chore: version

feat: mobile widgets

.claude-plugin/marketplace.json

@@ -0,0 +1,13 @@
+{
+  "name": "taskview",
+  "owner": {
+    "name": "Nikolai Giman"
+  },
+  "plugins": [
+    {
+      "name": "taskview",
+      "source": "./taskview-plugin",
+      "description": "Manage TaskView projects and tasks from Claude Code. Bundles the TaskView MCP server, skills, and slash commands."
+    }
+  ]
+}

.gitignore

@@ -5,6 +5,8 @@ ReleasesBuilds/*
 iconcreator
 *.prod.*
 .DS_Store
+.cursor
+.claude
 node_modules
 __APP_BUILD__
 ssl-create

README.md

@@ -1,7 +1,7 @@
 # TaskView™
 
 <p align="center">
-  <img src="./assets/taskview/kanban-dark.png" alt="TaskView logo" width="320">
+  <img src="./assets/taskview/kanban-dark.png" alt="TaskView — Kanban board" width="1440" style="max-width: 100%;">
 </p>
 
 <p align="center">
@@ -14,7 +14,7 @@
 </p>
 
 <details>
-  <summary><strong>View more screenshots</strong></summary>
+  <summary style="font-size: 24px"><strong>View more screenshots</strong></summary>
 
   <br>
 
@@ -60,6 +60,15 @@
   <a href="./LICENSE">
     <img src="https://img.shields.io/badge/license-Source--Available-blue" alt="Source-Available License">
   </a>
+  <a href="https://github.com/Gimanh/taskview-community/releases">
+    <img src="https://img.shields.io/github/v/release/Gimanh/taskview-community?label=release&color=brightgreen" alt="Latest release">
+  </a>
+  <a href="https://www.npmjs.com/package/taskview-mcp">
+    <img src="https://img.shields.io/npm/v/taskview-mcp?label=taskview-mcp&logo=npm&color=CB3837" alt="taskview-mcp on npm">
+  </a>
+  <a href="https://www.npmjs.com/package/taskview-api">
+    <img src="https://img.shields.io/npm/v/taskview-api?label=taskview-api&logo=npm&color=CB3837" alt="taskview-api on npm">
+  </a>
   <img src="https://img.shields.io/badge/status-active-brightgreen" alt="Active development">
   <img src="https://img.shields.io/badge/self--hosted-Docker-2496ED" alt="Docker self-hosted">
 </p>
@@ -169,7 +178,37 @@ Depending on the permissions assigned to an API token, an AI assistant can:
 
 MCP access can be restricted by permission and by selected projects.
 
-See the [TaskView MCP documentation](https://taskview.tech/docs/integrations/mcp) for configuration examples.
+### Connecting an MCP client
+
+The MCP server is published as [`taskview-mcp`](https://www.npmjs.com/package/taskview-mcp) and runs over stdio via `npx` — no install required. You only need a TaskView API token (`tvk_...`) — generate one in your account settings (see [API tokens](https://taskview.tech/docs/features/api-tokens)). Scope the token to the minimum permissions and projects the assistant should reach.
+
+**Claude Code** — add to `.claude/settings.json` (project) or `~/.claude.json` (global):
+
+```json
+{
+  "mcpServers": {
+    "taskview": {
+      "command": "npx",
+      "args": ["-y", "taskview-mcp"],
+      "env": {
+        "TASKVIEW_URL": "https://api.taskview.tech",
+        "TASKVIEW_TOKEN": "tvk_your_token_here"
+      }
+    }
+  }
+}
+```
+
+**Claude Desktop** — add the same `mcpServers` block to `claude_desktop_config.json`.
+
+**Other MCP clients** (Cursor, Windsurf, etc.) — use the same stdio command `npx -y taskview-mcp` with the `TASKVIEW_URL` and `TASKVIEW_TOKEN` environment variables in that client's MCP configuration.
+
+| Variable | Required | Description |
+|---|---|---|
+| `TASKVIEW_URL` | yes | TaskView API server URL (e.g. `https://api.taskview.tech`, or your self-hosted instance) |
+| `TASKVIEW_TOKEN` | yes | API token with the `tvk_` prefix |
+
+See the [TaskView MCP documentation](https://taskview.tech/docs/integrations/mcp) and the [`taskview-mcp` package README](taskview-packages/taskview-mcp/README.md) for the full tool list and more options.
 
 ## Quick start
 

api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskview-ce-api-server",
-  "version": "1.48.4",
+  "version": "1.50.1",
   "scripts": {
     "dev": "bun run --watch ./server.ts",
     "start": "NODE_ENV=production node ./dist/taskview-server.js",
@@ -83,4 +83,4 @@
   "engines": {
     "node": ">=24 <25"
   }
-}
+}

api/src/App.ts

@@ -5,6 +5,7 @@ import { corsMiddleware } from './middlewares/cors';
 import errorHandler from './middlewares/error-handler';
 import routes from './routes';
 import passport, { initPassportLogin } from './tv-modules/auth/strategies/passport-login';
+import { LoginMethods } from './tv-modules/auth/LoginMethods';
 import cookieParser from 'cookie-parser';
 import { registerAllEventHandlers, startAllWorkers } from './core/all-events';
 
@@ -13,6 +14,8 @@ export default class App {
     public port: number;
 
     constructor(port: number) {
+        LoginMethods.validateOnStartup();
+
         this.app = express();
         this.port = port;
 
@@ -31,7 +34,17 @@ export default class App {
     protected extendApp(): void { }
     protected extendMiddlewares(): void { }
 
+    private resolveTrustProxy(): boolean | number | string {
+        const raw = process.env.TRUST_PROXY?.trim();
+        if (!raw || raw.toLowerCase() === 'false') return false;
+        if (raw.toLowerCase() === 'true') return true;
+        if (/^\d+$/.test(raw)) return Number(raw);
+        return raw;
+    }
+
     private initializeMiddlewares() {
+        this.app.set('trust proxy', this.resolveTrustProxy());
+
         //add tvJson method, clien need response format like {response: data}
         this.app.use((_req: Request, res: Response, next) => {
             res.tvJson = function (data: any) {
@@ -51,7 +64,16 @@ export default class App {
                 }
             },
         }));
-        this.app.use(express.urlencoded({ extended: true }));
+        this.app.use(express.urlencoded({
+            extended: true,
+            verify: (req: any, _res, buf) => {
+                // Slack sends slash commands / interactivity as urlencoded; keep the raw body
+                // for HMAC signature verification (VerifySlackRequest).
+                if (req.url?.includes('/messaging/slack/')) {
+                    req.rawBody = buf;
+                }
+            },
+        }));
         this.app.use(appUserMiddleware);
     }
 

api/src/core/all-events.ts

@@ -6,6 +6,7 @@ import { WebhooksDispatcher } from '../tv-modules/webhooks/WebhooksDispatcher';
 import { TimeTrackingDispatcher } from '../tv-modules/time-tracking/TimeTrackingDispatcher';
 import { SprintsDispatcher } from '../tv-modules/sprints/SprintsDispatcher';
 import { RecurrenceDispatcher } from '../tv-modules/recurrence/RecurrenceDispatcher';
+import { MessagingDispatcher } from '../tv-modules/messaging/MessagingDispatcher';
 
 const dispatchers: Dispatcher[] = [
     new NotificationDispatcher(),
@@ -14,6 +15,7 @@ const dispatchers: Dispatcher[] = [
     new TimeTrackingDispatcher(),
     new SprintsDispatcher(),
     new RecurrenceDispatcher(),
+    new MessagingDispatcher(),
 ];
 
 export function registerAllEventHandlers() {

api/src/migrations/taskview/migrate.json

@@ -640,5 +640,69 @@
         "description": [
             "Added tasks.recurrence_rules.has_time — explicit flag for whether a series is anchored to a wall-clock time or is date-only. Previously the code inferred 'no time' from a midnight dtstart, which silently collapsed an explicit 00:00 series into date-only. Backfill (has_time = dtstart::time <> '00:00:00') reproduces the old inference so existing series keep their behavior; new series carry the flag through from the origin task's start_time (null = date-only, set = timed, including midnight)."
         ]
+    },
+    "50": {
+        "version": "1.55.0",
+        "name": "Release 1.55.0",
+        "releaseDate": "20260628",
+        "scripts": [
+            "/1.55.0/0.alter-goals-add-is-inbox.sql",
+            "/1.55.0/1.backfill-inbox-goals.sql",
+            "/1.55.0/2.unique-inbox-per-org.sql"
+        ],
+        "description": [
+            "Added tasks.goals.is_inbox (BOOLEAN NOT NULL DEFAULT FALSE) — flags a project as the user's personal Inbox. One Inbox per personal organization, auto-created at signup and guarded against deletion and archival in GoalsManager.",
+            "Backfill: for every personal organization without an Inbox, inserts one tasks.goals row (name='Inbox', is_inbox=true, owner=the org owner, organization_id=the org). The existing AFTER INSERT triggers fully provision it like any project — default kanban statuses, the owner added to collaboration, and the default editor/executor roles with their permissions. Idempotent — skips orgs that already have an Inbox.",
+            "Partial unique index goals_one_inbox_per_org_uidx ON tasks.goals (organization_id) WHERE is_inbox — enforces at most one Inbox per organization at the DB level, hardening the check-then-insert against concurrent races."
+        ]
+    },
+    "51": {
+        "version": "1.56.0",
+        "name": "Messaging integrations",
+        "releaseDate": "20260701",
+        "scripts": [
+            "/1.56.0/0.create-messaging-tables.sql",
+            "/1.56.0/1.alter-messaging-add-events.sql"
+        ],
+        "description": [
+            "Messaging integrations module (Slack / Telegram)",
+            "Outbound delivery connections for personal and project/org owners",
+            "Pending link tokens for binding + user identity map",
+            "Per-connection event subscription (which events to deliver)"
+        ]
+    },
+    "52": {
+        "version": "1.57.0",
+        "name": "Unique project membership",
+        "releaseDate": "20260702",
+        "scripts": [
+            "/1.57.0/0.unique-users-to-goals.sql"
+        ],
+        "description": [
+            "Deduplicate collaboration.users_to_goals rows",
+            "Unique index on (user_id, goal_id) — one membership per user per project"
+        ]
+    },
+    "53": {
+        "version": "1.58.0",
+        "name": "Messaging channel post-content flag",
+        "releaseDate": "20260702",
+        "scripts": [
+            "/1.58.0/0.alter-messaging-add-post-content.sql"
+        ],
+        "description": [
+            "Per-connection opt-out for posting task description to project channels"
+        ]
+    },
+    "54": {
+        "version": "1.59.0",
+        "name": "Messaging identity workspace scoping",
+        "releaseDate": "20260705",
+        "scripts": [
+            "/1.59.0/0.alter-messaging-identity-add-team.sql"
+        ],
+        "description": [
+            "Add external_team_id to messaging_identity_map so Slack identities are keyed by (provider, team, user) — prevents cross-workspace identity collision"
+        ]
     }
 }

api/src/migrations/taskview/sql/1.55.0/0.alter-goals-add-is-inbox.sql

@@ -0,0 +1,4 @@
+ALTER TABLE tasks.goals
+    ADD COLUMN IF NOT EXISTS is_inbox BOOLEAN NOT NULL DEFAULT FALSE;
+    -- Flags a project as the user's personal Inbox. One Inbox per personal organization;
+    -- drives auto-create at signup, the backfill below, and the delete/archive guard.

api/src/migrations/taskview/sql/1.55.0/1.backfill-inbox-goals.sql

@@ -0,0 +1,17 @@
+-- For every personal organization that has no Inbox yet, create one.
+-- The AFTER INSERT triggers on tasks.goals fully provision the goal, exactly like
+-- a normal project: default kanban statuses (kanban_add_default_columns), the owner
+-- added to collaboration (add_self_to_collaboration), and the default editor/executor
+-- roles with their permissions (add_roles_after_insert). The owner also has full
+-- permissions implicitly.
+-- Idempotent: orgs that already have an Inbox are skipped.
+INSERT INTO tasks.goals (name, owner, organization_id, is_inbox)
+SELECT 'Inbox', o.owner_id, o.id, TRUE
+FROM tv_auth.organizations o
+WHERE o.is_personal = 1
+  AND NOT EXISTS (
+      SELECT 1
+      FROM tasks.goals g
+      WHERE g.organization_id = o.id
+        AND g.is_inbox = TRUE
+  );

api/src/migrations/taskview/sql/1.55.0/2.unique-inbox-per-org.sql

@@ -0,0 +1,7 @@
+-- Hard guarantee of at most one Inbox per organization. Defends the
+-- check-then-insert in GoalsRepository.createInboxGoal against concurrent
+-- signups/calls that could both pass the findInboxGoal precheck and insert.
+-- Safe to create here: it runs after the idempotent backfill, so no duplicates exist.
+CREATE UNIQUE INDEX IF NOT EXISTS goals_one_inbox_per_org_uidx
+ON tasks.goals (organization_id)
+WHERE is_inbox;

api/src/migrations/taskview/sql/1.56.0/0.create-messaging-tables.sql

@@ -0,0 +1,47 @@
+-- Messaging integrations (Slack / Telegram): outbound delivery targets, pending
+-- binding tokens, and the map between a TaskView user and their external account.
+-- See promo/integrations.md for the full design.
+
+CREATE TABLE IF NOT EXISTS tasks.messaging_connections (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    provider VARCHAR(20) NOT NULL,
+    owner_type VARCHAR(20) NOT NULL,
+    owner_id INTEGER NOT NULL,
+    target_chat_id VARCHAR(255) NOT NULL,
+    title VARCHAR(255),
+    external_team_id VARCHAR(255),
+    access_token_encrypted VARCHAR,
+    is_active BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW()
+);
+
+-- One delivery target per (provider, owner, chat) — re-connecting the same chat updates instead of duplicating.
+CREATE UNIQUE INDEX IF NOT EXISTS messaging_connection_unique
+    ON tasks.messaging_connections (provider, owner_type, owner_id, target_chat_id);
+
+-- Pending binding intent, redeemed from the messenger. Owner is polymorphic
+-- (user / project / organization); permission to bind is checked when the token is minted.
+CREATE TABLE IF NOT EXISTS tasks.messaging_link_tokens (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    token VARCHAR(128) NOT NULL UNIQUE,
+    provider VARCHAR(20) NOT NULL,
+    owner_type VARCHAR(20) NOT NULL,
+    owner_id INTEGER NOT NULL,
+    created_by INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    expires_at TIMESTAMP NOT NULL,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS tasks.messaging_identity_map (
+    id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    user_id INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    provider VARCHAR(20) NOT NULL,
+    external_user_id VARCHAR(255),
+    linked_at TIMESTAMP,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+
+-- One identity per provider per user.
+CREATE UNIQUE INDEX IF NOT EXISTS messaging_identity_unique
+    ON tasks.messaging_identity_map (user_id, provider);

api/src/migrations/taskview/sql/1.56.0/1.alter-messaging-add-events.sql

@@ -0,0 +1,5 @@
+-- Per-connection event subscription: which events this messaging connection delivers.
+-- Default covers the common task events; users opt into sprint events in the UI.
+ALTER TABLE tasks.messaging_connections
+    ADD COLUMN IF NOT EXISTS events VARCHAR[] NOT NULL
+    DEFAULT ARRAY['task.created','task.assigned','task.statusChanged','task.completed']::VARCHAR[];

api/src/migrations/taskview/sql/1.57.0/0.unique-users-to-goals.sql

@@ -0,0 +1,15 @@
+-- A user is either a member of a project or not — there is no meaning to two
+-- membership rows for the same (user_id, goal_id). Roles live in a separate table
+-- (collaboration.users_to_roles), so multi-role membership does not need duplicate rows.
+-- Dedupe any existing duplicates (the table has no PK, so key off ctid), then enforce
+-- uniqueness. Insert paths use ON CONFLICT DO NOTHING so re-adding a member is idempotent.
+
+DELETE FROM collaboration.users_to_goals
+WHERE ctid NOT IN (
+    SELECT MIN(ctid)
+    FROM collaboration.users_to_goals
+    GROUP BY user_id, goal_id
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS users_to_goals_user_goal_uidx
+    ON collaboration.users_to_goals (user_id, goal_id);

api/src/migrations/taskview/sql/1.58.0/0.alter-messaging-add-post-content.sql

@@ -0,0 +1,5 @@
+-- Project channels: opt-out flag for including the RBAC-gated task description in the
+-- channel message. Default TRUE (channel is a deliberate broadcast). Personal DMs are
+-- unaffected — they always gate the description per recipient (COMPONENT_CAN_WATCH_CONTENT).
+ALTER TABLE tasks.messaging_connections
+    ADD COLUMN IF NOT EXISTS post_content BOOLEAN NOT NULL DEFAULT TRUE;

api/src/migrations/taskview/sql/1.59.0/0.alter-messaging-identity-add-team.sql

@@ -0,0 +1 @@
+ALTER TABLE tasks.messaging_identity_map ADD COLUMN IF NOT EXISTS external_team_id VARCHAR(255);

api/src/routes/index.ts

@@ -6,6 +6,7 @@ import GraphRoutes from '../tv-modules/graph/GraphRoutes';
 import IntegrationsRoutes from '../tv-modules/integrations/IntegrationsRoutes';
 import NotificationsRoutes from '../tv-modules/notifications/NotificationsRoutes';
 import WebhooksRoutes from '../tv-modules/webhooks/WebhooksRoutes';
+import MessagingRoutes from '../tv-modules/messaging/MessagingRoutes';
 import ApiTokensRoutes from '../tv-modules/api-tokens/ApiTokensRoutes';
 import SessionsRoutes from '../tv-modules/sessions/SessionsRoutes';
 import KanbanRoutes from '../tv-modules/kanban/KanbanRoutes';
@@ -39,6 +40,7 @@ const routes: Record<string, RoutableConstructor> = {
     '/module/integrations': IntegrationsRoutes,
     '/module/notifications': NotificationsRoutes,
     '/module/webhooks': WebhooksRoutes,
+    '/module/messaging': MessagingRoutes,
     '/module/api-tokens': ApiTokensRoutes,
     '/module/sessions': SessionsRoutes,
     '/module/organizations': OrganizationRoutes,

api/src/tv-modules/analytics/sections/financial/tagAmountPayload.ts

@@ -2,7 +2,7 @@ import type { AnalyticsDataset, AnalyticsSeriesPayload, LocalizedText } from 'ta
 import type { AmountPerTagMonthSectionRow } from '../row.types'
 import { UNTAGGED_TAG_ID } from '../../types'
 
-const UNTAGGED_LABEL: LocalizedText = { ru: 'Без тегов', en: 'Untagged' }
+const UNTAGGED_LABEL: LocalizedText = { ru: 'Без тегов', en: 'Untagged', de: 'Ohne Tags', es: 'Sin etiquetas' }
 
 export type BuildTagAmountPayloadArgs = {
   rows: AmountPerTagMonthSectionRow[]

api/src/tv-modules/auth/AuthController.ts

@@ -6,7 +6,11 @@ import { z } from 'zod';
 import { Email } from '../../core/Email';
 import { $logger } from '../../modules/logget';
 import {
+    ChangeDefaultUserCredentialsSchema,
+    ChangeOwnPasswordByPasswordSchema,
+    ChangeOwnPasswordSchema,
     ChangePasswordDataScheme,
+    type PasswordChangeConfirmationMode,
     ConfirmEmailReqDataSchema,
     RefreshTokenSchema,
     RemindPasswordSchema,
@@ -15,13 +19,19 @@ import {
     UserJwtPayloadSchema,
 } from '../../types/auth.types';
 import { generateString, isEmail, time } from '../../utils/helpers';
+import { LoginMethods } from './LoginMethods';
 import EnEmailTemplate from './mail/confirm-email-en';
 import RuEmailTemplate from './mail/confirm-email-ru';
 import LoginCodeEmailTemplate from './mail/login-code-en';
 import type { ExternalAuthUser } from './strategies/external-auth.types';
 import { OrganizationRepository } from '../organizations/OrganizationRepository';
+import { GoalsRepository } from '../goals/GoalsRepository';
 
 const LOGIN_CODE_TTL_MS = 5 * 60 * 1000;
+const PASSWORD_CHANGE_CODE_TTL_S = 15 * 60;
+const PASSWORD_CHANGE_CODE_RESEND_COOLDOWN_S = 60;
+// Seeded by migration 0.0.0 (app_permissions.sql) on self-hosted installs.
+const DEFAULT_USER_EMAIL = 'test@mail.dest';
 
 export default class AuthController {
     private readonly jwtAlg: Algorithm = process.env.JWT_ALG as Algorithm;
@@ -30,12 +40,14 @@ export default class AuthController {
 
     private readonly refreshTokenCookieName: string = 'taskview-refresh';
     private readonly orgRepository: OrganizationRepository = new OrganizationRepository();
+    private readonly goalsRepository: GoalsRepository = new GoalsRepository();
 
     private async createPersonalWorkspace(userId: number, email: string, login: string) {
         const slug = `org-${crypto.randomUUID().slice(0, 8)}`
         const org = await this.orgRepository.create({ name: `${login}'s workspace`, slug }, userId, true)
         if (org) {
             await this.orgRepository.addMember(org.id, email, 'owner')
+            await this.goalsRepository.createInboxGoal({ ownerId: userId, organizationId: org.id })
         }
     }
 
@@ -310,7 +322,7 @@ export default class AuthController {
     loginByCode = async (req: Request, res: Response) => {
         const schema = z.object({
             email: z.string().trim().email().toLowerCase(),
-            code: z.string().trim().regex(/^\d{6}$/, '6-digit code'),
+            code: z.string().trim().min(6).max(64),
         });
 
         const data = schema.safeParse(req.body);
@@ -653,6 +665,187 @@ export default class AuthController {
         return res.json(newTokens);
     };
 
+    getLoginOptions = async (_req: Request, res: Response) => {
+        return res.status(200).send({
+            magicLink: LoginMethods.isEnabled('magic-link'),
+            password: LoginMethods.isEnabled('password'),
+            sso: LoginMethods.isEnabled('sso'),
+            socialProviders: LoginMethods.availableSocialProviders(),
+        });
+    };
+
+    private passwordChangeConfirmationMode(): PasswordChangeConfirmationMode {
+        return process.env.PASSWORD_CHANGE_CONFIRMATION === 'password' ? 'password' : 'email';
+    }
+
+    getPasswordChangeMode = async (_req: Request, res: Response) => {
+        return res.status(200).send({ mode: this.passwordChangeConfirmationMode() });
+    };
+
+    sendPasswordChangeCode = async (req: Request, res: Response) => {
+        if (this.passwordChangeConfirmationMode() !== 'email') {
+            return res.status(403).send();
+        }
+
+        const userEmail = req.appUser.getUserData()?.email;
+        if (!userEmail) {
+            return res.status(400).end();
+        }
+
+        const userData = await req.appUser.authManager.repository.getUserByLogin(userEmail, true);
+        if (!userData) {
+            return res.status(400).end();
+        }
+
+        const now = Math.floor(Date.now() / 1000);
+        const sinceLastCode = userData.remind_password_time ? now - userData.remind_password_time : null;
+        if (sinceLastCode !== null && sinceLastCode < PASSWORD_CHANGE_CODE_RESEND_COOLDOWN_S) {
+            return res.status(429).send({
+                message: 'Please wait before requesting another code.',
+                retryAfter: PASSWORD_CHANGE_CODE_RESEND_COOLDOWN_S - sinceLastCode,
+            });
+        }
+
+        // High-entropy code: the shared remind_password_code column is also redeemable
+        // via the unauthenticated /password/reset endpoint, so a short numeric code
+        // would be brute-forceable there.
+        const code = generateString(12);
+        const saved = await req.appUser.authManager.repository.setReminderCodeAndTime(userEmail, code, now);
+        if (!saved) {
+            $logger.error(`Can not save password change code for user ${userData.id}`);
+            return res.status(500).end();
+        }
+
+        const text = `Your TaskView password change code is ${code}\n\nUse this code to confirm your new password. The code expires in 15 minutes.\n\nIf you didn't request this change, ignore this email.`;
+
+        Email.send({
+            text,
+            to: userEmail,
+            subject: `Your TaskView password change code: ${code}`,
+            from: process.env.SMTP_FROM_EMAIL as string,
+        })
+            .then((ok) => {
+                if (!ok) $logger.error({ to: userEmail }, 'Failed to send password change code email');
+            })
+            .catch((err) => $logger.error({ err, to: userEmail }, 'Failed to send password change code email'));
+
+        return res.status(200).end();
+    };
+
+    changeOwnPassword = async (req: Request, res: Response) => {
+        const userEmail = req.appUser.getUserData()?.email;
+        if (!userEmail) {
+            return res.status(400).end();
+        }
+
+        const userData = await req.appUser.authManager.repository.getUserByLogin(userEmail, true);
+        if (!userData) {
+            return res.status(400).send();
+        }
+
+        if (this.passwordChangeConfirmationMode() === 'password') {
+            const parsedData = ChangeOwnPasswordByPasswordSchema.safeParse(req.body);
+            if (!parsedData.success) {
+                return res.status(400).send();
+            }
+
+            const validPassword = await this.comparePasswords(parsedData.data.currentPassword, userData.password);
+            if (!validPassword) {
+                return res.status(403).send({ field: 'currentPassword' });
+            }
+
+            return this.applyNewPassword(res, req, userData.id, parsedData.data.password);
+        }
+
+        const parsedData = ChangeOwnPasswordSchema.safeParse(req.body);
+        if (!parsedData.success) {
+            return res.status(400).send();
+        }
+
+        if (!userData.remind_password_code || !userData.remind_password_time) {
+            return res.status(400).send();
+        }
+
+        const now = Math.floor(Date.now() / 1000);
+        if (now > userData.remind_password_time + PASSWORD_CHANGE_CODE_TTL_S) {
+            return res.status(400).send();
+        }
+
+        if (userData.remind_password_code !== parsedData.data.code) {
+            return res.status(400).send();
+        }
+
+        await req.appUser.authManager.repository.setReminderCodeAndTime(userEmail, null, null);
+
+        return this.applyNewPassword(res, req, userData.id, parsedData.data.password);
+    };
+
+    private async applyNewPassword(res: Response, req: Request, userId: number, newPassword: string) {
+        const passwordHash = hashSync(newPassword, 10);
+        const result = await req.appUser.authManager.repository.updateUserPassword(passwordHash, userId);
+        if (!result) {
+            $logger.error(`Can not update password for user ${userId}`);
+            return res.status(500).send();
+        }
+
+        const currentSessionId = req.appUser.getTokenId();
+        await req.appUser.authManager.sessionStorage.deleteAllSessions(userId, currentSessionId);
+
+        return res.status(200).send({ changed: true });
+    }
+
+    changeDefaultUserCredentials = async (req: Request, res: Response) => {
+        const parsedData = ChangeDefaultUserCredentialsSchema.safeParse(req.body);
+        if (!parsedData.success) {
+            return res.status(400).send();
+        }
+
+        const userEmail = req.appUser.getUserData()?.email;
+        if (!userEmail) {
+            return res.status(400).end();
+        }
+
+        const userData = await req.appUser.authManager.repository.getUserByLogin(userEmail, true);
+        if (!userData || userData.email.toLowerCase() !== DEFAULT_USER_EMAIL) {
+            return res.status(403).send();
+        }
+
+        const validPassword = await this.comparePasswords(parsedData.data.currentPassword, userData.password);
+        if (!validPassword) {
+            return res.status(403).send({ field: 'currentPassword' });
+        }
+
+        const { login, email } = parsedData.data;
+
+        if (login !== userData.login && (await req.appUser.authManager.repository.getUserByLogin(login))) {
+            return res.status(409).send({ field: 'login' });
+        }
+        if (email !== userData.email && (await req.appUser.authManager.repository.getUserByLogin(email, true))) {
+            return res.status(409).send({ field: 'email' });
+        }
+
+        const updated = await req.appUser.authManager.repository.updateUserCredentials({
+            userId: userData.id,
+            oldEmail: userData.email,
+            login,
+            email,
+            passwordHash: hashSync(parsedData.data.password, 10),
+        });
+        if (updated === 'conflict') {
+            return res.status(409).send({ field: 'email' });
+        }
+        if (updated !== 'ok') {
+            return res.status(500).send();
+        }
+
+        // JWTs carry login/email and refresh does not re-read them from the DB,
+        // so drop every session and make the user sign in with the new credentials.
+        await req.appUser.authManager.sessionStorage.deleteAllSessions(userData.id);
+        this.clearRefreshToken(res);
+
+        return res.status(200).send({ changed: true });
+    };
+
     sendDeleteAccountCode = async (req: Request, res: Response) => {
         const userId = req.appUser.getUserData()?.id;
         const userEmail = req.appUser.getUserData()?.email;

api/src/tv-modules/auth/AuthModel.ts

@@ -1,6 +1,8 @@
+import { eq } from 'drizzle-orm';
+import { CollaborationUsersSchema, OrganizationMembersSchema, SsoIdentitiesSchema, UsersSchema } from 'taskview-db-schemas';
 import { Database } from '../../modules/db';
 import { $logger } from '../../modules/logget';
-import type { RegisterUserInDb, UserDbRecord } from '../../types/auth.types';
+import type { RegisterUserInDb, UpdateUserCredentialsArgs, UpdateUserCredentialsResult, UserDbRecord } from '../../types/auth.types';
 
 export default class AuthModel {
     private readonly db: Database;
@@ -133,6 +135,38 @@ export default class AuthModel {
         }
     }
 
+    async updateUserCredentials(args: UpdateUserCredentialsArgs): Promise<UpdateUserCredentialsResult> {
+        try {
+            await this.db.dbDrizzle.transaction(async (tx) => {
+                await tx
+                    .update(UsersSchema)
+                    .set({ login: args.login, email: args.email, password: args.passwordHash })
+                    .where(eq(UsersSchema.id, args.userId));
+                await tx
+                    .update(OrganizationMembersSchema)
+                    .set({ email: args.email })
+                    .where(eq(OrganizationMembersSchema.email, args.oldEmail));
+                await tx
+                    .update(CollaborationUsersSchema)
+                    .set({ email: args.email })
+                    .where(eq(CollaborationUsersSchema.email, args.oldEmail));
+                await tx
+                    .update(SsoIdentitiesSchema)
+                    .set({ email: args.email })
+                    .where(eq(SsoIdentitiesSchema.userId, args.userId));
+            });
+            return 'ok';
+        } catch (error) {
+            // unique(organization_id, email): the new email is already an invited member of one of the user's orgs
+            const pgCode = (error as { code?: string })?.code ?? (error as { cause?: { code?: string } })?.cause?.code;
+            if (pgCode === '23505') {
+                return 'conflict';
+            }
+            $logger.error(error, `Can not update credentials for user ${args.userId}`);
+            return 'error';
+        }
+    }
+
     async updateUserPassword(password: string, userId: number): Promise<boolean> {
         try {
             const query = 'UPDATE tv_auth.users SET password = $1 WHERE id = $2';

api/src/tv-modules/auth/AuthRoutes.ts

@@ -2,6 +2,8 @@ import { Router, type NextFunction, type Request, type Response } from 'express'
 import type { Routable } from '../../types/routable.type';
 import AuthController from './AuthController';
 import { IsLoggedIn } from './middlewares/is-logged-in';
+import { RejectApiTokenAuth } from '../api-tokens/middlewares/RejectApiTokenAuth';
+import { RequireLoginMethod, RequireSocialProvider } from './middlewares/require-login-method';
 import passport from './strategies/passport-login';
 import { ExternalProviderScope } from './strategies/external-auth.types';
 export default class AuthRoutes implements Routable {
@@ -19,13 +21,18 @@ export default class AuthRoutes implements Routable {
     }
 
     initRoutes() {
-        this.router.post('/send-login-code', this.authController.sendLoginCode);
-        this.router.post('/login-by-code', this.authController.loginByCode);
-        this.router.post('/login', this.authController.login);
+        this.router.get('/login-options', this.authController.getLoginOptions);
+        this.router.post('/send-login-code', [RequireLoginMethod('magic-link')], this.authController.sendLoginCode);
+        this.router.post('/login-by-code', [RequireLoginMethod('magic-link')], this.authController.loginByCode);
+        this.router.post('/login', [RequireLoginMethod('password')], this.authController.login);
         this.router.post('/registration', this.authController.registration);
         this.router.get('/confirm/email/:code/login/:login', this.authController.confirmEmail);
-        this.router.post('/email/recovery', this.authController.remindPassword);
-        this.router.post('/password/reset', this.authController.changeRemindedPassword);
+        this.router.post('/email/recovery', [RequireLoginMethod('password')], this.authController.remindPassword);
+        this.router.post('/password/reset', [RequireLoginMethod('password')], this.authController.changeRemindedPassword);
+        this.router.get('/password/change/mode', [IsLoggedIn], this.authController.getPasswordChangeMode);
+        this.router.post('/password/change/code', [IsLoggedIn, RejectApiTokenAuth], this.authController.sendPasswordChangeCode);
+        this.router.post('/password/change', [IsLoggedIn, RejectApiTokenAuth], this.authController.changeOwnPassword);
+        this.router.post('/credentials/change', [IsLoggedIn, RejectApiTokenAuth], this.authController.changeDefaultUserCredentials);
         this.router.post('/logout', [IsLoggedIn], this.authController.logout);
         this.router.post('/refresh/token', this.authController.refreshTokens);
         this.router.post('/delete/account/code', [IsLoggedIn], this.authController.sendDeleteAccountCode);
@@ -33,6 +40,7 @@ export default class AuthRoutes implements Routable {
 
         this.router.get(
             '/provider/:providerName',
+            RequireSocialProvider,
             (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
                 scope: ExternalProviderScope[req.params.providerName],
                 session: false,
@@ -43,6 +51,7 @@ export default class AuthRoutes implements Routable {
         );
         this.router.get(
             '/provider/:providerName/callback',
+            RequireSocialProvider,
             (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
                 scope: ExternalProviderScope[req.params.providerName], session: false
             })(req, res, next),
@@ -51,6 +60,7 @@ export default class AuthRoutes implements Routable {
 
         this.router.post(
             '/provider/:providerName/callback',
+            RequireSocialProvider,
             (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
                 scope: ExternalProviderScope[req.params.providerName], session: false
             })(req, res, next),

api/src/tv-modules/auth/LoginMethods.ts

@@ -0,0 +1,66 @@
+import type { LoginMethod } from '../../types/auth.types';
+
+export class LoginMethods {
+    static readonly ALL: LoginMethod[] = ['magic-link', 'password', 'sso', 'social'];
+
+    static enabled(): Set<LoginMethod> {
+        const raw = process.env.AUTH_LOGIN_METHODS;
+        if (!raw || !raw.trim()) {
+            return new Set(LoginMethods.ALL);
+        }
+        return new Set(LoginMethods.parse(raw).valid);
+    }
+
+    static isEnabled(method: LoginMethod): boolean {
+        return LoginMethods.enabled().has(method);
+    }
+
+    static validateOnStartup(): void {
+        const raw = process.env.AUTH_LOGIN_METHODS;
+        if (!raw || !raw.trim()) return;
+
+        const { valid, invalid } = LoginMethods.parse(raw);
+        if (invalid.length > 0) {
+            throw new Error(
+                `AUTH_LOGIN_METHODS contains unknown values: ${invalid.join(', ')}. Allowed: ${LoginMethods.ALL.join(', ')}`
+            );
+        }
+        if (valid.length === 0) {
+            throw new Error('AUTH_LOGIN_METHODS disables every login method — nobody would be able to sign in');
+        }
+    }
+
+    static configuredSocialProviders(): string[] {
+        const providers: string[] = [];
+        if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET && process.env.GOOGLE_CALLBACK_URL) {
+            providers.push('google');
+        }
+        if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET && process.env.GITHUB_CALLBACK_URL) {
+            providers.push('github');
+        }
+        if (
+            process.env.APPLE_CLIENT_ID &&
+            process.env.APPLE_TEAM_ID &&
+            process.env.APPLE_KEY_ID &&
+            process.env.APPLE_CALLBACK_URL &&
+            process.env.APPLE_KEY_LOCATION
+        ) {
+            providers.push('apple');
+        }
+        return providers;
+    }
+
+    static availableSocialProviders(): string[] {
+        return LoginMethods.isEnabled('social') ? LoginMethods.configuredSocialProviders() : [];
+    }
+
+    private static parse(raw: string): { valid: LoginMethod[]; invalid: string[] } {
+        const values = raw
+            .split(',')
+            .map((value) => value.trim().toLowerCase())
+            .filter(Boolean);
+        const valid = values.filter((value): value is LoginMethod => (LoginMethods.ALL as string[]).includes(value));
+        const invalid = values.filter((value) => !(LoginMethods.ALL as string[]).includes(value));
+        return { valid, invalid };
+    }
+}

api/src/tv-modules/auth/middlewares/require-login-method.ts

@@ -0,0 +1,20 @@
+import type { NextFunction, Request, Response } from 'express';
+import type { LoginMethod } from '../../../types/auth.types';
+import { LoginMethods } from '../LoginMethods';
+
+export const RequireLoginMethod = (method: LoginMethod) => {
+    return (_req: Request, res: Response, next: NextFunction) => {
+        if (!LoginMethods.isEnabled(method)) {
+            return res.status(403).send();
+        }
+        return next();
+    };
+};
+
+export const RequireSocialProvider = (req: Request, res: Response, next: NextFunction) => {
+    const providerName = String(req.params.providerName || '').toLowerCase();
+    if (!LoginMethods.availableSocialProviders().includes(providerName)) {
+        return res.status(403).send();
+    }
+    return next();
+};

api/src/tv-modules/auth/strategies/apple.strategy.ts

@@ -16,8 +16,7 @@ export function initAppleStrategy() {
         !process.env.APPLE_KEY_ID ||
         !process.env.APPLE_CALLBACK_URL ||
         !process.env.APPLE_KEY_LOCATION) {
-        $logger.warn("APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_CALLBACK_URL, and APPLE_KEY_LOCATION must be set");
-        console.warn("APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_CALLBACK_URL, and APPLE_KEY_LOCATION must be set");
+        $logger.debug("Apple login is not configured (APPLE_CLIENT_ID / APPLE_TEAM_ID / APPLE_KEY_ID / APPLE_CALLBACK_URL / APPLE_KEY_LOCATION) — skipping");
         return;
     }
 

api/src/tv-modules/auth/strategies/github.strategy.ts

@@ -7,8 +7,7 @@ import type { VerifyCallback } from "passport-google-oauth20";
 
 export function initGithubStrategy() {
     if (!process.env.GITHUB_CLIENT_ID || !process.env.GITHUB_CLIENT_SECRET || !process.env.GITHUB_CALLBACK_URL) {
-        $logger.warn("GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and GITHUB_CALLBACK_URL must be set");
-        console.warn("GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and GITHUB_CALLBACK_URL must be set");
+        $logger.debug("GitHub login is not configured (GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET / GITHUB_CALLBACK_URL) — skipping");
         return;
     }
 

api/src/tv-modules/auth/strategies/google.strategy.ts

@@ -5,8 +5,7 @@ import type { ExternalAuthUser } from "./external-auth.types";
 
 export function initGoogleStrategy() {
     if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET || !process.env.GOOGLE_CALLBACK_URL) {
-        $logger.warn("GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_CALLBACK_URL must be set");
-        console.warn("GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_CALLBACK_URL must be set");
+        $logger.debug("Google login is not configured (GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET / GOOGLE_CALLBACK_URL) — skipping");
         return;
     }
     const options = {

api/src/tv-modules/collaboration/CollaborationRepository.ts

@@ -74,7 +74,7 @@ export class CollaborationRepository {
         }
 
         await this.db
-            .query(`insert into collaboration.users_to_goals (goal_id, user_id) values ($1, $2)`, [goalId, userId])
+            .query(`insert into collaboration.users_to_goals (goal_id, user_id) values ($1, $2) on conflict (user_id, goal_id) do nothing`, [goalId, userId])
             .catch(logError);
 
         return userId ?? false;
@@ -220,7 +220,7 @@ export class CollaborationRepository {
                 await tx.insert(CollaborationUsersToGoalsSchema).values({
                     userId: userId,
                     goalId: args.goalId,
-                });
+                }).onConflictDoNothing();
 
                 return user;
             })

api/src/tv-modules/goals/GoalsManager.ts

@@ -63,8 +63,16 @@ export default class GoalsManager {
         return new GoalItemForClient(goal, (await this.getPermissionsForGoal(goal.id)).getAllPermissions());
     }
 
+    private async isInboxGoal(goalId: number): Promise<boolean> {
+        const goal = await this.goalsRepository.findGoalById(goalId);
+        return !!goal && goal.isInbox;
+    }
+
     /** @deprecated use deleteGoalNew instead */
     async deleteGoal(goalId: number): Promise<boolean> {
+        if (await this.isInboxGoal(goalId)) {
+            return false;
+        }
         return await this.goalsRepository.deleteGoal(goalId);
     }
 
@@ -88,6 +96,9 @@ export default class GoalsManager {
     }
 
     async updateArchive(goalId: number, archive: GoalItemInDb['archive']) {
+        if (archive === 1 && (await this.isInboxGoal(goalId))) {
+            return false;
+        }
         return await this.goalsRepository.updateArchive(goalId, archive);
     }
 
@@ -134,6 +145,12 @@ export default class GoalsManager {
     }
 
     async updateGoalNew(goalData: GoalsArgUpdate): Promise<GoalsItemForClientWithPermissions | false> {
+        // The Inbox must never be archived. Archiving flows through this endpoint
+        // (PATCH /module/goals), not the unrouted updateArchive, so the guard lives here.
+        if (goalData.archive === 1 && (await this.isInboxGoal(goalData.id))) {
+            return false;
+        }
+
         const goal = await this.goalsRepository.updateGoalNew(goalData);
 
         if (!goal) {
@@ -153,6 +170,9 @@ export default class GoalsManager {
     }
 
     async deleteGoalNew(goalData: GoalsArgDelete) {
+        if (await this.isInboxGoal(goalData.goalId)) {
+            return false;
+        }
         return await this.goalsRepository.deleteGoalNew(goalData);
     }
 

api/src/tv-modules/goals/GoalsRepository.ts

@@ -12,7 +12,7 @@ import type { AddGoalToDbArg, GoalItemInDb, GoalItemsInDb, UpdateGoalDbArg } fro
 import { logError } from '../../utils/api';
 import { updateQuery } from '../../utils/db-helper';
 import { callWithCatch } from '../../utils/helpers';
-import type { GoalsArgAdd, GoalsArgDelete, GoalsArgUpdate } from './types';
+import type { GoalsArgAdd, GoalsArgCreateInbox, GoalsArgDelete, GoalsArgUpdate } from './types';
 
 export class GoalsRepository {
     private readonly db: Database;
@@ -157,6 +157,7 @@ export class GoalsRepository {
                     backlogVersion: GoalsSchema.backlogVersion,
                     organizationId: GoalsSchema.organizationId,
                     estimateUnit: GoalsSchema.estimateUnit,
+                    isInbox: GoalsSchema.isInbox,
                 })
                 .from(GoalsSchema)
                 .leftJoin(CollaborationUsersToGoalsSchema, eq(GoalsSchema.id, CollaborationUsersToGoalsSchema.goalId))
@@ -232,9 +233,56 @@ export class GoalsRepository {
         return result[0];
     }
 
-    async updateGoalNew(goalData: GoalsArgUpdate): Promise<GoalsSchemaTypeForSelect | false> {
+    async findInboxGoal(organizationId: number): Promise<GoalsSchemaTypeForSelect | false> {
         const result = await callWithCatch(() =>
-            this.db.dbDrizzle.update(GoalsSchema).set(goalData).where(eq(GoalsSchema.id, goalData.id)).returning()
+            this.db.dbDrizzle
+                .select()
+                .from(GoalsSchema)
+                .where(and(eq(GoalsSchema.organizationId, organizationId), eq(GoalsSchema.isInbox, true)))
+        );
+        if (!result || result.length === 0) return false;
+        return result[0];
+    }
+
+    async createInboxGoal(args: GoalsArgCreateInbox): Promise<GoalsSchemaTypeForSelect | false> {
+        const existing = await this.findInboxGoal(args.organizationId);
+        if (existing) {
+            return existing;
+        }
+
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle
+                .insert(GoalsSchema)
+                .values({
+                    name: 'Inbox',
+                    owner: args.ownerId,
+                    organizationId: args.organizationId,
+                    isInbox: true,
+                })
+                .returning()
+        );
+
+        if (!result) {
+            return false;
+        }
+
+        return result[0];
+    }
+
+    async updateGoalNew(goalData: GoalsArgUpdate): Promise<GoalsSchemaTypeForSelect | false> {
+        const updates: Partial<typeof GoalsSchema.$inferInsert> = {};
+        if (goalData.name !== undefined) updates.name = goalData.name;
+        if (goalData.description !== undefined) updates.description = goalData.description;
+        if (goalData.color !== undefined) updates.color = goalData.color;
+        if (goalData.estimateUnit !== undefined) updates.estimateUnit = goalData.estimateUnit;
+        if (goalData.archive !== undefined) updates.archive = goalData.archive;
+
+        if (Object.keys(updates).length === 0) {
+            return this.findGoalById(goalData.id);
+        }
+
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(GoalsSchema).set(updates).where(eq(GoalsSchema.id, goalData.id)).returning()
         );
         if (!result) {
             return false;

api/src/tv-modules/goals/types.ts

@@ -17,6 +17,7 @@ export const GoalsArkTypeUpdate = type({
     'description?': 'string | null',
     'color?': 'string | null',
     "estimateUnit?": "'hours' | 'points'",
+    'archive?': '0 | 1',
 });
 
 export type GoalsArgUpdate = typeof GoalsArkTypeUpdate.infer;
@@ -34,3 +35,8 @@ export const GoalsArkTypeFetch = type({
 export type GoalsArgFetch = typeof GoalsArkTypeFetch.infer;
 
 export type GoalsItemForClientWithPermissions = GoalsSchemaTypeForSelect & { permissions: GoalPermissionsForClient };
+
+export type GoalsArgCreateInbox = {
+    ownerId: number;
+    organizationId: number;
+};

api/src/tv-modules/messaging/MessagingController.ts

@@ -0,0 +1,241 @@
+import type { Request, Response } from 'express';
+import { ArkErrors } from 'arktype';
+import AuthController from '../auth/AuthController';
+import { AppUser } from '../../core/AppUser';
+import { GoalPermissions } from '../../types/auth.types';
+import { $logger } from '../../modules/logget';
+import { MessagingManager } from './MessagingManager';
+import { SlackInboundManager } from './SlackInboundManager';
+import { SLACK_OAUTH_NONCE_COOKIE } from './config';
+import {
+    MessagingArkTypeConnectLink,
+    MessagingArkTypeById,
+    MessagingArkTypeToggle,
+    MessagingArkTypeUpdateEvents,
+    MessagingArkTypeProviderParam,
+    MessagingArkTypeProjectToggle,
+    MessagingArkTypeProjectDelete,
+    MessagingArkTypeProjectPostContent,
+} from './types';
+import { getAuthorizedGoalId } from './middlewares/ProjectMessagingPermission';
+
+export class MessagingController {
+    private readonly manager = new MessagingManager();
+    private readonly slackInbound = new SlackInboundManager();
+
+    // Slash command (/task). Signature already verified by VerifySlackRequest.
+    slackCommands = async (req: Request, res: Response) => {
+        try {
+            const reply = await this.slackInbound.handleSlashCommand(req.body ?? {});
+            return res.json(reply);
+        } catch (err) {
+            $logger.error(err, '[Messaging/Slack] slash command failed');
+            return res.json({ response_type: 'ephemeral', text: 'Something went wrong handling that command.' });
+        }
+    };
+
+    // Button clicks and modal submissions. Payload is a JSON string in the `payload` field.
+    slackInteractivity = async (req: Request, res: Response) => {
+        try {
+            const raw = (req.body as { payload?: unknown })?.payload;
+            const interaction = typeof raw === 'string' ? JSON.parse(raw) : raw;
+            const result = await this.slackInbound.handleInteraction(interaction ?? {});
+            return res.json(result ?? {});
+        } catch (err) {
+            $logger.error(err, '[Messaging/Slack] interactivity failed');
+            return res.status(200).end();
+        }
+    };
+
+    fetch = async (req: Request, res: Response) => {
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.fetchPersonalConnections(userId);
+        return res.tvJson(result);
+    };
+
+    connectLink = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeConnectLink({ ...req.params, ...req.query });
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.createPersonalConnectLink(userId, data.provider);
+        if (!result) return res.status(503).end();
+        return res.tvJson(result);
+    };
+
+    toggle = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeToggle(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.togglePersonal(data.id, userId, data.isActive);
+        if (!result) return res.status(404).end();
+        return res.tvJson(result);
+    };
+
+    delete = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeById(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.deletePersonal(data.id, userId);
+        return res.tvJson(result);
+    };
+
+    updateEvents = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeUpdateEvents(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.updatePersonalEvents(data.id, userId, data.events);
+        if (!result) return res.status(404).end();
+        return res.tvJson(result);
+    };
+
+    fetchProject = async (_req: Request, res: Response) => {
+        const result = await this.manager.fetchProjectConnections(getAuthorizedGoalId(res));
+        return res.tvJson(result);
+    };
+
+    projectConnectLink = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeProviderParam(req.params);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+
+        const userId = req.appUser.getUserData()?.id;
+        if (!userId) return res.status(401).end();
+
+        const result = await this.manager.createProjectConnectLink(getAuthorizedGoalId(res), userId, data.provider);
+        if (!result) return res.status(503).end();
+        return res.tvJson(result);
+    };
+
+    toggleProject = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeProjectToggle(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+        const result = await this.manager.toggleProject(data.id, getAuthorizedGoalId(res), data.isActive);
+        if (!result) return res.status(404).end();
+        return res.tvJson(result);
+    };
+
+    deleteProject = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeProjectDelete(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+        const result = await this.manager.deleteProject(data.id, getAuthorizedGoalId(res));
+        return res.tvJson(result);
+    };
+
+    updateProjectEvents = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeUpdateEvents(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+        const result = await this.manager.updateProjectEvents(data.id, getAuthorizedGoalId(res), data.events);
+        if (!result) return res.status(404).end();
+        return res.tvJson(result);
+    };
+
+    updateProjectPostContent = async (req: Request, res: Response) => {
+        const data = MessagingArkTypeProjectPostContent(req.body);
+        if (data instanceof ArkErrors) {
+            return res.status(400).send(data.summary);
+        }
+        const result = await this.manager.updateProjectPostContent(data.id, getAuthorizedGoalId(res), data.postContent);
+        if (!result) return res.status(404).end();
+        return res.tvJson(result);
+    };
+
+    // Slack uses OAuth (browser redirect), so the user's JWT is passed as ?token and
+    // validated manually — a full-page redirect can't carry the API Authorization header.
+    slackOAuthStart = async (req: Request, res: Response) => {
+        try {
+            const token = req.query.token as string;
+            if (!token) return res.status(401).send('token is required');
+
+            const userPayload = await AuthController.validateTokens(token);
+            const userId = userPayload?.userData?.id;
+            if (!userId) return res.status(401).send('Invalid token');
+
+            if (!this.manager.getProvider('slack')?.isConfigured()) {
+                return res.status(503).send('Slack is not configured on the server (set SLACK_CLIENT_ID, SLACK_CLIENT_SECRET, SLACK_CALLBACK_URL)');
+            }
+
+            const scope: 'user' | 'project' = req.query.scope === 'project' ? 'project' : 'user';
+            let ownerId = userId;
+
+            if (scope === 'project') {
+                const goalId = Number(req.query.goalId);
+                if (!goalId || Number.isNaN(goalId)) return res.status(400).send('goalId is required');
+                const checker = await new AppUser(userPayload).permissionsFetcher.getCheckerForGoal(goalId);
+                if (!checker.hasPermissions(GoalPermissions.INTEGRATIONS_CAN_MANAGE)) return res.status(403).end();
+                ownerId = goalId;
+            }
+
+            const returnPath = this.safeReturnPath(req.query.returnPath);
+            const start = await this.manager.startOAuthConnect('slack', { ownerType: scope, ownerId, userId, returnPath });
+            if (!start) return res.status(503).send('Slack is not configured on the server');
+            // The provider hands back the anti-CSRF nonce cookie to set on this browser.
+            if (start.kind === 'oauth') {
+                res.cookie(start.setCookie.name, start.setCookie.value, {
+                    httpOnly: true,
+                    secure: process.env.NODE_ENV === 'production',
+                    sameSite: 'lax',
+                    maxAge: start.setCookie.maxAgeMs,
+                });
+            }
+            return res.redirect(start.url);
+        } catch (err) {
+            $logger.error(err, '[Messaging/Slack] Failed to start OAuth');
+            return res.status(500).send('Failed to start Slack OAuth');
+        }
+    };
+
+    slackOAuthCallback = async (req: Request, res: Response) => {
+        const code = req.query.code as string;
+        const state = req.query.state as string;
+        const nonce = req.cookies?.[SLACK_OAUTH_NONCE_COOKIE] as string | undefined;
+        res.clearCookie(SLACK_OAUTH_NONCE_COOKIE);
+        if (!code || !state) return res.redirect(`${process.env.APP_URL}?messaging=error`);
+        try {
+            const result = await this.manager.handleInbound('slack', { source: 'oauth-callback', payload: { code, state }, cookie: nonce });
+            return res.redirect(`${process.env.APP_URL}${this.safeReturnPath(result?.redirect)}?messaging=connected`);
+        } catch (err) {
+            $logger.error({ error: err instanceof Error ? err.message : String(err), hasNonce: !!nonce }, '[Messaging/Slack] OAuth callback failed');
+            return res.redirect(`${process.env.APP_URL}?messaging=error`);
+        }
+    };
+
+    private safeReturnPath(value: unknown): string {
+        return typeof value === 'string' && value.startsWith('/') && !value.startsWith('//') && !value.includes('\\')
+            ? value
+            : '';
+    }
+
+    telegramWebhook = async (req: Request, res: Response) => {
+        res.status(200).end();
+        await this.manager.handleInbound('telegram', { source: 'webhook', payload: req.body });
+    };
+}

api/src/tv-modules/messaging/MessagingDispatcher.ts

@@ -0,0 +1,371 @@
+import { eq } from 'drizzle-orm';
+import { SprintsSchema, TasksSchema } from 'taskview-db-schemas';
+import { eventBus, type AppEvents } from '../../core/EventBus';
+import { getJobQueue } from '../../core/JobQueue';
+import { Database } from '../../modules/db';
+import { decrypt } from '../../utils/crypto';
+import { $logger } from '../../modules/logget';
+import { GoalPermissionsRepository } from '../../core/GoalPermissionsRepository';
+import { GoalPermissionsChecker } from '../../core/GoalPermissionsChecker';
+import { GoalPermissions } from '../../types/auth.types';
+import { MessagingRepository } from './MessagingRepository';
+import { MessagingManager } from './MessagingManager';
+import { buildMessagingMessage } from './messages';
+import { buildTaskDeepLink } from './utils';
+import type { Dispatcher } from '../../core/Dispatcher';
+import type { MessagingConnectionsSchemaTypeForSelect } from 'taskview-db-schemas';
+import type { MessagingDeliverJobData, MessagingEvent, MessagingProviderId } from './types';
+import type { MessagingDispatchArgs, MessagingRecipient, MessagingTaskContext } from './types.internal';
+
+const MESSAGING_DELIVER_JOB = 'messaging-deliver';
+const MAX_ATTEMPTS = 3;
+
+export class MessagingDispatcher implements Dispatcher {
+    private readonly repository = new MessagingRepository();
+    private readonly manager = new MessagingManager();
+    private readonly permissionsRepo = new GoalPermissionsRepository();
+
+    register(): void {
+        eventBus.on('task.created', (data) => this.onTaskCreated(data));
+        eventBus.on('task.assigneesChanged', (data) => this.onTaskAssigned(data));
+        eventBus.on('task.updated', (data) => this.onTaskUpdated(data));
+        eventBus.on('task.assignedToSprint', (data) => this.onTaskAddedToSprint(data));
+        eventBus.on('task.deleted', (data) => this.onTaskDeleted(data));
+
+        eventBus.on('sprint.created', (data) => this.onSprintObj('sprint.created', data));
+        eventBus.on('sprint.updated', (data) => this.onSprintObj('sprint.updated', data));
+        eventBus.on('sprint.activated', (data) => this.onSprint('sprint.started', data));
+        eventBus.on('sprint.reviewStarted', (data) => this.onSprint('sprint.reviewStarted', data));
+        eventBus.on('sprint.completed', (data) => this.onSprint('sprint.completed', data));
+        eventBus.on('sprint.paused', (data) => this.onSprint('sprint.paused', data));
+        eventBus.on('sprint.resumed', (data) => this.onSprint('sprint.resumed', data));
+        eventBus.on('sprint.deleted', (data) => this.onSprint('sprint.deleted', data));
+
+        eventBus.on('collaboration.userAdded', (data) => this.onMember('member.added', data.goalId, data.email, data.initiatorId));
+        eventBus.on('collaboration.userRemoved', (data) => this.onMemberByCollab('member.removed', data.goalId, data.collaborationUserId, data.initiatorId));
+        eventBus.on('collaboration.rolesChanged', (data) => this.onMemberByCollab('member.rolesChanged', data.goalId, data.collaborationUserId, data.initiatorId));
+
+        eventBus.on('time-entry.started', (data) => this.onTimeEntry('time.started', data.goalId, data.taskId, data.userId));
+        eventBus.on('time-entry.stopped', (data) => this.onTimeEntry('time.stopped', data.goalId, data.taskId, data.userId));
+        eventBus.on('time-entry.created', (data) => this.onTimeEntry('time.logged', data.entry.goalId, data.entry.taskId, data.initiatorId));
+        eventBus.on('time-entry.updated', (data) => this.onTimeEntry('time.updated', data.entry.goalId, data.entry.taskId, data.initiatorId));
+        eventBus.on('time-entry.deleted', (data) => this.onTimeEntry('time.deleted', data.goalId, data.taskId, data.initiatorId));
+
+        eventBus.on('recurrence.created', (data) => this.onRecurrence('recurrence.created', data.rule.goalId, data.initiatorId));
+        eventBus.on('recurrence.updated', (data) => this.onRecurrence('recurrence.updated', data.rule.goalId, data.initiatorId));
+        eventBus.on('recurrence.paused', (data) => this.onRecurrence('recurrence.paused', data.goalId, data.initiatorId));
+        eventBus.on('recurrence.resumed', (data) => this.onRecurrence('recurrence.resumed', data.goalId, data.initiatorId));
+        eventBus.on('recurrence.ended', (data) => this.onRecurrence('recurrence.ended', data.goalId, data.initiatorId));
+        eventBus.on('recurrence.deleted', (data) => this.onRecurrence('recurrence.deleted', data.goalId, data.initiatorId));
+        eventBus.on('recurrence.instanceSkipped', (data) => this.onRecurrence('recurrence.skipped', data.goalId, data.initiatorId));
+    }
+
+    async registerWorkers(): Promise<void> {
+        const boss = getJobQueue();
+        await boss.createQueue(MESSAGING_DELIVER_JOB);
+        await boss.work<MessagingDeliverJobData>(MESSAGING_DELIVER_JOB, async ([job]) => {
+            await this.deliverJob(job.data);
+        });
+    }
+
+    private async onTaskCreated(data: AppEvents['task.created']): Promise<void> {
+        // A brand-new task usually has no assignees yet, so target project members.
+        const recipients = await this.repository.fetchProjectMemberRecipients(data.task.goalId);
+        await this.dispatch({
+            event: 'task.created',
+            goalId: data.task.goalId,
+            personalRecipients: recipients,
+            initiatorId: data.initiatorId,
+            task: this.taskCtx(data.task)
+        });
+    }
+
+    private async onTaskAssigned(data: AppEvents['task.assigneesChanged']): Promise<void> {
+        if (data.userIds.length === 0) return;
+        const task = await this.fetchTask(data.taskId);
+        if (!task) return;
+
+        // Keep only collab ids still assigned AND still project members, then resolve to auth recipients.
+        const currentAssignees = new Set(await this.repository.fetchCurrentAssigneeCollabIds(task.id));
+        const stillAssigned = data.userIds.filter(id => currentAssignees.has(id));
+        const memberCollabIds = await this.repository.filterCollabIdsInGoal(stillAssigned, task.goalId);
+        if (memberCollabIds.length === 0) return;
+        const recipients = await this.repository.resolveCollabIdsToRecipients(memberCollabIds);
+
+        await this.dispatch({
+            event: 'task.assigned',
+            goalId: task.goalId,
+            personalRecipients: recipients,
+            initiatorId: data.initiatorId,
+            task: this.taskCtx(task)
+        });
+    }
+
+    private async onTaskUpdated(data: AppEvents['task.updated']): Promise<void> {
+        const changes = data.changes ?? {};
+        let event: MessagingEvent;
+        let titleOverride: string | undefined;
+        if ('complete' in changes && data.task.complete === true) event = 'task.completed';
+        else if ('complete' in changes && data.task.complete === false) {
+            // Reopen: gated by the same task.completed subscription, but shown as "reopened".
+            event = 'task.completed';
+            titleOverride = '[Task reopened]';
+        } else if ('statusId' in changes) event = 'task.statusChanged';
+        else event = 'task.edited';
+
+        const recipients = await this.taskAssigneeRecipients(data.task.id, data.task.goalId);
+        await this.dispatch({
+            event,
+            goalId: data.task.goalId,
+            personalRecipients: recipients,
+            initiatorId: data.initiatorId,
+            task: this.taskCtx(data.task),
+            titleOverride
+        });
+    }
+
+    private async onTaskAddedToSprint(data: AppEvents['task.assignedToSprint']): Promise<void> {
+        if (!data.sprintId) return;
+        const task = await this.fetchTask(data.taskId);
+        if (!task) return;
+        const recipients = await this.taskAssigneeRecipients(data.taskId, data.goalId);
+        await this.dispatch({
+            event: 'task.addedToSprint',
+            goalId: data.goalId,
+            personalRecipients: recipients,
+            initiatorId: data.initiatorId,
+            task: this.taskCtx(task)
+        });
+    }
+
+    private async onTaskDeleted(data: AppEvents['task.deleted']): Promise<void> {
+        const recipients = await this.repository.fetchProjectMemberRecipients(data.goalId);
+        await this.dispatch({
+            event: 'task.deleted',
+            goalId: data.goalId,
+            personalRecipients: recipients,
+            initiatorId: data.initiatorId,
+            body: `#${data.taskId}`
+        });
+    }
+
+    private async onSprintObj(event: MessagingEvent, data: { sprint: { goalId: number; name: string }; initiatorId: number }): Promise<void> {
+        const recipients = await this.repository.fetchProjectMemberRecipients(data.sprint.goalId);
+        await this.dispatch({
+            event,
+            goalId: data.sprint.goalId,
+            personalRecipients: recipients,
+            initiatorId: data.initiatorId,
+            body: data.sprint.name
+        });
+    }
+
+    private async onSprint(event: MessagingEvent, data: { sprintId: number; goalId: number; initiatorId: number | null }): Promise<void> {
+        const name = await this.fetchSprintName(data.sprintId);
+        const recipients = await this.repository.fetchProjectMemberRecipients(data.goalId);
+        await this.dispatch({
+            event,
+            goalId: data.goalId,
+            personalRecipients: recipients,
+            initiatorId: data.initiatorId,
+            body: name
+        });
+    }
+
+    private async onMember(event: MessagingEvent, goalId: number, body: string, initiatorId: number): Promise<void> {
+        const recipients = await this.repository.fetchProjectMemberRecipients(goalId);
+        await this.dispatch({
+            event,
+            goalId,
+            personalRecipients: recipients,
+            initiatorId,
+            body
+        });
+    }
+
+    private async onMemberByCollab(event: MessagingEvent, goalId: number, collabId: number, initiatorId: number): Promise<void> {
+        const email = await this.repository.fetchCollabEmail(collabId);
+        await this.onMember(event, goalId, email ?? '', initiatorId);
+    }
+
+    private async onTimeEntry(event: MessagingEvent, goalId: number, taskId: number, initiatorId: number | null): Promise<void> {
+        const task = await this.fetchTask(taskId);
+        const recipients = await this.repository.fetchProjectMemberRecipients(goalId);
+        // Time entries reference a task → gate the task description like task events.
+        await this.dispatch({
+            event,
+            goalId,
+            personalRecipients: recipients,
+            initiatorId,
+            task: task ? this.taskCtx(task) : undefined,
+            body: task ? undefined : `#${taskId}`
+        });
+    }
+
+    private async onRecurrence(event: MessagingEvent, goalId: number, initiatorId: number): Promise<void> {
+        // Recurring-rule template content is not shown (avoids leaking gated task content); title only.
+        const recipients = await this.repository.fetchProjectMemberRecipients(goalId);
+        await this.dispatch({ event, goalId, personalRecipients: recipients, initiatorId, body: '' });
+    }
+
+    private async dispatch(args: MessagingDispatchArgs): Promise<void> {
+        // No initiator exclusion: messaging is an explicit opt-in feed — if you
+        // subscribed to an event you receive it, even for your own actions.
+        const url = args.task ? await this.buildTaskUrl(args.goalId, args.task.id, args.task.goalListId) : undefined;
+        const projectName = await this.repository.fetchGoalName(args.goalId);
+        // Assignee emails are RBAC-gated content. Compute once, then include per recipient
+        // only when they may see assignees (TASKS_CAN_WATCH_ASSIGNED_USERS) — same treatment
+        // as the description, which is gated by COMPONENT_CAN_WATCH_CONTENT.
+        const footerText = args.task ? await this.assigneesFooter(args.task.id) : undefined;
+
+        let personalCount = 0;
+        for (const r of args.personalRecipients) {
+            const checker = args.task ? await this.checkerForRecipient(args.goalId, r) : null;
+            const body = this.bodyForRecipient(args, checker);
+            const footer = footerText && checker?.hasPermissions(GoalPermissions.TASKS_CAN_WATCH_ASSIGNED_USERS) ? footerText : undefined;
+            const message = buildMessagingMessage({
+                event: args.event,
+                audience: 'personal',
+                body,
+                url,
+                taskId: args.task?.id,
+                projectName,
+                footer,
+                completed: args.task?.complete,
+                titleOverride: args.titleOverride
+            });
+            const connections = await this.subscribed('user', r.userId, args.event);
+            personalCount += connections.length;
+            await this.enqueueAll(connections, message);
+        }
+
+        // Project channel: a shared channel's membership doesn't map to TaskView content
+        // permission. By default the description AND assignees ARE posted (a channel is a
+        // deliberate broadcast); a connection can opt out via post_content — then task events
+        // get title + link only (no description, no assignee emails). Non-task bodies
+        // (sprint name, …) are not RBAC-gated content.
+        const projectConnections = await this.subscribed('project', args.goalId, args.event);
+        for (const connection of projectConnections) {
+            const projectBody = args.task
+                ? (connection.postContent ? (args.task.description ?? `#${args.task.id}`) : '')
+                : (args.body ?? '');
+            const projectFooter = connection.postContent ? footerText : undefined;
+            // A content-hidden channel gets title + link only — no description, no assignee footer,
+            // and no action buttons (their modals would expose members / task state).
+            const projectMessage = buildMessagingMessage({
+                event: args.event,
+                audience: 'project',
+                body: projectBody,
+                url,
+                taskId: args.task?.id,
+                projectName,
+                footer: projectFooter,
+                completed: args.task?.complete,
+                titleOverride: args.titleOverride,
+                actions: connection.postContent
+            });
+            await this.enqueueAll([connection], projectMessage);
+        }
+
+        $logger.info(
+            { event: args.event, goalId: args.goalId, members: args.personalRecipients.length, personalConns: personalCount, projectConns: projectConnections.length },
+            '[Messaging] dispatch',
+        );
+    }
+
+    private bodyForRecipient(args: MessagingDispatchArgs, checker: GoalPermissionsChecker | null): string {
+        if (!args.task) return args.body ?? '';
+        const canWatch = checker?.hasPermissions(GoalPermissions.COMPONENT_CAN_WATCH_CONTENT) ?? false;
+        return canWatch ? (args.task.description ?? `#${args.task.id}`) : `#${args.task.id}`;
+    }
+
+    /** Per-recipient permission checker for the goal; fail-closed (empty) on lookup error. */
+    private async checkerForRecipient(goalId: number, recipient: MessagingRecipient): Promise<GoalPermissionsChecker> {
+        const permissions = await this.permissionsRepo
+            .fetchPermissionsForGoalByUser({ goalId, userId: recipient.userId, email: recipient.email })
+            .catch((err) => {
+                $logger.error(err, `[Messaging] permission check failed for user=${recipient.userId}`);
+                return [];
+            });
+        return new GoalPermissionsChecker(permissions);
+    }
+
+    private async buildTaskUrl(goalId: number, taskId: number, goalListId: number | null): Promise<string | undefined> {
+        const orgSlug = await this.repository.fetchGoalOrgSlug(goalId);
+        return buildTaskDeepLink(orgSlug, goalId, taskId, goalListId);
+    }
+
+    /** "👤 email1, email2" of the task's current assignees, or undefined if none. */
+    private async assigneesFooter(taskId: number): Promise<string | undefined> {
+        const collabIds = await this.repository.fetchCurrentAssigneeCollabIds(taskId);
+        if (collabIds.length === 0) return undefined;
+        const assignees = await this.repository.resolveCollabIdsToRecipients(collabIds);
+        if (assignees.length === 0) return undefined;
+        return `👤 ${assignees.map((a) => a.email).join(', ')}`;
+    }
+
+    private async subscribed(ownerType: string, ownerId: number, event: MessagingEvent): Promise<MessagingConnectionsSchemaTypeForSelect[]> {
+        const connections = await this.repository.fetchActiveByOwner(ownerType, ownerId);
+        return connections.filter(c => c.events.includes(event));
+    }
+
+    private async taskAssigneeRecipients(taskId: number, goalId: number): Promise<MessagingRecipient[]> {
+        const collabIds = await this.repository.fetchCurrentAssigneeCollabIds(taskId);
+        const memberCollabIds = await this.repository.filterCollabIdsInGoal(collabIds, goalId);
+        return this.repository.resolveCollabIdsToRecipients(memberCollabIds);
+    }
+
+    private taskCtx(task: { id: number; goalListId: number | null; description: string | null; complete: boolean | null }): MessagingTaskContext {
+        return { id: task.id, goalListId: task.goalListId, description: task.description, complete: task.complete === true };
+    }
+
+    private async fetchTask(taskId: number) {
+        const db = Database.getInstance();
+        const rows = await db.dbDrizzle.select().from(TasksSchema).where(eq(TasksSchema.id, taskId)).limit(1);
+        return rows[0] ?? null;
+    }
+
+    private async fetchSprintName(sprintId: number): Promise<string> {
+        const db = Database.getInstance();
+        const rows = await db.dbDrizzle.select({ name: SprintsSchema.name }).from(SprintsSchema).where(eq(SprintsSchema.id, sprintId)).limit(1);
+        return rows[0]?.name ?? `#${sprintId}`;
+    }
+
+    private async enqueueAll(connections: MessagingConnectionsSchemaTypeForSelect[], message: ReturnType<typeof buildMessagingMessage>): Promise<void> {
+        const boss = getJobQueue();
+        for (const connection of connections) {
+            await boss.send(MESSAGING_DELIVER_JOB, {
+                connectionId: connection.id,
+                provider: connection.provider as MessagingProviderId,
+                chatId: connection.targetChatId,
+                accessTokenEncrypted: connection.accessTokenEncrypted,
+                message,
+                attempt: 1,
+            } satisfies MessagingDeliverJobData);
+        }
+    }
+
+    private async deliverJob(data: MessagingDeliverJobData): Promise<void> {
+        const provider = this.manager.getProvider(data.provider);
+        if (!provider || !provider.isConfigured()) return;
+
+        const result = await provider.deliver({
+            chatId: data.chatId,
+            accessToken: data.accessTokenEncrypted ? decrypt(data.accessTokenEncrypted) : null,
+            message: data.message,
+        });
+
+        $logger.info({ connectionId: data.connectionId, provider: data.provider, success: result.success, errorCode: result.errorCode }, '[Messaging] deliver result');
+
+        if (result.success) return;
+
+        if (data.attempt < MAX_ATTEMPTS) {
+            const boss = getJobQueue();
+            const delay = Math.pow(2, data.attempt) * 5;
+            await boss.send(MESSAGING_DELIVER_JOB, { ...data, attempt: data.attempt + 1 }, { startAfter: delay });
+            return;
+        }
+
+        $logger.warn(`[Messaging] Delivery failed for connection=${data.connectionId} after ${MAX_ATTEMPTS} attempts`);
+    }
+}

api/src/tv-modules/messaging/MessagingManager.ts

@@ -0,0 +1,199 @@
+import { AppUser } from '../../core/AppUser';
+import { GoalPermissions } from '../../types/auth.types';
+import { $logger } from '../../modules/logget';
+import { MessagingRepository } from './MessagingRepository';
+import { TelegramProvider } from './providers/telegram.provider';
+import { SlackProvider } from './providers/slack.provider';
+import { buildTaskDeepLink } from './utils';
+import type { MessagingProvider } from './providers/MessagingProvider';
+import type { ConnectContext, ConnectStart, InboundIntent, InboundRaw, MessagingConnectionForClient, MessagingConnectLinkResult } from './types.internal';
+import { sanitizeMessagingEvents, type MessagingMessage, type MessagingProviderId } from './types';
+import type { MessagingConnectionsSchemaTypeForSelect } from 'taskview-db-schemas';
+
+export class MessagingManager {
+    public readonly repository = new MessagingRepository();
+    private readonly telegram = new TelegramProvider();
+    private readonly slack = new SlackProvider();
+    private readonly providers: Map<MessagingProviderId, MessagingProvider>;
+
+    constructor() {
+        this.providers = new Map<MessagingProviderId, MessagingProvider>([
+            ['telegram', this.telegram],
+            ['slack', this.slack],
+        ]);
+    }
+
+    getProvider(id: MessagingProviderId): MessagingProvider | undefined {
+        return this.providers.get(id);
+    }
+
+    private async beginConnect(id: MessagingProviderId, ctx: ConnectContext): Promise<ConnectStart | null> {
+        const provider = this.getProvider(id);
+        if (!provider?.isConfigured()) return null;
+        const start = await provider.startConnect(ctx);
+        if (start.kind === 'deep-link') {
+            const row = await this.repository.createLinkToken({
+                token: start.persistToken.token,
+                provider: id,
+                ownerType: ctx.ownerType,
+                ownerId: ctx.ownerId,
+                createdBy: ctx.userId,
+                expiresAt: start.persistToken.expiresAt,
+            });
+            if (!row) return null;
+        }
+        return start;
+    }
+
+    async createPersonalConnectLink(userId: number, provider: MessagingProviderId): Promise<MessagingConnectLinkResult | null> {
+        return this.toLinkResult(provider, await this.beginConnect(provider, { ownerType: 'user', ownerId: userId, userId }));
+    }
+
+    async createProjectConnectLink(goalId: number, userId: number, provider: MessagingProviderId): Promise<MessagingConnectLinkResult | null> {
+        return this.toLinkResult(provider, await this.beginConnect(provider, { ownerType: 'project', ownerId: goalId, userId }));
+    }
+
+    private toLinkResult(provider: MessagingProviderId, start: ConnectStart | null): MessagingConnectLinkResult | null {
+        if (start?.kind !== 'deep-link') return null;
+        return { provider, url: start.url, token: start.persistToken.token, expiresAt: start.persistToken.expiresAt.toISOString() };
+    }
+
+    async startOAuthConnect(provider: MessagingProviderId, ctx: ConnectContext): Promise<ConnectStart | null> {
+        return this.beginConnect(provider, ctx);
+    }
+
+    async handleInbound(id: MessagingProviderId, raw: InboundRaw): Promise<{ redirect?: string } | null> {
+        const provider = this.getProvider(id);
+        if (!provider) return null;
+        const intent = await provider.parseInbound(raw);
+        if (!intent) return null;
+
+        if (intent.kind === 'createConnection') {
+            await this.repository.createConnection(intent.connection);
+            if (intent.identity) await this.repository.upsertIdentity({ userId: intent.identity.userId, provider: id, externalUserId: intent.identity.externalUserId, externalTeamId: intent.identity.externalTeamId });
+            return { redirect: intent.redirect };
+        }
+
+        if (intent.kind === 'command') {
+            const reply = await this.runCreateTask(id, intent);
+            await provider.deliver({ chatId: intent.chatId, accessToken: null, message: reply });
+            return null;
+        }
+
+        await this.bindByToken(id, provider, intent);
+        return null;
+    }
+
+    private async runCreateTask(id: MessagingProviderId, intent: Extract<InboundIntent, { kind: 'command' }>): Promise<MessagingMessage> {
+        const note = (title: string): MessagingMessage => ({ event: 'task.created', title });
+
+        const userId = await this.repository.findUserIdByExternalId({ provider: id, externalUserId: intent.externalUserId, externalTeamId: null });
+        if (!userId) return note('Link your account in TaskView first (Personal → Connect), then try /task again.');
+
+        const goalIds = await this.repository.fetchProjectGoalIdsByChannel({ provider: id, channelId: intent.chatId, externalTeamId: null });
+        if (goalIds.length === 0) return note('This chat is not linked to a TaskView project.');
+        if (goalIds.length > 1) return note('This chat is linked to several projects — create the task in TaskView.');
+
+        const appUser = await this.buildAppUser(userId);
+        if (!appUser) return note('Could not resolve your TaskView account.');
+
+        const checker = await appUser.permissionsFetcher.getCheckerForGoal(goalIds[0]);
+        if (!checker.hasPermissions(GoalPermissions.COMPONENT_CAN_ADD_TASKS)) {
+            return note('You do not have permission to create tasks in this project.');
+        }
+
+        const created = await appUser.tasksManager.addTaskNew({ goalId: goalIds[0], description: intent.text });
+        const task = created?.[0];
+        if (!task) return note('Failed to create the task.');
+
+        const orgSlug = await this.repository.fetchGoalOrgSlug(goalIds[0]);
+        const url = buildTaskDeepLink(orgSlug, goalIds[0], task.id, task.goalListId ?? null);
+        return { event: 'task.created', title: '✅ Task created', body: intent.text, url };
+    }
+
+    private async buildAppUser(userId: number): Promise<AppUser | null> {
+        const record = await new AppUser().authManager.repository.fetchUserById(userId);
+        if (!record || record.block !== 0) return null;
+        return new AppUser({ id: 0, userData: { id: record.id, login: record.login, email: record.email } });
+    }
+
+    private async bindByToken(id: MessagingProviderId, provider: MessagingProvider, intent: Extract<InboundIntent, { kind: 'bindByToken' }>): Promise<void> {
+        const link = await this.repository.findValidLinkToken(id, intent.token);
+        // Silently drop unknown/expired tokens or a token used in the wrong chat kind — no
+        // reply, so the endpoint can't be used as an outbound-message amplifier.
+        if (!link || link.ownerType !== intent.scope) return;
+
+        const connection = await this.repository.createConnection({
+            provider: id,
+            ownerType: link.ownerType,
+            ownerId: link.ownerId,
+            targetChatId: intent.chatId,
+            title: intent.title,
+            externalTeamId: null,
+            accessTokenEncrypted: null,
+        });
+        if (!connection) {
+            $logger.error(`[Messaging] Failed to create ${id} connection for ${link.ownerType}=${link.ownerId}`);
+            return;
+        }
+
+        // Telegram user IDs are globally unique, so there is no workspace to scope by.
+        if (intent.scope === 'user') await this.repository.upsertIdentity({ userId: link.ownerId, provider: id, externalUserId: intent.externalUserId, externalTeamId: null });
+        await this.repository.consumeLinkToken(link.id);
+
+        const text = intent.scope === 'user'
+            ? 'Done! Your TaskView account is linked — notifications will be delivered here.'
+            : 'Done! This chat is connected to your TaskView project — project events will be posted here.';
+        await provider.deliver({ chatId: intent.chatId, accessToken: null, message: { event: 'task.created', title: text } });
+    }
+
+    async fetchPersonalConnections(userId: number): Promise<MessagingConnectionForClient[]> {
+        const connections = await this.repository.fetchByOwner('user', userId);
+        return connections.map(c => this.toClient(c));
+    }
+
+    async togglePersonal(id: number, userId: number, isActive: boolean): Promise<MessagingConnectionForClient | null> {
+        const updated = await this.repository.setActiveOwned({ id, ownerType: 'user', ownerId: userId, isActive });
+        return updated ? this.toClient(updated) : null;
+    }
+
+    async deletePersonal(id: number, userId: number): Promise<boolean> {
+        return this.repository.deleteOwned({ id, ownerType: 'user', ownerId: userId });
+    }
+
+    async updatePersonalEvents(id: number, userId: number, events: string[]): Promise<MessagingConnectionForClient | null> {
+        const updated = await this.repository.updateEventsOwned({ id, ownerType: 'user', ownerId: userId, events: sanitizeMessagingEvents(events) });
+        return updated ? this.toClient(updated) : null;
+    }
+
+    async fetchProjectConnections(goalId: number): Promise<MessagingConnectionForClient[]> {
+        const connections = await this.repository.fetchByOwner('project', goalId);
+        return connections.map(c => this.toClient(c));
+    }
+
+    async toggleProject(id: number, goalId: number, isActive: boolean): Promise<MessagingConnectionForClient | null> {
+        // goalId was verified against the caller by IsGoalOwnerByGoalId; the WHERE
+        // clause also binds the connection to that goal, so no cross-project mutation.
+        const updated = await this.repository.setActiveOwned({ id, ownerType: 'project', ownerId: goalId, isActive });
+        return updated ? this.toClient(updated) : null;
+    }
+
+    async deleteProject(id: number, goalId: number): Promise<boolean> {
+        return this.repository.deleteOwned({ id, ownerType: 'project', ownerId: goalId });
+    }
+
+    async updateProjectEvents(id: number, goalId: number, events: string[]): Promise<MessagingConnectionForClient | null> {
+        const updated = await this.repository.updateEventsOwned({ id, ownerType: 'project', ownerId: goalId, events: sanitizeMessagingEvents(events) });
+        return updated ? this.toClient(updated) : null;
+    }
+
+    async updateProjectPostContent(id: number, goalId: number, postContent: boolean): Promise<MessagingConnectionForClient | null> {
+        const updated = await this.repository.setPostContentOwned({ id, ownerType: 'project', ownerId: goalId, postContent });
+        return updated ? this.toClient(updated) : null;
+    }
+
+    private toClient(connection: MessagingConnectionsSchemaTypeForSelect): MessagingConnectionForClient {
+        const { accessTokenEncrypted, ...rest } = connection;
+        return rest;
+    }
+}

api/src/tv-modules/messaging/MessagingRepository.ts

@@ -0,0 +1,311 @@
+import { createHash } from 'crypto';
+import { and, eq, gt, inArray, isNull } from 'drizzle-orm';
+import { alias } from 'drizzle-orm/pg-core';
+import {
+    CollaborationUsersSchema,
+    CollaborationUsersToGoalsSchema,
+    GoalsSchema,
+    MessagingConnectionsSchema,
+    MessagingIdentityMapSchema,
+    MessagingLinkTokensSchema,
+    OrganizationsSchema,
+    TasksAssigneeSchema,
+    UsersSchema,
+    type MessagingConnectionsSchemaTypeForSelect,
+    type MessagingLinkTokensSchemaTypeForSelect,
+} from 'taskview-db-schemas';
+import { Database } from '../../modules/db';
+import { callWithCatch } from '../../utils/helpers';
+import { SLACK_WEBHOOK_PREFIX } from './config';
+import type {
+    MessagingChannelLookup,
+    MessagingConnectionCreate,
+    MessagingIdentityLookup,
+    MessagingIdentityUpsert,
+    MessagingLinkTokenCreate,
+    MessagingOwnedRef,
+    MessagingOwnedToggle,
+    MessagingRecipient,
+} from './types.internal';
+
+export class MessagingRepository {
+    private readonly db: Database;
+
+    constructor() {
+        this.db = Database.getInstance();
+    }
+
+    async createConnection(data: MessagingConnectionCreate): Promise<MessagingConnectionsSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.insert(MessagingConnectionsSchema)
+                .values(data)
+                .onConflictDoUpdate({
+                    target: [
+                        MessagingConnectionsSchema.provider,
+                        MessagingConnectionsSchema.ownerType,
+                        MessagingConnectionsSchema.ownerId,
+                        MessagingConnectionsSchema.targetChatId,
+                    ],
+                    set: {
+                        title: data.title,
+                        externalTeamId: data.externalTeamId,
+                        accessTokenEncrypted: data.accessTokenEncrypted,
+                        isActive: true,
+                        updatedAt: new Date(),
+                    },
+                })
+                .returning()
+        );
+        return result?.[0] ?? null;
+    }
+
+    async fetchById(id: number): Promise<MessagingConnectionsSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(MessagingConnectionsSchema).where(eq(MessagingConnectionsSchema.id, id))
+        );
+        return result?.[0] ?? null;
+    }
+
+    async fetchByOwner(ownerType: string, ownerId: number): Promise<MessagingConnectionsSchemaTypeForSelect[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(MessagingConnectionsSchema).where(
+                and(
+                    eq(MessagingConnectionsSchema.ownerType, ownerType),
+                    eq(MessagingConnectionsSchema.ownerId, ownerId),
+                )
+            )
+        );
+        return result ?? [];
+    }
+
+    async fetchActiveByOwner(ownerType: string, ownerId: number): Promise<MessagingConnectionsSchemaTypeForSelect[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(MessagingConnectionsSchema).where(
+                and(
+                    eq(MessagingConnectionsSchema.ownerType, ownerType),
+                    eq(MessagingConnectionsSchema.ownerId, ownerId),
+                    eq(MessagingConnectionsSchema.isActive, true),
+                )
+            )
+        );
+        return result ?? [];
+    }
+
+    async setActiveOwned(args: MessagingOwnedToggle): Promise<MessagingConnectionsSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(MessagingConnectionsSchema)
+                .set({ isActive: args.isActive, updatedAt: new Date() })
+                .where(this.ownedWhere(args))
+                .returning()
+        );
+        return result?.[0] ?? null;
+    }
+
+    async deleteOwned(args: MessagingOwnedRef): Promise<boolean> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.delete(MessagingConnectionsSchema).where(this.ownedWhere(args))
+        );
+        return !!result?.rowCount;
+    }
+
+    private ownedWhere(args: MessagingOwnedRef) {
+        return and(
+            eq(MessagingConnectionsSchema.id, args.id),
+            eq(MessagingConnectionsSchema.ownerType, args.ownerType),
+            eq(MessagingConnectionsSchema.ownerId, args.ownerId),
+        );
+    }
+
+    async resolveCollabIdsToRecipients(collabIds: number[]): Promise<MessagingRecipient[]> {
+        if (collabIds.length === 0) return [];
+        const authUsers = alias(UsersSchema, 'auth_users');
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ userId: authUsers.id, email: authUsers.email })
+                .from(CollaborationUsersSchema)
+                .innerJoin(authUsers, eq(CollaborationUsersSchema.email, authUsers.email))
+                .where(inArray(CollaborationUsersSchema.id, collabIds))
+        );
+        return rows ?? [];
+    }
+
+    async updateEventsOwned(args: MessagingOwnedRef & { events: string[] }): Promise<MessagingConnectionsSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(MessagingConnectionsSchema)
+                .set({ events: args.events, updatedAt: new Date() })
+                .where(this.ownedWhere(args))
+                .returning()
+        );
+        return result?.[0] ?? null;
+    }
+
+    async setPostContentOwned(args: MessagingOwnedRef & { postContent: boolean }): Promise<MessagingConnectionsSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.update(MessagingConnectionsSchema)
+                .set({ postContent: args.postContent, updatedAt: new Date() })
+                .where(this.ownedWhere(args))
+                .returning()
+        );
+        return result?.[0] ?? null;
+    }
+
+    async fetchCollabEmail(collabId: number): Promise<string | null> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ email: CollaborationUsersSchema.email })
+                .from(CollaborationUsersSchema)
+                .where(eq(CollaborationUsersSchema.id, collabId))
+                .limit(1)
+        );
+        return rows?.[0]?.email ?? null;
+    }
+
+    async fetchProjectMemberRecipients(goalId: number): Promise<MessagingRecipient[]> {
+        const authUsers = alias(UsersSchema, 'auth_users');
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ userId: authUsers.id, email: authUsers.email })
+                .from(CollaborationUsersToGoalsSchema)
+                .innerJoin(CollaborationUsersSchema, eq(CollaborationUsersToGoalsSchema.userId, CollaborationUsersSchema.id))
+                .innerJoin(authUsers, eq(CollaborationUsersSchema.email, authUsers.email))
+                .where(eq(CollaborationUsersToGoalsSchema.goalId, goalId))
+        );
+        return rows ?? [];
+    }
+
+    async fetchGoalName(goalId: number): Promise<string | null> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ name: GoalsSchema.name }).from(GoalsSchema).where(eq(GoalsSchema.id, goalId)).limit(1)
+        );
+        return rows?.[0]?.name ?? null;
+    }
+
+    async fetchGoalOrgSlug(goalId: number): Promise<string | null> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ slug: OrganizationsSchema.slug })
+                .from(GoalsSchema)
+                .innerJoin(OrganizationsSchema, eq(GoalsSchema.organizationId, OrganizationsSchema.id))
+                .where(eq(GoalsSchema.id, goalId))
+                .limit(1)
+        );
+        return rows?.[0]?.slug ?? null;
+    }
+
+    async filterCollabIdsInGoal(collabIds: number[], goalId: number): Promise<number[]> {
+        if (collabIds.length === 0) return [];
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ userId: CollaborationUsersToGoalsSchema.userId })
+                .from(CollaborationUsersToGoalsSchema)
+                .where(and(
+                    eq(CollaborationUsersToGoalsSchema.goalId, goalId),
+                    inArray(CollaborationUsersToGoalsSchema.userId, collabIds),
+                ))
+        );
+        return (rows ?? []).map(r => r.userId);
+    }
+
+    async fetchCurrentAssigneeCollabIds(taskId: number): Promise<number[]> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ collabUserId: TasksAssigneeSchema.collabUserId })
+                .from(TasksAssigneeSchema)
+                .where(eq(TasksAssigneeSchema.taskId, taskId))
+        );
+        return (rows ?? []).map(r => r.collabUserId);
+    }
+
+    async createLinkToken(data: MessagingLinkTokenCreate): Promise<MessagingLinkTokensSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.insert(MessagingLinkTokensSchema)
+                .values({ ...data, token: this.hashToken(data.token) })
+                .returning()
+        );
+        return result?.[0] ?? null;
+    }
+
+    async findValidLinkToken(provider: string, token: string): Promise<MessagingLinkTokensSchemaTypeForSelect | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select().from(MessagingLinkTokensSchema).where(
+                and(
+                    eq(MessagingLinkTokensSchema.provider, provider),
+                    eq(MessagingLinkTokensSchema.token, this.hashToken(token)),
+                    gt(MessagingLinkTokensSchema.expiresAt, new Date()),
+                )
+            )
+        );
+        return result?.[0] ?? null;
+    }
+
+    async consumeLinkToken(id: number): Promise<void> {
+        await callWithCatch(() =>
+            this.db.dbDrizzle.delete(MessagingLinkTokensSchema).where(eq(MessagingLinkTokensSchema.id, id))
+        );
+    }
+
+    async findUserIdByExternalId(args: MessagingIdentityLookup): Promise<number | null> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ userId: MessagingIdentityMapSchema.userId })
+                .from(MessagingIdentityMapSchema)
+                .where(and(
+                    eq(MessagingIdentityMapSchema.provider, args.provider),
+                    eq(MessagingIdentityMapSchema.externalUserId, args.externalUserId),
+                    args.externalTeamId === null
+                        ? isNull(MessagingIdentityMapSchema.externalTeamId)
+                        : eq(MessagingIdentityMapSchema.externalTeamId, args.externalTeamId),
+                ))
+                .limit(1)
+        );
+        return rows?.[0]?.userId ?? null;
+    }
+
+    async fetchProjectGoalIdsByChannel(args: MessagingChannelLookup): Promise<number[]> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ goalId: MessagingConnectionsSchema.ownerId })
+                .from(MessagingConnectionsSchema)
+                .where(and(
+                    eq(MessagingConnectionsSchema.provider, args.provider),
+                    eq(MessagingConnectionsSchema.ownerType, 'project'),
+                    eq(MessagingConnectionsSchema.targetChatId, args.channelId),
+                    eq(MessagingConnectionsSchema.isActive, true),
+                    args.externalTeamId === null
+                        ? isNull(MessagingConnectionsSchema.externalTeamId)
+                        : eq(MessagingConnectionsSchema.externalTeamId, args.externalTeamId),
+                ))
+        );
+        return rows?.map((r) => r.goalId) ?? [];
+    }
+
+    async fetchSlackBotTokenEncrypted(teamId: string): Promise<string | null> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ token: MessagingConnectionsSchema.accessTokenEncrypted })
+                .from(MessagingConnectionsSchema)
+                .where(and(
+                    eq(MessagingConnectionsSchema.provider, 'slack'),
+                    eq(MessagingConnectionsSchema.externalTeamId, teamId),
+                    eq(MessagingConnectionsSchema.isActive, true),
+                ))
+        );
+        return rows?.map((r) => r.token).find((t): t is string => !!t && !t.startsWith(SLACK_WEBHOOK_PREFIX)) ?? null;
+    }
+
+    async fetchGoalCollabMembers(goalId: number): Promise<{ collabId: number; email: string }[]> {
+        const rows = await callWithCatch(() =>
+            this.db.dbDrizzle.selectDistinct({ collabId: CollaborationUsersSchema.id, email: CollaborationUsersSchema.email })
+                .from(CollaborationUsersToGoalsSchema)
+                .innerJoin(CollaborationUsersSchema, eq(CollaborationUsersToGoalsSchema.userId, CollaborationUsersSchema.id))
+                .where(eq(CollaborationUsersToGoalsSchema.goalId, goalId))
+        );
+        return rows ?? [];
+    }
+
+    async upsertIdentity(args: MessagingIdentityUpsert): Promise<void> {
+        await callWithCatch(() =>
+            this.db.dbDrizzle.insert(MessagingIdentityMapSchema)
+                .values({ userId: args.userId, provider: args.provider, externalUserId: args.externalUserId, externalTeamId: args.externalTeamId, linkedAt: new Date() })
+                .onConflictDoUpdate({
+                    target: [MessagingIdentityMapSchema.userId, MessagingIdentityMapSchema.provider],
+                    set: { externalUserId: args.externalUserId, externalTeamId: args.externalTeamId, linkedAt: new Date() },
+                })
+        );
+    }
+
+    private hashToken(token: string): string {
+        return createHash('sha256').update(token).digest('hex');
+    }
+}

api/src/tv-modules/messaging/MessagingRoutes.ts

@@ -0,0 +1,51 @@
+import { Router } from 'express'
+import type { Routable } from '../../types/routable.type'
+import { IsLoggedIn } from '../auth/middlewares/is-logged-in'
+import { RejectApiTokenAuth } from '../api-tokens/middlewares/RejectApiTokenAuth'
+import { MessagingController } from './MessagingController'
+import { VerifyTelegramWebhook } from './middlewares/VerifyTelegramWebhook'
+import { VerifySlackRequest } from './middlewares/VerifySlackRequest'
+import { CanManageProjectMessaging, CanViewProjectMessaging } from './middlewares/ProjectMessagingPermission'
+
+export default class MessagingRoutes implements Routable {
+    private readonly router: ReturnType<typeof Router>
+    private readonly controller: MessagingController
+
+    constructor() {
+        this.router = Router()
+        this.controller = new MessagingController()
+        this.initRoutes()
+    }
+
+    getRouter() {
+        return this.router
+    }
+
+    initRoutes() {
+        // Personal (per-user) connections — scoped to the authenticated user.
+        this.router.get('', [IsLoggedIn, RejectApiTokenAuth], this.controller.fetch)
+        this.router.patch('/toggle', [IsLoggedIn, RejectApiTokenAuth], this.controller.toggle)
+        this.router.patch('/events', [IsLoggedIn, RejectApiTokenAuth], this.controller.updateEvents)
+        this.router.delete('', [IsLoggedIn, RejectApiTokenAuth], this.controller.delete)
+        this.router.get('/:provider/connect-link', [IsLoggedIn, RejectApiTokenAuth], this.controller.connectLink)
+
+        // Project connections — guarded by project ownership (goalId in body/query).
+        this.router.get('/project', [IsLoggedIn, RejectApiTokenAuth, CanViewProjectMessaging], this.controller.fetchProject)
+        this.router.patch('/project/toggle', [IsLoggedIn, RejectApiTokenAuth, CanManageProjectMessaging], this.controller.toggleProject)
+        this.router.patch('/project/events', [IsLoggedIn, RejectApiTokenAuth, CanManageProjectMessaging], this.controller.updateProjectEvents)
+        this.router.patch('/project/post-content', [IsLoggedIn, RejectApiTokenAuth, CanManageProjectMessaging], this.controller.updateProjectPostContent)
+        this.router.delete('/project', [IsLoggedIn, RejectApiTokenAuth, CanManageProjectMessaging], this.controller.deleteProject)
+        this.router.get('/project/:provider/connect-link', [IsLoggedIn, RejectApiTokenAuth, CanManageProjectMessaging], this.controller.projectConnectLink)
+
+        // Slack OAuth — public (auth carried by the JWT ?token on start and the signed state on callback).
+        this.router.get('/slack/oauth/start', this.controller.slackOAuthStart)
+        this.router.get('/slack/oauth/callback', this.controller.slackOAuthCallback)
+
+        // Inbound webhook — public, protected by the Telegram secret-token header.
+        this.router.post('/telegram/webhook', [VerifyTelegramWebhook], this.controller.telegramWebhook)
+
+        // Slack inbound (slash commands + interactivity) — public, protected by the Slack signature.
+        this.router.post('/slack/commands', [VerifySlackRequest], this.controller.slackCommands)
+        this.router.post('/slack/interactivity', [VerifySlackRequest], this.controller.slackInteractivity)
+    }
+}

api/src/tv-modules/messaging/SlackInboundManager.ts

@@ -0,0 +1,245 @@
+import { AppUser } from '../../core/AppUser';
+import { GoalPermissions } from '../../types/auth.types';
+import { decrypt } from '../../utils/crypto';
+import { MessagingRepository } from './MessagingRepository';
+import { SlackProvider } from './providers/slack.provider';
+import {
+    SLACK_ACTION_ASSIGN,
+    SLACK_ACTION_DONE,
+    SLACK_ACTION_REOPEN,
+    SLACK_ASSIGN_BLOCK,
+    SLACK_ASSIGN_SELECT_ACTION,
+    SLACK_VIEW_ASSIGN_CALLBACK,
+} from './providers/slack.constants';
+import { buildTaskDeepLink, escapeSlackText } from './utils';
+import type { SlackEphemeralReply, SlackInteractionPayload, SlackSlashCommandPayload } from './types.internal';
+
+// Orchestrates inbound Slack actions: /task (create), and Done / Assign buttons.
+// Every path resolves the Slack user to a TaskView user (identity map) and enforces
+// that user's RBAC before touching anything.
+export class SlackInboundManager {
+    private readonly repository = new MessagingRepository();
+    private readonly slack = new SlackProvider();
+
+    async handleSlashCommand(payload: SlackSlashCommandPayload): Promise<SlackEphemeralReply> {
+        const userId = await this.resolveUser(payload.user_id, payload.team_id);
+        if (!userId) return this.ephemeral(this.linkPrompt());
+
+        const description = (payload.text ?? '').trim();
+        if (!description) return this.ephemeral('Usage: /task <description>');
+
+        const goalIds = await this.repository.fetchProjectGoalIdsByChannel({ provider: 'slack', channelId: payload.channel_id ?? '', externalTeamId: payload.team_id ?? null });
+        if (goalIds.length === 0) return this.ephemeral('This channel is not linked to a TaskView project.');
+        if (goalIds.length > 1) return this.ephemeral('This channel is linked to several projects — create the task in TaskView.');
+
+        const appUser = await this.buildAppUser(userId);
+        if (!appUser) return this.ephemeral('Could not resolve your TaskView account.');
+
+        const checker = await appUser.permissionsFetcher.getCheckerForGoal(goalIds[0]);
+        if (!checker.hasPermissions(GoalPermissions.COMPONENT_CAN_ADD_TASKS)) {
+            return this.ephemeral('You do not have permission to create tasks in this project.');
+        }
+
+        const created = await appUser.tasksManager.addTaskNew({ goalId: goalIds[0], description });
+        if (!created?.[0]) return this.ephemeral('Failed to create the task.');
+        return this.ephemeral(`✅ Task created: ${description}`);
+    }
+
+    async handleInteraction(interaction: SlackInteractionPayload): Promise<object | void> {
+        if (interaction.type === 'view_submission') return this.handleAssignSubmit(interaction);
+        if (interaction.type === 'block_actions') return this.handleBlockAction(interaction);
+    }
+
+    private async handleBlockAction(i: SlackInteractionPayload): Promise<void> {
+        const action = i.actions?.[0];
+        const taskId = Number(action?.value);
+        if (!action?.action_id || !taskId) return;
+
+        const userId = await this.resolveUser(i.user?.id, i.team?.id);
+        if (!userId) return this.ackEphemeral(i.response_url, this.linkPrompt());
+
+        if (action.action_id === SLACK_ACTION_DONE) return this.completeTask(i, userId, taskId);
+        if (action.action_id === SLACK_ACTION_REOPEN) return this.reopenTask(i, userId, taskId);
+        if (action.action_id === SLACK_ACTION_ASSIGN) return this.openAssignModal(i, userId, taskId);
+    }
+
+    private async completeTask(i: SlackInteractionPayload, userId: number, taskId: number): Promise<void> {
+        const appUser = await this.buildAppUser(userId);
+        if (!appUser) return;
+        const task = await appUser.tasksManager.fetchTaskById({ taskId });
+        // Same reply as permission-denied below, so this can't be used to probe which task IDs exist.
+        if (!task) return this.ackEphemeral(i.response_url, "You don't have access to this task.");
+
+        const checker = await appUser.permissionsFetcher.getCheckerForGoal(task.goalId);
+        if (!checker.hasPermissions(GoalPermissions.TASKS_CAN_EDIT_STATUS)) {
+            return this.ackEphemeral(i.response_url, "You don't have access to this task.");
+        }
+
+        await appUser.tasksManager.updateTask({ id: taskId, complete: true });
+        // Show which task (description gated by content permission, like notifications) + a link.
+        const label = checker.hasPermissions(GoalPermissions.COMPONENT_CAN_WATCH_CONTENT) && task.description
+            ? task.description.slice(0, 200)
+            : `#${taskId}`;
+        const orgSlug = await this.repository.fetchGoalOrgSlug(task.goalId);
+        const url = buildTaskDeepLink(orgSlug, task.goalId, taskId, task.goalListId ?? null);
+        const text = url ? `✅ Task completed: <${url}|${escapeSlackText(label)}>` : `✅ Task completed: ${escapeSlackText(label)}`;
+        await this.ackEphemeral(i.response_url, text);
+    }
+
+    private async reopenTask(i: SlackInteractionPayload, userId: number, taskId: number): Promise<void> {
+        const appUser = await this.buildAppUser(userId);
+        if (!appUser) return;
+        const task = await appUser.tasksManager.fetchTaskById({ taskId });
+        // Same reply as permission-denied below, so this can't be used to probe which task IDs exist.
+        if (!task) return this.ackEphemeral(i.response_url, "You don't have access to this task.");
+
+        const checker = await appUser.permissionsFetcher.getCheckerForGoal(task.goalId);
+        if (!checker.hasPermissions(GoalPermissions.TASKS_CAN_EDIT_STATUS)) {
+            return this.ackEphemeral(i.response_url, "You don't have access to this task.");
+        }
+
+        await appUser.tasksManager.updateTask({ id: taskId, complete: false });
+        await this.ackEphemeral(i.response_url, '↩️ Task reopened');
+    }
+
+    private async openAssignModal(i: SlackInteractionPayload, userId: number, taskId: number): Promise<void> {
+        const appUser = await this.buildAppUser(userId);
+        if (!appUser) return;
+        const task = await appUser.tasksManager.fetchTaskById({ taskId });
+        // Same reply as permission-denied below, so this can't be used to probe which task IDs exist.
+        if (!task) return this.ackEphemeral(i.response_url, "You don't have access to this task.");
+
+        const checker = await appUser.permissionsFetcher.getCheckerForGoal(task.goalId);
+        if (!checker.hasPermissions(GoalPermissions.TASKS_CAN_ASSIGN_USERS)) {
+            return this.ackEphemeral(i.response_url, "You don't have access to this task.");
+        }
+
+        const members = await this.repository.fetchGoalCollabMembers(task.goalId);
+        if (members.length === 0) return this.ackEphemeral(i.response_url, 'This project has no members to assign.');
+
+        const botToken = await this.botTokenForTeam(i.team?.id);
+        if (!botToken || !i.trigger_id) return this.ackEphemeral(i.response_url, 'Slack workspace is not fully connected.');
+
+        // Pre-select the current assignees so the modal shows who's assigned and lets the
+        // user add or remove — submit sets the whole list.
+        const currentAssignees = await this.repository.fetchCurrentAssigneeCollabIds(taskId);
+        const metadata = JSON.stringify({ taskId });
+        await this.slack.openModal({ botToken, triggerId: i.trigger_id, view: this.assignView(members, currentAssignees, metadata) });
+    }
+
+    private async handleAssignSubmit(i: SlackInteractionPayload): Promise<object> {
+        if (i.view?.callback_id !== SLACK_VIEW_ASSIGN_CALLBACK) return {};
+        const meta = this.parseMeta(i.view.private_metadata);
+        const taskId = Number(meta.taskId);
+        if (!taskId) return {};
+
+        const selected = i.view.state?.values?.[SLACK_ASSIGN_BLOCK]?.[SLACK_ASSIGN_SELECT_ACTION]?.selected_options ?? [];
+        const selectedCollabIds = selected.map((o) => Number(o.value)).filter((n) => Number.isInteger(n) && n > 0);
+
+        const userId = await this.resolveUser(i.user?.id, i.team?.id);
+        if (!userId) return this.viewError(this.linkPrompt());
+        const appUser = await this.buildAppUser(userId);
+        if (!appUser) return {};
+
+        const task = await appUser.tasksManager.fetchTaskById({ taskId });
+        if (!task) return {};
+        const checker = await appUser.permissionsFetcher.getCheckerForGoal(task.goalId);
+        if (!checker.hasPermissions(GoalPermissions.TASKS_CAN_ASSIGN_USERS)) {
+            return this.viewError('You do not have permission to assign this task.');
+        }
+
+        // toggleTaskUsers is called directly (not via the HTTP CanUpdateTaskAssignee guard),
+        // so re-validate every selected id is a member of this goal — Slack doesn't guarantee
+        // the submitted values are among the options we offered.
+        const valid = await this.repository.filterCollabIdsInGoal(selectedCollabIds, task.goalId);
+        if (valid.length !== selectedCollabIds.length) return this.viewError('One of the selected users is not a member of this project.');
+
+        // SET the assignee list to exactly the selection — this both adds and removes.
+        // An empty selection clears everyone (the input block is optional).
+        await appUser.tasksManager.toggleTaskUsers({ taskId, userIds: selectedCollabIds });
+        return {}; // closes the modal
+    }
+
+    private async resolveUser(slackUserId?: string, teamId?: string): Promise<number | null> {
+        if (!slackUserId) return null;
+        // Scope by workspace: a Slack user id is unique only within its team.
+        return this.repository.findUserIdByExternalId({ provider: 'slack', externalUserId: slackUserId, externalTeamId: teamId ?? null });
+    }
+
+    private async buildAppUser(userId: number): Promise<AppUser | null> {
+        const record = await new AppUser().authManager.repository.fetchUserById(userId);
+        if (!record || record.block !== 0) return null;
+        return new AppUser({ id: 0, userData: { id: record.id, login: record.login, email: record.email } });
+    }
+
+    private async botTokenForTeam(teamId?: string): Promise<string | null> {
+        if (!teamId) return null;
+        const encrypted = await this.repository.fetchSlackBotTokenEncrypted(teamId);
+        if (!encrypted) return null;
+        try {
+            return decrypt(encrypted);
+        } catch {
+            return null;
+        }
+    }
+
+    private assignView(members: { collabId: number; email: string }[], currentAssignees: number[], privateMetadata: string): object {
+        const current = new Set(currentAssignees);
+        const options = members.slice(0, 100).map((m) => ({
+            text: { type: 'plain_text', text: m.email.slice(0, 75) },
+            value: String(m.collabId),
+        }));
+        const initialOptions = options.filter((o) => current.has(Number(o.value)));
+
+        const element: Record<string, unknown> = {
+            type: 'multi_static_select',
+            action_id: SLACK_ASSIGN_SELECT_ACTION,
+            placeholder: { type: 'plain_text', text: 'Select assignees' },
+            options,
+        };
+        // Slack rejects an empty initial_options array — only set it when there are current ones.
+        if (initialOptions.length > 0) element.initial_options = initialOptions;
+
+        return {
+            type: 'modal',
+            callback_id: SLACK_VIEW_ASSIGN_CALLBACK,
+            private_metadata: privateMetadata,
+            title: { type: 'plain_text', text: 'Assignees' },
+            submit: { type: 'plain_text', text: 'Save' },
+            close: { type: 'plain_text', text: 'Cancel' },
+            blocks: [
+                {
+                    type: 'input',
+                    block_id: SLACK_ASSIGN_BLOCK,
+                    optional: true, // allow clearing everyone
+                    label: { type: 'plain_text', text: 'Assignees' },
+                    element,
+                },
+            ],
+        };
+    }
+
+    private parseMeta(raw?: string): { taskId?: number } {
+        try {
+            return raw ? JSON.parse(raw) : {};
+        } catch {
+            return {};
+        }
+    }
+
+    private viewError(message: string): object {
+        return { response_action: 'errors', errors: { [SLACK_ASSIGN_BLOCK]: message } };
+    }
+
+    private async ackEphemeral(responseUrl: string | undefined, text: string): Promise<void> {
+        if (responseUrl) await this.slack.respondEphemeral(responseUrl, text);
+    }
+
+    private ephemeral(text: string): SlackEphemeralReply {
+        return { response_type: 'ephemeral', text };
+    }
+
+    private linkPrompt(): string {
+        return `Link your Slack account in TaskView first: ${process.env.APP_URL ?? ''}`;
+    }
+}

api/src/tv-modules/messaging/config.ts

@@ -0,0 +1,21 @@
+// Configuration constants for the messaging module. Endpoints are env-overridable
+// (a mock server in tests, or an enterprise proxy), defaulting to the public provider
+// URLs. The Slack Web API methods all derive from one base.
+
+const SLACK_API_BASE = process.env.SLACK_API_BASE_URL || 'https://slack.com/api';
+
+export const SLACK_AUTHORIZE_URL = process.env.SLACK_AUTHORIZE_URL || 'https://slack.com/oauth/v2/authorize';
+export const SLACK_WEBHOOK_PREFIX = process.env.SLACK_WEBHOOK_PREFIX || 'https://hooks.slack.com/';
+export const SLACK_TOKEN_URL = `${SLACK_API_BASE}/oauth.v2.access`;
+export const SLACK_POST_MESSAGE_URL = `${SLACK_API_BASE}/chat.postMessage`;
+export const SLACK_UPDATE_MESSAGE_URL = `${SLACK_API_BASE}/chat.update`;
+export const SLACK_VIEWS_OPEN_URL = `${SLACK_API_BASE}/views.open`;
+
+export const SLACK_OAUTH_NONCE_COOKIE = 'msg_slack_oauth_nonce';
+export const OAUTH_STATE_TTL = '10m';
+export const OAUTH_NONCE_MAX_AGE_MS = 10 * 60 * 1000;
+
+export const TELEGRAM_API = 'https://api.telegram.org';
+
+// Lifetime of a deep-link binding token (connect-link flow).
+export const LINK_TTL_MS = 15 * 60 * 1000;

api/src/tv-modules/messaging/messages.ts

@@ -0,0 +1,46 @@
+import type { BuildMessagingMessageArgs, MessagingEvent, MessagingMessage } from './types';
+
+type Audience = 'personal' | 'project';
+
+// Delivered message titles. English on the server, matching NotificationMessages —
+// the backend has no i18n/per-recipient locale, so notification text is English by
+// convention. (The event-selection UI is localized separately via frontend i18n.)
+// Personal wording is second-person where it differs from the project-channel wording.
+const TITLES: Record<MessagingEvent, { personal: string; project: string }> = {
+    'task.created': { personal: '[New task]', project: '[New task]' },
+    'task.assigned': { personal: '[Task assigned to you]', project: '[Task assigned]' },
+    'task.statusChanged': { personal: '[Task status changed]', project: '[Task status changed]' },
+    'task.completed': { personal: '[Task completed]', project: '[Task completed]' },
+    'task.edited': { personal: '[Task edited]', project: '[Task edited]' },
+    'task.addedToSprint': { personal: '[Task added to sprint]', project: '[Task added to sprint]' },
+    'task.deleted': { personal: '[Task deleted]', project: '[Task deleted]' },
+    'sprint.created': { personal: '[Sprint created]', project: '[Sprint created]' },
+    'sprint.updated': { personal: '[Sprint edited]', project: '[Sprint edited]' },
+    'sprint.started': { personal: '[Sprint started]', project: '[Sprint started]' },
+    'sprint.reviewStarted': { personal: '[Sprint review started]', project: '[Sprint review started]' },
+    'sprint.completed': { personal: '[Sprint completed]', project: '[Sprint completed]' },
+    'sprint.paused': { personal: '[Sprint paused]', project: '[Sprint paused]' },
+    'sprint.resumed': { personal: '[Sprint resumed]', project: '[Sprint resumed]' },
+    'sprint.deleted': { personal: '[Sprint deleted]', project: '[Sprint deleted]' },
+    'member.added': { personal: '[Member added]', project: '[Member added]' },
+    'member.removed': { personal: '[Member removed]', project: '[Member removed]' },
+    'member.rolesChanged': { personal: '[Member roles changed]', project: '[Member roles changed]' },
+    'time.started': { personal: '[Timer started]', project: '[Timer started]' },
+    'time.stopped': { personal: '[Timer stopped]', project: '[Timer stopped]' },
+    'time.logged': { personal: '[Time logged]', project: '[Time logged]' },
+    'time.updated': { personal: '[Time entry edited]', project: '[Time entry edited]' },
+    'time.deleted': { personal: '[Time entry deleted]', project: '[Time entry deleted]' },
+    'recurrence.created': { personal: '[Recurrence created]', project: '[Recurrence created]' },
+    'recurrence.updated': { personal: '[Recurrence edited]', project: '[Recurrence edited]' },
+    'recurrence.paused': { personal: '[Recurrence paused]', project: '[Recurrence paused]' },
+    'recurrence.resumed': { personal: '[Recurrence resumed]', project: '[Recurrence resumed]' },
+    'recurrence.ended': { personal: '[Recurrence ended]', project: '[Recurrence ended]' },
+    'recurrence.deleted': { personal: '[Recurrence deleted]', project: '[Recurrence deleted]' },
+    'recurrence.skipped': { personal: '[Occurrence skipped]', project: '[Occurrence skipped]' },
+};
+
+export function buildMessagingMessage(args: BuildMessagingMessageArgs): MessagingMessage {
+    const base = args.titleOverride ?? TITLES[args.event][args.audience];
+    const title = args.projectName ? `${base} [${args.projectName}]` : base;
+    return { event: args.event, title, body: args.body, url: args.url, taskId: args.taskId, footer: args.footer, completed: args.completed, actions: args.actions };
+}

api/src/tv-modules/messaging/middlewares/ProjectMessagingPermission.ts

@@ -0,0 +1,22 @@
+import type { NextFunction, Request, Response } from 'express';
+import { GoalPermissions, type GoalPermissionType } from '../../../types/auth.types';
+
+function requireProjectPermission(permission: GoalPermissionType) {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        const goalId = Number(req.body?.goalId ?? req.query?.goalId);
+        if (!goalId || Number.isNaN(goalId)) return res.status(400).end();
+
+        const checker = await req.appUser.permissionsFetcher.getCheckerForGoal(goalId);
+        if (!checker.hasPermissions(permission)) return res.status(403).end();
+
+        res.locals.messagingGoalId = goalId;
+        return next();
+    };
+}
+
+export const CanManageProjectMessaging = requireProjectPermission(GoalPermissions.INTEGRATIONS_CAN_MANAGE);
+export const CanViewProjectMessaging = requireProjectPermission(GoalPermissions.INTEGRATIONS_CAN_VIEW);
+
+export function getAuthorizedGoalId(res: Response): number {
+    return res.locals.messagingGoalId as number;
+}

api/src/tv-modules/messaging/middlewares/VerifySlackRequest.ts

@@ -0,0 +1,32 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+import type { NextFunction, Request, Response } from 'express';
+import { $logger } from '../../../modules/logget';
+
+const MAX_AGE_SECONDS = 300;
+
+// Verifies inbound Slack requests (slash commands, interactivity) via the app Signing
+// Secret: HMAC-SHA256 over `v0:${timestamp}:${rawBody}`, compared timing-safe against the
+// X-Slack-Signature header, with a 5-minute timestamp window to blunt replay.
+export const VerifySlackRequest = (req: Request, res: Response, next: NextFunction) => {
+    const secret = process.env.SLACK_SIGNING_SECRET;
+    if (!secret) {
+        $logger.error('[Messaging/Slack] SLACK_SIGNING_SECRET is not set — rejecting inbound request');
+        return res.status(503).end();
+    }
+
+    const signature = req.headers['x-slack-signature'] as string | undefined;
+    const timestamp = req.headers['x-slack-request-timestamp'] as string | undefined;
+    const rawBody = (req as unknown as { rawBody?: Buffer }).rawBody;
+    if (!signature || !timestamp || !rawBody) return res.status(401).end();
+
+    const ts = Number(timestamp);
+    if (!Number.isFinite(ts) || Math.abs(Date.now() / 1000 - ts) > MAX_AGE_SECONDS) return res.status(401).end();
+
+    const expected = `v0=${createHmac('sha256', secret).update(`v0:${timestamp}:${rawBody.toString('utf8')}`).digest('hex')}`;
+    const expectedBuf = Buffer.from(expected);
+    const signatureBuf = Buffer.from(signature);
+    if (expectedBuf.length !== signatureBuf.length || !timingSafeEqual(expectedBuf, signatureBuf)) {
+        return res.status(401).end();
+    }
+    return next();
+};

api/src/tv-modules/messaging/middlewares/VerifyTelegramWebhook.ts

@@ -0,0 +1,35 @@
+import { timingSafeEqual } from 'crypto';
+import type { NextFunction, Request, Response } from 'express';
+import { $logger } from '../../../modules/logget';
+
+/**
+ * Telegram sends the value configured via setWebhook's secret_token in this
+ * header on every update. Reject anything that doesn't match so the public
+ * inbound endpoint can't be spoofed.
+ */
+export function VerifyTelegramWebhook(req: Request, res: Response, next: NextFunction) {
+    const expected = process.env.TELEGRAM_WEBHOOK_SECRET;
+    if (!expected) {
+        $logger.warn('[Messaging/Telegram] webhook rejected: TELEGRAM_WEBHOOK_SECRET not set');
+        return res.status(503).end();
+    }
+
+    const provided = req.header('X-Telegram-Bot-Api-Secret-Token') ?? '';
+    if (!safeEqual(provided, expected)) {
+        $logger.warn({ hasHeader: !!req.header('X-Telegram-Bot-Api-Secret-Token') }, '[Messaging/Telegram] webhook rejected: secret mismatch');
+        return res.status(401).end();
+    }
+
+    return next();
+}
+
+function safeEqual(a: string, b: string): boolean {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length) return false;
+    try {
+        return timingSafeEqual(aBuf, bBuf);
+    } catch {
+        return false;
+    }
+}

api/src/tv-modules/messaging/providers/MessagingProvider.ts

@@ -0,0 +1,27 @@
+import type { MessagingDeliverArgs, MessagingDeliverResult, MessagingProviderId } from '../types';
+import type { ConnectContext, ConnectStart, InboundIntent, InboundRaw } from '../types.internal';
+
+/**
+ * Full contract for a messaging provider (Telegram, Slack, …). A provider owns its
+ * protocol end-to-end — building connect URLs, exchanging OAuth codes, parsing inbound
+ * payloads, calling the messenger API. It returns normalized data; the manager does the
+ * business work (persistence, RBAC) and never branches on the concrete provider.
+ */
+export interface MessagingProvider {
+    readonly id: MessagingProviderId;
+
+    /** Whether this instance has the credentials needed to operate (env/admin config). */
+    isConfigured(): boolean;
+
+    /** Send one message to a chat/channel. Never throws — failures come back as a result. */
+    deliver(args: MessagingDeliverArgs): Promise<MessagingDeliverResult>;
+
+    /**
+     * Everything needed to start connecting this owner: an authorize/deep-link URL, plus
+     * optionally a token to persist (deep-link flows) or a cookie to set (OAuth anti-CSRF).
+     */
+    startConnect(ctx: ConnectContext): Promise<ConnectStart>;
+
+    /** Parse a raw inbound payload (webhook / OAuth callback) into a normalized intent, or null. */
+    parseInbound(raw: InboundRaw): Promise<InboundIntent | null>;
+}

api/src/tv-modules/messaging/providers/slack.constants.ts

@@ -0,0 +1,8 @@
+// Slack Block Kit action / callback identifiers, shared between the provider (which
+// renders the buttons/modal) and the inbound handler (which routes interactions by them).
+export const SLACK_ACTION_DONE = 'tv_task_done';
+export const SLACK_ACTION_REOPEN = 'tv_task_reopen';
+export const SLACK_ACTION_ASSIGN = 'tv_task_assign';
+export const SLACK_VIEW_ASSIGN_CALLBACK = 'tv_assign_submit';
+export const SLACK_ASSIGN_BLOCK = 'tv_assign_block';
+export const SLACK_ASSIGN_SELECT_ACTION = 'tv_assign_select';

api/src/tv-modules/messaging/providers/slack.provider.ts

@@ -0,0 +1,290 @@
+import { createHash, randomBytes } from 'crypto';
+import axios from 'axios';
+import jwt from 'jsonwebtoken';
+import { $logger } from '../../../modules/logget';
+import { encrypt } from '../../../utils/crypto';
+import type { MessagingProvider } from './MessagingProvider';
+import type { MessagingDeliverArgs, MessagingDeliverResult, MessagingMessage, MessagingProviderId } from '../types';
+import type { MessagingOwnerType } from '../types';
+import { SLACK_ACTION_ASSIGN, SLACK_ACTION_DONE, SLACK_ACTION_REOPEN } from './slack.constants';
+import type { ConnectContext, ConnectStart, InboundIntent, InboundRaw, MessagingOAuthState, SlackOAuthAccessResponse, SlackOAuthExchange, SlackOpenModalArgs } from '../types.internal';
+import {
+    OAUTH_NONCE_MAX_AGE_MS,
+    OAUTH_STATE_TTL,
+    SLACK_AUTHORIZE_URL,
+    SLACK_OAUTH_NONCE_COOKIE,
+    SLACK_POST_MESSAGE_URL,
+    SLACK_TOKEN_URL,
+    SLACK_VIEWS_OPEN_URL,
+    SLACK_WEBHOOK_PREFIX,
+} from '../config';
+import { escapeSlackText, isSafeUrl } from '../utils';
+
+/**
+ * Slack provider. Bot credentials are instance-level (env), like GitHub/GitLab.
+ * Personal connections DM the installing user (bot token + chat.postMessage);
+ * project connections use an incoming webhook (channel chosen during install).
+ */
+export class SlackProvider implements MessagingProvider {
+    readonly id: MessagingProviderId = 'slack';
+
+    isConfigured(): boolean {
+        return !!process.env.SLACK_CLIENT_ID && !!process.env.SLACK_CLIENT_SECRET && !!process.env.SLACK_CALLBACK_URL;
+    }
+
+    getOAuthUrl(state: string, ownerType: MessagingOwnerType): string {
+        const clientId = process.env.SLACK_CLIENT_ID;
+        const redirectUri = process.env.SLACK_CALLBACK_URL;
+        if (!clientId || !redirectUri) {
+            throw new Error('Slack integration OAuth is not configured');
+        }
+        // Personal → bot posts a DM to the installer. Project → channel is picked at
+        // install via incoming-webhook, and chat:write lets us post + update messages
+        // (chat.update) and open modals for the interactive buttons via the bot token.
+        const scope = ownerType === 'project' ? 'incoming-webhook,chat:write' : 'chat:write';
+        const params = new URLSearchParams({
+            client_id: clientId,
+            scope,
+            redirect_uri: redirectUri,
+            state,
+        });
+        return `${SLACK_AUTHORIZE_URL}?${params.toString()}`;
+    }
+
+    async exchangeCode(code: string): Promise<SlackOAuthExchange> {
+        const redirectUri = process.env.SLACK_CALLBACK_URL;
+        const res = await axios.post<SlackOAuthAccessResponse>(
+            SLACK_TOKEN_URL,
+            new URLSearchParams({
+                client_id: process.env.SLACK_CLIENT_ID ?? '',
+                client_secret: process.env.SLACK_CLIENT_SECRET ?? '',
+                code,
+                redirect_uri: redirectUri ?? '',
+            }),
+            { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } },
+        );
+
+        const data = res.data;
+        if (!data.ok || !data.access_token) {
+            throw new Error(`Slack code exchange failed: ${data.error ?? 'unknown'}`);
+        }
+
+        return {
+            botToken: data.access_token,
+            teamId: data.team?.id ?? null,
+            teamName: data.team?.name ?? null,
+            authedUserId: data.authed_user?.id ?? null,
+            webhookUrl: data.incoming_webhook?.url ?? null,
+            webhookChannel: data.incoming_webhook?.channel ?? null,
+            webhookChannelId: data.incoming_webhook?.channel_id ?? null,
+        };
+    }
+
+    async startConnect(ctx: ConnectContext): Promise<ConnectStart> {
+        // Anti-CSRF: a nonce is set as a cookie on the initiating browser and its hash is
+        // carried inside the signed state, verified on callback.
+        const nonce = randomBytes(32).toString('hex');
+        const state = jwt.sign(
+            {
+                provider: 'slack',
+                ownerType: ctx.ownerType,
+                ownerId: ctx.ownerId,
+                userId: ctx.userId,
+                nonceHash: this.hashNonce(nonce),
+                returnPath: ctx.returnPath ?? '',
+            } as MessagingOAuthState,
+            process.env.JWT_SIGN as string,
+            { expiresIn: OAUTH_STATE_TTL },
+        );
+        return {
+            kind: 'oauth',
+            url: this.getOAuthUrl(state, ctx.ownerType),
+            setCookie: { name: SLACK_OAUTH_NONCE_COOKIE, value: nonce, maxAgeMs: OAUTH_NONCE_MAX_AGE_MS },
+        };
+    }
+
+    async parseInbound(raw: InboundRaw): Promise<InboundIntent | null> {
+        // Slash commands / interactivity are handled by SlackInboundManager (they need
+        // multi-step Slack UI). Here we only complete the OAuth connect round-trip.
+        if (raw.source !== 'oauth-callback') return null;
+        const { code, state } = (raw.payload as { code?: string; state?: string }) ?? {};
+        if (!code || !state) return null;
+
+        const payload = jwt.verify(state, process.env.JWT_SIGN as string) as MessagingOAuthState;
+        if (payload.provider !== 'slack') throw new Error('Provider mismatch in OAuth state');
+
+        // The state's nonce hash must match the cookie set on the initiating browser.
+        // Enforced only in production: local dev often splits the frontend (localhost) from
+        // the public callback (tunnel), where a single browser cookie can't bridge origins.
+        const nonceOk = !!raw.cookie && this.hashNonce(raw.cookie) === payload.nonceHash;
+        if (!nonceOk) {
+            if (process.env.NODE_ENV === 'production') throw new Error('OAuth state/nonce mismatch');
+            $logger.warn('[Messaging/Slack] Skipping OAuth nonce check (non-production; split-origin dev)');
+        }
+
+        const ex = await this.exchangeCode(code);
+
+        if (payload.ownerType === 'project') {
+            if (!ex.webhookChannelId) throw new Error('Slack did not return the chosen channel');
+            // Store the bot token (not the webhook URL): posting via chat.postMessage also
+            // lets us update messages and open modals for the interactive buttons.
+            return {
+                kind: 'createConnection',
+                redirect: payload.returnPath,
+                connection: {
+                    provider: 'slack',
+                    ownerType: 'project',
+                    ownerId: payload.ownerId,
+                    targetChatId: ex.webhookChannelId,
+                    title: ex.webhookChannel,
+                    externalTeamId: ex.teamId,
+                    accessTokenEncrypted: encrypt(ex.botToken),
+                },
+            };
+        }
+
+        if (!ex.authedUserId) throw new Error('Slack did not return the installing user');
+        return {
+            kind: 'createConnection',
+            redirect: payload.returnPath,
+            identity: { userId: payload.userId, externalUserId: ex.authedUserId, externalTeamId: ex.teamId ?? null },
+            connection: {
+                provider: 'slack',
+                ownerType: 'user',
+                ownerId: payload.userId,
+                targetChatId: ex.authedUserId,
+                title: ex.teamName ? `Slack (${ex.teamName})` : 'Slack',
+                externalTeamId: ex.teamId,
+                accessTokenEncrypted: encrypt(ex.botToken),
+            },
+        };
+    }
+
+    private hashNonce(nonce: string): string {
+        return createHash('sha256').update(nonce).digest('hex');
+    }
+
+    async deliver(args: MessagingDeliverArgs): Promise<MessagingDeliverResult> {
+        if (!args.accessToken) return { success: false };
+        const secret = args.accessToken;
+        const text = this.render(args.message);
+        const blocks = this.buildTaskBlocks(args.message);
+
+        try {
+            // Legacy project connections store a webhook URL (no bot token → no interactive
+            // buttons). Newer connections store a bot token and post via chat.postMessage.
+            if (secret.startsWith(SLACK_WEBHOOK_PREFIX)) {
+                const res = await axios.post(secret, { text, blocks }, { timeout: 10000 });
+                return { success: res.status === 200 };
+            }
+
+            const res = await axios.post<{ ok: boolean; error?: string }>(
+                SLACK_POST_MESSAGE_URL,
+                { channel: args.chatId, text, blocks },
+                { headers: { Authorization: `Bearer ${secret}` }, timeout: 10000 },
+            );
+            if (!res.data.ok) {
+                $logger.warn(`[Messaging/Slack] chat.postMessage failed: ${res.data.error ?? 'unknown'} (channel=${args.chatId})`);
+            }
+            return { success: res.data.ok, errorCode: res.data.ok ? undefined : 400 };
+        } catch (err) {
+            // Never log the raw axios error — its config.url (incoming webhook, itself a
+            // secret) / config.headers.Authorization (bot token) would land in disk logs.
+            const status = (err as { response?: { status?: number } })?.response?.status;
+            $logger.error({ status }, `[Messaging/Slack] Delivery failed to ${args.chatId}`);
+            return { success: false };
+        }
+    }
+
+    /** Opens a modal (assignee picker). trigger_id from the interaction expires in ~3s. */
+    async openModal(args: SlackOpenModalArgs): Promise<boolean> {
+        return this.callApi(SLACK_VIEWS_OPEN_URL, args.botToken, { trigger_id: args.triggerId, view: args.view });
+    }
+
+    /** Ephemeral feedback for an interaction — posts to the payload's response_url (no token). */
+    async respondEphemeral(responseUrl: string, text: string): Promise<void> {
+        // response_url is Slack-supplied; pin its host to the configured webhook host so a
+        // trust regression can never turn this into an SSRF to an arbitrary URL.
+        let host: string;
+        try {
+            host = new URL(responseUrl).host;
+        } catch {
+            return;
+        }
+        if (host !== new URL(SLACK_WEBHOOK_PREFIX).host) return;
+        try {
+            // replace_original:false — post a separate ephemeral note, never overwrite the card
+            // the button was on (the response_url default is to replace the original message).
+            await axios.post(responseUrl, { response_type: 'ephemeral', replace_original: false, text }, { timeout: 10000 });
+        } catch {
+            // Best-effort user feedback; nothing to recover if Slack's response_url is unreachable.
+        }
+    }
+
+    private async callApi(url: string, botToken: string, body: Record<string, unknown>): Promise<boolean> {
+        try {
+            const res = await axios.post<{ ok: boolean; error?: string }>(url, body, {
+                headers: { Authorization: `Bearer ${botToken}` },
+                timeout: 10000,
+            });
+            if (!res.data.ok) $logger.warn(`[Messaging/Slack] ${url.split('/').pop()} failed: ${res.data.error ?? 'unknown'}`);
+            return res.data.ok;
+        } catch (err) {
+            const status = (err as { response?: { status?: number } })?.response?.status;
+            $logger.error({ status }, `[Messaging/Slack] API call failed: ${url.split('/').pop()}`);
+            return false;
+        }
+    }
+
+    // Block Kit: a text section plus Done/Assign action buttons for task events. The button
+    // value carries the taskId so the interaction round-trips it back to us.
+    private buildTaskBlocks(message: MessagingMessage): unknown[] {
+        const url = message.url && isSafeUrl(message.url) ? message.url : undefined;
+        const blocks: unknown[] = [];
+
+        // Task name as a large header (Slack's biggest text). Header is plain_text only — no
+        // link/markdown — so the clickable label lives in the section below.
+        if (message.body) {
+            blocks.push({ type: 'header', text: { type: 'plain_text', text: message.body.slice(0, 150), emoji: true } });
+        }
+
+        // Event + project label; the whole line links to the task.
+        const label = escapeSlackText(message.title);
+        blocks.push({ type: 'section', text: { type: 'mrkdwn', text: url ? `*<${url}|${label}>*` : `*${label}*` } });
+        // Assignees line above the buttons so the actions sit at the very bottom.
+        if (message.footer) {
+            blocks.push({ type: 'context', elements: [{ type: 'mrkdwn', text: escapeSlackText(message.footer) }] });
+        }
+        if (message.taskId && message.actions !== false) {
+            // A completed task offers Reopen; an open task offers Done.
+            const primary = message.completed
+                ? { type: 'button', text: { type: 'plain_text', text: '↩️ Reopen' }, action_id: SLACK_ACTION_REOPEN, value: String(message.taskId) }
+                : { type: 'button', text: { type: 'plain_text', text: '✅ Done' }, action_id: SLACK_ACTION_DONE, value: String(message.taskId) };
+            blocks.push({
+                type: 'actions',
+                elements: [
+                    primary,
+                    { type: 'button', text: { type: 'plain_text', text: '👤 Assign' }, action_id: SLACK_ACTION_ASSIGN, value: String(message.taskId) },
+                ],
+            });
+        }
+        return blocks;
+    }
+
+    private render(message: MessagingMessage): string {
+        const url = message.url && isSafeUrl(message.url) ? message.url : undefined;
+        const lines: string[] = [];
+        if (url) {
+            // Slack link syntax <url|text>: hyperlink the description, or the title
+            // when there is no description.
+            lines.push(message.body
+                ? `*${escapeSlackText(message.title)}*\n<${url}|${escapeSlackText(message.body)}>`
+                : `*<${url}|${escapeSlackText(message.title)}>*`);
+        } else {
+            lines.push(`*${escapeSlackText(message.title)}*`);
+            if (message.body) lines.push(escapeSlackText(message.body));
+        }
+        if (message.footer) lines.push(escapeSlackText(message.footer));
+        return lines.join('\n');
+    }
+}

api/src/tv-modules/messaging/providers/telegram.provider.ts

@@ -0,0 +1,105 @@
+import { randomBytes } from 'crypto';
+import { $logger } from '../../../modules/logget';
+import type { MessagingProvider } from './MessagingProvider';
+import type { MessagingDeliverArgs, MessagingDeliverResult, MessagingMessage, MessagingProviderId } from '../types';
+import type { ConnectContext, ConnectStart, InboundIntent, InboundRaw, TelegramInboundMessage } from '../types.internal';
+import { LINK_TTL_MS, TELEGRAM_API } from '../config';
+import { escapeHtml, isSafeUrl } from '../utils';
+
+/**
+ * Telegram bot provider. The bot token is instance-level (env), so the SaaS
+ * ships an official bot and self-hosted installs supply their own via
+ * TELEGRAM_BOT_TOKEN — no code fork, only config.
+ */
+export class TelegramProvider implements MessagingProvider {
+    readonly id: MessagingProviderId = 'telegram';
+
+    isConfigured(): boolean {
+        return !!process.env.TELEGRAM_BOT_TOKEN && !!process.env.TELEGRAM_BOT_USERNAME;
+    }
+
+    async deliver(args: MessagingDeliverArgs): Promise<MessagingDeliverResult> {
+        const token = process.env.TELEGRAM_BOT_TOKEN;
+        if (!token) return { success: false };
+
+        try {
+            const response = await fetch(`${TELEGRAM_API}/bot${token}/sendMessage`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    chat_id: args.chatId,
+                    text: this.render(args.message),
+                    parse_mode: 'HTML',
+                    disable_web_page_preview: true,
+                }),
+                signal: AbortSignal.timeout(10000),
+            });
+            return { success: response.ok, errorCode: response.ok ? undefined : response.status };
+        } catch (err) {
+            // Log only the message — the raw error can carry the request URL, which
+            // embeds the bot token.
+            const message = err instanceof Error ? err.message : 'unknown error';
+            $logger.error({ message }, `[Messaging/Telegram] Delivery failed to chat=${args.chatId}`);
+            return { success: false };
+        }
+    }
+
+    async startConnect(ctx: ConnectContext): Promise<ConnectStart> {
+        const username = process.env.TELEGRAM_BOT_USERNAME;
+        const token = randomBytes(24).toString('hex');
+        const expiresAt = new Date(Date.now() + LINK_TTL_MS);
+        // Personal → deep-link into a private chat (auto-sends /start <token>).
+        // Project → startgroup lets the admin add the bot to a group; the bind completes
+        // when they run /connect <token> there.
+        const url = ctx.ownerType === 'user'
+            ? `https://t.me/${username}?start=${token}`
+            : `https://t.me/${username}?startgroup=${token}`;
+        return { kind: 'deep-link', url, persistToken: { token, expiresAt } };
+    }
+
+    async parseInbound(raw: InboundRaw): Promise<InboundIntent | null> {
+        if (raw.source !== 'webhook') return null;
+        const message = (raw.payload as { message?: TelegramInboundMessage })?.message;
+        if (!message) return null;
+
+        const text = typeof message.text === 'string' ? message.text.trim() : '';
+        const chatId = message.chat?.id;
+        const chatType = message.chat?.type;
+        const fromId = message.from?.id;
+        if (!text || text.length > 4096 || typeof chatId !== 'number' || typeof fromId !== 'number') return null;
+
+        // /task <description> — create a task in this chat's project.
+        const taskMatch = text.match(/^\/task(?:@\w+)?\s+([\s\S]+)$/);
+        if (taskMatch) {
+            return { kind: 'command', command: 'createTask', text: taskMatch[1].trim().slice(0, 2000), chatId: String(chatId), externalUserId: String(fromId) };
+        }
+
+        const match = text.match(/^\/(?:start|connect)(?:@\w+)?\s+(\S+)$/);
+        if (!match) return null;
+
+        if (chatType === 'private') {
+            const title = typeof message.from?.username === 'string' ? `@${message.from.username}` : null;
+            return { kind: 'bindByToken', token: match[1], scope: 'user', chatId: String(chatId), externalUserId: String(fromId), title };
+        }
+        if (chatType === 'group' || chatType === 'supergroup') {
+            const title = typeof message.chat?.title === 'string' ? message.chat.title : null;
+            return { kind: 'bindByToken', token: match[1], scope: 'project', chatId: String(chatId), externalUserId: String(fromId), title };
+        }
+        return null;
+    }
+
+    private render(message: MessagingMessage): string {
+        // Mirror the Slack layout: task name (bold) on top, the "[event] [project]" label as
+        // the link below, assignees last. Telegram has no header size, so name is just bold.
+        const url = message.url && isSafeUrl(message.url) ? message.url : undefined;
+        const lines: string[] = [];
+
+        if (message.body) lines.push(`<b>${escapeHtml(message.body)}</b>`);
+
+        const label = escapeHtml(message.title);
+        lines.push(url ? `<a href="${escapeHtml(url)}">${label}</a>` : label);
+
+        if (message.footer) lines.push(escapeHtml(message.footer));
+        return lines.join('\n');
+    }
+}

api/src/tv-modules/messaging/types.internal.ts

@@ -0,0 +1,209 @@
+import type { MessagingConnectionsSchemaTypeForSelect } from 'taskview-db-schemas';
+import type { MessagingEvent, MessagingOwnerType, MessagingProviderId } from './types';
+
+export type MessagingConnectionForClient = Omit<MessagingConnectionsSchemaTypeForSelect, 'accessTokenEncrypted'>;
+
+export interface MessagingRecipient {
+    userId: number;
+    email: string;
+}
+
+export interface SlackOpenModalArgs {
+    botToken: string;
+    triggerId: string;
+    view: unknown;
+}
+
+export interface SlackOAuthAccessResponse {
+    ok: boolean;
+    error?: string;
+    access_token?: string;
+    team?: { id?: string; name?: string };
+    authed_user?: { id?: string };
+    incoming_webhook?: { url?: string; channel?: string; channel_id?: string };
+}
+
+export interface SlackSlashCommandPayload {
+    user_id?: string;
+    channel_id?: string;
+    team_id?: string;
+    text?: string;
+}
+
+export interface SlackInteractionPayload {
+    type?: string;
+    user?: { id?: string };
+    team?: { id?: string };
+    trigger_id?: string;
+    response_url?: string;
+    channel?: { id?: string };
+    container?: { message_ts?: string };
+    message?: { ts?: string; blocks?: { type?: string; text?: { text?: string } }[] };
+    actions?: { action_id?: string; value?: string }[];
+    view?: {
+        callback_id?: string;
+        private_metadata?: string;
+        state?: { values?: Record<string, Record<string, { selected_options?: { value?: string }[] }>> };
+    };
+}
+
+export interface SlackEphemeralReply {
+    response_type: 'ephemeral';
+    text: string;
+}
+
+export interface TelegramInboundMessage {
+    text?: unknown;
+    chat?: { id?: unknown; type?: unknown; title?: unknown };
+    from?: { id?: unknown; username?: unknown };
+}
+
+export interface MessagingTaskContext {
+    id: number;
+    goalListId: number | null;
+    description: string | null;
+    complete: boolean;
+}
+
+export interface MessagingDispatchArgs {
+    event: MessagingEvent;
+    goalId: number;
+    personalRecipients: MessagingRecipient[];
+    initiatorId: number | null;
+    /** Simple, non-content body (sprint name, member email, …). */
+    body?: string;
+    /** Task context: description is RBAC-gated per recipient (COMPONENT_CAN_WATCH_CONTENT) + a task deep-link. */
+    task?: MessagingTaskContext;
+    /** Overrides the title (e.g. "[Task reopened]" while still gated by the task.completed subscription). */
+    titleOverride?: string;
+}
+
+/** Slack identities are keyed by workspace; Telegram passes externalTeamId = null. */
+export interface MessagingIdentityUpsert {
+    userId: number;
+    provider: string;
+    externalUserId: string;
+    externalTeamId: string | null;
+}
+
+export interface MessagingIdentityLookup {
+    provider: string;
+    externalUserId: string;
+    externalTeamId: string | null;
+}
+
+export interface MessagingChannelLookup {
+    provider: string;
+    channelId: string;
+    externalTeamId: string | null;
+}
+
+export interface MessagingConnectionCreate {
+    provider: MessagingProviderId;
+    ownerType: MessagingOwnerType;
+    ownerId: number;
+    targetChatId: string;
+    title: string | null;
+    externalTeamId: string | null;
+    accessTokenEncrypted: string | null;
+}
+
+export interface MessagingOwnedRef {
+    id: number;
+    ownerType: MessagingOwnerType;
+    ownerId: number;
+}
+
+export interface MessagingOwnedToggle extends MessagingOwnedRef {
+    isActive: boolean;
+}
+
+export interface MessagingLinkTokenCreate {
+    token: string;
+    provider: MessagingProviderId;
+    ownerType: MessagingOwnerType;
+    ownerId: number;
+    createdBy: number;
+    expiresAt: Date;
+}
+
+export interface SlackOAuthExchange {
+    botToken: string;
+    teamId: string | null;
+    teamName: string | null;
+    authedUserId: string | null;
+    webhookUrl: string | null;
+    webhookChannel: string | null;
+    webhookChannelId: string | null;
+}
+
+export interface MessagingOAuthState {
+    provider: MessagingProviderId;
+    ownerType: MessagingOwnerType;
+    ownerId: number;
+    userId: number;
+    /** SHA-256 of a nonce also stored in an httpOnly cookie — binds the flow to the initiating browser (anti-CSRF). */
+    nonceHash: string;
+    /** In-app path the user started from, to return them there after the callback. */
+    returnPath: string;
+}
+
+export interface MessagingConnectLinkResult {
+    provider: MessagingProviderId;
+    url: string;
+    token: string;
+    expiresAt: string;
+}
+
+// ── Provider lifecycle (single MessagingProvider interface) ─────────────────
+// Everything a provider needs to start a connection. The manager stays generic:
+// it never branches on provider — it just persists what the provider returns.
+
+export interface ConnectContext {
+    ownerType: MessagingOwnerType;
+    ownerId: number;
+    userId: number;
+    /** In-app path to return to after an OAuth round-trip (Slack); ignored by others. */
+    returnPath?: string;
+}
+
+// Discriminated so the two flows can't be mixed up: a deep-link provider always mints a
+// token to persist; an OAuth provider always sets an anti-CSRF cookie. Never both.
+export type ConnectStart =
+    | { kind: 'deep-link'; url: string; persistToken: { token: string; expiresAt: Date } }
+    | { kind: 'oauth'; url: string; setCookie: { name: string; value: string; maxAgeMs: number } };
+
+/** Raw inbound, tagged by which endpoint received it so the provider can parse accordingly. */
+export interface InboundRaw {
+    source: 'oauth-callback' | 'webhook';
+    payload: unknown;
+    /** Cookie value echoed back for verification (OAuth nonce). */
+    cookie?: string;
+}
+
+/** Normalized inbound outcome. The provider parses protocol; the manager does DB + RBAC. */
+export type InboundIntent =
+    | {
+        kind: 'createConnection';
+        connection: MessagingConnectionCreate;
+        /** Personal connections also link the messenger account to a TaskView user. */
+        identity?: { userId: number; externalUserId: string; externalTeamId: string | null };
+        /** In-app path to redirect the browser to (OAuth callback). */
+        redirect?: string;
+    }
+    | {
+        kind: 'bindByToken';
+        token: string;
+        scope: MessagingOwnerType;
+        chatId: string;
+        externalUserId: string;
+        title: string | null;
+    }
+    | {
+        /** A command from a chat (e.g. Telegram /task). The manager resolves identity + RBAC. */
+        kind: 'command';
+        command: 'createTask';
+        text: string;
+        chatId: string;
+        externalUserId: string;
+    };

api/src/tv-modules/messaging/types.ts

@@ -0,0 +1,162 @@
+import { type } from 'arktype';
+
+export const MESSAGING_PROVIDERS = ['telegram', 'slack'] as const;
+export type MessagingProviderId = typeof MESSAGING_PROVIDERS[number];
+
+export const MESSAGING_OWNER_TYPES = ['user', 'project', 'organization'] as const;
+export type MessagingOwnerType = typeof MESSAGING_OWNER_TYPES[number];
+
+/**
+ * Provider-agnostic event kinds the module reacts to. They map onto EventBus
+ * events in MessagingDispatcher and onto notification types for preferences.
+ */
+/**
+ * User-selectable events. Task events target the task's assignees; sprint events
+ * target project members. Each connection subscribes to the subset it wants.
+ */
+export const MESSAGING_EVENTS = [
+    // tasks — audience: the task's assignees (task.deleted → project members)
+    'task.created',
+    'task.assigned',
+    'task.statusChanged',
+    'task.completed',
+    'task.edited',
+    'task.addedToSprint',
+    'task.deleted',
+    // sprints — audience: project members
+    'sprint.created',
+    'sprint.updated',
+    'sprint.started',
+    'sprint.reviewStarted',
+    'sprint.completed',
+    'sprint.paused',
+    'sprint.resumed',
+    'sprint.deleted',
+    // members — audience: project members
+    'member.added',
+    'member.removed',
+    'member.rolesChanged',
+    // time tracking — audience: project members
+    'time.started',
+    'time.stopped',
+    'time.logged',
+    'time.updated',
+    'time.deleted',
+    // recurring rules — audience: project members
+    'recurrence.created',
+    'recurrence.updated',
+    'recurrence.paused',
+    'recurrence.resumed',
+    'recurrence.ended',
+    'recurrence.deleted',
+    'recurrence.skipped',
+] as const;
+export type MessagingEvent = typeof MESSAGING_EVENTS[number];
+
+export function sanitizeMessagingEvents(events: string[]): MessagingEvent[] {
+    const allowed = new Set<string>(MESSAGING_EVENTS);
+    return [...new Set(events.filter((e) => allowed.has(e)))] as MessagingEvent[];
+}
+
+/** Normalized message a provider renders into its own format. */
+export interface MessagingMessage {
+    event: MessagingEvent;
+    title: string;
+    body?: string;
+    url?: string;
+    /** Present for task events — lets the Slack provider attach Done/Assign action buttons. */
+    taskId?: number;
+    /** An extra line rendered at the bottom (e.g. assignees) — part of the original message. */
+    footer?: string;
+    /** Task's current completion state — the primary button is Reopen when true, else Done. */
+    completed?: boolean;
+    /** Whether to render interactive action buttons (Slack). Suppressed for content-hidden channels. */
+    actions?: boolean;
+}
+
+export interface BuildMessagingMessageArgs {
+    event: MessagingEvent;
+    audience: 'personal' | 'project';
+    body: string;
+    url?: string;
+    taskId?: number;
+    projectName?: string | null;
+    footer?: string;
+    completed?: boolean;
+    /** Overrides the title (keeps the subscription event but shows different wording, e.g. reopened). */
+    titleOverride?: string;
+    /** Whether to render interactive action buttons. Defaults to shown; false for content-hidden channels. */
+    actions?: boolean;
+}
+
+export interface MessagingDeliverArgs {
+    chatId: string;
+    /** Decrypted per-connection secret (Slack bot token / webhook URL); null for Telegram (instance bot token from env). */
+    accessToken: string | null;
+    message: MessagingMessage;
+}
+
+export interface MessagingDeliverResult {
+    success: boolean;
+    errorCode?: number;
+}
+
+export interface MessagingDeliverJobData {
+    connectionId: number;
+    provider: MessagingProviderId;
+    chatId: string;
+    accessTokenEncrypted: string | null;
+    message: MessagingMessage;
+    attempt: number;
+}
+
+const NumberFromString = type('string|number').pipe((v) => Number(v));
+
+// Derived from MESSAGING_PROVIDERS so adding a provider doesn't silently fail validation.
+const MessagingProviderParam = type.enumerated(...MESSAGING_PROVIDERS);
+
+export const MessagingArkTypeConnectLink = type({
+    provider: MessagingProviderParam,
+});
+export type MessagingArgConnectLink = typeof MessagingArkTypeConnectLink.infer;
+
+export const MessagingArkTypeById = type({
+    id: NumberFromString,
+});
+export type MessagingArgById = typeof MessagingArkTypeById.infer;
+
+export const MessagingArkTypeToggle = type({
+    id: 'number',
+    isActive: 'boolean',
+});
+export type MessagingArgToggle = typeof MessagingArkTypeToggle.infer;
+
+export const MessagingArkTypeUpdateEvents = type({
+    id: 'number',
+    events: 'string[]',
+});
+export type MessagingArgUpdateEvents = typeof MessagingArkTypeUpdateEvents.infer;
+
+// Project routes take goalId from IsProjectGoalOwner (res.locals), not the payload,
+// so these schemas validate only the non-authorization fields.
+export const MessagingArkTypeProviderParam = type({
+    provider: MessagingProviderParam,
+});
+export type MessagingArgProviderParam = typeof MessagingArkTypeProviderParam.infer;
+
+export const MessagingArkTypeProjectToggle = type({
+    id: 'number',
+    isActive: 'boolean',
+});
+export type MessagingArgProjectToggle = typeof MessagingArkTypeProjectToggle.infer;
+
+export const MessagingArkTypeProjectDelete = type({
+    id: 'number',
+});
+export type MessagingArgProjectDelete = typeof MessagingArkTypeProjectDelete.infer;
+
+export const MessagingArkTypeProjectPostContent = type({
+    id: 'number',
+    postContent: 'boolean',
+});
+export type MessagingArgProjectPostContent = typeof MessagingArkTypeProjectPostContent.infer;

api/src/tv-modules/messaging/utils.ts

@@ -0,0 +1,38 @@
+import { ALL_TASKS_LIST_ID } from '../../types/tasks.types';
+
+// Reusable text/URL helpers shared across the messaging module.
+
+// Frontend deep-link to a task: /:orgSlug/:projectId/:listId/:taskId. A task with no
+// list lives in the virtual "All tasks" list (ALL_TASKS_LIST_ID sentinel, shared with web).
+export function buildTaskDeepLink(orgSlug: string | null, goalId: number, taskId: number, goalListId: number | null): string | undefined {
+    const appUrl = process.env.APP_URL;
+    if (!appUrl || !orgSlug) return undefined;
+    const listSegment = goalListId ?? ALL_TASKS_LIST_ID;
+    return `${appUrl}/${orgSlug}/${goalId}/${listSegment}/${taskId}`;
+}
+
+// Only http(s) links are ever rendered — blocks tg://, javascript:, etc.
+export function isSafeUrl(url: string): boolean {
+    try {
+        const scheme = new URL(url).protocol;
+        return scheme === 'http:' || scheme === 'https:';
+    } catch {
+        return false;
+    }
+}
+
+// Escapes HTML text and attribute contexts (the quotes matter inside href="...")
+// so a user-controlled value can't break out of a Telegram HTML message.
+export function escapeHtml(text: string): string {
+    return text
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
+// Slack mrkdwn requires escaping these three in text (incl. link labels).
+export function escapeSlackText(text: string): string {
+    return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}

api/src/tv-modules/sso/SsoController.ts

@@ -6,6 +6,7 @@ import { $logger } from '../../modules/logget'
 import { logError } from '../../utils/api'
 import { generateString, isEmail } from '../../utils/helpers'
 import AuthModel from '../auth/AuthModel'
+import { GoalsRepository } from '../goals/GoalsRepository'
 import { OrganizationRepository } from '../organizations/OrganizationRepository'
 import { createSsoProvider } from './providers/provider-factory'
 import { SsoRepository } from './SsoRepository'
@@ -17,6 +18,7 @@ export class SsoController {
   private readonly ssoRepo = new SsoRepository()
   private readonly authModel = new AuthModel()
   private readonly orgRepo = new OrganizationRepository()
+  private readonly goalsRepo = new GoalsRepository()
 
   initiateLogin = async (req: Request, res: Response) => {
     const configId = Number(req.params.configId)
@@ -75,6 +77,7 @@ export class SsoController {
         const personalOrg = await this.orgRepo.create({ name: `${login}'s workspace`, slug: personalOrgSlug }, id, true)
         if (personalOrg) {
           await this.orgRepo.addMember(personalOrg.id, ssoResult.email, 'owner')
+          await this.goalsRepo.createInboxGoal({ ownerId: id, organizationId: personalOrg.id })
         }
 
         userData = await this.authModel.getUserByLogin(ssoResult.email, isEmail(ssoResult.email))

api/src/tv-modules/sso/SsoRoutes.ts

@@ -3,6 +3,7 @@ import type { Routable } from '../../types/routable.type'
 import { IsLoggedIn } from '../auth/middlewares/is-logged-in'
 import { IsOrgAdmin } from '../organizations/middlewares/IsOrgAdmin'
 import { IsSsoConfigAdmin } from './middlewares/IsSsoConfigAdmin'
+import { RequireLoginMethod } from '../auth/middlewares/require-login-method'
 import { SsoController } from './SsoController'
 
 export default class SsoRoutes implements Routable {
@@ -20,10 +21,10 @@ export default class SsoRoutes implements Routable {
   }
 
   initRoutes() {
-    this.router.get('/providers', this.controller.listPublicProviders)
-    this.router.get('/login/:configId', this.controller.initiateLogin)
-    this.router.get('/callback/:configId', this.controller.handleCallback)
-    this.router.post('/callback/:configId', this.controller.handleCallback)
+    this.router.get('/providers', [RequireLoginMethod('sso')], this.controller.listPublicProviders)
+    this.router.get('/login/:configId', [RequireLoginMethod('sso')], this.controller.initiateLogin)
+    this.router.get('/callback/:configId', [RequireLoginMethod('sso')], this.controller.handleCallback)
+    this.router.post('/callback/:configId', [RequireLoginMethod('sso')], this.controller.handleCallback)
 
     this.router.get('/admin/metadata', [IsLoggedIn, IsOrgAdmin], this.controller.parseMetadata)
     this.router.get('/admin/configs', [IsLoggedIn, IsOrgAdmin], this.controller.listConfigs)

api/src/tv-modules/sso/providers/oidc.provider.ts

@@ -110,10 +110,12 @@ export class OidcProvider implements SsoProvider {
       throw new Error('CSRF state mismatch — possible CSRF attack')
     }
 
-    const currentUrl = new URL(req.originalUrl, `${req.protocol}://${req.get('host')}`)
+    const callbackOrigin = new URL(this.config.oidcCallbackUrl!).origin
+    const currentUrl = new URL(req.originalUrl, callbackOrigin)
     const tokens = await client.authorizationCodeGrant(config, currentUrl, {
       pkceCodeVerifier: codeVerifier,
       expectedState: returnedState,
+      expectedNonce: storedNonce,
     })
 
     const claims = tokens.claims()
@@ -122,10 +124,6 @@ export class OidcProvider implements SsoProvider {
       throw new Error('OIDC token missing email claim')
     }
 
-    if (claims.nonce !== storedNonce) {
-      throw new Error('Nonce mismatch — possible token replay attack')
-    }
-
     return {
       email: (claims.email as string).toLowerCase(),
       externalId: claims.sub,

api/src/tv-modules/start/StartManager.ts

@@ -89,7 +89,7 @@ export class StartManager {
         await this.fetchSharedGoals(organizationId);
         const goalIds = await this.getAllGoalsIds(organizationId);
 
-        const tasks = await this.repository.searchTask(description.trim(), goalIds);
+        const tasks = await this.repository.searchTask({ description, goalsIds: goalIds });
         return tasks;
     }
 }

api/src/tv-modules/start/StartRepository.ts

@@ -1,5 +1,5 @@
-import { and, eq, inArray, isNotNull, or } from 'drizzle-orm';
-import { GoalsSchema, GoalsListSchema } from 'taskview-db-schemas';
+import { and, eq, ilike, inArray, isNotNull, isNull, or } from 'drizzle-orm';
+import { GoalsSchema, GoalsListSchema, TasksSchema } from 'taskview-db-schemas';
 import type { AppUser } from '../../core/AppUser';
 import { Database } from '../../modules/db';
 import { $logger } from '../../modules/logget';
@@ -8,7 +8,7 @@ import { logError } from '../../utils/api';
 import { callWithCatch } from '../../utils/helpers';
 import type { TagToTaskInDb } from '../tags/tags.types';
 import { TaskItemForClient } from '../tasks/TaskItemForClient';
-import type { AssigneesForTaskFromDb, FetchAllListsResult, UsersByProjectsFromDb } from './start.types';
+import type { AssigneesForTaskFromDb, FetchAllListsResult, SearchTaskArgs, SearchTaskResult, UsersByProjectsFromDb } from './start.types';
 
 //TODO: refactor 
 export class StartRepository {
@@ -371,31 +371,38 @@ export class StartRepository {
         return [...taskIdToTaskMap.values()];
     }
 
-    async searchTask(description: string, goalsIds: number[]): Promise<TaskItemForClient[]> {
-        if (goalsIds.length === 0 || !description.trim()) {
+    async searchTask(args: SearchTaskArgs): Promise<SearchTaskResult[]> {
+        const description = args.description.trim();
+        if (args.goalsIds.length === 0 || !description) {
             return [];
         }
-        const placeholders = goalsIds.map((_id, index) => {
-            return `$${index + 1}`;
-        });
 
-        const result = await this.db.query<TaskItemInDb>(
-            `select * from tasks.tasks where goal_id in (${placeholders.join(',')}) and complete = FALSE and parent_id is null and description ILIKE $${goalsIds.length + 1}`,
-            [...goalsIds, `%${description}%`]
+        const idMatch = description.match(/^#(\d+)$/);
+        const searchCondition = idMatch
+            ? eq(TasksSchema.id, Number(idMatch[1]))
+            : and(
+                eq(TasksSchema.complete, false),
+                isNull(TasksSchema.parentId),
+                ilike(TasksSchema.description, `%${description}%`),
+            );
+
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle
+                .select()
+                .from(TasksSchema)
+                .where(and(inArray(TasksSchema.goalId, args.goalsIds), searchCondition))
         );
 
         if (!result) {
             return [];
         }
 
-        const map: Map<number, TaskItemForClient> = new Map();
-
-        result.rows.forEach((t) => {
-            if (!map.get(t.id)) {
-                map.set(t.id, new TaskItemForClient(t));
-            }
-        });
-
-        return [...map.values()];
+        return result.map((task) => ({
+            ...task,
+            tags: [],
+            assignedUsers: [],
+            historyId: null,
+            subtasks: [],
+        }));
     }
 }

api/src/tv-modules/start/start.types.ts

@@ -1,3 +1,17 @@
+import type { TasksSchemaTypeForSelect } from 'taskview-db-schemas';
+
+export type SearchTaskArgs = {
+    description: string;
+    goalsIds: number[];
+};
+
+export type SearchTaskResult = TasksSchemaTypeForSelect & {
+    tags: number[];
+    assignedUsers: number[];
+    historyId: number | null;
+    subtasks: SearchTaskResult[];
+};
+
 export type FetchAllListsResult = {
     goalName: string | null;
     listName: string | null;

api/src/tv-modules/ui-preferences/types.ts

@@ -44,6 +44,8 @@ const firstDayOfWeekArkType = type('number.integer').narrow((v, ctx) =>
 
 export const UiSettingsArkType = type({
   'firstDayOfWeek?': firstDayOfWeekArkType,
+  'defaultProjectId?': 'number.integer >= 1',
+  'defaultView?': "'tasks' | 'kanban' | 'graph' | 'sprints'",
 })
 
 export type UiSettings = typeof UiSettingsArkType.infer

api/src/types/app.types.ts

@@ -22,6 +22,21 @@ export const AppEnvSchema = z.object({
     SMTP_FROM_NAME: z.string().optional(),
     SMTP_FROM_EMAIL: z.string().optional(),
     APP_URL: z.string(),
+
+    // How account password changes are confirmed: code sent by email (default) or current password
+    PASSWORD_CHANGE_CONFIRMATION: z.enum(['email', 'password']).optional(),
+
+    // Comma-separated list of enabled login methods (magic-link, password, sso, social); unset = all enabled
+    AUTH_LOGIN_METHODS: z.string().optional(),
+
+    TELEGRAM_BOT_TOKEN: z.string().optional(),
+    TELEGRAM_BOT_USERNAME: z.string().optional(),
+    TELEGRAM_WEBHOOK_SECRET: z.string().optional(),
+
+    SLACK_CLIENT_ID: z.string().optional(),
+    SLACK_CLIENT_SECRET: z.string().optional(),
+    SLACK_CALLBACK_URL: z.string().optional(),
+    SLACK_SIGNING_SECRET: z.string().optional(),
 });
 
 export const StringToNumber = z

api/src/types/auth.types.ts

@@ -62,6 +62,61 @@ export const ChangePasswordDataScheme = z
 
 export type ChangePasswordData = z.infer<typeof ChangePasswordDataScheme>;
 
+export const ChangeOwnPasswordSchema = z
+    .object({
+        code: z.string().min(1).max(64),
+        password: z.string().min(6).max(128),
+        passwordRepeat: z.string().max(128),
+    })
+    .refine((data) => data.password === data.passwordRepeat, {
+        message: "Passwords don't match",
+        path: ['passwordRepeat'],
+    });
+
+export type ChangeOwnPassword = z.infer<typeof ChangeOwnPasswordSchema>;
+
+export const ChangeOwnPasswordByPasswordSchema = z
+    .object({
+        currentPassword: z.string().min(1).max(128),
+        password: z.string().min(6).max(128),
+        passwordRepeat: z.string().max(128),
+    })
+    .refine((data) => data.password === data.passwordRepeat, {
+        message: "Passwords don't match",
+        path: ['passwordRepeat'],
+    });
+
+export type ChangeOwnPasswordByPassword = z.infer<typeof ChangeOwnPasswordByPasswordSchema>;
+
+export type PasswordChangeConfirmationMode = 'email' | 'password';
+
+export type LoginMethod = 'magic-link' | 'password' | 'sso' | 'social';
+
+export const ChangeDefaultUserCredentialsSchema = z
+    .object({
+        currentPassword: z.string().min(1).max(128),
+        login: z.string().min(3).max(64).regex(/^[a-zA-Z0-9._-]+$/).toLowerCase(),
+        email: z.string().email().max(255).toLowerCase(),
+        password: z.string().min(6).max(128),
+        passwordRepeat: z.string().max(128),
+    })
+    .refine((data) => data.password === data.passwordRepeat, {
+        message: "Passwords don't match",
+        path: ['passwordRepeat'],
+    });
+
+export type ChangeDefaultUserCredentials = z.infer<typeof ChangeDefaultUserCredentialsSchema>;
+
+export type UpdateUserCredentialsArgs = {
+    userId: number;
+    oldEmail: string;
+    login: string;
+    email: string;
+    passwordHash: string;
+};
+
+export type UpdateUserCredentialsResult = 'ok' | 'conflict' | 'error';
+
 export const RefreshTokenSchema = z.object({
     refreshToken: z.string(),
 });

docs/1.getting-started/2.installation.md

@@ -144,6 +144,10 @@ services:
   taskview-webapp:
     image: gimanhead/taskview-ce-webapp:latest
     restart: unless-stopped
+    environment:
+      # The web app will always use this API server and hide the server selector on the login page.
+      # Remove this variable if you want to pick the API server manually on the login page.
+      TASKVIEW_API_URL: "http://localhost:1725"
     ports:
       - "8888:80"
   # Enable for realtime notification read https://taskview.tech/docs/configuration/environment-variables#centrifugo-configuration-file 
@@ -175,14 +179,16 @@ Go to [http://localhost:8888](http://localhost:8888) in your browser. You'll see
 
 ### Configure the API server
 
-Before logging in, you need to tell the web app where the API server is running. Click the **server settings** icon on the login page and add the API server URL:
+The web app (port 8888) serves the frontend, while the API server (port 1725) handles authentication, projects, tasks, and all backend operations.
+
+If you set `TASKVIEW_API_URL` on the `taskview-webapp` service (as in the compose file above), there is nothing to configure — the web app already knows where the API is, and the server selector is hidden from the login page.
+
+Without `TASKVIEW_API_URL`, click the **server settings** section on the login page and add the API server URL manually:
 
 ```
 http://localhost:1725
 ```
 
-This is the API server that handles authentication, projects, tasks, and all backend operations. The web app (port 8888) serves the frontend, while the API server (port 1725) handles the data.
-
 ### Log in with the default user
 
 The database migration creates a default user so you can log in right away:
@@ -193,31 +199,25 @@ The database migration creates a default user so you can log in right away:
 Use these credentials to verify that everything is working - check that the UI loads, you can create a project, add tasks, etc.
 
 ::callout{icon="i-lucide-alert-triangle" color="error"}
-**Important:** The default user is for initial setup only. Once you've confirmed the system works, delete the default user and create your own account with a secure password.
+**Important:** The default credentials are publicly known — anyone who has read this page can sign in to a fresh installation. Claim the account right after the first login.
 ::
 
-### Replacing the default user
+### Claim the default account
+
+Make the default account your own — no SMTP or database access needed:
 
 1. Log in with the default credentials
-2. Register a new account with your real email and a strong password
-3. Delete the default `admin` account
+2. Open **Account settings** — the highlighted **Login and email** card is shown at the top (it is visible only to the default user)
+3. Set your own login, email and a strong password, confirm with the current password (`user1!#Q`), and click **Save and sign out**
+4. Sign in again with your new login and password
 
-If you prefer to create the first user directly in the database, generate a password hash:
+![The Login and email card in Account settings for claiming the default account](/taskview/change-def-account.png)
 
-```ts
-import { hashSync } from 'bcryptjs'
+Your organizations, projects and permissions are preserved. Once the email is changed, the card disappears and the claim endpoint is disabled.
 
-const passwordHash = hashSync('your-secure-password', 12)
-console.log(passwordHash)
-```
-
-Or as a one-liner:
-
-```bash
-node -e "console.log(require('bcryptjs').hashSync('your-secure-password', 12))"
-```
-
-Then insert the user into the database with the generated hash.
+::callout{icon="i-lucide-mail" color="info"}
+Changing the password later requires a confirmation code sent by email. If your installation has no SMTP, set `PASSWORD_CHANGE_CONFIRMATION="password"` in `.env.taskview` so password changes are confirmed with the current password instead. See [Environment Variables](/docs/configuration/environment-variables#authentication).
+::
 
 ## Updating
 
@@ -233,7 +233,8 @@ The migration container will automatically apply any new database changes on sta
 ## Production tips
 
 - **Use a reverse proxy** (Nginx, Caddy, Traefik) to terminate SSL and serve everything over HTTPS
-- **Update `APP_URL` and `API_URL`** in `.env.taskview` to match your production domain
+- **Update `APP_URL`** in `.env.taskview` and `TASKVIEW_API_URL` on the webapp service to match your production domains
+- **Trim the login page** — set `AUTH_LOGIN_METHODS` in `.env.taskview` to offer only the sign-in methods you actually use (e.g. `AUTH_LOGIN_METHODS="password"`). Google/GitHub/Apple buttons are shown only when the provider is configured.
 - **Back up the database** - the `pgdata` volume contains all your data
 - **Set `restart: unless-stopped`** on all services so they survive server reboots
 - **SMTP setup** - add SMTP variables to `.env.taskview` if you want email features (password recovery, invitations). See [Configuration](/docs/configuration/environment-variables) for details.

docs/2.features/12.ui-customization.md

@@ -0,0 +1,47 @@
+---
+title: UI Customization
+description: Personalize TaskView per user - reorder and hide task fields and analytics blocks, set the first day of week, and pick a default project and view to open right after signing in.
+navigation:
+  icon: i-lucide-sliders-horizontal
+---
+
+TaskView lets every user tune the interface to how they actually work. All settings on this page are personal — they are stored per user on the server and follow you across devices and browsers.
+
+Open **Settings → UI customization** from the user menu.
+
+## Reorder and hide items
+
+Three sections are driven by drag-and-drop lists:
+
+- **Tasks** — the fields shown in the task detail view (note, status, priority, assignees, tags, deadline, sprint, estimate, time tracking, history, …)
+- **Analytics — Indicators** — the KPI tiles on the analytics page
+- **Analytics — Charts** — the charts on the analytics page
+
+For every item you can:
+
+- **Reorder** — drag by the handle on the left
+- **Show / hide** — toggle visibility
+- **Narrow / wide** — for task fields, choose whether the field takes half or the full width of the detail view
+
+All available items are listed here; permission checks still apply at render time, so an enabled item may stay hidden if you lack the permission to see it.
+
+## Others
+
+### First day of week
+
+Sets which day calendars start on. Applies to all date pickers across the app. "Default" follows your locale.
+
+### Default project and view
+
+Normally, after signing in you land on the home screen and navigate to your project and board manually. If you always start in the same place, set it as the default:
+
+- **Default project** — the project TaskView opens right after you sign in (or reopen the app with an active session)
+- **Default view** — which view of that project to open: **Tasks**, **Kanban**, **Graph** or **Sprints**
+
+When a default project is set, a quick-jump button with the project name also appears in the sidebar next to **Inbox** — click it from anywhere to return to your project in the chosen view.
+
+If the default project is deleted or you lose access to it, TaskView falls back to the home screen. Choose "Home screen (default)" to turn the feature off.
+
+## How it is stored
+
+Preferences are saved automatically (no Save button) through the `ui-preferences` API and kept per user account. Resetting the browser or switching devices does not lose them.

docs/3.integrations/3.messaging.md

@@ -0,0 +1,336 @@
+---
+title: Telegram & Slack Setup
+description: Connect Telegram and Slack to TaskView to receive task notifications. Personal direct messages and project-wide group channels, with instance-level bot credentials, OAuth, signed inbound webhooks, and SHA-256 hashed binding tokens.
+navigation:
+  icon: i-lucide-send
+---
+
+TaskView messaging integrations deliver task events to messengers. There are two levels of connection:
+
+- **Personal** — a user links their own account and receives direct messages about their tasks (assigned, deadline, etc.).
+- **Project** — an admin connects a group/channel, and events for that project are posted to it for the whole team.
+
+The bot credentials are configured **per instance** (via environment variables), so the official TaskView SaaS ships an official bot and self-hosted installs supply their own — no code changes, only configuration.
+
+## Notification model & event delivery
+
+Understanding **who receives what** matters, because it is not "every subscriber gets every event".
+
+### Connection scope
+
+- **Personal** connections are keyed to a **user** (`ownerType = user`), not to a project or organization. One personal connection covers **all** your projects **and** organizations — switching the organization you view in the app does not change delivery. You receive DMs about your tasks everywhere you are a member.
+- **Project** connections are keyed to a **project** (`ownerType = project`). They post that project's events to the connected channel/group for the whole team.
+
+### Per-event audience (personal delivery)
+
+Each event is delivered to a specific **audience**. A subscriber receives it only if they are in that audience — the subscription checkbox controls *whether* you get an event you're eligible for, not *who* is eligible.
+
+| Event | Personal recipients |
+|---|---|
+| **Task created** | **all project members** (a new task usually has no assignees yet) |
+| **Task assigned** | the task's **assignees** |
+| **Task status changed** | the task's **assignees** |
+| **Task completed / reopened** | the task's **assignees** |
+| Sprint / member / time-tracking events | the relevant project members / actors |
+
+Key rules:
+
+- **No initiator exclusion.** Messaging is an explicit opt-in feed, so you receive an event even for **your own** action — e.g. completing a task you're assigned to still DMs you. The initiator is not filtered out; they simply receive the event if they are in the audience.
+- **Consequence:** for everything **except Task created**, you are notified **only if you are an assignee** of that task. A task with **no assignees** produces **no** personal completed/status notification for anyone (there is no one in the audience). "Not an assignee → not notified" applies to the initiator too — they are just one non-assignee among others.
+- **Task reopened** is delivered under the **Task completed** subscription (same checkbox), shown with a `[Task reopened]` title and a ↩️→ Done button.
+
+### Project delivery & content gating
+
+- Project events go to the connected channel/group when the connection is **active** and **subscribed** to that event.
+- Delivery is queued (pg-boss) and retried with backoff (up to 3 attempts).
+
+#### The `post content` toggle
+
+A shared channel is **not** an RBAC principal — TaskView can't check the permissions of each channel member (they may not even have a TaskView account). So instead of per-viewer gating, a project connection has one explicit switch, **post content**, set by whoever connected the channel (requires `INTEGRATIONS_CAN_MANAGE`). It decides how much of a task event is broadcast:
+
+| | `post content = true` (default) | `post content = false` |
+|---|---|---|
+| Task **title** + link | ✅ posted | ✅ posted |
+| Task **description** | ✅ posted | ❌ hidden |
+| **Assignee** footer (`👤 emails`) | ✅ posted | ❌ hidden |
+| **Action buttons** (Done / Reopen / Assign) | ✅ shown | ❌ hidden |
+
+Turn it **off** for a channel whose audience should see only that *something happened* (title + link) without the task's content, assignee emails, or interactive actions. The event itself is still delivered either way — only the content and buttons are suppressed. Buttons are hidden on a content-hidden channel because the Assign action opens a modal listing project members, which would defeat the point of hiding content.
+
+> **Personal** DMs are different: each recipient is a known TaskView user, so the description is gated per recipient by `COMPONENT_CAN_WATCH_CONTENT` and the assignee footer by `TASKS_CAN_WATCH_ASSIGNED_USERS` — and action buttons are always shown (any action still runs under that user's own RBAC).
+
+## Prerequisites
+
+- TaskView API running and reachable over **public HTTPS** (messengers deliver updates/redirects to your API; `localhost` is not reachable from Telegram/Slack — use your production domain or a tunnel for local testing)
+- PostgreSQL database with migrations applied
+- `.env.taskview` file configured
+
+> **Local testing tunnel:** prefer `cloudflared tunnel --url http://localhost:1401` — it gives a clean HTTPS URL with no interstitial. `ngrok`'s free tier shows a "You are about to visit…" warning page that breaks the browser OAuth redirect (you can't inject the `ngrok-skip-browser-warning` header into Slack's redirect); if you must use ngrok free, open the tunnel URL once in your browser and click **Visit Site** first, or upgrade to a paid plan.
+>
+> For Slack, the API base the **frontend** calls and `SLACK_CALLBACK_URL` must be the **same HTTPS origin** — the anti-CSRF nonce cookie is set on `oauth/start` and read on the callback, so a `localhost` start + tunnel callback will not work.
+
+---
+
+## 1. Database Migration
+
+The migration creates the required tables (`tasks.messaging_connections`, `tasks.messaging_link_tokens`, `tasks.messaging_identity_map`) automatically. The migration container handles this on startup — no manual steps needed.
+
+---
+
+## 2. Telegram
+
+### 2.1 Create a bot
+
+1. Open [@BotFather](https://t.me/BotFather) in Telegram
+2. Send `/newbot` and follow the prompts
+3. Copy the **bot token** (looks like `123456789:AA...`) and note the **bot username** (without `@`)
+
+### 2.2 Configure the bot for group commands
+
+Project connections are completed by typing a command **inside a group**, so the bot must be allowed to read group messages:
+
+1. In @BotFather, send `/setprivacy` → choose your bot → **Disable**
+   (with privacy enabled, members must instead address the bot explicitly: `/connect@your_bot <token>`)
+2. Send `/setjoingroups` → choose your bot → **Enable**
+
+### 2.3 Environment variables
+
+Add to `.env.taskview`:
+
+```
+TELEGRAM_BOT_TOKEN=123456789:AA-your-bot-token
+TELEGRAM_BOT_USERNAME=your_bot            # without the leading @
+TELEGRAM_WEBHOOK_SECRET=<random-secret>   # any long random string
+```
+
+Generate a webhook secret:
+
+```bash
+node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+```
+
+> The webhook secret is compared (in constant time) against the `X-Telegram-Bot-Api-Secret-Token` header on every inbound update, so only Telegram can reach the endpoint.
+
+### 2.4 Register the webhook with Telegram
+
+Tell Telegram where to deliver updates. Run once (replace the placeholders):
+
+```bash
+curl "https://api.telegram.org/bot<TELEGRAM_BOT_TOKEN>/setWebhook" \
+  -d "url=https://<your-api-domain>/module/messaging/telegram/webhook" \
+  -d "secret_token=<TELEGRAM_WEBHOOK_SECRET>"
+```
+
+Verify it took effect:
+
+```bash
+curl "https://api.telegram.org/bot<TELEGRAM_BOT_TOKEN>/getWebhookInfo"
+```
+
+`url` should point at your `/module/messaging/telegram/webhook` and `pending_update_count` should be `0`.
+
+### 2.5 Usage
+
+Restart the API after setting the environment variables, then in TaskView open a project → right-click it in the sidebar → **"Messengers"**.
+
+**Personal (Direct messages)**
+
+1. On the **Personal** tab, click **Connect** → **Telegram** → **Get link**
+2. Click **Open in Telegram** and press **Start** in the bot chat
+3. Your account is linked — you'll now get DMs about your tasks
+
+**Project (Group channel)**
+
+1. On the **Project** tab (requires the `INTEGRATIONS_CAN_MANAGE` permission), click **Connect** → **Telegram** → **Get link**
+2. Click **Add bot to group** and pick the group, or add the bot manually
+3. In that group, send the shown command: `/connect <token>`
+4. The group is connected — project events are now posted there
+
+You can toggle any connection on/off or disconnect it from the same page.
+
+**Creating tasks from a group (`/task`)**
+
+In a group linked to **exactly one** project, any member can create a task:
+
+```
+/task Buy the domain
+```
+
+- Requires the sender to have **linked their personal Telegram account** (Personal tab → Connect → Telegram) — the command runs under their TaskView permissions (`COMPONENT_CAN_ADD_TASKS`).
+- The bot replies with the created task and a link. In an unlinked chat, or one linked to several projects, it says so and creates nothing.
+- **Privacy mode note:** with the bot's group privacy **enabled**, Telegram only delivers commands addressed to the bot — use `/task@your_bot <description>` (same as `/connect`). Disable privacy (and re-add the bot) to allow a bare `/task`.
+
+---
+
+## 3. Slack
+
+Slack uses per-instance OAuth credentials, mirroring the GitHub/GitLab integration model. Requires `ENCRYPTION_KEY` (tokens are stored AES-256-GCM encrypted).
+
+> **Public HTTPS is required.** Slack must reach your API over HTTPS for OAuth, slash
+> commands and interactivity. In local dev use a tunnel (ngrok / cloudflared); note that a
+> free ngrok URL changes on every restart — if it changes you must update the Redirect URL,
+> the Slash Command / Interactivity Request URLs **and** `SLACK_CALLBACK_URL`, then restart.
+
+### 3.1 Create the app
+
+1. Go to [api.slack.com/apps](https://api.slack.com/apps) → **Create New App** → **From scratch** → name it (e.g. `TaskView`) and pick your workspace.
+
+2. **App name vs bot name** (these are two different fields — a common point of confusion):
+   - **Basic Information → Display Information → App name** — the app's name in the api.slack.com console (the dropdown at the top-left). Purely cosmetic for the console.
+   - **App Home → App Display Name → Edit → Display Name (Bot Name)** — how the **bot** signs its messages in Slack (e.g. `TaskView`). Changing it only takes effect after a **Reinstall** (step 5).
+
+### 3.2 OAuth & scopes
+
+1. **OAuth & Permissions → Redirect URLs → Add New Redirect URL** — enter exactly your `SLACK_CALLBACK_URL`, then **Save URLs**:
+   ```
+   https://<your-api-domain>/module/messaging/slack/oauth/callback
+   ```
+   Slack rejects plain `http://localhost` — HTTPS only.
+
+2. **OAuth & Permissions → Scopes → Bot Token Scopes** — add:
+   - `chat:write` — post messages (personal DMs + project channels). **Required.**
+   - `commands` — needed for the `/task` slash command (inbound).
+   - `chat:write.public` — *optional but recommended*: lets the bot post to **any public channel without being invited**. Without it you must `/invite` the bot into each channel (see step 5).
+   - `im:write` — *optional*, only if personal DMs fail to open.
+   > `incoming-webhook` is added automatically when you enable Incoming Webhooks (step 3.3) and is what makes the project-connect channel picker appear.
+
+### 3.3 Features
+
+1. **Incoming Webhooks → Activate Incoming Webhooks: On.** Required for the **project (channel)** connect flow — it makes Slack show a channel picker during install.
+
+2. **Slash Commands → Create New Command:**
+   - Command: `/task`
+   - Request URL: `https://<your-api-domain>/module/messaging/slack/commands`
+   - Short description: `Create a TaskView task`
+
+3. **Interactivity & Shortcuts → On**, Request URL:
+   ```
+   https://<your-api-domain>/module/messaging/slack/interactivity
+   ```
+   Powers the **Done / Reopen / Assign** buttons and the assignee modal.
+
+### 3.4 Credentials → environment variables
+
+**Basic Information → App Credentials** — copy the three values:
+
+```
+SLACK_CLIENT_ID=<your-client-id>
+SLACK_CLIENT_SECRET=<your-client-secret>
+SLACK_CALLBACK_URL=https://<your-api-domain>/module/messaging/slack/oauth/callback
+SLACK_SIGNING_SECRET=<your-signing-secret>
+```
+
+- `SLACK_CALLBACK_URL` must **exactly** match the Redirect URL from step 3.2.
+- `SLACK_SIGNING_SECRET` verifies inbound slash commands / interactivity (without it those endpoints return 503).
+- Tokens are stored AES-256-GCM encrypted — `ENCRYPTION_KEY` is required.
+- Optional endpoint overrides (tests / enterprise proxy): `SLACK_API_BASE_URL`, `SLACK_AUTHORIZE_URL`, `SLACK_WEBHOOK_PREFIX` (see the environment-variables reference).
+
+Then **restart the API.**
+
+### 3.5 Install (and reinstall)
+
+1. **OAuth & Permissions → Install to Workspace** (or *Reinstall to Workspace*).
+2. **Reinstall whenever you change scopes** or the bot display name — otherwise changes don't take effect.
+3. **Invite the bot into the channel(s)** it should post to:
+   ```
+   /invite @TaskView
+   ```
+   `chat.postMessage` fails with `not_in_channel` if the bot isn't a member. Either invite it per channel, or add the `chat:write.public` scope (step 3.2) so it can post to any **public** channel without an invite (private channels always need an invite).
+
+### 3.6 Connect and use
+
+Open **Messengers** in a project:
+
+- **Personal:** Personal tab → **Connect** → **Slack** → **Continue with Slack** → authorize. The bot DMs you about your tasks. This also **links your Slack account** (required for inbound actions to run as you).
+- **Project:** Project tab (needs `INTEGRATIONS_CAN_MANAGE`) → **Connect** → **Slack** → **Continue with Slack** → pick the channel during install. Project events post to that channel. **Invite the bot into that channel** (step 3.5).
+
+> **Gotcha — "added an integration to this channel" is NOT enough.** After you pick a channel during install, Slack posts *"added an integration to this channel: TaskView"* there. That only adds the app's incoming webhook — it does **not** make the bot **user** a channel member, and TaskView posts via the bot (`chat.postMessage`, so it can also render buttons). So delivery still fails with `not_in_channel` until you explicitly run **`/invite @TaskView`** in that channel (or use `chat:write.public`). Confirm the connection's channel is the one you meant — the `#channel` you picked in the webhook dropdown is where events go.
+
+**Acting from Slack:**
+- `/task <description>` in a channel linked to **exactly one** project → creates a task there. (In a DM or an unlinked channel it replies that the channel isn't linked; a channel linked to several projects is ambiguous and is refused — create it in the app.)
+- Under each task notification: **✅ Done** (complete), **↩️ Reopen** (on a completed card), **👤 Assign** (a modal that pre-selects current assignees; add/remove and Save to set the list).
+- Every inbound action runs under the invoking user's TaskView RBAC, so they must have linked their Slack account. Requests are verified with the Signing Secret.
+
+> **Notification model:** messengers are a **feed/history** — each event posts a new message. TaskView does **not** edit past cards, so an old card may still show a live button after the task changed elsewhere. Actions are idempotent and always re-check the current state + permissions, so a stale click is safe.
+
+### 3.7 Distribution
+
+By default a Slack app is **private to your workspace**. To let other workspaces install it, enable **Public Distribution** (free); to list it in the Slack Marketplace, pass Slack's review (also free — a review, not a fee). Self-hosted installs keep the app private; the official SaaS uses one distributed app. Creating and distributing an app does **not** require a paid Slack plan.
+
+---
+
+## 4. Full `.env.taskview` Example
+
+```env
+# ... existing vars ...
+
+# Telegram messaging integration
+TELEGRAM_BOT_TOKEN=123456789:AA-your-bot-token
+TELEGRAM_BOT_USERNAME=your_bot
+TELEGRAM_WEBHOOK_SECRET=a1b2c3d4e5f6...
+
+# Slack messaging integration
+SLACK_CLIENT_ID=
+SLACK_CLIENT_SECRET=
+SLACK_CALLBACK_URL=https://api.taskview.tech/module/messaging/slack/oauth/callback
+SLACK_SIGNING_SECRET=
+
+# Required for Slack (encrypted token storage), shared with SSO/other integrations
+ENCRYPTION_KEY=a1b2c3d4e5f6...  # 64 hex characters
+```
+
+---
+
+## 5. SaaS vs Self-Hosted
+
+| | Official SaaS | Self-hosted |
+|---|---|---|
+| **Telegram** | One official bot, credentials shipped with the instance | Create your own bot via @BotFather and set `TELEGRAM_*` |
+| **Slack** | One official distributed app | Create your own Slack app and set `SLACK_*` |
+
+There is no code fork between the two — only the values of the environment variables differ. If the variables are unset, the integration simply does not appear until an admin configures it.
+
+---
+
+## 6. Production Notes
+
+- **Public HTTPS is mandatory** for the inbound webhook. Update the `setWebhook` URL to your production domain.
+- **Re-run `setWebhook`** whenever the API domain changes.
+- **`TELEGRAM_WEBHOOK_SECRET`**: store securely, never commit to git.
+- **Group privacy**: if `/connect` in a group does nothing, the bot's privacy mode is likely still enabled (see step 2.2).
+
+---
+
+## 7. Troubleshooting
+
+**The "Messengers" page shows a 503 / "This messenger is not configured on the server"**
+→ `TELEGRAM_BOT_TOKEN` or `TELEGRAM_BOT_USERNAME` is missing; the API was not restarted after setting them.
+
+**Pressing Start / sending `/connect` does nothing**
+→ The webhook is not registered or points at the wrong URL. Check `getWebhookInfo` (step 2.4) and confirm the API is reachable over public HTTPS.
+
+**`/connect <token>` in a group is ignored**
+→ The bot's privacy mode is enabled. Disable it (step 2.2), or use `/connect@your_bot <token>`.
+
+**"Link is invalid or expired"**
+→ Binding tokens are single-use and expire after 15 minutes. Generate a new one from the **Connect** dialog.
+
+**Notifications don't arrive after connecting**
+→ Confirm the connection is toggled **on**, and that you are actually assigned to the task. Project posts require an active project connection.
+
+### Slack
+
+**Nothing posts to a linked channel (personal DM works)** — the log shows `chat.postMessage failed: not_in_channel`
+→ The bot **user** isn't a member of that channel. Seeing *"added an integration to this channel: TaskView"* is **not** the same as the bot joining — that message is just the incoming webhook. Run **`/invite @TaskView`** (the bot user) in the channel, or add the `chat:write.public` scope and reinstall. The log line names the channel id (`channel=…`) — make sure it's the one you intended.
+
+**`/task` replies "This channel is not linked to a TaskView project"**
+→ Run it in a **project channel** (connected via Messengers → Project), not in a DM. A channel linked to **several** projects is refused as ambiguous — create the task in the app.
+
+**Slash command / buttons return an error or nothing**
+→ `SLACK_SIGNING_SECRET` is missing (endpoints return 503), the Request URLs don't match your current public host, or the app wasn't reinstalled after enabling `commands` / `chat:write`.
+
+**"You need to link your Slack account"**
+→ Inbound actions run under your TaskView permissions. Link it: Personal tab → Connect → Slack.
+
+**Bot still shows the old name in messages**
+→ Changing **Display Name (Bot Name)** requires **Reinstall to Workspace**. The console dropdown name is a separate field (Basic Information → App name).

docs/3.integrations/diagrams/messaging-slack.puml

@@ -0,0 +1,83 @@
+@startuml messaging-slack
+title TaskView — Slack messaging integration (sequence)
+
+actor User
+participant "Web\n(frontend)" as Web
+participant "Slack" as Slack
+participant "API routes\n+ controller" as API
+participant "MessagingManager /\nSlackInboundManager" as Mgr
+participant "SlackProvider" as Prov
+participant "MessagingDispatcher" as Disp
+participant "EventBus /\nTasksManager" as Core
+queue "pg-boss" as Q
+database "PostgreSQL" as DB
+
+== Connect (OAuth) ==
+User -> Web: Messengers → Connect Slack
+Web -> API: GET /slack/oauth/start (?token, returnPath)
+API -> Mgr: startOAuthConnect(ctx)
+Mgr -> Prov: startConnect(ctx)
+Prov --> API: url + anti-CSRF nonce cookie
+API --> User: 302 → Slack authorize
+User -> Slack: authorize (project: pick a channel)
+Slack -> API: GET /slack/oauth/callback (code, state)
+API -> Mgr: handleInbound(source=oauth-callback, cookie=nonce)
+Mgr -> Prov: parseInbound → verify state+nonce, exchange code
+Prov -> Slack: oauth.v2.access
+Slack --> Prov: bot token, team, channel
+Prov --> Mgr: {createConnection, identity?}
+Mgr -> DB: store connection (encrypted bot token)\n(+ identity_map for personal)
+API --> User: 302 back (?messaging=connected)
+
+== Outbound notification ==
+User -> Core: create / assign / complete a task
+Core -> Disp: EventBus emit task.*
+Disp -> DB: resolve recipients + subscribed connections
+note right of Disp: description RBAC-gated per recipient\n(COMPONENT_CAN_WATCH_CONTENT)
+Disp -> Q: enqueue deliver jobs
+Q -> Disp: worker → deliverJob
+Disp -> Prov: deliver(message)
+Prov -> Slack: chat.postMessage (Block Kit + buttons)
+Slack --> User: notification card
+alt delivery fails
+  Disp -> Q: re-enqueue (backoff, max 3)
+end
+
+== Inbound: /task ==
+User -> Slack: /task <text> (project channel)
+Slack -> API: POST /slack/commands
+API -> API: VerifySlackRequest (HMAC signature + replay window)
+API -> Mgr: handleSlashCommand(payload)
+Mgr -> DB: identity (slack user → userId)
+Mgr -> DB: channel → project (goalId)
+Mgr -> Core: RBAC (COMPONENT_CAN_ADD_TASKS) + addTaskNew
+Core --> Mgr: created task
+Mgr --> Slack: ephemeral "✅ Task created: <text>" (no link)
+Slack --> User: ephemeral reply
+
+== Inbound: Done / Reopen / Assign buttons ==
+User -> Slack: click Done / Reopen / Assign
+Slack -> API: POST /slack/interactivity
+API -> API: VerifySlackRequest (signature)
+API -> Mgr: handleInteraction(payload)
+Mgr -> DB: identity → userId
+alt Assign
+  Mgr -> Slack: views.open (multi-select modal, current assignees pre-selected)
+  User -> Slack: pick assignees → Save
+  Slack -> API: POST /slack/interactivity (view_submission)
+  API -> Mgr: handleAssignSubmit
+  Mgr -> Core: RBAC (TASKS_CAN_ASSIGN_USERS) + toggleTaskUsers (set)
+  Mgr --> Slack: {} → modal closes (no ephemeral)
+else Done / Reopen
+  Mgr -> Core: RBAC (TASKS_CAN_EDIT_STATUS) + updateTask(complete)
+  Mgr --> Slack: ephemeral ack (response_url, replace_original=false)
+  Slack --> User: private confirmation
+end
+
+note over User, DB
+  Feed model: each event posts a NEW card.
+  Past cards are not edited; a stale click is safe
+  (idempotent action + RBAC re-check).
+end note
+
+@enduml

docs/3.integrations/diagrams/messaging-telegram.puml

@@ -0,0 +1,75 @@
+@startuml messaging-telegram
+title TaskView — Telegram messaging integration (sequence)
+
+actor User
+participant "Web\n(frontend)" as Web
+participant "Telegram" as TG
+participant "API routes\n+ controller" as API
+participant "MessagingManager" as Mgr
+participant "TelegramProvider" as Prov
+participant "MessagingDispatcher" as Disp
+participant "EventBus /\nTasksManager" as Core
+queue "pg-boss" as Q
+database "PostgreSQL" as DB
+
+== One-time setup (admin) ==
+note over API, TG
+  Admin runs setWebhook(url, secret_token) once.
+  Telegram then POSTs every update to
+  /module/messaging/telegram/webhook.
+end note
+
+== Connect (deep-link binding) ==
+User -> Web: Messengers → Connect Telegram → Get link
+Web -> API: GET /:provider/connect-link (personal or project)
+API -> Mgr: createPersonalConnectLink / createProjectConnectLink
+Mgr -> Prov: startConnect(ctx)
+Prov --> Mgr: t.me deep-link + one-time token
+Mgr -> DB: store hashed link token (TTL 15 min)
+API --> User: deep-link ("Add bot to group") + /connect <token>
+User -> TG: /start <token> (private)  or  /connect <token> (group)
+TG -> API: POST /telegram/webhook
+API -> API: VerifyTelegramWebhook (secret token, constant-time)
+API -> Mgr: handleInbound(source=webhook)
+Mgr -> Prov: parseInbound → {bindByToken, scope}
+Mgr -> DB: findValidLinkToken → create connection\n(+ identity_map for personal), consume token
+Mgr -> Prov: deliver("Done! connected")
+Prov -> TG: sendMessage
+TG --> User: confirmation
+
+== Outbound notification ==
+User -> Core: create / assign / complete a task
+Core -> Disp: EventBus emit task.*
+Disp -> DB: resolve recipients + subscribed connections
+note right of Disp: description RBAC-gated per recipient\n(COMPONENT_CAN_WATCH_CONTENT)
+Disp -> Q: enqueue deliver jobs
+Q -> Disp: worker → deliverJob
+Disp -> Prov: deliver(message)
+Prov -> TG: sendMessage (HTML, link on "[event] [project]")
+TG --> User: notification
+alt delivery fails
+  Disp -> Q: re-enqueue (backoff, max 3)
+end
+
+== Inbound: /task ==
+User -> TG: /task <text> (group; /task@bot if privacy is on)
+TG -> API: POST /telegram/webhook
+API -> API: VerifyTelegramWebhook (secret token)
+API -> Mgr: handleInbound(source=webhook)
+Mgr -> Prov: parseInbound → {command: createTask}
+Mgr -> DB: identity (telegram user → userId)
+Mgr -> DB: group chat → project (goalId)
+Mgr -> Core: RBAC (COMPONENT_CAN_ADD_TASKS) + addTaskNew
+Core --> Mgr: created task
+Mgr -> Prov: deliver("Task created" + link)
+Prov -> TG: sendMessage
+TG --> User: reply
+
+note over User, DB
+  Telegram = notifications + binding + /task.
+  No inline buttons (Done/Assign) — that is Slack-only.
+  The link is always sent; Telegram itself won't render
+  a localhost href (needs a public APP_URL).
+end note
+
+@enduml

docs/4.configuration/1.environment-variables.md

@@ -25,6 +25,15 @@ These must match your PostgreSQL setup.
 |---|---|---|---|
 | `APP_PORT` | No | `1401` | Port the API server listens on |
 | `APP_URL` | Yes | https://app.taskview.tech | Full URL of the web app (e.g. `https://tasks.company.com`). Used for OAuth redirects and email links. |
+| `TRUST_PROXY` | No | `false` | Set when running behind a reverse proxy so `X-Forwarded-Proto`/`X-Forwarded-For` are honoured (correct `https` URLs, real client IP). Use the number of proxies in front of the app (`1` for a single Caddy/nginx), or an IP/subnet list (`10.0.0.0/8`, `uniquelocal`). Leave unset for direct access. Avoid `true` (trusts any hop, allows header spoofing). |
+
+## Web app
+
+Unlike everything else on this page, this variable is set on the **web app container** (`taskview-webapp`), not in `.env.taskview`.
+
+| Variable | Required | Default | Description |
+|---|---|---|---|
+| `TASKVIEW_API_URL` | No | - | Pins the API server URL for the web app (e.g. `https://api.company.com`). When set, the "Select server" section disappears from the login page and the app always talks to this API. When unset, users pick the API server on the login page themselves. |
 
 ## Authentication
 
@@ -34,6 +43,8 @@ These must match your PostgreSQL setup.
 | `ACCESS_LIFE_TIME` | No | `1d` | How long access tokens are valid. Examples: `1h`, `1d`, `7d` |
 | `REFRESH_LIFE_TIME` | No | `2d` | How long refresh tokens are valid |
 | `JWT_ALG` | No | `HS256` | JWT signing algorithm |
+| `AUTH_LOGIN_METHODS` | No | all enabled | Comma-separated list of login methods to offer: `magic-link`, `password`, `sso`, `social`. Disabled methods disappear from the login page and their API endpoints return 403. The API refuses to start if the list contains a typo or disables every method. |
+| `PASSWORD_CHANGE_CONFIRMATION` | No | `email` | How account password changes are confirmed: `email` — a confirmation code is sent to the user's email (requires SMTP); `password` — the user confirms with their current password (works without SMTP, recommended for installs without a mail server). |
 
 ::callout{icon="i-lucide-shield" color="warning"}
 Generate a strong JWT secret: `node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`
@@ -98,6 +109,23 @@ For connecting GitLab repositories.
 | `GITLAB_BASE_URL` | No | `https://gitlab.com` | Override for self-hosted GitLab |
 | `GITLAB_API_URL` | No | `https://gitlab.com/api/v4` | Override for self-hosted GitLab API |
 
+## Messaging Integrations (Telegram / Slack)
+
+For delivering task notifications to messengers. See [Telegram & Slack Setup](/docs/integrations/messaging) for a step-by-step guide.
+
+| Variable | Required | Default | Description |
+|---|---|---|---|
+| `TELEGRAM_BOT_TOKEN` | No | - | Bot token from @BotFather |
+| `TELEGRAM_BOT_USERNAME` | No | - | Bot username without `@` (used to build deep-links) |
+| `TELEGRAM_WEBHOOK_SECRET` | No | - | Secret verified against Telegram's `X-Telegram-Bot-Api-Secret-Token` header on inbound updates |
+| `SLACK_CLIENT_ID` | No | - | Slack app client ID |
+| `SLACK_CLIENT_SECRET` | No | - | Slack app client secret |
+| `SLACK_CALLBACK_URL` | No | - | OAuth callback URL (must match the Slack app redirect URL) |
+| `SLACK_SIGNING_SECRET` | No | - | Slack request signing secret — verifies inbound slash commands / interactivity (`/task`, Done/Assign buttons) |
+| `SLACK_API_BASE_URL` | No | `https://slack.com/api` | Override the Slack Web API base (testing / enterprise proxy) |
+| `SLACK_AUTHORIZE_URL` | No | `https://slack.com/oauth/v2/authorize` | Override the Slack OAuth authorize URL |
+| `SLACK_WEBHOOK_PREFIX` | No | `https://hooks.slack.com/` | Override the incoming-webhook URL prefix (used to detect legacy webhook connections) |
+
 ## Notifications
 
 Optional configuration for real-time and push notification delivery.
@@ -191,6 +219,11 @@ JWT_SIGN="secret"
 ACCESS_LIFE_TIME="3d"
 REFRESH_LIFE_TIME="9d"
 
+# Login methods offered on the login page (unset = all enabled)
+#AUTH_LOGIN_METHODS="magic-link,password,sso,social"
+# Password change confirmation: "email" (code by email, needs SMTP) or "password" (no SMTP needed)
+#PASSWORD_CHANGE_CONFIRMATION="email"
+
 SMTP_HOST=smtp
 SMTP_PORT=587
 SMTP_USERNAME=
@@ -227,6 +260,14 @@ GITLAB_INTEGRATION_CALLBACK_URL=https://api.taskview.tech/module/integrations/oa
 
 ENCRYPTION_KEY=
 
+# Messaging integrations
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_BOT_USERNAME=
+TELEGRAM_WEBHOOK_SECRET=
+# SLACK_CLIENT_ID=
+# SLACK_CLIENT_SECRET=
+# SLACK_SIGNING_SECRET=
+
 # Notifications (optional)
 # FIREBASE_CREDENTIALS_PATH=./firebase-credentials.json
 # CENTRIFUGO_API_URL=http://centrifugo:8000

docs/4.configuration/2.authentication.md

@@ -7,6 +7,21 @@ navigation:
 
 TaskView supports multiple ways to sign in - email/password, email/code, GitHub, Google, and Apple. You can enable whichever methods make sense for your team.
 
+## Choosing login methods
+
+By default the login page offers every method. Use the `AUTH_LOGIN_METHODS` environment variable to offer only the ones you need:
+
+```env
+# Comma-separated list: magic-link, password, sso, social
+AUTH_LOGIN_METHODS="password,sso"
+```
+
+Disabled methods disappear from the login page and their API endpoints return 403 — the setting is enforced server-side, not just hidden in the UI. Google/GitHub/Apple buttons are additionally shown only when the provider is actually configured, so unconfigured providers never render dead buttons.
+
+::callout{icon="i-lucide-shield" color="warning"}
+The API refuses to start if `AUTH_LOGIN_METHODS` contains an unknown value or disables every method — a broken config can't silently lock everyone out.
+::
+
 ## Email and password
 
 This is the default method and works out of the box. Users register with an email and password, and log in the same way (email conformation is required).
@@ -14,10 +29,23 @@ This is the default method and works out of the box. Users register with an emai
 If you have SMTP configured, users will receive a confirmation email after registration. 
 Without SMTP, email confirmation is skipped and accounts should be activated manually.
 
+### Changing your password
+
+Users can set or change their password from **Account settings → Password**. How the change is confirmed depends on the `PASSWORD_CHANGE_CONFIRMATION` environment variable:
+
+- `email` (default) — a confirmation code is sent to the user's email. Requires SMTP.
+- `password` — the user confirms with their current password. No SMTP needed; recommended for installations without a mail server (password login is the only way in there, so every user knows their password).
+
+After a successful change all other sessions are signed out; the current one stays active.
+
 ### Password recovery
 
 Requires SMTP. Users click "Forgot password" on the login screen, enter their email, and receive a reset link. Without SMTP configured, password recovery is not available - you'll need to reset passwords manually in the database.
 
+### The default user (self-hosted)
+
+Fresh installations ship a preinstalled user (`user` / `user1!#Q`). That account gets a dedicated **Login and email** card in Account settings to claim it in one step — set your own login, email and password, confirmed by the current password, no SMTP required. See [Installation → Claim the default account](/docs/getting-started/installation#claim-the-default-account).
+
 ## OAuth providers
 
 TaskView can use external providers for login. This is separate from the integration OAuth (which is for connecting GitHub/GitLab repositories).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskview-ce-monorepo",
-  "version": "1.48.4",
+  "version": "1.50.1",
   "private": true,
   "description": "TaskView CE monorepo containing web, API, and packages",
   "workspaces": [
@@ -44,4 +44,4 @@
     "passport-github2": "^0.1.12",
     "passport-google-oauth20": "^2.0.0"
   }
-}
+}

taskview-packages/capacitor-widget-bridge/.gitignore

@@ -0,0 +1,6 @@
+android/build/
+android/.gradle/
+android/local.properties
+.swiftpm/
+ios/.build/
+DerivedData/

taskview-packages/capacitor-widget-bridge/Package.swift

@@ -0,0 +1,24 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+    name: "CapacitorWidgetBridge",
+    platforms: [.iOS(.v15)],
+    products: [
+        .library(
+            name: "CapacitorWidgetBridge",
+            targets: ["WidgetBridgePlugin"])
+    ],
+    dependencies: [
+        .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", from: "8.0.0")
+    ],
+    targets: [
+        .target(
+            name: "WidgetBridgePlugin",
+            dependencies: [
+                .product(name: "Capacitor", package: "capacitor-swift-pm"),
+                .product(name: "Cordova", package: "capacitor-swift-pm")
+            ],
+            path: "ios/Sources/WidgetBridgePlugin")
+    ]
+)

taskview-packages/capacitor-widget-bridge/android/build.gradle

@@ -0,0 +1,51 @@
+ext {
+    junitVersion = project.hasProperty('junitVersion') ? rootProject.ext.junitVersion : '4.13.2'
+    androidxAppCompatVersion = project.hasProperty('androidxAppCompatVersion') ? rootProject.ext.androidxAppCompatVersion : '1.7.1'
+}
+
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.13.0'
+    }
+}
+
+apply plugin: 'com.android.library'
+
+android {
+    namespace = "tech.taskview.plugins.widgetbridge"
+    compileSdk = project.hasProperty('compileSdkVersion') ? rootProject.ext.compileSdkVersion : 36
+    defaultConfig {
+        minSdkVersion project.hasProperty('minSdkVersion') ? rootProject.ext.minSdkVersion : 24
+        targetSdkVersion project.hasProperty('targetSdkVersion') ? rootProject.ext.targetSdkVersion : 36
+        versionCode 1
+        versionName "1.0"
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+        }
+    }
+    lintOptions {
+        abortOnError = false
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_21
+        targetCompatibility JavaVersion.VERSION_21
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    implementation fileTree(dir: 'libs', include: ['*.jar'])
+    implementation project(':capacitor-android')
+    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+}

taskview-packages/capacitor-widget-bridge/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android" />

taskview-packages/capacitor-widget-bridge/android/src/main/java/tech/taskview/plugins/widgetbridge/WidgetBridgePlugin.java

@@ -0,0 +1,48 @@
+package tech.taskview.plugins.widgetbridge;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.SharedPreferences;
+
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+@CapacitorPlugin(name = "WidgetBridge")
+public class WidgetBridgePlugin extends Plugin {
+
+    public static final String PREFS_NAME = "taskview_widget";
+    public static final String SNAPSHOT_KEY = "widgetSnapshot";
+    public static final String ACTION_WIDGET_UPDATE = "tech.taskview.widget.UPDATE";
+
+    @PluginMethod
+    public void setSnapshot(PluginCall call) {
+        String snapshot = call.getString("snapshot");
+        if (snapshot == null) {
+            call.reject("snapshot is required");
+            return;
+        }
+        prefs().edit().putString(SNAPSHOT_KEY, snapshot).apply();
+        notifyWidgets();
+        call.resolve();
+    }
+
+    @PluginMethod
+    public void clearSnapshot(PluginCall call) {
+        prefs().edit().remove(SNAPSHOT_KEY).apply();
+        notifyWidgets();
+        call.resolve();
+    }
+
+    private SharedPreferences prefs() {
+        return getContext().getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE);
+    }
+
+    private void notifyWidgets() {
+        Context context = getContext();
+        Intent intent = new Intent(ACTION_WIDGET_UPDATE);
+        intent.setPackage(context.getPackageName());
+        context.sendBroadcast(intent);
+    }
+}

taskview-packages/capacitor-widget-bridge/ios/Sources/WidgetBridgePlugin/WidgetBridgePlugin.swift

@@ -0,0 +1,44 @@
+import Foundation
+import Capacitor
+import WidgetKit
+
+@objc(WidgetBridgePlugin)
+public class WidgetBridgePlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "WidgetBridgePlugin"
+    public let jsName = "WidgetBridge"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "setSnapshot", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "clearSnapshot", returnType: CAPPluginReturnPromise)
+    ]
+
+    static let snapshotKey = "widgetSnapshot"
+
+    private var sharedDefaults: UserDefaults? {
+        guard let appGroup = getConfig().getString("appGroup") else { return nil }
+        return UserDefaults(suiteName: appGroup)
+    }
+
+    @objc func setSnapshot(_ call: CAPPluginCall) {
+        guard let snapshot = call.getString("snapshot") else {
+            call.reject("snapshot is required")
+            return
+        }
+        guard let defaults = sharedDefaults else {
+            call.reject("WidgetBridge appGroup is not configured in capacitor.config")
+            return
+        }
+        defaults.set(snapshot, forKey: Self.snapshotKey)
+        WidgetCenter.shared.reloadAllTimelines()
+        call.resolve()
+    }
+
+    @objc func clearSnapshot(_ call: CAPPluginCall) {
+        guard let defaults = sharedDefaults else {
+            call.reject("WidgetBridge appGroup is not configured in capacitor.config")
+            return
+        }
+        defaults.removeObject(forKey: Self.snapshotKey)
+        WidgetCenter.shared.reloadAllTimelines()
+        call.resolve()
+    }
+}

taskview-packages/capacitor-widget-bridge/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "capacitor-widget-bridge",
+  "private": false,
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Capacitor bridge that shares a data snapshot with native home-screen widgets (iOS WidgetKit / Android App Widgets)",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "ios",
+    "android",
+    "Package.swift"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "type-check": "tsc --noEmit"
+  },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    },
+    "android": {
+      "src": "android"
+    }
+  },
+  "peerDependencies": {
+    "@capacitor/core": "^8.0.0"
+  },
+  "devDependencies": {
+    "@capacitor/core": "^8.1.0",
+    "typescript": "~5.8.3"
+  }
+}

taskview-packages/capacitor-widget-bridge/src/definitions.ts

@@ -0,0 +1,32 @@
+export type WidgetSnapshotTask = {
+  id: number
+  title: string
+  priority: 1 | 2 | 3
+  overdue: boolean
+  endTime: string | null
+  endDate: string | null
+  path: string
+}
+
+export type WidgetSnapshotMode = 'today' | 'upcoming'
+
+export type WidgetSnapshot = {
+  v: 3
+  generatedAt: string
+  locale: string
+  orgSlug: string | null
+  mode: WidgetSnapshotMode
+  todayCount: number
+  overdueCount: number
+  upcomingCount: number
+  tasks: WidgetSnapshotTask[]
+}
+
+export type SetSnapshotOptions = {
+  snapshot: string
+}
+
+export type WidgetBridgePlugin = {
+  setSnapshot(options: SetSnapshotOptions): Promise<void>
+  clearSnapshot(): Promise<void>
+}

taskview-packages/capacitor-widget-bridge/src/index.ts

@@ -0,0 +1,12 @@
+import { registerPlugin } from '@capacitor/core'
+import type { WidgetBridgePlugin } from './definitions'
+
+export const WidgetBridge = registerPlugin<WidgetBridgePlugin>('WidgetBridge')
+
+export type {
+  WidgetBridgePlugin,
+  WidgetSnapshot,
+  WidgetSnapshotMode,
+  WidgetSnapshotTask,
+  SetSnapshotOptions,
+} from './definitions'

taskview-packages/capacitor-widget-bridge/tsconfig.json

@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "lib": [
+      "ES2020"
+    ],
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "declaration": true,
+    "declarationMap": true,
+    "outDir": "./dist",
+    "noEmit": false,
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": [
+    "src"
+  ]
+}

taskview-packages/taskview-api/src/api/analytics.types.ts

@@ -23,6 +23,8 @@ export type AnalyticsRange = {
 export type LocalizedText = {
   ru: string
   en: string
+  de?: string
+  es?: string
 }
 
 export type AnalyticsUnit =

taskview-packages/taskview-api/src/api/goals.types.ts

@@ -44,6 +44,7 @@ export type GoalItem = {
     dateCreation: string | null;
     organizationId: number | null;
     estimateUnit: 'hours' | 'points';
+    isInbox: boolean;
 };
 
 export type GoalArgItemAdd = Pick<GoalItem, 'name'> & Partial<Pick<GoalItem, 'description' | 'color' | 'organizationId'>>;

taskview-packages/taskview-api/src/api/messaging.ts

@@ -0,0 +1,81 @@
+import TvApiBase from './base';
+import type { AppResponse } from '@/api/base.types';
+import type {
+    MessagingArgDelete,
+    MessagingArgProjectDelete,
+    MessagingArgProjectToggle,
+    MessagingArgToggle,
+    MessagingConnectLinkResult,
+    MessagingConnectionItem,
+    MessagingProviderId,
+} from './messaging.types';
+
+export default class TvMessagingApi extends TvApiBase {
+    protected moduleUrl = '/module/messaging';
+
+    public async fetch() {
+        return this.request(
+            this.$axios.get<AppResponse<MessagingConnectionItem[]>>(`${this.moduleUrl}`)
+        );
+    }
+
+    public async connectLink(provider: MessagingProviderId) {
+        return this.request(
+            this.$axios.get<AppResponse<MessagingConnectLinkResult>>(`${this.moduleUrl}/${provider}/connect-link`)
+        );
+    }
+
+    public async toggle(data: MessagingArgToggle) {
+        return this.request(
+            this.$axios.patch<AppResponse<MessagingConnectionItem>>(`${this.moduleUrl}/toggle`, data)
+        );
+    }
+
+    public async updateEvents(data: { id: number; events: string[] }) {
+        return this.request(
+            this.$axios.patch<AppResponse<MessagingConnectionItem>>(`${this.moduleUrl}/events`, data)
+        );
+    }
+
+    public async delete(data: MessagingArgDelete) {
+        return this.request(
+            this.$axios.delete<AppResponse<boolean>>(`${this.moduleUrl}`, { data })
+        );
+    }
+
+    public async fetchProject(goalId: number) {
+        return this.request(
+            this.$axios.get<AppResponse<MessagingConnectionItem[]>>(`${this.moduleUrl}/project`, { params: { goalId } })
+        );
+    }
+
+    public async projectConnectLink(provider: MessagingProviderId, goalId: number) {
+        return this.request(
+            this.$axios.get<AppResponse<MessagingConnectLinkResult>>(`${this.moduleUrl}/project/${provider}/connect-link`, { params: { goalId } })
+        );
+    }
+
+    public async toggleProject(data: MessagingArgProjectToggle) {
+        return this.request(
+            this.$axios.patch<AppResponse<MessagingConnectionItem>>(`${this.moduleUrl}/project/toggle`, data)
+        );
+    }
+
+    public async updateProjectEvents(data: { id: number; goalId: number; events: string[] }) {
+        return this.request(
+            this.$axios.patch<AppResponse<MessagingConnectionItem>>(`${this.moduleUrl}/project/events`, data)
+        );
+    }
+
+    public async updateProjectPostContent(data: { id: number; goalId: number; postContent: boolean }) {
+        return this.request(
+            this.$axios.patch<AppResponse<MessagingConnectionItem>>(`${this.moduleUrl}/project/post-content`, data)
+        );
+    }
+
+    public async deleteProject(data: MessagingArgProjectDelete) {
+        return this.request(
+            this.$axios.delete<AppResponse<boolean>>(`${this.moduleUrl}/project`, { data })
+        );
+    }
+}

taskview-packages/taskview-api/src/api/messaging.types.ts

@@ -0,0 +1,79 @@
+export type MessagingProviderId = 'telegram' | 'slack';
+
+export type MessagingOwnerType = 'user' | 'project' | 'organization';
+
+export const MESSAGING_EVENTS = [
+    'task.created',
+    'task.assigned',
+    'task.statusChanged',
+    'task.completed',
+    'task.edited',
+    'task.addedToSprint',
+    'task.deleted',
+    'sprint.created',
+    'sprint.updated',
+    'sprint.started',
+    'sprint.reviewStarted',
+    'sprint.completed',
+    'sprint.paused',
+    'sprint.resumed',
+    'sprint.deleted',
+    'member.added',
+    'member.removed',
+    'member.rolesChanged',
+    'time.started',
+    'time.stopped',
+    'time.logged',
+    'time.updated',
+    'time.deleted',
+    'recurrence.created',
+    'recurrence.updated',
+    'recurrence.paused',
+    'recurrence.resumed',
+    'recurrence.ended',
+    'recurrence.deleted',
+    'recurrence.skipped',
+] as const;
+export type MessagingEvent = typeof MESSAGING_EVENTS[number];
+
+export type MessagingConnectionItem = {
+    id: number;
+    provider: MessagingProviderId;
+    ownerType: MessagingOwnerType;
+    ownerId: number;
+    targetChatId: string;
+    title: string | null;
+    externalTeamId: string | null;
+    events: string[];
+    postContent: boolean;
+    isActive: boolean;
+    createdAt: string | null;
+    updatedAt: string | null;
+};
+
+export type MessagingConnectLinkResult = {
+    provider: MessagingProviderId;
+    url: string;
+    token: string;
+    expiresAt: string;
+};
+
+export type MessagingArgToggle = {
+    id: number;
+    isActive: boolean;
+};
+
+export type MessagingArgDelete = {
+    id: number;
+};
+
+export type MessagingArgProjectToggle = {
+    id: number;
+    goalId: number;
+    isActive: boolean;
+};
+
+export type MessagingArgProjectDelete = {
+    id: number;
+    goalId: number;
+};

taskview-packages/taskview-api/src/api/ui-preferences.types.ts

@@ -7,8 +7,12 @@ export type UiPreferencesItem = {
 
 export type FirstDayOfWeek = 0 | 1 | 2 | 3 | 4 | 5 | 6
 
+export type DefaultView = 'tasks' | 'kanban' | 'graph' | 'sprints'
+
 export type UiSettings = {
   firstDayOfWeek?: FirstDayOfWeek
+  defaultProjectId?: number
+  defaultView?: DefaultView
 }
 
 export const UI_SETTINGS_KEY = '__settings__'

taskview-packages/taskview-api/src/index.ts

@@ -12,6 +12,7 @@ export * from '@/api/kanban.types';
 export * from '@/api/integrations.types';
 export * from '@/api/notifications.api.types';
 export * from '@/api/webhooks.types';
+export * from '@/api/messaging.types';
 export * from '@/api/api-tokens.types';
 export * from '@/api/sessions.types';
 export * from '@/api/organizations.types';

taskview-packages/taskview-api/src/tv.ts

@@ -9,6 +9,7 @@ import TvIntegrationsApi from "./api/integrations";
 import TvKanban from "./api/kanban";
 import TvNotificationsApi from "./api/notifications";
 import TvWebhooks from "./api/webhooks";
+import TvMessagingApi from "./api/messaging";
 import TvApiTokens from "./api/api-tokens";
 import TvSessions from "./api/sessions";
 import TvOrganizationsApi from "./api/organizations";
@@ -43,6 +44,8 @@ export class TvApi {
 
     public webhooks: TvWebhooks;
 
+    public messaging: TvMessagingApi;
+
     public apiTokens: TvApiTokens;
 
     public sessions: TvSessions;
@@ -84,6 +87,8 @@ export class TvApi {
 
         this.webhooks = new TvWebhooks(this.$axios);
 
+        this.messaging = new TvMessagingApi(this.$axios);
+
         this.apiTokens = new TvApiTokens(this.$axios);
 
         this.sessions = new TvSessions(this.$axios);

taskview-packages/taskview-db-schemas/src/index.ts

@@ -13,6 +13,7 @@ export * from './schemas/notifications.schema';
 export * from './schemas/device-tokens.schema';
 export * from './schemas/notification-preferences.schema';
 export * from './schemas/webhooks.schema';
+export * from './schemas/messaging.schema';
 export * from './schemas/api-tokens.schema';
 export * from './schemas/user-tokens.schema';
 export * from './schemas/organizations.schema';

taskview-packages/taskview-db-schemas/src/schemas/collaboration-users.schema.ts

@@ -1,4 +1,4 @@
-import { integer, pgSchema, time, varchar } from "drizzle-orm/pg-core";
+import { integer, pgSchema, time, uniqueIndex, varchar } from "drizzle-orm/pg-core";
 import { GoalsSchema } from "./goals.schema";
 import { PermissionsSchema } from "./users.schema";
 
@@ -26,7 +26,9 @@ export const CollaborationPermissionsToRoleSchema = pgSchema('collaboration').ta
 export const CollaborationUsersToGoalsSchema = pgSchema('collaboration').table('users_to_goals', {
     userId: integer('user_id').notNull().references(() => CollaborationUsersSchema.id, { onDelete: 'cascade' }),
     goalId: integer('goal_id').notNull().references(() => GoalsSchema.id, { onDelete: 'cascade' }),
-});
+}, (table) => [
+    uniqueIndex('users_to_goals_user_goal_uidx').on(table.userId, table.goalId),
+]);
 
 export const CollaborationUsersToRolesSchema = pgSchema('collaboration').table('users_to_roles', {
     userId: integer('user_id').notNull().references(() => CollaborationUsersSchema.id, { onDelete: 'cascade' }),

taskview-packages/taskview-db-schemas/src/schemas/goals.schema.ts

@@ -1,4 +1,4 @@
-import { integer, pgSchema, timestamp, varchar } from "drizzle-orm/pg-core";
+import { boolean, integer, pgSchema, timestamp, varchar } from "drizzle-orm/pg-core";
 import { UsersSchema } from "./users.schema";
 import { OrganizationsSchema } from "./organizations.schema";
 // import { createInsertSchema, createSelectSchema } from "drizzle-arktype";
@@ -16,6 +16,7 @@ export const GoalsSchema = pgSchema('tasks').table('goals', {
     backlogVersion: integer('backlog_version').default(1),
     organizationId: integer('organization_id').references(() => OrganizationsSchema.id, { onDelete: 'cascade' }),
     estimateUnit: varchar('estimate_unit', { length: 10 }).$type<'hours' | 'points'>().notNull().default('points'),
+    isInbox: boolean('is_inbox').notNull().default(false),
 });
 
 export type GoalsSchemaTypeForSelect = typeof GoalsSchema.$inferSelect;

taskview-packages/taskview-db-schemas/src/schemas/messaging.schema.ts

@@ -0,0 +1,58 @@
+import { boolean, integer, pgSchema, timestamp, uniqueIndex, varchar } from "drizzle-orm/pg-core";
+import { UsersSchema } from "./users.schema";
+
+export const MessagingConnectionsSchema = pgSchema('tasks').table('messaging_connections', {
+    id: integer().primaryKey().generatedAlwaysAsIdentity(),
+    provider: varchar({ length: 20 }).notNull(),
+    ownerType: varchar('owner_type', { length: 20 }).notNull(),
+    ownerId: integer('owner_id').notNull(),
+    targetChatId: varchar('target_chat_id', { length: 255 }).notNull(),
+    title: varchar({ length: 255 }),
+    externalTeamId: varchar('external_team_id', { length: 255 }),
+    accessTokenEncrypted: varchar('access_token_encrypted'),
+    events: varchar().array().notNull().default(['task.created', 'task.assigned', 'task.statusChanged', 'task.completed']),
+    // Project channels only: whether to include the RBAC-gated task description in the
+    // channel message. Default on — a channel is a deliberate broadcast; owners who care
+    // about COMPONENT_CAN_WATCH_CONTENT turn it off. Personal DMs always gate per-recipient.
+    postContent: boolean('post_content').notNull().default(true),
+    isActive: boolean('is_active').notNull().default(true),
+    createdAt: timestamp('created_at').defaultNow(),
+    updatedAt: timestamp('updated_at').defaultNow(),
+}, (table) => [
+    uniqueIndex('messaging_connection_unique').on(table.provider, table.ownerType, table.ownerId, table.targetChatId),
+]);
+
+// Pending binding intent for any owner (user / project / organization). A user
+// generates a token in TaskView, then redeems it from the messenger (deep-link
+// for personal, /connect in a group for project). Consumed on redemption.
+export const MessagingLinkTokensSchema = pgSchema('tasks').table('messaging_link_tokens', {
+    id: integer().primaryKey().generatedAlwaysAsIdentity(),
+    token: varchar({ length: 128 }).notNull().unique(),
+    provider: varchar({ length: 20 }).notNull(),
+    ownerType: varchar('owner_type', { length: 20 }).notNull(),
+    ownerId: integer('owner_id').notNull(),
+    createdBy: integer('created_by').notNull().references(() => UsersSchema.id, { onDelete: 'cascade' }),
+    expiresAt: timestamp('expires_at').notNull(),
+    createdAt: timestamp('created_at').defaultNow(),
+});
+
+// Pure identity: which external account belongs to which TaskView user. Populated
+// when a personal connection is bound; reused later to resolve inbound commands.
+export const MessagingIdentityMapSchema = pgSchema('tasks').table('messaging_identity_map', {
+    id: integer().primaryKey().generatedAlwaysAsIdentity(),
+    userId: integer('user_id').notNull().references(() => UsersSchema.id, { onDelete: 'cascade' }),
+    provider: varchar({ length: 20 }).notNull(),
+    externalUserId: varchar('external_user_id', { length: 255 }),
+    // Slack user IDs are unique only WITHIN a workspace, so identity must be keyed by
+    // (provider, team, user). Null for Telegram, whose user IDs are globally unique.
+    externalTeamId: varchar('external_team_id', { length: 255 }),
+    linkedAt: timestamp('linked_at'),
+    createdAt: timestamp('created_at').defaultNow(),
+}, (table) => [
+    uniqueIndex('messaging_identity_unique').on(table.userId, table.provider),
+]);
+
+export type MessagingConnectionsSchemaTypeForSelect = typeof MessagingConnectionsSchema.$inferSelect;
+export type MessagingConnectionsSchemaTypeForInsert = typeof MessagingConnectionsSchema.$inferInsert;
+export type MessagingLinkTokensSchemaTypeForSelect = typeof MessagingLinkTokensSchema.$inferSelect;
+export type MessagingIdentityMapSchemaTypeForSelect = typeof MessagingIdentityMapSchema.$inferSelect;

taskview-plugin/.claude-plugin/plugin.json

@@ -0,0 +1,24 @@
+{
+  "name": "taskview",
+  "displayName": "TaskView",
+  "version": "0.1.0",
+  "description": "Manage TaskView projects and tasks from Claude Code — browse projects, view and create tasks, and log your work without leaving the terminal. Bundles the TaskView MCP server.",
+  "author": {
+    "name": "Nikolai Giman"
+  },
+  "userConfig": {
+    "taskview_url": {
+      "type": "string",
+      "title": "TaskView API URL",
+      "description": "TaskView Cloud is https://api.taskview.tech — or your own self-hosted instance URL (e.g. https://taskview.yourcompany.com).",
+      "required": true
+    },
+    "taskview_token": {
+      "type": "string",
+      "title": "TaskView API token",
+      "description": "An API token (tvk_...) generated in your TaskView account settings. Scope it to the minimum permissions and projects the assistant should be able to reach.",
+      "sensitive": true,
+      "required": true
+    }
+  }
+}

taskview-plugin/.mcp.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "taskview": {
+      "command": "npx",
+      "args": ["-y", "taskview-mcp"],
+      "env": {
+        "TASKVIEW_URL": "${user_config.taskview_url}",
+        "TASKVIEW_TOKEN": "${user_config.taskview_token}"
+      }
+    }
+  }
+}

taskview-plugin/README.md

@@ -0,0 +1,38 @@
+# TaskView plugin for Claude Code
+
+Browse and manage your [TaskView](https://taskview.tech) projects and tasks directly from Claude Code. The plugin bundles the [`taskview-mcp`](https://www.npmjs.com/package/taskview-mcp) server plus skills and slash commands, so setup is just "install and paste a token" — no manual config editing.
+
+## What you get
+
+- **Bundled MCP server** — the full TaskView tool surface (projects, lists, tasks, tags, kanban, collaboration, dependencies, notifications), no separate install.
+- **Slash commands:**
+  - `/taskview-projects` — list your projects
+  - `/taskview-tasks [project]` — show tasks in a project
+  - `/taskview-new-task <description>` — create a task
+  - `/taskview-log [project]` — log the work done this session as a task
+- **Skill** — conventions so the assistant resolves ids correctly, paginates, and logs completed work as top-level tasks.
+
+## Requirements
+
+- Node.js >= 24 (the bundled MCP server runs via `npx`)
+- A TaskView API token (`tvk_...`) from your account settings — see [API tokens](https://taskview.tech/docs/features/api-tokens)
+
+## Install
+
+```text
+/plugin marketplace add Gimanh/taskview-community
+/plugin install taskview@taskview
+```
+
+On install you'll be prompted for two values:
+
+| Setting | Example | Notes |
+|---|---|---|
+| **TaskView API URL** | `https://api.taskview.tech` | TaskView Cloud, or your self-hosted instance URL |
+| **TaskView API token** | `tvk_...` | Stored securely in your system keychain. Scope it to the minimum permissions/projects needed. |
+
+That's it — the `taskview` MCP server and the commands become available after the plugin is enabled.
+
+## Security
+
+The token is supplied via the plugin's secure `userConfig` (marked sensitive → stored in the OS keychain, not in plaintext settings) and passed to the MCP server only as an environment variable. Every tool call still goes through the full TaskView API stack — authentication, permission checks, and token-scope intersection. Give the token only the scope the assistant should have.

taskview-plugin/commands/taskview-log.md

@@ -0,0 +1,13 @@
+---
+description: Log the work done in this session as a TaskView task
+---
+
+Record what was accomplished in the current Claude Code session as a TaskView task, using the `taskview` MCP tools.
+
+1. Summarize the concrete work completed in this session in 1–3 short lines.
+2. Ask the user which project to log it under (or use the one they name in $ARGUMENTS), and resolve its id with `list_goals`.
+3. Create **one top-level task** with `create_task` — description = the summary. Set priority/deadline only if the user asks.
+4. Show the created task and ask whether to break it into subtasks or add tags.
+5. Add task note if needed.
+
+Confirm the project before creating. Do not create the task in a guessed project, and do not create duplicates — check `list_tasks` if unsure.

taskview-plugin/commands/taskview-new-task.md

@@ -0,0 +1,14 @@
+---
+description: Create a task in TaskView
+---
+
+Create a TaskView task using the `taskview` MCP tools.
+
+Request: $ARGUMENTS
+
+1. Parse the request for: task description, target project, optional list, priority (1=low, 2=medium, 3=high), and deadline.
+2. Resolve the project id with `list_goals` (and the list id with `list_lists` if a list is named). If the project is missing or ambiguous, ask — do not guess.
+3. Call `create_task` with the resolved ids and parsed fields.
+4. Confirm what was created (project, description, priority, deadline) and offer to add tags or assignees.
+
+Never create a task in a guessed/unconfirmed project.

taskview-plugin/commands/taskview-projects.md

@@ -0,0 +1,11 @@
+---
+description: List your TaskView projects (goals)
+---
+
+List the user's TaskView projects using the `taskview` MCP tools.
+
+1. If the user has more than one organization, resolve it with `list_organizations` and ask which one if unclear.
+2. Call `list_goals` and present the projects as a short list: name, and a hint of activity if available.
+3. Offer next actions — e.g. "view tasks in a project" (`/taskview-tasks`) or "create a task" (`/taskview-new-task`).
+
+Do not invent project names or ids — only show what the tools return.

taskview-plugin/commands/taskview-tasks.md

@@ -0,0 +1,14 @@
+---
+description: Show tasks in a TaskView project
+---
+
+Show the user's TaskView tasks using the `taskview` MCP tools.
+
+Arguments (optional): a project name to scope to — $ARGUMENTS
+
+1. Resolve the project: call `list_goals` and match $ARGUMENTS to a project. If empty or ambiguous, ask which project.
+2. Optionally scope to a list with `list_lists` + the `componentId` if the user names one.
+3. Call `list_tasks` (0-based `page`, ~30/page) — page through until a page returns fewer than 30. Pass `showCompleted` only if the user wants completed tasks. Use `sortBy` with `descending` when ordering by date or priority.
+4. Present a concise checklist: status, description, priority (1=low/2=med/3=high), deadline.
+
+Resolve every id first — never guess project/list ids.

taskview-plugin/skills/taskview/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: taskview
+description: Conventions for browsing and managing TaskView projects, lists, and tasks through the bundled taskview MCP tools
+---
+
+# Working with TaskView
+
+This plugin connects Claude Code to a TaskView instance through the `taskview`
+MCP server. Use it to let the user view and manage their work without leaving
+the terminal.
+
+## Terminology
+
+- A **goal** IS a **project** — the words are interchangeable. Every tool/param
+  that says "goal" (`goalId`, `list_goals`, `create_goal`) means a project. When
+  the user says "project", use the `*_goal` tools.
+
+## Data model (top → bottom)
+
+- **Organization** — workspace grouping projects and members.
+- **Project (goal)** — `goalId`; `list_goals` / `create_goal` / `update_goal`.
+- **List (component)** — a section inside a project; pass `componentId` to
+  `list_tasks` to scope to one list, omit it to see all tasks.
+- **Task** — unit of work; supports subtasks, assignees, tags, priority
+  (1=low, 2=medium, 3=high), deadlines, and dependencies.
+
+## Rules that prevent mistakes
+
+- **Resolve IDs first, never guess them.** Map a name to its numeric id with the
+  matching `list_*` tool (project → `list_goals`, list → `list_lists`,
+  members → `list_collaborators_for_goal`, columns → `list_kanban_columns`,
+  tags → `list_tags`), then pass that id to create/update/delete tools.
+- **`list_tasks` is paginated** — `page` is 0-based (~30/page). Keep requesting
+  the next page until one returns fewer than 30. Completed tasks are hidden
+  unless `showCompleted` is set. Use `sortBy` (`date` | `priority`) with
+  `descending` to order.
+- **Ask before destructive actions** (`delete_*`) and before creating duplicates
+  — check with a `list_*` call first.
+
+## Presenting results
+
+- Show tasks as a concise checklist: status, description, priority, deadline.
+- When something is ambiguous (which project/list/org), ask one short question
+  rather than guessing.
+
+## Logging completed work
+
+When the user asks to record what was done, create **one top-level task per
+finished unit of work** in the relevant project (resolve it first), with a clear
+description and, if known, the list and priority. Do not bury the summary as a
+subtask unless the user asks for that.

web/android/app/build.gradle

@@ -7,8 +7,8 @@ android {
         applicationId "com.handscreamgnl.taskview.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 14801
-        versionName "1.48.1"
+        versionCode 14902
+        versionName "1.49.2"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

web/android/app/capacitor.build.gradle

@@ -17,6 +17,7 @@ dependencies {
     implementation project(':capacitor-push-notifications')
     implementation project(':capacitor-splash-screen')
     implementation project(':capgo-capacitor-updater')
+    implementation project(':capacitor-widget-bridge')
 
 }
 

web/android/app/src/main/AndroidManifest.xml

@@ -29,6 +29,24 @@
 
         </activity>
 
+        <receiver
+            android:name=".widget.TodayWidgetProvider"
+            android:exported="false"
+            android:label="@string/widget_today_title">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+                <action android:name="tech.taskview.widget.UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/widget_today_info" />
+        </receiver>
+
+        <service
+            android:name=".widget.TodayWidgetService"
+            android:permission="android.permission.BIND_REMOTEVIEWS"
+            android:exported="false" />
+
         <provider
             android:name="androidx.core.content.FileProvider"
             android:authorities="${applicationId}.fileprovider"

web/android/app/src/main/java/com/handscream/taskview/app/widget/TodayWidgetFactory.java

@@ -0,0 +1,141 @@
+package com.handscream.taskview.app.widget;
+
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import android.view.View;
+import android.widget.RemoteViews;
+import android.widget.RemoteViewsService;
+
+import com.handscream.taskview.app.R;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import tech.taskview.plugins.widgetbridge.WidgetBridgePlugin;
+
+public class TodayWidgetFactory implements RemoteViewsService.RemoteViewsFactory {
+
+    private final Context context;
+    private final List<JSONObject> tasks = new ArrayList<>();
+    private boolean upcoming = false;
+
+    public TodayWidgetFactory(Context context) {
+        this.context = context;
+    }
+
+    @Override
+    public void onCreate() {
+    }
+
+    @Override
+    public void onDataSetChanged() {
+        tasks.clear();
+        upcoming = false;
+        String snapshot = context
+                .getSharedPreferences(WidgetBridgePlugin.PREFS_NAME, Context.MODE_PRIVATE)
+                .getString(WidgetBridgePlugin.SNAPSHOT_KEY, null);
+        if (snapshot == null) return;
+        try {
+            JSONObject parsed = new JSONObject(snapshot);
+            upcoming = "upcoming".equals(parsed.optString("mode"));
+            JSONArray items = parsed.optJSONArray("tasks");
+            if (items == null) return;
+            for (int i = 0; i < items.length(); i++) {
+                JSONObject task = items.optJSONObject(i);
+                if (task != null) tasks.add(task);
+            }
+        } catch (JSONException ignored) {
+        }
+    }
+
+    @Override
+    public void onDestroy() {
+        tasks.clear();
+    }
+
+    @Override
+    public int getCount() {
+        return tasks.size();
+    }
+
+    @Override
+    public RemoteViews getViewAt(int position) {
+        JSONObject task = tasks.get(position);
+        RemoteViews row = new RemoteViews(context.getPackageName(), R.layout.widget_today_item);
+
+        row.setTextViewText(R.id.widget_item_title, task.optString("title"));
+        row.setImageViewResource(R.id.widget_item_checkbox, priorityCheckbox(task.optInt("priority", 1)));
+
+        boolean overdue = !upcoming && task.optBoolean("overdue", false);
+        String meta = upcoming
+                ? formatEndDate(task)
+                : (overdue ? context.getString(R.string.widget_overdue) : formatEndTime(task));
+        if (meta == null || meta.isEmpty()) {
+            row.setViewVisibility(R.id.widget_item_meta, View.GONE);
+        } else {
+            row.setViewVisibility(R.id.widget_item_meta, View.VISIBLE);
+            row.setTextViewText(R.id.widget_item_meta, meta);
+            row.setTextColor(
+                    R.id.widget_item_meta,
+                    context.getColor(overdue ? R.color.widget_overdue : R.color.widget_text_secondary));
+        }
+
+        Intent fillIn = new Intent();
+        String path = task.optString("path", "");
+        if (!path.isEmpty()) {
+            fillIn.setData(Uri.parse("taskview://open?path=" + Uri.encode(path)));
+        }
+        row.setOnClickFillInIntent(R.id.widget_item_root, fillIn);
+
+        return row;
+    }
+
+    private int priorityCheckbox(int priority) {
+        switch (priority) {
+            case 3:
+                return R.drawable.widget_checkbox_high;
+            case 2:
+                return R.drawable.widget_checkbox_medium;
+            default:
+                return R.drawable.widget_checkbox_low;
+        }
+    }
+
+    private String formatEndTime(JSONObject task) {
+        if (task.isNull("endTime")) return null;
+        String endTime = task.optString("endTime", "");
+        return endTime.length() >= 5 ? endTime.substring(0, 5) : endTime;
+    }
+
+    private String formatEndDate(JSONObject task) {
+        if (task.isNull("endDate")) return null;
+        String endDate = task.optString("endDate", "");
+        String[] parts = endDate.split("-");
+        return parts.length == 3 ? parts[2] + "." + parts[1] : endDate;
+    }
+
+    @Override
+    public RemoteViews getLoadingView() {
+        return null;
+    }
+
+    @Override
+    public int getViewTypeCount() {
+        return 1;
+    }
+
+    @Override
+    public long getItemId(int position) {
+        return tasks.get(position).optLong("id", position);
+    }
+
+    @Override
+    public boolean hasStableIds() {
+        return true;
+    }
+}

web/android/app/src/main/java/com/handscream/taskview/app/widget/TodayWidgetProvider.java

@@ -0,0 +1,90 @@
+package com.handscream.taskview.app.widget;
+
+import android.app.PendingIntent;
+import android.appwidget.AppWidgetManager;
+import android.appwidget.AppWidgetProvider;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import android.widget.RemoteViews;
+
+import com.handscream.taskview.app.MainActivity;
+import com.handscream.taskview.app.R;
+
+import org.json.JSONObject;
+
+import tech.taskview.plugins.widgetbridge.WidgetBridgePlugin;
+
+public class TodayWidgetProvider extends AppWidgetProvider {
+
+    @Override
+    public void onUpdate(Context context, AppWidgetManager manager, int[] appWidgetIds) {
+        for (int appWidgetId : appWidgetIds) {
+            manager.updateAppWidget(appWidgetId, buildViews(context, appWidgetId));
+        }
+    }
+
+    @Override
+    public void onReceive(Context context, Intent intent) {
+        super.onReceive(context, intent);
+        if (WidgetBridgePlugin.ACTION_WIDGET_UPDATE.equals(intent.getAction())) {
+            AppWidgetManager manager = AppWidgetManager.getInstance(context);
+            int[] ids = manager.getAppWidgetIds(new ComponentName(context, TodayWidgetProvider.class));
+            if (ids.length == 0) return;
+            manager.notifyAppWidgetViewDataChanged(ids, R.id.widget_today_list);
+            onUpdate(context, manager, ids);
+        }
+    }
+
+    private RemoteViews buildViews(Context context, int appWidgetId) {
+        RemoteViews views = new RemoteViews(context.getPackageName(), R.layout.widget_today);
+
+        JSONObject snapshot = readSnapshot(context);
+        boolean upcoming = snapshot != null && "upcoming".equals(snapshot.optString("mode"));
+        int count = snapshot == null
+                ? 0
+                : (upcoming ? snapshot.optInt("upcomingCount", 0) : snapshot.optInt("todayCount", 0));
+        views.setTextViewText(
+                R.id.widget_today_title,
+                context.getString(upcoming ? R.string.widget_upcoming_title : R.string.widget_today_title));
+        views.setTextViewText(R.id.widget_today_count, String.valueOf(count));
+
+        Intent adapter = new Intent(context, TodayWidgetService.class);
+        adapter.putExtra(AppWidgetManager.EXTRA_APPWIDGET_ID, appWidgetId);
+        adapter.setData(Uri.parse(adapter.toUri(Intent.URI_INTENT_SCHEME)));
+        views.setRemoteAdapter(R.id.widget_today_list, adapter);
+        views.setEmptyView(R.id.widget_today_list, R.id.widget_today_empty);
+
+        PendingIntent openApp = PendingIntent.getActivity(
+                context,
+                0,
+                new Intent(context, MainActivity.class),
+                PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_IMMUTABLE);
+        views.setOnClickPendingIntent(R.id.widget_today_header, openApp);
+        views.setOnClickPendingIntent(R.id.widget_today_empty, openApp);
+
+        Intent template = new Intent(context, MainActivity.class);
+        template.setAction(Intent.ACTION_VIEW);
+        PendingIntent templateIntent = PendingIntent.getActivity(
+                context,
+                1,
+                template,
+                PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE);
+        views.setPendingIntentTemplate(R.id.widget_today_list, templateIntent);
+
+        return views;
+    }
+
+    private JSONObject readSnapshot(Context context) {
+        String snapshot = context
+                .getSharedPreferences(WidgetBridgePlugin.PREFS_NAME, Context.MODE_PRIVATE)
+                .getString(WidgetBridgePlugin.SNAPSHOT_KEY, null);
+        if (snapshot == null) return null;
+        try {
+            return new JSONObject(snapshot);
+        } catch (Exception e) {
+            return null;
+        }
+    }
+}

web/android/app/src/main/java/com/handscream/taskview/app/widget/TodayWidgetService.java

@@ -0,0 +1,12 @@
+package com.handscream.taskview.app.widget;
+
+import android.content.Intent;
+import android.widget.RemoteViewsService;
+
+public class TodayWidgetService extends RemoteViewsService {
+
+    @Override
+    public RemoteViewsFactory onGetViewFactory(Intent intent) {
+        return new TodayWidgetFactory(getApplicationContext());
+    }
+}