { dateLocale } = useLocalisation();
   const { data: sessionData } = authClient.useSession();
   const utils = api.useUtils();
   const [allActivities, setAllActivities] = useState<
@@ -391,25 +429,21 @@ const ActivityList = ({
               cursor: nextCursor,
             });
 
-            if (nextPage) {
-              const existingIds = new Set(
-                currentActivities.map((a) => a.publicId),
-              );
-              const newActivities = nextPage.activities.filter(
-                (a: { publicId: string }) => !existingIds.has(a.publicId),
-              );
-              currentActivities = [...currentActivities, ...newActivities];
-              currentHasMore = nextPage.hasMore;
-            } else {
-              break;
-            }
+            const existingIds = new Set(
+              currentActivities.map((a) => a.publicId),
+            );
+            const newActivities = nextPage.activities.filter(
+              (a: { publicId: string }) => !existingIds.has(a.publicId),
+            );
+            currentActivities = [...currentActivities, ...newActivities];
+            currentHasMore = nextPage.hasMore;
           }
 
           setAllActivities(currentActivities);
           setHasMore(false);
         };
 
-        fetchAllRemaining();
+        void fetchAllRemaining();
       } else {
         setAllActivities(firstPageData.activities);
         setHasMore(firstPageData.hasMore);
@@ -436,17 +470,15 @@ const ActivityList = ({
         cursor: nextCursor,
       });
 
-      if (nextPage) {
-        const existingIds = new Set(allActivities.map((a) => a.publicId));
-        const newActivities = nextPage.activities.filter(
-          (a: { publicId: string }) => !existingIds.has(a.publicId),
-        );
-        setAllActivities((prev) => [...prev, ...newActivities]);
-        setHasMore(nextPage.hasMore);
+      const existingIds = new Set(allActivities.map((a) => a.publicId));
+      const newActivities = nextPage.activities.filter(
+        (a: { publicId: string }) => !existingIds.has(a.publicId),
+      );
+      setAllActivities((prev) => [...prev, ...newActivities]);
+      setHasMore(nextPage.hasMore);
 
-        if (!nextPage.hasMore) {
-          isFullyExpandedRef.current = true;
-        }
+      if (!nextPage.hasMore) {
+        isFullyExpandedRef.current = true;
       }
     } finally {
       setIsLoadingMore(false);
@@ -473,7 +505,10 @@ const ActivityList = ({
           fromDueDate: activity.fromDueDate ?? null,
           toDueDate: activity.toDueDate ?? null,
           dateLocale: dateLocale,
-          mergedLabels: (activity as any).mergedLabels,
+          mergedLabels: (activity as ActivityWithMergedLabels).mergedLabels,
+          attachmentName:
+            (activity as ActivityWithMergedLabels).attachment?.originalFilename ??
+            null,
         });
 
         if (activity.type === "card.updated.comment.added")

apps/web/src/views/card/components/Comment.tsx

@@ -1,12 +1,13 @@
 import { t } from "@lingui/core/macro";
 import { formatDistanceToNow } from "date-fns";
 import { useState } from "react";
-import ContentEditable from "react-contenteditable";
 import { useForm } from "react-hook-form";
 import { HiEllipsisHorizontal, HiPencil, HiTrash } from "react-icons/hi2";
 
 import Avatar from "~/components/Avatar";
 import Button from "~/components/Button";
+import Editor from "~/components/Editor";
+import type { WorkspaceMember } from "~/components/Editor";
 import Dropdown from "~/components/Dropdown";
 import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
@@ -29,7 +30,6 @@ const Comment = ({
   createdAt,
   comment,
   isAuthor,
-  isAdmin,
   isEdited = false,
   isViewOnly = false,
 }: {
@@ -42,7 +42,6 @@ const Comment = ({
   createdAt: string;
   comment: string | undefined;
   isAuthor: boolean;
-  isAdmin: boolean;
   isEdited: boolean;
   isViewOnly: boolean;
 }) => {
@@ -57,6 +56,30 @@ const Comment = ({
     },
   });
 
+  const { data: cardData } = api.card.byId.useQuery(
+    {
+      cardPublicId,
+    },
+    {
+      enabled: !!cardPublicId && cardPublicId.length >= 12,
+    },
+  );
+
+  const workspaceMembers: WorkspaceMember[] =
+    cardData?.list.board.workspace.members
+      .filter((member) => member.email)
+      .map((member) => ({
+        publicId: member.publicId,
+        email: member.email,
+        user: member.user
+          ? {
+              id: member.user.id,
+              name: member.user.name ?? null,
+              image: member.user.image ?? null,
+            }
+          : null,
+      })) ?? [];
+
   if (!publicId) return null;
 
   const updateCommentMutation = api.card.updateComment.useMutation({
@@ -142,21 +165,28 @@ const Comment = ({
         )}
       </div>
       {!isEditing ? (
-        <ContentEditable
-          html={comment ?? ""}
-          disabled={true}
-          className="break-anywhere mt-2 text-sm"
-        />
+        <div className="mt-2">
+          <Editor
+            content={comment ?? null}
+            readOnly={true}
+            workspaceMembers={workspaceMembers}
+            enableYouTubeEmbed={false}
+            disableHeadings={true}
+          />
+        </div>
       ) : (
         <form onSubmit={handleSubmit(onSubmit)}>
-          <ContentEditable
-            placeholder={t`Add a comment...`}
-            html={watch("comment")}
-            disabled={false}
-            onChange={(e) => setValue("comment", e.target.value)}
-            className="block w-full max-w-[800px] border-0 bg-transparent py-1.5 text-sm text-light-900 focus-visible:outline-none dark:text-dark-1000 sm:text-sm sm:leading-6"
-          />
-          <div className="flex justify-end space-x-2">
+          <div className="mt-2">
+            <Editor
+              content={watch("comment")}
+              onChange={(value) => setValue("comment", value)}
+              workspaceMembers={workspaceMembers}
+              enableYouTubeEmbed={false}
+              placeholder={t`Add comment... (type '/' to open commands or '@' to mention)`}
+              disableHeadings={true}
+            />
+          </div>
+          <div className="flex justify-end space-x-2 mt-2">
             <Button
               size="sm"
               variant="ghost"

apps/web/src/views/card/components/Dropdown.tsx

@@ -1,6 +1,7 @@
 import { t } from "@lingui/core/macro";
 import {
   HiEllipsisHorizontal,
+  HiLink,
   HiOutlineCheckCircle,
   HiOutlineTrash,
 } from "react-icons/hi2";
@@ -10,18 +11,54 @@ import { authClient } from "@kan/auth/client";
 import Dropdown from "~/components/Dropdown";
 import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
+import { usePopup } from "~/providers/popup";
 
 export default function CardDropdown({
+  cardPublicId,
+  isTemplate,
+  boardPublicId,
   cardCreatedBy,
 }: {
+  cardPublicId: string;
+  isTemplate?: boolean;
+  boardPublicId?: string;
   cardCreatedBy?: string | null;
 }) {
   const { openModal } = useModal();
+  const { showPopup } = usePopup();
   const { canEditCard, canDeleteCard } = usePermissions();
   const { data: session } = authClient.useSession();
   const isCreator = cardCreatedBy && session?.user.id === cardCreatedBy;
 
+  const handleCopyCardLink = async () => {
+    const path =
+      isTemplate && boardPublicId
+        ? `/templates/${boardPublicId}/cards/${cardPublicId}`
+        : `/cards/${cardPublicId}`;
+    const url = `${window.location.origin}${path}`;
+    try {
+      await navigator.clipboard.writeText(url);
+      showPopup({
+        header: t`Link copied`,
+        icon: "success",
+        message: t`Card URL copied to clipboard`,
+      });
+    } catch (error) {
+      console.error(error);
+      showPopup({
+        header: t`Unable to copy link`,
+        icon: "error",
+        message: t`Please try again.`,
+      });
+    }
+  };
+
   const items = [
+    {
+      label: t`Copy card link`,
+      action: handleCopyCardLink,
+      icon: <HiLink className="h-[16px] w-[16px] text-dark-900" />,
+    },
     ...(canEditCard
       ? [
           {

apps/web/src/views/card/components/NewCommentForm.tsx

@@ -1,8 +1,9 @@
 import { t } from "@lingui/core/macro";
-import ContentEditable from "react-contenteditable";
 import { useForm } from "react-hook-form";
 import { HiOutlineArrowUp } from "react-icons/hi2";
 
+import Editor from "~/components/Editor";
+import type { WorkspaceMember } from "~/components/Editor";
 import LoadingSpinner from "~/components/LoadingSpinner";
 import { usePermissions } from "~/hooks/usePermissions";
 import { usePopup } from "~/providers/popup";
@@ -13,7 +14,13 @@ interface FormValues {
   comment: string;
 }
 
-const NewCommentForm = ({ cardPublicId }: { cardPublicId: string }) => {
+const NewCommentForm = ({
+  cardPublicId,
+  workspaceMembers,
+}: {
+  cardPublicId: string;
+  workspaceMembers: WorkspaceMember[];
+}) => {
   const utils = api.useUtils();
   const { showPopup } = usePopup();
   const { canCreateComment } = usePermissions();
@@ -23,10 +30,6 @@ const NewCommentForm = ({ cardPublicId }: { cardPublicId: string }) => {
     },
   });
 
-  const queryParams = {
-    cardPublicId,
-  };
-
   const addCommentMutation = api.card.addComment.useMutation({
     onError: (_error, _newList) => {
       showPopup({
@@ -57,18 +60,13 @@ const NewCommentForm = ({ cardPublicId }: { cardPublicId: string }) => {
       onSubmit={handleSubmit(onSubmit)}
       className="flex w-full max-w-[800px] flex-col rounded-xl border border-light-600 bg-light-100 p-4 text-light-900 focus-visible:outline-none dark:border-dark-400 dark:bg-dark-100 dark:text-dark-1000 sm:text-sm sm:leading-6"
     >
-      <ContentEditable
-        placeholder={t`Add a comment...`}
-        html={watch("comment")}
-        disabled={false}
-        onChange={(e) => setValue("comment", e.target.value)}
-        className="block w-full border-0 bg-transparent py-1.5 text-light-900 focus-visible:outline-none dark:text-dark-1000 sm:text-sm sm:leading-6"
-        onKeyDown={async (e) => {
-          if (e.key === "Enter" && e.shiftKey) {
-            e.preventDefault();
-            await handleSubmit(onSubmit)();
-          }
-        }}
+      <Editor
+        content={watch("comment")}
+        onChange={(value) => setValue("comment", value)}
+        workspaceMembers={workspaceMembers}
+        enableYouTubeEmbed={false}
+        placeholder={t`Add comment... (type '/' to open commands or '@' to mention)`}
+        disableHeadings={true}
       />
       <div className="flex justify-end">
         <button

apps/web/src/views/card/index.tsx

@@ -3,8 +3,11 @@ import { useRouter } from "next/router";
 import { t } from "@lingui/core/macro";
 import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
+import { HiXMark } from "react-icons/hi2";
 import { IoChevronForwardSharp } from "react-icons/io5";
 
+import { authClient } from "@kan/auth/client";
+
 import Avatar from "~/components/Avatar";
 import Editor from "~/components/Editor";
 import FeedbackModal from "~/components/FeedbackModal";
@@ -14,8 +17,6 @@ import Modal from "~/components/modal";
 import { NewWorkspaceForm } from "~/components/NewWorkspaceForm";
 import { PageHead } from "~/components/PageHead";
 import { EditYouTubeModal } from "~/components/YouTubeEmbed/EditYouTubeModal";
-import { authClient } from "@kan/auth/client";
-
 import { usePermissions } from "~/hooks/usePermissions";
 import { useModal } from "~/providers/modal";
 import { usePopup } from "~/providers/popup";
@@ -167,7 +168,6 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
   const {
     modalContentType,
     entityId,
-    openModal,
     getModalState,
     clearModalState,
     isOpen,
@@ -198,8 +198,24 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
   };
 
   const board = card?.list.board;
+  const workspaceMembers = board?.workspace.members;
   const boardId = board?.publicId;
 
+  const editorWorkspaceMembers =
+    workspaceMembers
+      ?.filter((member) => member.email)
+      .map((member) => ({
+        publicId: member.publicId,
+        email: member.email,
+        user: member.user
+          ? {
+              id: member.user.id,
+              name: member.user.name ?? null,
+              image: member.user.image ?? null,
+            }
+          : null,
+      })) ?? [];
+
   const updateCard = api.card.update.useMutation({
     onError: () => {
       showPopup({
@@ -317,7 +333,19 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
                 </Link>
               </div>
               <div className="flex items-center gap-2">
-                <Dropdown cardCreatedBy={card?.createdBy} />
+                <Dropdown
+                  cardPublicId={cardId}
+                  isTemplate={isTemplate}
+                  boardPublicId={boardId}
+                  cardCreatedBy={card?.createdBy}
+                />
+                <Link
+                  href={`/${isTemplate ? "templates" : "boards"}/${boardId}`}
+                  className="flex h-7 w-7 items-center justify-center rounded-[5px] text-light-900 hover:bg-light-200 dark:text-dark-900 dark:hover:bg-dark-200"
+                  aria-label={t`Close`}
+                >
+                  <HiXMark className="h-4 w-4" />
+                </Link>
               </div>
             </>
           )}
@@ -374,9 +402,15 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
                       <div className="mt-2">
                         <Editor
                           content={card.description}
-                          onChange={canEdit ? (e) => setValue("description", e) : undefined}
-                          onBlur={canEdit ? () => handleSubmit(onSubmit)() : undefined}
-                          workspaceMembers={board?.workspace.members ?? []}
+                          onChange={
+                            canEdit
+                              ? (e) => setValue("description", e)
+                              : undefined
+                          }
+                          onBlur={
+                            canEdit ? () => handleSubmit(onSubmit)() : undefined
+                          }
+                          workspaceMembers={workspaceMembers ?? []}
                           readOnly={!canEdit}
                         />
                       </div>
@@ -420,7 +454,10 @@ export default function CardPage({ isTemplate }: { isTemplate?: boolean }) {
                     </div>
                     {!isTemplate && (
                       <div className="mt-6">
-                        <NewCommentForm cardPublicId={cardId} />
+                        <NewCommentForm
+                          cardPublicId={cardId}
+                          workspaceMembers={editorWorkspaceMembers}
+                        />
                       </div>
                     )}
                   </div>

apps/web/src/views/pricing/components/FeatureComparisonTable.tsx

@@ -1,293 +1,539 @@
 import { t } from "@lingui/core/macro";
+import React, { useEffect, useRef, useState } from "react";
 import { HiCheckCircle, HiXCircle } from "react-icons/hi2";
-
-interface Feature {
-  key: string;
-  label: string;
-  kan: boolean | string;
-  trello: boolean | string;
-}
-
-interface Section {
-  name: string;
-  features: Feature[];
-}
+import { twMerge } from "tailwind-merge";
 
 type FrequencyValue = "monthly" | "annually";
 
-const CellValue = ({ value }: { value: boolean | string }) => {
-  if (typeof value === "string") {
-    return (
-      <span className="text-sm text-dark-900 dark:text-dark-900">{value}</span>
-    );
-  }
-  return value ? (
-    <HiCheckCircle className="h-5 w-5 text-light-950 dark:text-dark-1000" />
-  ) : (
-    <HiXCircle className="h-5 w-5 text-light-700 dark:text-dark-600" />
-  );
-};
+interface PlanFeature {
+  key: string;
+  label: string;
+  free: string | boolean | { text: string; highlight?: boolean; highlightFirstWord?: boolean };
+  teams: string | boolean | { text: string; highlight?: boolean; highlightFirstWord?: boolean };
+  pro: string | boolean | { text: string; highlight?: boolean; highlightFirstWord?: boolean };
+  enterprise: string | boolean | { text: string; highlight?: boolean; highlightFirstWord?: boolean };
+}
+
+interface FeatureSection {
+  name: string;
+  features: PlanFeature[];
+}
 
 const FeatureComparisonTable = ({
-  frequencyValue,
+  frequencyValue: _frequencyValue,
 }: {
   frequencyValue: FrequencyValue;
 }) => {
-  const sections: Section[] = [
+  // Keep pricing column headers visible as you scroll
+  const containerRef = useRef<HTMLDivElement | null>(null);
+  const [isHeaderFixed, setIsHeaderFixed] = useState(false);
+  const [headerRect, setHeaderRect] = useState<{ left: number; width: number }>({
+    left: 0,
+    width: 0,
+  });
+
+  useEffect(() => {
+    const HEADER_OFFSET = 64; // px; matches fixed top nav height
+
+    const handleScroll = () => {
+      if (!containerRef.current) return;
+
+      // Hide fixed header on mobile (screens smaller than 620px)
+      if (window.innerWidth < 620) {
+        setIsHeaderFixed(false);
+        return;
+      }
+
+      const rect = containerRef.current.getBoundingClientRect();
+      const pastHeader = rect.top <= HEADER_OFFSET;
+      const aboveBottom = rect.bottom > HEADER_OFFSET + 40;
+
+      const shouldFix = pastHeader && aboveBottom;
+      setIsHeaderFixed(shouldFix);
+
+      if (shouldFix) {
+        setHeaderRect({
+          left: rect.left,
+          width: rect.width,
+        });
+      }
+    };
+
+    handleScroll();
+    window.addEventListener("scroll", handleScroll, { passive: true });
+    window.addEventListener("resize", handleScroll);
+    return () => {
+      window.removeEventListener("scroll", handleScroll);
+      window.removeEventListener("resize", handleScroll);
+    };
+  }, []);
+  const planSpecificLimits: PlanFeature[] = [
     {
-      name: t`Core features`,
-      features: [
-        {
-          key: "ulimited-workspaces",
-          label: t`Unlimited workspaces`,
-          kan: true,
-          trello: false,
-        },
-        {
-          key: "unlimited-boards",
-          label: t`Unlimited boards`,
-          kan: true,
-          trello: false,
-        },
-        {
-          key: "unlimited-lists",
-          label: t`Unlimited lists`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "unlimited-cards",
-          label: t`Unlimited cards`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "activity-log",
-          label: t`Activity log`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "templates",
-          label: t`Custom templates`,
-          kan: true,
-          trello: false,
-        },
-        { key: "labels", label: t`Labels & filters`, kan: true, trello: true },
-        { key: "checklists", label: t`Checklists`, kan: true, trello: true },
-        {
-          key: "import",
-          label: t`Import from Trello`,
-          kan: true,
-          trello: false,
-        },
-        {
-          key: "visibility",
-          label: t`Board visibility`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "search",
-          label: t`Intelligent search`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "workspace-url",
-          label: t`Custom workspace link`,
-          kan: true,
-          trello: false,
-        },
-      ],
+      key: "boards",
+      label: t`Boards`,
+      free: { text: t`Unlimited boards`, highlightFirstWord: true },
+      teams: { text: t`Unlimited boards`, highlightFirstWord: true },
+      pro: { text: t`Unlimited boards`, highlightFirstWord: true },
+      enterprise: { text: t`Unlimited boards`, highlightFirstWord: true },
     },
     {
-      name: t`Teams`,
-      features: [
-        {
-          key: "pricing",
-          label: t`Price per user/month`,
-          kan: frequencyValue === "monthly" ? `$10.00` : `$8.00`,
-          trello: frequencyValue === "monthly" ? `$12.00` : `$10.00`,
-        },
-        {
-          key: "comments",
-          label: t`Comments & mentions`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "assignments",
-          label: t`Assignees`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "sharing",
-          label: t`Board sharing & invites`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "invite-links",
-          label: t`Invite links`,
-          kan: true,
-          trello: true,
-        },
-      ],
+      key: "members",
+      label: t`Members`,
+      free: { text: t`1 user`, highlightFirstWord: true },
+      teams: { text: t`Per-seat pricing`, highlightFirstWord: true },
+      pro: { text: t`Unlimited members`, highlightFirstWord: true },
+      enterprise: { text: t`Unlimited members`, highlightFirstWord: true },
+    },
+    {
+      key: "file-uploads",
+      label: t`File uploads`,
+      free: { text: t`10mb file uploads`, highlightFirstWord: true },
+      teams: { text: t`Unlimited file uploads`, highlightFirstWord: true },
+      pro: { text: t`Unlimited file uploads`, highlightFirstWord: true },
+      enterprise: { text: t`Unlimited file uploads`, highlightFirstWord: true },
+    },
+      {
+        key: "workspace-username",
+        label: t`Workspace username`,
+        free: { text: t`Default username`, highlightFirstWord: true },
+        teams: { text: t`Default username`, highlightFirstWord: true },
+        pro: { text: t`Custom username`, highlightFirstWord: true },
+        enterprise: { text: t`Custom username`, highlightFirstWord: true },
+      },
+  ];
+
+  const coreFeatures: PlanFeature[] = [
+    {
+      key: "checklists",
+      label: t`Checklists`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "custom-templates",
+      label: t`Board templates`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "labels-filters",
+      label: t`Labels & filters`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "board-visibility",
+      label: t`Board visibility`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "search",
+      label: t`Intelligent search`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "activity-log",
+      label: t`Activity log`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "comments",
+      label: t`Comments`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "roles-permissions",
+      label: t`Roles & permissions`,
+      free: false,
+      teams: false,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "custom-branding",
+      label: t`Custom branding`,
+      free: false,
+      teams: false,
+      pro: true,
+      enterprise: true,
+    },
+  ];
+
+  const collaborationFeatures: PlanFeature[] = [
+    {
+      key: "mentions",
+      label: t`Mentions`,
+      free: false,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "email-notifications",
+      label: t`Email notifications`,
+      free: false,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "assignees",
+      label: t`Assignees`,
+      free: false,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "invite-links",
+      label: t`Invite links`,
+      free: false,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+  ];
+
+  const importsFeatures: PlanFeature[] = [
+    {
+      key: "import-export",
+      label: t`Trello`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+  ];
+
+  const platformFeatures: PlanFeature[] = [
+    {
+      key: "open-source",
+      label: t`Open source`,
+      free: true,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "rest-api",
+      label: t`API`,
+      free: { text: t`Limited API access` },
+      teams: { text: t`Full API access`, highlight: true },
+      pro: { text: t`Full API access`, highlight: true },
+      enterprise: { text: t`Full API access`, highlight: true },
+    },
+    {
+      key: "self-hostable",
+      label: t`On-premise`,
+      free: false,
+      teams: false,
+      pro: false,
+      enterprise: true,
+    },
+  ];
+
+  const securityFeatures: PlanFeature[] = [
+    {
+      key: "sso",
+      label: t`SSO`,
+      free: { text: t`Google SSO`, highlight: true },
+      teams: { text: t`Google SSO`, highlight: true },
+      pro: { text: t`Google SSO`, highlight: true },
+      enterprise: { text: t`Google SSO + SAML`, highlight: true },
+    },
+    {
+      key: "admin-roles",
+      label: t`Admin roles`,
+      free: { text: t`Admin roles`, highlight: true },
+      teams: { text: t`Admin roles`, highlight: true },
+      pro: { text: t`Admin roles`, highlight: true },
+      enterprise: { text: t`Advanced admin roles`, highlight: true },
+    },
+  ];
+
+  const supportFeatures: PlanFeature[] = [
+    {
+      key: "priority-email-support",
+      label: t`Priority email support`,
+      free: false,
+      teams: true,
+      pro: true,
+      enterprise: true,
+    },
+    {
+      key: "account-manager",
+      label: t`Account manager`,
+      free: false,
+      teams: false,
+      pro: false,
+      enterprise: true,
+    },
+    {
+      key: "sla",
+      label: t`SLA`,
+      free: false,
+      teams: false,
+      pro: false,
+      enterprise: true,
+    },
+  ];
+
+  const sections: FeatureSection[] = [
+    {
+      name: "",
+      features: planSpecificLimits,
+    },
+    {
+      name: t`Core features`,
+      features: coreFeatures,
+    },
+    {
+      name: t`Collaboration`,
+      features: collaborationFeatures,
+    },
+    {
+      name: t`Imports`,
+      features: importsFeatures,
     },
     {
       name: t`Platform`,
-      features: [
-        {
-          key: "api",
-          label: t`REST API`,
-          kan: true,
-          trello: true,
-        },
-        {
-          key: "open-source",
-          label: t`Open source`,
-          kan: true,
-          trello: false,
-        },
-        {
-          key: "self-hostable",
-          label: t`Self-hostable`,
-          kan: true,
-          trello: false,
-        },
-        {
-          key: "white-label",
-          label: t`White label`,
-          kan: true,
-          trello: false,
-        },
-        {
-          key: "performance",
-          label: t`Fast & lightweight`,
-          kan: true,
-          trello: false,
-        },
-        {
-          key: "this-is-a-joke",
-          label: t`Owned by Atlassian`,
-          kan: false,
-          trello: true,
-        },
-      ],
+      features: platformFeatures,
+    },
+    {
+      name: t`Security`,
+      features: securityFeatures,
+    },
+    {
+      name: t`Support`,
+      features: supportFeatures,
     },
   ];
 
-  const products = [
-    {
-      id: "kan",
-      name: t`Kan`,
-      featured: true,
-    },
-    {
-      id: "trello",
-      name: t`Trello`,
-      featured: false,
-    },
+  const plans = [
+    { id: "free", name: t`Free`, tierId: "tier-free" },
+    { id: "teams", name: t`Teams`, tierId: "tier-teams" },
+    { id: "pro", name: t`Pro`, tierId: "tier-pro" },
+    { id: "enterprise", name: t`Enterprise`, tierId: "tier-enterprise" },
   ];
 
+  const CellValue = ({
+    value,
+    label,
+  }: {
+    value: string | boolean | { text: string; highlight?: boolean; highlightFirstWord?: boolean };
+    label: string;
+  }) => {
+    if (typeof value === "object" && value !== null) {
+      const { text, highlight, highlightFirstWord } = value;
+
+      if (highlightFirstWord) {
+        const spaceIndex = text.indexOf(" ");
+        const firstWord = spaceIndex === -1 ? text : text.slice(0, spaceIndex);
+        const rest = spaceIndex === -1 ? "" : text.slice(spaceIndex);
+        return (
+          <div className="flex items-center gap-2.5">
+            <HiCheckCircle className="mt-0.5 h-4 w-4 shrink-0 text-light-1000 dark:text-dark-1000" />
+            <span className="text-sm font-medium">
+              <span className="text-light-1000 dark:text-dark-1000">{firstWord}</span>
+              <span className="text-light-950 dark:text-dark-800">{rest}</span>
+            </span>
+          </div>
+        );
+      }
+
+      return (
+        <div className="flex items-center gap-2.5">
+          <HiCheckCircle
+            className={twMerge(
+              "mt-0.5 h-4 w-4 shrink-0",
+              highlight
+                ? "text-light-1000 dark:text-dark-1000"
+                : "text-light-400 dark:text-dark-600",
+            )}
+          />
+          <span
+            className={twMerge(
+              "text-sm font-medium",
+              highlight
+                ? "text-light-1000 dark:text-dark-950"
+                : "text-light-950 dark:text-dark-800",
+            )}
+          >
+            {text}
+          </span>
+        </div>
+      );
+    }
+
+    if (value) {
+      return (
+        <div className="flex items-center gap-2.5">
+          <HiCheckCircle className="mt-0.5 h-4 w-4 shrink-0 text-light-1000 dark:text-dark-1000" />
+          <span className="text-sm font-medium text-light-1000 dark:text-dark-950">
+            {label}
+          </span>
+        </div>
+      );
+    }
+
+    return (
+      <div className="flex items-center gap-2.5">
+        <HiXCircle className="mt-0.5 h-4 w-4 shrink-0 text-light-400 dark:text-dark-600" />
+        <span className="text-sm font-medium text-light-800 dark:text-dark-800">
+          {label}
+        </span>
+      </div>
+    );
+  };
+
+  const getFeatureValue = (
+    feature: PlanFeature,
+    planId: string,
+  ): string | boolean | { text: string; highlight?: boolean; highlightFirstWord?: boolean } => {
+    switch (planId) {
+      case "free":
+        return feature.free;
+      case "teams":
+        return feature.teams;
+      case "pro":
+        return feature.pro;
+      case "enterprise":
+        return feature.enterprise;
+      default:
+        return false;
+    }
+  };
+
   return (
-    <section aria-labelledby="comparison-heading" className="w-full px-4">
-      <div className="mx-auto max-w-6xl py-8 lg:py-10">
-        <div className="grid grid-cols-3 gap-x-8 border-t border-light-500 before:block dark:border-dark-300">
-          {products.map((product) => (
-            <div key={product.id} aria-hidden="true" className="-mt-px">
-              <div
-                className={`${product.featured ? "border-dark-200 dark:border-dark-800" : "border-transparent"} border-t-2 pt-8`}
-              >
-                <p
-                  className={`${product.featured ? "text-dark-50 dark:text-dark-1000" : "text-light-1000 dark:text-dark-1000"} text-center text-sm font-semibold`}
-                >
-                  {product.name}
-                </p>
+    <section aria-labelledby="comparison-heading" className="w-full">
+      <div className="mx-auto max-w-7xl">
+        <div
+          ref={containerRef}
+          className="relative overflow-x-auto rounded-lg border border-light-300 bg-light-50 dark:border-dark-300 dark:bg-dark-50"
+        >
+          {isHeaderFixed && (
+            <div
+              className="hidden sm:block fixed z-40 border-b border-light-300 bg-light-50/95 dark:border-dark-400 dark:bg-dark-50/95"
+              style={{
+                top: 64,
+                left: headerRect.left,
+                width: headerRect.width,
+              }}
+            >
+              <div className="grid grid-cols-4 border-x border-light-300 dark:border-dark-300">
+                {plans.map((plan) => {
+                  const isMostPopular = plan.id === "pro";
+                  return (
+                    <div
+                      key={`fixed-${plan.id}`}
+                      className={twMerge(
+                        "flex items-center px-6 py-3 text-left text-base font-semibold",
+                        isMostPopular
+                          ? "bg-light-200 text-light-1000 dark:bg-dark-100 dark:text-dark-1000"
+                          : "bg-light-50 text-dark-50 dark:bg-dark-50 dark:text-dark-1000",
+                      )}
+                    >
+                      {plan.name}
+                      {plan.id === "pro" && <span className="ml-1 text-xl">∞</span>}
+                    </div>
+                  );
+                })}
               </div>
             </div>
-          ))}
-        </div>
-
-        <div className="-mt-6 space-y-12">
-          {sections.map((section) => (
-            <div key={section.name}>
-              <h4 className="text-sm font-semibold text-light-1000 dark:text-dark-1000">
-                {section.name}
-              </h4>
-              <div className="relative -mx-8 mt-8">
-                <div
-                  aria-hidden="true"
-                  className="absolute inset-x-8 inset-y-0 grid grid-cols-3 gap-x-8 before:block"
-                >
-                  {products.map((product) => (
-                    <div
-                      key={product.id}
-                      className={`size-full rounded-lg ${product.featured ? "bg-white shadow-sm dark:bg-dark-50 dark:shadow-none" : ""}`}
-                    />
-                  ))}
-                </div>
-
-                <table className="relative w-full border-separate border-spacing-x-8">
-                  <thead>
-                    <tr className="text-left">
-                      <th scope="col">
-                        <span className="sr-only">{t`Feature`}</span>
-                      </th>
-                      {products.map((p) => (
-                        <th key={p.id} scope="col">
-                          <span className="sr-only">{p.name}</span>
-                        </th>
-                      ))}
-                    </tr>
-                  </thead>
-                  <tbody>
-                    {section.features.map((feature, featureIdx) => (
-                      <tr key={feature.key}>
-                        <th
-                          scope="row"
-                          className="w-1/3 py-3 pr-4 text-left text-sm font-normal text-light-1000 dark:text-dark-1000"
-                        >
-                          {feature.label}
-                          {featureIdx !== section.features.length - 1 ? (
-                            <div className="absolute inset-x-8 mt-3 h-px bg-light-500 dark:bg-dark-300" />
-                          ) : null}
-                        </th>
-                        {products.map((p) => (
+          )}
+          <table className="w-full border-separate border-spacing-0">
+            <thead>
+              <tr>
+                {plans.map((plan) => {
+                  const isMostPopular = plan.id === "pro";
+                  return (
+                    <th
+                      key={plan.id}
+                      scope="col"
+                      className={twMerge(
+                        "w-1/4 px-6 py-4 text-left text-base font-semibold",
+                        isMostPopular
+                          ? "bg-light-200 text-light-1000 dark:bg-dark-100 dark:text-dark-1000"
+                          : "bg-light-50 text-dark-50 dark:bg-dark-50 dark:text-dark-1000",
+                      )}
+                    >
+                      <span className="flex items-center">
+                        {plan.name}
+                        {plan.id === "pro" && <span className="ml-1 text-xl">∞</span>}
+                      </span>
+                    </th>
+                  );
+                })}
+              </tr>
+            </thead>
+            <tbody>
+              {sections.map((section, sectionIdx) => (
+                <React.Fragment key={section.name || `section-${sectionIdx}`}>
+                  {section.name && (
+                    <tr>
+                      {plans.map((plan) => {
+                        const isPro = plan.id === "pro";
+                        return (
                           <td
-                            key={p.id}
-                            className="relative w-1/3 px-4 py-0 text-center"
+                            key={plan.id}
+                            className={twMerge(
+                              "border-t px-6 py-3 text-left text-sm font-semibold text-dark-900 dark:text-dark-900",
+                              isPro
+                                ? "border-light-400 bg-light-200 dark:border-dark-400 dark:bg-dark-100"
+                                : "border-light-300 bg-light-50 dark:border-dark-400 dark:bg-dark-50",
+                            )}
                           >
-                            <span className="relative inline-flex w-full items-center justify-center py-3">
-                              <CellValue
-                                value={
-                                  p.id === "kan" ? feature.kan : feature.trello
-                                }
-                              />
-                            </span>
+                            {plan.id === "free" ? section.name : ""}
                           </td>
-                        ))}
-                      </tr>
-                    ))}
-                  </tbody>
-                </table>
-
-                <div
-                  aria-hidden="true"
-                  className="pointer-events-none absolute inset-x-8 inset-y-0 grid grid-cols-3 gap-x-8 before:block"
-                >
-                  {products.map((product) => (
-                    <div
-                      key={product.id}
-                      className={`${product.featured ? "ring-1 ring-light-500 dark:ring-dark-800" : "ring-0"} rounded-2xl`}
-                    />
+                        );
+                      })}
+                    </tr>
+                  )}
+                  {section.features.map((feature) => (
+                    <tr key={feature.key}>
+                      {plans.map((plan) => {
+                        const isPro = plan.id === "pro";
+                        return (
+                          <td
+                            key={plan.id}
+                            className={twMerge(
+                              "w-1/4 border-t px-6 py-3 text-left",
+                              isPro
+                                ? "border-light-400 bg-light-200 dark:border-dark-400 dark:bg-dark-100"
+                                : "border-light-300 dark:border-dark-400",
+                            )}
+                          >
+                            <CellValue
+                              value={getFeatureValue(feature, plan.id)}
+                              label={feature.label}
+                            />
+                          </td>
+                        );
+                      })}
+                    </tr>
                   ))}
-                </div>
-              </div>
-            </div>
-          ))}
+                </React.Fragment>
+              ))}
+            </tbody>
+          </table>
         </div>
       </div>
     </section>

apps/web/src/views/pricing/components/PricingTiers.tsx

@@ -23,81 +23,115 @@ const Pricing = ({
 }) => {
   const tiers = [
     {
-      name: t`Individuals`,
-      id: "tier-individuals",
+      name: t`Free`,
+      id: "tier-free",
       href: "signup",
-      buttonText: t`Get Started`,
-      price: { monthly: t`Free`, annually: t`Free` },
-      description: t`Everything you need, free forever. Unlimited boards, unlimited lists, unlimited cards. Upgrade any time.`,
-      featureHeader: t`Free, forever`,
+      buttonText: t`Get started`,
+      price: { monthly: t`$0`, annually: t`$0` },
+      description: t`Free for everyone`,
+      bestFor: t`Best for individuals and solo creators getting started`,
+      featureHeader: undefined,
       features: [
-        t`1 user`,
-        t`Unlimited boards`,
-        t`Unlimited cards`,
-        t`Custom board templates`,
-        t`Checklists`,
+        { text: t`1 user` },
+        { text: t`Unlimited boards` },
+        { text: t`Unlimited cards` },
+        { text: t`Custom board templates` },
+        { text: t`Checklists` },
       ],
       showPrice: true,
+      ctaSubtext: undefined,
+      mostPopular: false,
+      highlighted: false,
     },
     {
       name: t`Teams`,
       id: "tier-teams",
       href: "signup",
-      buttonText: t`Get Started`,
-      price: { monthly: "$10.00", annually: "$8.00" },
-      description: t`Kan is better with a team. Perfect for small and growing teams looking to collaborate.`,
-      featureHeader: t`Everything in the free plan, plus:`,
+      buttonText: t`Get started`,
+      price: { monthly: "$10", annually: "$8" },
+      description: t`Perfect for small and growing teams looking to collaborate.`,
+      bestFor: t`Best for small and growing teams that need collaboration`,
+      featureHeader: undefined,
       features: [
-        t`Workspace members`,
-        t`Admin roles`,
-        t`Priority email support`,
-        t`Support the development of the project`,
+        { text: t`All Free features +` },
+        { text: t`Workspace members` },
+        { text: t`Invite links` },
+        { text: t`Unlimited file uploads` },
+        { text: t`Email notifications for mentions` },
+        { text: t`Priority email support` },
+      ],
+      highlighted: false,
+      showPrice: true,
+      showPriceSuffix: true,
+      ctaSubtext: t`14 day free trial · Switch plans or cancel anytime`,
+      mostPopular: false,
+    },
+    {
+      name: t`Pro`,
+      id: "tier-pro",
+      href: "signup",
+      buttonText: t`Get started`,
+      price: { monthly: "$29", annually: "$24" },
+      description: t`Unlimited seats and advanced features for growing teams.`,
+      bestFor: t`Best for teams that want to scale without limits`,
+      featureHeader: undefined,
+      features: [
+        { text: t`All Teams features +` },
+        { text: t`Unlimited members` },
+        { text: t`Custom workspace username` },
+        { text: t`Configurable user roles and permissions` },
+        { text: t`Custom branding` },
       ],
       highlighted: true,
       showPrice: true,
-      showPriceSuffix: true,
+      showPriceSuffix: false,
+      ctaSubtext: t`14 day free trial · Switch plans or cancel anytime`,
+      mostPopular: true,
     },
     {
-      name: t`Self Host`,
-      id: "tier-self-host",
-      href: "https://github.com/kanbn/kan",
-      buttonText: t`View docs`,
-      price: { monthly: "-", annually: "-" },
-      description: t`Host Kan on your own infrastructure. Ideal for organisations that need complete control over their data.`,
-      featureHeader: t`Complete control and ownership:`,
+      name: t`Enterprise`,
+      id: "tier-enterprise",
+      href: "mailto:support@kan.bn?subject=Enterprise Inquiry",
+      buttonText: t`Contact Sales`,
+      price: { monthly: t`Contact us`, annually: t`Contact us` },
+      description: t`Advanced security, compliance, and dedicated support for large organizations.`,
+      bestFor: t`Best for large organizations with advanced needs`,
+      featureHeader: undefined,
       features: [
-        t`Run on your own infrastructure`,
-        t`Own your data`,
-        t`Custom domain`,
+        { text: t`All Pro features +` },
+        { text: t`SAML SSO` },
+        { text: t`Advanced admin controls` },
+        { text: t`Dedicated account manager` },
+        { text: t`Custom SLA` },
+        { text: t`On-premise deployment option` },
       ],
+      highlighted: false,
+      showPrice: true,
+      showPriceSuffix: false,
+      ctaSubtext: undefined,
       mostPopular: false,
-      showPrice: false,
     },
   ];
 
   return (
     <>
-      <div className="flex flex-col items-center justify-center px-4 pb-10">
-        <div className="mt-14 flex flex-col items-center justify-center">
-          <div className="mb-8 flex items-center gap-2 rounded-full border bg-white px-4 py-1.5 text-center text-xs font-bold text-gray-800 dark:border-dark-300 dark:bg-dark-1000 dark:text-gray-800 lg:text-sm">
-            <HiBolt />
-            <p>{t`Launch offer: unlimited seats for just $29/month with Pro`}</p>
-          </div>
+      <div className="mx-auto max-w-7xl px-4">
+        <div className="mb-8 flex items-center justify-center">
           <fieldset aria-label={t`Payment frequency`}>
             <RadioGroup
               value={frequency}
               onChange={(value) => setFrequency(value)}
-              className="grid grid-cols-2 gap-x-1 rounded-full p-1 text-center text-xs/5 font-semibold ring-1 ring-inset ring-light-600 dark:ring-dark-600"
+              className="flex gap-1 rounded-lg border border-light-300 bg-light-50 p-1 dark:border-dark-300 dark:bg-dark-50"
             >
               {frequencies.map((option) => (
                 <Radio
                   key={option.value}
                   value={option}
                   className={twMerge(
-                    "cursor-pointer rounded-full px-2.5 py-1 text-xs transition-colors lg:text-sm",
+                    "cursor-pointer rounded-md px-4 py-1.5 text-sm font-medium transition-colors",
                     frequency?.value === option.value
-                      ? "bg-dark-50 text-white dark:bg-light-50 dark:text-dark-50"
-                      : "text-light-900 hover:bg-light-100 dark:hover:bg-dark-100",
+                      ? "bg-white text-light-1000 shadow-sm dark:bg-dark-100 dark:text-dark-1000"
+                      : "text-light-600 dark:text-dark-700",
                   )}
                 >
                   {option.label}
@@ -106,103 +140,129 @@ const Pricing = ({
             </RadioGroup>
           </fieldset>
         </div>
-      </div>
 
-      <div className="isolate mx-auto mb-10 grid max-w-md grid-cols-1 gap-8 px-4 lg:mx-0 lg:max-w-none lg:grid-cols-3">
+        <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
         {tiers.map((tier) => (
           <div
             key={tier.id}
             className={twMerge(
-              tier.highlighted
-                ? "bg-dark-50 ring-1 ring-dark-50 dark:ring-dark-800"
-                : "bg-light-50 ring-1 ring-light-300 dark:bg-dark-50 dark:ring-dark-300",
-              "rounded-3xl p-8 xl:p-10",
+              "relative flex h-full flex-col rounded-lg border p-6",
+              tier.mostPopular
+                ? "border-light-400 bg-light-200 dark:border-dark-400 dark:bg-dark-100"
+                : "border-light-300 bg-light-50 dark:border-dark-300 dark:bg-dark-50",
             )}
           >
-            <div className="flex items-center justify-between gap-x-4">
-              <h3
-                id={tier.id}
-                className={twMerge(
-                  tier.highlighted
-                    ? "text-dark-1000 dark:text-dark-1000"
-                    : "text-dark-50 dark:text-dark-1000",
-                  "text-lg/8 font-semibold",
+            {tier.id === "tier-pro" && (
+              <div className="absolute right-2 top-2 z-10">
+                <span className="inline-flex items-center gap-1 rounded-full border border-light-400 bg-light-100 px-3 py-1 text-center text-xs text-dark-600 dark:border-dark-400 dark:bg-dark-100 dark:text-dark-900">
+                  <HiBolt className="h-3 w-3 -ml-0.5" />
+                  {t`Launch offer`}
+                </span>
+              </div>
+            )}
+            <h3
+              id={tier.id}
+              className={twMerge(
+                "mb-4 flex items-center text-base font-semibold",
+                tier.mostPopular
+                  ? "text-light-1000 dark:text-dark-1000"
+                  : "text-light-1000 dark:text-dark-1000",
+              )}
+            >
+              {tier.name}
+              {tier.id === "tier-pro" && <span className="ml-1 text-xl leading-none">∞</span>}
+            </h3>
+            <div className="mb-4">
+              <p className="flex items-baseline gap-x-1">
+                <span
+                  className={twMerge(
+                    "text-2xl font-semibold",
+                    tier.mostPopular
+                      ? "text-light-1000 dark:text-dark-1000"
+                      : "text-light-1000 dark:text-dark-1000",
+                    !tier.showPrice && "opacity-0",
+                  )}
+                >
+                  {tier.price[frequency?.value ?? "monthly"]}
+                </span>
+                {tier.id === "tier-pro" && (
+                  <span
+                    className={twMerge(
+                      "text-2xl font-semibold line-through",
+                      tier.mostPopular
+                        ? "text-light-600 dark:text-dark-600"
+                        : "text-light-600 dark:text-dark-600",
+                    )}
+                  >
+                    {frequency?.value === "annually" ? "$79" : "$100"}
+                  </span>
                 )}
-              >
-                {tier.name}
-              </h3>
-              {tier.highlighted && (
-                <p className="rounded-full bg-light-50 px-2.5 py-1 text-[12px] font-semibold text-dark-500 dark:bg-dark-1000 dark:text-dark-50">
-                  {t`14 day free trial`}
-                </p>
+                {tier.showPriceSuffix && (
+                  <span className="text-sm font-normal text-dark-400 dark:text-dark-700">
+                    {frequency?.priceSuffix}
+                  </span>
+                )}
+                {tier.id === "tier-pro" && (
+                  <span className="text-sm font-normal text-dark-400 dark:text-dark-700">
+                    {t`/month`}
+                  </span>
+                )}
+              </p>
+            </div>
+            {tier.bestFor && (
+              <p className="mb-6 text-sm text-dark-400 dark:text-dark-700">
+                {tier.bestFor}
+              </p>
+            )}
+            <div className="mb-6">
+              {tier.id === "tier-enterprise" ? (
+                <a
+                  href={tier.href}
+                  aria-describedby={tier.id}
+                  className="block w-full rounded-md border border-dark-200 bg-transparent px-4 py-2 text-center text-sm font-medium text-dark-50 transition-colors hover:bg-dark-50 hover:text-light-50 dark:border-dark-300 dark:text-dark-1000 dark:hover:bg-dark-200"
+                >
+                  {tier.buttonText}
+                </a>
+              ) : (
+                <>
+                  <Link
+                    href={tier.href}
+                    aria-describedby={tier.id}
+                    className={twMerge(
+                      "block w-full rounded-md px-4 py-2 text-center text-sm font-medium transition-colors",
+                      tier.mostPopular
+                        ? "bg-dark-50 text-light-50 shadow-sm hover:bg-dark-100 dark:bg-dark-1000 dark:text-dark-50 dark:hover:bg-dark-900"
+                        : "border border-dark-200 bg-transparent text-dark-50 transition-colors hover:bg-dark-50 hover:text-light-50 dark:border-dark-300 dark:text-dark-1000 dark:hover:bg-dark-200",
+                    )}
+                  >
+                    {tier.buttonText}
+                  </Link>
+                </>
               )}
             </div>
-            <p
-              className={twMerge(
-                "mt-4 text-sm/6 text-dark-950 dark:text-dark-900",
-                tier.highlighted ? "text-light-100" : "text-dark-50",
-              )}
-            >
-              {tier.description}
-            </p>
-            <p className="mt-6 flex items-baseline gap-x-1">
-              <span
-                className={twMerge(
-                  "text-3xl font-semibold tracking-tight text-light-100",
-                  tier.highlighted
-                    ? "text-light-50 dark:text-dark-1000"
-                    : "text-gray-900 dark:text-dark-1000",
-                  !tier.showPrice && "opacity-0",
-                )}
-              >
-                {tier.price[frequency?.value ?? "monthly"]}
-              </span>
-              {tier.showPriceSuffix && (
-                <span className="text-sm/6 font-semibold text-light-50 dark:text-dark-900">
-                  {frequency?.priceSuffix}
-                </span>
-              )}
-            </p>
-            <Link
-              href={tier.href}
-              aria-describedby={tier.id}
-              className={twMerge(
-                tier.highlighted
-                  ? "bg-light-50 text-dark-50 shadow-sm dark:bg-dark-1000 dark:text-dark-50"
-                  : "bg-dark-50 text-light-50 dark:bg-dark-200 dark:text-dark-1000",
-                "mt-6 block rounded-md px-3 py-2 text-center text-sm/6 font-semibold focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600",
-              )}
-            >
-              {tier.buttonText}
-            </Link>
-            <p
-              className={twMerge(
-                "mt-8 text-sm/6 font-bold",
-                tier.highlighted
-                  ? "text-light-100 dark:text-dark-1000"
-                  : "text-dark-50 dark:text-dark-1000",
-              )}
-            >
-              {tier.featureHeader}
-            </p>
-            <ul
-              role="list"
-              className={twMerge(
-                "mt-2 space-y-3 text-sm/6 text-light-600",
-                tier.highlighted
-                  ? "text-light-100 dark:text-dark-1000"
-                  : "text-dark-50 dark:text-dark-1000",
-              )}
-            >
-              {tier.features.map((feature) => (
-                <li key={feature} className="flex items-center gap-x-3">
-                  <HiCheckCircle className="h-5 w-5" />
-                  {feature}
+            <ul role="list" className="space-y-2.5">
+              {tier.features.map((feature, index) => (
+                <li
+                  key={`${tier.id}-feature-${index}`}
+                  className="flex items-start gap-x-2.5"
+                >
+                  <HiCheckCircle
+                    className="mt-0.5 h-4 w-4 shrink-0 text-light-1000 dark:text-dark-1000"
+                  />
+                  <span className="text-sm text-dark-600 dark:text-dark-800">
+                    {feature.text}
+                  </span>
                 </li>
               ))}
             </ul>
           </div>
         ))}
+        </div>
+        <div className="mx-auto mt-8 max-w-3xl px-4 text-center">
+          <div className="inline-flex items-center gap-2 rounded-full border bg-light-50 px-4 py-1 text-center text-xs text-light-1000 dark:border-dark-300 dark:bg-dark-50 dark:text-dark-900">
+            <p>{t`14 day free trial · Switch plans or cancel anytime`}</p>
+          </div>
+        </div>
       </div>
     </>
   );

apps/web/src/views/pricing/index.tsx

@@ -43,8 +43,8 @@ export default function PricingView() {
             <p className="mt-4 text-center text-3xl font-bold text-light-1000 dark:text-dark-1000 lg:text-5xl">
               {t`Simple pricing`}
             </p>
-            <p className="text:md lg:text-md mt-6 max-w-[500px] text-center text-light-950 dark:text-dark-900">
-              {t`Get started for free, with no usage limits. For collaboration, upgrade to a plan that fits the size of your team.`}
+            <p className="text:md lg:text-md mt-6 max-w-[300px] text-center text-light-950 dark:text-dark-900">
+              {t`Start free. Upgrade as your team grows. No hidden fees, no contracts.`}
             </p>
           </div>
           <PricingTiers
@@ -59,23 +59,9 @@ export default function PricingView() {
         </div>
 
         <div className="pb-22 flex flex-col items-center justify-center px-4">
-          <div className="flex items-center gap-2 rounded-full border bg-light-50 px-4 py-1 text-center text-xs text-light-1000 dark:border-dark-300 dark:bg-dark-50 dark:text-dark-900 lg:text-sm">
-            <p>{t`Features`}</p>
-          </div>
+        
 
-          <p className="mt-4 text-center text-3xl font-bold text-light-1000 dark:text-dark-1000 lg:text-4xl">
-            {t`Feature breakdown`}
-          </p>
-          <p className="text-md lg:text-md my-4 max-w-[500px] text-center text-light-950 dark:text-dark-900">
-            {t`Compare our features to see why Kan is the best choice.`}
-          </p>
-          <div className="mt-2">
-            <Button variant="primary" href="/signup">
-              {t`Get started`}
-            </Button>
-          </div>
-
-          <div className="mt-10 w-full max-w-[900px]">
+          <div className="mt-10 w-full">
             <FeatureComparisonTable
               frequencyValue={frequency?.value ?? "annually"}
             />

apps/web/src/views/public/board/CardModal.tsx

@@ -1,12 +1,13 @@
 import { useRouter } from "next/router";
 import { t } from "@lingui/core/macro";
 import { useEffect, useRef, useState } from "react";
-import { HiXMark } from "react-icons/hi2";
+import { HiLink, HiXMark } from "react-icons/hi2";
 
 import Badge from "~/components/Badge";
 import Editor from "~/components/Editor";
 import LabelIcon from "~/components/LabelIcon";
 import { useModal } from "~/providers/modal";
+import { usePopup } from "~/providers/popup";
 import { api } from "~/utils/api";
 import ActivityList from "~/views/card/components/ActivityList";
 import { AttachmentThumbnails } from "~/views/card/components/AttachmentThumbnails";
@@ -23,10 +24,29 @@ export function CardModal({
 }) {
   const router = useRouter();
   const { closeModal, isOpen } = useModal();
+  const { showPopup } = usePopup();
   const [showFade, setShowFade] = useState(false);
   const [showTopFade, setShowTopFade] = useState(false);
   const scrollRef = useRef<HTMLDivElement>(null);
 
+  const handleCopyCardLink = async () => {
+    try {
+      await navigator.clipboard.writeText(window.location.href);
+      showPopup({
+        header: t`Link copied`,
+        icon: "success",
+        message: t`Card URL copied to clipboard`,
+      });
+    } catch (error) {
+      console.error(error);
+      showPopup({
+        header: t`Unable to copy link`,
+        icon: "error",
+        message: t`Please try again.`,
+      });
+    }
+  };
+
   const { data, isLoading } = api.card.byId.useQuery(
     {
       cardPublicId: cardPublicId ?? "",
@@ -65,33 +85,44 @@ export function CardModal({
         <div className="h-full p-8">
           <div className="mb-6">
             <div className="flex w-full items-center justify-between">
-              <button
-                className="absolute right-[2rem] top-[2rem] rounded p-1 hover:bg-light-300 focus:outline-none dark:hover:bg-dark-300"
-                onClick={(e) => {
-                  e.preventDefault();
-                  closeModal();
+              <div className="absolute right-[2rem] top-[2rem] flex items-center gap-1">
+                <button
+                  type="button"
+                  onClick={handleCopyCardLink}
+                  className="rounded p-1.5 transition-all hover:bg-light-200 focus:outline-none dark:hover:bg-dark-100"
+                  aria-label="Copy card link"
+                >
+                  <HiLink className="h-4 w-4 text-light-900 dark:text-dark-900" />
+                </button>
+                <button
+                  type="button"
+                  className="rounded p-1.5 transition-all hover:bg-light-200 focus:outline-none dark:hover:bg-dark-100"
+                  onClick={(e) => {
+                    e.preventDefault();
+                    closeModal();
 
-                  setTimeout(() => {
-                    void router.replace(
-                      {
-                        pathname: router.pathname,
-                        query: {
-                          ...router.query,
-                          workspaceSlug,
-                          boardSlug: [boardSlug],
+                    setTimeout(() => {
+                      void router.replace(
+                        {
+                          pathname: router.pathname,
+                          query: {
+                            ...router.query,
+                            workspaceSlug: workspaceSlug ?? "",
+                            boardSlug: [boardSlug ?? ""],
+                          },
                         },
-                      },
-                      undefined,
-                      { shallow: true },
-                    );
-                  }, 400);
-                }}
-              >
-                <HiXMark
-                  size={18}
-                  className="dark:text-dark-9000 text-light-900"
-                />
-              </button>
+                        undefined,
+                        { shallow: true },
+                      );
+                    }, 400);
+                  }}
+                >
+                  <HiXMark
+                    size={18}
+                    className="text-light-900 dark:text-dark-900"
+                  />
+                </button>
+              </div>
               {isLoading ? (
                 <div className="flex space-x-2">
                   <div className="h-[2.3rem] w-[300px] animate-pulse rounded-[5px] bg-light-300 dark:bg-dark-300" />

apps/web/src/views/public/board/index.tsx

@@ -30,7 +30,7 @@ export default function PublicBoardView() {
   const { showPopup } = usePopup();
   const [isRouteLoaded, setIsRouteLoaded] = useState(false);
   const { openModal } = useModal();
-  
+
   const { ref: scrollRef, onMouseDown } = useDragToScroll({
     enabled: true,
     direction: "horizontal",
@@ -70,30 +70,35 @@ export default function PublicBoardView() {
     },
   );
 
-  const CopyBoardLink = () => {
-    return (
-      <button
-        onClick={async () => {
-          try {
-            await navigator.clipboard.writeText(window.location.href);
-          } catch (error) {
-            console.error(error);
-          }
-
-          showPopup({
-            header: t`Link copied`,
-            icon: "success",
-            message: t`Board URL copied to clipboard`,
-          });
-        }}
-        className="rounded p-1.5 transition-all hover:bg-light-200 dark:hover:bg-dark-100"
-        aria-label={`Copy board URL`}
-      >
-        <HiLink className={`h-4 w-4 text-light-900 dark:text-dark-900`} />
-      </button>
-    );
+  const handleCopyBoardLink = async () => {
+    try {
+      await navigator.clipboard.writeText(window.location.href);
+      showPopup({
+        header: t`Link copied`,
+        icon: "success",
+        message: t`Board URL copied to clipboard`,
+      });
+    } catch (error) {
+      console.error(error);
+      showPopup({
+        header: t`Unable to copy link`,
+        icon: "error",
+        message: t`Please try again.`,
+      });
+    }
   };
 
+  const CopyBoardLink = () => (
+    <button
+      type="button"
+      onClick={handleCopyBoardLink}
+      className="rounded p-1.5 transition-all hover:bg-light-200 focus:outline-none dark:hover:bg-dark-100"
+      aria-label="Copy board URL"
+    >
+      <HiLink className="h-4 w-4 text-light-900 dark:text-dark-900" />
+    </button>
+  );
+
   const pathWithoutQuery = router.asPath.split("?")[0];
   const splitPath = pathWithoutQuery?.split("/") ?? [];
   const cardPublicId = splitPath.length > 3 ? splitPath[3] : null;

apps/web/src/views/settings/IntegrationsSettings.tsx

@@ -1,9 +1,13 @@
+import { zodResolver } from "@hookform/resolvers/zod";
 import { t } from "@lingui/core/macro";
 import { useEffect } from "react";
+import { useForm } from "react-hook-form";
 import { HiMiniArrowTopRightOnSquare } from "react-icons/hi2";
+import { z } from "zod";
 
 import Button from "~/components/Button";
 import FeedbackModal from "~/components/FeedbackModal";
+import Input from "~/components/Input";
 import Modal from "~/components/modal";
 import { NewWorkspaceForm } from "~/components/NewWorkspaceForm";
 import { PageHead } from "~/components/PageHead";
@@ -11,10 +15,28 @@ import { useModal } from "~/providers/modal";
 import { usePopup } from "~/providers/popup";
 import { api } from "~/utils/api";
 
+const githubTokenSchema = z.object({
+  token: z.string().min(1, { message: t`Token is required` }),
+});
+
+type GitHubTokenFormValues = z.infer<typeof githubTokenSchema>;
+
 export default function IntegrationsSettings() {
   const { modalContentType, isOpen } = useModal();
   const { showPopup } = usePopup();
 
+  const {
+    register,
+    handleSubmit,
+    formState: { isDirty, errors },
+    reset,
+  } = useForm<GitHubTokenFormValues>({
+    resolver: zodResolver(githubTokenSchema),
+    defaultValues: {
+      token: "",
+    },
+  });
+
   const {
     data: integrations,
     refetch: refetchIntegrations,
@@ -34,21 +56,25 @@ export default function IntegrationsSettings() {
       },
     );
 
+  const { data: githubStatus, refetch: refetchGithubStatus } =
+    api.integration.getGitHubStatus.useQuery();
+
   useEffect(() => {
     const handleFocus = () => {
-      refetchIntegrations();
+      void refetchIntegrations();
+      void refetchGithubStatus();
     };
     window.addEventListener("focus", handleFocus);
     return () => {
       window.removeEventListener("focus", handleFocus);
     };
-  }, [refetchIntegrations]);
+  }, [refetchIntegrations, refetchGithubStatus]);
 
   const { mutateAsync: disconnectTrello } =
     api.integration.disconnect.useMutation({
       onSuccess: () => {
-        refetchIntegrations();
-        refetchTrelloUrl();
+        void refetchIntegrations();
+        void refetchTrelloUrl();
         showPopup({
           header: t`Trello disconnected`,
           message: t`Your Trello account has been disconnected.`,
@@ -64,6 +90,49 @@ export default function IntegrationsSettings() {
       },
     });
 
+  const { mutateAsync: saveGithubToken, isPending: isSavingGithubToken } =
+    api.integration.saveGitHubToken.useMutation({
+      onSuccess: () => {
+        void refetchGithubStatus();
+        reset();
+        showPopup({
+          header: t`GitHub connected`,
+          message: t`Your GitHub account has been connected.`,
+          icon: "success",
+        });
+      },
+      onError: () => {
+        showPopup({
+          header: t`Error connecting GitHub`,
+          message: t`An error occurred while connecting your GitHub account.`,
+          icon: "error",
+        });
+      },
+    });
+
+  const onSubmitGithubToken = (data: GitHubTokenFormValues) => {
+    void saveGithubToken({ token: data.token });
+  };
+
+  const { mutateAsync: disconnectGithub } =
+    api.integration.disconnectGitHub.useMutation({
+      onSuccess: () => {
+        void refetchGithubStatus();
+        showPopup({
+          header: t`GitHub disconnected`,
+          message: t`Your GitHub account has been disconnected.`,
+          icon: "success",
+        });
+      },
+      onError: () => {
+        showPopup({
+          header: t`Error disconnecting GitHub`,
+          message: t`An error occurred while disconnecting your GitHub account.`,
+          icon: "error",
+        });
+      },
+    });
+
   return (
     <>
       <PageHead title={t`Settings | Integrations`} />
@@ -112,6 +181,51 @@ export default function IntegrationsSettings() {
         )}
       </div>
 
+      <div className="mb-8 border-t border-light-300 dark:border-dark-300">
+        <h2 className="mb-4 mt-8 text-[14px] font-bold text-neutral-900 dark:text-dark-1000">
+          {t`GitHub`}
+        </h2>
+        {!githubStatus?.connected ? (
+          <>
+            <p className="mb-4 text-sm text-neutral-500 dark:text-dark-900">
+              {t`Connect your GitHub account to import projects.`}
+            </p>
+            <form
+              onSubmit={handleSubmit(onSubmitGithubToken)}
+              className="flex gap-2"
+            >
+              <div className="mb-4 flex w-full max-w-[325px] items-center gap-2">
+                <Input
+                  type="password"
+                  placeholder="Personal Access Token"
+                  {...register("token")}
+                  errorMessage={errors.token?.message}
+                />
+              </div>
+              <div>
+                <Button
+                  variant="secondary"
+                  type="submit"
+                  disabled={!isDirty || isSavingGithubToken}
+                  isLoading={isSavingGithubToken}
+                >
+                  {t`Connect GitHub`}
+                </Button>
+              </div>
+            </form>
+          </>
+        ) : (
+          <>
+            <p className="mb-8 text-sm text-neutral-500 dark:text-dark-900">
+              {t`Your GitHub account is connected.`}
+            </p>
+            <Button variant="secondary" onClick={() => disconnectGithub()}>
+              {t`Disconnect GitHub`}
+            </Button>
+          </>
+        )}
+      </div>
+
       {/* Global modals */}
       <Modal
         modalSize="md"

apps/web/src/views/settings/components/UpdateWorkspaceUrlForm.tsx

@@ -33,7 +33,7 @@ const UpdateWorkspaceUrlForm = ({
       .min(3, {
         message: t`URL must be at least 3 characters long`,
       })
-      .max(24, { message: t`URL cannot exceed 24 characters` })
+      .max(64, { message: t`URL cannot exceed 64 characters` })
       .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/, {
         message: t`URL can only contain letters, numbers, and hyphens`,
       }),

cloud/docker-compose.yml

@@ -1,4 +1,17 @@
 services:
+  migrator:
+    image: ghcr.io/kanbn/kan-migrate:latest
+    container_name: ${MIGRATOR_CONTAINER_NAME:-kan-migrate}
+    build:
+      context: ..
+      dockerfile: apps/web/Dockerfile
+      target: migrate
+    networks:
+      - dokploy-network
+    environment:
+      - POSTGRES_URL=${POSTGRES_URL}
+    restart: "no"
+
   web:
     image: ghcr.io/kanbn/kan:latest
     container_name: ${CONTAINER_NAME:-kan-web}
@@ -9,6 +22,7 @@ services:
     build:
       context: ..
       dockerfile: apps/web/Dockerfile
+      target: web
       args:
         APP_VERSION: ${APP_VERSION:-}
     env_file:
@@ -79,6 +93,9 @@ services:
       - NEXT_PUBLIC_UMAMI_ID=${NEXT_PUBLIC_UMAMI_ID}
       - NEXT_PUBLIC_POSTHOG_KEY=${NEXT_PUBLIC_POSTHOG_KEY}
       - NEXT_PUBLIC_POSTHOG_HOST=${NEXT_PUBLIC_POSTHOG_HOST}
+    depends_on:
+      migrator:
+        condition: service_completed_successfully
 
 networks:
   dokploy-network:

docker-compose.yml

@@ -1,4 +1,20 @@
 services:
+  migrate:
+    image: ghcr.io/kanbn/kan-migrate:latest
+    container_name: ${CONTAINER_NAME:-kan-migrate}
+    networks:
+      - kan-network
+    build:
+      context: .
+      dockerfile: ./apps/web/Dockerfile
+      target: migrate
+    environment:
+      - POSTGRES_URL=${POSTGRES_URL}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: "no"
+
   web:
     image: ghcr.io/kanbn/kan:latest
     container_name: ${CONTAINER_NAME:-kan-web}
@@ -6,10 +22,10 @@ services:
       - "${WEB_PORT:-3000}:3000"
     networks:
       - kan-network
-      - dokploy-network
     build:
       context: .
-      dockerfile: ./apps/web/Dockerfile.new
+      dockerfile: ./apps/web/Dockerfile
+      target: web
     env_file:
       - .env
     environment:
@@ -107,7 +123,8 @@ services:
       - APPLE_CLIENT_SECRET=${APPLE_CLIENT_SECRET}
       - APPLE_APP_BUNDLE_IDENTIFIER=${APPLE_APP_BUNDLE_IDENTIFIER}
     depends_on:
-      - postgres
+      migrate:
+        condition: service_completed_successfully
     restart: unless-stopped
 
   postgres:
@@ -121,14 +138,17 @@ services:
       - 5432:5432
     volumes:
       - kan_postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U kan -d kan_db"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
     restart: unless-stopped
     networks:
       - kan-network
 
 networks:
   kan-network:
-  dokploy-network:
-    external: true
 
 volumes:
   kan_postgres_data:

packages/api/src/routers/attachment.ts

@@ -142,9 +142,18 @@ export const attachmentRouter = createTRPCRouter({
         createdBy: userId,
       });
 
+      if (!attachment) {
+        throw new TRPCError({
+          message: "Failed to create attachment",
+          code: "INTERNAL_SERVER_ERROR",
+        });
+      }
+
       await cardActivityRepo.create(ctx.db, {
         type: "card.updated.attachment.added",
         cardId: card.id,
+        attachmentId: attachment.id,
+        toTitle: input.originalFilename,
         createdBy: userId,
       });
 
@@ -206,6 +215,8 @@ export const attachmentRouter = createTRPCRouter({
       await cardActivityRepo.create(ctx.db, {
         type: "card.updated.attachment.removed",
         cardId: attachment.cardId,
+        attachmentId: attachment.id,
+        fromTitle: attachment.originalFilename,
         createdBy: userId,
       });
 

packages/api/src/routers/board.ts

@@ -34,6 +34,7 @@ export const boardRouter = createTRPCRouter({
       z.object({
         workspacePublicId: z.string().min(12),
         type: z.enum(["regular", "template"]).optional(),
+        archived: z.boolean().optional(),
       }),
     )
     .output(
@@ -65,7 +66,10 @@ export const boardRouter = createTRPCRouter({
         ctx.db,
         workspace.id,
         userId,
-        { type: input.type }
+        {
+          type: input.type,
+          archived: input.archived ?? false,
+        }
       );
 
       return result;
@@ -153,28 +157,51 @@ export const boardRouter = createTRPCRouter({
       // Generate presigned URLs for workspace member avatars
       const workspaceWithAvatarUrls = result.workspace
         ? {
-            ...result.workspace,
-            members: await Promise.all(
-              result.workspace.members.map(async (member) => {
-                if (!member.user?.image) {
-                  return member;
-                }
+          ...result.workspace,
+          members: await Promise.all(
+            result.workspace.members.map(async (member) => {
+              if (!member.user?.image) {
+                return member;
+              }
 
-                const avatarUrl = await generateAvatarUrl(member.user.image);
-                return {
-                  ...member,
-                  user: {
-                    ...member.user,
-                    image: avatarUrl,
-                  },
-                };
-              }),
-            ),
-          }
+              const avatarUrl = await generateAvatarUrl(member.user.image);
+              return {
+                ...member,
+                user: {
+                  ...member.user,
+                  image: avatarUrl,
+                },
+              };
+            }),
+          ),
+        }
         : result.workspace;
 
+      // Generate presigned URLs for card member avatars
+      const listsWithAvatarUrls = await Promise.all(
+        result.lists.map(async (list) => ({
+          ...list,
+          cards: await Promise.all(
+            list.cards.map(async (card) => ({
+              ...card,
+              members: await Promise.all(
+                card.members.map(async (member) => {
+                  if (!member.user?.image) return member;
+                  const avatarUrl = await generateAvatarUrl(member.user.image);
+                  return {
+                    ...member,
+                    user: { ...member.user, image: avatarUrl },
+                  };
+                }),
+              ),
+            })),
+          ),
+        })),
+      );
+
       return {
         ...result,
+        lists: listsWithAvatarUrls,
         workspace: workspaceWithAvatarUrls,
       };
     }),
@@ -195,7 +222,7 @@ export const boardRouter = createTRPCRouter({
         workspaceSlug: z
           .string()
           .min(3)
-          .max(24)
+          .max(64)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/),
         boardSlug: z
           .string()
@@ -438,7 +465,8 @@ export const boardRouter = createTRPCRouter({
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/)
           .optional(),
         visibility: z.enum(["public", "private"]).optional(),
-        favorite: z.boolean().optional()
+        favorite: z.boolean().optional(),
+        isArchived: z.boolean().optional(),
       }),
     )
     .output(z.object({ success: z.boolean() }).or(z.custom<Awaited<ReturnType<typeof boardRepo.update>>>()))
@@ -480,7 +508,7 @@ export const boardRouter = createTRPCRouter({
       }
 
       // Handle other updates (name, slug, visibility)
-      const hasOtherUpdates = input.name || input.slug || input.visibility !== undefined;
+      const hasOtherUpdates = input.name || input.slug || input.visibility !== undefined || input.isArchived !== undefined;
 
       if (!hasOtherUpdates) {
         // Only favorite was updated, return success
@@ -507,6 +535,7 @@ export const boardRouter = createTRPCRouter({
         slug: input.slug,
         boardPublicId: input.boardPublicId,
         visibility: input.visibility,
+        isArchived: input.isArchived,
       });
 
       if (!result)

packages/api/src/routers/card.ts

@@ -10,8 +10,13 @@ import * as workspaceRepo from "@kan/db/repository/workspace.repo";
 
 import { createTRPCRouter, protectedProcedure, publicProcedure } from "../trpc";
 import { mergeActivities } from "../utils/activities";
+import { sendMentionEmails } from "../utils/notifications";
 import { assertCanDelete, assertCanEdit, assertPermission } from "../utils/permissions";
 import { generateAttachmentUrl, generateAvatarUrl } from "@kan/shared/utils";
+import {
+  createCardWebhookPayload,
+  sendWebhooksForWorkspace,
+} from "../utils/webhook";
 
 export const cardRouter = createTRPCRouter({
   create: protectedProcedure
@@ -153,6 +158,43 @@ export const cardRouter = createTRPCRouter({
         await cardActivityRepo.bulkCreate(ctx.db, cardActivitesInsert);
       }
 
+      if (input.description) {
+        sendMentionEmails({
+          db: ctx.db,
+          cardPublicId: newCard.publicId,
+          commentHtml: input.description,
+          commenterUserId: userId,
+        }).catch((error) => {
+          console.error("Failed to send mention emails:", error);
+        });
+      }
+
+      // Fire webhooks (non-blocking)
+      sendWebhooksForWorkspace(
+        ctx.db,
+        list.workspaceId,
+        createCardWebhookPayload(
+          "card.created",
+          {
+            id: String(newCard.id),
+            title: input.title,
+            description: input.description,
+            dueDate: input.dueDate ?? null,
+            listId: String(newCard.listId),
+          },
+          {
+            boardId: list.boardPublicId,
+            boardName: list.boardName,
+            listName: list.name,
+            user: ctx.user
+              ? { id: ctx.user.id, name: ctx.user.name }
+              : undefined,
+          },
+        ),
+      ).catch((error) => {
+        console.error("Webhook delivery failed:", error);
+      });
+
       return newCard;
     }),
   addComment: protectedProcedure
@@ -215,6 +257,16 @@ export const cardRouter = createTRPCRouter({
         createdBy: userId,
       });
 
+      sendMentionEmails({
+        db: ctx.db,
+        cardPublicId: input.cardPublicId,
+        commentHtml: input.comment,
+        commenterUserId: userId,
+        commentId: newComment.id,
+      }).catch((error) => {
+        console.error("Failed to send mention emails:", error);
+      });
+
       return newComment;
     }),
   updateComment: protectedProcedure
@@ -295,6 +347,16 @@ export const cardRouter = createTRPCRouter({
         createdBy: userId,
       });
 
+      sendMentionEmails({
+        db: ctx.db,
+        cardPublicId: input.cardPublicId,
+        commentHtml: input.comment,
+        commenterUserId: userId,
+        commentId: updatedComment.id,
+      }).catch((error) => {
+        console.error("Failed to send mention emails:", error);
+      });
+
       return updatedComment;
     }),
   deleteComment: protectedProcedure
@@ -924,6 +986,15 @@ export const cardRouter = createTRPCRouter({
           fromDescription: existingCard.description ?? undefined,
           toDescription: input.description,
         });
+
+        sendMentionEmails({
+          db: ctx.db,
+          cardPublicId: input.cardPublicId,
+          commentHtml: input.description,
+          commenterUserId: userId,
+        }).catch((error) => {
+          console.error("Failed to send mention emails:", error);
+        });
       }
 
       if (
@@ -966,6 +1037,59 @@ export const cardRouter = createTRPCRouter({
         await cardActivityRepo.bulkCreate(ctx.db, activities);
       }
 
+      // Build changes object for webhook
+      const webhookChanges: Record<string, { from: unknown; to: unknown }> = {};
+      if (input.title && existingCard.title !== input.title) {
+        webhookChanges.title = { from: existingCard.title, to: input.title };
+      }
+      if (input.description && existingCard.description !== input.description) {
+        webhookChanges.description = {
+          from: existingCard.description,
+          to: input.description,
+        };
+      }
+      if (
+        input.dueDate !== undefined &&
+        previousDueDate?.getTime() !== input.dueDate?.getTime()
+      ) {
+        webhookChanges.dueDate = { from: previousDueDate, to: input.dueDate };
+      }
+      if (newListId && existingCard.listId !== newListId) {
+        webhookChanges.listId = { from: existingCard.listId, to: newListId };
+      }
+
+      // Fire webhooks (non-blocking)
+      sendWebhooksForWorkspace(
+        ctx.db,
+        card.workspaceId,
+        createCardWebhookPayload(
+          newListId && existingCard.listId !== newListId
+            ? "card.moved"
+            : "card.updated",
+          {
+            id: String(result.id),
+            title: result.title,
+            description: result.description,
+            dueDate: result.dueDate,
+            listId: String(newListId ?? existingCard.listId),
+          },
+          {
+            boardId: card.boardPublicId,
+            boardName: card.boardName,
+            listName: card.listName,
+            user: ctx.user
+              ? { id: ctx.user.id, name: ctx.user.name }
+              : undefined,
+            changes:
+              Object.keys(webhookChanges).length > 0
+                ? webhookChanges
+                : undefined,
+          },
+        ),
+      ).catch((error) => {
+        console.error("Webhook delivery failed:", error);
+      });
+
       return result;
     }),
   delete: protectedProcedure
@@ -1013,6 +1137,9 @@ export const cardRouter = createTRPCRouter({
         card.createdBy,
       );
 
+      // Fetch full card data before delete for webhook
+      const fullCard = await cardRepo.getByPublicId(ctx.db, input.cardPublicId);
+
       const deletedAt = new Date();
 
       await cardRepo.softDelete(ctx.db, {
@@ -1027,6 +1154,34 @@ export const cardRouter = createTRPCRouter({
         createdBy: userId,
       });
 
+      // Fire webhooks (non-blocking)
+      if (fullCard) {
+        sendWebhooksForWorkspace(
+          ctx.db,
+          card.workspaceId,
+          createCardWebhookPayload(
+            "card.deleted",
+            {
+              id: String(fullCard.id),
+              title: fullCard.title,
+              description: fullCard.description,
+              dueDate: fullCard.dueDate,
+              listId: String(fullCard.listId),
+            },
+            {
+              boardId: card.boardPublicId,
+              boardName: card.boardName,
+              listName: card.listName,
+              user: ctx.user
+                ? { id: ctx.user.id, name: ctx.user.name }
+                : undefined,
+            },
+          ),
+        ).catch((error) => {
+          console.error("Webhook delivery failed:", error);
+        });
+      }
+
       return { success: true };
     }),
 });

packages/api/src/routers/checklist.ts

@@ -81,6 +81,16 @@ export const checklistRouter = createTRPCRouter({
       return newChecklist;
     }),
   update: protectedProcedure
+    .meta({
+      openapi: {
+        summary: "Update a checklist",
+        method: "PUT",
+        path: "/checklists/{checklistPublicId}",
+        description: "Updates a checklist by its public ID",
+        tags: ["Cards"],
+        protect: true,
+      },
+    })
     .input(
       z.object({
         checklistPublicId: z.string().length(12),

packages/api/src/routers/import.ts

@@ -11,10 +11,12 @@ import * as labelRepo from "@kan/db/repository/label.repo";
 import * as listRepo from "@kan/db/repository/list.repo";
 import * as workspaceRepo from "@kan/db/repository/workspace.repo";
 import { colours } from "@kan/shared/constants";
-import { generateUID } from "@kan/shared/utils";
+import { generateSlug, generateUID } from "@kan/shared/utils";
 
 import { createTRPCRouter, protectedProcedure } from "../trpc";
 import { assertPermission } from "../utils/permissions";
+import { assertUserInWorkspace } from "../utils/auth";
+import { decryptToken } from "../utils/encryption";
 import { apiKeys, urls } from "./integration";
 
 export interface TrelloBoard {
@@ -50,6 +52,51 @@ interface TrelloCheckItem {
   pos: number;
 }
 
+interface GitHubProjectsResponse {
+  data: {
+    viewer: {
+      projectsV2: {
+        nodes?: { id: string; title: string }[];
+      };
+      organizations: {
+        nodes: {
+          projectsV2: {
+            nodes?: { id: string; title: string }[];
+          };
+        }[];
+      };
+    };
+  };
+  errors?: unknown[];
+}
+
+interface GitHubGraphQLResponse {
+  data?: {
+    node?: GitHubProjectV2Node;
+  };
+  errors?: unknown[];
+}
+
+interface GitHubProjectV2Node {
+  title: string;
+  field?: {
+    options?: { id: string; name: string }[];
+  };
+  areaField?: {
+    options?: { id: string; name: string; color: string }[];
+  };
+  items?: {
+    nodes: {
+      fieldValueByName?: { name: string };
+      areaValue?: { name: string };
+      content?: {
+        title?: string;
+        body?: string;
+      };
+    }[];
+  };
+}
+
 interface TrelloCard {
   id: string;
   name: string | null;
@@ -464,4 +511,436 @@ export const importRouter = createTRPCRouter({
         return { boardsCreated };
       }),
   }),
+  github: createTRPCRouter({
+    getProjects: protectedProcedure
+      .meta({
+        openapi: {
+          summary: "Get projects from GitHub",
+          method: "GET",
+          path: "/integrations/github/projects",
+          description: "Retrieves all projects from GitHub",
+          tags: ["Integrations"],
+          protect: true,
+        },
+      })
+      .input(z.void())
+      .output(z.array(z.object({ id: z.string(), name: z.string() })))
+      .query(async ({ ctx }) => {
+        const user = ctx.user;
+
+        if (!user)
+          throw new TRPCError({
+            message: "User not authenticated",
+            code: "UNAUTHORIZED",
+          });
+
+        const integration = await integrationsRepo.getProviderForUser(
+          ctx.db,
+          user.id,
+          "github",
+        );
+
+        if (!integration)
+          throw new TRPCError({
+            message: "GitHub token not found",
+            code: "UNAUTHORIZED",
+          });
+
+        const token = decryptToken(integration.accessToken);
+
+        // GraphQL query to fetch Projects V2 for the user and their organizations
+        const query = `
+          query {
+            viewer {
+              projectsV2(first: 20) {
+                nodes {
+                  id
+                  title
+                }
+              }
+              organizations(first: 10) {
+                nodes {
+                  projectsV2(first: 10) {
+                    nodes {
+                      id
+                      title
+                    }
+                  }
+                }
+              }
+            }
+          }
+        `;
+
+        const response = await fetch("https://api.github.com/graphql", {
+          method: "POST",
+          headers: {
+            Authorization: `token ${token}`,
+            "Content-Type": "application/json",
+            "User-Agent": "Kan-App",
+          },
+          body: JSON.stringify({ query }),
+        });
+
+        if (!response.ok) {
+          const errorText = await response.text();
+          console.error(
+            `GitHub API Error: ${response.status} ${response.statusText}`,
+          );
+          console.error(`GitHub API Response: ${errorText}`);
+
+          throw new TRPCError({
+            message: `Failed to fetch GitHub projects: ${response.status} ${response.statusText}`,
+            code: "INTERNAL_SERVER_ERROR",
+          });
+        }
+
+        const result = (await response.json()) as GitHubProjectsResponse;
+
+        if (result.errors) {
+          console.error("GitHub GraphQL Errors:", result.errors);
+          throw new TRPCError({
+            message: "Failed to fetch GitHub projects (GraphQL Error)",
+            code: "INTERNAL_SERVER_ERROR",
+          });
+        }
+
+        const userProjects = result.data.viewer.projectsV2.nodes ?? [];
+        const orgProjects = result.data.viewer.organizations.nodes.flatMap(
+          (org) => org.projectsV2.nodes ?? [],
+        );
+
+        const allProjects = [...userProjects, ...orgProjects];
+
+        return allProjects.map((project) => ({
+          id: project.id,
+          name: project.title,
+        }));
+      }),
+
+    importProjects: protectedProcedure
+      .meta({
+        openapi: {
+          summary: "Import projects from GitHub",
+          method: "POST",
+          path: "/imports/github/projects",
+          description: "Imports projects from GitHub",
+          tags: ["Imports"],
+          protect: true,
+        },
+      })
+      .input(
+        z.object({
+          projectIds: z.array(z.string()),
+          workspacePublicId: z.string().min(12),
+        }),
+      )
+      .output(z.object({ projectsImported: z.number() }))
+      .mutation(async ({ ctx, input }) => {
+        const userId = ctx.user?.id;
+        if (!userId) throw new TRPCError({ code: "UNAUTHORIZED" });
+
+        const integration = await integrationsRepo.getProviderForUser(
+          ctx.db,
+          userId,
+          "github",
+        );
+
+        if (!integration)
+          throw new TRPCError({
+            code: "UNAUTHORIZED",
+            message: "GitHub token not found",
+          });
+
+        const token = decryptToken(integration.accessToken);
+
+        const workspace = await workspaceRepo.getByPublicId(
+          ctx.db,
+          input.workspacePublicId,
+        );
+        if (!workspace)
+          throw new TRPCError({
+            code: "NOT_FOUND",
+            message: "Workspace not found",
+          });
+
+        await assertUserInWorkspace(ctx.db, userId, workspace.id);
+
+        const newImport = await importRepo.create(ctx.db, {
+          source: "github",
+          createdBy: userId,
+        });
+
+        if (!newImport) {
+          throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: "Failed to create import record",
+          });
+        }
+
+        const newImportId = newImport.id;
+        let projectsImported = 0;
+
+        for (const projectId of input.projectIds) {
+          // GraphQL query to fetch Project V2 details, status options, area options, and items
+          const query = `
+            query($id: ID!) {
+              node(id: $id) {
+                ... on ProjectV2 {
+                  title
+                  field(name: "Status") {
+                    ... on ProjectV2SingleSelectField {
+                      options {
+                        id
+                        name
+                      }
+                    }
+                  }
+                  areaField: field(name: "Area") {
+                    ... on ProjectV2SingleSelectField {
+                      options {
+                        id
+                        name
+                        color
+                      }
+                    }
+                  }
+                  items(first: 100) {
+                    nodes {
+                      fieldValueByName(name: "Status") {
+                        ... on ProjectV2ItemFieldSingleSelectValue {
+                          name
+                        }
+                      }
+                      areaValue: fieldValueByName(name: "Area") {
+                        ... on ProjectV2ItemFieldSingleSelectValue {
+                          name
+                        }
+                      }
+                      content {
+                        ... on Issue {
+                          title
+                          body
+                        }
+                        ... on PullRequest {
+                          title
+                          body
+                        }
+                        ... on DraftIssue {
+                          title
+                          body
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          `;
+
+          const response = await fetch("https://api.github.com/graphql", {
+            method: "POST",
+            headers: {
+              Authorization: `token ${token}`,
+              "Content-Type": "application/json",
+              "User-Agent": "Kan-App",
+            },
+            body: JSON.stringify({ query, variables: { id: projectId } }),
+          });
+
+          const result = (await response.json()) as GitHubGraphQLResponse;
+          if (result.errors || !result.data?.node) continue;
+
+          const projectData = result.data.node;
+          const statusOptions = projectData.field?.options ?? [];
+          const areaOptions = projectData.areaField?.options ?? [];
+          const items = projectData.items?.nodes ?? [];
+
+          const boardPublicId = generateUID();
+          const board = await boardRepo.create(ctx.db, {
+            publicId: boardPublicId,
+            name: projectData.title,
+            workspaceId: workspace.id,
+            slug: generateSlug(projectData.title),
+            createdBy: userId,
+            importId: newImportId,
+          });
+
+          if (!board) continue;
+
+          // Prepare Labels
+          const labelsInsert = areaOptions.map((option) => {
+            let colourCode = "#0d9488"; // Default Teal
+            const ghColor = option.color;
+
+            // Map GitHub colors to Kan colors
+            if (ghColor === "BLUE") colourCode = "#0284c7";
+            else if (ghColor === "GREEN") colourCode = "#65a30d";
+            else if (ghColor === "YELLOW") colourCode = "#ca8a04";
+            else if (ghColor === "ORANGE") colourCode = "#ea580c";
+            else if (ghColor === "RED") colourCode = "#dc2626";
+            else if (ghColor === "PINK") colourCode = "#db2777";
+            else if (ghColor === "PURPLE") colourCode = "#4f46e5";
+            else if (ghColor === "GRAY") colourCode = "#0d9488";
+
+            return {
+              publicId: generateUID(),
+              name: option.name,
+              colourCode,
+              createdBy: userId,
+              boardId: board.id,
+              importId: newImportId,
+            };
+          });
+
+          const createdLabels = await labelRepo.bulkCreate(
+            ctx.db,
+            labelsInsert,
+          );
+          const labelMap = new Map<string, number>();
+
+          createdLabels.forEach((label, index) => {
+            const originalName = areaOptions[index]?.name;
+            if (originalName) {
+              labelMap.set(originalName, label.id);
+            }
+          });
+
+          // Prepare Lists
+          const listsInsert: {
+            publicId: string;
+            name: string;
+            createdBy: string;
+            boardId: number;
+            index: number;
+            importId: number;
+          }[] = [];
+
+          if (statusOptions.length === 0) {
+            listsInsert.push({
+              publicId: generateUID(),
+              name: "To Do",
+              createdBy: userId,
+              boardId: board.id,
+              index: 0,
+              importId: newImportId,
+            });
+          } else {
+            statusOptions.forEach((option, index) => {
+              listsInsert.push({
+                publicId: generateUID(),
+                name: option.name,
+                createdBy: userId,
+                boardId: board.id,
+                index: index,
+                importId: newImportId,
+              });
+            });
+          }
+
+          const createdLists = await listRepo.bulkCreate(ctx.db, listsInsert);
+          const listIdMap = new Map<string, number>();
+          createdLists.forEach((list, index) => {
+            const originalName = listsInsert[index]?.name;
+            if (originalName) {
+              listIdMap.set(originalName, list.id);
+            }
+          });
+
+          // Prepare Cards
+          const itemsToInsert: {
+            item: NonNullable<
+              NonNullable<
+                NonNullable<GitHubProjectV2Node["items"]>["nodes"]
+              >[number]
+            >;
+            listId: number;
+            title: string;
+            description: string;
+          }[] = [];
+
+          for (const item of items) {
+            const statusName = item.fieldValueByName?.name;
+            const content = item.content ?? {};
+            const title = content.title ?? "Untitled Card";
+            const description = content.body ?? "";
+
+            let listId = statusName ? listIdMap.get(statusName) : undefined;
+
+            // Fallback to first list
+            if (!listId && createdLists.length > 0) {
+              listId = createdLists[0]?.id;
+            }
+
+            if (listId) {
+              itemsToInsert.push({
+                item,
+                listId,
+                title,
+                description,
+              });
+            }
+          }
+
+          const cardsInput = itemsToInsert.map((data, index) => ({
+            publicId: generateUID(),
+            title: data.title,
+            description: data.description,
+            createdBy: userId,
+            listId: data.listId,
+            index: index,
+            importId: newImportId,
+          }));
+
+          const createdCards = await cardRepo.bulkCreate(ctx.db, cardsInput);
+
+          // Create Activities
+          const activities = createdCards.map((card) => ({
+            type: "card.created" as const,
+            cardId: card.id,
+            createdBy: userId,
+          }));
+
+          if (activities.length > 0) {
+            await cardActivityRepo.bulkCreate(ctx.db, activities);
+          }
+
+          // Link Labels
+          const cardLabelRelations: { cardId: number; labelId: number }[] = [];
+          createdCards.forEach((card, index) => {
+            const originalItem = itemsToInsert[index]?.item;
+            const areaName = originalItem?.areaValue?.name;
+
+            if (areaName) {
+              const labelId = labelMap.get(areaName);
+              if (labelId) {
+                cardLabelRelations.push({
+                  cardId: card.id,
+                  labelId: labelId,
+                });
+              }
+            }
+          });
+
+          if (cardLabelRelations.length > 0) {
+            await cardRepo.bulkCreateCardLabelRelationships(
+              ctx.db,
+              cardLabelRelations,
+            );
+          }
+
+          projectsImported++;
+        }
+
+        if (projectsImported > 0 && newImportId) {
+          await importRepo.update(
+            ctx.db,
+            { status: "success" },
+            { importId: newImportId },
+          );
+        }
+
+        return { projectsImported };
+      }),
+  }),
 });

packages/api/src/routers/integration.ts

@@ -14,7 +14,65 @@ export const apiKeys = {
   trello: process.env.TRELLO_APP_API_KEY,
 };
 
+import { encryptToken } from "../utils/encryption";
+
 export const integrationRouter = createTRPCRouter({
+  saveGitHubToken: protectedProcedure
+    .input(z.object({ token: z.string() }))
+    .mutation(async ({ ctx, input }) => {
+      const user = ctx.user;
+
+      if (!user)
+        throw new TRPCError({
+          message: "User not authenticated",
+          code: "UNAUTHORIZED",
+        });
+
+      const encryptedToken = encryptToken(input.token);
+
+      const expiresAt = new Date();
+      expiresAt.setFullYear(expiresAt.getFullYear() + 1);
+
+      await integrationsRepo.createOrUpdateProvider(ctx.db, {
+        provider: "github",
+        userId: user.id,
+        accessToken: encryptedToken,
+        expiresAt,
+      });
+
+      return { success: true };
+    }),
+
+  disconnectGitHub: protectedProcedure.mutation(async ({ ctx }) => {
+    const user = ctx.user;
+
+    if (!user)
+      throw new TRPCError({
+        message: "User not authenticated",
+        code: "UNAUTHORIZED",
+      });
+
+    await integrationsRepo.deleteProviderForUser(ctx.db, user.id, "github");
+    return { success: true };
+  }),
+
+  getGitHubStatus: protectedProcedure.query(async ({ ctx }) => {
+    const user = ctx.user;
+
+    if (!user)
+      throw new TRPCError({
+        message: "User not authenticated",
+        code: "UNAUTHORIZED",
+      });
+
+    const connected = await integrationsRepo.isProviderAvailableForUser(
+      ctx.db,
+      user.id,
+      "github",
+    );
+    return { connected };
+  }),
+
   providers: protectedProcedure
     .meta({
       openapi: {
@@ -67,7 +125,7 @@ export const integrationRouter = createTRPCRouter({
         protect: true,
       },
     })
-    .input(z.object({ provider: z.enum(["trello"]) }))
+    .input(z.object({ provider: z.enum(["trello", "github"]) }))
     .output(z.object({}))
     .mutation(async ({ ctx, input }) => {
       const user = ctx.user;

packages/api/src/routers/member.ts

@@ -210,11 +210,12 @@ export const memberRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member)
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: `Member with public ID ${input.memberPublicId} not found`,
           code: "NOT_FOUND",
         });
+      }
 
       const deletedMember = await memberRepo.softDelete(ctx.db, {
         memberId: member.id,
@@ -720,7 +721,7 @@ export const memberRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",

packages/api/src/routers/permission.ts

@@ -133,7 +133,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",
@@ -209,7 +209,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",
@@ -274,7 +274,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",
@@ -339,7 +339,7 @@ export const permissionRouter = createTRPCRouter({
         input.memberPublicId,
       );
 
-      if (!member) {
+      if (!member || member.workspaceId !== workspace.id) {
         throw new TRPCError({
           message: "Member not found",
           code: "NOT_FOUND",

packages/api/src/routers/workspace.ts

@@ -160,7 +160,7 @@ export const workspaceRouter = createTRPCRouter({
         workspaceSlug: z
           .string()
           .min(3)
-          .max(24)
+          .max(64)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/),
       }),
     )
@@ -207,7 +207,7 @@ export const workspaceRouter = createTRPCRouter({
         slug: z
           .string()
           .min(3)
-          .max(24)
+          .max(64)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/)
           .optional(),
       }),
@@ -290,7 +290,7 @@ export const workspaceRouter = createTRPCRouter({
         slug: z
           .string()
           .min(3)
-          .max(24)
+          .max(64)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/)
           .optional(),
         description: z.string().min(3).max(280).optional(),
@@ -424,7 +424,7 @@ export const workspaceRouter = createTRPCRouter({
         workspaceSlug: z
           .string()
           .min(3)
-          .max(24)
+          .max(64)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/),
       }),
     )

packages/api/src/utils/encryption.ts

@@ -0,0 +1,53 @@
+import crypto from "crypto";
+
+const ALGORITHM = "aes-256-gcm";
+const SECRET_KEY = process.env.BETTER_AUTH_SECRET;
+
+if (!SECRET_KEY) {
+  throw new Error("Encryption key is missing. Set BETTER_AUTH_SECRET.");
+}
+
+// Ensure the key is exactly 32 bytes
+const key = crypto.createHash("sha256").update(String(SECRET_KEY)).digest();
+
+export const encryptToken = (text: string) => {
+  const iv = crypto.randomBytes(12); // 12 bytes is the recommended IV size for GCM
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+
+  // buffer concat is faster/cleaner for raw binary manipulation
+  const encrypted = Buffer.concat([
+    cipher.update(text, "utf8"),
+    cipher.final(),
+  ]);
+
+  const authTag = cipher.getAuthTag();
+
+  // Combine IV + AuthTag + EncryptedData into one buffer
+  // This saves space compared to storing them as separate hex strings
+  const combined = Buffer.concat([iv, authTag, encrypted]);
+
+  // Return as URL-safe Base64 (ideal for cookies)
+  return combined.toString("base64url");
+};
+
+export const decryptToken = (text: string) => {
+  // Convert URL-safe Base64 back to a Buffer
+  const combined = Buffer.from(text, "base64url");
+
+  // Extract the parts based on fixed lengths
+  // IV is 12 bytes (standard for GCM)
+  // AuthTag is 16 bytes (standard for GCM)
+  const iv = combined.subarray(0, 12);
+  const authTag = combined.subarray(12, 28);
+  const encryptedText = combined.subarray(28);
+
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+
+  // If the cookie was tampered with, this will throw an error
+  const decrypted = Buffer.concat([
+    decipher.update(encryptedText),
+    decipher.final(),
+  ]);
+  return decrypted.toString("utf8");
+};

packages/api/src/utils/notifications.ts

@@ -0,0 +1,133 @@
+import { env } from "next-runtime-env";
+
+import type { dbClient } from "@kan/db/client";
+import * as cardRepo from "@kan/db/repository/card.repo";
+import * as memberRepo from "@kan/db/repository/member.repo";
+import * as notificationRepo from "@kan/db/repository/notification.repo";
+import * as userRepo from "@kan/db/repository/user.repo";
+import * as workspaceRepo from "@kan/db/repository/workspace.repo";
+import { sendEmail } from "@kan/email";
+import { parseMentionsFromHTML } from "@kan/shared/utils";
+
+/**
+ * Sends mention notification emails to mentioned members
+ * Only sends emails for new mentions (checks notification table to avoid duplicates)
+ */
+export async function sendMentionEmails({
+  db,
+  cardPublicId,
+  commentHtml,
+  commenterUserId,
+  commentId,
+}: {
+  db: dbClient;
+  cardPublicId: string;
+  commentHtml: string;
+  commenterUserId: string;
+  commentId?: number;
+}) {
+  try {
+    // Parse mentions from HTML
+    const mentionPublicIds = parseMentionsFromHTML(commentHtml);
+    if (mentionPublicIds.length === 0) return;
+
+    // Get card with board information
+    const card = await cardRepo.getWithListAndMembersByPublicId(db, cardPublicId);
+    if (!card?.list.board) return;
+
+    const board = card.list.board;
+    const boardName = board.name;
+    const cardTitle = card.title;
+    const cardId = card.id;
+
+    // Get workspace ID from workspace publicId
+    const workspace = await workspaceRepo.getByPublicId(
+      db,
+      board.workspace.publicId,
+    );
+    if (!workspace?.id) return;
+
+    const workspaceId = workspace.id;
+
+    // Get commenter information
+    const commenter = await userRepo.getById(db, commenterUserId);
+    if (!commenter) return;
+
+    const commenterName = commenter.name?.trim() || commenter.email;
+
+    // Get mentioned members with full details (filtered by workspace)
+    const membersWithDetails = await memberRepo.getByPublicIdsWithUsers(
+      db,
+      mentionPublicIds,
+      workspaceId,
+    );
+
+    // Filter out the commenter
+    const membersToNotify = membersWithDetails.filter(
+      (member) => member.user?.id !== commenterUserId,
+    );
+
+    if (membersToNotify.length === 0) return;
+
+    const baseUrl = env("NEXT_PUBLIC_BASE_URL");
+    const cardUrl = `${baseUrl}/cards/${cardPublicId}`;
+
+    // Send emails to all mentioned members (only if notification doesn't exist)
+    await Promise.all(
+      membersToNotify.map(async (member) => {
+        const userId = member.user?.id;
+        const email = member.user?.email ?? member.email;
+
+        // Skip pending members (no userId) - they can be mentioned but won't receive emails
+        if (!userId || !email) return;
+
+        try {
+          // Check if notification already exists for this mention
+          const notificationExists = await notificationRepo.exists(db, {
+            userId,
+            cardId,
+            type: "mention",
+          });
+
+          // If notification already exists, skip sending email
+          if (notificationExists) {
+            return;
+          }
+
+          // Create notification record
+          await notificationRepo.create(db, {
+            type: "mention",
+            userId,
+            cardId,
+            commentId,
+          });
+
+          // Send email
+          await sendEmail(
+            email,
+            `${commenterName} mentioned you in a comment on ${cardTitle}`,
+            "MENTION",
+            {
+              commenterName,
+              boardName,
+              cardTitle,
+              cardUrl,
+            },
+          );
+        } catch (error) {
+          console.error("Failed to send mention email:", {
+            email,
+            cardPublicId,
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }),
+    );
+  } catch (error) {
+    console.error("Error sending mention emails:", {
+      cardPublicId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+

packages/api/src/utils/webhook.test.ts

@@ -0,0 +1,528 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+vi.mock("@kan/db/repository/webhook.repo", () => ({
+  getActiveByWorkspaceId: vi.fn(),
+}));
+
+import * as webhookRepo from "@kan/db/repository/webhook.repo";
+import {
+  sendWebhookToUrl,
+  sendWebhooksForWorkspace,
+  createCardWebhookPayload,
+  webhookUrlSchema,
+  type WebhookPayload,
+} from "./webhook";
+
+const mockGetActiveByWorkspaceId = webhookRepo.getActiveByWorkspaceId as ReturnType<typeof vi.fn>;
+
+describe("webhook utilities", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2024-01-15T12:00:00.000Z"));
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  describe("createCardWebhookPayload", () => {
+    it("creates a payload with required card fields", () => {
+      const payload = createCardWebhookPayload(
+        "card.created",
+        {
+          id: "card-123",
+          title: "Test Card",
+          listId: "list-456",
+        },
+        {
+          boardId: "board-789",
+        },
+      );
+
+      expect(payload.event).toBe("card.created");
+      expect(payload.timestamp).toBe("2024-01-15T12:00:00.000Z");
+      expect(payload.data.card).toEqual({
+        id: "card-123",
+        title: "Test Card",
+        description: undefined,
+        dueDate: null,
+        listId: "list-456",
+        boardId: "board-789",
+      });
+    });
+
+    it("includes optional card fields when provided", () => {
+      const dueDate = new Date("2024-02-01T10:00:00.000Z");
+      const payload = createCardWebhookPayload(
+        "card.updated",
+        {
+          id: "card-123",
+          title: "Test Card",
+          description: "A description",
+          dueDate,
+          listId: "list-456",
+        },
+        {
+          boardId: "board-789",
+        },
+      );
+
+      expect(payload.data.card.description).toBe("A description");
+      expect(payload.data.card.dueDate).toBe("2024-02-01T10:00:00.000Z");
+    });
+
+    it("includes board context when provided", () => {
+      const payload = createCardWebhookPayload(
+        "card.created",
+        {
+          id: "card-123",
+          title: "Test Card",
+          listId: "list-456",
+        },
+        {
+          boardId: "board-789",
+          boardName: "My Board",
+        },
+      );
+
+      expect(payload.data.board).toEqual({
+        id: "board-789",
+        name: "My Board",
+      });
+    });
+
+    it("includes list context when provided", () => {
+      const payload = createCardWebhookPayload(
+        "card.created",
+        {
+          id: "card-123",
+          title: "Test Card",
+          listId: "list-456",
+        },
+        {
+          boardId: "board-789",
+          listName: "To Do",
+        },
+      );
+
+      expect(payload.data.list).toEqual({
+        id: "list-456",
+        name: "To Do",
+      });
+    });
+
+    it("includes user context when provided", () => {
+      const payload = createCardWebhookPayload(
+        "card.created",
+        {
+          id: "card-123",
+          title: "Test Card",
+          listId: "list-456",
+        },
+        {
+          boardId: "board-789",
+          user: {
+            id: "user-111",
+            name: "John Doe",
+          },
+        },
+      );
+
+      expect(payload.data.user).toEqual({
+        id: "user-111",
+        name: "John Doe",
+      });
+    });
+
+    it("includes changes for card.updated events", () => {
+      const payload = createCardWebhookPayload(
+        "card.updated",
+        {
+          id: "card-123",
+          title: "Updated Title",
+          listId: "list-456",
+        },
+        {
+          boardId: "board-789",
+          changes: {
+            title: { from: "Old Title", to: "Updated Title" },
+          },
+        },
+      );
+
+      expect(payload.data.changes).toEqual({
+        title: { from: "Old Title", to: "Updated Title" },
+      });
+    });
+  });
+
+  describe("sendWebhookToUrl", () => {
+    const originalFetch = global.fetch;
+
+    beforeEach(() => {
+      global.fetch = vi.fn();
+    });
+
+    afterEach(() => {
+      global.fetch = originalFetch;
+    });
+
+    const mockPayload: WebhookPayload = {
+      event: "card.created",
+      timestamp: "2024-01-15T12:00:00.000Z",
+      data: {
+        card: {
+          id: "card-123",
+          title: "Test Card",
+          listId: "list-456",
+          boardId: "board-789",
+        },
+      },
+    };
+
+    describe("SSRF protection", () => {
+      it("blocks HTTP URLs", async () => {
+        const result = await sendWebhookToUrl("http://example.com/webhook", undefined, mockPayload);
+        expect(result.success).toBe(false);
+        expect(result.error).toContain("HTTPS");
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it("blocks localhost", async () => {
+        const result = await sendWebhookToUrl("https://localhost/webhook", undefined, mockPayload);
+        expect(result.success).toBe(false);
+        expect(result.error).toContain("Localhost");
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it("blocks 127.0.0.1", async () => {
+        const result = await sendWebhookToUrl("https://127.0.0.1/webhook", undefined, mockPayload);
+        expect(result.success).toBe(false);
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it("blocks cloud metadata endpoint", async () => {
+        const result = await sendWebhookToUrl("https://169.254.169.254/latest/meta-data/", undefined, mockPayload);
+        expect(result.success).toBe(false);
+        expect(result.error).toContain("metadata");
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it("blocks private 10.x.x.x IPs", async () => {
+        const result = await sendWebhookToUrl("https://10.0.0.1/webhook", undefined, mockPayload);
+        expect(result.success).toBe(false);
+        expect(result.error).toContain("Private");
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it("blocks private 192.168.x.x IPs", async () => {
+        const result = await sendWebhookToUrl("https://192.168.1.1/webhook", undefined, mockPayload);
+        expect(result.success).toBe(false);
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it("allows valid HTTPS URLs", async () => {
+        (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({ ok: true, status: 200 });
+        const result = await sendWebhookToUrl("https://example.com/webhook", undefined, mockPayload);
+        expect(result.success).toBe(true);
+        expect(global.fetch).toHaveBeenCalled();
+      });
+    });
+
+    it("sends POST request with correct headers", async () => {
+      (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+      });
+
+      await sendWebhookToUrl("https://example.com/webhook", undefined, mockPayload);
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        "https://example.com/webhook",
+        expect.objectContaining({
+          method: "POST",
+          headers: expect.objectContaining({
+            "Content-Type": "application/json",
+            "X-Webhook-Event": "card.created",
+            "X-Webhook-Timestamp": "2024-01-15T12:00:00.000Z",
+          }),
+          body: JSON.stringify(mockPayload),
+        }),
+      );
+    });
+
+    it("includes signature header when secret is provided", async () => {
+      (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+      });
+
+      await sendWebhookToUrl("https://example.com/webhook", "my-secret", mockPayload);
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        "https://example.com/webhook",
+        expect.objectContaining({
+          headers: expect.objectContaining({
+            "X-Webhook-Signature": expect.stringMatching(/^[a-f0-9]{64}$/),
+          }),
+        }),
+      );
+    });
+
+    it("returns success for 2xx responses", async () => {
+      (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+      });
+
+      const result = await sendWebhookToUrl(
+        "https://example.com/webhook",
+        undefined,
+        mockPayload,
+      );
+
+      expect(result).toEqual({ success: true, statusCode: 200 });
+    });
+
+    it("returns failure for non-2xx responses", async () => {
+      (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
+        ok: false,
+        status: 500,
+        statusText: "Internal Server Error",
+      });
+
+      const result = await sendWebhookToUrl(
+        "https://example.com/webhook",
+        undefined,
+        mockPayload,
+      );
+
+      expect(result).toEqual({
+        success: false,
+        statusCode: 500,
+        error: "500 Internal Server Error",
+      });
+    });
+
+    it("returns failure on network error", async () => {
+      (global.fetch as ReturnType<typeof vi.fn>).mockRejectedValueOnce(
+        new Error("Network error"),
+      );
+
+      const result = await sendWebhookToUrl(
+        "https://example.com/webhook",
+        undefined,
+        mockPayload,
+      );
+
+      expect(result).toEqual({
+        success: false,
+        error: "Network error",
+      });
+    });
+
+    it("returns timeout error when request takes too long", async () => {
+      (global.fetch as ReturnType<typeof vi.fn>).mockImplementationOnce(
+        () =>
+          new Promise((_, reject) => {
+            setTimeout(() => {
+              const error = new Error("Aborted");
+              error.name = "AbortError";
+              reject(error);
+            }, 15000);
+          }),
+      );
+
+      const resultPromise = sendWebhookToUrl(
+        "https://example.com/webhook",
+        undefined,
+        mockPayload,
+      );
+
+      // Advance timers to trigger the abort
+      vi.advanceTimersByTime(15000);
+
+      const result = await resultPromise;
+      expect(result).toEqual({
+        success: false,
+        error: "Request timed out",
+      });
+    });
+  });
+
+  describe("sendWebhooksForWorkspace", () => {
+    const originalFetch = global.fetch;
+
+    beforeEach(() => {
+      global.fetch = vi.fn();
+    });
+
+    afterEach(() => {
+      global.fetch = originalFetch;
+    });
+
+    const mockDb = {} as Parameters<typeof sendWebhooksForWorkspace>[0];
+
+    const mockPayload: WebhookPayload = {
+      event: "card.created",
+      timestamp: "2024-01-15T12:00:00.000Z",
+      data: {
+        card: {
+          id: "card-123",
+          title: "Test Card",
+          listId: "list-456",
+          boardId: "board-789",
+        },
+      },
+    };
+
+    it("sends to all active webhooks subscribed to the event", async () => {
+      mockGetActiveByWorkspaceId.mockResolvedValueOnce([
+        {
+          id: 1,
+          publicId: "wh-1",
+          url: "https://example.com/webhook1",
+          secret: "secret1",
+          events: ["card.created", "card.updated"],
+          active: true,
+        },
+        {
+          id: 2,
+          publicId: "wh-2",
+          url: "https://example.com/webhook2",
+          secret: null,
+          events: ["card.created"],
+          active: true,
+        },
+      ]);
+
+      (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValue({
+        ok: true,
+        status: 200,
+      });
+
+      await sendWebhooksForWorkspace(mockDb, 1, mockPayload);
+
+      // Event filtering now happens at DB level
+      expect(mockGetActiveByWorkspaceId).toHaveBeenCalledWith(
+        mockDb,
+        1,
+        "card.created",
+      );
+      expect(global.fetch).toHaveBeenCalledTimes(2);
+      expect(global.fetch).toHaveBeenCalledWith(
+        "https://example.com/webhook1",
+        expect.any(Object),
+      );
+      expect(global.fetch).toHaveBeenCalledWith(
+        "https://example.com/webhook2",
+        expect.any(Object),
+      );
+    });
+
+    it("does not send when no webhooks match the event (DB-level filtering)", async () => {
+      // DB-level event filter returns empty array when no webhooks match
+      mockGetActiveByWorkspaceId.mockResolvedValueOnce([]);
+
+      await sendWebhooksForWorkspace(mockDb, 1, mockPayload);
+
+      expect(mockGetActiveByWorkspaceId).toHaveBeenCalledWith(
+        mockDb,
+        1,
+        "card.created",
+      );
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    it("continues sending to other webhooks when one fails", async () => {
+      const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+      mockGetActiveByWorkspaceId.mockResolvedValueOnce([
+        {
+          id: 1,
+          publicId: "wh-1",
+          url: "https://example.com/webhook1",
+          secret: null,
+          events: ["card.created"],
+          active: true,
+        },
+        {
+          id: 2,
+          publicId: "wh-2",
+          url: "https://example.com/webhook2",
+          secret: null,
+          events: ["card.created"],
+          active: true,
+        },
+      ]);
+
+      (global.fetch as ReturnType<typeof vi.fn>)
+        .mockResolvedValueOnce({ ok: false, status: 500, statusText: "Error" })
+        .mockResolvedValueOnce({ ok: true, status: 200 });
+
+      await sendWebhooksForWorkspace(mockDb, 1, mockPayload);
+
+      expect(global.fetch).toHaveBeenCalledTimes(2);
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining("Webhook delivery failed"),
+      );
+
+      consoleSpy.mockRestore();
+    });
+
+    it("handles empty webhook list", async () => {
+      mockGetActiveByWorkspaceId.mockResolvedValueOnce([]);
+
+      await sendWebhooksForWorkspace(mockDb, 1, mockPayload);
+
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    it("catches and logs DB errors without throwing", async () => {
+      const consoleSpy = vi
+        .spyOn(console, "error")
+        .mockImplementation(() => {});
+      mockGetActiveByWorkspaceId.mockRejectedValueOnce(
+        new Error("DB connection failed"),
+      );
+
+      // Should not throw — the try/catch absorbs the error
+      await expect(
+        sendWebhooksForWorkspace(mockDb, 1, mockPayload),
+      ).resolves.toBeUndefined();
+
+      expect(consoleSpy).toHaveBeenCalledWith(
+        "Failed to send webhooks for workspace:",
+        expect.any(Error),
+      );
+
+      consoleSpy.mockRestore();
+    });
+  });
+
+  describe("webhookUrlSchema", () => {
+    it("accepts valid HTTPS URLs", () => {
+      expect(webhookUrlSchema.safeParse("https://example.com/webhook").success).toBe(true);
+    });
+
+    it("rejects HTTP URLs", () => {
+      const result = webhookUrlSchema.safeParse("http://example.com/webhook");
+      expect(result.success).toBe(false);
+    });
+
+    it("rejects localhost", () => {
+      const result = webhookUrlSchema.safeParse("https://localhost/webhook");
+      expect(result.success).toBe(false);
+    });
+
+    it("rejects private IPs", () => {
+      expect(webhookUrlSchema.safeParse("https://10.0.0.1/webhook").success).toBe(false);
+      expect(webhookUrlSchema.safeParse("https://192.168.1.1/webhook").success).toBe(false);
+    });
+
+    it("rejects cloud metadata endpoints", () => {
+      expect(webhookUrlSchema.safeParse("https://169.254.169.254/latest").success).toBe(false);
+    });
+  });
+});

packages/api/src/utils/webhook.ts

@@ -0,0 +1,258 @@
+import crypto from "crypto";
+import { z } from "zod";
+
+import type { dbClient } from "@kan/db/client";
+import type { WebhookEvent } from "@kan/db/schema";
+import * as webhookRepo from "@kan/db/repository/webhook.repo";
+
+export type WebhookEventType = WebhookEvent;
+
+export interface WebhookPayload {
+  event: WebhookEventType;
+  timestamp: string;
+  data: {
+    card: {
+      id: string;
+      title: string;
+      description?: string | null;
+      dueDate?: string | null; // ISO string after JSON serialization
+      listId: string;
+      boardId: string;
+    };
+    board?: {
+      id: string;
+      name: string;
+    };
+    list?: {
+      id: string;
+      name: string;
+    };
+    user?: {
+      id: string;
+      name: string | null;
+    };
+    changes?: Record<string, { from: unknown; to: unknown }>;
+  };
+}
+
+function generateSignature(payload: string, secret: string): string {
+  return crypto.createHmac("sha256", secret).update(payload).digest("hex");
+}
+
+/**
+ * Zod schema for webhook URLs with SSRF mitigation.
+ * Requires HTTPS and blocks private/internal IP ranges, localhost,
+ * and cloud metadata endpoints.
+ */
+export const webhookUrlSchema = z
+  .string()
+  .url()
+  .max(2048)
+  .refine(
+    (url) => {
+      try {
+        return new URL(url).protocol === "https:";
+      } catch {
+        return false;
+      }
+    },
+    { message: "Only HTTPS URLs are allowed" },
+  )
+  .refine(
+    (url) => {
+      try {
+        const hostname = new URL(url).hostname.toLowerCase();
+        return !(
+          hostname === "localhost" ||
+          hostname === "127.0.0.1" ||
+          hostname === "::1" ||
+          hostname === "0.0.0.0"
+        );
+      } catch {
+        return false;
+      }
+    },
+    { message: "Localhost URLs are not allowed" },
+  )
+  .refine(
+    (url) => {
+      try {
+        const hostname = new URL(url).hostname.toLowerCase();
+        return !(
+          hostname === "169.254.169.254" ||
+          hostname === "metadata.google.internal"
+        );
+      } catch {
+        return false;
+      }
+    },
+    { message: "Cloud metadata endpoints are not allowed" },
+  )
+  .refine(
+    (url) => {
+      try {
+        const hostname = new URL(url).hostname.toLowerCase();
+        const ipv4Match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(hostname);
+        if (ipv4Match) {
+          const [, a, b] = ipv4Match.map(Number);
+          if (
+            a === 10 ||
+            (a === 172 && b! >= 16 && b! <= 31) ||
+            (a === 192 && b === 168)
+          ) {
+            return false;
+          }
+        }
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    { message: "Private IP addresses are not allowed" },
+  );
+
+/**
+ * Send a webhook payload to a specific URL.
+ *
+ * SSRF note: URL validation (HTTPS-only, no private IPs, no cloud metadata)
+ * is enforced both here at delivery time and at webhook creation via
+ * webhookUrlSchema. This function is only reachable by workspace admins.
+ */
+export async function sendWebhookToUrl(
+  url: string,
+  secret: string | undefined,
+  payload: WebhookPayload,
+): Promise<{ success: boolean; statusCode?: number; error?: string }> {
+  const result = webhookUrlSchema.safeParse(url);
+  if (!result.success) {
+    return { success: false, error: result.error.issues[0]?.message };
+  }
+
+  const body = JSON.stringify(payload);
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    "X-Webhook-Event": payload.event,
+    "X-Webhook-Timestamp": payload.timestamp,
+  };
+
+  if (secret) {
+    headers["X-Webhook-Signature"] = generateSignature(body, secret);
+  }
+
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 10000);
+
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal,
+    });
+
+    clearTimeout(timeoutId);
+
+    if (!response.ok) {
+      return {
+        success: false,
+        statusCode: response.status,
+        error: `${response.status} ${response.statusText}`,
+      };
+    }
+
+    return { success: true, statusCode: response.status };
+  } catch (error) {
+    clearTimeout(timeoutId);
+
+    if (error instanceof Error && error.name === "AbortError") {
+      return { success: false, error: "Request timed out" };
+    }
+
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : "Unknown error",
+    };
+  }
+}
+
+/**
+ * Send webhook to all active webhooks for a workspace that are subscribed to the event.
+ * Wrapped in try/catch so callers using fire-and-forget don't risk unhandled rejections.
+ */
+export async function sendWebhooksForWorkspace(
+  db: dbClient,
+  workspaceId: number,
+  payload: WebhookPayload,
+): Promise<void> {
+  try {
+    // Get active webhooks for this workspace
+    const webhooks = await webhookRepo.getActiveByWorkspaceId(db, workspaceId);
+
+    // Filter webhooks that are subscribed to this specific event
+    const webhooksForEvent = webhooks.filter((webhook) =>
+      webhook.events.includes(payload.event),
+    );
+
+    // Send to all subscribed webhooks in parallel (fire and forget)
+    const promises = webhooksForEvent.map((webhook) =>
+      sendWebhookToUrl(webhook.url, webhook.secret ?? undefined, payload).then(
+        (result) => {
+          if (!result.success) {
+            console.error(
+              `Webhook delivery failed to ${webhook.url}: ${result.error}`,
+            );
+          }
+        },
+      ),
+    );
+
+    // Wait for all to complete but don't block on failures
+    await Promise.allSettled(promises);
+  } catch (error) {
+    console.error("Failed to send webhooks for workspace:", error);
+  }
+}
+
+export function createCardWebhookPayload(
+  event: WebhookEventType,
+  card: {
+    id: string;
+    title: string;
+    description?: string | null;
+    dueDate?: Date | null;
+    listId: string;
+  },
+  context: {
+    boardId: string;
+    boardName?: string;
+    listName?: string;
+    user?: {
+      id: string;
+      name: string | null;
+    };
+    changes?: Record<string, { from: unknown; to: unknown }>;
+  },
+): WebhookPayload {
+  return {
+    event,
+    timestamp: new Date().toISOString(),
+    data: {
+      card: {
+        id: card.id,
+        title: card.title,
+        description: card.description,
+        dueDate: card.dueDate?.toISOString() ?? null,
+        listId: card.listId,
+        boardId: context.boardId,
+      },
+      board: context.boardName
+        ? { id: context.boardId, name: context.boardName }
+        : undefined,
+      list: context.listName
+        ? { id: card.listId, name: context.listName }
+        : undefined,
+      user: context.user,
+      changes: context.changes,
+    },
+  };
+}

packages/auth/package.json

@@ -21,6 +21,7 @@
     "dev": "tsc",
     "format": "prettier --check . --ignore-path ../../.gitignore",
     "lint": "eslint",
+    "test": "vitest run",
     "typecheck": "tsc --noEmit --emitDeclarationOnly false"
   },
   "devDependencies": {

packages/auth/src/auth.ts

@@ -11,15 +11,14 @@ import { createPlugins } from "./plugins";
 import { configuredProviders } from "./providers";
 
 export const initAuth = (db: dbClient) => {
+  const baseURL = env("NEXT_PUBLIC_BASE_URL") || env("BETTER_AUTH_URL");
+  const trustedOrigins =
+    env("BETTER_AUTH_TRUSTED_ORIGINS")?.split(",").filter(Boolean) ?? [];
+
   return betterAuth({
     secret: env("BETTER_AUTH_SECRET"),
-    baseURL: env("NEXT_PUBLIC_BASE_URL"),
-    trustedOrigins: env("BETTER_AUTH_TRUSTED_ORIGINS")
-      ? [
-          env("NEXT_PUBLIC_BASE_URL") ?? "",
-          ...(env("BETTER_AUTH_TRUSTED_ORIGINS")?.split(",") ?? []),
-        ]
-      : [env("NEXT_PUBLIC_BASE_URL") ?? ""],
+    baseURL,
+    trustedOrigins: [...(baseURL ? [baseURL] : []), ...trustedOrigins],
     database: drizzleAdapter(db, {
       provider: "pg",
       schema: {
@@ -34,8 +33,10 @@ export const initAuth = (db: dbClient) => {
     },
     emailAndPassword: {
       enabled: env("NEXT_PUBLIC_ALLOW_CREDENTIALS")?.toLowerCase() === "true",
-      disableSignUp:
-        env("NEXT_PUBLIC_DISABLE_SIGN_UP")?.toLowerCase() === "true",
+      // Sign-up restriction is handled by the user.create.before database
+      // hook which checks for pending invitations, allowing invited users
+      // to register even when public sign-up is disabled.
+      disableSignUp: false,
       sendResetPassword: async (data) => {
         await sendEmail(data.user.email, "Reset Password", "RESET_PASSWORD", {
           resetPasswordUrl: data.url,

packages/auth/src/hooks.test.ts

@@ -0,0 +1,195 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("next-runtime-env", () => ({
+  env: vi.fn(),
+}));
+
+vi.mock("@kan/db/repository/member.repo", () => ({
+  getByEmailAndStatus: vi.fn(),
+  getByPublicId: vi.fn(),
+  acceptInvite: vi.fn(),
+}));
+
+vi.mock("@kan/db/repository/user.repo", () => ({
+  update: vi.fn(),
+}));
+
+vi.mock("@kan/email", () => ({
+  notificationClient: null,
+}));
+
+vi.mock("@kan/shared", () => ({
+  createEmailUnsubscribeLink: vi.fn(),
+  createS3Client: vi.fn(),
+}));
+
+vi.mock("@aws-sdk/client-s3", () => ({
+  PutObjectCommand: vi.fn(),
+}));
+
+vi.mock("@novu/api/models/components", () => ({
+  ChatOrPushProviderEnum: { Discord: "discord" },
+}));
+
+import { env } from "next-runtime-env";
+import * as memberRepo from "@kan/db/repository/member.repo";
+import { createDatabaseHooks } from "./hooks";
+
+const mockEnv = env as ReturnType<typeof vi.fn>;
+const mockGetByEmailAndStatus =
+  memberRepo.getByEmailAndStatus as ReturnType<typeof vi.fn>;
+
+const db = {} as Parameters<typeof createDatabaseHooks>[0];
+
+const fakeUser = {
+  id: "user-1",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  email: "test@example.com",
+  emailVerified: false,
+  name: "Test User",
+};
+
+describe("createDatabaseHooks", () => {
+  const hooks = createDatabaseHooks(db);
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe("user.create.before", () => {
+    it("allows sign-up when DISABLE_SIGN_UP is not set", async () => {
+      mockEnv.mockReturnValue(undefined);
+
+      const result = await hooks.user.create.before(fakeUser, {});
+      expect(result).toBe(true);
+      expect(mockGetByEmailAndStatus).not.toHaveBeenCalled();
+    });
+
+    it("allows sign-up when DISABLE_SIGN_UP is false", async () => {
+      mockEnv.mockImplementation((key: string) =>
+        key === "NEXT_PUBLIC_DISABLE_SIGN_UP" ? "false" : undefined,
+      );
+
+      const result = await hooks.user.create.before(fakeUser, {});
+      expect(result).toBe(true);
+      expect(mockGetByEmailAndStatus).not.toHaveBeenCalled();
+    });
+
+    it("blocks sign-up when disabled and user has no pending invitation", async () => {
+      mockEnv.mockImplementation((key: string) =>
+        key === "NEXT_PUBLIC_DISABLE_SIGN_UP" ? "true" : undefined,
+      );
+      mockGetByEmailAndStatus.mockResolvedValue(undefined);
+
+      const result = await hooks.user.create.before(fakeUser, {});
+      expect(result).toBe(false);
+      expect(mockGetByEmailAndStatus).toHaveBeenCalledWith(
+        db,
+        "test@example.com",
+        "invited",
+      );
+    });
+
+    it("allows sign-up when disabled but user has a pending invitation", async () => {
+      mockEnv.mockImplementation((key: string) =>
+        key === "NEXT_PUBLIC_DISABLE_SIGN_UP" ? "true" : undefined,
+      );
+      mockGetByEmailAndStatus.mockResolvedValue({
+        id: "member-1",
+        email: "test@example.com",
+        status: "invited",
+      });
+
+      const result = await hooks.user.create.before(fakeUser, {});
+      expect(result).toBe(true);
+      expect(mockGetByEmailAndStatus).toHaveBeenCalledWith(
+        db,
+        "test@example.com",
+        "invited",
+      );
+    });
+
+    it("blocks sign-up when disabled and invitation exists but domain is not allowed", async () => {
+      mockEnv.mockImplementation((key: string) =>
+        key === "NEXT_PUBLIC_DISABLE_SIGN_UP" ? "true" : undefined,
+      );
+      process.env.BETTER_AUTH_ALLOWED_DOMAINS = "acme.com";
+      mockGetByEmailAndStatus.mockResolvedValue({
+        id: "member-1",
+        email: "test@example.com",
+        status: "invited",
+      });
+
+      const result = await hooks.user.create.before(fakeUser, {});
+      expect(result).toBe(false);
+
+      delete process.env.BETTER_AUTH_ALLOWED_DOMAINS;
+    });
+
+    // The user.create.before hook fires for ALL sign-up paths including
+    // OIDC/social — verify invite bypass works regardless of auth method.
+    it("allows OIDC/social sign-up when disabled but user has a pending invitation", async () => {
+      mockEnv.mockImplementation((key: string) =>
+        key === "NEXT_PUBLIC_DISABLE_SIGN_UP" ? "true" : undefined,
+      );
+      const oidcUser = {
+        ...fakeUser,
+        id: "user-oidc",
+        email: "sso@corp.com",
+        image: "https://provider.com/avatar.jpg",
+      };
+      mockGetByEmailAndStatus.mockResolvedValue({
+        id: "member-2",
+        email: "sso@corp.com",
+        status: "invited",
+      });
+
+      const result = await hooks.user.create.before(oidcUser, {});
+      expect(result).toBe(true);
+      expect(mockGetByEmailAndStatus).toHaveBeenCalledWith(
+        db,
+        "sso@corp.com",
+        "invited",
+      );
+    });
+
+    it("blocks OIDC/social sign-up when disabled and user has no pending invitation", async () => {
+      mockEnv.mockImplementation((key: string) =>
+        key === "NEXT_PUBLIC_DISABLE_SIGN_UP" ? "true" : undefined,
+      );
+      const oidcUser = {
+        ...fakeUser,
+        id: "user-oidc",
+        email: "random@external.com",
+        image: "https://provider.com/avatar.jpg",
+      };
+      mockGetByEmailAndStatus.mockResolvedValue(undefined);
+
+      const result = await hooks.user.create.before(oidcUser, {});
+      expect(result).toBe(false);
+      expect(mockGetByEmailAndStatus).toHaveBeenCalledWith(
+        db,
+        "random@external.com",
+        "invited",
+      );
+    });
+
+    it("allows sign-up when disabled, invitation exists, and domain is allowed", async () => {
+      mockEnv.mockImplementation((key: string) =>
+        key === "NEXT_PUBLIC_DISABLE_SIGN_UP" ? "true" : undefined,
+      );
+      process.env.BETTER_AUTH_ALLOWED_DOMAINS = "example.com";
+      mockGetByEmailAndStatus.mockResolvedValue({
+        id: "member-1",
+        email: "test@example.com",
+        status: "invited",
+      });
+
+      const result = await hooks.user.create.before(fakeUser, {});
+      expect(result).toBe(true);
+
+      delete process.env.BETTER_AUTH_ALLOWED_DOMAINS;
+    });
+  });
+});

packages/auth/src/plugins.ts

@@ -5,9 +5,10 @@ import { magicLink } from "better-auth/plugins/magic-link";
 import type { dbClient } from "@kan/db/client";
 import * as memberRepo from "@kan/db/repository/member.repo";
 import * as subscriptionRepo from "@kan/db/repository/subscription.repo";
+import * as userRepo from "@kan/db/repository/user.repo";
 import * as workspaceRepo from "@kan/db/repository/workspace.repo";
-import { generateUID } from "@kan/shared/utils";
 import { sendEmail } from "@kan/email";
+import { generateUID } from "@kan/shared/utils";
 import { createStripeClient } from "@kan/stripe";
 
 import { socialProvidersPlugin } from "./providers";
@@ -133,20 +134,21 @@ export function createPlugins(db: dbClient) {
 
                 if (workspace?.id) {
                   await memberRepo.pauseAllMembers(db, workspace.id);
-                  
+
                   // Reset slug to publicId, or generate a UID if publicId is taken
                   let newSlug = workspace.publicId;
-                  
+
                   if (workspace.slug !== workspace.publicId) {
-                    const isPublicIdAvailable = await workspaceRepo.isWorkspaceSlugAvailable(
-                      db,
-                      workspace.publicId,
-                    );
+                    const isPublicIdAvailable =
+                      await workspaceRepo.isWorkspaceSlugAvailable(
+                        db,
+                        workspace.publicId,
+                      );
                     if (!isPublicIdAvailable) {
                       newSlug = generateUID();
                     }
                   }
-                  
+
                   await workspaceRepo.update(db, subscription.referenceId, {
                     plan: "free",
                     slug: newSlug,
@@ -171,18 +173,76 @@ export function createPlugins(db: dbClient) {
     magicLink({
       expiresIn: 60 * 60 * 24 * 7, // 7 days
       sendMagicLink: async ({ email, url }) => {
-        if (url.includes("type=invite")) {
-          await sendEmail(
-            email,
-            "Invitation to join workspace",
-            "JOIN_WORKSPACE",
-            {
-              magicLoginUrl: url,
-            },
+        try {
+          const decodedUrl = decodeURIComponent(url);
+          console.log("Sending magic link to:", email, "URL:", url);
+          console.log(
+            "Magic link contains invite:",
+            decodedUrl.includes("type=invite"),
           );
-        } else {
-          await sendEmail(email, "Sign in to kan.bn", "MAGIC_LINK", {
-            magicLoginUrl: url,
+          if (decodedUrl.includes("type=invite")) {
+            let inviterName = "";
+            let workspaceName = "";
+
+            try {
+              const urlObj = new URL(url);
+              const callbackUrl = urlObj.searchParams.get("callbackURL");
+              if (callbackUrl) {
+                const callbackParams = new URL(
+                  callbackUrl,
+                  process.env.NEXT_PUBLIC_BASE_URL,
+                ).searchParams;
+                const memberPublicId = callbackParams.get("memberPublicId");
+
+                if (memberPublicId) {
+                  const member = await memberRepo.getByPublicId(
+                    db,
+                    memberPublicId,
+                  );
+                  if (member) {
+                    const [workspace, inviter] = await Promise.all([
+                      workspaceRepo.getById(db, member.workspaceId),
+                      userRepo.getById(db, member.createdBy),
+                    ]);
+
+                    if (workspace) workspaceName = workspace.name;
+                    if (inviter) inviterName = inviter.name ?? "";
+                  }
+                }
+              }
+            } catch (error) {
+              console.error("Failed to fetch invite details:", error);
+            }
+
+            await sendEmail(
+              email,
+              workspaceName
+                ? `Invitation to join the workspace ${workspaceName}`
+                : "Invitation to join workspace",
+              "JOIN_WORKSPACE",
+              {
+                magicLoginUrl: url,
+                inviterName,
+                workspaceName,
+              },
+            );
+          } else {
+            await sendEmail(
+              email,
+              process.env.NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY === "true"
+                ? "Sign in to your account"
+                : "Sign in to Kan",
+              "MAGIC_LINK",
+              {
+                magicLoginUrl: url,
+              },
+            );
+          }
+        } catch (error) {
+          console.error("Error sending magic link:", {
+            email,
+            url,
+            error,
           });
         }
       },

packages/auth/vitest.config.ts

@@ -0,0 +1,14 @@
+import { defineConfig } from "vitest/config";
+import { resolve } from "path";
+
+export default defineConfig({
+  test: {
+    root: __dirname,
+    include: ["src/**/*.test.ts"],
+  },
+  resolve: {
+    alias: {
+      "@kan/db": resolve(__dirname, "../db/src"),
+    },
+  },
+});

packages/db/migrations/20260129210000_AddWorkspaceWebhooks.sql

@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS "workspace_webhooks" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"publicId" varchar(12) NOT NULL,
+	"workspaceId" bigint NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"url" varchar(2048) NOT NULL,
+	"secret" text,
+	"events" text NOT NULL,
+	"active" boolean DEFAULT true NOT NULL,
+	"createdBy" uuid NOT NULL,
+	"createdAt" timestamp DEFAULT now() NOT NULL,
+	"updatedAt" timestamp,
+	CONSTRAINT "workspace_webhooks_publicId_unique" UNIQUE("publicId")
+);
+--> statement-breakpoint
+ALTER TABLE "workspace_webhooks" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspace_webhooks_workspace_idx" ON "workspace_webhooks" USING btree ("workspaceId");--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "workspace_webhooks" ADD CONSTRAINT "workspace_webhooks_workspaceId_workspace_id_fk" FOREIGN KEY ("workspaceId") REFERENCES "public"."workspace"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "workspace_webhooks" ADD CONSTRAINT "workspace_webhooks_createdBy_user_id_fk" FOREIGN KEY ("createdBy") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;

packages/db/migrations/20260207214056_AddNotificationsTable.sql

@@ -0,0 +1,46 @@
+CREATE TYPE "public"."notification_type" AS ENUM('mention', 'workspace.member.added', 'workspace.member.removed', 'workspace.role.changed');--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "notification" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"publicId" varchar(12) NOT NULL,
+	"type" "notification_type" NOT NULL,
+	"userId" uuid NOT NULL,
+	"cardId" bigint,
+	"commentId" bigint,
+	"workspaceId" bigint,
+	"metadata" text,
+	"readAt" timestamp,
+	"createdAt" timestamp DEFAULT now() NOT NULL,
+	"deletedAt" timestamp,
+	CONSTRAINT "notification_publicId_unique" UNIQUE("publicId")
+);
+--> statement-breakpoint
+ALTER TABLE "notification" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_userId_user_id_fk" FOREIGN KEY ("userId") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_cardId_card_id_fk" FOREIGN KEY ("cardId") REFERENCES "public"."card"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_commentId_card_comments_id_fk" FOREIGN KEY ("commentId") REFERENCES "public"."card_comments"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "notification" ADD CONSTRAINT "notification_workspaceId_workspace_id_fk" FOREIGN KEY ("workspaceId") REFERENCES "public"."workspace"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_deleted_idx" ON "notification" USING btree ("userId","deletedAt");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_read_deleted_idx" ON "notification" USING btree ("userId","readAt","deletedAt");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_type_card_idx" ON "notification" USING btree ("userId","type","cardId");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_type_workspace_idx" ON "notification" USING btree ("userId","type","workspaceId");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "notification_user_created_idx" ON "notification" USING btree ("userId","createdAt");

packages/db/migrations/20260208033314_AddAttachmentToActivity.sql

@@ -0,0 +1,6 @@
+ALTER TABLE "card_activity" ADD COLUMN "attachmentId" bigint;--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "card_activity" ADD CONSTRAINT "card_activity_attachmentId_card_attachment_id_fk" FOREIGN KEY ("attachmentId") REFERENCES "public"."card_attachment"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;

packages/db/migrations/20260224105235_AddGitHubIntegrationSupport.sql

@@ -0,0 +1,2 @@
+ALTER TYPE "public"."source" ADD VALUE 'github';--> statement-breakpoint
+ALTER TABLE "integration" ALTER COLUMN "accessToken" SET DATA TYPE text;--> statement-breakpoint

packages/db/migrations/20260225195947_AddIsArchivedToBoard.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "board" ADD COLUMN "isArchived" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "board_is_archived_idx" ON "board" USING btree ("isArchived");