chore: new mobile version

Merge pull request #46 from Gimanh/feat/tv-mcp
feat: mcp and orgs
2026-09-12 05:49:01 +00:00 · 2026-05-04 00:09:27 +02:00 · 2026-04-21 10:13:11 +02:00 · 2026-04-21 10:12:42 +02:00 · 2026-04-20 08:51:24 +02:00 · 2026-04-19 21:28:55 +02:00
1059 changed files with 56689 additions and 9371 deletions
@@ -28,11 +28,11 @@ jobs:
          PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN_CLA }}
        with:
          path-to-signatures: 'signatures/cla.json'
-          path-to-document: 'https://github.com/Gimanh/test-cla1/blob/main/CLA/CLA.md'
+          path-to-document: 'https://github.com/Gimanh/taskview-community/blob/main/CLA/CLA.md'
          branch: 'cla-signatures'
          allowlist: bot*,dependabot[bot]
          custom-notsigned-prcomment: >
            Thank you for your contribution!
-            Please read the CLA: $pathToCLADocument
+            Please read the CLA: https://github.com/Gimanh/taskview-community/blob/main/CLA/CLA.md
            Then comment exactly:
            "I have read the CLA Document and I hereby sign the CLA"
@@ -35,4 +35,8 @@ tsconfig.app.tsbuildinfo
 customer-license
 !build-dockers.sh
 !build-docker-api.sh
-!build-docker-web.sh
+!build-docker-web.sh
+!entrypoint.sh
+!build-docker-migrations.sh
+*.private
+*.private*
@@ -0,0 +1 @@
+engine-strict=true
@@ -1,6 +1,6 @@
 # TaskView Source-Available License

-Version 1.0 – Draft (tailored for TaskView)
+Version 1.0

 ---

@@ -113,9 +113,14 @@ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMA

 For commercial licensing inquiries, contact:

-**[licensing@taskview.tech](mailto:licensing@taskview.tech)**
+**[support@taskview.tech](mailto:support@taskview.tech)**

 ## 10. Termination

 - Any violation of Sections 4 or 5 automatically terminates the rights granted under this License.
 - Rights may be reinstated if You cure the violation within 21 days and cease all prohibited use.
+
+--- 
+
+Copyright (c) 2026 Nikolai Giman
+All rights reserved.
@@ -5,6 +5,12 @@
 TaskView is a self-hosted project and task management platform focused on clarity, ownership, and control.
 TaskView is built for teams that want a transparent, self-hosted alternative to SaaS task managers.

+## Apps
+* [Docs](https://taskview.tech/docs/) 
+* [Web](https://app.taskview.tech/)  
+* [iOS](https://apps.apple.com/lk/app/taskview-todo-list-tasks/id6499107867)  
+* [Android](https://play.google.com/store/apps/details?id=com.handscreamgnl.taskview.app&hl=en)  
+
 It is designed for teams and individuals who want:  
 - full control over their data
 - transparent architecture
@@ -127,14 +133,18 @@ docker-compose up
 Make sure the image versions match the version defined in the root package.json.

 ## Roadmap
- Migrate api-server to BunJS
+
 - Plugin / extension system
- Migrate to NuxtUI or similar ui library
+- [X] Migrate to NuxtUI or similar ui library
 - Enterprise SSO and identity integrations
- Redesign
+- [X] Redesign
 - Desktop version


 Note for contributors: contributions are accepted under the CLA (see CONTRIBUTING.md). The Project is distributed under the TaskView Source-Available License.

-© TaskView
+---
+
+TaskView is developed and maintained by Nikolai Giman.
+
+Copyright © 2026 Nikolai Giman
@@ -11,6 +11,7 @@ DB_PORT=5432
 # Application
 APP_PORT=1401
 APP_URL=http://localhost:3000
+API_URL=http://localhost:1401

 # JWT Configuration
 JWT_SIGN=your_jwt_secret_here
@@ -25,4 +26,35 @@ SMTP_USERNAME=your_email@example.com
 SMTP_PASSWORD=your_smtp_password_here
 SMTP_ENCRYPTION=ssl
 SMTP_FROM_NAME=TaskView
-SMTP_FROM_EMAIL=your_email@example.com
+SMTP_FROM_EMAIL=your_email@example.com
+
+# Encryption (32-byte hex key for AES-256-GCM)
+# Generate a key: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+ENCRYPTION_KEY=
+
+# GitHub Integration OAuth (separate from login OAuth)
+GITHUB_INTEGRATION_CLIENT_ID=
+GITHUB_INTEGRATION_CLIENT_SECRET=
+GITHUB_INTEGRATION_CALLBACK_URL=http://localhost:1401/module/integrations/oauth/github/callback
+# For GitHub Enterprise, override these:
+# GITHUB_BASE_URL=https://github.yourcompany.com
+# GITHUB_API_URL=https://github.yourcompany.com/api/v3
+
+# GitLab Integration OAuth
+GITLAB_INTEGRATION_CLIENT_ID=
+GITLAB_INTEGRATION_CLIENT_SECRET=
+GITLAB_INTEGRATION_CALLBACK_URL=http://localhost:1401/module/integrations/oauth/gitlab/callback
+# For self-hosted GitLab, override these:
+# GITLAB_BASE_URL=https://gitlab.yourcompany.com
+# GITLAB_API_URL=https://gitlab.yourcompany.com/api/v4
+
+# Firebase Cloud Messaging (push notifications for mobile, optional)
+# Path to Firebase service account JSON file
+# FIREBASE_CREDENTIALS_PATH=./firebase-credentials.json
+
+# Centrifugo (real-time notifications, optional)
+# CENTRIFUGO_API_URL=http://localhost:8000
+# CENTRIFUGO_API_KEY=your_centrifugo_api_key_here
+# CENTRIFUGO_TOKEN_SECRET=your_centrifugo_token_secret_here
+# Public port that clients use to connect to Centrifugo (exposed port, not internal docker port)
+# CENTRIFUGO_PUBLIC_PORT=8000
@@ -5,14 +5,16 @@

 VERSION=$1

+if [ -z "$VERSION" ]; then
+    echo "Usage: ./build-docker-api.sh <version>"
+    echo "Example: ./build-docker-api.sh 1.17.0"
+    exit 1
+fi
+
 node -v

-# Build the server scripts for the docker container (obfuscated scripts)
-npm run vite-build-docker
-
-# Create the taskview-server.js file for running the server 
-# (taskview-server-api.jsc is bytecode file that will be created by bytenode when docker file is run)
-echo "const bytenode = require('bytenode');  require('./taskview-server-api.jsc');" > ./dist/taskview-server.js
+# Build the server scripts for the docker container
+npm run build:docker

 # Copy the production package.json to the dist folder
 cp ./production.package.json ./dist/package.json
@@ -20,14 +22,17 @@ cp ./production.package.json ./dist/package.json
 # Copy the production ecosystem.config.js to the dist folder
 cp ./production.ecosystem.config.js ./dist/ecosystem.config.js

-# Build the migration scripts for the docker container (obfuscated scripts)
-npm run vite-build-migration
-mkdir ./dist-migration/taskview
+# Build the migration scripts for the docker container
+npm run build:migration
+mkdir -p ./dist-migration/taskview
 cp -R ./src/migrations/taskview/* ./dist-migration/taskview
 node ./commands/copy-migration-files.js

+echo "Building docker image..."
 docker buildx build --platform=linux/amd64,linux/arm64 -t gimanhead/taskview-ce-api-server:$VERSION -t gimanhead/taskview-ce-api-server:latest . --load

 cd postgresql
 bash ./build-docker-migrations.sh $VERSION
-cd ..
+cd ..
+
+echo "Build complete! Image: gimanhead/taskview-ce-api-server:$VERSION"
@@ -0,0 +1,6 @@
+CENTRIFUGO_TOKEN_HMAC_SECRET_KEY=taskview-centrifugo-secret-change-me
+CENTRIFUGO_API_KEY=taskview-centrifugo-api-key-change-me
+CENTRIFUGO_ALLOWED_ORIGINS=*
+CENTRIFUGO_ADMIN=true
+CENTRIFUGO_ADMIN_PASSWORD=admin
+CENTRIFUGO_ADMIN_SECRET=admin-secret-change-me
@@ -16,6 +16,7 @@ SMTP_PASSWORD="smtp-password"
 SMTP_ENCRYPTION="ssl"
 SMTP_FROM_NAME="TaskViewApiServer"
 SMTP_FROM_EMAIL="smtp"
+CORS_ALLOWED_ORIGINS="http://localhost:5173,http://127.0.0.1:5173,http://localhost:3000,http://localhost:8888,http://127.0.0.1:3000,http://127.0.0.1:8888"

 # Constant value
 APP_URL="https://taskview.handscream.com"
@@ -0,0 +1,15 @@
+{
+  "allow_subscribe_for_client": true,
+  "user_personal_channel_namespace": "personal",
+  "namespaces": [
+    {
+      "name": "personal",
+      "presence": false,
+      "join_leave": false,
+      "history_size": 10,
+      "history_ttl": "300s",
+      "force_recovery": true,
+      "allow_subscribe_for_client": true
+    }
+  ]
+}
@@ -0,0 +1,15 @@
+services:
+  centrifugo:
+    image: centrifugo/centrifugo:v5
+    restart: unless-stopped
+    command: centrifugo -c config.json
+    env_file:
+      - ./.env.centrifugo
+    ports:
+      - "8000:8000"
+    volumes:
+      - ./centrifugo/config.json:/centrifugo/config.json
+    ulimits:
+      nofile:
+        soft: 65535
+        hard: 65535
@@ -14,7 +14,7 @@ services:
      timeout: 5s
      retries: 5
  migration:
-    image: gimanhead/taskview-ce-db-migration:1.18.0
+    image: gimanhead/taskview-ce-db-migration:latest
    restart: "no"
    depends_on:
      db:
@@ -23,12 +23,12 @@ services:
      - ./.env.taskview

  taskview-ce-webapp:
-    image: gimanhead/taskview-ce-webapp:1.18.0
+    image: gimanhead/taskview-ce-webapp:latest
    restart: "no"
    ports:
      - "8888:80"
  taskview-api-server:
-    image: gimanhead/taskview-ce-api-server:1.18.0
+    image: gimanhead/taskview-ce-api-server:latest
    restart: "no"
    ports:
      - "1725:1401"
@@ -1,10 +1,6 @@
-FROM node:20-bullseye-slim
+FROM node:24.12.0-alpine

-RUN apt-get update && apt-get install -y \
-    curl \
-    build-essential \
-    qemu-user-static \
-    && rm -rf /var/lib/apt/lists/*
+RUN apk add --no-cache curl

 RUN npm install pm2 -g

@@ -12,10 +8,7 @@ WORKDIR /usr/src/app

 COPY ./dist .

-RUN npm install
-RUN npm run byte
-RUN rm ./taskview-server-api.js
-RUN rm ./taskview-server-docker.js
+RUN npm install --omit=dev

 EXPOSE 1401

@@ -1,15 +1,14 @@
 {
  "name": "taskview-ce-api-server",
-  "version": "1.17.0",
+  "version": "1.42.5",
  "scripts": {
-    "byte": "bytenode --compile ./dist/taskview-server-api.js",
-    "vite-build": "vite build && javascript-obfuscator ./dist/taskview-server.js --output ./dist/taskview-server-api.js && npm run byte",
-    "vite-build-docker": "vite build --config ./vite.config.docker.mts && javascript-obfuscator ./dist/taskview-server-docker.js --output ./dist/taskview-server-api.js",
-    "vite-build-migration": "vite build --config ./vite.config-migration.mts",
-    "start": "bun run --watch ./server.ts",
-    "build": "bun build ./server.ts --outdir=dist --target=node",
-    "build-all": "bun build ./server.ts --outdir=dist --target=node --minify && javascript-obfuscator ./dist/server.js --output ./dist/taskview.js",
-    "start-prod": "NODE_ENV=production bun run --watch ./server.ts",
+    "dev": "bun run --watch ./server.ts",
+    "start": "NODE_ENV=production node ./dist/taskview-server.js",
+    "build": "vite build",
+    "build:packages": "pnpm --filter taskview-db-schemas build && pnpm --filter taskview-api build",
+    "build:docker": "pnpm run build:packages && vite build --config ./vite.config.docker.mts",
+    "build:migration": "vite build --config ./vite.config-migration.mts",
+    "build:all": "pnpm run build:docker && pnpm run build:migration",
    "test": "vitest",
    "type-check": "tsc --noEmit",
    "lint": "biome lint .",
@@ -21,18 +20,17 @@
    "@rollup/plugin-commonjs": "^28.0.1",
    "@rollup/plugin-node-resolve": "^15.3.0",
    "@types/bcrypt": "^5.0.2",
-    "@types/bun": "latest",
+    "@types/cookie-parser": "^1.4.10",
    "@types/cors": "^2.8.17",
    "@types/express": "^4.17.21",
    "@types/jsonwebtoken": "^9.0.7",
    "@types/node": "^22.10.3",
+    "@types/passport-apple": "^2.0.3",
    "@types/pg": "^8.15.5",
    "@types/semver": "^7.5.8",
+    "@types/ua-parser-js": "^0.7.39",
    "aws-sdk": "^2.1691.0",
-    "bytenode": "1.5.6",
-    "javascript-obfuscator": "^4.1.1",
    "mock-aws-s3": "^4.0.2",
-    "nexe": "^4.0.0-rc.6",
    "nock": "^13.5.5",
    "vite": "^5.4.9",
    "vite-plugin-node": "^4.0.0",
@@ -44,24 +42,41 @@
    "typescript": "^5.0.0"
  },
  "dependencies": {
+    "@node-saml/node-saml": "^5.1.0",
    "@types/bcryptjs": "^2.4.6",
+    "@types/passport": "^1.0.17",
+    "@types/passport-github2": "^1.2.9",
+    "@types/passport-google-oauth20": "^2.0.17",
    "@vitejs/plugin-legacy": "^5.4.2",
    "@vitejs/plugin-vue": "^5.1.4",
-    "axios": "^1.7.7",
+    "@xmldom/xmldom": "^0.9.9",
+    "axios": "1.13.5",
    "bcryptjs": "^2.4.3",
+    "cookie-parser": "^1.4.7",
    "cors": "^2.8.5",
    "dotenv": "^16.4.5",
    "drizzle-orm": "^0.44.4",
    "emailjs": "^4.0.3",
    "express": "4.21.0",
+    "firebase-admin": "^12.7.0",
    "helmet": "^7.1.0",
    "jsonwebtoken": "^9.0.2",
+    "openid-client": "^6.8.2",
+    "passport": "^0.7.0",
+    "passport-apple": "^2.0.2",
+    "passport-github2": "^0.1.12",
+    "passport-google-oauth20": "^2.0.0",
    "pg": "^8.16.3",
+    "pg-boss": "^12.14.0",
    "pino": "^9.4.0",
    "rotating-file-stream": "^3.2.5",
    "semver": "^7.6.3",
    "taskview-db-schemas": "workspace:^",
    "terser": "^5.36.0",
+    "ua-parser-js": "^2.0.9",
    "zod": "^3.23.8"
+  },
+  "engines": {
+    "node": ">=24 <25"
  }
-}
+}
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+VERSION=$1
+
+docker buildx build --platform=linux/amd64,linux/arm64 -t gimanhead/taskview-ce-db-migration:$VERSION -t gimanhead/taskview-ce-db-migration:latest . --load
@@ -1,5 +1,5 @@
-FROM node:20-slim
-RUN apt-get update && apt-get install -y postgresql-client && apt-get clean
+FROM node:24.12.0-alpine
+RUN apk add --no-cache postgresql-client

 # ENV DB_HOST=localhost
 # ENV DB_USER=tvdbuser
@@ -0,0 +1,34 @@
+#!/bin/sh
+# entrypoint.sh
+
+echo "Waiting for the database service to be ready..."
+
+# Wait for the database service to be ready
+until PGPASSWORD=$DB_PASSWORD psql -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" -c '\q'; do
+  >&2 echo "Postgres is unavailable - sleeping"
+  sleep 2
+done
+
+>&2 echo "Postgres is up - executing command"
+
+# Check if tables exist in the 'tasks' schema using SQL query.
+# 'count(*)' will return 0 if there are no tables.
+# We read this result and make a decision.
+TABLE_COUNT=$(PGPASSWORD=$DB_PASSWORD psql -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT count(*) FROM information_schema.tables WHERE table_schema = 'tasks';" | xargs)
+
+if [ "$TABLE_COUNT" -eq 0 ]; then
+  echo "No tables found in the 'tasks' schema. Running migration with --create."
+  node /app-migration/taskview-db-migration.js --create
+else
+  echo "Tables already exist in the 'tasks' schema ($TABLE_COUNT tables found). Running standard migration."
+  node /app-migration/taskview-db-migration.js
+fi
+
+# Check the exit code of the migration script
+if [ $? -ne 0 ]; then
+  >&2 echo "Migration failed! Exiting with an error."
+  exit 1
+else
+  >&2 echo "Migration successful!"
+  exit 0
+fi
@@ -1,9 +1,8 @@
 {
+    "name": "taskview-ce-api-server",
+    "version": "1.17.0",
    "scripts": {
-        "byte": "bytenode --compile ./taskview-server-api.js",
        "start": "pm2-runtime start ecosystem.config.js --env production"
    },
-    "dependencies": {
-        "bytenode": "1.5.6"
-    }
+    "dependencies": {}
 }
@@ -4,8 +4,21 @@ import helmet from 'helmet';
 import { appUserMiddleware } from './middlewares/app-user-middleware';
 import errorHandler from './middlewares/error-handler';
 import routes from './routes';
+import passport, { initPassportLogin } from './tv-modules/auth/strategies/passport-login';
+import cookieParser from 'cookie-parser';
+import { registerAllEventHandlers, startAllWorkers } from './core/all-events';

-const VRS = '1.18.0';
+const allow = new Set([
+    ...(process.env.CORS_REMOVE_DEFAULT_ALLOWED_ORIGINS === 'true' ? [] : [
+        // default allowed origins for official TaskView apps
+        "https://app.taskview.tech",
+        "https://taskview.handscream.com",
+        "capacitor://taskview.handscream.com",
+        "capacitor://app.taskview.tech",
+        "https://appleid.apple.com"
+    ]),
+    ...(process.env.CORS_ALLOWED_ORIGINS?.split(',') || []),
+]);

 export default class App {
    public app: express.Application;
@@ -15,11 +28,21 @@ export default class App {
        this.app = express();
        this.port = port;

+        this.extendApp();
+
        this.initializeMiddlewares();
+        registerAllEventHandlers();
        this.initializeRoutes();
        this.app.use(errorHandler);
+        this.app.use(passport.initialize());
+        initPassportLogin();
+
+        this.extendMiddlewares();
    }

+    protected extendApp(): void { }
+    protected extendMiddlewares(): void { }
+
    private initializeMiddlewares() {
        //add tvJson method, clien need response format like {response: data}
        this.app.use((_req: Request, res: Response, next) => {
@@ -29,10 +52,27 @@ export default class App {
            next();
        });

+        this.app.use(cookieParser());
        this.app.use(appUserMiddleware);
-        this.app.use(cors());
+
+        this.app.use(cors({
+            credentials: true,
+            origin(origin, cb) {
+                if (!origin || origin === 'null') return cb(null, true);
+                if (allow.has(origin)) return cb(null, true);
+                return cb(new Error(`CORS blocked origin: ${origin}`), false);
+            },
+        }));
+
        this.app.use(helmet());
-        this.app.use(express.json());
+        this.app.use(express.json({
+            verify: (req: any, _res, buf) => {
+                // Store raw body for webhook signature verification github and gitlab integrations
+                if (req.url?.includes('/webhook/')) {
+                    req.rawBody = buf;
+                }
+            },
+        }));
        this.app.use(express.urlencoded({ extended: true }));
    }

@@ -43,9 +83,9 @@ export default class App {
    }

    public listen() {
-        return this.app.listen(this.port, '0.0.0.0', () => {
+        return this.app.listen(this.port, '0.0.0.0', async () => {
            console.log(`Server is running on port ${this.port}`);
-            console.log(`Server version is ${VRS}`);
+            await startAllWorkers();
        });
    }
 }
@@ -7,6 +7,10 @@ import { KanbanManager } from '../tv-modules/kanban/KanbanManager';
 import { GoalListManager } from '../tv-modules/lists/GoalListManager';
 import { StartManager } from '../tv-modules/start/StartManager';
 import { TagsManager } from '../tv-modules/tags/TagsManager';
+import { IntegrationsManager } from '../tv-modules/integrations/IntegrationsManager';
+import { NotificationsManager } from '../tv-modules/notifications/NotificationsManager';
+import { OrganizationManager } from '../tv-modules/organizations/OrganizationManager';
+import { SsoManager } from '../tv-modules/sso/SsoManager';
 import { TasksManager } from '../tv-modules/tasks/TasksManager';
 import type { UserDbRecord, UserJwtPayload } from '../types/auth.types';
 import { GoalPermissionsFetcher } from './GoalPermissionsFetcher';
@@ -22,10 +26,17 @@ export class AppUser {
    public readonly tagsManager: TagsManager;
    public readonly authManager: AuthManager;
    private hasActiveToken: boolean = false;
+    private apiTokenAuth: boolean = false;
+    private tokenPermissions?: string[];
+    private allowedGoalIds?: number[];
    private userDataFromDb?: UserDbRecord;
    public readonly startManager: StartManager;
    public readonly kanbanManager: KanbanManager;
    public readonly graphManager: GraphManager;
+    public readonly integrationsManager: IntegrationsManager;
+    public readonly notificationsManager: NotificationsManager;
+    public readonly organizationManager: OrganizationManager;
+    public readonly ssoManager: SsoManager;

    constructor(userData?: UserJwtPayload) {
        this.userData = userData;
@@ -40,6 +51,10 @@ export class AppUser {
        this.startManager = new StartManager(this);
        this.kanbanManager = new KanbanManager(this);
        this.graphManager = new GraphManager(this);
+        this.integrationsManager = new IntegrationsManager(this);
+        this.notificationsManager = new NotificationsManager(this);
+        this.organizationManager = new OrganizationManager(this);
+        this.ssoManager = new SsoManager(this);
    }

    getTokenId(): number | undefined {
@@ -69,4 +84,26 @@ export class AppUser {
    isBlocked(): boolean {
        return this.userDataFromDb?.block !== 0;
    }
+
+    /**
+     * Use it for API token authentication.
+     * @param permissions Permissions that the API token has
+     */
+    setApiTokenAuth(permissions: string[], goalIds: number[]) {
+        this.apiTokenAuth = true;
+        this.tokenPermissions = permissions;
+        this.allowedGoalIds = goalIds;
+    }
+
+    isApiTokenAuth(): boolean {
+        return this.apiTokenAuth;
+    }
+
+    getAllowedGoalIds(): number[] | undefined {
+        return this.allowedGoalIds;
+    }
+
+    getTokenPermissions(): string[] | undefined {
+        return this.tokenPermissions;
+    }
 }
@@ -0,0 +1,77 @@
+import jwt from 'jsonwebtoken';
+import { $logger } from '../modules/logget';
+
+interface CentrifugoPublishPayload {
+    channel: string;
+    data: Record<string, unknown>;
+}
+
+export class CentrifugoClient {
+    private readonly apiUrl: string;
+    private readonly apiKey: string;
+    private readonly enabled: boolean;
+
+    constructor() {
+        const url = process.env.CENTRIFUGO_API_URL;
+        const key = process.env.CENTRIFUGO_API_KEY;
+        this.enabled = !!(url && key);
+        this.apiUrl = url || '';
+        this.apiKey = key || '';
+
+        if (!this.enabled) {
+            $logger.warn('[Centrifugo] Not configured — real-time notifications disabled');
+        }
+    }
+
+    async publish(channel: string, data: Record<string, unknown>): Promise<boolean> {
+        if (!this.enabled) return false;
+
+        try {
+            const payload: CentrifugoPublishPayload = { channel, data };
+            const response = await fetch(`${this.apiUrl}/api/publish`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `apikey ${this.apiKey}`,
+                },
+                body: JSON.stringify(payload),
+            });
+
+            if (!response.ok) {
+                $logger.error({ status: response.status }, '[Centrifugo] Publish failed');
+                return false;
+            }
+
+            return true;
+        } catch (err) {
+            $logger.error({ err }, '[Centrifugo] Publish error');
+            return false;
+        }
+    }
+
+    async publishToUser(userId: number, event: string, data: Record<string, unknown>): Promise<boolean> {
+        return this.publish(`personal:#${userId}`, { event, ...data });
+    }
+
+    isEnabled(): boolean {
+        return this.enabled;
+    }
+
+    static generateConnectionToken(userId: number): string {
+        const secret = process.env.CENTRIFUGO_TOKEN_SECRET || process.env.JWT_SIGN || '';
+        return jwt.sign(
+            { sub: String(userId) },
+            secret,
+            { expiresIn: '24h' }
+        );
+    }
+}
+
+let _instance: CentrifugoClient | null = null;
+
+export function getCentrifugoClient(): CentrifugoClient {
+    if (!_instance) {
+        _instance = new CentrifugoClient();
+    }
+    return _instance;
+}
@@ -0,0 +1,4 @@
+export interface Dispatcher {
+    register(): void;
+    registerWorkers(): Promise<void>;
+}
@@ -0,0 +1,41 @@
+import { EventEmitter } from 'node:events';
+import type { TasksSchemaTypeForSelect } from 'taskview-db-schemas';
+import { $logger } from '../modules/logget';
+
+export interface AppEvents {
+    'task.created': { task: TasksSchemaTypeForSelect; initiatorId: number };
+    'task.updated': { task: TasksSchemaTypeForSelect; changes: Record<string, unknown>; initiatorId: number };
+    'task.assigneesChanged': { taskId: number; userIds: number[]; initiatorId: number };
+    'task.deleted': { taskId: number; goalId: number; initiatorId: number };
+    'collaboration.userAdded': { goalId: number; email: string; initiatorId: number };
+    'collaboration.userRemoved': { goalId: number; collaborationUserId: number; initiatorId: number };
+    'collaboration.rolesChanged': { goalId: number; collaborationUserId: number; initiatorId: number };
+}
+
+type EventName = keyof AppEvents;
+type EventHandler<T extends EventName> = (data: AppEvents[T]) => void | Promise<void>;
+
+class AppEventBus {
+    private emitter = new EventEmitter();
+
+    on<T extends EventName>(event: T, handler: EventHandler<T>) {
+        this.emitter.on(event, (data: AppEvents[T]) => {
+            try {
+                const result = handler(data);
+                if (result instanceof Promise) {
+                    result.catch((err) => {
+                        $logger.error(err, `EventBus handler error [${event}]`);
+                    });
+                }
+            } catch (err) {
+                $logger.error(err, `EventBus handler error [${event}]`);
+            }
+        });
+    }
+
+    emit<T extends EventName>(event: T, data: AppEvents[T]) {
+        this.emitter.emit(event, data);
+    }
+}
+
+export const eventBus = new AppEventBus();
@@ -39,14 +39,25 @@ export class GoalPermissionsFetcher {

        if (!goalId) { return new GoalPermissionsChecker([]); }

+        //Token authentication check
+        const allowedGoalIds = this.user.getAllowedGoalIds();
+        if (allowedGoalIds && allowedGoalIds.length > 0 && !allowedGoalIds.includes(goalId)) {
+            return new GoalPermissionsChecker([]);
+        }
+
        if (this.isCacheValid(goalId)) {
            return this.checkerCache[goalId].checker;
        }

+        let permissions = await this.goalPermissionsRepository.fetchPermissionsForGoal(goalId, this.user);
+
+        const tokenPerms = this.user.getTokenPermissions();
+        if (tokenPerms && tokenPerms.length > 0) {
+            permissions = permissions.filter(p => tokenPerms.includes(p.permissionName));
+        }
+
        this.checkerCache[goalId] = {
-            checker: new GoalPermissionsChecker(
-                await this.goalPermissionsRepository.fetchPermissionsForGoal(goalId, this.user)
-            ),
+            checker: new GoalPermissionsChecker(permissions),
            timestamp: performance.now(),
        };

@@ -0,0 +1,53 @@
+import { PgBoss } from 'pg-boss';
+import { $logger } from '../modules/logget';
+import { Database } from '../modules/db';
+
+let boss: PgBoss | null = null;
+
+export async function startJobQueue(): Promise<PgBoss> {
+    boss = new PgBoss({
+        host: process.env.DB_HOST,
+        user: process.env.DB_USER,
+        password: process.env.DB_PASSWORD,
+        database: process.env.DB_NAME,
+        port: +process.env.DB_PORT!,
+        schema: 'pgboss',
+    });
+
+    boss.on('error', (err) => {
+        $logger.error(err, '[JobQueue] Error');
+    });
+
+    await boss.start();
+    $logger.info('[JobQueue] Started');
+
+    return boss;
+}
+
+export function getJobQueue(): PgBoss {
+    if (!boss) {
+        throw new Error('JobQueue not started. Call startJobQueue() first.');
+    }
+    return boss;
+}
+
+/** Cancel jobs by singletonKey — finds and deletes matching queued jobs */
+export async function cancelJobBySingletonKey(queueName: string, singletonKey: string): Promise<void> {
+    if (!boss) return;
+    const db = Database.getInstance();
+    const result = await db.query<{ id: string }>(
+        `SELECT id FROM pgboss.job WHERE name = $1 AND singleton_key = $2 AND state IN ('created', 'retry')`,
+        [queueName, singletonKey],
+    );
+
+    const count = result?.rows?.length ?? 0;
+    if (count === 0) {
+        $logger.info(`[JobQueue] Cancel: no jobs found for key="${singletonKey}"`);
+        return;
+    }
+
+    for (const row of result!.rows) {
+        await boss.deleteJob(queueName, row.id);
+        $logger.info(`[JobQueue] Deleted job id=${row.id} key="${singletonKey}"`);
+    }
+}
@@ -0,0 +1,22 @@
+import { startJobQueue } from './JobQueue';
+import type { Dispatcher } from './Dispatcher';
+import { NotificationDispatcher } from '../tv-modules/notifications/NotificationDispatcher';
+import { RealtimeDispatcher } from '../tv-modules/realtime/RealtimeDispatcher';
+import { WebhooksDispatcher } from '../tv-modules/webhooks/WebhooksDispatcher';
+
+const dispatchers: Dispatcher[] = [
+    new NotificationDispatcher(),
+    new RealtimeDispatcher(),
+    new WebhooksDispatcher(),
+];
+
+export function registerAllEventHandlers() {
+    dispatchers.forEach((d) => d.register());
+}
+
+export async function startAllWorkers() {
+    await startJobQueue();
+    for (const d of dispatchers) {
+        await d.registerWorkers();
+    }
+}
@@ -2,20 +2,45 @@ import type { NextFunction, Request, Response } from 'express';
 import { AppUser } from '../core/AppUser';
 import { $logger } from '../modules/logget';
 import AuthController from '../tv-modules/auth/AuthController';
+import { getApiTokensManager } from '../tv-modules/api-tokens/ApiTokensManager';
+import { TOKEN_PREFIX } from '../tv-modules/api-tokens/types';

 export const appUserMiddleware = async (req: Request, res: Response, next: NextFunction) => {
    const token = req.headers['authorization']?.split(' ')[1];
+
+    if (token && token.startsWith(TOKEN_PREFIX)) {
+        const record = await getApiTokensManager().validateToken(token);
+        if (record) {
+            const authManager = new AppUser().authManager;
+            const userData = await authManager.repository.fetchUserById(record.userId);
+            if (userData && userData.block === 0) {
+                req.appUser = new AppUser({
+                    id: 0,
+                    userData: { id: userData.id, login: userData.login, email: userData.email },
+                });
+                req.appUser.setUserDataFromDb(userData);
+                req.appUser.setHasActiveToken(true);
+                req.appUser.setApiTokenAuth(record.allowedPermissions, record.allowedGoalIds);
+            } else {
+                req.appUser = new AppUser();
+            }
+        } else {
+            req.appUser = new AppUser();
+        }
+        return next();
+    }
+
    if (token) {
        const userPayload = await AuthController.validateTokens(token);
        if (userPayload) {
            req.appUser = new AppUser(userPayload);
            try {
-                const [tokens, userData] = await Promise.allSettled([
-                    req.appUser.authManager.jwtStorage.fetchTokens(userPayload.id),
+                const [sessionActive, userData] = await Promise.allSettled([
+                    req.appUser.authManager.sessionStorage.isSessionActive(userPayload.id),
                    req.appUser.authManager.repository.fetchUserById(userPayload.userData.id),
                ]);

-                if (tokens.status === 'fulfilled') {
+                if (sessionActive.status === 'fulfilled' && sessionActive.value) {
                    req.appUser.setHasActiveToken(true);
                }

@@ -0,0 +1,15 @@
+import type { NextFunction, Request, Response } from 'express'
+
+export const IsOrgMemberIfProvided = async (req: Request, res: Response, next: NextFunction) => {
+  const organizationId = Number(
+    req.query.organizationId || req.body.organizationId || req.params.organizationId
+  )
+
+  if (!organizationId) return next()
+
+  const member = await req.appUser.organizationManager.getCurrentUserMember(organizationId)
+
+  if (!member) return res.status(403).end()
+
+  next()
+}
@@ -282,5 +282,195 @@
        "description": [
            "Release 1.16.0"
        ]
+    },
+    "22": {
+        "version": "1.18.2",
+        "name": "Release 1.18.2",
+        "releaseDate": "20260108",
+        "scripts": [
+            "/1.18.2/0.1.18.2.sql",
+            "/1.18.2/all-triggers.sql"
+        ],
+        "description": [
+            "Release 1.18.2"
+        ]
+    },
+    "23": {
+        "version": "1.20.0",
+        "name": "Release 1.20.0",
+        "releaseDate": "20260221",
+        "scripts": [
+            "/1.20.0/all-triggers.sql"
+        ],
+        "description": [
+            "Validate tag and task belong to the same project on insert into tasks_to_tags"
+        ]
+    },
+    "24": {
+        "version": "1.21.0",
+        "name": "Release 1.21.0",
+        "releaseDate": "20260302",
+        "scripts": [
+            "/1.21.0/0.1.21.0.sql"
+        ],
+        "description": [
+            "Added integrations table for GitHub/GitLab integration",
+            "Added integration_task_map table for issue-task mapping"
+        ]
+    },
+    "25": {
+        "version": "1.22.0",
+        "name": "Release 1.22.0",
+        "releaseDate": "20260304",
+        "scripts": [
+            "/1.22.0/0.1.22.0.sql"
+        ],
+        "description": [
+            "Added last_synced_at column to integrations for incremental sync"
+        ]
+    },
+    "26": {
+        "version": "1.23.0",
+        "name": "Release 1.23.0",
+        "releaseDate": "20260314",
+        "scripts": [
+            "/1.23.0/0.1.23.0.sql"
+        ],
+        "description": [
+            "Added source_url column to tasks for external issue links"
+        ]
+    },
+    "27": {
+        "version": "1.24.0",
+        "name": "Release 1.24.0",
+        "releaseDate": "20260315",
+        "scripts": [
+            "/1.24.0/0.1.24.0.sql"
+        ],
+        "description": [
+            "Added reminders, notifications, and push_subscriptions tables"
+        ]
+    },
+    "28": {
+        "version": "1.25.0",
+        "name": "Release 1.25.0",
+        "releaseDate": "20260317",
+        "scripts": [
+            "/1.25.0/0.1.25.0.sql"
+        ],
+        "description": [
+            "Added type column to notifications table"
+        ]
+    },
+    "29": {
+        "version": "1.26.0",
+        "name": "Release 1.26.0",
+        "releaseDate": "20260320",
+        "scripts": [
+            "/1.26.0/0.1.26.0.sql"
+        ],
+        "description": [
+            "Added notification_preferences table with JSONB settings"
+        ]
+    },
+    "30": {
+        "version": "1.27.0",
+        "name": "Release 1.27.0",
+        "releaseDate": "20260322",
+        "scripts": [
+            "/1.27.0/0.1.27.0.sql"
+        ],
+        "description": [
+            "Added webhooks and webhook_deliveries tables"
+        ]
+    },
+    "31": {
+        "version": "1.28.0",
+        "name": "Fix missing 1.25.0 migrations",
+        "releaseDate": "20260323",
+        "scripts": [
+            "/1.28.0/0.fix-missing-1.25.0-migrations.sql"
+        ],
+        "description": [
+            "Fix: apply missing migrations from 1.25.0 - convert TIMETZ to TIME and add timezone column to device_tokens"
+        ]
+    },
+    "32": {
+        "version": "1.29.0",
+        "name": "Release 1.29.0",
+        "releaseDate": "20260328",
+        "scripts": [
+            "/1.29.0/0.1.29.0.sql"
+        ],
+        "description": [
+            "Added api_tokens table for personal access tokens"
+        ]
+    },
+    "33": {
+        "version": "1.30.0",
+        "name": "Release 1.30.0",
+        "releaseDate": "20260328",
+        "scripts": [
+            "/1.30.0/0.1.30.0.sql"
+        ],
+        "description": [
+            "Added allowed_goal_ids column to api_tokens for project-scoped tokens"
+        ]
+    },
+    "34": {
+        "version": "1.31.0",
+        "name": "Release 1.31.0",
+        "releaseDate": "20260328",
+        "scripts": [
+            "/1.31.0/0.1.31.0.sql",
+            "/1.31.0/all-triggers.sql"
+        ],
+        "description": [
+            "Remove JWT storage from user_tokens, add session metadata (device_name, user_agent, last_used_at)",
+            "Add trigger to remove user from task assignees when removed from project collaboration"
+        ]
+    },
+    "35": {
+        "version": "1.32.0",
+        "name": "Release 1.32.0",
+        "releaseDate": "20260404",
+        "scripts": [
+            "/1.32.0/0.1.32.0.sql",
+            "/1.32.0/1.migrate-organizations.sql"
+        ],
+        "description": [
+            "Added organizations and organization_members tables",
+            "Migrate existing users to personal workspaces",
+            "Added organization_id column to goals"
+        ]
+    },
+    "36": {
+        "version": "1.33.0",
+        "name": "Release 1.33.0",
+        "releaseDate": "20260411",
+        "scripts": [
+            "/1.33.0/0.1.33.0.sql",
+            "/1.33.0/1.add-saml-signing-fields.sql",
+            "/1.33.0/2.add-saml-logout-url.sql",
+            "/1.33.0/3.add-scim-fields.sql"
+        ],
+        "description": [
+            "Added SSO support (SAML 2.0 + OIDC)",
+            "Added sso_configs, sso_identities, saml_request_cache tables",
+            "Added SAML AuthnRequest signing support",
+            "Added SAML logout URL for SLO",
+            "Added SCIM provisioning support"
+        ]
+    },
+    "37": {
+        "version": "1.44.0",
+        "name": "Release 1.44.0",
+        "releaseDate": "20260418",
+        "scripts": [
+            "/1.44.0/0.create-missing-personal-orgs.sql"
+        ],
+        "description": [
+            "Create personal organizations for users without any organization membership"
+        ]
    }
 }
@@ -0,0 +1,41 @@
+--Delete orphaned records from history.tasks_tasks table
+delete from history.tasks_tasks h
+where not exists (
+  select 1
+  from tasks.tasks t
+  where t.id = h.task_id
+);
+
+--Delete orphaned records from history.tasks_goal_lists table
+delete from history.tasks_goal_lists h 
+where not exists (
+    select  1 
+    from tasks.goal_lists gl 
+    where gl.id = h.goal_list_id
+);
+
+--Delete orphaned records from history.tasks_goals table
+delete from history.tasks_goals h 
+where not exists (
+    select  1 
+    from tasks.goals g 
+    where g.id = h.goal_id
+);
+
+alter table history.tasks_tasks 
+add constraint fk_history_tasks_tasks_task_id 
+foreign key (task_id) 
+references tasks.tasks (id) on delete cascade;
+
+alter table history.tasks_goal_lists
+add constraint fk_history_tasks_goal_lists_goal_list_id 
+foreign key (goal_list_id) 
+references tasks.goal_lists (id) on delete cascade;
+
+alter table history.tasks_goals
+add constraint fk_history_tasks_goals_goal_id 
+foreign key (goal_id) 
+references tasks.goals (id) on delete cascade;
+
+
+
@@ -0,0 +1,557 @@
+--1.
+--Trigger set previous version
+create or replace function app.trigger_set_previous_version()
+    returns trigger as
+$date_complete$
+begin
+    new.prev_version = old.version;
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists trigger_set_previous_version on app.version;
+create trigger trigger_set_previous_version
+    before insert
+    on app.version
+    for each row
+execute procedure app.trigger_set_previous_version();
+
+--2.
+--Trigger for adding owner for taskList from goal
+create or replace function tasks.trigger_set_owner_for_component()
+    returns trigger as
+$date_complete$
+begin
+    new.owner = (select owner from tasks.goals where id = new.goal_id);
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists trigger_set_owner_for_component on tasks.goal_lists;
+create trigger trigger_set_owner_for_component
+    before insert
+    on tasks.goal_lists
+    for each row
+execute procedure tasks.trigger_set_owner_for_component();
+
+--3.
+--Trigger for updating date_complete for task
+create or replace function tasks.update_date_complete()
+    returns trigger as
+$date_complete$
+begin
+    if new.complete != old.complete
+    then
+        if new.complete = true
+        then
+            update tasks.tasks set date_complete = now() where id = old.id;
+        else
+            update tasks.tasks set date_complete = null where id = old.id;
+        end if;
+    end if;
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists tr_update_date_complete on tasks.tasks;
+create trigger tr_update_date_complete
+    after update
+    on tasks.tasks
+    for each row
+execute procedure tasks.update_date_complete();
+
+--4.
+-- Delete user from collaboration if not assigned to any goal
+create or replace function collaboration.delete_user_if_not_assigned_to_goal()
+returns trigger as $$
+declare
+    count int;
+begin
+    if not exists (
+        select 1
+        from collaboration.users_to_goals
+        where user_id = old.user_id
+        limit 1
+    ) then
+        delete from collaboration.users where id = old.user_id;
+    end if;
+
+    return old;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_delete_user_if_not_assigned_to_goal on collaboration.users_to_goals;
+create trigger trigger_delete_user_if_not_assigned_to_goal 
+    after delete 
+    on collaboration.users_to_goals 
+    for each row 
+execute function collaboration.delete_user_if_not_assigned_to_goal();
+
+--5.
+--Trigger for checking task graph relation goal to avoid connection between tasks from different goals
+create or replace function tasks.check_task_graph_relation_goal()
+returns trigger as $$
+declare
+    from_goal int;
+    to_goal   int;
+begin
+    select goal_id into from_goal from tasks.tasks where id = new.from_task_id;
+    select goal_id into to_goal   from tasks.tasks where id = new.to_task_id;
+
+    if from_goal is null or to_goal is null then
+        raise exception 'Invalid task reference in relation';
+    end if;
+
+    if from_goal <> to_goal then
+        raise exception 'Relation goal_id must match both tasks'' goal_id';
+    end if;
+
+    new.goal_id := from_goal;
+
+    return new;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_task_relation_goal on tasks.task_relations;
+create trigger trigger_task_relation_goal
+before insert or update on tasks.task_relations
+for each row execute function tasks.check_task_graph_relation_goal();
+
+--6.
+--Trigger for logging changes in taskList to history table
+create or replace function tasks.log_changes_tasks_goal_lists()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_goal_lists (goal_list_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_goal_lists (goal_list_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_goal_lists on tasks.goal_lists;
+create trigger trigger_log_changes_tasks_goal_lists
+    before update or delete
+    on tasks.goal_lists
+    for each row
+execute procedure tasks.log_changes_tasks_goal_lists();
+
+--7.
+--Trigger for logging changes in goal to history table
+create or replace function tasks.log_changes_tasks_goals()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_goals (goal_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_goals (goal_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_goals on tasks.goals;
+create trigger trigger_log_changes_tasks_goals
+    before update or delete
+    on tasks.goals
+    for each row
+execute procedure tasks.log_changes_tasks_goals();
+
+--8.
+--Trigger for logging changes in task to history table
+create or replace function tasks.log_changes_tasks_tasks()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_tasks (task_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_tasks (task_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_tasks on tasks.tasks;
+create trigger trigger_log_changes_tasks_tasks
+    before update or delete
+    on tasks.tasks
+    for each row
+execute procedure tasks.log_changes_tasks_tasks();
+
+--9.
+--Trigger for setting goal_id default for task
+CREATE OR REPLACE FUNCTION tasks.set_goal_id_default_for_task()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    goal_id INT;
+BEGIN
+    
+    SELECT gl.goal_id
+    INTO goal_id
+    FROM tasks.goal_lists gl
+    WHERE gl.id = NEW.goal_list_id;
+
+    IF goal_id IS NOT NULL THEN
+        NEW.goal_id := goal_id;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists before_insert_set_goal_id_for_task on tasks.tasks;
+
+CREATE TRIGGER before_insert_set_goal_id_for_task
+    BEFORE INSERT OR UPDATE
+    ON tasks.tasks
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.set_goal_id_default_for_task();
+
+
+--10.
+--Trigger for adding default roles and permissions for goal
+CREATE OR REPLACE FUNCTION tasks.add_roles_and_permissions()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    editor_role_id  INTEGER;
+    executor_role_id INTEGER;
+BEGIN
+    -- 1. Create role "editor"
+    INSERT INTO collaboration.roles (name, goal_id)
+    VALUES ('editor', NEW.id)
+    RETURNING id INTO editor_role_id;
+
+    -- 2. Create role "executor"
+    INSERT INTO collaboration.roles (name, goal_id)
+    VALUES ('executor', NEW.id)
+    RETURNING id INTO executor_role_id;
+
+    -- 3. Add permissions for role "editor"
+    INSERT INTO collaboration.permissions_to_role (role_id, permission_id)
+    SELECT editor_role_id, id
+    FROM tv_auth.permissions
+    WHERE name IN (
+                   'goal_can_watch_content',
+                   'goal_can_edit',
+                   'goal_can_add_task_list',
+                   'goal_can_manage_users',
+                   'component_can_watch_content',
+                   'component_can_edit',
+                   'component_can_delete',
+                   'component_can_add_tasks',
+                   'task_can_edit_deadline',
+                   'task_can_watch_subtasks',
+                   'task_can_watch_note',
+                   'task_can_recovery_history',
+                   'task_can_watch_assigned_users',
+                   'task_can_edit_priority',
+                   'task_can_delete',
+                   'task_can_watch_details',
+                   'task_can_assign_users',
+                   'task_can_add_subtasks',
+                   'task_can_watch_tags',
+                   'task_can_watch_priority',
+                   'task_can_access_history',
+                   'task_can_edit_tags',
+                   'task_can_edit_description',
+                   'task_can_edit_status',
+                   'task_can_edit_note',
+                   'kanban_can_manage',
+                   'kanban_can_view',
+                   'graph_can_manage',
+                   'graph_can_view'
+        );
+
+    -- 4. Add permissions for role "viewver"
+    INSERT INTO collaboration.permissions_to_role (role_id, permission_id)
+    SELECT executor_role_id, id
+    FROM tv_auth.permissions
+    WHERE name IN (
+                   'goal_can_watch_content',
+                   'component_can_watch_content',
+                   'component_can_add_tasks',
+                   'task_can_watch_subtasks',
+                   'task_can_watch_note',
+                   'task_can_watch_assigned_users',
+                   'task_can_watch_details',
+                   'task_can_add_subtasks',
+                   'task_can_watch_tags',
+                   'task_can_watch_priority'
+        );
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+
+drop trigger if exists add_roles_after_insert on tasks.goals;
+
+CREATE TRIGGER add_roles_after_insert
+    AFTER INSERT
+    ON tasks.goals 
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.add_roles_and_permissions();
+
+
+--11.
+--Trigger for adjusting start and end dates for task
+CREATE OR REPLACE FUNCTION tasks.adjust_start_and_end_dates()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    start_timestamp TIMESTAMPTZ;
+    end_timestamp   TIMESTAMPTZ;
+BEGIN
+    -- If start_date is NULL, then start_time should be NULL
+    IF NEW.start_date IS NULL THEN
+        NEW.start_time := NULL;
+    END IF;
+
+    -- If end_date is NULL, then end_time should be NULL
+    IF NEW.end_date IS NULL THEN
+        NEW.end_time := NULL;
+    END IF;
+
+    -- If both dates are set
+    IF NEW.start_date IS NOT NULL AND NEW.end_date IS NOT NULL THEN
+        -- Adjust dates
+        IF NEW.start_date > NEW.end_date THEN
+            -- If start_date is greater than end_date, set end_date to start_date
+            NEW.end_date := NEW.start_date;
+            -- end_time remains unchanged
+        ELSIF NEW.end_date < NEW.start_date THEN
+            -- If end_date is less than start_date, set start_date to end_date
+            NEW.start_date := NEW.end_date;
+            -- start_time remains unchanged
+        END IF;
+
+        -- Prepare timestamps for comparison
+        start_timestamp := (NEW.start_date::text || ' ' || COALESCE(NEW.start_time::text, '00:00:00+00'))::timestamptz;
+        end_timestamp := (NEW.end_date::text || ' ' || COALESCE(NEW.end_time::text, '00:00:00+00'))::timestamptz;
+
+        -- If start_timestamp is greater than end_timestamp, adjust end_date and end_time
+        IF start_timestamp > end_timestamp THEN
+            NEW.end_date := NEW.start_date;
+            -- Assign end_time only if start_time is not NULL
+            IF NEW.start_time IS NOT NULL AND NEW.end_time IS NOT NULL THEN
+                NEW.end_time := NEW.start_time;
+            END IF;
+        END IF;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+
+drop trigger if exists adjust_dates_and_times_trigger on tasks.tasks;
+CREATE TRIGGER adjust_dates_and_times_trigger
+    BEFORE INSERT OR UPDATE
+    ON tasks.tasks
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.adjust_start_and_end_dates();
+
+--12.
+--Trigger for adding self/owner to collaboration table to be able to assign tasks to self
+create or replace function tasks.add_self_to_collaboration()
+returns trigger as $$
+DECLARE
+    owner_email TEXT;
+BEGIN
+
+    select email into owner_email
+    from tv_auth.users
+    where id = NEW.owner;
+
+    if owner_email is not null then
+        insert into collaboration.users (email) values (owner_email) ON CONFLICT (email) DO NOTHING;
+        insert into collaboration.users_to_goals (goal_id, user_id) values (NEW.id, (select id from collaboration.users where email = owner_email));
+    end if;
+
+    return NEW;
+END;
+$$ language plpgsql;
+
+drop trigger if exists add_selt_to_collaboration_trg on tasks.goals;
+
+create trigger add_selt_to_collaboration_trg
+    after insert on tasks.goals
+    for each row
+    execute function tasks.add_self_to_collaboration();
+
+--13.
+--Trigger for adding default kanban columns for new goal
+CREATE OR REPLACE FUNCTION tasks.kanban_add_default_columns()
+RETURNS TRIGGER AS $$
+BEGIN
+    -- Add default columns for new goal
+    INSERT INTO tasks.statuses (name, goal_id, view_order)
+    VALUES 
+        ('TODO', NEW.id, 1),
+        ('In Progress', NEW.id, 2),
+        ('Done', NEW.id, 3);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS kanban_add_default_columns_trg ON tasks.goals;
+
+CREATE TRIGGER kanban_add_default_columns_trg
+AFTER INSERT ON tasks.goals
+FOR EACH ROW
+EXECUTE FUNCTION tasks.kanban_add_default_columns();
+
+--14.
+--Trigger for validating the correct statusId for the inserted value. To avoid assigning a status that does not belong to the goal.
+CREATE OR REPLACE FUNCTION tasks.check_task_status_goal()
+RETURNS TRIGGER AS $$
+BEGIN
+    -- Check if there is a record in tasks.statuses with the same goal_id
+    IF NOT EXISTS (
+        SELECT 1 FROM tasks.statuses s 
+        WHERE s.id = NEW.status_id AND s.goal_id = NEW.goal_id
+    ) THEN
+        RAISE EXCEPTION 'Status ID % is not valid for goal ID %', NEW.status_id, NEW.goal_id;
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists enforce_task_status_goal on tasks.tasks;
+
+CREATE TRIGGER enforce_task_status_goal
+BEFORE INSERT OR UPDATE ON tasks.tasks
+FOR EACH ROW
+WHEN (NEW.status_id IS NOT NULL)
+EXECUTE FUNCTION tasks.check_task_status_goal();
+
+--15.
+--Trigger for setting default orders value for task
+CREATE OR REPLACE FUNCTION tasks.set_order_value()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW.task_order IS NULL THEN
+        NEW.task_order := NEW.id;
+    END IF;
+    IF NEW.kanban_order IS NULL THEN
+        NEW.kanban_order := NEW.id;
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists set_order_trigger on tasks.tasks;
+CREATE TRIGGER set_order_trigger
+BEFORE INSERT ON tasks.tasks
+FOR EACH ROW
+EXECUTE FUNCTION tasks.set_order_value();
+
+--16.
+--Trigger for setting default view order for new status
+CREATE OR REPLACE FUNCTION tasks.status_set_default_view_order()
+RETURNS TRIGGER AS $$
+DECLARE
+    new_view_order INT;
+BEGIN
+    -- Determine the next view_order for the given goal_id
+    SELECT COALESCE(MAX(view_order), 0) + 1 INTO new_view_order
+    FROM tasks.statuses
+    WHERE goal_id = NEW.goal_id;
+
+    -- Assign the calculated value to the view_order field
+    NEW.view_order := new_view_order;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists set_default_status_view_order on tasks.statuses;
+
+CREATE TRIGGER set_default_status_view_order
+BEFORE INSERT ON tasks.statuses
+FOR EACH ROW
+EXECUTE FUNCTION tasks.status_set_default_view_order();
+
+--17.
+--Trigger for validating the correct user_id for the inserted value. To avoid assigning a user that does not belong to the goal.
+CREATE OR REPLACE FUNCTION tasks_auth.control_user_id_is_from_same_goal_as_task()
+RETURNS TRIGGER AS $$
+DECLARE
+    user_exists BOOLEAN;
+BEGIN
+    SELECT EXISTS (
+        SELECT 1 
+        FROM tasks.tasks tt    
+        LEFT JOIN collaboration.users_to_goals utg ON utg.goal_id = tt.goal_id
+        WHERE tt.id = NEW.task_id AND utg.user_id = NEW.collab_user_id
+    ) INTO user_exists;
+
+    IF NOT user_exists THEN
+        RAISE EXCEPTION 'User % is not associated with the goal of task %', NEW.collab_user_id, NEW.task_id;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists trigger_control_user_id_is_from_same_goal_as_task on tasks_auth.task_assignee;
+
+CREATE TRIGGER trigger_control_user_id_is_from_same_goal_as_task
+BEFORE INSERT ON tasks_auth.task_assignee
+FOR EACH ROW
+EXECUTE FUNCTION tasks_auth.control_user_id_is_from_same_goal_as_task();
+
+--18.
+--Trigger for adding owner for task, extend owner from goal or taskList
+
+--delete old function with wrong name
+drop trigger if exists trigger_set_owner_for_task on tasks.tasks;
+drop function if exists tasks.trigger_set_owner_for_task();
+
+CREATE OR REPLACE FUNCTION tasks.fn_set_owner_for_task()
+RETURNS TRIGGER AS
+$body$
+BEGIN
+    NEW.owner := COALESCE(
+        (SELECT owner FROM tasks.goal_lists WHERE id = NEW.goal_list_id),
+        (SELECT owner FROM tasks.goals WHERE id = NEW.goal_id)
+    );
+    
+    IF NEW.owner IS NULL THEN
+        RAISE EXCEPTION 'Can not insert task without owner';
+    END IF;
+
+    RETURN NEW;
+END;
+$body$
+LANGUAGE plpgsql;
+
+drop trigger if exists trigger_set_owner_for_task on tasks.tasks;
+create trigger trigger_set_owner_for_task
+    before insert
+    on tasks.tasks
+    for each row
+execute procedure tasks.fn_set_owner_for_task();
+
@@ -0,0 +1,585 @@
+--1.
+--Trigger set previous version
+create or replace function app.trigger_set_previous_version()
+    returns trigger as
+$date_complete$
+begin
+    new.prev_version = old.version;
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists trigger_set_previous_version on app.version;
+create trigger trigger_set_previous_version
+    before insert
+    on app.version
+    for each row
+execute procedure app.trigger_set_previous_version();
+
+--2.
+--Trigger for adding owner for taskList from goal
+create or replace function tasks.trigger_set_owner_for_component()
+    returns trigger as
+$date_complete$
+begin
+    new.owner = (select owner from tasks.goals where id = new.goal_id);
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists trigger_set_owner_for_component on tasks.goal_lists;
+create trigger trigger_set_owner_for_component
+    before insert
+    on tasks.goal_lists
+    for each row
+execute procedure tasks.trigger_set_owner_for_component();
+
+--3.
+--Trigger for updating date_complete for task
+create or replace function tasks.update_date_complete()
+    returns trigger as
+$date_complete$
+begin
+    if new.complete != old.complete
+    then
+        if new.complete = true
+        then
+            update tasks.tasks set date_complete = now() where id = old.id;
+        else
+            update tasks.tasks set date_complete = null where id = old.id;
+        end if;
+    end if;
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists tr_update_date_complete on tasks.tasks;
+create trigger tr_update_date_complete
+    after update
+    on tasks.tasks
+    for each row
+execute procedure tasks.update_date_complete();
+
+--4.
+-- Delete user from collaboration if not assigned to any goal
+create or replace function collaboration.delete_user_if_not_assigned_to_goal()
+returns trigger as $$
+declare
+    count int;
+begin
+    if not exists (
+        select 1
+        from collaboration.users_to_goals
+        where user_id = old.user_id
+        limit 1
+    ) then
+        delete from collaboration.users where id = old.user_id;
+    end if;
+
+    return old;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_delete_user_if_not_assigned_to_goal on collaboration.users_to_goals;
+create trigger trigger_delete_user_if_not_assigned_to_goal 
+    after delete 
+    on collaboration.users_to_goals 
+    for each row 
+execute function collaboration.delete_user_if_not_assigned_to_goal();
+
+--5.
+--Trigger for checking task graph relation goal to avoid connection between tasks from different goals
+create or replace function tasks.check_task_graph_relation_goal()
+returns trigger as $$
+declare
+    from_goal int;
+    to_goal   int;
+begin
+    select goal_id into from_goal from tasks.tasks where id = new.from_task_id;
+    select goal_id into to_goal   from tasks.tasks where id = new.to_task_id;
+
+    if from_goal is null or to_goal is null then
+        raise exception 'Invalid task reference in relation';
+    end if;
+
+    if from_goal <> to_goal then
+        raise exception 'Relation goal_id must match both tasks'' goal_id';
+    end if;
+
+    new.goal_id := from_goal;
+
+    return new;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_task_relation_goal on tasks.task_relations;
+create trigger trigger_task_relation_goal
+before insert or update on tasks.task_relations
+for each row execute function tasks.check_task_graph_relation_goal();
+
+--6.
+--Trigger for logging changes in taskList to history table
+create or replace function tasks.log_changes_tasks_goal_lists()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_goal_lists (goal_list_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_goal_lists (goal_list_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_goal_lists on tasks.goal_lists;
+create trigger trigger_log_changes_tasks_goal_lists
+    before update or delete
+    on tasks.goal_lists
+    for each row
+execute procedure tasks.log_changes_tasks_goal_lists();
+
+--7.
+--Trigger for logging changes in goal to history table
+create or replace function tasks.log_changes_tasks_goals()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_goals (goal_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_goals (goal_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_goals on tasks.goals;
+create trigger trigger_log_changes_tasks_goals
+    before update or delete
+    on tasks.goals
+    for each row
+execute procedure tasks.log_changes_tasks_goals();
+
+--8.
+--Trigger for logging changes in task to history table
+create or replace function tasks.log_changes_tasks_tasks()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_tasks (task_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_tasks (task_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_tasks on tasks.tasks;
+create trigger trigger_log_changes_tasks_tasks
+    before update or delete
+    on tasks.tasks
+    for each row
+execute procedure tasks.log_changes_tasks_tasks();
+
+--9.
+--Trigger for setting goal_id default for task
+CREATE OR REPLACE FUNCTION tasks.set_goal_id_default_for_task()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    goal_id INT;
+BEGIN
+    
+    SELECT gl.goal_id
+    INTO goal_id
+    FROM tasks.goal_lists gl
+    WHERE gl.id = NEW.goal_list_id;
+
+    IF goal_id IS NOT NULL THEN
+        NEW.goal_id := goal_id;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists before_insert_set_goal_id_for_task on tasks.tasks;
+
+CREATE TRIGGER before_insert_set_goal_id_for_task
+    BEFORE INSERT OR UPDATE
+    ON tasks.tasks
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.set_goal_id_default_for_task();
+
+
+--10.
+--Trigger for adding default roles and permissions for goal
+CREATE OR REPLACE FUNCTION tasks.add_roles_and_permissions()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    editor_role_id  INTEGER;
+    executor_role_id INTEGER;
+BEGIN
+    -- 1. Create role "editor"
+    INSERT INTO collaboration.roles (name, goal_id)
+    VALUES ('editor', NEW.id)
+    RETURNING id INTO editor_role_id;
+
+    -- 2. Create role "executor"
+    INSERT INTO collaboration.roles (name, goal_id)
+    VALUES ('executor', NEW.id)
+    RETURNING id INTO executor_role_id;
+
+    -- 3. Add permissions for role "editor"
+    INSERT INTO collaboration.permissions_to_role (role_id, permission_id)
+    SELECT editor_role_id, id
+    FROM tv_auth.permissions
+    WHERE name IN (
+                   'goal_can_watch_content',
+                   'goal_can_edit',
+                   'goal_can_add_task_list',
+                   'goal_can_manage_users',
+                   'component_can_watch_content',
+                   'component_can_edit',
+                   'component_can_delete',
+                   'component_can_add_tasks',
+                   'task_can_edit_deadline',
+                   'task_can_watch_subtasks',
+                   'task_can_watch_note',
+                   'task_can_recovery_history',
+                   'task_can_watch_assigned_users',
+                   'task_can_edit_priority',
+                   'task_can_delete',
+                   'task_can_watch_details',
+                   'task_can_assign_users',
+                   'task_can_add_subtasks',
+                   'task_can_watch_tags',
+                   'task_can_watch_priority',
+                   'task_can_access_history',
+                   'task_can_edit_tags',
+                   'task_can_edit_description',
+                   'task_can_edit_status',
+                   'task_can_edit_note',
+                   'kanban_can_manage',
+                   'kanban_can_view',
+                   'graph_can_manage',
+                   'graph_can_view'
+        );
+
+    -- 4. Add permissions for role "viewver"
+    INSERT INTO collaboration.permissions_to_role (role_id, permission_id)
+    SELECT executor_role_id, id
+    FROM tv_auth.permissions
+    WHERE name IN (
+                   'goal_can_watch_content',
+                   'component_can_watch_content',
+                   'component_can_add_tasks',
+                   'task_can_watch_subtasks',
+                   'task_can_watch_note',
+                   'task_can_watch_assigned_users',
+                   'task_can_watch_details',
+                   'task_can_add_subtasks',
+                   'task_can_watch_tags',
+                   'task_can_watch_priority'
+        );
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+
+drop trigger if exists add_roles_after_insert on tasks.goals;
+
+CREATE TRIGGER add_roles_after_insert
+    AFTER INSERT
+    ON tasks.goals 
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.add_roles_and_permissions();
+
+
+--11.
+--Trigger for adjusting start and end dates for task
+CREATE OR REPLACE FUNCTION tasks.adjust_start_and_end_dates()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    start_timestamp TIMESTAMPTZ;
+    end_timestamp   TIMESTAMPTZ;
+BEGIN
+    -- If start_date is NULL, then start_time should be NULL
+    IF NEW.start_date IS NULL THEN
+        NEW.start_time := NULL;
+    END IF;
+
+    -- If end_date is NULL, then end_time should be NULL
+    IF NEW.end_date IS NULL THEN
+        NEW.end_time := NULL;
+    END IF;
+
+    -- If both dates are set
+    IF NEW.start_date IS NOT NULL AND NEW.end_date IS NOT NULL THEN
+        -- Adjust dates
+        IF NEW.start_date > NEW.end_date THEN
+            -- If start_date is greater than end_date, set end_date to start_date
+            NEW.end_date := NEW.start_date;
+            -- end_time remains unchanged
+        ELSIF NEW.end_date < NEW.start_date THEN
+            -- If end_date is less than start_date, set start_date to end_date
+            NEW.start_date := NEW.end_date;
+            -- start_time remains unchanged
+        END IF;
+
+        -- Prepare timestamps for comparison
+        start_timestamp := (NEW.start_date::text || ' ' || COALESCE(NEW.start_time::text, '00:00:00+00'))::timestamptz;
+        end_timestamp := (NEW.end_date::text || ' ' || COALESCE(NEW.end_time::text, '00:00:00+00'))::timestamptz;
+
+        -- If start_timestamp is greater than end_timestamp, adjust end_date and end_time
+        IF start_timestamp > end_timestamp THEN
+            NEW.end_date := NEW.start_date;
+            -- Assign end_time only if start_time is not NULL
+            IF NEW.start_time IS NOT NULL AND NEW.end_time IS NOT NULL THEN
+                NEW.end_time := NEW.start_time;
+            END IF;
+        END IF;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+
+drop trigger if exists adjust_dates_and_times_trigger on tasks.tasks;
+CREATE TRIGGER adjust_dates_and_times_trigger
+    BEFORE INSERT OR UPDATE
+    ON tasks.tasks
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.adjust_start_and_end_dates();
+
+--12.
+--Trigger for adding self/owner to collaboration table to be able to assign tasks to self
+create or replace function tasks.add_self_to_collaboration()
+returns trigger as $$
+DECLARE
+    owner_email TEXT;
+BEGIN
+
+    select email into owner_email
+    from tv_auth.users
+    where id = NEW.owner;
+
+    if owner_email is not null then
+        insert into collaboration.users (email) values (owner_email) ON CONFLICT (email) DO NOTHING;
+        insert into collaboration.users_to_goals (goal_id, user_id) values (NEW.id, (select id from collaboration.users where email = owner_email));
+    end if;
+
+    return NEW;
+END;
+$$ language plpgsql;
+
+drop trigger if exists add_selt_to_collaboration_trg on tasks.goals;
+
+create trigger add_selt_to_collaboration_trg
+    after insert on tasks.goals
+    for each row
+    execute function tasks.add_self_to_collaboration();
+
+--13.
+--Trigger for adding default kanban columns for new goal
+CREATE OR REPLACE FUNCTION tasks.kanban_add_default_columns()
+RETURNS TRIGGER AS $$
+BEGIN
+    -- Add default columns for new goal
+    INSERT INTO tasks.statuses (name, goal_id, view_order)
+    VALUES 
+        ('TODO', NEW.id, 1),
+        ('In Progress', NEW.id, 2),
+        ('Done', NEW.id, 3);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS kanban_add_default_columns_trg ON tasks.goals;
+
+CREATE TRIGGER kanban_add_default_columns_trg
+AFTER INSERT ON tasks.goals
+FOR EACH ROW
+EXECUTE FUNCTION tasks.kanban_add_default_columns();
+
+--14.
+--Trigger for validating the correct statusId for the inserted value. To avoid assigning a status that does not belong to the goal.
+CREATE OR REPLACE FUNCTION tasks.check_task_status_goal()
+RETURNS TRIGGER AS $$
+BEGIN
+    -- Check if there is a record in tasks.statuses with the same goal_id
+    IF NOT EXISTS (
+        SELECT 1 FROM tasks.statuses s 
+        WHERE s.id = NEW.status_id AND s.goal_id = NEW.goal_id
+    ) THEN
+        RAISE EXCEPTION 'Status ID % is not valid for goal ID %', NEW.status_id, NEW.goal_id;
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists enforce_task_status_goal on tasks.tasks;
+
+CREATE TRIGGER enforce_task_status_goal
+BEFORE INSERT OR UPDATE ON tasks.tasks
+FOR EACH ROW
+WHEN (NEW.status_id IS NOT NULL)
+EXECUTE FUNCTION tasks.check_task_status_goal();
+
+--15.
+--Trigger for setting default orders value for task
+CREATE OR REPLACE FUNCTION tasks.set_order_value()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW.task_order IS NULL THEN
+        NEW.task_order := NEW.id;
+    END IF;
+    IF NEW.kanban_order IS NULL THEN
+        NEW.kanban_order := NEW.id;
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists set_order_trigger on tasks.tasks;
+CREATE TRIGGER set_order_trigger
+BEFORE INSERT ON tasks.tasks
+FOR EACH ROW
+EXECUTE FUNCTION tasks.set_order_value();
+
+--16.
+--Trigger for setting default view order for new status
+CREATE OR REPLACE FUNCTION tasks.status_set_default_view_order()
+RETURNS TRIGGER AS $$
+DECLARE
+    new_view_order INT;
+BEGIN
+    -- Determine the next view_order for the given goal_id
+    SELECT COALESCE(MAX(view_order), 0) + 1 INTO new_view_order
+    FROM tasks.statuses
+    WHERE goal_id = NEW.goal_id;
+
+    -- Assign the calculated value to the view_order field
+    NEW.view_order := new_view_order;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists set_default_status_view_order on tasks.statuses;
+
+CREATE TRIGGER set_default_status_view_order
+BEFORE INSERT ON tasks.statuses
+FOR EACH ROW
+EXECUTE FUNCTION tasks.status_set_default_view_order();
+
+--17.
+--Trigger for validating the correct user_id for the inserted value. To avoid assigning a user that does not belong to the goal.
+CREATE OR REPLACE FUNCTION tasks_auth.control_user_id_is_from_same_goal_as_task()
+RETURNS TRIGGER AS $$
+DECLARE
+    user_exists BOOLEAN;
+BEGIN
+    SELECT EXISTS (
+        SELECT 1 
+        FROM tasks.tasks tt    
+        LEFT JOIN collaboration.users_to_goals utg ON utg.goal_id = tt.goal_id
+        WHERE tt.id = NEW.task_id AND utg.user_id = NEW.collab_user_id
+    ) INTO user_exists;
+
+    IF NOT user_exists THEN
+        RAISE EXCEPTION 'User % is not associated with the goal of task %', NEW.collab_user_id, NEW.task_id;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists trigger_control_user_id_is_from_same_goal_as_task on tasks_auth.task_assignee;
+
+CREATE TRIGGER trigger_control_user_id_is_from_same_goal_as_task
+BEFORE INSERT ON tasks_auth.task_assignee
+FOR EACH ROW
+EXECUTE FUNCTION tasks_auth.control_user_id_is_from_same_goal_as_task();
+
+--18.
+--Trigger for adding owner for task, extend owner from goal or taskList
+
+--delete old function with wrong name
+drop trigger if exists trigger_set_owner_for_task on tasks.tasks;
+drop function if exists tasks.trigger_set_owner_for_task();
+
+CREATE OR REPLACE FUNCTION tasks.fn_set_owner_for_task()
+RETURNS TRIGGER AS
+$body$
+BEGIN
+    NEW.owner := COALESCE(
+        (SELECT owner FROM tasks.goal_lists WHERE id = NEW.goal_list_id),
+        (SELECT owner FROM tasks.goals WHERE id = NEW.goal_id)
+    );
+    
+    IF NEW.owner IS NULL THEN
+        RAISE EXCEPTION 'Can not insert task without owner';
+    END IF;
+
+    RETURN NEW;
+END;
+$body$
+LANGUAGE plpgsql;
+
+drop trigger if exists trigger_set_owner_for_task on tasks.tasks;
+create trigger trigger_set_owner_for_task
+    before insert
+    on tasks.tasks
+    for each row
+execute procedure tasks.fn_set_owner_for_task();
+
+--19.
+--Trigger for validating that tag and task belong to the same project (goal_id)
+drop trigger if exists trigger_check_tag_task_same_goal on tasks.tasks_to_tags;
+drop function if exists tasks.check_tag_task_same_goal();
+
+create or replace function tasks.check_tag_task_same_goal()
+returns trigger as $$
+declare
+    v_tag_goal_id integer;
+    v_task_goal_id integer;
+begin
+    select goal_id into v_tag_goal_id from tasks.tags where id = new.tag_id;
+    select goal_id into v_task_goal_id from tasks.tasks where id = new.task_id;
+
+    if v_tag_goal_id is null or v_tag_goal_id != v_task_goal_id then
+        raise exception 'Tag (id=%) and task (id=%) belong to different projects', new.tag_id, new.task_id;
+    end if;
+
+    return new;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_check_tag_task_same_goal on tasks.tasks_to_tags;
+create trigger trigger_check_tag_task_same_goal
+    before insert on tasks.tasks_to_tags
+    for each row
+execute function tasks.check_tag_task_same_goal();
+
@@ -0,0 +1,24 @@
+CREATE TABLE IF NOT EXISTS tasks.integrations (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    provider VARCHAR(20) NOT NULL CHECK (provider IN ('github', 'gitlab')),
+    access_token_encrypted TEXT,
+    refresh_token_encrypted TEXT,
+    repo_external_id VARCHAR(255),
+    repo_full_name VARCHAR(255),
+    project_id INTEGER NOT NULL REFERENCES tasks.goals(id) ON DELETE CASCADE,
+    webhook_id VARCHAR(255),
+    webhook_secret_encrypted TEXT,
+    is_active BOOLEAN NOT NULL DEFAULT true,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS tasks.integration_task_map (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    integration_id INTEGER NOT NULL REFERENCES tasks.integrations(id) ON DELETE CASCADE,
+    task_id INTEGER NOT NULL REFERENCES tasks.tasks(id) ON DELETE CASCADE,
+    issue_number INTEGER NOT NULL,
+    issue_state VARCHAR(20) NOT NULL DEFAULT 'open',
+    synced_at TIMESTAMP DEFAULT NOW(),
+    UNIQUE(integration_id, issue_number)
+);
@@ -0,0 +1,25 @@
+ALTER TABLE tasks.integrations ADD COLUMN IF NOT EXISTS last_synced_at TIMESTAMP;
+
+INSERT INTO tv_auth.permissions (name, description, permission_group, description_locales)
+VALUES (
+    'integrations_can_manage',
+    'User can manage integrations (connect, disconnect, sync)',
+    2,
+    '{
+        "en": "Manage integrations. User can connect, disconnect, configure and sync integrations",
+        "ru": "Управление интеграциями. Пользователь может подключать, отключать, настраивать и синхронизировать интеграции"
+    }'::jsonb
+)
+ON CONFLICT DO NOTHING;
+
+INSERT INTO tv_auth.permissions (name, description, permission_group, description_locales)
+VALUES (
+    'integrations_can_view',
+    'User can view integrations list',
+    2,
+    '{
+        "en": "View integrations. User can view the list of connected integrations",
+        "ru": "Просмотр интеграций. Пользователь может просматривать список подключённых интеграций"
+    }'::jsonb
+)
+ON CONFLICT DO NOTHING;
@@ -0,0 +1,2 @@
+ALTER TABLE tasks.tasks
+    ADD COLUMN IF NOT EXISTS source_url VARCHAR(500);
@@ -0,0 +1,13 @@
+-- Notifications
+CREATE TABLE IF NOT EXISTS tasks.notifications (
+    id INTEGER GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    user_id INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    task_id INTEGER REFERENCES tasks.tasks(id) ON DELETE SET NULL,
+    title VARCHAR(255) NOT NULL,
+    body VARCHAR(1000),
+    read BOOLEAN NOT NULL DEFAULT false,
+    created_at TIMESTAMP NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_notifications_user_unread
+    ON tasks.notifications (user_id, created_at DESC) WHERE NOT read;
@@ -0,0 +1,11 @@
+ALTER TABLE tasks.notifications
+    ADD COLUMN IF NOT EXISTS type VARCHAR(50) NOT NULL DEFAULT 'deadline';
+
+CREATE TABLE IF NOT EXISTS tasks.device_tokens (
+    id INTEGER GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    user_id INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    token VARCHAR(500) NOT NULL,
+    platform VARCHAR(20) NOT NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT NOW(),
+    CONSTRAINT uq_device_token UNIQUE (user_id, token)
+);
@@ -0,0 +1,5 @@
+-- Convert TIMETZ columns to TIME (without timezone)
+-- Existing values are converted to UTC automatically by "AT TIME ZONE 'UTC'"
+ALTER TABLE tasks.tasks
+  ALTER COLUMN start_time TYPE TIME USING start_time AT TIME ZONE 'UTC',
+  ALTER COLUMN end_time TYPE TIME USING end_time AT TIME ZONE 'UTC';
@@ -0,0 +1,2 @@
+ALTER TABLE tasks.device_tokens
+  ADD COLUMN IF NOT EXISTS timezone VARCHAR(50) NOT NULL DEFAULT 'UTC';
@@ -0,0 +1,4 @@
+CREATE TABLE IF NOT EXISTS tasks.notification_preferences (
+    user_id INTEGER PRIMARY KEY REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    settings JSONB NOT NULL DEFAULT '{}'
+);
@@ -0,0 +1,26 @@
+CREATE TABLE IF NOT EXISTS tasks.webhooks (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    goal_id INTEGER NOT NULL REFERENCES tasks.goals(id) ON DELETE CASCADE,
+    url VARCHAR(500) NOT NULL,
+    secret_encrypted VARCHAR NOT NULL,
+    events VARCHAR[] NOT NULL DEFAULT '{}',
+    is_active BOOLEAN NOT NULL DEFAULT true,
+    consecutive_failures INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS tasks.webhook_deliveries (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    webhook_id INTEGER NOT NULL REFERENCES tasks.webhooks(id) ON DELETE CASCADE,
+    event VARCHAR(50) NOT NULL,
+    payload JSONB NOT NULL,
+    status VARCHAR(20) NOT NULL DEFAULT 'pending',
+    response_code INTEGER,
+    attempts INTEGER NOT NULL DEFAULT 0,
+    last_attempt_at TIMESTAMP,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhooks_goal_id ON tasks.webhooks(goal_id);
+CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_webhook_id ON tasks.webhook_deliveries(webhook_id);
@@ -0,0 +1,10 @@
+-- Fix: these migrations were missing from 1.25.0 migrate.json scripts list
+
+-- Convert TIMETZ columns to TIME (without timezone)
+-- Existing values are converted to UTC automatically by "AT TIME ZONE 'UTC'"
+ALTER TABLE tasks.tasks
+  ALTER COLUMN start_time TYPE TIME USING start_time AT TIME ZONE 'UTC',
+  ALTER COLUMN end_time TYPE TIME USING end_time AT TIME ZONE 'UTC';
+
+ALTER TABLE tasks.device_tokens
+  ADD COLUMN IF NOT EXISTS timezone VARCHAR(50) NOT NULL DEFAULT 'UTC';
@@ -0,0 +1,13 @@
+CREATE TABLE IF NOT EXISTS tv_auth.api_tokens (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    user_id INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    name VARCHAR(100) NOT NULL,
+    token_hash VARCHAR(64) NOT NULL UNIQUE,
+    allowed_permissions VARCHAR[] NOT NULL DEFAULT '{}',
+    last_used_at TIMESTAMP,
+    expires_at TIMESTAMP,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_api_tokens_token_hash ON tv_auth.api_tokens(token_hash);
+CREATE INDEX IF NOT EXISTS idx_api_tokens_user_id ON tv_auth.api_tokens(user_id);
@@ -0,0 +1 @@
+ALTER TABLE tv_auth.api_tokens ADD COLUMN IF NOT EXISTS allowed_goal_ids INTEGER[] NOT NULL DEFAULT '{}';
@@ -0,0 +1,6 @@
+ALTER TABLE tv_auth.user_tokens
+  DROP COLUMN IF EXISTS access_token,
+  DROP COLUMN IF EXISTS refresh_token,
+  ADD COLUMN IF NOT EXISTS device_name varchar(200),
+  ADD COLUMN IF NOT EXISTS user_agent text,
+  ADD COLUMN IF NOT EXISTS last_used_at timestamp;
@@ -0,0 +1,610 @@
+--1.
+--Trigger set previous version
+create or replace function app.trigger_set_previous_version()
+    returns trigger as
+$date_complete$
+begin
+    new.prev_version = old.version;
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists trigger_set_previous_version on app.version;
+create trigger trigger_set_previous_version
+    before insert
+    on app.version
+    for each row
+execute procedure app.trigger_set_previous_version();
+
+--2.
+--Trigger for adding owner for taskList from goal
+create or replace function tasks.trigger_set_owner_for_component()
+    returns trigger as
+$date_complete$
+begin
+    new.owner = (select owner from tasks.goals where id = new.goal_id);
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists trigger_set_owner_for_component on tasks.goal_lists;
+create trigger trigger_set_owner_for_component
+    before insert
+    on tasks.goal_lists
+    for each row
+execute procedure tasks.trigger_set_owner_for_component();
+
+--3.
+--Trigger for updating date_complete for task
+create or replace function tasks.update_date_complete()
+    returns trigger as
+$date_complete$
+begin
+    if new.complete != old.complete
+    then
+        if new.complete = true
+        then
+            update tasks.tasks set date_complete = now() where id = old.id;
+        else
+            update tasks.tasks set date_complete = null where id = old.id;
+        end if;
+    end if;
+    return new;
+end;
+$date_complete$
+    language plpgsql;
+
+drop trigger if exists tr_update_date_complete on tasks.tasks;
+create trigger tr_update_date_complete
+    after update
+    on tasks.tasks
+    for each row
+execute procedure tasks.update_date_complete();
+
+--4.
+-- Delete user from collaboration if not assigned to any goal
+create or replace function collaboration.delete_user_if_not_assigned_to_goal()
+returns trigger as $$
+declare
+    count int;
+begin
+    if not exists (
+        select 1
+        from collaboration.users_to_goals
+        where user_id = old.user_id
+        limit 1
+    ) then
+        delete from collaboration.users where id = old.user_id;
+    end if;
+
+    return old;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_delete_user_if_not_assigned_to_goal on collaboration.users_to_goals;
+create trigger trigger_delete_user_if_not_assigned_to_goal 
+    after delete 
+    on collaboration.users_to_goals 
+    for each row 
+execute function collaboration.delete_user_if_not_assigned_to_goal();
+
+--5.
+--Trigger for checking task graph relation goal to avoid connection between tasks from different goals
+create or replace function tasks.check_task_graph_relation_goal()
+returns trigger as $$
+declare
+    from_goal int;
+    to_goal   int;
+begin
+    select goal_id into from_goal from tasks.tasks where id = new.from_task_id;
+    select goal_id into to_goal   from tasks.tasks where id = new.to_task_id;
+
+    if from_goal is null or to_goal is null then
+        raise exception 'Invalid task reference in relation';
+    end if;
+
+    if from_goal <> to_goal then
+        raise exception 'Relation goal_id must match both tasks'' goal_id';
+    end if;
+
+    new.goal_id := from_goal;
+
+    return new;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_task_relation_goal on tasks.task_relations;
+create trigger trigger_task_relation_goal
+before insert or update on tasks.task_relations
+for each row execute function tasks.check_task_graph_relation_goal();
+
+--6.
+--Trigger for logging changes in taskList to history table
+create or replace function tasks.log_changes_tasks_goal_lists()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_goal_lists (goal_list_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_goal_lists (goal_list_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_goal_lists on tasks.goal_lists;
+create trigger trigger_log_changes_tasks_goal_lists
+    before update or delete
+    on tasks.goal_lists
+    for each row
+execute procedure tasks.log_changes_tasks_goal_lists();
+
+--7.
+--Trigger for logging changes in goal to history table
+create or replace function tasks.log_changes_tasks_goals()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_goals (goal_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_goals (goal_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_goals on tasks.goals;
+create trigger trigger_log_changes_tasks_goals
+    before update or delete
+    on tasks.goals
+    for each row
+execute procedure tasks.log_changes_tasks_goals();
+
+--8.
+--Trigger for logging changes in task to history table
+create or replace function tasks.log_changes_tasks_tasks()
+    returns trigger as
+$body$
+begin
+    if tg_op = 'DELETE' then
+        insert into history.tasks_tasks (task_id, edit_date, task, deleted) values (old.id, now(), to_jsonb(old), 1);
+        return old;
+    elseif tg_op = 'UPDATE' then
+        insert into history.tasks_tasks (task_id, edit_date, task, deleted)
+        VALUES (old.id, new.date_creation, to_jsonb(old), 0);
+        new.edit_date = now();
+        return new;
+    end if;
+end
+$body$
+    language plpgsql;
+
+drop trigger if exists trigger_log_changes_tasks_tasks on tasks.tasks;
+create trigger trigger_log_changes_tasks_tasks
+    before update or delete
+    on tasks.tasks
+    for each row
+execute procedure tasks.log_changes_tasks_tasks();
+
+--9.
+--Trigger for setting goal_id default for task
+CREATE OR REPLACE FUNCTION tasks.set_goal_id_default_for_task()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    goal_id INT;
+BEGIN
+    
+    SELECT gl.goal_id
+    INTO goal_id
+    FROM tasks.goal_lists gl
+    WHERE gl.id = NEW.goal_list_id;
+
+    IF goal_id IS NOT NULL THEN
+        NEW.goal_id := goal_id;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists before_insert_set_goal_id_for_task on tasks.tasks;
+
+CREATE TRIGGER before_insert_set_goal_id_for_task
+    BEFORE INSERT OR UPDATE
+    ON tasks.tasks
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.set_goal_id_default_for_task();
+
+
+--10.
+--Trigger for adding default roles and permissions for goal
+CREATE OR REPLACE FUNCTION tasks.add_roles_and_permissions()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    editor_role_id  INTEGER;
+    executor_role_id INTEGER;
+BEGIN
+    -- 1. Create role "editor"
+    INSERT INTO collaboration.roles (name, goal_id)
+    VALUES ('editor', NEW.id)
+    RETURNING id INTO editor_role_id;
+
+    -- 2. Create role "executor"
+    INSERT INTO collaboration.roles (name, goal_id)
+    VALUES ('executor', NEW.id)
+    RETURNING id INTO executor_role_id;
+
+    -- 3. Add permissions for role "editor"
+    INSERT INTO collaboration.permissions_to_role (role_id, permission_id)
+    SELECT editor_role_id, id
+    FROM tv_auth.permissions
+    WHERE name IN (
+                   'goal_can_watch_content',
+                   'goal_can_edit',
+                   'goal_can_add_task_list',
+                   'goal_can_manage_users',
+                   'component_can_watch_content',
+                   'component_can_edit',
+                   'component_can_delete',
+                   'component_can_add_tasks',
+                   'task_can_edit_deadline',
+                   'task_can_watch_subtasks',
+                   'task_can_watch_note',
+                   'task_can_recovery_history',
+                   'task_can_watch_assigned_users',
+                   'task_can_edit_priority',
+                   'task_can_delete',
+                   'task_can_watch_details',
+                   'task_can_assign_users',
+                   'task_can_add_subtasks',
+                   'task_can_watch_tags',
+                   'task_can_watch_priority',
+                   'task_can_access_history',
+                   'task_can_edit_tags',
+                   'task_can_edit_description',
+                   'task_can_edit_status',
+                   'task_can_edit_note',
+                   'kanban_can_manage',
+                   'kanban_can_view',
+                   'graph_can_manage',
+                   'graph_can_view'
+        );
+
+    -- 4. Add permissions for role "viewver"
+    INSERT INTO collaboration.permissions_to_role (role_id, permission_id)
+    SELECT executor_role_id, id
+    FROM tv_auth.permissions
+    WHERE name IN (
+                   'goal_can_watch_content',
+                   'component_can_watch_content',
+                   'component_can_add_tasks',
+                   'task_can_watch_subtasks',
+                   'task_can_watch_note',
+                   'task_can_watch_assigned_users',
+                   'task_can_watch_details',
+                   'task_can_add_subtasks',
+                   'task_can_watch_tags',
+                   'task_can_watch_priority'
+        );
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+
+drop trigger if exists add_roles_after_insert on tasks.goals;
+
+CREATE TRIGGER add_roles_after_insert
+    AFTER INSERT
+    ON tasks.goals 
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.add_roles_and_permissions();
+
+
+--11.
+--Trigger for adjusting start and end dates for task
+CREATE OR REPLACE FUNCTION tasks.adjust_start_and_end_dates()
+    RETURNS TRIGGER AS
+$$
+DECLARE
+    start_timestamp TIMESTAMPTZ;
+    end_timestamp   TIMESTAMPTZ;
+BEGIN
+    -- If start_date is NULL, then start_time should be NULL
+    IF NEW.start_date IS NULL THEN
+        NEW.start_time := NULL;
+    END IF;
+
+    -- If end_date is NULL, then end_time should be NULL
+    IF NEW.end_date IS NULL THEN
+        NEW.end_time := NULL;
+    END IF;
+
+    -- If both dates are set
+    IF NEW.start_date IS NOT NULL AND NEW.end_date IS NOT NULL THEN
+        -- Adjust dates
+        IF NEW.start_date > NEW.end_date THEN
+            -- If start_date is greater than end_date, set end_date to start_date
+            NEW.end_date := NEW.start_date;
+            -- end_time remains unchanged
+        ELSIF NEW.end_date < NEW.start_date THEN
+            -- If end_date is less than start_date, set start_date to end_date
+            NEW.start_date := NEW.end_date;
+            -- start_time remains unchanged
+        END IF;
+
+        -- Prepare timestamps for comparison
+        start_timestamp := (NEW.start_date::text || ' ' || COALESCE(NEW.start_time::text, '00:00:00+00'))::timestamptz;
+        end_timestamp := (NEW.end_date::text || ' ' || COALESCE(NEW.end_time::text, '00:00:00+00'))::timestamptz;
+
+        -- If start_timestamp is greater than end_timestamp, adjust end_date and end_time
+        IF start_timestamp > end_timestamp THEN
+            NEW.end_date := NEW.start_date;
+            -- Assign end_time only if start_time is not NULL
+            IF NEW.start_time IS NOT NULL AND NEW.end_time IS NOT NULL THEN
+                NEW.end_time := NEW.start_time;
+            END IF;
+        END IF;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+
+drop trigger if exists adjust_dates_and_times_trigger on tasks.tasks;
+CREATE TRIGGER adjust_dates_and_times_trigger
+    BEFORE INSERT OR UPDATE
+    ON tasks.tasks
+    FOR EACH ROW
+EXECUTE FUNCTION tasks.adjust_start_and_end_dates();
+
+--12.
+--Trigger for adding self/owner to collaboration table to be able to assign tasks to self
+create or replace function tasks.add_self_to_collaboration()
+returns trigger as $$
+DECLARE
+    owner_email TEXT;
+BEGIN
+
+    select email into owner_email
+    from tv_auth.users
+    where id = NEW.owner;
+
+    if owner_email is not null then
+        insert into collaboration.users (email) values (owner_email) ON CONFLICT (email) DO NOTHING;
+        insert into collaboration.users_to_goals (goal_id, user_id) values (NEW.id, (select id from collaboration.users where email = owner_email));
+    end if;
+
+    return NEW;
+END;
+$$ language plpgsql;
+
+drop trigger if exists add_selt_to_collaboration_trg on tasks.goals;
+
+create trigger add_selt_to_collaboration_trg
+    after insert on tasks.goals
+    for each row
+    execute function tasks.add_self_to_collaboration();
+
+--13.
+--Trigger for adding default kanban columns for new goal
+CREATE OR REPLACE FUNCTION tasks.kanban_add_default_columns()
+RETURNS TRIGGER AS $$
+BEGIN
+    -- Add default columns for new goal
+    INSERT INTO tasks.statuses (name, goal_id, view_order)
+    VALUES 
+        ('TODO', NEW.id, 1),
+        ('In Progress', NEW.id, 2),
+        ('Done', NEW.id, 3);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS kanban_add_default_columns_trg ON tasks.goals;
+
+CREATE TRIGGER kanban_add_default_columns_trg
+AFTER INSERT ON tasks.goals
+FOR EACH ROW
+EXECUTE FUNCTION tasks.kanban_add_default_columns();
+
+--14.
+--Trigger for validating the correct statusId for the inserted value. To avoid assigning a status that does not belong to the goal.
+CREATE OR REPLACE FUNCTION tasks.check_task_status_goal()
+RETURNS TRIGGER AS $$
+BEGIN
+    -- Check if there is a record in tasks.statuses with the same goal_id
+    IF NOT EXISTS (
+        SELECT 1 FROM tasks.statuses s 
+        WHERE s.id = NEW.status_id AND s.goal_id = NEW.goal_id
+    ) THEN
+        RAISE EXCEPTION 'Status ID % is not valid for goal ID %', NEW.status_id, NEW.goal_id;
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists enforce_task_status_goal on tasks.tasks;
+
+CREATE TRIGGER enforce_task_status_goal
+BEFORE INSERT OR UPDATE ON tasks.tasks
+FOR EACH ROW
+WHEN (NEW.status_id IS NOT NULL)
+EXECUTE FUNCTION tasks.check_task_status_goal();
+
+--15.
+--Trigger for setting default orders value for task
+CREATE OR REPLACE FUNCTION tasks.set_order_value()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW.task_order IS NULL THEN
+        NEW.task_order := NEW.id;
+    END IF;
+    IF NEW.kanban_order IS NULL THEN
+        NEW.kanban_order := NEW.id;
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists set_order_trigger on tasks.tasks;
+CREATE TRIGGER set_order_trigger
+BEFORE INSERT ON tasks.tasks
+FOR EACH ROW
+EXECUTE FUNCTION tasks.set_order_value();
+
+--16.
+--Trigger for setting default view order for new status
+CREATE OR REPLACE FUNCTION tasks.status_set_default_view_order()
+RETURNS TRIGGER AS $$
+DECLARE
+    new_view_order INT;
+BEGIN
+    -- Determine the next view_order for the given goal_id
+    SELECT COALESCE(MAX(view_order), 0) + 1 INTO new_view_order
+    FROM tasks.statuses
+    WHERE goal_id = NEW.goal_id;
+
+    -- Assign the calculated value to the view_order field
+    NEW.view_order := new_view_order;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists set_default_status_view_order on tasks.statuses;
+
+CREATE TRIGGER set_default_status_view_order
+BEFORE INSERT ON tasks.statuses
+FOR EACH ROW
+EXECUTE FUNCTION tasks.status_set_default_view_order();
+
+--17.
+--Trigger for validating the correct user_id for the inserted value. To avoid assigning a user that does not belong to the goal.
+CREATE OR REPLACE FUNCTION tasks_auth.control_user_id_is_from_same_goal_as_task()
+RETURNS TRIGGER AS $$
+DECLARE
+    user_exists BOOLEAN;
+BEGIN
+    SELECT EXISTS (
+        SELECT 1 
+        FROM tasks.tasks tt    
+        LEFT JOIN collaboration.users_to_goals utg ON utg.goal_id = tt.goal_id
+        WHERE tt.id = NEW.task_id AND utg.user_id = NEW.collab_user_id
+    ) INTO user_exists;
+
+    IF NOT user_exists THEN
+        RAISE EXCEPTION 'User % is not associated with the goal of task %', NEW.collab_user_id, NEW.task_id;
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+drop trigger if exists trigger_control_user_id_is_from_same_goal_as_task on tasks_auth.task_assignee;
+
+CREATE TRIGGER trigger_control_user_id_is_from_same_goal_as_task
+BEFORE INSERT ON tasks_auth.task_assignee
+FOR EACH ROW
+EXECUTE FUNCTION tasks_auth.control_user_id_is_from_same_goal_as_task();
+
+--18.
+--Trigger for adding owner for task, extend owner from goal or taskList
+
+--delete old function with wrong name
+drop trigger if exists trigger_set_owner_for_task on tasks.tasks;
+drop function if exists tasks.trigger_set_owner_for_task();
+
+CREATE OR REPLACE FUNCTION tasks.fn_set_owner_for_task()
+RETURNS TRIGGER AS
+$body$
+BEGIN
+    NEW.owner := COALESCE(
+        (SELECT owner FROM tasks.goal_lists WHERE id = NEW.goal_list_id),
+        (SELECT owner FROM tasks.goals WHERE id = NEW.goal_id)
+    );
+    
+    IF NEW.owner IS NULL THEN
+        RAISE EXCEPTION 'Can not insert task without owner';
+    END IF;
+
+    RETURN NEW;
+END;
+$body$
+LANGUAGE plpgsql;
+
+drop trigger if exists trigger_set_owner_for_task on tasks.tasks;
+create trigger trigger_set_owner_for_task
+    before insert
+    on tasks.tasks
+    for each row
+execute procedure tasks.fn_set_owner_for_task();
+
+--19.
+--Trigger for validating that tag and task belong to the same project (goal_id)
+drop trigger if exists trigger_check_tag_task_same_goal on tasks.tasks_to_tags;
+drop function if exists tasks.check_tag_task_same_goal();
+
+create or replace function tasks.check_tag_task_same_goal()
+returns trigger as $$
+declare
+    v_tag_goal_id integer;
+    v_task_goal_id integer;
+begin
+    select goal_id into v_tag_goal_id from tasks.tags where id = new.tag_id;
+    select goal_id into v_task_goal_id from tasks.tasks where id = new.task_id;
+
+    if v_tag_goal_id is null or v_tag_goal_id != v_task_goal_id then
+        raise exception 'Tag (id=%) and task (id=%) belong to different projects', new.tag_id, new.task_id;
+    end if;
+
+    return new;
+end;
+$$ language plpgsql;
+
+drop trigger if exists trigger_check_tag_task_same_goal on tasks.tasks_to_tags;
+create trigger trigger_check_tag_task_same_goal
+    before insert on tasks.tasks_to_tags
+    for each row
+execute function tasks.check_tag_task_same_goal();
+
+--20.
+-- Remove user from task assignees when removed from project collaboration
+
+drop trigger if exists trigger_remove_user_from_task_assignees on collaboration.users_to_goals;
+drop function if exists collaboration.remove_user_from_task_assignees();
+
+
+CREATE OR REPLACE FUNCTION collaboration.remove_user_from_task_assignees()
+RETURNS TRIGGER AS $$
+BEGIN
+    DELETE FROM tasks_auth.task_assignee
+    WHERE collab_user_id = OLD.user_id
+      AND task_id IN (SELECT id FROM tasks.tasks WHERE goal_id = OLD.goal_id);
+
+    RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trigger_remove_user_from_task_assignees ON collaboration.users_to_goals;
+
+CREATE TRIGGER trigger_remove_user_from_task_assignees
+    BEFORE DELETE
+    ON collaboration.users_to_goals
+    FOR EACH ROW
+EXECUTE FUNCTION collaboration.remove_user_from_task_assignees();
@@ -0,0 +1,50 @@
+-- Organizations
+CREATE TABLE IF NOT EXISTS tv_auth.organizations (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    name VARCHAR NOT NULL,
+    slug VARCHAR NOT NULL UNIQUE,
+    owner_id INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    logo_url VARCHAR,
+    is_personal INTEGER NOT NULL DEFAULT 0,
+    plan VARCHAR NOT NULL DEFAULT 'free',
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_organizations_owner_id ON tv_auth.organizations(owner_id);
+CREATE INDEX IF NOT EXISTS idx_organizations_slug ON tv_auth.organizations(slug);
+
+-- Organization members (by email, not user_id)
+CREATE TABLE IF NOT EXISTS tv_auth.organization_members (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    organization_id INTEGER NOT NULL REFERENCES tv_auth.organizations(id) ON DELETE CASCADE,
+    email VARCHAR NOT NULL,
+    role VARCHAR NOT NULL DEFAULT 'member',
+    invited_by INTEGER REFERENCES tv_auth.users(id) ON DELETE SET NULL,
+    created_at TIMESTAMP DEFAULT NOW(),
+    UNIQUE(organization_id, email)
+);
+
+CREATE INDEX IF NOT EXISTS idx_org_members_organization_id ON tv_auth.organization_members(organization_id);
+CREATE INDEX IF NOT EXISTS idx_org_members_email ON tv_auth.organization_members(email);
+
+-- Add organization_id to goals (nullable for migration, will be set NOT NULL after data migration)
+ALTER TABLE tasks.goals ADD COLUMN IF NOT EXISTS organization_id INTEGER;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM information_schema.table_constraints
+        WHERE constraint_name = 'goals_organization_id_fkey'
+          AND table_schema = 'tasks'
+          AND table_name = 'goals'
+    ) THEN
+        ALTER TABLE tasks.goals
+        ADD CONSTRAINT goals_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES tv_auth.organizations(id)
+        ON DELETE CASCADE;
+    END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS idx_goals_organization_id ON tasks.goals(organization_id);
@@ -0,0 +1,36 @@
+-- Step 1: Create personal organization for each user who owns goals
+INSERT INTO tv_auth.organizations (name, slug, owner_id, is_personal)
+SELECT
+    u.login || '''s workspace',
+    'org-' || substr(md5(random()::text), 1, 8),
+    u.id,
+    1
+FROM tv_auth.users u
+WHERE EXISTS (SELECT 1 FROM tasks.goals g WHERE g.owner = u.id)
+ON CONFLICT DO NOTHING;
+
+-- Step 2: Link goals to their owner's organization
+UPDATE tasks.goals g
+SET organization_id = o.id
+FROM tv_auth.organizations o
+WHERE g.owner = o.owner_id
+  AND g.organization_id IS NULL;
+
+-- Step 3: Add owner as org member with role 'owner' (by email)
+INSERT INTO tv_auth.organization_members (organization_id, email, role)
+SELECT o.id, u.email, 'owner'
+FROM tv_auth.organizations o
+JOIN tv_auth.users u ON u.id = o.owner_id
+ON CONFLICT (organization_id, email) DO NOTHING;
+
+-- Step 4: Add existing goal collaborators as org members (by email)
+INSERT INTO tv_auth.organization_members (organization_id, email, role)
+SELECT DISTINCT g.organization_id, cu.email, 'member'
+FROM collaboration.users_to_goals cutg
+JOIN collaboration.users cu ON cu.id = cutg.user_id
+JOIN tasks.goals g ON g.id = cutg.goal_id
+WHERE g.organization_id IS NOT NULL
+ON CONFLICT (organization_id, email) DO NOTHING;
+
+-- Step 5: Make organization_id NOT NULL
+ALTER TABLE tasks.goals ALTER COLUMN organization_id SET NOT NULL;
@@ -0,0 +1,45 @@
+CREATE TABLE IF NOT EXISTS tv_auth.sso_configs (
+  id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+  organization_id INTEGER NOT NULL REFERENCES tv_auth.organizations(id) ON DELETE CASCADE,
+  protocol VARCHAR NOT NULL,
+  display_name VARCHAR NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+
+  saml_entry_point VARCHAR,
+  saml_issuer VARCHAR,
+  saml_cert TEXT,
+  saml_callback_url VARCHAR,
+
+  oidc_issuer VARCHAR,
+  oidc_client_id VARCHAR,
+  oidc_client_secret VARCHAR,
+  oidc_callback_url VARCHAR,
+  oidc_scope VARCHAR,
+
+  default_org_role VARCHAR NOT NULL DEFAULT 'member',
+  email_domain_restriction VARCHAR NOT NULL,
+
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW(),
+  UNIQUE(email_domain_restriction)
+);
+
+CREATE TABLE IF NOT EXISTS tv_auth.sso_identities (
+  id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+  user_id INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+  sso_config_id INTEGER NOT NULL REFERENCES tv_auth.sso_configs(id) ON DELETE CASCADE,
+  external_id VARCHAR NOT NULL,
+  email VARCHAR NOT NULL,
+  last_login_at TIMESTAMP,
+  created_at TIMESTAMP DEFAULT NOW(),
+  UNIQUE(sso_config_id, external_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_sso_identities_user_id ON tv_auth.sso_identities(user_id);
+CREATE INDEX IF NOT EXISTS idx_sso_identities_email ON tv_auth.sso_identities(email);
+
+CREATE TABLE IF NOT EXISTS tv_auth.saml_request_cache (
+  key VARCHAR PRIMARY KEY,
+  value VARCHAR NOT NULL,
+  created_at BIGINT NOT NULL
+);
@@ -0,0 +1,2 @@
+ALTER TABLE tv_auth.sso_configs ADD COLUMN IF NOT EXISTS saml_signing_key TEXT;
+ALTER TABLE tv_auth.sso_configs ADD COLUMN IF NOT EXISTS saml_signing_cert TEXT;
@@ -0,0 +1 @@
+ALTER TABLE tv_auth.sso_configs ADD COLUMN IF NOT EXISTS saml_logout_url VARCHAR;
@@ -0,0 +1,2 @@
+ALTER TABLE tv_auth.sso_configs ADD COLUMN IF NOT EXISTS scim_token VARCHAR;
+ALTER TABLE tv_auth.sso_configs ADD COLUMN IF NOT EXISTS scim_enabled INTEGER NOT NULL DEFAULT 0;
@@ -0,0 +1,22 @@
+-- Create personal organizations for users who don't have any organization membership
+-- This covers the default seed user (login: 'user', email: 'test@mail.dest')
+-- and any other users who may exist without an organization
+INSERT INTO tv_auth.organizations (name, slug, owner_id, is_personal)
+SELECT
+    u.login || '''s workspace',
+    'org-' || substr(md5(random()::text), 1, 8),
+    u.id,
+    1
+FROM tv_auth.users u
+WHERE NOT EXISTS (
+    SELECT 1 FROM tv_auth.organization_members om WHERE om.email = u.email
+)
+ON CONFLICT DO NOTHING;
+
+-- Add these users as owners of their new personal organizations
+INSERT INTO tv_auth.organization_members (organization_id, email, role)
+SELECT o.id, u.email, 'owner'
+FROM tv_auth.organizations o
+JOIN tv_auth.users u ON u.id = o.owner_id
+WHERE o.is_personal = 1
+ON CONFLICT (organization_id, email) DO NOTHING;
@@ -3,11 +3,19 @@ import CollaborationRoutes from '../tv-modules/collaboration/CollaborationRoutes
 import CollaborationRolesRoutes from '../tv-modules/collaboration-roles/CollaborationRolesRoutes';
 import GoalsRoutes from '../tv-modules/goals/GoalsRoutes';
 import GraphRoutes from '../tv-modules/graph/GraphRoutes';
+import IntegrationsRoutes from '../tv-modules/integrations/IntegrationsRoutes';
+import NotificationsRoutes from '../tv-modules/notifications/NotificationsRoutes';
+import WebhooksRoutes from '../tv-modules/webhooks/WebhooksRoutes';
+import ApiTokensRoutes from '../tv-modules/api-tokens/ApiTokensRoutes';
+import SessionsRoutes from '../tv-modules/sessions/SessionsRoutes';
 import KanbanRoutes from '../tv-modules/kanban/KanbanRoutes';
 import GoalListRoutes from '../tv-modules/lists/GoalListRoutes';
 import StartRoutes from '../tv-modules/start/StartRoutes';
 import TagsRouter from '../tv-modules/tags/TagsRouter';
 import TasksRoutes from '../tv-modules/tasks/TasksRoutes';
+import OrganizationRoutes from '../tv-modules/organizations/OrganizationRoutes';
+import SsoRoutes from '../tv-modules/sso/SsoRoutes';
+import ScimRoutes from '../tv-modules/scim/ScimRoutes';
 import type { Routable } from '../types/routable.type';

 type RoutableConstructor = new (...args: any[]) => Routable;
@@ -23,6 +31,14 @@ const routes: Record<string, RoutableConstructor> = {
    '/module/about': StartRoutes,
    '/module/kanban': KanbanRoutes,
    '/module/graph': GraphRoutes,
+    '/module/integrations': IntegrationsRoutes,
+    '/module/notifications': NotificationsRoutes,
+    '/module/webhooks': WebhooksRoutes,
+    '/module/api-tokens': ApiTokensRoutes,
+    '/module/sessions': SessionsRoutes,
+    '/module/organizations': OrganizationRoutes,
+    '/module/sso': SsoRoutes,
+    '/scim/v2': ScimRoutes,
 };

 export default routes;
@@ -0,0 +1,53 @@
+import type { Request, Response } from 'express';
+import { ArkErrors } from 'arktype';
+import { getApiTokensManager } from './ApiTokensManager';
+import { ApiTokenArkTypeCreate, ApiTokenArkTypeDelete } from './types';
+import { Database } from '../../modules/db';
+
+export class ApiTokensController {
+    private get manager() { return getApiTokensManager(); }
+
+    create = async (req: Request, res: Response) => {
+        const data = ApiTokenArkTypeCreate(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.create(userId, data);
+        if (!result) return res.status(500).end();
+
+        return res.tvJson(result);
+    };
+
+    delete = async (req: Request, res: Response) => {
+        const data = ApiTokenArkTypeDelete(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.delete(data.id, userId);
+        return res.tvJson(result);
+    };
+
+    fetch = async (req: Request, res: Response) => {
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.fetchAll(userId);
+        return res.tvJson(result);
+    };
+
+    fetchPermissions = async (_req: Request, res: Response) => {
+        const db = Database.getInstance();
+        const result = await db.query<{ id: number; name: string; description: string; permissionGroup: number }>(
+            `SELECT id, name, description, permission_group as "permissionGroup" FROM tv_auth.permissions WHERE permission_group <> 1 ORDER BY permission_group, id`
+        );
+        return res.tvJson(result?.rows ?? []);
+    };
+}
@@ -0,0 +1,68 @@
+import { randomBytes, createHash } from 'crypto';
+import { ApiTokensRepository } from './ApiTokensRepository';
+import { TOKEN_PREFIX, type ApiTokenArgCreate } from './types';
+import type { ApiTokensSchemaTypeForSelect } from 'taskview-db-schemas';
+
+export type ApiTokenForClient = Omit<ApiTokensSchemaTypeForSelect, 'tokenHash'>;
+
+export class ApiTokensManager {
+    public readonly repository: ApiTokensRepository;
+
+    constructor() {
+        this.repository = new ApiTokensRepository();
+    }
+
+    async create(userId: number, data: ApiTokenArgCreate): Promise<{ token: string; item: ApiTokenForClient } | null> {
+        const raw = randomBytes(32).toString('hex');
+        const fullToken = TOKEN_PREFIX + raw;
+        const tokenHash = createHash('sha256').update(fullToken).digest('hex');
+
+        const expiresAt = data.expiresAt ? new Date(data.expiresAt) : null;
+
+        const record = await this.repository.create({
+            userId,
+            name: data.name,
+            tokenHash,
+            allowedPermissions: data.allowedPermissions ?? [],
+            allowedGoalIds: data.allowedGoalIds ?? [],
+            expiresAt,
+        });
+
+        if (!record) return null;
+
+        return { token: fullToken, item: this.toClient(record) };
+    }
+
+    async delete(id: number, userId: number): Promise<boolean> {
+        return this.repository.delete(id, userId);
+    }
+
+    async fetchAll(userId: number): Promise<ApiTokenForClient[]> {
+        const tokens = await this.repository.fetchByUserId(userId);
+        return tokens.map((t) => this.toClient(t));
+    }
+
+    async validateToken(fullToken: string): Promise<ApiTokensSchemaTypeForSelect | null> {
+        const tokenHash = createHash('sha256').update(fullToken).digest('hex');
+        const record = await this.repository.findByTokenHash(tokenHash);
+
+        if (!record) return null;
+        if (record.expiresAt && record.expiresAt < new Date()) return null;
+
+        this.repository.updateLastUsedAt(record.id).catch(() => {});
+
+        return record;
+    }
+
+    private toClient(token: ApiTokensSchemaTypeForSelect): ApiTokenForClient {
+        const { tokenHash, ...rest } = token;
+        return rest;
+    }
+}
+
+let _instance: ApiTokensManager | null = null;
+
+export function getApiTokensManager(): ApiTokensManager {
+    if (!_instance) _instance = new ApiTokensManager();
+    return _instance;
+}
@@ -0,0 +1,50 @@
+import { and, eq } from 'drizzle-orm';
+import { ApiTokensSchema, type ApiTokensSchemaTypeForSelect } from 'taskview-db-schemas';
+import { Database } from '../../modules/db';
+import { callWithCatch } from '../../utils/helpers';
+
+export class ApiTokensRepository {
+    private readonly db: Database;
+
+    constructor() {
+        this.db = Database.getInstance();
+    }
+
+    async create(data: { userId: number; name: string; tokenHash: string; allowedPermissions: string[]; allowedGoalIds: number[]; expiresAt: Date | null }): Promise<ApiTokensSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.insert(ApiTokensSchema).values(data).returning()
+        );
+        return result?.[0] ?? null;
+    }
+
+    async delete(id: number, userId: number): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.delete(ApiTokensSchema).where(
+                and(eq(ApiTokensSchema.id, id), eq(ApiTokensSchema.userId, userId))
+            )
+        );
+        return !!result?.rowCount;
+    }
+
+    async fetchByUserId(userId: number): Promise<ApiTokensSchemaTypeForSelect[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(ApiTokensSchema).where(eq(ApiTokensSchema.userId, userId))
+        );
+        return result ?? [];
+    }
+
+    async findByTokenHash(tokenHash: string): Promise<ApiTokensSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(ApiTokensSchema).where(eq(ApiTokensSchema.tokenHash, tokenHash))
+        );
+        return result?.[0] ?? null;
+    }
+
+    async updateLastUsedAt(id: number): Promise<void> {
+        await callWithCatch(() =>
+            this.db.dbDrizzle.update(ApiTokensSchema)
+                .set({ lastUsedAt: new Date() })
+                .where(eq(ApiTokensSchema.id, id))
+        );
+    }
+}
@@ -0,0 +1,27 @@
+import { Router } from 'express';
+import type { Routable } from '../../types/routable.type';
+import { IsLoggedIn } from '../auth/middlewares/is-logged-in';
+import { ApiTokensController } from './ApiTokensController';
+import { RejectApiTokenAuth } from './middlewares/RejectApiTokenAuth';
+
+export default class ApiTokensRoutes implements Routable {
+    private readonly router: ReturnType<typeof Router>;
+    private readonly controller: ApiTokensController;
+
+    constructor() {
+        this.router = Router();
+        this.controller = new ApiTokensController();
+        this.initRoutes();
+    }
+
+    getRouter() {
+        return this.router;
+    }
+
+    initRoutes() {
+        this.router.get('', [IsLoggedIn, RejectApiTokenAuth], this.controller.fetch);
+        this.router.post('', [IsLoggedIn, RejectApiTokenAuth], this.controller.create);
+        this.router.delete('', [IsLoggedIn, RejectApiTokenAuth], this.controller.delete);
+        this.router.get('/permissions', [IsLoggedIn, RejectApiTokenAuth], this.controller.fetchPermissions);
+    }
+}
@@ -0,0 +1,8 @@
+import type { NextFunction, Request, Response } from 'express';
+
+export const RejectApiTokenAuth = (req: Request, res: Response, next: NextFunction) => {
+    if (req.appUser.isApiTokenAuth()) {
+        return res.status(403).end();
+    }
+    return next();
+};
@@ -0,0 +1,18 @@
+import { type } from 'arktype';
+
+export const ApiTokenArkTypeCreate = type({
+    name: 'string',
+    'allowedPermissions?': 'string[]',
+    'allowedGoalIds?': 'number[]',
+    'expiresAt?': 'string|null',
+});
+
+export type ApiTokenArgCreate = typeof ApiTokenArkTypeCreate.infer;
+
+export const ApiTokenArkTypeDelete = type({
+    id: 'number',
+});
+
+export type ApiTokenArgDelete = typeof ApiTokenArkTypeDelete.infer;
+
+export const TOKEN_PREFIX = 'tvk_';
@@ -1,4 +1,5 @@
 import { compare, hashSync } from 'bcryptjs';
+import { randomInt } from 'crypto';
 import type { Request, Response } from 'express';
 import jwt, { type Algorithm, decode } from 'jsonwebtoken';
 import { z } from 'zod';
@@ -16,12 +17,25 @@ import {
 import { generateString, isEmail, time } from '../../utils/helpers';
 import EnEmailTemplate from './mail/confirm-email-en';
 import RuEmailTemplate from './mail/confirm-email-ru';
+import type { ExternalAuthUser } from './strategies/external-auth.types';
+import { OrganizationRepository } from '../organizations/OrganizationRepository';

 export default class AuthController {
    private readonly jwtAlg: Algorithm = process.env.JWT_ALG as Algorithm;
    private readonly jwtExp: string = process.env.ACCESS_LIFE_TIME!;
    private readonly jwtRefreshExp: string = process.env.REFRESH_LIFE_TIME!;

+    private readonly refreshTokenCookieName: string = 'taskview-refresh';
+    private readonly orgRepository: OrganizationRepository = new OrganizationRepository();
+
+    private async createPersonalWorkspace(userId: number, email: string, login: string) {
+        const slug = `org-${crypto.randomUUID().slice(0, 8)}`
+        const org = await this.orgRepository.create({ name: `${login}'s workspace`, slug }, userId, true)
+        if (org) {
+            await this.orgRepository.addMember(org.id, email, 'owner')
+        }
+    }
+
    comparePasswords(pwd: string, hash: string): Promise<boolean> {
        return new Promise((resolve) => {
            //Prev version was written in PHP need to replace
@@ -76,21 +90,22 @@ export default class AuthController {
    }

    makeidLogin(length: number) {
-        let result = '';
-        const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-        const charactersLength = characters.length;
-        let counter = 0;
-        while (counter < length) {
-            result += characters.charAt(Math.floor(Math.random() * charactersLength));
-            counter += 1;
+        let result = ''
+        const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+        const charactersLength = characters.length
+        for (let i = 0; i < length; i++) {
+            result += characters.charAt(randomInt(charactersLength))
        }
-        return result;
+        return result
    }

    generateEmailConfirmCode() {
        return this.makeidLogin(16);
    }

+    generateLoginCode() {
+        return `${this.makeidLogin(12)}:${Date.now()}`.toLocaleLowerCase();
+    }
    /**
     * Register user by email and send login code to the email
     * @param req
@@ -110,9 +125,8 @@ export default class AuthController {

        const { email } = data.data;

-        const code = `${this.makeidLogin(12)}:${Date.now()}`.toLocaleLowerCase();
+        const code = this.generateLoginCode();

-        $logger.info(data.data, `[AuthController:sendLoginCode] we got data for send login code`);

        let userData = await req.appUser.authManager.repository.getUserByLogin(email, isEmail(email));

@@ -123,8 +137,6 @@ export default class AuthController {
        }

        if (!userData) {
-            $logger.info(`[AuthController:sendLoginCode] trying to register user ${email}`);
-
            const password = this.makeidLogin(7),
                login = this.makeidLogin(7);

@@ -136,17 +148,18 @@ export default class AuthController {
                confirmEmailCode: '',
            });
            if (!id) {
-                $logger.error(`Can not register user ${email}`);
+                $logger.error(`Can not register user`);
                return res.status(500).end();
            }

-            $logger.info(`[AuthController:sendLoginCode] user registered ${email}`);
+            await this.createPersonalWorkspace(id, email, login)
+            $logger.info(`[AuthController:sendLoginCode] user registered`);
        }

        userData = await req.appUser.authManager.repository.getUserByLogin(email, isEmail(email));

        if (!userData) {
-            $logger.error(`Can not fetch user after registration by code ${email}`);
+            $logger.error(`Can not fetch user after registration by code`);
            return res.status(500).end();
        }

@@ -154,11 +167,11 @@ export default class AuthController {
        const now = Date.now();

        if (!lastUpdate || (lastUpdate && now - +lastUpdate > 60 * 1000)) {
-            $logger.info(`[AuthController:sendLoginCode] updating login code for user ${email}`);
+            $logger.info(`[AuthController:sendLoginCode] updating login code for user`);

            await req.appUser.authManager.repository.updateLoginCode(code, email);

-            $logger.info(`[AuthController:sendLoginCode] sending code by email to ${email}`);
+            $logger.info(`[AuthController:sendLoginCode] sending code by email to`);

            await this.sendCodeByEmail(code.split(':')[0], email);
        }
@@ -175,6 +188,111 @@ export default class AuthController {
        });
    }

+    loginByProvider = async (req: Request, res: Response) => {
+        const user = req.user as ExternalAuthUser;
+
+        if (!user) {
+            return res.status(400).send('User not found');
+        }
+
+        let userData = await req.appUser.authManager.repository.getUserByLogin(
+            user.email,
+            isEmail(user.email)
+        );
+
+        if (!userData) {
+            const password = this.makeidLogin(7);
+            const login = this.makeidLogin(7);
+
+            const id = await req.appUser.authManager.repository.registerUserInDb({
+                login,
+                email: user.email,
+                password: hashSync(password, 10),
+                block: 0,
+                confirmEmailCode: '',
+            });
+
+            if (!id) {
+                $logger.error(`Can not register user`);
+                return res.status(500).send(`Can not register user`);
+            }
+
+            await this.createPersonalWorkspace(id, user.email, login)
+
+            userData = await req.appUser.authManager.repository.getUserByLogin(
+                user.email,
+                isEmail(user.email)
+            );
+        }
+
+        if (!userData) {
+            $logger.error(`Can not find user after registration`);
+            return res.status(500).send(`Can not find user ${user.email} after registration`);
+        }
+
+        const code = this.generateLoginCode();
+
+        const result = await req.appUser.authManager.repository.updateLoginCode(code, userData.email);
+
+        if (!result) {
+            $logger.error(`Can not update login code for user`);
+            return res.status(500).send(`Can not update login code for user`);
+        }
+
+        const authData = {
+            code: code.split(':')[0],
+            email: userData.email,
+        };
+
+        const encodedAuthData = encodeURIComponent(JSON.stringify(authData));
+
+        try {
+            const platformData = JSON.parse(req.query.state as string);
+
+            if (platformData.platform === "mobile") {
+                return res.redirect(
+                    `taskview://login?tokens=${encodedAuthData}`
+                );
+            }
+        } catch (error) {
+            $logger.info(`Can not parse platform data from state: ${req.query.state}`);
+        }
+
+        return res.redirect(`${process.env.APP_URL}/login?tokens=${encodedAuthData}`);
+    }
+
+    private parseLifetimeToMs(lifetime: string): number {
+        const match = lifetime.match(/^(\d+)([smhdw])$/)
+        if (!match) return 1000 * 60 * 60 * 24 * 30
+        const value = parseInt(match[1])
+        const unit = match[2]
+        const multipliers: Record<string, number> = {
+            s: 1_000,
+            m: 60_000,
+            h: 3_600_000,
+            d: 86_400_000,
+            w: 604_800_000,
+        }
+        return value * (multipliers[unit] || 86_400_000)
+    }
+
+    setRefreshToken = async (res: Response, refreshToken: string) => {
+        res.cookie(this.refreshTokenCookieName, refreshToken, {
+            httpOnly: true,
+            secure: true,
+            sameSite: "none",
+            maxAge: this.parseLifetimeToMs(this.jwtRefreshExp),
+        });
+    }
+
+    clearRefreshToken = (res: Response) => {
+        res.clearCookie(this.refreshTokenCookieName, {
+            httpOnly: true,
+            secure: true,
+            sameSite: "none",
+        });
+    }
+
    loginByCode = async (req: Request, res: Response) => {
        const schema = z.object({
            email: z.string().email().toLowerCase(),
@@ -202,34 +320,32 @@ export default class AuthController {
        }

        if (tokenFromDb[0] !== data.data.code) {
-            return res.status(400).end();
+            return res.status(400).send({ message: 'Invalid code' });
        }

-        const tokenRowId = await req.appUser.authManager.jwtStorage.initTokenRecord(userData.id);
-        if (!tokenRowId) {
+        if (tokenFromDb[1] && Date.now() - +tokenFromDb[1] > 60 * 1000) {
+            await req.appUser.authManager.repository.updateLoginCode(null, userData.email);
+            return res.status(400).send({ message: 'Code expired, get new code' });
+        }
+
+        // Invalidate code immediately to prevent replay attacks
+        await req.appUser.authManager.repository.updateLoginCode(null, userData.email);
+
+        const sessionId = await req.appUser.authManager.sessionStorage.createSession(
+            userData.id,
+            req.ip,
+            req.headers['user-agent']
+        );
+        if (!sessionId) {
            return res.status(500).end();
        }

        const tokens = this.getTokens({
-            id: tokenRowId,
+            id: sessionId,
            userData,
        } as const);

-        const updateResult = await req.appUser.authManager.jwtStorage.updateTokens(
-            tokens.access,
-            tokens.refresh,
-            tokenRowId
-        );
-
-        if (!updateResult) {
-            $logger.error(`Can not update tokens in JWT Storage for user ${userData.id} and rowId ${tokenRowId}`);
-        }
-
-        try {
-            await req.appUser.authManager.repository.updateLoginCode(null, userData.email);
-        } catch (_err: unknown) {
-            $logger.error(`Can not update updateLoginCode after login`);
-        }
+        await this.setRefreshToken(res, tokens.refresh);

        return res.json(tokens);
    };
@@ -246,7 +362,6 @@ export default class AuthController {
        const userData = await req.appUser.authManager.repository.getUserByLogin(login, isEmail(login));

        if (!userData) {
-            $logger.info(`Can not find user with login ${login}`);
            return res.status(400).end();
        }

@@ -256,25 +371,21 @@ export default class AuthController {

        const valid = await this.comparePasswords(password, userData.password);
        if (valid) {
-            const tokenRowId = await req.appUser.authManager.jwtStorage.initTokenRecord(userData.id);
-            if (!tokenRowId) {
+            const sessionId = await req.appUser.authManager.sessionStorage.createSession(
+                userData.id,
+                req.ip,
+                req.headers['user-agent']
+            );
+            if (!sessionId) {
                return res.status(500).end();
            }

            const tokens = this.getTokens({
-                id: tokenRowId,
+                id: sessionId,
                userData,
            } as const);

-            const updateResult = await req.appUser.authManager.jwtStorage.updateTokens(
-                tokens.access,
-                tokens.refresh,
-                tokenRowId
-            );
-
-            if (!updateResult) {
-                $logger.error(`Can not update tokens in JWT Storage for user ${userData.id} and rowId ${tokenRowId}`);
-            }
+            await this.setRefreshToken(res, tokens.refresh);

            return res.json(tokens);
        }
@@ -290,7 +401,7 @@ export default class AuthController {

        email = (email as string).toLowerCase();
        if (!isEmail(email)) {
-            return res.status(40).end();
+            return res.status(400).end();
        }

        password = hashSync(password, 10);
@@ -313,6 +424,8 @@ export default class AuthController {
            return res.status(500).end();
        }

+        await this.createPersonalWorkspace(id, email, login)
+
        let emailTemplate: string = '';
        let confirmEmailBody: string = '';
        const acceptLanguage = req.headers['accept-language'];
@@ -325,7 +438,7 @@ export default class AuthController {
            emailTemplate = EnEmailTemplate;
        }

-        const confirmUrl = `https://apitaskview.handscream.com/module/auth/confirm/email/${confirmEmailCode}/login/${login}`;
+        const confirmUrl = `${process.env.APP_URL}/module/auth/confirm/email/${confirmEmailCode}/login/${login}`;

        if (emailTemplate) {
            confirmEmailBody = emailTemplate.replace('{link}', confirmUrl);
@@ -410,7 +523,7 @@ export default class AuthController {
        const result = await req.appUser.authManager.repository.setReminderCodeAndTime(userData.email, code, seconds);

        if (!result) {
-            $logger.error(`Can not set remind_code and time for user ${userData.email}`);
+            $logger.error(`Can not set remind_code and time for user`);
            return res.status(500).send();
        }

@@ -460,8 +573,6 @@ export default class AuthController {

        const passwordHash = hashSync(parsedData.data.password, 10);

-        $logger.debug(`Update ${passwordHash} for ${userData.id}`);
-
        const result = await req.appUser.authManager.repository.updateUserPassword(passwordHash, userData.id);

        $logger.debug(`Update result ${result}`);
@@ -473,54 +584,59 @@ export default class AuthController {
    };

    logout = async (req: Request, res: Response) => {
-        if (!req.headers['authorization']) {
-            return res.status(400).end();
+        this.clearRefreshToken(res);
+
+        const sessionId = req.appUser.getTokenId();
+        const userId = req.appUser.getUserData()?.id;
+
+        if (!sessionId || !userId) {
+            return res.status(401).send({ message: 'Unauthorized' });
        }

-        const result = req.headers['authorization'].match(/Bearer\s(\S+)/);
-
-        if (!result) {
-            return res.status(400).end();
-        }
-
-        const payload = decode(result['1']) as UserJwtPayload;
-        if (!payload) {
-            return res.status(400).end();
-        }
-
-        const deleteResult = await req.appUser.authManager.jwtStorage.deleteTokens(payload.userData.id, result['1']);
+        const deleteResult = await req.appUser.authManager.sessionStorage.deleteSession(sessionId, userId);

        if (!deleteResult) {
-            return res.status(500).end();
+            return res.status(500).send({ message: 'Failed to delete session' });
        }

-        return res.send();
+        return res.status(204).end();
    };

    refreshTokens = async (req: Request, res: Response) => {
-        const refreshData = RefreshTokenSchema.safeParse(req.body);
-        if (!refreshData.success) {
+        let refreshToken = req.cookies[this.refreshTokenCookieName];
+
+        if (!refreshToken) {
+            const refreshData = RefreshTokenSchema.safeParse(req.body);
+
+            if (!refreshData.success) {
+                return res.status(400).send({ message: 'Invalid refresh token' });
+            }
+
+            refreshToken = refreshData.data.refreshToken;
+            $logger.info(`Refresh token found in body`);
+        } else {
+            $logger.info(`Refresh token found in cookies`);
+        }
+
+        const payload = await AuthController.validateTokens(refreshToken);
+
+        if (!payload) {
+            $logger.info('Refresh token validation failed');
+            this.clearRefreshToken(res);
            return res.status(400).end();
        }

-        const payload = await AuthController.validateTokens(refreshData.data.refreshToken);
-
-        if (!payload) {
-            return res.status(400).end();
+        const isActive = await req.appUser.authManager.sessionStorage.isSessionActive(payload.id);
+        if (!isActive) {
+            this.clearRefreshToken(res);
+            return res.status(401).end();
        }

        const newTokens = this.getTokens(payload);

-        const update = await req.appUser.authManager.jwtStorage.updateTokens(
-            newTokens.access,
-            newTokens.refresh,
-            payload.id
-        );
+        await req.appUser.authManager.sessionStorage.updateLastUsed(payload.id);

-        if (!update) {
-            $logger.error(`Can not refresh tokens for ${payload}`);
-            return res.status(500).end();
-        }
+        await this.setRefreshToken(res, newTokens.refresh);

        return res.json(newTokens);
    };
@@ -542,12 +658,12 @@ export default class AuthController {
        });

        if (!sendResult) {
-            $logger.error(`Can not send account deletion code for user ${userId}`);
+            $logger.error(`Can not send account deletion code for user`);
        }
        const insertCode = await req.appUser.authManager.repository.addDeleteAccountCode(code, userId);

        if (!insertCode) {
-            $logger.error(`Can not insert account deletion code for user ${userId}`);
+            $logger.error(`Can not insert account deletion code for user`);
            return res.status(500).end();
        }
        return res.status(200).end();
@@ -1,15 +1,15 @@
 import type { AppUser } from '../../core/AppUser';
 import AuthModel from './AuthModel';
-import JwtStorage from './JwtStorage';
+import SessionStorage from './SessionStorage';

 export class AuthManager {
    protected readonly user: AppUser;
    public readonly repository: AuthModel;
-    public readonly jwtStorage: JwtStorage;
+    public readonly sessionStorage: SessionStorage;

    constructor(user: AppUser) {
        this.user = user;
        this.repository = new AuthModel();
-        this.jwtStorage = new JwtStorage();
+        this.sessionStorage = new SessionStorage();
    }
 }
@@ -42,6 +42,7 @@ export default class AuthModel {
            return !!(data.rowCount && data.rowCount > 0);
        } catch (error: unknown) {
            $logger.error(error, 'Can not update login code');
+            return false;
        }

        return true;
@@ -1,8 +1,9 @@
-import { Router } from 'express';
+import { Router, type NextFunction, type Request, type Response } from 'express';
 import type { Routable } from '../../types/routable.type';
 import AuthController from './AuthController';
 import { IsLoggedIn } from './middlewares/is-logged-in';
-
+import passport from './strategies/passport-login';
+import { ExternalProviderScope } from './strategies/external-auth.types';
 export default class AuthRoutes implements Routable {
    private readonly router: ReturnType<typeof Router>;
    private readonly authController: AuthController;
@@ -29,5 +30,31 @@ export default class AuthRoutes implements Routable {
        this.router.post('/refresh/token', this.authController.refreshTokens);
        this.router.post('/delete/account/code', [IsLoggedIn], this.authController.sendDeleteAccountCode);
        this.router.post('/delete/account', [IsLoggedIn], this.authController.deleteUserAccaunt);
+
+        this.router.get(
+            '/provider/:providerName',
+            (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
+                scope: ExternalProviderScope[req.params.providerName],
+                session: false,
+                state: JSON.stringify({
+                    platform: req.query.platform || '',
+                })
+            })(req, res, next)
+        );
+        this.router.get(
+            '/provider/:providerName/callback',
+            (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
+                scope: ExternalProviderScope[req.params.providerName], session: false
+            })(req, res, next),
+            this.authController.loginByProvider
+        );
+
+        this.router.post(
+            '/provider/:providerName/callback',
+            (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
+                scope: ExternalProviderScope[req.params.providerName], session: false
+            })(req, res, next),
+            this.authController.loginByProvider
+        );
    }
 }
@@ -1,76 +0,0 @@
-import { Database } from '../../modules/db';
-import { $logger } from '../../modules/logget';
-import type { TokensFromDb } from '../../types/auth.types';
-
-export default class JwtStorage {
-    private db: Database;
-
-    constructor() {
-        this.db = Database.getInstance();
-    }
-
-    async initTokenRecord(userId: number): Promise<number | false> {
-        try {
-            const data = await this.db.query<{ id: number }>(
-                'INSERT INTO tv_auth.user_tokens (user_id) VALUES ($1) RETURNING id;',
-                [userId]
-            );
-            if (data?.rows && data.rows.length > 0) {
-                return data.rows[0].id;
-            }
-            return false;
-        } catch (error: any) {
-            $logger.error('Can not complete initTokenRecord', {
-                userId,
-                errorMessage: error.message,
-                errorStack: error.stack,
-            });
-            return false;
-        }
-    }
-
-    async updateTokens(accessToken: string, refreshToken: string, rowId: number): Promise<boolean> {
-        const query = `
-          UPDATE tv_auth.user_tokens
-          SET access_token = $1, refresh_token = $2
-          WHERE id = $3;
-        `;
-
-        try {
-            const res = await this.db.query(query, [accessToken, refreshToken, rowId]);
-            return !!(res.rowCount && res.rowCount > 0);
-        } catch (error: any) {
-            $logger.error('Error updating tokens:', { errorMessage: error.message, errorStack: error.stack });
-            return false;
-        }
-    }
-
-    async fetchTokens(rowId: number): Promise<TokensFromDb | false> {
-        const query = 'SELECT * FROM tv_auth.user_tokens WHERE id = $1;';
-        try {
-            const res = await this.db.query<TokensFromDb>(query, [rowId]);
-            if (res?.rows && res.rows.length > 0) {
-                return res.rows[0];
-            }
-
-            return false;
-        } catch (error: any) {
-            $logger.error('Error fetching tokens', {
-                rowId,
-                errorMessage: error.message,
-                errorStack: error.stack,
-            });
-            return false;
-        }
-    }
-
-    async deleteTokens(userId: number, accessToken: string): Promise<boolean> {
-        try {
-            const query = 'DELETE FROM tv_auth.user_tokens WHERE user_id = $1 AND access_token = $2;';
-            const deleteResul = await this.db.query(query, [userId, accessToken]);
-            return !!(deleteResul.rowCount && deleteResul.rowCount > 0);
-        } catch (_error: any) {
-            return false;
-        }
-    }
-}
@@ -0,0 +1,80 @@
+import { and, eq, ne } from 'drizzle-orm'
+import { UserTokensSchema } from 'taskview-db-schemas'
+import { Database } from '../../modules/db'
+import { callWithCatch, parseDeviceName } from '../../utils/helpers'
+
+export default class SessionStorage {
+  private readonly db: Database
+
+  constructor() {
+    this.db = Database.getInstance()
+  }
+
+  async createSession(userId: number, ip: string | undefined, userAgent: string | undefined): Promise<number | false> {
+    const deviceName = parseDeviceName(userAgent)
+    const result = await callWithCatch(() =>
+      this.db.dbDrizzle.insert(UserTokensSchema).values({
+        userId,
+        userIp: ip || null,
+        deviceName,
+        userAgent: userAgent || null,
+        lastUsedAt: new Date(),
+      }).returning({ id: UserTokensSchema.id })
+    )
+    return result?.[0]?.id ?? false
+  }
+
+  async isSessionActive(sessionId: number): Promise<boolean> {
+    const result = await callWithCatch(() =>
+      this.db.dbDrizzle.select({ id: UserTokensSchema.id })
+        .from(UserTokensSchema)
+        .where(eq(UserTokensSchema.id, sessionId))
+    )
+    return !!(result && result.length > 0)
+  }
+
+  async updateLastUsed(sessionId: number): Promise<void> {
+    await callWithCatch(() =>
+      this.db.dbDrizzle.update(UserTokensSchema)
+        .set({ lastUsedAt: new Date() })
+        .where(eq(UserTokensSchema.id, sessionId))
+    )
+  }
+
+  async deleteSession(sessionId: number, userId: number): Promise<boolean> {
+    const result = await callWithCatch(() =>
+      this.db.dbDrizzle.delete(UserTokensSchema)
+        .where(and(eq(UserTokensSchema.id, sessionId), eq(UserTokensSchema.userId, userId)))
+    )
+    return !!result?.rowCount
+  }
+
+  async deleteAllSessions(userId: number, excludeSessionId?: number): Promise<boolean> {
+    if (excludeSessionId) {
+      const result = await callWithCatch(() =>
+        this.db.dbDrizzle.delete(UserTokensSchema)
+          .where(and(
+            eq(UserTokensSchema.userId, userId),
+            ne(UserTokensSchema.id, excludeSessionId)
+          ))
+      )
+      return !!result
+    }
+
+    const result = await callWithCatch(() =>
+      this.db.dbDrizzle.delete(UserTokensSchema)
+        .where(eq(UserTokensSchema.userId, userId))
+    )
+    return !!result
+  }
+
+  async fetchUserSessions(userId: number) {
+    const result = await callWithCatch(() =>
+      this.db.dbDrizzle.select()
+        .from(UserTokensSchema)
+        .where(eq(UserTokensSchema.userId, userId))
+        .orderBy(UserTokensSchema.lastUsedAt)
+    )
+    return result ?? []
+  }
+}
@@ -7,7 +7,7 @@ import { Database } from '../../../modules/db';
 import type { UserJwtPayload } from '../../../types/auth.types';
 import { delay } from '../../../utils/helpers';
 import AuthModel from '../AuthModel';
-import JwtStorage from '../JwtStorage';
+import JwtStorage from '../SessionStorage';

 const port = 1809;
 const url = `http://localhost:${port}`;
@@ -69,13 +69,9 @@ describe('Login API', () => {
        expect((payloadRefresh as any).userData).toHaveProperty('login');
        expect((payloadRefresh as any).userData).toHaveProperty('email');

-        const jwtStorage = new JwtStorage();
-        const result = await jwtStorage.fetchTokens(payloadRefresh.id);
-
-        if (!result) {
-            throw new Error('Can not fetch tokens');
-        }
-        expect(result.access_token).toBeTruthy();
+        const sessionStorage = new JwtStorage();
+        const isActive = await sessionStorage.isSessionActive(payloadRefresh.id);
+        expect(isActive).toBe(true);
    });

    it('Registration', async () => {
@@ -2,17 +2,17 @@ import { afterAll, beforeEach, describe, expect, it } from 'vitest';
 import { Database } from '../../../modules/db';
 import type { RegisterUserInDb } from '../../../types/auth.types';
 import AuthModel from '../AuthModel';
-import JwtStorage from '../JwtStorage';
+import SessionStorage from '../SessionStorage';

-describe('AuthModel Integration Tests', () => {
-    let jwtStorage: JwtStorage;
+describe('SessionStorage Integration Tests', () => {
+    let sessionStorage: SessionStorage;
    let authModel: AuthModel;
    let emailNum: number;
    let userId: number;
-    let rowId: number;
+    let sessionId: number;

    beforeEach(async () => {
-        jwtStorage = new JwtStorage();
+        sessionStorage = new SessionStorage();
        authModel = new AuthModel();
        emailNum = Date.now();

@@ -24,7 +24,7 @@ describe('AuthModel Integration Tests', () => {
            block: 0,
        };
        userId = (await authModel.registerUserInDb(userData)) as number;
-        rowId = (await jwtStorage.initTokenRecord(userId)) as number;
+        sessionId = (await sessionStorage.createSession(userId, '127.0.0.1', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/120')) as number;
    });

    afterAll(async () => {
@@ -32,40 +32,34 @@ describe('AuthModel Integration Tests', () => {
        await db.query("delete from tv_auth.users where login not in ('user', 'user1', 'user3')");
    });

-    it('initTokenRecord', async () => {
-        expect(rowId).toBeTruthy();
+    it('createSession', async () => {
+        expect(sessionId).toBeTruthy();
        const deleteAllSession = await authModel.clearAllSessionTokensForUser(userId);
        expect(deleteAllSession).toBe(true);
    });

-    it('updateTokens', async () => {
-        const updateResult = await jwtStorage.updateTokens('access-1', 'refresh-1', rowId);
-        expect(updateResult).toBe(true);
+    it('isSessionActive', async () => {
+        const isActive = await sessionStorage.isSessionActive(sessionId);
+        expect(isActive).toBe(true);
+
+        const isInactive = await sessionStorage.isSessionActive(999999);
+        expect(isInactive).toBe(false);
    });

-    it('fetchTokens', async () => {
-        let fetchResult = await jwtStorage.fetchTokens(rowId);
-        expect(fetchResult).toBeTruthy();
-        expect(fetchResult).toHaveProperty('id');
-        expect(fetchResult).toHaveProperty('user_id');
-        expect(fetchResult).toHaveProperty('access_token');
-        expect(fetchResult).toHaveProperty('refresh_token');
-        expect(fetchResult).toHaveProperty('user_ip');
-        expect(fetchResult).toHaveProperty('time_creation');
-
-        const updateResult = await jwtStorage.updateTokens('access-1', 'refresh-1', rowId);
-        expect(updateResult).toBe(true);
-
-        fetchResult = await jwtStorage.fetchTokens(rowId);
-        expect(fetchResult).toBeTruthy();
-        if (fetchResult) {
-            expect(fetchResult.access_token).toBe('access-1');
-            expect(fetchResult.refresh_token).toBe('refresh-1');
-        }
+    it('fetchUserSessions', async () => {
+        const sessions = await sessionStorage.fetchUserSessions(userId);
+        expect(sessions.length).toBeGreaterThan(0);
+        expect(sessions[0]).toHaveProperty('id');
+        expect(sessions[0]).toHaveProperty('userId');
+        expect(sessions[0]).toHaveProperty('deviceName');
+        expect(sessions[0]).toHaveProperty('userIp');
    });

-    it('deleteTokens', async () => {
-        const result = await jwtStorage.deleteTokens(userId, 'access-1');
+    it('deleteSession', async () => {
+        const result = await sessionStorage.deleteSession(sessionId, userId);
        expect(result).toBe(true);
+
+        const isActive = await sessionStorage.isSessionActive(sessionId);
+        expect(isActive).toBe(false);
    });
 });
@@ -2,10 +2,19 @@ import type { NextFunction, Request, Response } from 'express';
 import AuthController from '../AuthController';

 export const IsLoggedIn = async (req: Request, res: Response, next: NextFunction) => {
+    if (req.appUser.isApiTokenAuth() && !req.appUser.isBlocked()) {
+        return next();
+    }
+
    const token = req.headers['authorization']?.split(' ')[1];
    if (token) {
        const userPayload = await AuthController.validateTokens(token);
-        if (userPayload && req.appUser.getTokenId() === userPayload.id && !req.appUser.isBlocked()) {
+        if (
+            userPayload
+            && req.appUser.getTokenId() === userPayload.id
+            && req.appUser.getHasActiveToken()
+            && !req.appUser.isBlocked()
+        ) {
            return next();
        }
    }
@@ -0,0 +1,50 @@
+import passport from "passport";
+import { Strategy as AppleStrategy } from "passport-apple";
+import jwt from "jsonwebtoken";
+import { $logger } from "../../../modules/logget";
+import type { ExternalAuthUser } from "./external-auth.types";
+
+interface AppleDecodedToken {
+    email?: string;
+    email_verified?: boolean | string;
+    sub?: string;
+}
+
+export function initAppleStrategy() {
+    if (!process.env.APPLE_CLIENT_ID ||
+        !process.env.APPLE_TEAM_ID ||
+        !process.env.APPLE_KEY_ID ||
+        !process.env.APPLE_CALLBACK_URL ||
+        !process.env.APPLE_KEY_LOCATION) {
+        $logger.warn("APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_CALLBACK_URL, and APPLE_KEY_LOCATION must be set");
+        console.warn("APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_CALLBACK_URL, and APPLE_KEY_LOCATION must be set");
+        return;
+    }
+
+    const options = {
+        clientID: process.env.APPLE_CLIENT_ID,
+        teamID: process.env.APPLE_TEAM_ID,
+        callbackURL: process.env.APPLE_CALLBACK_URL,
+        keyID: process.env.APPLE_KEY_ID,
+        privateKeyLocation: process.env.APPLE_KEY_LOCATION,
+        scope: ["name", "email"],
+        passReqToCallback: true as const,
+    };
+
+    passport.use(new AppleStrategy(options, async (_req, _accessToken, _refreshToken, idToken, _profile, done) => {
+        try {
+            const decoded = jwt.decode(idToken) as AppleDecodedToken | null;
+            const email = decoded?.email;
+            if (!email) return done(null, undefined);
+
+            const user: ExternalAuthUser = {
+                email,
+                provider: "apple",
+            };
+
+            done(null, user);
+        } catch (e) {
+            done(e instanceof Error ? e : new Error(String(e)));
+        }
+    }));
+}
@@ -0,0 +1,10 @@
+export type ExternalAuthUser = {
+    email: string;
+    provider: 'google' | 'github' | string;
+}
+
+export const ExternalProviderScope: Record<ExternalAuthUser['provider'], string[]> = {
+    google: ["email"],
+    github: ["user:email"],
+    apple: ["email"],
+}
@@ -0,0 +1,37 @@
+import passport from "passport";
+import { Strategy as GitHubStrategy } from "passport-github2";
+import { $logger } from "../../../modules/logget";
+import type { ExternalAuthUser } from "./external-auth.types";
+import type { Profile } from "passport-github2";
+import type { VerifyCallback } from "passport-google-oauth20";
+
+export function initGithubStrategy() {
+    if (!process.env.GITHUB_CLIENT_ID || !process.env.GITHUB_CLIENT_SECRET || !process.env.GITHUB_CALLBACK_URL) {
+        $logger.warn("GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and GITHUB_CALLBACK_URL must be set");
+        console.warn("GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and GITHUB_CALLBACK_URL must be set");
+        return;
+    }
+
+    const options = {
+        clientID: process.env.GITHUB_CLIENT_ID,
+        clientSecret: process.env.GITHUB_CLIENT_SECRET,
+        callbackURL: process.env.GITHUB_CALLBACK_URL,
+        scope: ["user:email"],
+    }
+
+    passport.use(new GitHubStrategy(options, async (_accessToken: string, _refreshToken: string, profile: Profile, done: VerifyCallback) => {
+        try {
+            const email = profile.emails?.[0]?.value;
+            if (!email) return done(null, false);
+
+            const user: ExternalAuthUser = {
+                email,
+                provider: "github",
+            };
+
+            done(null, user);
+        } catch (e) {
+            done(e);
+        }
+    }));
+}
@@ -0,0 +1,33 @@
+import passport from "passport";
+import { Strategy as GoogleStrategy } from "passport-google-oauth20";
+import { $logger } from "../../../modules/logget";
+import type { ExternalAuthUser } from "./external-auth.types";
+
+export function initGoogleStrategy() {
+    if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET || !process.env.GOOGLE_CALLBACK_URL) {
+        $logger.warn("GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_CALLBACK_URL must be set");
+        console.warn("GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_CALLBACK_URL must be set");
+        return;
+    }
+    const options = {
+        clientID: process.env.GOOGLE_CLIENT_ID,
+        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+        callbackURL: process.env.GOOGLE_CALLBACK_URL,
+    }
+
+    passport.use(new GoogleStrategy(options, async (_accessToken, _refreshToken, profile, done) => {
+        try {
+            const email = profile.emails?.[0]?.value;
+            if (!email || !profile._json.email_verified) return done(null, false);
+
+            const user: ExternalAuthUser = {
+                email,
+                provider: "google",
+            };
+
+            done(null, user);
+        } catch (e) {
+            done(e);
+        }
+    }));
+}
@@ -0,0 +1,13 @@
+import passport from "passport";
+import { initGoogleStrategy } from "./google.strategy";
+import { initGithubStrategy } from "./github.strategy";
+import { initAppleStrategy } from "./apple.strategy";
+
+export function initPassportLogin() {
+    initGoogleStrategy();
+    initGithubStrategy();
+    initAppleStrategy();
+}
+
+export default passport;
+
@@ -192,4 +192,14 @@ export class CollaborationRolesRepository {

        return result;
    }
+
+    async assignAllPermissionsToRole(roleId: number, permissionIds: number[]): Promise<boolean> {
+        if (permissionIds.length === 0) return false
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle
+                .insert(CollaborationPermissionsToRoleSchema)
+                .values(permissionIds.map(permissionId => ({ roleId, permissionId })))
+        )
+        return !!result
+    }
 }
@@ -1,5 +1,6 @@
 import { type } from 'arktype';
 import type { Request, Response } from 'express';
+import { eventBus } from '../../core/EventBus';
 import { $logger } from '../../modules/logget';
 import {
    CollaborationArkTypeAddUser,
@@ -83,6 +84,14 @@ export class CollaborationController {

        const user = await req.appUser.collaborationManager.addUserNew(output);

+        if (user) {
+            eventBus.emit('collaboration.userAdded', {
+                goalId: output.goalId,
+                email: output.email.toLowerCase(),
+                initiatorId: req.appUser.getUserData()!.id,
+            });
+        }
+
        return res.tvJson(user ?? null);
    };

@@ -93,7 +102,17 @@ export class CollaborationController {
            return res.status(400).send(output.summary);
        }

-        return res.tvJson(await req.appUser.collaborationManager.deleteUserNew(output));
+        const result = await req.appUser.collaborationManager.deleteUserNew(output);
+
+        if (result) {
+            eventBus.emit('collaboration.userRemoved', {
+                goalId: output.goalId,
+                collaborationUserId: output.id,
+                initiatorId: req.appUser.getUserData()!.id,
+            });
+        }
+
+        return res.tvJson(result);
    };

    toggleUserRolesNew = async (req: Request, res: Response) => {
@@ -103,11 +122,20 @@ export class CollaborationController {
            return res.status(400).send(output.summary);
        }

-        return res.tvJson(await req.appUser.collaborationManager.toggleUserRolesNew(output));
+        const result = await req.appUser.collaborationManager.toggleUserRolesNew(output);
+
+        eventBus.emit('collaboration.rolesChanged', {
+            goalId: output.goalId,
+            collaborationUserId: output.userId,
+            initiatorId: req.appUser.getUserData()!.id,
+        });
+
+        return res.tvJson(result);
    };

    fetchAllUsersNew = async (req: Request, res: Response) => {
-        const users = await req.appUser.collaborationManager.fetchAllUsersNew();
+        const organizationId = req.query.organizationId ? Number(req.query.organizationId) : undefined;
+        const users = await req.appUser.collaborationManager.fetchAllUsersNew(organizationId);
        return res.tvJson(users);
    };

@@ -108,7 +108,7 @@ export class CollaborationManager {
    }

    async addUser(args: AddUserArg): Promise<CollaborationUserInDb | false> {
-        const userId = await this.repository.addUserForCollaboration(args.goalId, args.email);
+        const userId = await this.repository.addUserForCollaboration(args.goalId, args.email.toLowerCase());
        if (!userId) {
            return false;
        }
@@ -121,7 +121,20 @@ export class CollaborationManager {
    }

    async addUserNew(args: CollaborationArgAddUser): Promise<CollaborationUserWithRoles | null> {
-        const user = await this.repository.addUserForCollaborationNew(args);
+        const email = args.email.toLowerCase();
+
+        const goal = await this.user.goalsManager.goalsRepository.findGoalById(args.goalId);
+        if (goal && goal.organizationId) {
+            const member = await this.user.organizationManager.repository.getMemberByEmail(goal.organizationId, email);
+            if (!member) {
+                await this.user.organizationManager.repository.addMember(goal.organizationId, email, 'member');
+            }
+        }
+
+        const user = await this.repository.addUserForCollaborationNew({
+            ...args,
+            email,
+        });
        if (!user) return null;

        return {
@@ -142,15 +155,15 @@ export class CollaborationManager {
        return await this.repository.toggleUserRolesNew(args);
    }

-    async fetchAllUsersNew(): Promise<CollaborationUserWithRoles[]> {
-        
-        const sharedGoals = await this.user.goalsManager.fetchSharedGoals();
+    async fetchAllUsersNew(organizationId?: number): Promise<CollaborationUserWithRoles[]> {
+
+        const sharedGoals = await this.user.goalsManager.fetchSharedGoals(organizationId);

        const goalIds = sharedGoals
            .filter((g) => g.hasPermissions(GoalPermissions.TASKS_CAN_WATCH_ASSIGNED_USERS))
            .map((g) => g.id);

-        const ownGoals = await this.user.goalsManager.fetchAllOwnGoalsIds();
+        const ownGoals = await this.user.goalsManager.fetchAllOwnGoalsIds(organizationId);

        goalIds.push(...ownGoals);

@@ -1,6 +1,7 @@
 import { Router } from 'express';
 import type { Routable } from '../../types/routable.type';
 import { IsLoggedIn } from '../auth/middlewares/is-logged-in';
+import { IsOrgMemberIfProvided } from '../../middlewares/is-org-member';
 import { CollaborationController } from './CollaborationController';
 import { CanAddUserCollaboration } from './middlewares/CanAddUserCollaboration';
 import { CanDeleteUserCollaboration } from './middlewares/CanDeleteUserCollaboration';
@@ -50,7 +51,7 @@ export default class CollaborationRoutes implements Routable {
        /**
         * Fetch all users for collaboration
         */
-        this.router.get('', [IsLoggedIn], this.collaborationController.fetchAllUsersNew);
+        this.router.get('', [IsLoggedIn, IsOrgMemberIfProvided], this.collaborationController.fetchAllUsersNew);

        /**
         * Fetch users for goal for collaboration
@@ -7,7 +7,7 @@ import {
    UpdateGoalDbArgSchema,
 } from '../../types/goal.type';
 import { logError } from '../../utils/api';
-import { GoalsArkTypeAdd, GoalsArkTypeDelete, GoalsArkTypeUpdate } from './types';
+import { GoalsArkTypeAdd, GoalsArkTypeDelete, GoalsArkTypeFetch, GoalsArkTypeUpdate } from './types';

 export default class GoalsController {
    fetchGoals = async (req: Request, res: Response) => {
@@ -106,6 +106,10 @@ export default class GoalsController {
    };

    fetchGoalsNew = async (req: Request, res: Response) => {
-        return res.tvJson(await req.appUser.goalsManager.fetchGoalsNew());
+        const out = GoalsArkTypeFetch(req.query);
+        if (out instanceof type.errors) {
+            return res.status(400).send(out.summary);
+        }
+        return res.tvJson(await req.appUser.goalsManager.fetchGoalsNew(out.organizationId));
    };
 }
@@ -69,8 +69,8 @@ export default class GoalsManager {
    }

    /** @deprecated use fetchSharedGoalsForUser from GoalsRepository instead */
-    async fetchSharedGoals() {
-        const goals = await this.goalsRepository.fetchSharedGoals(this.user);
+    async fetchSharedGoals(organizationId?: number) {
+        const goals = await this.goalsRepository.fetchSharedGoals(this.user, organizationId);
        return await Promise.all(
            goals.map(
                async (g) =>
@@ -91,8 +91,8 @@ export default class GoalsManager {
        return await this.goalsRepository.updateArchive(goalId, archive);
    }

-    async fetchAllOwnGoalsIds() {
-        return await this.goalsRepository.fetchAllOwnGoalsIds(this.user);
+    async fetchAllOwnGoalsIds(organizationId?: number) {
+        return await this.goalsRepository.fetchAllOwnGoalsIds(this.user, organizationId);
    }

    async createGoal(goalData: GoalsArgAdd): Promise<GoalsItemForClientWithPermissions | false> {
@@ -100,10 +100,28 @@ export default class GoalsManager {
        if (!isNotNullable(userId)) {
            return false;
        }
-        const goal = await this.goalsRepository.createGoal(goalData, userId);
+
+        let ownerId = userId;
+        if (goalData.organizationId) {
+            const org = await this.user.organizationManager.getById(goalData.organizationId);
+            if (!org) return false;
+            ownerId = org.ownerId;
+        } else {
+            const personalOrgId = await this.user.organizationManager.getPersonalOrgId();
+            if (!personalOrgId) return false;
+            goalData = { ...goalData, organizationId: personalOrgId };
+        }
+
+        const creatorId = goalData.organizationId && ownerId !== userId ? userId : undefined;
+        const goal = await this.goalsRepository.createGoal(goalData, ownerId, creatorId);
        if (!goal) {
            return false;
        }
+
+        if (creatorId) {
+            await this.addCreatorAsCollaboratorWithFullAccess(goal.id);
+        }
+
        return {
            ...goal,
            permissions: (
@@ -138,24 +156,34 @@ export default class GoalsManager {
        return await this.goalsRepository.deleteGoalNew(goalData);
    }

-    async fetchGoalsNew(): Promise<GoalsItemForClientWithPermissions[]> {
-        const sharedGoals = await this.goalsRepository.fetchSharedGoalsForUser(this.user!);
-        const ownGoals = await this.goalsRepository.fetchGoalsNew(this.user.getUserData()?.id!);
+    async fetchGoalsNew(organizationId?: number): Promise<GoalsItemForClientWithPermissions[]> {
+        const sharedGoals = await this.goalsRepository.fetchSharedGoalsForUser(this.user!, organizationId);
+        const ownGoals = await this.goalsRepository.fetchGoalsNew(this.user.getUserData()?.id!, organizationId);
+
+        const allowedGoalIds = this.user.getAllowedGoalIds();
+        const filterByAllowed = allowedGoalIds && allowedGoalIds.length > 0;
+
+        const filteredOwnGoals = filterByAllowed
+            ? ownGoals.filter((g) => allowedGoalIds.includes(g.id))
+            : ownGoals;
+        const filteredSharedGoals = filterByAllowed
+            ? sharedGoals.filter((g) => allowedGoalIds.includes(g.id))
+            : sharedGoals;

        let ownGoalsWithPermissions: GoalsItemForClientWithPermissions[] = [];
        let sharedGoalsWithPermissions: GoalsItemForClientWithPermissions[] = [];

-        if (ownGoals.length > 0) {
+        if (filteredOwnGoals.length > 0) {
            const permChecker = await this.user.permissionsFetcher.getPermissionsForType(
-                ownGoals[0].id,
+                filteredOwnGoals[0].id,
                GoalPermissionsFetcher.PERMISSION_TYPE_FOR_GOAL
            );
-            ownGoalsWithPermissions = ownGoals.map((g) => ({ ...g, permissions: permChecker.getAllPermissions() }));
+            ownGoalsWithPermissions = filteredOwnGoals.map((g) => ({ ...g, permissions: permChecker.getAllPermissions() }));
        }

-        if (sharedGoals.length > 0) {
+        if (filteredSharedGoals.length > 0) {
            sharedGoalsWithPermissions = await Promise.all(
-                sharedGoals.map(async (g) => {
+                filteredSharedGoals.map(async (g) => {
                    return {
                        ...g,
                        permissions: (
@@ -171,4 +199,26 @@ export default class GoalsManager {

        return [...ownGoalsWithPermissions, ...sharedGoalsWithPermissions];
    }
+
+    private async addCreatorAsCollaboratorWithFullAccess(goalId: number) {
+        const email = this.user.getUserData()?.email
+        if (!email) return
+
+        const collabUser = await this.user.collaborationManager.addUserNew({ goalId, email })
+        if (!collabUser) return
+
+        const role = await this.user.collaborationRolesManager.repository.addRoleNew('TvOrgAdmin', goalId)
+        if (!role) return
+
+        const allPermissions = await this.user.collaborationRolesManager.repository.fetchAllAvailablePermissionsNew()
+        if (allPermissions.length > 0) {
+            await this.user.collaborationRolesManager.repository.assignAllPermissionsToRole(role.id, allPermissions.map(p => p.id))
+        }
+
+        await this.user.collaborationManager.repository.toggleUserRolesNew({
+            goalId,
+            userId: collabUser.id,
+            roles: [role.id],
+        })
+    }
 }
@@ -105,20 +105,25 @@ export class GoalsRepository {
        return !!(del.rowCount && del.rowCount > 0);
    }

-    async fetchSharedGoals(user: AppUser): Promise<GoalItemInDb[]> {
+    async fetchSharedGoals(user: AppUser, organizationId?: number): Promise<GoalItemInDb[]> {
        if (!user.getUserData()?.email) {
            $logger.error('Trying fetch shared goals without active user');
            return [];
        }

-        const result = await this.db
-            .query<GoalItemInDb>(
-                `select tg.* from tasks.goals tg
+        const params: any[] = [user.getUserData()?.email, user.getUserData()?.id];
+        let sql = `select tg.* from tasks.goals tg
            left join collaboration.users_to_goals utg on utg.goal_id = tg.id
            left join collaboration.users cu on cu.id = utg.user_id
-                    where cu.email = $1 and tg.owner <> $2`,
-                [user.getUserData()?.email, user.getUserData()?.id]
-            )
+                    where cu.email = $1 and tg.owner <> $2`;
+
+        if (organizationId) {
+            sql += ' and tg.organization_id = $3';
+            params.push(organizationId);
+        }
+
+        const result = await this.db
+            .query<GoalItemInDb>(sql, params)
            .catch(logError);

        if (!result) {
@@ -128,9 +133,16 @@ export class GoalsRepository {
        return result.rows;
    }

-    async fetchSharedGoalsForUser(user: AppUser): Promise<GoalsSchemaTypeForSelect[]> {
-        // debugger;
+    async fetchSharedGoalsForUser(user: AppUser, organizationId?: number): Promise<GoalsSchemaTypeForSelect[]> {
        const result = await callWithCatch(() => {
+            const conditions = [
+                eq(CollaborationUsersSchema.email, user.getUserData()?.email!),
+                ne(GoalsSchema.owner, user.getUserData()?.id!),
+            ];
+            if (organizationId) {
+                conditions.push(eq(GoalsSchema.organizationId, organizationId));
+            }
+
            const query = this.db.dbDrizzle
                .select({
                    id: GoalsSchema.id,
@@ -142,6 +154,8 @@ export class GoalsRepository {
                    creatorId: GoalsSchema.creatorId,
                    editDate: GoalsSchema.editDate,
                    archive: GoalsSchema.archive,
+                    backlogVersion: GoalsSchema.backlogVersion,
+                    organizationId: GoalsSchema.organizationId,
                })
                .from(GoalsSchema)
                .leftJoin(CollaborationUsersToGoalsSchema, eq(GoalsSchema.id, CollaborationUsersToGoalsSchema.goalId))
@@ -149,12 +163,7 @@ export class GoalsRepository {
                    CollaborationUsersSchema,
                    eq(CollaborationUsersToGoalsSchema.userId, CollaborationUsersSchema.id)
                )
-                .where(
-                    and(
-                        eq(CollaborationUsersSchema.email, user.getUserData()?.email!),
-                        ne(GoalsSchema.owner, user.getUserData()?.id!)
-                    )
-                );
+                .where(and(...conditions));
            // const sql = query.toSQL();
            // console.log('query', sql);
            return query;
@@ -183,29 +192,34 @@ export class GoalsRepository {
        return !!(result.rowCount && result.rowCount > 0);
    }

-    async fetchAllOwnGoalsIds(user: AppUser): Promise<number[]> {
-        const ownGoals = await this.db
-            .query<{ id: number }>('select id from tasks.goals where owner = $1 and archive = $2', [
-                user.getUserData()?.id,
-                0,
-            ])
-            .catch(logError);
-
-        if (!ownGoals) {
-            $logger.error(`Can not fetch own goals for all state`);
-            return [];
+    async fetchAllOwnGoalsIds(user: AppUser, organizationId?: number): Promise<number[]> {
+        const conditions = [
+            eq(GoalsSchema.owner, user.getUserData()?.id!),
+            eq(GoalsSchema.archive, 0),
+        ];
+        if (organizationId) {
+            conditions.push(eq(GoalsSchema.organizationId, organizationId));
        }

-        return ownGoals.rows.map((g) => g.id);
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle
+                .select({ id: GoalsSchema.id })
+                .from(GoalsSchema)
+                .where(and(...conditions))
+        );
+
+        if (!result) return [];
+        return result.map((g) => g.id);
    }

-    async createGoal(goalData: GoalsArgAdd, userId: number): Promise<GoalsSchemaTypeForSelect | false> {
+    async createGoal(goalData: GoalsArgAdd, ownerId: number, creatorId?: number): Promise<GoalsSchemaTypeForSelect | false> {
        const result = await callWithCatch(() =>
            this.db.dbDrizzle
                .insert(GoalsSchema)
                .values({
                    ...goalData,
-                    owner: userId,
+                    owner: ownerId,
+                    ...(creatorId && { creatorId }),
                })
                .returning()
        );
@@ -240,9 +254,22 @@ export class GoalsRepository {
        return !!(result?.rowCount && result.rowCount > 0);
    }

-    async fetchGoalsNew(userId: number): Promise<GoalsSchemaTypeForSelect[]> {
+    async findGoalById(goalId: number): Promise<GoalsSchemaTypeForSelect | false> {
        const result = await callWithCatch(() =>
-            this.db.dbDrizzle.select().from(GoalsSchema).where(eq(GoalsSchema.owner, userId))
+            this.db.dbDrizzle.select().from(GoalsSchema).where(eq(GoalsSchema.id, goalId))
+        );
+        if (!result || result.length === 0) return false;
+        return result[0];
+    }
+
+    async fetchGoalsNew(userId: number, organizationId?: number): Promise<GoalsSchemaTypeForSelect[]> {
+        const conditions = [eq(GoalsSchema.owner, userId)];
+        if (organizationId) {
+            conditions.push(eq(GoalsSchema.organizationId, organizationId));
+        }
+
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(GoalsSchema).where(and(...conditions))
        );
        if (!result) {
            return [];
@@ -3,6 +3,7 @@ import type { Routable } from '../../types/routable.type';
 import { IsLoggedIn } from '../auth/middlewares/is-logged-in';
 import GoalsController from './GoalsController';
 // import { CanArchiveGoal } from './middlewares/CanArchiveGoal';
+import { IsOrgMemberIfProvided } from '../../middlewares/is-org-member';
 import { canAddGoal } from './middlewares/can-add-goal';
 import { canDeleteGoal } from './middlewares/can-delete-goal';
 import { canEditGoal } from './middlewares/can-edit-goal';
@@ -23,9 +24,9 @@ export default class GoalsRoutes implements Routable {
    }

    initRoutes() {
-        this.router.post('', [IsLoggedIn, canAddGoal], this.goalsController.createGoal);
+        this.router.post('', [IsLoggedIn, IsOrgMemberIfProvided, canAddGoal], this.goalsController.createGoal);
        this.router.patch('', [IsLoggedIn, canEditGoal], this.goalsController.updateGoalNew);
        this.router.delete('', [IsLoggedIn, canDeleteGoal], this.goalsController.deleteGoalNew);
-        this.router.get('', [IsLoggedIn, canFetchGoals], this.goalsController.fetchGoalsNew);
+        this.router.get('', [IsLoggedIn, IsOrgMemberIfProvided, canFetchGoals], this.goalsController.fetchGoalsNew);
    }
 }
@@ -1,9 +1,18 @@
-import type { NextFunction, Request, Response } from 'express';
+import type { NextFunction, Request, Response } from 'express'
+import { ORG_ADMIN_ROLES, type OrgRole } from '../../organizations/types'

 export const canAddGoal = async (req: Request, res: Response, next: NextFunction) => {
-    if (!req.appUser.isBlocked()) {
-        return next();
+    if (req.appUser.isBlocked()) {
+        return res.status(403).end()
    }

-    return res.status(403).end();
-};
+    const organizationId = req.body.organizationId
+    if (organizationId) {
+        const member = await req.appUser.organizationManager.getCurrentUserMember(Number(organizationId))
+        if (!member || !ORG_ADMIN_ROLES.includes(member.role as OrgRole)) {
+            return res.status(403).end()
+        }
+    }
+
+    return next()
+}
@@ -6,6 +6,7 @@ export const GoalsArkTypeAdd = type({
    name: 'string',
    'description?': 'string | null',
    'color?': 'string | null',
+    'organizationId?': 'number',
 });

 export type GoalsArgAdd = typeof GoalsArkTypeAdd.infer;
@@ -25,4 +26,10 @@ export const GoalsArkTypeDelete = type({

 export type GoalsArgDelete = typeof GoalsArkTypeDelete.infer;

+export const GoalsArkTypeFetch = type({
+    'organizationId?': type('string | number').pipe((v) => Number(v)),
+});
+
+export type GoalsArgFetch = typeof GoalsArkTypeFetch.infer;
+
 export type GoalsItemForClientWithPermissions = GoalsSchemaTypeForSelect & { permissions: GoalPermissionsForClient };
@@ -18,6 +18,13 @@ export class GraphRepository {
        return result ?? [];
    }

+    public async fetchById(id: number): Promise<GraphReturnRelationsType | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(GraphRelationsSchema).where(eq(GraphRelationsSchema.id, id))
+        );
+        return result?.[0] ?? null;
+    }
+
    public async fetchAllEdges(goalId: number): Promise<GraphReturnRelationsType[]> {
        const result = await callWithCatch(() =>
            this.db.dbDrizzle.select().from(GraphRelationsSchema).where(eq(GraphRelationsSchema.goalId, goalId))
@@ -2,6 +2,9 @@ import { Router } from 'express';
 import type { Routable } from '../../types/routable.type';
 import { IsLoggedIn } from '../auth/middlewares/is-logged-in';
 import { GraphController } from './GraphControler';
+import { CanManageGraph } from './middlewares/CanManageGraph';
+import { CanViewGraph } from './middlewares/CanViewGraph';
+
 export default class GraphRoutes implements Routable {
    private readonly router: ReturnType<typeof Router>;
    private readonly graphController: GraphController;
@@ -17,8 +20,8 @@ export default class GraphRoutes implements Routable {
    }

    initRoutes() {
-        this.router.post('', [IsLoggedIn], this.graphController.addEdge);
-        this.router.get('/:goalId', [IsLoggedIn], this.graphController.fetchAllEdges);
-        this.router.delete('/:id', [IsLoggedIn], this.graphController.deleteEdge);
+        this.router.post('', [IsLoggedIn, CanManageGraph], this.graphController.addEdge);
+        this.router.get('/:goalId', [IsLoggedIn, CanViewGraph], this.graphController.fetchAllEdges);
+        this.router.delete('/:id', [IsLoggedIn, CanManageGraph], this.graphController.deleteEdge);
    }
 }
@@ -0,0 +1,17 @@
+import type { NextFunction, Request, Response } from 'express';
+import { GoalPermissions } from '../../../types/auth.types';
+import { resolveGoalId } from './resolveGoalId';
+
+export const CanManageGraph = async (req: Request, res: Response, next: NextFunction) => {
+    const goalId = await resolveGoalId(req);
+    if (!goalId) {
+        return res.status(400).end();
+    }
+
+    const checker = await req.appUser.permissionsFetcher.getCheckerForGoal(goalId);
+    if (checker.hasPermissions(GoalPermissions.GRAPH_CAN_MANAGE)) {
+        return next();
+    }
+
+    return res.status(403).end();
+};
@@ -0,0 +1,17 @@
+import type { NextFunction, Request, Response } from 'express';
+import { GoalPermissions } from '../../../types/auth.types';
+import { resolveGoalId } from './resolveGoalId';
+
+export const CanViewGraph = async (req: Request, res: Response, next: NextFunction) => {
+    const goalId = await resolveGoalId(req);
+    if (!goalId) {
+        return res.status(400).end();
+    }
+
+    const checker = await req.appUser.permissionsFetcher.getCheckerForGoal(goalId);
+    if (checker.hasPermissions(GoalPermissions.GRAPH_CAN_VIEW)) {
+        return next();
+    }
+
+    return res.status(403).end();
+};
@@ -0,0 +1,37 @@
+import type { Request } from 'express';
+import { GraphRepository } from '../GraphRepository';
+import { TasksRepository } from '../../tasks/TasksRepository';
+
+/**
+ * Resolves goalId from graph request.
+ * - GET /:goalId → params.goalId
+ * - POST (addEdge) → resolve via fromTaskId (body.source)
+ * - DELETE /:id → resolve via edge id
+ */
+export async function resolveGoalId(req: Request): Promise<number | null> {
+    // Direct goalId in params (fetchAllEdges)
+    if (req.params.goalId) {
+        const id = Number(req.params.goalId);
+        return isNaN(id) ? null : id;
+    }
+
+    // addEdge: resolve goalId from task
+    if (req.body?.source) {
+        const taskId = Number(req.body.source);
+        if (isNaN(taskId)) return null;
+        const tasksRepo = new TasksRepository();
+        const task = await tasksRepo.fetchTaskByIdNew(taskId);
+        return task?.goalId ?? null;
+    }
+
+    // deleteEdge: resolve goalId from edge
+    if (req.params.id) {
+        const edgeId = Number(req.params.id);
+        if (isNaN(edgeId)) return null;
+        const graphRepo = new GraphRepository();
+        const edge = await graphRepo.fetchById(edgeId);
+        return edge?.goalId ?? null;
+    }
+
+    return null;
+}
@@ -0,0 +1,296 @@
+import { type } from 'arktype';
+import type { Request, Response } from 'express';
+import { logError } from '../../utils/api';
+import { decrypt } from '../../utils/crypto';
+import AuthController from '../auth/AuthController';
+import { IntegrationsRepository } from './IntegrationsRepository';
+import { verifyGitHubWebhookSignature, GITHUB_BASE_URL } from './providers/github.provider';
+import { verifyGitLabWebhookToken, GITLAB_BASE_URL } from './providers/gitlab.provider';
+import { IntegrationsArkTypeAdd, IntegrationsArkTypeDelete, IntegrationsArkTypeFetch, IntegrationsArkTypeSelectRepo, IntegrationsArkTypeToggle } from './types';
+
+export default class IntegrationsController {
+    createIntegration = async (req: Request, res: Response) => {
+        const out = IntegrationsArkTypeAdd(req.body);
+        if (out instanceof type.errors) {
+            return res.status(400).send(out.summary);
+        }
+        const result = await req.appUser.integrationsManager.create(out).catch(logError);
+        return res.tvJson(result ?? null);
+    };
+
+    deleteIntegration = async (req: Request, res: Response) => {
+        const out = IntegrationsArkTypeDelete(req.body);
+        if (out instanceof type.errors) {
+            return res.status(400).send(out.summary);
+        }
+        const result = await req.appUser.integrationsManager.delete(out).catch(logError);
+        return res.tvJson(!!result);
+    };
+
+    toggleIntegration = async (req: Request, res: Response) => {
+        const out = IntegrationsArkTypeToggle(req.body);
+        if (out instanceof type.errors) {
+            return res.status(400).send(out.summary);
+        }
+        const result = await req.appUser.integrationsManager.toggle(out).catch(logError);
+        return res.tvJson(result ?? null);
+    };
+
+    fetchIntegrations = async (req: Request, res: Response) => {
+        const out = IntegrationsArkTypeFetch(req.query);
+        if (out instanceof type.errors) {
+            return res.status(400).send(out.summary);
+        }
+        const result = await req.appUser.integrationsManager.fetch(out).catch(logError);
+        return res.tvJson(result ?? []);
+    };
+
+    initiateOAuth = async (req: Request, res: Response) => {
+        try {
+            const token = req.query.token as string;
+            if (!token) {
+                return res.status(401).send('token is required');
+            }
+            const userPayload = await AuthController.validateTokens(token);
+            if (!userPayload?.userData?.id) {
+                return res.status(401).send('Invalid token');
+            }
+
+            const provider = req.params.provider;
+            const projectId = Number(req.query.projectId);
+            if (!projectId || isNaN(projectId)) {
+                return res.status(400).send('projectId is required');
+            }
+            const url = req.appUser.integrationsManager.getOAuthUrl(provider, projectId, userPayload.userData.id);
+            return res.redirect(url);
+        } catch (err) {
+            logError(err);
+            return res.status(500).send('Failed to initiate OAuth');
+        }
+    };
+
+    handleOAuthCallback = async (req: Request, res: Response) => {
+        try {
+            const provider = req.params.provider;
+            const code = req.query.code as string;
+            const state = req.query.state as string;
+
+            if (!code || !state) {
+                return res.redirect(`${process.env.APP_URL}?oauth=error`);
+            }
+
+            const { projectId, userLogin } = await req.appUser.integrationsManager.handleOAuthCallback(provider, code, state);
+            return res.redirect(`${process.env.APP_URL}/${userLogin}/${projectId}/integrations?oauth=success`);
+        } catch (err) {
+            logError(err);
+            return res.redirect(`${process.env.APP_URL}?oauth=error`);
+        }
+    };
+
+    fetchRepos = async (req: Request, res: Response) => {
+        try {
+            const integrationId = Number(req.query.integrationId);
+            if (!integrationId || isNaN(integrationId)) {
+                return res.status(400).send('integrationId is required');
+            }
+            const repos = await req.appUser.integrationsManager.fetchRepos(integrationId);
+            return res.tvJson(repos);
+        } catch (err) {
+            logError(err);
+            return res.tvJson([]);
+        }
+    };
+
+    selectRepo = async (req: Request, res: Response) => {
+        const out = IntegrationsArkTypeSelectRepo(req.body);
+        if (out instanceof type.errors) {
+            return res.status(400).send(out.summary);
+        }
+        const result = await req.appUser.integrationsManager.selectRepo(out).catch(logError);
+        return res.tvJson(result ?? null);
+    };
+
+    syncIntegration = async (req: Request, res: Response) => {
+        try {
+            const integrationId = Number(req.body.integrationId);
+            if (!integrationId || isNaN(integrationId)) {
+                return res.status(400).send('integrationId is required');
+            }
+            const synced = await req.appUser.integrationsManager.syncIssues(integrationId);
+            return res.tvJson({ synced });
+        } catch (err) {
+            logError(err);
+            return res.tvJson({ synced: 0 });
+        }
+    };
+
+    handleGitHubWebhook = async (req: Request, res: Response) => {
+        try {
+            const signature = req.headers['x-hub-signature-256'] as string;
+            const event = req.headers['x-github-event'] as string;
+
+            if (!signature) {
+                return res.status(401).send('Missing signature');
+            }
+
+            if (event !== 'issues') {
+                return res.status(200).send('OK');
+            }
+
+            const repoFullName = req.body?.repository?.full_name;
+            if (!repoFullName) {
+                return res.status(400).send('Missing repository');
+            }
+
+            const repo = new IntegrationsRepository();
+            const integrations = await repo.fetchAllActiveByRepoFullName(repoFullName);
+            if (integrations.length === 0) {
+                return res.status(404).send('Integration not found');
+            }
+
+            // Verify signature with the first integration that has a webhook secret
+            const withSecret = integrations.find((i) => i.webhookSecretEncrypted);
+            if (!withSecret) {
+                return res.status(401).send('No webhook secret');
+            }
+            const secret = decrypt(withSecret.webhookSecretEncrypted!);
+            const rawBody = (req as any).rawBody as Buffer;
+            if (!rawBody || !verifyGitHubWebhookSignature(rawBody, signature, secret)) {
+                return res.status(401).send('Invalid signature');
+            }
+
+            const action = req.body.action as string;
+            const issue = req.body.issue;
+            if (!issue) {
+                return res.status(200).send('OK');
+            }
+
+            const issueNumber = issue.number as number;
+            const issueTitle = issue.title as string;
+            const issueBody = (issue.body as string) || null;
+
+            for (const integration of integrations) {
+                const mapping = await repo.fetchMappingByIssueNumber(integration.id, issueNumber);
+
+                if (action === 'opened') {
+                    if (!mapping) {
+                        const repoFullName = req.body?.repository?.full_name;
+                        await repo.createTaskAndMapping(
+                            integration.projectId,
+                            issueTitle,
+                            integration.id,
+                            issueNumber,
+                            'open',
+                            issueBody,
+                            false,
+                            `${GITHUB_BASE_URL}/${repoFullName}/issues/${issueNumber}`,
+                        );
+                    }
+                } else if (action === 'edited') {
+                    if (mapping) {
+                        await repo.updateTaskTitleAndNote(mapping.taskId, issueTitle, issueBody);
+                    }
+                } else if (action === 'closed') {
+                    if (mapping) {
+                        await repo.updateTaskComplete(mapping.taskId, true);
+                        await repo.updateMappingState(mapping.id, 'closed');
+                    }
+                } else if (action === 'reopened') {
+                    if (mapping) {
+                        await repo.updateTaskComplete(mapping.taskId, false);
+                        await repo.updateMappingState(mapping.id, 'open');
+                    }
+                }
+            }
+
+            return res.status(200).send('OK');
+        } catch (err) {
+            logError(err);
+            return res.status(500).send('Webhook processing failed');
+        }
+    };
+
+    handleGitLabWebhook = async (req: Request, res: Response) => {
+        try {
+            const token = req.headers['x-gitlab-token'] as string;
+
+            if (!token) {
+                return res.status(401).send('Missing token');
+            }
+
+            if (req.body?.object_kind !== 'issue') {
+                return res.status(200).send('OK');
+            }
+
+            const projectId = String(req.body?.project?.id);
+            if (!projectId) {
+                return res.status(400).send('Missing project');
+            }
+
+            const repo = new IntegrationsRepository();
+            const integrations = await repo.fetchAllActiveByRepoExternalId(projectId);
+            if (integrations.length === 0) {
+                return res.status(404).send('Integration not found');
+            }
+
+            // Verify token with the first integration that has a webhook secret
+            const withSecret = integrations.find((i) => i.webhookSecretEncrypted);
+            if (!withSecret) {
+                return res.status(401).send('No webhook secret');
+            }
+            const secret = decrypt(withSecret.webhookSecretEncrypted!);
+            if (!verifyGitLabWebhookToken(token, secret)) {
+                return res.status(401).send('Invalid token');
+            }
+
+            const attrs = req.body.object_attributes;
+            if (!attrs) {
+                return res.status(200).send('OK');
+            }
+
+            const issueIid = attrs.iid as number;
+            const issueTitle = attrs.title as string;
+            const issueDescription = (attrs.description as string) || null;
+            const action = attrs.action as string;
+
+            for (const integration of integrations) {
+                const mapping = await repo.fetchMappingByIssueNumber(integration.id, issueIid);
+
+                if (action === 'open') {
+                    if (!mapping) {
+                        const repoPath = req.body?.project?.path_with_namespace;
+                        await repo.createTaskAndMapping(
+                            integration.projectId,
+                            issueTitle,
+                            integration.id,
+                            issueIid,
+                            'open',
+                            issueDescription,
+                            false,
+                            `${GITLAB_BASE_URL}/${repoPath}/-/issues/${issueIid}`,
+                        );
+                    }
+                } else if (action === 'update') {
+                    if (mapping) {
+                        await repo.updateTaskTitleAndNote(mapping.taskId, issueTitle, issueDescription);
+                    }
+                } else if (action === 'close') {
+                    if (mapping) {
+                        await repo.updateTaskComplete(mapping.taskId, true);
+                        await repo.updateMappingState(mapping.id, 'closed');
+                    }
+                } else if (action === 'reopen') {
+                    if (mapping) {
+                        await repo.updateTaskComplete(mapping.taskId, false);
+                        await repo.updateMappingState(mapping.id, 'open');
+                    }
+                }
+            }
+
+            return res.status(200).send('OK');
+        } catch (err) {
+            logError(err);
+            return res.status(500).send('Webhook processing failed');
+        }
+    };
+}
@@ -0,0 +1,368 @@
+import jwt from 'jsonwebtoken';
+import type { AppUser } from '../../core/AppUser';
+import { encrypt, decrypt } from '../../utils/crypto';
+
+import { logError } from '../../utils/api';
+import { $logger } from '../../modules/logget';
+
+import { IntegrationsRepository } from './IntegrationsRepository';
+import { TasksRepository } from '../tasks/TasksRepository';
+import type { IntegrationsSchemaTypeForSelect } from 'taskview-db-schemas';
+import type { IntegrationsArgAdd, IntegrationsArgDelete, IntegrationsArgFetch, IntegrationsArgSelectRepo, IntegrationsArgToggle, OAuthStatePayload, RepoItemForClient } from './types';
+import { randomBytes } from 'crypto';
+import { getGitHubOAuthUrl, exchangeGitHubCode, fetchGitHubRepos, fetchGitHubIssues, createGitHubWebhook, updateGitHubIssueState, GITHUB_BASE_URL } from './providers/github.provider';
+import { getGitLabOAuthUrl, exchangeGitLabCode, fetchGitLabRepos, fetchGitLabIssues, createGitLabWebhook, updateGitLabIssueState, refreshGitLabToken, GITLAB_BASE_URL } from './providers/gitlab.provider';
+
+export class IntegrationsManager {
+    public readonly repository: IntegrationsRepository;
+    private readonly user: AppUser;
+
+    constructor(user: AppUser) {
+        this.user = user;
+        this.repository = new IntegrationsRepository();
+    }
+
+    async create(data: IntegrationsArgAdd): Promise<IntegrationsSchemaTypeForSelect | false> {
+        return this.repository.create(data);
+    }
+
+    async delete(data: IntegrationsArgDelete): Promise<boolean> {
+        return this.repository.delete(data);
+    }
+
+    async toggle(data: IntegrationsArgToggle): Promise<IntegrationsSchemaTypeForSelect | false> {
+        const result = await this.repository.toggle(data);
+        if (result && data.isActive) {
+            this.syncIssues(data.id).catch(logError);
+        }
+        return result;
+    }
+
+    async fetch(data: IntegrationsArgFetch): Promise<IntegrationsSchemaTypeForSelect[]> {
+        const projectId = Number(data.projectId);
+        if (isNaN(projectId)) return [];
+        return this.repository.fetchByProjectId(projectId);
+    }
+
+    getOAuthUrl(provider: string, projectId: number, userId: number): string {
+        const state = jwt.sign(
+            { userId, projectId, provider } as OAuthStatePayload,
+            process.env.JWT_SIGN as string,
+            { expiresIn: '10m' }
+        );
+
+        if (provider === 'github') {
+            return getGitHubOAuthUrl(state);
+        } else if (provider === 'gitlab') {
+            return getGitLabOAuthUrl(state);
+        }
+        throw new Error(`Unknown provider: ${provider}`);
+    }
+
+    async handleOAuthCallback(provider: string, code: string, state: string): Promise<{ projectId: number; userLogin: string }> {
+        $logger.debug({ provider }, '[integrations] handleOAuthCallback start');
+        const payload = jwt.verify(state, process.env.JWT_SIGN as string) as OAuthStatePayload;
+
+        if (payload.provider !== provider) {
+            $logger.error({ provider, payloadProvider: payload.provider }, '[integrations] provider mismatch in state');
+            throw new Error('Provider mismatch in state');
+        }
+
+        const userLogin = await this.repository.fetchUserLogin(payload.userId);
+        if (!userLogin) {
+            $logger.error({ userId: payload.userId }, '[integrations] user not found during OAuth callback');
+            throw new Error('User not found');
+        }
+
+        let accessTokenEncrypted: string;
+        let refreshTokenEncrypted: string | null = null;
+
+        if (provider === 'github') {
+            const accessToken = await exchangeGitHubCode(code);
+            accessTokenEncrypted = encrypt(accessToken);
+        } else if (provider === 'gitlab') {
+            const tokens = await exchangeGitLabCode(code);
+            accessTokenEncrypted = encrypt(tokens.accessToken);
+            refreshTokenEncrypted = encrypt(tokens.refreshToken);
+        } else {
+            throw new Error(`Unknown provider: ${provider}`);
+        }
+
+        await this.repository.createWithToken(
+            provider as 'github' | 'gitlab',
+            payload.projectId,
+            accessTokenEncrypted,
+            refreshTokenEncrypted,
+        );
+
+        $logger.debug({ provider, projectId: payload.projectId, userLogin }, '[integrations] OAuth callback completed');
+        return { projectId: payload.projectId, userLogin };
+    }
+
+    async fetchRepos(integrationId: number): Promise<RepoItemForClient[]> {
+        const integration = await this.repository.fetchById(integrationId);
+        if (!integration || !integration.accessTokenEncrypted) return [];
+
+        const accessToken = await this.getAccessToken(integration);
+        if (!accessToken) return [];
+
+        if (integration.provider === 'github') {
+            const repos = await fetchGitHubRepos(accessToken);
+            return repos.map((r) => ({
+                id: r.id,
+                fullName: r.full_name,
+                name: r.name,
+                isPrivate: r.private,
+                description: r.description,
+                url: r.html_url,
+            }));
+        } else if (integration.provider === 'gitlab') {
+            const repos = await fetchGitLabRepos(accessToken);
+            return repos.map((r) => ({
+                id: r.id,
+                fullName: r.path_with_namespace,
+                name: r.name,
+                isPrivate: r.visibility === 'private',
+                description: r.description,
+                url: r.web_url,
+            }));
+        }
+
+        return [];
+    }
+
+    async selectRepo(data: IntegrationsArgSelectRepo): Promise<IntegrationsSchemaTypeForSelect | false> {
+        const integration = await this.repository.fetchById(data.integrationId);
+        if (!integration) return false;
+
+        const exists = await this.repository.existsRepoInProject(integration.projectId, data.repoFullName, data.integrationId);
+        if (exists) {
+            $logger.debug({ integrationId: data.integrationId, repoFullName: data.repoFullName, projectId: integration.projectId }, '[integrations] repo already connected to project, skipping');
+            return false;
+        }
+
+        const result = await this.repository.updateRepo(data);
+        if (result) {
+            $logger.debug({ integrationId: data.integrationId, repoFullName: data.repoFullName }, '[integrations] repo selected, starting sync and webhook registration');
+            this.syncIssues(data.integrationId).catch(logError);
+            this.registerWebhook(data.integrationId).catch(logError);
+        }
+        return result;
+    }
+
+    private async registerWebhook(integrationId: number): Promise<void> {
+        const integration = await this.repository.fetchById(integrationId);
+        if (!integration || !integration.accessTokenEncrypted || !integration.repoFullName) return;
+
+        const apiUrl = process.env.API_URL;
+        if (!apiUrl) return;
+
+        const accessToken = await this.getAccessToken(integration);
+        if (!accessToken) {
+            $logger.error({ integrationId, provider: integration.provider }, '[integrations] registerWebhook failed: no access token');
+            return;
+        }
+
+        const webhookSecret = randomBytes(32).toString('hex');
+        const webhookUrl = `${apiUrl}/module/integrations/webhook/${integration.provider}`;
+
+        let webhookId: string;
+
+        if (integration.provider === 'github') {
+            const result = await createGitHubWebhook(accessToken, integration.repoFullName, webhookUrl, webhookSecret);
+            webhookId = String(result.id);
+        } else if (integration.provider === 'gitlab' && integration.repoExternalId) {
+            const result = await createGitLabWebhook(accessToken, Number(integration.repoExternalId), webhookUrl, webhookSecret);
+            webhookId = String(result.id);
+        } else {
+            return;
+        }
+
+        $logger.debug({ integrationId, provider: integration.provider, webhookId }, '[integrations] webhook registered');
+        await this.repository.updateWebhook(integrationId, webhookId, encrypt(webhookSecret));
+    }
+
+    async syncIssues(integrationId: number): Promise<number> {
+        const integration = await this.repository.fetchById(integrationId);
+        if (!integration || !integration.accessTokenEncrypted || !integration.repoFullName) return 0;
+
+        const accessToken = await this.getAccessToken(integration);
+        if (!accessToken) {
+            $logger.error({ integrationId, provider: integration.provider }, '[integrations] syncIssues failed: no access token');
+            return 0;
+        }
+
+        const since = integration.lastSyncedAt?.toISOString();
+        $logger.debug({ integrationId, provider: integration.provider, repo: integration.repoFullName, since: since ?? 'full sync' }, '[integrations] syncIssues start');
+        const existingMappings = await this.repository.fetchMappingsByIntegrationId(integrationId);
+        const mappingsByIssueNumber = new Map(existingMappings.map((m) => [m.issueNumber, m]));
+
+        // Backfill sourceUrl for existing tasks that don't have it yet
+        if (existingMappings.length > 0) {
+            const baseUrl = integration.provider === 'github' ? GITHUB_BASE_URL : GITLAB_BASE_URL;
+            const issuePath = integration.provider === 'gitlab' ? '/-/issues/' : '/issues/';
+            const prefix = `${baseUrl}/${integration.repoFullName}${issuePath}`;
+            await this.repository.backfillSourceUrls(integrationId, prefix).catch(logError);
+        }
+
+        type NewIssueItem = { goalId: number; description: string; integrationId: number; issueNumber: number; issueState: string; note: string | null; complete: boolean; kanbanOrder: number; sourceUrl: string | null };
+        const newItems: NewIssueItem[] = [];
+
+        if (integration.provider === 'github') {
+            const issues = await fetchGitHubIssues(accessToken, integration.repoFullName, since);
+            for (const issue of issues) {
+                const existing = mappingsByIssueNumber.get(issue.number);
+                if (existing) {
+                    const isClosed = issue.state === 'closed';
+                    const targetState = isClosed ? 'closed' : 'open';
+                    await this.repository.updateTaskComplete(existing.taskId, isClosed).catch(logError);
+                    if (existing.issueState !== targetState) {
+                        await this.repository.updateMappingState(existing.id, targetState).catch(logError);
+                    }
+                    await this.repository.updateTaskTitleAndNote(existing.taskId, issue.title, issue.body ?? null).catch(logError);
+                    await this.repository.updateTaskSourceUrl(existing.taskId, `${GITHUB_BASE_URL}/${integration.repoFullName}/issues/${issue.number}`).catch(logError);
+                    continue;
+                }
+                newItems.push({
+                    goalId: integration.projectId,
+                    description: issue.title,
+                    integrationId,
+                    issueNumber: issue.number,
+                    issueState: issue.state === 'open' ? 'open' : 'closed',
+                    note: issue.body ?? null,
+                    complete: issue.state === 'closed',
+                    kanbanOrder: 0,
+                    sourceUrl: `${GITHUB_BASE_URL}/${integration.repoFullName}/issues/${issue.number}`,
+                });
+            }
+        } else if (integration.provider === 'gitlab' && integration.repoExternalId) {
+            const issues = await fetchGitLabIssues(accessToken, Number(integration.repoExternalId), since);
+            for (const issue of issues) {
+                const existing = mappingsByIssueNumber.get(issue.iid);
+                if (existing) {
+                    const isClosed = issue.state === 'closed';
+                    const targetState = isClosed ? 'closed' : 'open';
+                    await this.repository.updateTaskComplete(existing.taskId, isClosed).catch(logError);
+                    if (existing.issueState !== targetState) {
+                        await this.repository.updateMappingState(existing.id, targetState).catch(logError);
+                    }
+                    await this.repository.updateTaskTitleAndNote(existing.taskId, issue.title, issue.description ?? null).catch(logError);
+                    await this.repository.updateTaskSourceUrl(existing.taskId, `${GITLAB_BASE_URL}/${integration.repoFullName}/-/issues/${issue.iid}`).catch(logError);
+                    continue;
+                }
+                const isClosed = issue.state === 'closed';
+                newItems.push({
+                    goalId: integration.projectId,
+                    description: issue.title,
+                    integrationId,
+                    issueNumber: issue.iid,
+                    issueState: isClosed ? 'closed' : 'open',
+                    note: issue.description ?? null,
+                    complete: isClosed,
+                    kanbanOrder: 0,
+                    sourceUrl: `${GITLAB_BASE_URL}/${integration.repoFullName}/-/issues/${issue.iid}`,
+                });
+            }
+        }
+
+        // Issues come newest-first from API.
+        // Reverse so oldest is inserted first (lower ID) and newest last (higher ID).
+        // This way list view (ORDER BY id DESC) shows newest first.
+        // Assign kanbanOrder so newest = smallest (appears first in kanban).
+        // Issues come newest-first from API.
+        // Reverse so oldest is inserted first (lower ID) and newest last (higher ID).
+        // List view (ORDER BY id DESC) shows newest first.
+        // Assign kanbanOrder: each next item goes further into minus from current min.
+        // Newest (last in array) gets the smallest value → appears first in kanban.
+        if (newItems.length > 0) {
+            newItems.reverse();
+            const { KANBAN_ORDER_GAP } = TasksRepository;
+            const min = await this.user.tasksManager.repository.fetchTaskWithMinKanbanOrder(integration.projectId, null);
+            for (let i = 0; i < newItems.length; i++) {
+                newItems[i].kanbanOrder = (min ?? 0) - KANBAN_ORDER_GAP * (i + 1);
+            }
+        }
+
+        const created = await this.repository.createTasksAndMappingsBatch(newItems);
+        await this.repository.updateLastSyncedAt(integrationId);
+
+        $logger.debug({ integrationId, created, updatedExisting: existingMappings.length, totalIssuesFetched: newItems.length + existingMappings.length }, '[integrations] syncIssues completed');
+        return created;
+    }
+
+    async onTaskCompleteChanged(taskId: number, complete: boolean): Promise<boolean> {
+        const mapping = await this.repository.fetchMappingByTaskId(taskId);
+        if (!mapping) return true;
+
+        const { integration } = mapping;
+        $logger.debug({ taskId, complete, provider: integration.provider, isActive: integration.isActive, issueNumber: mapping.issueNumber, issueState: mapping.issueState }, '[integrations] onTaskCompleteChanged');
+        if (!integration.isActive || !integration.accessTokenEncrypted || !integration.repoFullName) return true;
+
+        const targetState = complete ? 'closed' : 'open';
+        if (mapping.issueState === targetState) {
+            $logger.debug({ taskId, targetState }, '[integrations] onTaskCompleteChanged: state already matches, skipping');
+            return true;
+        }
+
+        const accessToken = await this.getAccessToken(integration);
+        if (!accessToken) {
+            $logger.error({ taskId, integrationId: integration.id, provider: integration.provider }, '[integrations] onTaskCompleteChanged: no access token');
+            return false;
+        }
+
+        if (integration.provider === 'github') {
+            await updateGitHubIssueState(accessToken, integration.repoFullName, mapping.issueNumber, targetState);
+        } else if (integration.provider === 'gitlab' && integration.repoExternalId) {
+            await updateGitLabIssueState(
+                accessToken,
+                Number(integration.repoExternalId),
+                mapping.issueNumber,
+                complete ? 'close' : 'reopen',
+            );
+        }
+
+        await this.repository.updateMappingState(mapping.id, targetState);
+        $logger.debug({ taskId, issueNumber: mapping.issueNumber, targetState }, '[integrations] onTaskCompleteChanged: issue state updated');
+        return true;
+    }
+
+    private async getAccessToken(integration: IntegrationsSchemaTypeForSelect): Promise<string | null> {
+        if (!integration.accessTokenEncrypted) return null;
+
+        const accessToken = decrypt(integration.accessTokenEncrypted);
+
+        if (integration.provider !== 'gitlab' || !integration.refreshTokenEncrypted) {
+            return accessToken;
+        }
+
+        // Try the current token, refresh on 401
+        try {
+            const axios = (await import('axios')).default;
+            const gitlabApiUrl = process.env.GITLAB_API_URL || 'https://gitlab.com/api/v4';
+            await axios.get(`${gitlabApiUrl}/user`, {
+                headers: { Authorization: `Bearer ${accessToken}` },
+            });
+            return accessToken;
+        } catch (err: any) {
+            if (err?.response?.status !== 401) return accessToken;
+            $logger.debug({ integrationId: integration.id }, '[integrations] GitLab token expired (401), refreshing');
+        }
+
+        // Token expired, refresh it
+        try {
+            const refreshToken = decrypt(integration.refreshTokenEncrypted);
+            const tokens = await refreshGitLabToken(refreshToken);
+            await this.repository.updateTokens(
+                integration.id,
+                encrypt(tokens.accessToken),
+                encrypt(tokens.refreshToken),
+            );
+            $logger.debug({ integrationId: integration.id }, '[integrations] GitLab token refreshed successfully');
+            return tokens.accessToken;
+        } catch (err) {
+            $logger.error({ integrationId: integration.id, err }, '[integrations] GitLab token refresh failed');
+            return null;
+        }
+    }
+
+}
@@ -0,0 +1,334 @@
+import { and, eq, ne, isNull, sql } from 'drizzle-orm';
+import { IntegrationsSchema, IntegrationTaskMapSchema, TasksSchema, UsersSchema, type IntegrationsSchemaTypeForSelect, type IntegrationTaskMapSchemaTypeForSelect } from 'taskview-db-schemas';
+import { Database } from '../../modules/db';
+import { callWithCatch } from '../../utils/helpers';
+import type { IntegrationsArgAdd, IntegrationsArgDelete, IntegrationsArgSelectRepo, IntegrationsArgToggle } from './types';
+import { TasksRepository } from '../tasks/TasksRepository';
+
+export class IntegrationsRepository {
+    private readonly db: Database;
+
+    constructor() {
+        this.db = Database.getInstance();
+    }
+
+    async create(data: IntegrationsArgAdd): Promise<IntegrationsSchemaTypeForSelect | false> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.insert(IntegrationsSchema).values({
+                provider: data.provider,
+                repoFullName: data.repoFullName,
+                projectId: data.projectId,
+            }).returning()
+        );
+        if (!result) return false;
+        return result[0];
+    }
+
+    async delete(data: IntegrationsArgDelete): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.delete(IntegrationsSchema).where(eq(IntegrationsSchema.id, data.id))
+        );
+        if (!result) return false;
+        return !!(result?.rowCount && result.rowCount > 0);
+    }
+
+    async toggle(data: IntegrationsArgToggle): Promise<IntegrationsSchemaTypeForSelect | false> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(IntegrationsSchema)
+                .set({ isActive: data.isActive, updatedAt: new Date() })
+                .where(eq(IntegrationsSchema.id, data.id))
+                .returning()
+        );
+        if (!result) return false;
+        return result[0];
+    }
+
+    async fetchByProjectId(projectId: number): Promise<IntegrationsSchemaTypeForSelect[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(IntegrationsSchema)
+                .where(eq(IntegrationsSchema.projectId, projectId))
+        );
+        if (!result) return [];
+        return result;
+    }
+
+    async fetchById(id: number): Promise<IntegrationsSchemaTypeForSelect | undefined> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(IntegrationsSchema)
+                .where(eq(IntegrationsSchema.id, id))
+        );
+        if (!result || result.length === 0) return undefined;
+        return result[0];
+    }
+
+    async createWithToken(
+        provider: 'github' | 'gitlab',
+        projectId: number,
+        accessTokenEncrypted: string,
+        refreshTokenEncrypted?: string | null,
+    ): Promise<IntegrationsSchemaTypeForSelect | false> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.insert(IntegrationsSchema).values({
+                provider,
+                projectId,
+                accessTokenEncrypted,
+                refreshTokenEncrypted: refreshTokenEncrypted ?? null,
+            }).returning()
+        );
+        if (!result) return false;
+        return result[0];
+    }
+
+    async existsRepoInProject(projectId: number, repoFullName: string, excludeIntegrationId?: number): Promise<boolean> {
+        const conditions = [
+            eq(IntegrationsSchema.projectId, projectId),
+            eq(IntegrationsSchema.repoFullName, repoFullName),
+        ];
+        if (excludeIntegrationId) {
+            conditions.push(ne(IntegrationsSchema.id, excludeIntegrationId));
+        }
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ id: IntegrationsSchema.id }).from(IntegrationsSchema)
+                .where(and(...conditions))
+        );
+        return !!result && result.length > 0;
+    }
+
+    async updateRepo(data: IntegrationsArgSelectRepo): Promise<IntegrationsSchemaTypeForSelect | false> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(IntegrationsSchema)
+                .set({
+                    repoFullName: data.repoFullName,
+                    repoExternalId: data.repoExternalId,
+                    updatedAt: new Date(),
+                })
+                .where(eq(IntegrationsSchema.id, data.integrationId))
+                .returning()
+        );
+        if (!result) return false;
+        return result[0];
+    }
+
+    async createTaskAndMapping(
+        goalId: number,
+        description: string,
+        integrationId: number,
+        issueNumber: number,
+        issueState: string,
+        note?: string | null,
+        complete?: boolean,
+        sourceUrl?: string | null,
+    ): Promise<IntegrationTaskMapSchemaTypeForSelect | false> {
+        const tasksRepo = new TasksRepository();
+        const kanbanOrder = await tasksRepo.getNextKanbanOrder(goalId);
+
+        const result = await callWithCatch(async () => {
+            const [task] = await this.db.dbDrizzle.insert(TasksSchema).values({
+                goalId,
+                description,
+                complete: complete ?? false,
+                note: note || null,
+                kanbanOrder,
+                sourceUrl: sourceUrl || null,
+            }).returning();
+            const [mapping] = await this.db.dbDrizzle.insert(IntegrationTaskMapSchema).values({
+                integrationId,
+                taskId: task.id,
+                issueNumber,
+                issueState,
+            }).returning();
+            return mapping;
+        });
+        if (!result) return false;
+        return result;
+    }
+
+    async fetchMappingsByIntegrationId(integrationId: number): Promise<IntegrationTaskMapSchemaTypeForSelect[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(IntegrationTaskMapSchema)
+                .where(eq(IntegrationTaskMapSchema.integrationId, integrationId))
+        );
+        if (!result) return [];
+        return result;
+    }
+
+    async updateTokens(integrationId: number, accessTokenEncrypted: string, refreshTokenEncrypted: string | null): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(IntegrationsSchema)
+                .set({ accessTokenEncrypted, refreshTokenEncrypted, updatedAt: new Date() })
+                .where(eq(IntegrationsSchema.id, integrationId))
+        );
+        return !!result;
+    }
+
+    async updateWebhook(integrationId: number, webhookId: string, webhookSecretEncrypted: string): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(IntegrationsSchema)
+                .set({ webhookId, webhookSecretEncrypted, updatedAt: new Date() })
+                .where(eq(IntegrationsSchema.id, integrationId))
+        );
+        return !!result;
+    }
+
+    async fetchAllActiveByRepoFullName(repoFullName: string): Promise<IntegrationsSchemaTypeForSelect[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(IntegrationsSchema)
+                .where(
+                    and(
+                        eq(IntegrationsSchema.repoFullName, repoFullName),
+                        eq(IntegrationsSchema.isActive, true),
+                    )
+                )
+        );
+        return result || [];
+    }
+
+    async fetchAllActiveByRepoExternalId(repoExternalId: string): Promise<IntegrationsSchemaTypeForSelect[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(IntegrationsSchema)
+                .where(
+                    and(
+                        eq(IntegrationsSchema.repoExternalId, repoExternalId),
+                        eq(IntegrationsSchema.isActive, true),
+                    )
+                )
+        );
+        return result || [];
+    }
+
+    async fetchMappingByIssueNumber(integrationId: number, issueNumber: number): Promise<IntegrationTaskMapSchemaTypeForSelect | undefined> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(IntegrationTaskMapSchema)
+                .where(
+                    and(
+                        eq(IntegrationTaskMapSchema.integrationId, integrationId),
+                        eq(IntegrationTaskMapSchema.issueNumber, issueNumber),
+                    )
+                )
+        );
+        if (!result || result.length === 0) return undefined;
+        return result[0];
+    }
+
+    async fetchMappingByTaskId(taskId: number): Promise<(IntegrationTaskMapSchemaTypeForSelect & { integration: IntegrationsSchemaTypeForSelect }) | undefined> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle
+                .select()
+                .from(IntegrationTaskMapSchema)
+                .innerJoin(IntegrationsSchema, eq(IntegrationTaskMapSchema.integrationId, IntegrationsSchema.id))
+                .where(eq(IntegrationTaskMapSchema.taskId, taskId))
+        );
+        if (!result || result.length === 0) return undefined;
+        return {
+            ...result[0].integration_task_map,
+            integration: result[0].integrations,
+        };
+    }
+
+    async updateTaskComplete(taskId: number, complete: boolean): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(TasksSchema)
+                .set({ complete })
+                .where(eq(TasksSchema.id, taskId))
+        );
+        return !!result;
+    }
+
+    async updateTaskTitleAndNote(taskId: number, description: string, note: string | null): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(TasksSchema)
+                .set({ description, note })
+                .where(eq(TasksSchema.id, taskId))
+        );
+        return !!result;
+    }
+
+    async updateTaskSourceUrl(taskId: number, sourceUrl: string): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(TasksSchema)
+                .set({ sourceUrl })
+                .where(eq(TasksSchema.id, taskId))
+        );
+        return !!result;
+    }
+
+    async backfillSourceUrls(integrationId: number, urlPrefix: string): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.execute(sql`
+                UPDATE tasks.tasks t
+                SET source_url = ${urlPrefix} || m.issue_number
+                FROM tasks.integration_task_map m
+                WHERE m.task_id = t.id
+                  AND m.integration_id = ${integrationId}
+                  AND t.source_url IS NULL
+            `)
+        );
+        return !!result;
+    }
+
+    async updateMappingState(mappingId: number, issueState: string): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(IntegrationTaskMapSchema)
+                .set({ issueState, syncedAt: new Date() })
+                .where(eq(IntegrationTaskMapSchema.id, mappingId))
+        );
+        return !!result;
+    }
+
+    async createTasksAndMappingsBatch(
+        items: Array<{ goalId: number; description: string; integrationId: number; issueNumber: number; issueState: string; note: string | null; complete: boolean; kanbanOrder: number; sourceUrl: string | null }>,
+    ): Promise<number> {
+        if (items.length === 0) return 0;
+        let created = 0;
+        const BATCH_SIZE = 100;
+
+        for (let i = 0; i < items.length; i += BATCH_SIZE) {
+            const batch = items.slice(i, i + BATCH_SIZE);
+            const result = await callWithCatch(async () => {
+                const tasks = await this.db.dbDrizzle.insert(TasksSchema).values(
+                    batch.map((item) => ({
+                        goalId: item.goalId,
+                        description: item.description,
+                        complete: item.complete,
+                        note: item.note,
+                        kanbanOrder: item.kanbanOrder,
+                        sourceUrl: item.sourceUrl,
+                    })),
+                ).returning({ id: TasksSchema.id });
+
+                await this.db.dbDrizzle.insert(IntegrationTaskMapSchema).values(
+                    tasks.map((task, idx) => ({
+                        integrationId: batch[idx].integrationId,
+                        taskId: task.id,
+                        issueNumber: batch[idx].issueNumber,
+                        issueState: batch[idx].issueState,
+                    })),
+                );
+
+                return tasks.length;
+            });
+            if (result) created += result;
+        }
+
+        return created;
+    }
+
+    async updateLastSyncedAt(integrationId: number): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(IntegrationsSchema)
+                .set({ lastSyncedAt: new Date() })
+                .where(eq(IntegrationsSchema.id, integrationId))
+        );
+        return !!result;
+    }
+
+    async fetchUserLogin(userId: number): Promise<string | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ login: UsersSchema.login }).from(UsersSchema)
+                .where(eq(UsersSchema.id, userId))
+        );
+        if (!result || result.length === 0) return null;
+        return result[0].login;
+    }
+
+}
@@ -0,0 +1,35 @@
+import { Router } from 'express';
+import type { Routable } from '../../types/routable.type';
+import { IsLoggedIn } from '../auth/middlewares/is-logged-in';
+import IntegrationsController from './IntegrationsController';
+import { CanManageIntegrations } from './middlewares/CanManageIntegrations';
+import { CanViewIntegrations } from './middlewares/CanViewIntegrations';
+
+export default class IntegrationsRoutes implements Routable {
+    private readonly router: ReturnType<typeof Router>;
+    private readonly controller: IntegrationsController;
+
+    constructor() {
+        this.router = Router();
+        this.controller = new IntegrationsController();
+        this.initRoutes();
+    }
+
+    getRouter() {
+        return this.router;
+    }
+
+    initRoutes() {
+        this.router.get('', [IsLoggedIn, CanViewIntegrations], this.controller.fetchIntegrations);
+        this.router.post('', [IsLoggedIn, CanManageIntegrations], this.controller.createIntegration);
+        this.router.delete('', [IsLoggedIn, CanManageIntegrations], this.controller.deleteIntegration);
+        this.router.patch('/toggle', [IsLoggedIn, CanManageIntegrations], this.controller.toggleIntegration);
+        this.router.patch('/select-repo', [IsLoggedIn, CanManageIntegrations], this.controller.selectRepo);
+        this.router.post('/sync', [IsLoggedIn, CanManageIntegrations], this.controller.syncIntegration);
+        this.router.get('/repos', [IsLoggedIn, CanViewIntegrations], this.controller.fetchRepos);
+        this.router.get('/oauth/:provider', this.controller.initiateOAuth);
+        this.router.get('/oauth/:provider/callback', this.controller.handleOAuthCallback);
+        this.router.post('/webhook/github', this.controller.handleGitHubWebhook);
+        this.router.post('/webhook/gitlab', this.controller.handleGitLabWebhook);
+    }
+}
@@ -0,0 +1,17 @@
+import type { NextFunction, Request, Response } from 'express';
+import { GoalPermissions } from '../../../types/auth.types';
+import { resolveProjectId } from './resolveProjectId';
+
+export const CanManageIntegrations = async (req: Request, res: Response, next: NextFunction) => {
+    const projectId = await resolveProjectId(req);
+    if (!projectId) {
+        return res.status(400).end();
+    }
+
+    const checker = await req.appUser.permissionsFetcher.getCheckerForGoal(projectId);
+    if (checker.hasPermissions(GoalPermissions.INTEGRATIONS_CAN_MANAGE)) {
+        return next();
+    }
+
+    return res.status(403).end();
+};
@@ -0,0 +1,17 @@
+import type { NextFunction, Request, Response } from 'express';
+import { GoalPermissions } from '../../../types/auth.types';
+import { resolveProjectId } from './resolveProjectId';
+
+export const CanViewIntegrations = async (req: Request, res: Response, next: NextFunction) => {
+    const projectId = await resolveProjectId(req);
+    if (!projectId) {
+        return res.status(400).end();
+    }
+
+    const checker = await req.appUser.permissionsFetcher.getCheckerForGoal(projectId);
+    if (checker.hasPermissions(GoalPermissions.INTEGRATIONS_CAN_VIEW)) {
+        return next();
+    }
+
+    return res.status(403).end();
+};
@@ -0,0 +1,23 @@
+import type { Request } from 'express';
+import { IntegrationsRepository } from '../IntegrationsRepository';
+
+/**
+ * Resolves projectId from request.
+ * Checks body (projectId, integrationId, id) and query (projectId, integrationId).
+ */
+export async function resolveProjectId(req: Request): Promise<number | null> {
+    // Direct projectId in body or query
+    const directId = req.body?.projectId ?? req.query?.projectId;
+    if (directId) {
+        const id = Number(directId);
+        return isNaN(id) ? null : id;
+    }
+
+    // integrationId from body or query, or id from body
+    const integrationId = Number(req.body?.integrationId || req.query?.integrationId || req.body?.id);
+    if (!integrationId || isNaN(integrationId)) return null;
+
+    const repo = new IntegrationsRepository();
+    const integration = await repo.fetchById(integrationId);
+    return integration?.projectId ?? null;
+}
@@ -0,0 +1,169 @@
+import axios from 'axios';
+import { createHmac, timingSafeEqual } from 'crypto';
+
+export const GITHUB_BASE_URL = process.env.GITHUB_BASE_URL || 'https://github.com';
+const GITHUB_API_URL = process.env.GITHUB_API_URL || 'https://api.github.com';
+const GITHUB_OAUTH_URL = `${GITHUB_BASE_URL}/login/oauth/authorize`;
+const GITHUB_TOKEN_URL = `${GITHUB_BASE_URL}/login/oauth/access_token`;
+
+export type GitHubRepo = {
+    id: number;
+    full_name: string;
+    name: string;
+    private: boolean;
+    description: string | null;
+    html_url: string;
+};
+
+export type GitHubIssue = {
+    number: number;
+    title: string;
+    body: string | null;
+    state: 'open' | 'closed';
+    html_url: string;
+    pull_request?: unknown;
+};
+
+export function getGitHubOAuthUrl(state: string): string {
+    const clientId = process.env.GITHUB_INTEGRATION_CLIENT_ID;
+    const redirectUri = process.env.GITHUB_INTEGRATION_CALLBACK_URL;
+    if (!clientId || !redirectUri) {
+        throw new Error('GitHub integration OAuth is not configured');
+    }
+    const params = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        scope: 'repo',
+        state,
+    });
+    return `${GITHUB_OAUTH_URL}?${params.toString()}`;
+}
+
+export async function exchangeGitHubCode(code: string): Promise<string> {
+    const res = await axios.post<{ access_token: string; token_type: string }>(
+        GITHUB_TOKEN_URL,
+        {
+            client_id: process.env.GITHUB_INTEGRATION_CLIENT_ID,
+            client_secret: process.env.GITHUB_INTEGRATION_CLIENT_SECRET,
+            code,
+        },
+        {
+            headers: { Accept: 'application/json' },
+        }
+    );
+    if (!res.data.access_token) {
+        throw new Error('Failed to exchange GitHub code for token');
+    }
+    return res.data.access_token;
+}
+
+export async function fetchGitHubRepos(accessToken: string): Promise<GitHubRepo[]> {
+    const repos: GitHubRepo[] = [];
+    let page = 1;
+    const perPage = 100;
+
+    while (true) {
+        const res = await axios.get<GitHubRepo[]>(`${GITHUB_API_URL}/user/repos`, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/vnd.github+json',
+            },
+            params: {
+                per_page: perPage,
+                page,
+                sort: 'updated',
+                direction: 'desc',
+            },
+        });
+        repos.push(...res.data);
+        if (res.data.length < perPage) break;
+        page++;
+    }
+
+    return repos;
+}
+
+export async function fetchGitHubIssues(accessToken: string, repoFullName: string, since?: string): Promise<GitHubIssue[]> {
+    const issues: GitHubIssue[] = [];
+    let page = 1;
+    const perPage = 100;
+
+    while (true) {
+        const res = await axios.get<GitHubIssue[]>(`${GITHUB_API_URL}/repos/${repoFullName}/issues`, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/vnd.github+json',
+            },
+            params: {
+                state: 'all',
+                per_page: perPage,
+                page,
+                sort: since ? 'updated' : 'created',
+                direction: 'desc',
+                ...(since ? { since } : {}),
+            },
+        });
+        // GitHub API returns pull requests as issues too — filter them out
+        const realIssues = res.data.filter((i) => !i.pull_request);
+        issues.push(...realIssues);
+        if (res.data.length < perPage) break;
+        page++;
+    }
+
+    return issues;
+}
+
+export async function createGitHubWebhook(
+    accessToken: string,
+    repoFullName: string,
+    webhookUrl: string,
+    secret: string,
+): Promise<{ id: number }> {
+    const res = await axios.post<{ id: number }>(
+        `${GITHUB_API_URL}/repos/${repoFullName}/hooks`,
+        {
+            name: 'web',
+            active: true,
+            events: ['issues'],
+            config: {
+                url: webhookUrl,
+                content_type: 'json',
+                secret,
+            },
+        },
+        {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/vnd.github+json',
+            },
+        },
+    );
+    return { id: res.data.id };
+}
+
+export function verifyGitHubWebhookSignature(rawBody: Buffer, signature: string, secret: string): boolean {
+    const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
+    try {
+        return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+    } catch {
+        return false;
+    }
+}
+
+export async function updateGitHubIssueState(
+    accessToken: string,
+    repoFullName: string,
+    issueNumber: number,
+    state: 'open' | 'closed',
+): Promise<void> {
+    await axios.patch(
+        `${GITHUB_API_URL}/repos/${repoFullName}/issues/${issueNumber}`,
+        { state },
+        {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/vnd.github+json',
+            },
+        },
+    );
+}
@@ -0,0 +1,175 @@
+import axios from 'axios';
+
+export const GITLAB_BASE_URL = process.env.GITLAB_BASE_URL || 'https://gitlab.com';
+const GITLAB_API_URL = process.env.GITLAB_API_URL || `${GITLAB_BASE_URL}/api/v4`;
+const GITLAB_OAUTH_URL = `${GITLAB_BASE_URL}/oauth/authorize`;
+const GITLAB_TOKEN_URL = `${GITLAB_BASE_URL}/oauth/token`;
+
+export type GitLabRepo = {
+    id: number;
+    path_with_namespace: string;
+    name: string;
+    visibility: 'private' | 'internal' | 'public';
+    description: string | null;
+    web_url: string;
+};
+
+export type GitLabIssue = {
+    iid: number;
+    title: string;
+    description: string | null;
+    state: 'opened' | 'closed';
+    web_url: string;
+};
+
+export function getGitLabOAuthUrl(state: string): string {
+    const clientId = process.env.GITLAB_INTEGRATION_CLIENT_ID;
+    const redirectUri = process.env.GITLAB_INTEGRATION_CALLBACK_URL;
+    if (!clientId || !redirectUri) {
+        throw new Error('GitLab integration OAuth is not configured');
+    }
+    const params = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        scope: 'api',
+        state,
+    });
+    return `${GITLAB_OAUTH_URL}?${params.toString()}`;
+}
+
+export async function exchangeGitLabCode(code: string): Promise<{ accessToken: string; refreshToken: string }> {
+    const res = await axios.post<{ access_token: string; refresh_token: string; token_type: string }>(
+        GITLAB_TOKEN_URL,
+        {
+            client_id: process.env.GITLAB_INTEGRATION_CLIENT_ID,
+            client_secret: process.env.GITLAB_INTEGRATION_CLIENT_SECRET,
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: process.env.GITLAB_INTEGRATION_CALLBACK_URL,
+        },
+    );
+    if (!res.data.access_token) {
+        throw new Error('Failed to exchange GitLab code for token');
+    }
+    return {
+        accessToken: res.data.access_token,
+        refreshToken: res.data.refresh_token,
+    };
+}
+
+export async function refreshGitLabToken(refreshToken: string): Promise<{ accessToken: string; refreshToken: string }> {
+    const res = await axios.post<{ access_token: string; refresh_token: string; token_type: string }>(
+        GITLAB_TOKEN_URL,
+        {
+            client_id: process.env.GITLAB_INTEGRATION_CLIENT_ID,
+            client_secret: process.env.GITLAB_INTEGRATION_CLIENT_SECRET,
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+            redirect_uri: process.env.GITLAB_INTEGRATION_CALLBACK_URL,
+        },
+    );
+    if (!res.data.access_token) {
+        throw new Error('Failed to refresh GitLab token');
+    }
+    return {
+        accessToken: res.data.access_token,
+        refreshToken: res.data.refresh_token,
+    };
+}
+
+export async function fetchGitLabRepos(accessToken: string): Promise<GitLabRepo[]> {
+    const repos: GitLabRepo[] = [];
+    let page = 1;
+    const perPage = 100;
+
+    while (true) {
+        const res = await axios.get<GitLabRepo[]>(`${GITLAB_API_URL}/projects`, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+            params: {
+                membership: true,
+                per_page: perPage,
+                page,
+                order_by: 'updated_at',
+                sort: 'desc',
+            },
+        });
+        repos.push(...res.data);
+        if (res.data.length < perPage) break;
+        page++;
+    }
+
+    return repos;
+}
+
+export async function fetchGitLabIssues(accessToken: string, projectId: number, updatedAfter?: string): Promise<GitLabIssue[]> {
+    const issues: GitLabIssue[] = [];
+    let page = 1;
+    const perPage = 100;
+
+    while (true) {
+        const res = await axios.get<GitLabIssue[]>(`${GITLAB_API_URL}/projects/${projectId}/issues`, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+            params: {
+                state: 'all',
+                per_page: perPage,
+                page,
+                order_by: updatedAfter ? 'updated_at' : 'created_at',
+                sort: 'desc',
+                ...(updatedAfter ? { updated_after: updatedAfter } : {}),
+            },
+        });
+        issues.push(...res.data);
+        if (res.data.length < perPage) break;
+        page++;
+    }
+
+    return issues;
+}
+
+export async function createGitLabWebhook(
+    accessToken: string,
+    projectId: number,
+    webhookUrl: string,
+    secret: string,
+): Promise<{ id: number }> {
+    const res = await axios.post<{ id: number }>(
+        `${GITLAB_API_URL}/projects/${projectId}/hooks`,
+        {
+            url: webhookUrl,
+            issues_events: true,
+            token: secret,
+        },
+        {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        },
+    );
+    return { id: res.data.id };
+}
+
+export function verifyGitLabWebhookToken(headerToken: string, secret: string): boolean {
+    return headerToken === secret;
+}
+
+export async function updateGitLabIssueState(
+    accessToken: string,
+    projectId: number,
+    issueIid: number,
+    stateEvent: 'close' | 'reopen',
+): Promise<void> {
+    await axios.put(
+        `${GITLAB_API_URL}/projects/${projectId}/issues/${issueIid}`,
+        { state_event: stateEvent },
+        {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        },
+    );
+}
@@ -0,0 +1,46 @@
+import { type } from 'arktype';
+
+export const IntegrationsArkTypeAdd = type({
+    provider: "'github' | 'gitlab'",
+    repoFullName: 'string',
+    projectId: 'number',
+});
+export type IntegrationsArgAdd = typeof IntegrationsArkTypeAdd.infer;
+
+export const IntegrationsArkTypeDelete = type({
+    id: 'number',
+});
+export type IntegrationsArgDelete = typeof IntegrationsArkTypeDelete.infer;
+
+export const IntegrationsArkTypeToggle = type({
+    id: 'number',
+    isActive: 'boolean',
+});
+export type IntegrationsArgToggle = typeof IntegrationsArkTypeToggle.infer;
+
+export const IntegrationsArkTypeFetch = type({
+    projectId: 'string',
+});
+export type IntegrationsArgFetch = typeof IntegrationsArkTypeFetch.infer;
+
+export const IntegrationsArkTypeSelectRepo = type({
+    integrationId: 'number',
+    repoFullName: 'string',
+    repoExternalId: 'string',
+});
+export type IntegrationsArgSelectRepo = typeof IntegrationsArkTypeSelectRepo.infer;
+
+export type OAuthStatePayload = {
+    userId: number;
+    projectId: number;
+    provider: 'github' | 'gitlab';
+};
+
+export type RepoItemForClient = {
+    id: number;
+    fullName: string;
+    name: string;
+    isPrivate: boolean;
+    description: string | null;
+    url: string;
+};
@@ -1,6 +1,7 @@
 import type { Request, Response } from 'express';
 import {
    KanbanArkTypeFetchTasksForColumn,
+    KanbanArkTypeFilters,
    KanbanArkTypeGetTasksOrderForColumnAndCursor,
    KanbanArkTypeUpdateTasksOrder,
    KanbanSchemaAddStatus,
@@ -53,7 +54,12 @@ export class KanbanController {
            return res.status(400).send(data.summary);
        }

-        return res.tvJson(await req.appUser.kanbanManager.fetchTasksForColumn(data));
+        const filters = KanbanArkTypeFilters(req.query);
+        if (filters instanceof ArkErrors) {
+            return res.status(400).send(filters.summary);
+        }
+
+        return res.tvJson(await req.appUser.kanbanManager.fetchTasksForColumn({ ...data, filters }));
    };


--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Nikolai Giman	c3ff29501b	chore: new mobile version	2026-05-04 00:09:27 +02:00
Gimanh	f5c3fe2bc8	Merge pull request #46 from Gimanh/feat/tv-mcp feat: mcp and orgs	2026-04-21 10:13:11 +02:00
Nikolai Giman	bc8264b979	chore: version	2026-04-21 10:12:42 +02:00
Nikolai Giman	6c8d03c35f	chore: add tutorial	2026-04-20 08:51:24 +02:00
Nikolai Giman	7ced0a54e1	fix: migration for basic user	2026-04-19 21:28:55 +02:00
Nikolai Giman	32a2819ebf	fix: notifications	2026-04-19 12:56:13 +02:00
Nikolai Giman	9bba904c16	wip: SSO and ORG fix	2026-04-19 12:08:52 +02:00
Nikolai Giman	b24f829a6b	doc: sso	2026-04-12 23:54:43 +02:00
Nikolai Giman	1be3dac90e	fix: oidc	2026-04-12 23:39:03 +02:00
Nikolai Giman	af63530390	feat: mcp & sso	2026-04-12 23:14:10 +02:00
Nikolai Giman	8d9276830f	fix: init loading	2026-04-06 00:10:25 +02:00
Nikolai Giman	8eab7c2573	fix: slug case and test	2026-04-05 22:45:09 +02:00
Nikolai Giman	d06266fb93	fix: ui, locale, tests	2026-04-05 22:39:03 +02:00
Nikolai Giman	4ec6b143ca	feat: mcp and orgs	2026-04-05 21:56:15 +02:00
Gimanh	e3e896e159	Merge pull request #45 from Gimanh/chore/doc-fix chore: doc build	2026-03-30 00:35:26 +02:00
Nikolai Giman	de26871aff	chore: doc build	2026-03-30 00:35:00 +02:00
Gimanh	3aff4c77f2	Merge pull request #44 from Gimanh/chore/version-1-40 chore: new version 1.41	2026-03-30 00:20:56 +02:00
Nikolai Giman	1d6af3ab7d	chore: new version 1.41	2026-03-30 00:20:34 +02:00
Gimanh	5600d261bc	Merge pull request #43 from Gimanh/feat/api-tokens feat: api-tokens	2026-03-29 22:42:55 +02:00
Nikolai Giman	35776d9eb5	fix: filter only allowed projects for api-tokens	2026-03-29 15:55:09 +02:00
Nikolai Giman	9f0cfccdc6	feat: api-tokens	2026-03-29 14:29:31 +02:00
Gimanh	ba17eff713	Merge pull request #42 from Gimanh/fix/migration fix: migration	2026-03-23 22:13:07 +01:00
Nikolai Giman	08ee2af865	fix: migration	2026-03-23 22:12:44 +01:00
Gimanh	4412ba1adf	Merge pull request #40 from Gimanh/ver/1-30 chore: version 1.32.0	2026-03-22 23:30:20 +01:00
Nikolai Giman	2ad29b77f9	chore: version 1.32.0	2026-03-22 23:29:56 +01:00
Gimanh	9307ab5e45	Merge pull request #39 from Gimanh/feat/notifications Feat/notifications	2026-03-22 20:10:58 +01:00
Nikolai Giman	2f4e84b54b	wip: updater	2026-03-22 20:09:50 +01:00
Nikolai Giman	c403673f4d	wip: notifications	2026-03-22 20:01:05 +01:00
Nikolai Giman	5c4859743e	wip: exclude initiator from notifications	2026-03-15 23:45:13 +01:00
Nikolai Giman	0bf0052909	wip: notifications, detect user assign and send	2026-03-15 23:38:55 +01:00
Nikolai Giman	0e1455b947	wip: notifications	2026-03-15 22:53:51 +01:00
Gimanh	63e2481b9d	Merge pull request #38 from Gimanh/fix/integrations Fix/integrations	2026-03-15 14:43:45 +01:00
Nikolai Giman	ade7c5d007	fix: add link to integration task source	2026-03-15 14:29:24 +01:00
Nikolai Giman	fc3d03f932	fix: filter issue	2026-03-13 22:35:18 +01:00
Gimanh	9de2b64acf	Merge pull request #37 from Gimanh/chore/docs chore: docs	2026-03-13 21:58:48 +01:00
Nikolai Giman	ef206635f6	chore: docs	2026-03-13 21:56:19 +01:00
Gimanh	b8b8481fb4	Merge pull request #36 from Gimanh/chore/version-1-24 chore: version up	2026-03-08 22:33:36 +01:00
Nikolai Giman	71f3385842	chore: version up	2026-03-08 22:32:59 +01:00
Gimanh	cf35720093	Merge pull request #35 from Gimanh/fix/ui-fixes fix: ui improvements	2026-03-08 22:15:40 +01:00
Nikolai Giman	3ef150add9	fix: ui improvements	2026-03-08 22:15:11 +01:00
Gimanh	626b532d2e	Merge pull request #33 from Gimanh/feat/date-new-placeholders feat: date new placeholders	2026-03-08 21:12:19 +01:00
Nikolai Giman	e5dfd74967	feat: date new placeholders	2026-03-08 21:11:55 +01:00
Gimanh	cb8f02af4f	Merge pull request #32 from Gimanh/fix/graph-permissions-for-api fix: handle graph permissions in the API	2026-03-08 20:34:57 +01:00
Nikolai Giman	996dd11af9	fix: handle graph permissions in the API	2026-03-08 20:33:48 +01:00
Gimanh	9a33837ffd	Merge pull request #31 from Gimanh/fix/main-screen-checkbox-disabled fix: read correct goal permissions for task checkbox	2026-03-08 20:31:29 +01:00
Nikolai Giman	7b24da0688	fix: read correct goal permissions for task checkbox	2026-03-08 18:39:50 +01:00
Gimanh	009d252651	Merge pull request #30 from Gimanh/fix/lists-load-for-taskdetail fix: lists load for task details	2026-03-08 18:11:59 +01:00
Nikolai Giman	3c7733e5b0	fix: lists load for task details	2026-03-08 18:11:06 +01:00
Gimanh	2fa8bd5227	Merge pull request #29 from Gimanh/feat/git-integration feat: integrations github & gitlab	2026-03-08 17:56:15 +01:00
Nikolai Giman	37039278c4	feat: integrations	2026-03-08 16:30:00 +01:00
Gimanh	3020e41b3a	Merge pull request #28 from Gimanh/fix/issues Fix/issues	2026-03-01 21:23:21 +01:00
Gimanh	8887d5e3e1	Merge branch 'main' into fix/issues	2026-03-01 21:22:58 +01:00
Nikolai Giman	0925547f8d	chore: version	2026-03-01 21:22:13 +01:00
Nikolai Giman	c6b769a476	fix: subtasks duplication	2026-03-01 21:05:55 +01:00
Nikolai Giman	3c49941693	fix: fetch root tasks for kanban	2026-03-01 18:21:25 +01:00
Gimanh	1d79dad5c8	Merge pull request #27 from Gimanh/chore/api-lib-version chore: lib version	2026-03-01 17:58:45 +01:00
Nikolai Giman	245adf204f	chore: lib version	2026-03-01 17:58:17 +01:00
Gimanh	08da93bd40	Merge pull request #25 from Gimanh/chore/readme chore: readme	2026-02-23 09:27:24 +01:00
Nikolai Giman	317b32edea	chore: readme	2026-02-23 09:26:56 +01:00
Gimanh	b24ab9b352	Merge pull request #24 from Gimanh/chore/version-1-20-4 chore: version	2026-02-22 21:18:45 +01:00
Nikolai Giman	b0482d438f	chore: version	2026-02-22 21:18:20 +01:00
Gimanh	8298125080	Merge pull request #23 from Gimanh/fix/mobile-build fix: mobile build	2026-02-22 21:08:16 +01:00
Nikolai Giman	47492637b4	fix: mobile build	2026-02-22 21:05:29 +01:00
Gimanh	1c25d1a1bd	Merge pull request #22 from Gimanh/feat/version chore: version	2026-02-22 20:33:38 +01:00
Nikolai Giman	f24536313c	chore: version	2026-02-22 20:33:16 +01:00
Gimanh	2a56c7c666	Merge pull request #21 from Gimanh/fix/save-locale Fix/save locale	2026-02-22 20:28:04 +01:00
Nikolai Giman	fd39c5303a	fix: save the locale in storage	2026-02-22 19:52:39 +01:00
Nikolai Giman	123733e44d	fix: types	2026-02-22 19:41:40 +01:00
Gimanh	38d4e39818	Merge pull request #20 from Gimanh/fix/urls fix: urls	2026-02-22 15:39:41 +01:00
Nikolai Giman	70a321b418	fix: urls	2026-02-22 15:38:58 +01:00
Gimanh	ed248c42cd	Merge pull request #19 from Gimanh/fix/external-auth fix: external auth and up version	2026-02-22 14:51:55 +01:00
Nikolai Giman	40f24c7933	fix: external auth and up version	2026-02-22 14:51:31 +01:00
Gimanh	ef4601d4a9	Merge pull request #18 from Gimanh/feat/nuxt-ui-client feat: web and mobile client in with nuxt-ui lib	2026-02-21 22:16:40 +01:00
Nikolai Giman	24341951cd	fix: update example env and version	2026-02-21 21:20:26 +01:00
Nikolai Giman	b6ba0fbf9b	fix: renamed directory web-nuxt-ui => web	2026-02-21 18:48:38 +01:00
Nikolai Giman	1064b88902	fix: add docker scripts	2026-02-21 18:36:22 +01:00
Nikolai Giman	b2eab9ec61	fix: renamed old folder	2026-02-21 18:26:35 +01:00
Nikolai Giman	3d0d3eca47	feat: web and mobile client in with nuxt-ui lib	2026-02-21 18:16:12 +01:00
Gimanh	55e5ae4335	Merge pull request #17 from Gimanh/fix/start-screen-loading fix: start screen loading	2026-02-21 13:06:52 +01:00
Nikolai Giman	3c456edbd8	fix: validate tag and task belong to the same project	2026-02-21 13:00:58 +01:00
Nikolai Giman	dc25a02ff2	fix: start screen loading	2026-02-16 00:31:22 +01:00
Gimanh	5c200c2704	Merge pull request #16 from Gimanh/fix/some-fixes Fix/some fixes	2026-02-14 19:05:43 +01:00
Nikolai Giman	5149e7101e	fix: types	2026-02-14 19:03:09 +01:00
Nikolai Giman	471a82b9f5	fix: fix issues	2026-02-08 22:06:49 +01:00
Gimanh	072ad5d629	Merge pull request #15 from Gimanh/chore/ios-version chore: up ios version	2026-01-25 21:41:59 +01:00
Nikolai Giman	dc5fd90bca	chore: up ios version	2026-01-25 21:41:30 +01:00
Gimanh	55f6347784	Merge pull request #14 from Gimanh/feat/apple-login feat: login by Apple	2026-01-25 19:20:44 +01:00
Nikolai Giman	165c1b2444	feat: login by Apple	2026-01-25 19:19:54 +01:00
Gimanh	b3cc983965	Merge pull request #13 from Gimanh/chore/version chore: version	2026-01-23 21:58:10 +01:00
Nikolai Giman	a14c332586	chore: version	2026-01-23 21:57:29 +01:00
Gimanh	aa91934f19	Merge pull request #12 from Gimanh/fix/use-cookie fix: use cookie	2026-01-22 20:03:13 +01:00
Gimanh	aa8e6e2da6	Merge branch 'main' into fix/use-cookie	2026-01-22 20:02:40 +01:00
Nikolai Giman	c4c9a16a09	fix: use cookie	2026-01-22 20:01:26 +01:00
Gimanh	293340c253	Merge pull request #11 from Gimanh/chore/docker-build add bash script	2026-01-19 00:19:03 +01:00
Nikolai Giman	04bb545c25	add bash script	2026-01-19 00:17:56 +01:00
Gimanh	aa235c10ea	Merge pull request #10 from Gimanh/chore/extend-app chore: add extend methods	2026-01-18 23:57:14 +01:00
Nikolai Giman	45e4a11605	chore: add extend methods	2026-01-18 23:56:23 +01:00
Gimanh	55b42dfecb	Merge pull request #9 from Gimanh/chore/deps chore: deps	2026-01-18 22:28:34 +01:00
Nikolai Giman	a620c39b50	chore: deps	2026-01-18 22:24:59 +01:00
Nikolai Giman	8edb2d50d3	chore: deps	2026-01-18 22:17:40 +01:00
Nikolai Giman	19093598a0	chore: deps	2026-01-18 22:13:59 +01:00
Gimanh	9091d576e1	Merge pull request #8 from Gimanh/feat/google-auth feat: add login by Google and GitHub	2026-01-12 21:36:24 +01:00
Nikolai Giman	7d9e4a811a	feat: update app version	2026-01-12 00:40:18 +01:00
Nikolai Giman	1b03e61d2b	feat: add login by Google and GitHub	2026-01-11 23:22:30 +01:00
Gimanh	0936f51a24	Merge pull request #7 from Gimanh/fix/history-deletion fix: delete history cascade with entity (goal, list, tasks)	2026-01-08 22:10:00 +01:00
Nikolai Giman	c4c6d91456	fix: delete history cascade with entity (goal, list, tasks)	2026-01-08 22:08:23 +01:00
Gimanh	1ba13eef45	Merge pull request #5 from Gimanh/fix/load-more-in-kanban fix: increase task limit in TasksRepository and handle columnId in Ka…	2026-01-05 20:01:40 +01:00
Nikolai Giman	8a67296673	fix: increase task limit in TasksRepository and handle columnId in KanbanBoard to fix load more issue	2026-01-05 20:00:18 +01:00
Gimanh	8fe3353c5f	Merge pull request #4 from Gimanh/fix/subtask-add-ui-bug fix: add subtasks to selectedTask	2026-01-04 23:58:58 +01:00
Nikolai Giman	61debcda11	fix: add subtasks to selectedTask	2026-01-04 23:57:36 +01:00
Gimanh	615a47eafd	Merge pull request #3 from Gimanh/chore/build chore: update build scripts and package configurations	2026-01-04 22:04:12 +01:00
Nikolai Giman	4705055062	chore: update node to version 24	2026-01-04 22:03:03 +01:00
Nikolai Giman	7426f72257	chore: update build scripts and package configurations	2026-01-04 16:54:08 +01:00
Gimanh	64ddf4acfa	Merge pull request #2 from Gimanh/chore/license-file-name chore: update md	2026-01-03 20:57:30 +01:00
Nikolai Giman	d843008091	chore: update md	2026-01-03 20:56:44 +01:00
Gimanh	95cbd330b1	Merge pull request #1 from Gimanh/chore/license-file-name chore: license & cla	2026-01-03 17:34:07 +01:00
Nikolai Giman	cf7055ce60	chore: license & cla	2026-01-03 17:24:57 +01:00
				`@@ -0,0 +1 @@`
				`ALTER TABLE tv_auth.api_tokens ADD COLUMN IF NOT EXISTS allowed_goal_ids INTEGER[] NOT NULL DEFAULT '{}';`
				`@@ -0,0 +1 @@`
				`ALTER TABLE tv_auth.sso_configs ADD COLUMN IF NOT EXISTS saml_logout_url VARCHAR;`